marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-21 05:59:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

spec(pre-push-safety-net): record M1–M5 release milestones and split M1 into M1a/M1b

Browse Source 
Add release-milestones.md as the executable outcome contract: prove one useful
Node detection, make it fast, verify PHP/Python transfer, qualify on untouched
cases, then enable a narrow advisory rollout. Link it from the roadmap, safety-net
steering, requirements, tasks, status and spec.json.

Split M1 after review. The raw NodeGoat <lambda>2 witness already exists in the
2026-09-14 post-census bundle; four admission vetoes discard it. M1a runs the
vulnerable/fixed/unchanged revisions under a task-local experimental flag that
records each veto instead of applying it, with a one-week box and a kill
criterion if the fixed twin is not quiet. M1b repairs only the vetoes that fired
and reruns through production rules. Existing approvals and thresholds unchanged.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-09-14 20:48:23 +02:00
co-authored by Claude Fable 5.1
parent 1ad472c68d
commit 8b66d5cb75
7 changed files with 311 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/specs/pre-push-safety-net/status.md
+12 -2
View File
@@ -5,6 +5,16 @@ approved. **26/27 executable tasks complete; task 8.3 remains blocked.**
Rollout: **NO-GO**. The alpha tag publishes experimental implementation and evidence;
it does not approve normal hook capabilities or production enforcement.
## Next release milestone
**M1a: show the NodeGoat detection with every admission veto recorded rather than
applied, fixed twin analyzed and quiet, one-week time box. Then M1b: repair only the
vetoes that fired and rerun through production rules.** None of the five release
milestones is verified yet.
The 26/27 task count is implementation progress, not proximity to rollout. Follow the
accepted [release milestone spec](release-milestones.md): usefulness → speed → shared
PHP/Python transfer → independent qualification → narrow advisory rollout.
## Verified
Immutable pushed snapshots, shared multi-ref deadlines, ranker-owned scope, physical
@@ -25,8 +35,8 @@ gates and a packaged native PHP/JavaScript partition smoke. See
completed all 21 measurements: all 18 changed/cold/growth/multi-ref transactions timed
out; the three identical-tip replays took 18.521–18.874s with valid graph/query reuse.
Still 0/24 declared target checks completed. Maximum observed cancellation/report
overrun was 0.874s, below the two-second allowance. Amortize engine startup/loading work and rerun the
frozen seven-class profile; require warm p95 <=30s and >=95% completed supported checks.
overrun was 0.874s, below the two-second allowance. After M1 establishes the useful
comparison, amortize engine startup/loading and rerun the frozen seven-class profile; require warm p95 <=30s and >=95% completed supported checks.
2. **Target and change-context evidence remains incomplete.** VAmPI preserves raw findings
at all three known sites, but the exact SQLI function question/transitive witness and
supported authorization context are unresolved. Raw findings or rank positions cannot