diff --git a/src/openultrasast/fusion.py b/src/openultrasast/fusion.py index acd7f7d..0259e88 100644 --- a/src/openultrasast/fusion.py +++ b/src/openultrasast/fusion.py @@ -1,11 +1,11 @@ -"""Fusion adjudication — OpenUltraCode-style two-panel deepening (Phase 13). +"""Fusion adjudication — OpenUltraCode-style two-panel deepening (Phase 13 of the retired openrouter-sast-harness plan). Fusion is the deepening mechanism for findings that need more reasoning than the ranker → hunter → verifier → mapping loop provides: critical/high severity, verifier disagreement, static-vs-semantic evidence conflict, findings that gate a risky fix or disclosure, or an explicit high-assurance request. Two panels independently review the bounded evidence (one steel-manning the vulnerability case, one the false-positive -case), critique and revise, vote, and a decider issues the final disposition. +case) and vote, and a decider issues the final disposition. The panels and the decider are deterministic and auditable. Every fused finding receives exactly one of the five dispositions, and the decision discloses panel roles, votes and the diff --git a/src/openultrasast/gate.py b/src/openultrasast/gate.py index 2df8501..852f6f2 100644 --- a/src/openultrasast/gate.py +++ b/src/openultrasast/gate.py @@ -1,4 +1,4 @@ -"""Detection-quality gate — the hard feasibility constraint (Phase 4 task 8). +"""Detection-quality gate — the hard feasibility constraint (Phase 4 task 8 of the retired openrouter-sast-harness plan). Aggregate recall and false-positive rate over the benchmark corpus must clear the project goal: recall >= 90% AND false-positive rate < 10%. This gate is computed diff --git a/src/openultrasast/mcp.py b/src/openultrasast/mcp.py index 7d6e9d4..2a18491 100644 --- a/src/openultrasast/mcp.py +++ b/src/openultrasast/mcp.py @@ -1,8 +1,8 @@ -"""Narrow MCP server for OpenCode integration (Phase 12). +"""Narrow MCP server for OpenCode integration (Phase 12 of the retired openrouter-sast-harness plan). Exposes only stable, project-level operations over MCP stdio (newline-delimited JSON-RPC 2.0), implemented with the standard library only. No tool exposes arbitrary -shell, Docker, or internal hunter tools — those stay inside controlled harness stages. +shell, Docker, or internal hunter tools — those stay inside the scan's own stages. The pure :meth:`McpServer.handle` dispatch is separated from the :func:`serve` stdio loop so the surface is unit-testable without a live client. """ diff --git a/src/openultrasast/model/pipeline.py b/src/openultrasast/model/pipeline.py index 43a9864..93e38a7 100644 --- a/src/openultrasast/model/pipeline.py +++ b/src/openultrasast/model/pipeline.py @@ -4,8 +4,8 @@ Everything before this module built an *arbiter* — something that judges a flo found on its own. Nothing proposed candidates to it, which is why the arbiter's recall was never comparable to a detector's: it could only report what it happened to find unaided. -This is the wiring the architecture was designed around, and it turns on a distinction that `judge` alone -conflated: +This is the wiring the architecture was designed around, and it turns on a distinction that the first judge +(`model/judge.py`, deleted 2026-10-02 because this module replaced it) conflated: the model CONTRADICTS it has coverage at this site and says no — a sanitizer lies on the path, or the sink is written in its declared-safe shape. The claim is dropped (Req 8.2). diff --git a/src/openultrasast/redaction.py b/src/openultrasast/redaction.py index b68d91c..8ae0285 100644 --- a/src/openultrasast/redaction.py +++ b/src/openultrasast/redaction.py @@ -1,4 +1,4 @@ -"""Secret redaction for traces and reports (Phase 15 hardening). +"""Secret redaction for traces and reports (Phase 15 hardening of the retired openrouter-sast-harness plan). Scan artifacts (trace events, reports) can quote source code that contains live credentials. This module masks well-known secret shapes before they are persisted, so diff --git a/src/openultrasast/skills.py b/src/openultrasast/skills.py index 89da93b..8461e78 100644 --- a/src/openultrasast/skills.py +++ b/src/openultrasast/skills.py @@ -1,4 +1,4 @@ -"""Trail of Bits skill index + router (Phase 14). +"""Trail of Bits skill index + router (Phase 14 of the retired openrouter-sast-harness plan). Security skills are scoped expertise, not global prompt bloat. Each skill is a small descriptor with routing metadata (languages, tags, vulnerability classes, stages) and