marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-22 06:29:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(m3): PHP still not established; blocker is the dataflow execution pass

Browse Source 
Retried the PMPro transfer with batch splitting, a 4500-second deadline and a
900-second query ceiling. Stopped after 26 minutes with no case completed and no
verdict, so PHP transfer remains unestablished.

A probe narrowed the cause and corrected my earlier reading of it. The evidence
pass answers all 4,425 PMPro PHP regions in ONE batch in 29.7 seconds with a 681 KB
response, exit 0, and its cost is fixed rather than per request: one request took
40.2 s and 4,425 took 29.7 s. Neither request count nor response size is anywhere
near a limit, so batch size and serialization are not the cause as I first supposed
from a single extrapolated data point.

What fails is the execution pass, which runs reachableByFlows per candidate.

The probe's own scope is recorded with it: it sent evidenceOnly=true and therefore
measured the structural pass, not the failing one. Those numbers would otherwise
read as evidence that PMPro's taint work is cheap, which they are not.

Splitting stays, because it is correct on its own terms and recovers a batch that
fails whole. It is worth noting it also makes an unrecoverable batch slower to
abandon, since each of the eight parts burns its own share of the query ceiling.

M3 remains two of three: Node established in M1b, Python established, PHP blocked
on dataflow cost for a 1,274-file repository.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-09-18 13:22:05 +02:00
co-authored by Claude Opus 5
parent aa66429a82
commit 537483657d
4 changed files with 102 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/specs/pre-push-safety-net/release-milestones.md
+9 -5
View File
@@ -144,11 +144,15 @@ zero admitted defects. That includes the SQL injection this spec names as previo
and both broken-object-level-authorization targets, which is the first time access control has
answered on Python at all.
PHP: not established. All three PMPro comparisons exhausted a 3000-second deadline with a
1200-second query ceiling and produced no artifact, so there is no target evidence. The taint
batch fails on the 1,274-file tree, first with an engine exception and then by timeout. The pins,
receipts and declared target are correct, so this is a runtime blocker on a large repository
rather than evidence about whether the design transfers.
PHP: not established, and the blocker is now named. All PMPro comparisons exhausted every budget
tried, up to a 4500-second deadline with a 900-second query ceiling, and produced no artifact, so
there is no target evidence. Splitting a failed batch into parts did not rescue it.
A probe narrowed the cause: the evidence pass answers all 4,425 PMPro regions in one batch in
29.7 seconds with a 681 KB response, and its cost is fixed rather than per request. Neither
request count nor response size is anywhere near a limit. What fails is the execution pass, which
runs `reachableByFlows` per candidate. The pins, receipts and declared target are correct, so the
question is being asked properly and the dataflow work is what cannot finish.
The exit asks for Node, PHP and Python together. Two of three are in hand.