marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-18 04:29:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(three-stage-scan): select bounded regress candidates with sev-5 extras

Browse Source
This commit is contained in:
Marius Ciepluch
2026-09-03 22:36:02 +02:00
parent eb87ef85ec
commit 7a584d4578
4 changed files with 220 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/specs/three-stage-scan/tasks.md
+2 -2
View File
@@ -93,7 +93,7 @@ This plan ships the three-stage scan without rebuilding CWE policy or the regex
- _Boundary: DockerCliRunner_
- _Depends: 4.1_
- [ ] 4.3 Reject unsafe regression snippets before execution
- [x] 4.3 Reject unsafe regression snippets before execution
- Snippets that refer to the Docker socket, host network, or writes under the source mount are not executed and become `inconclusive`.
- Observable completion: each forbidden shape is rejected in a unit test and no runner job is created.
- _Requirements: 5.8, 6.6_
@@ -103,7 +103,7 @@ This plan ships the three-stage scan without rebuilding CWE policy or the regex
## Phase 3 — Core: Regression verdicts
- [ ] 5. Produce worth-fixing verdicts from sandboxed candidates
- [ ] 5.1 Select a bounded candidate set from hotspots and severe reachable inventory
- [x] 5.1 Select a bounded candidate set from hotspots and severe reachable inventory
- Selection honors max-candidates and always includes reachable severity-5 inventory even when the ledger demoted the hotspot.
- Observable completion: a unit test with six hotspots and max-candidates three returns three, plus the sev-5 reachable extra when present.
- _Requirements: 5.1, 7.4, 9.5_