From 78c31ba72270f26b418ea8abf0c509d813e07b34 Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Fri, 2 Oct 2026 07:11:50 +0200 Subject: [PATCH] docs: refresh merged; v3 has 15 cases; .env.example names DeepSeek, OpenRouter embeddings and the S3 store Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo --- .env.example | 29 ++++++++++++++++++++--------- docs/evaluation.md | 2 +- 2 files changed, 21 insertions(+), 10 deletions(-) diff --git a/.env.example b/.env.example index adc346b..0050f20 100644 --- a/.env.example +++ b/.env.example @@ -1,12 +1,23 @@ -# Copy to .env and fill in. .env is gitignored. -OPENROUTER_API_KEY= +# Copy to .env and fill in. .env is gitignored and never committed. +# Note: values in .env never override variables already exported in your shell +# (e.g. from ~/.bashrc). Unset a stale export, or the shell value wins. -# Prove-budget and `ousast index` embeddings via OpenRouter /embeddings. +# LLM calls (verify, roles, the decision engine): DeepSeek. +DEEPSEEK_API_KEY= +# DEEPSEEK_BASE_URL=https://api.deepseek.com + +# Embeddings only: OpenAI text-embedding-3-small through OpenRouter. +OPENROUTER_API_KEY= OPENROUTER_EMBEDDING_MODEL=openai/text-embedding-3-small -# Any OpenAI-compatible chat endpoint works for the hunter: set the key above to that -# provider's key and override the base URL. Example for DeepSeek: -# OPENROUTER_API_KEY=sk-deepseek-... -# OPENROUTER_BASE_URL=https://api.deepseek.com/v1 -# Then set [models].hunter in openultrasast.toml (or --hunter-model) to that provider's model id. -OPENROUTER_BASE_URL= +# Plane memory store. Default is a local FileStore under ~/ousast-results/plane/memory. +# For an S3-compatible server (MinIO, RustFS): OUSAST_MEMORY=minio:// +# OUSAST_MEMORY=minio://sast-memory +# MINIO_ENDPOINT=host[:port] +# MINIO_ACCESS_KEY= +# MINIO_SECRET_KEY= +# MINIO_SECURE=true +# MINIO_REGION=us-east-1 +# MINIO_BUCKET=sast-memory +# The bucket must have versioning enabled and a lifecycle rule expiring runs/ (see ops/ax/README.md); +# the store verifies both at startup and refuses to run otherwise. diff --git a/docs/evaluation.md b/docs/evaluation.md index 945f9ec..ad76b4c 100644 --- a/docs/evaluation.md +++ b/docs/evaluation.md @@ -43,7 +43,7 @@ it may inform changes, but it can no longer qualify anything. | v1 (11 cases) | spent | engine: recall 1/11, precision 1/12, 4 fixed-side and 1 benign false alert; every M4 gate failed. Eight of eleven cases completed no question at the vulnerable pin. | `benchmarks/independent/results-v1.json` | | v2 (17 cases) | spent | engine: recall 0/17, 3 benign alerts, completion 13,206 of 108,374. Tool hunter: recall 1/17, precision 2/14, 1 fixed-side and 16 benign alerts, $8.88. No M4 gate met by either. | `results-v2.json`, `results-v2-hunter.json` | | v2, model-driven pipeline | exploratory (v2 already spent) | stopped after 7 of 17 cases when the account emptied: recall 4/7; precision not adjudicated; no gate measurable | `results-v2-model-pipeline.json` | -| v3 (PHP, 16 cases) | frozen, untouched | none: it is the one-time final check, run once under `protocol-v3.md` after a prediction is committed | `population-v3-php.toml`, `freeze-v3-php.json` | +| v3 (PHP, 15 cases; one SSRF slot left empty by the selection rule) | frozen, untouched | none: it is the one-time final check, run once under `protocol-v3.md` after a prediction is committed | `population-v3-php.toml`, `freeze-v3-php.json` | v3 is reserved: development and analysis work never reads its cases, and `tests/test_independent_population.py` fails when anything in the development tree (a recipe,