marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(harnessx): Phase 3 task 5.2 — SHA-pinned optional extra + capability guard

Browse Source 
Wire HarnessX as an optional, SHA-pinned extra with a lazy capability guard,
keeping the core install zero-dependency.

- pyproject: add [project.optional-dependencies] harnessx pinned to commit
  274c512 (Darwin-Agent/HarnessX). Core dependencies stays []. uv_build emits
  `Requires-Dist: harnessx @ git+...@<sha> ; extra == 'harnessx'` +
  `Provides-Extra: harnessx` (verified via uv build); release ships to GitHub
  Releases, not PyPI, so the direct-reference is fine.
- harness_ext.py: the capability seam. has_harnessx() probes via find_spec
  (never imports harnessx); require_harnessx() imports lazily on demand and
  raises HarnessXUnavailableError with install guidance when absent. Every
  Phase 3+ HarnessX path routes through here so heavy imports stay cold by default.
- uv.lock refreshed: the universal lock now resolves the harnessx tree (149 pkgs)
  but `uv sync --group dev` installs only 57 — harnessx is NOT importable in the
  default/CI venv (verified), so CI stays lean and never re-locks.
- Tests: core deps empty; the extra is a 40-hex SHA-pinned git URL; importing
  openultrasast.cli does not import harnessx; has_harnessx probes without
  importing; require_harnessx raises with guidance when absent.

98 tests pass; ruff + mypy clean; detection gate 93.6%/0% intact. Spec task 5
(5.1 + 5.2) checked off; next is task 6 (build_sast hunter sub-harness).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-06-22 16:08:43 +02:00
co-authored by Claude Opus 4.8
parent 97da477424
commit 5e206df166
6 changed files with 2616 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pyproject.toml
+11
View File
@@ -10,6 +10,17 @@ readme = "README.md"
requires-python = ">=3.11"
dependencies = []
[project.optional-dependencies]
# HarnessX is the optional agentic plane (LLM hunter/verifier + self-improvement).
# SHA-pinned for reproducibility; the heavy transitive footprint (see
# .kiro/specs/harnessx-self-improving-rulesets/dependency-audit.md) lands ONLY when
# this extra is installed. The core install stays zero-dependency and every HarnessX
# import is guarded by openultrasast.harness_ext (lazy). pip does not pull the
# recipe/verl_harnessX submodule (it is outside the packaged harnessx* modules).
harnessx = [
"harnessx @ git+https://github.com/Darwin-Agent/HarnessX.git@274c512eea67c64701f992d3b6fe06f0fd590ef0",
]
[project.scripts]
ousast = "openultrasast.cli:main"