marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-19 13:10:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

spec(search-with-proof): separate trust domains (brain with key, executor with repo code)

Browse Source 
Replaces the accepted key-exposure exception: the key never shares a sandbox with
repository code; executor AX tasks exchange commands and results via presigned
objects. Firecracker executors only if the pilot build-failure rate requires it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-05 16:26:19 +02:00
co-authored by Claude Opus 5.5
parent 5e03bdf07f
commit 721c4b0997
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/specs/search-with-proof/requirements.md
+6 -4
View File
@@ -101,10 +101,12 @@ known instead of restarting.
operator). Store credentials stay out of the cluster (presigned links, as today). For this arm, model calls inside operator). Store credentials stay out of the cluster (presigned links, as today). For this arm, model calls inside
the cluster supersede `unseen-repo-evaluation` Req 4.4 (model calls on the VM); that boundary is unchanged for all the cluster supersede `unseen-repo-evaluation` Req 4.4 (model calls on the VM); that boundary is unchanged for all
other arms. *(maintainer decision 2026-10-05: scoped key in the cluster)* other arms. *(maintainer decision 2026-10-05: scoped key in the cluster)*
2. The key never appears in a manifest, a log, a board entry or a record. *(Amended 2026-10-05, maintainer decision.)* 2. The key never appears in a manifest, a log, a board entry or a record, and never shares a sandbox with repository
In the cluster, repository code run by an explore step shares the task with the key and could read it; this risk is code. *(Amended 2026-10-05, maintainer decision: trust domains are separated instead of isolated inside one task.)*
accepted and bounded: the key is scoped to search, has a low spend cap, and is rotated after every run. On the host The agent loop (the "brain", holding the key) runs on the VM or in its own AX task and executes no repository code;
and VM the inner sandbox keeps the key out of executed code. every tool call that touches the repository runs in a separate executor AX task without the key, exchanging
commands and results through presigned store objects. A Firecracker executor runtime is considered only if the
pilot's `could_not_build` rate shows gVisor cannot build the projects.
### Requirement 6: Feasibility pilot, false-proof qualification, then the unseen pool ### Requirement 6: Feasibility pilot, false-proof qualification, then the unseen pool