docs: refresh merged; v3 has 15 cases; .env.example names DeepSeek, OpenRouter embeddings and the S3 store

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

.env.example

@@ -1,12 +1,23 @@
-# Copy to .env and fill in. .env is gitignored.
+# Copy to .env and fill in. .env is gitignored and never committed.
-OPENROUTER_API_KEY=
+# Note: values in .env never override variables already exported in your shell
+# (e.g. from ~/.bashrc). Unset a stale export, or the shell value wins.
 
-# Prove-budget and `ousast index` embeddings via OpenRouter /embeddings.
+# LLM calls (verify, roles, the decision engine): DeepSeek.
+DEEPSEEK_API_KEY=
+# DEEPSEEK_BASE_URL=https://api.deepseek.com
+
+# Embeddings only: OpenAI text-embedding-3-small through OpenRouter.
+OPENROUTER_API_KEY=
 OPENROUTER_EMBEDDING_MODEL=openai/text-embedding-3-small
 
-# Any OpenAI-compatible chat endpoint works for the hunter: set the key above to that
+# Plane memory store. Default is a local FileStore under ~/ousast-results/plane/memory.
-# provider's key and override the base URL. Example for DeepSeek:
+# For an S3-compatible server (MinIO, RustFS): OUSAST_MEMORY=minio://<bucket>
-#   OPENROUTER_API_KEY=sk-deepseek-...
+# OUSAST_MEMORY=minio://sast-memory
-#   OPENROUTER_BASE_URL=https://api.deepseek.com/v1
+# MINIO_ENDPOINT=host[:port]
-# Then set [models].hunter in openultrasast.toml (or --hunter-model) to that provider's model id.
+# MINIO_ACCESS_KEY=
-OPENROUTER_BASE_URL=
+# MINIO_SECRET_KEY=
+# MINIO_SECURE=true
+# MINIO_REGION=us-east-1
+# MINIO_BUCKET=sast-memory
+# The bucket must have versioning enabled and a lifecycle rule expiring runs/ (see ops/ax/README.md);
+# the store verifies both at startup and refuses to run otherwise.

docs/evaluation.md

@@ -43,7 +43,7 @@ it may inform changes, but it can no longer qualify anything.
 | v1 (11 cases) | spent | engine: recall 1/11, precision 1/12, 4 fixed-side and 1 benign false alert; every M4 gate failed. Eight of eleven cases completed no question at the vulnerable pin. | `benchmarks/independent/results-v1.json` |
 | v2 (17 cases) | spent | engine: recall 0/17, 3 benign alerts, completion 13,206 of 108,374. Tool hunter: recall 1/17, precision 2/14, 1 fixed-side and 16 benign alerts, $8.88. No M4 gate met by either. | `results-v2.json`, `results-v2-hunter.json` |
 | v2, model-driven pipeline | exploratory (v2 already spent) | stopped after 7 of 17 cases when the account emptied: recall 4/7; precision not adjudicated; no gate measurable | `results-v2-model-pipeline.json` |
-| v3 (PHP, 16 cases) | frozen, untouched | none: it is the one-time final check, run once under `protocol-v3.md` after a prediction is committed | `population-v3-php.toml`, `freeze-v3-php.json` |
+| v3 (PHP, 15 cases; one SSRF slot left empty by the selection rule) | frozen, untouched | none: it is the one-time final check, run once under `protocol-v3.md` after a prediction is committed | `population-v3-php.toml`, `freeze-v3-php.json` |
 
 v3 is reserved: development and analysis work never reads its cases, and
 `tests/test_independent_population.py` fails when anything in the development tree (a recipe,