marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-20 21:49:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

spec(pre-push-safety-net): record M1–M5 release milestones and split M1 into M1a/M1b

Browse Source 
Add release-milestones.md as the executable outcome contract: prove one useful
Node detection, make it fast, verify PHP/Python transfer, qualify on untouched
cases, then enable a narrow advisory rollout. Link it from the roadmap, safety-net
steering, requirements, tasks, status and spec.json.

Split M1 after review. The raw NodeGoat <lambda>2 witness already exists in the
2026-09-14 post-census bundle; four admission vetoes discard it. M1a runs the
vulnerable/fixed/unchanged revisions under a task-local experimental flag that
records each veto instead of applying it, with a one-week box and a kill
criterion if the fixed twin is not quiet. M1b repairs only the vetoes that fired
and reruns through production rules. Existing approvals and thresholds unchanged.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-09-14 20:48:23 +02:00
co-authored by Claude Fable 5.1
parent 1ad472c68d
commit 8b66d5cb75
7 changed files with 311 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/specs/pre-push-safety-net/tasks.md
+9 -7
View File
@@ -1,12 +1,14 @@
# Implementation Plan: pre-push-safety-net
Status: task plan approved by the maintainer on 2026-09-12. Groups 1–6 (tasks 1.1–6.4)
are implemented, reviewed and verified (20/27 subtasks). Tasks 4.3 and groups 5–6 used the
explicit Kiro manual review fallback after fresh agent dispatch reached its thread limit.
Group 5's six cold PMPro/Node timeouts remain historical NO-GO evidence. Group 6 verifies
compatible reuse with equal evidence/admission in a packaged authored JavaScript control;
its identical-revision run completed in 2.00s. This is not representative warm p95 or
independent capability qualification. Groups 7–8 remain pending; rollout remains NO-GO.
Status: the existing task plan remains approved. Groups 1–7 and tasks 8.1, 8.2 and 8.4
are verified (26/27 executable subtasks); task 8.3 and rollout remain NO-GO. Later work
used the documented manual review fallback where agent dispatch reached its limit.
The accepted [release milestone spec](release-milestones.md) now orders remaining work:
M1 useful Node comparison → M2 speed → M3 shared-language transfer → M4 independent
qualification → M5 narrow advisory rollout. All five milestones remain unverified.
These are release outcomes, not additional checked implementation tasks. Prepare bounded
owner design/task amendments as needed; preserve all completed task evidence below.
## Execution contract