marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-19 21:19:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: plain-English pass over the active specs

Browse Source 
Ran the humanizer rules over 79 prose files in the active specs (brief,
design, requirements, research and narrative docs). Removed em dashes,
significance inflation, forced rule-of-three, bold-label list items and
filler. Skipped tasks.md checklists and the retired specs (harnessx-*,
openrouter-sast-harness, unseen-repo-evaluation).

Every number, path, command, hash and identifier was preserved: checked
each file against HEAD for drift in numbers, inline code and code fences,
zero drift across all 79 files.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-12 18:16:41 +02:00
co-authored by Claude Opus 4.8
parent b08f372022
commit 39a1873e5b
79 changed files with 1103 additions and 1103 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/specs/mcp-shift-left-agent/brief.md
+6 -6
View File
@@ -8,8 +8,8 @@ skills. Related: `proof-arm-opencode` (the proof model), `pre-push-safety-net`
## Motivation
The pre-push hook is the gate. Developers and their coding agents want the same
security feedback **earlier**, while the code is still being written, not only at
push. And in an agent-driven workflow, a mandatory security check is how a human
security feedback **earlier**, while the code is still being written, before
push. In an agent-driven workflow, a mandatory security check is how a human
oversees agents: the agent's output has to clear it before it ships.
Proposal: expose the safety net through an MCP agent and a small set of skills so
@@ -19,20 +19,20 @@ proposes a push.
## Shape
- **Transport:** extend the existing narrow MCP server (`ousast mcp`, stdio) that
- Transport: extend the existing narrow MCP server (`ousast mcp`, stdio) that
OpenCode and other agents already speak. No new network surface; same
no-secret, bounded contract.
- **What the agent offers:**
- What the agent offers:
1. Scan the current diff with the static arm (fast, no model, no cluster) and
return findings scoped to the change, with location and a concrete repair
direction, not a confidence label.
2. Triage a finding: explain it in plain terms and whether it is reachable.
3. Prove on demand: hand the top candidate to the proof arm when a runnable
harness exists, and return the demonstrated proof-of-concept.
- **Skills:** the existing `openultrasast-scan` and `openultrasast-triage`
- Skills: the existing `openultrasast-scan` and `openultrasast-triage`
product skills, plus shift-left additions (scan-the-diff, explain-a-finding,
suggest-a-fix-direction) that a coding agent invokes mid-task.
- **Oversight mode:** a coding agent can be configured to call the scan as a
- Oversight mode: a coding agent can be configured to call the scan as a
required step before it finalizes a change, so security review is automatic
rather than remembered.