marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-20 21:49:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

spec(pre-push-safety-net): amend the sequence and declare the shippable scope

Browse Source 
Four decisions, recorded after the family detection census and the PHP correction. They change
sequence and declared scope; they change no acceptance threshold and no owner boundary.

Close M3 at a scale whose questions complete, before anything else. The not-established PHP record
came from two instrument defects rather than from the analyser, and bounded to 25 and 100 regions
PMPro completes with no timeout and establishes a true-positive SQL injection. Tasks 13.3 and 13.4
carry the replay and the question-completion gap, the second because admission reads outcomes and
M4 measures completion at 95 percent.

Reserve the untouched M4 population now, in parallel. M4 already permits preparation before the
frozen candidate exists and it is the longest lead-time item on the path. Task 15.1.

M2 is the only engineering item left and cannot be scoped away: a changed-code transaction spends
its whole budget in the build, and meeting the latency gate by analysing less is explicitly not
the same result.

Declare the v1 advisory scope as the families whose claims can be ADMITTED, which requires the
entailed rung: injection, untrusted destination and configuration. Access control is excluded
because on an application that splits route from data access the obligation is carried and a
carried obligation corroborates by design, so the family would ship as silence. Task 15.2.

The risk the amendment does not remove is stated with it: every number so far comes from subjects
used to build the analyser, one week of examining two of them surfaced seven false positives, and
the first independent evaluation should be expected to fail.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-09-21 10:41:25 +02:00
co-authored by Claude Opus 5
parent 1f51c82b51
commit 5b7288aa58
3 changed files with 98 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/specs/pre-push-safety-net/status.md
+15
View File
@@ -223,3 +223,18 @@ Evidence: [family detection census](../../../benchmarks/measurements/2026-09-19-
[every permissive setting](../../../benchmarks/measurements/2026-09-20-every-permissive-setting.json),
[PHP runtime after the graph fix](../../../benchmarks/measurements/2026-09-20-php-runtime-after-graph-fix.json),
[PHP detection corrected](../../../benchmarks/measurements/2026-09-20-php-detection-corrected.json).
## Strategy, 2026-09-21
Sequence amended after the family census and the PHP correction: close M3 at a completing scale
first (task 13.3), fix PHP question completion because admission reads outcomes (13.4), reserve
the untouched M4 population in parallel starting now (15.1), and give the remaining engineering to
M2 graph reuse, which cannot be scoped away because meeting the latency gate by analysing less is
explicitly not the same result. The v1 advisory scope is declared as the families whose claims can
be admitted at the entailed rung (15.2): injection, untrusted destination and configuration.
Access control is excluded because a carried obligation corroborates by design and would ship as
silence.
No acceptance threshold and no owner boundary changes. The risk that remains is that every number
so far comes from subjects used to build the analyser, and one week of examining two of them
surfaced seven false positives; the first independent evaluation should be expected to fail.