From 838638a69286281901445422bbb0405555fb5c97 Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Fri, 2 Oct 2026 15:16:10 +0200 Subject: [PATCH] release: v2.0.0 -- ax plane, HarnessX removed, S3 memory on RustFS, AI decision engine (in development) Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo --- README.md | 2 +- RELEASE_NOTES.md | 31 ++++++++++++++++++++++++++++++- docs/index.md | 2 +- pyproject.toml | 2 +- src/openultrasast/__init__.py | 2 +- uv.lock | 2 +- 6 files changed, 35 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index b9b63aa..f645812 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # OpenUltraSAST -**v1.2.0-alpha.1 (Python package `1.2.0a1`), state as of 2026-10-02.** An experimental static +**v2.0.0 (Python package `2.0.0`), state as of 2026-10-02.** An experimental static security analyser. The pre-push safety net is **NO-GO** for rollout: no hook capability is enabled and no independent population has passed the qualification gates (see [docs/evaluation.md](docs/evaluation.md)). See the [release notes](RELEASE_NOTES.md). diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index 1dad2d2..b3d91df 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -1,4 +1,33 @@ -# Unreleased +# v2.0.0 (2026-10-02) + +A new major release: the agentic plane runs on google/ax, HarnessX is gone, detection decisions move +toward a trained-by-memory AI classifier, and the plane memory lives in an S3-compatible store. + +- **Agentic plane on ax** (`ousast plane run|status|doctor|workspaces|remember|alerts-engine|harvest`): tasks + run in gVisor sandboxes on Agent Substrate; one Model and one budget per task; token attribution per task + and model; credentials only in the start request; per-task egress policies. First increment measured: + 16/20 declared sites agreed at $0.0205 per candidate (`benchmarks/independent/plane-increment-2.json`). +- **HarnessX removed.** Retired config keys fail with a reason; `[harnessx]` warns. Deterministic outputs + proven byte-identical (`benchmarks/measurements/2026-09-30-harnessx-removal-equality/`). +- **Memory store** (`OUSAST_MEMORY`): local files or any S3-compatible store with versioning, lifecycle, + tags and S3 Select; RustFS is the tested server (`docs/rustfs.md`). The store verifies its bucket at + startup and never falls back; every row carries its kind's queryable fields. New extra `s3` (boto3). +- **Decision engine (in development, not adopted):** an in-house DSPy-style AI classifier with local + memory; labels from ground truth; repository-grouped evaluation. Slice 2 on six families: out-of-repo + AUC 0.77-0.96 (within-pair 0.72-0.93); BLOCK not offered anywhere; see + `benchmarks/measurements/2026-10-02-decision-engine-slice-2/record.json` and `docs/memory-and-detection.md`. +- **Improvement from memory:** `ousast improve --memory`; the loop as a plane Run. +- **PHP quick-mode rules** (in-sample measurement only) beside the Joern engine; framework knowledge + tagged as optional priors (`ruleset/frameworks.toml`). +- **Populations:** v3 (PHP, 15 cases) frozen and untouched as the one-time final check; 97 advisory-fix + pairs added for negatives; licences of published cases verified (v1's OpenCVE case is BUSL-1.1). +- **Removed legacy:** dead modules (`model.judge`, `model.execution`, `model.calibrate`, + `stage_processors`, `slot_contract`); unread config keys `[dynamic]`, `[evidence]`, `[variants]`, + `[models] patcher` retired (`resolved_config.json` loses those sections); reference-only scripts under + `benchmarks/archive/`; the module audit now classifies by real imports. +- **Docs:** MkDocs site (`mkdocs serve`), including token ergonomics and the RustFS setup. + +Detailed notes for this release follow. ## PHP quick-mode rules (2026-09-30) diff --git a/docs/index.md b/docs/index.md index c5091a6..2e98c2a 100644 --- a/docs/index.md +++ b/docs/index.md @@ -5,7 +5,7 @@ repositories it has never seen: it scans a checkout, or the commits a `git push` and separates what it can prove from what it merely suspects. A scan that could not look at something records a degradation instead of reporting a clean result. -**State as of 2026-10-02 (v1.2.0-alpha.1):** the pre-push safety net is **NO-GO** for rollout. +**State as of 2026-10-02 (v2.0.0):** the pre-push safety net is **NO-GO** for rollout. No hook capability is enabled, and no independent population has passed the qualification gates (see [Evaluation](evaluation.md)). diff --git a/pyproject.toml b/pyproject.toml index fbbc4bf..d6977bc 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "uv_build" [project] name = "openultrasast" -version = "1.2.0a1" +version = "2.0.0" description = "OpenCode-oriented SAST harness for evidence-gated security analysis" readme = "README.md" requires-python = ">=3.11" diff --git a/src/openultrasast/__init__.py b/src/openultrasast/__init__.py index a514765..b9fd156 100644 --- a/src/openultrasast/__init__.py +++ b/src/openultrasast/__init__.py @@ -2,4 +2,4 @@ __all__ = ["__version__"] -__version__ = "1.2.0a1" +__version__ = "2.0.0" diff --git a/uv.lock b/uv.lock index de19b60..f9046e6 100644 --- a/uv.lock +++ b/uv.lock @@ -1024,7 +1024,7 @@ wheels = [ [[package]] name = "openultrasast" -version = "1.2.0a1" +version = "2.0.0" source = { editable = "." } dependencies = [ { name = "pyyaml" },