mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-19 04:59:28 +00:00
feat(model-grounded-detection): group 1, subtract the noise architecture
99 source modules -> 81. 832 tests -> 646. The whole learning/ package (16 modules, ~4,100 lines) and six semantic/ modules removed, with the three gates byte-identical to 2026-09-06-gate-baseline.txt at every step. The sequence is what made it safe: vocabularies ported first (1.1), importers detached second (1.2-1.3), deletion third (1.4). Every import break during the deletion was therefore a detachment miss in the importer and was fixed there -- no module was restored to satisfy one. Both misses were the same shape and were fixed as a class: operations.py and shapes.py each imported trailing_name from the deleted variants.py, so it moved to semantic/ir.py, its natural home, and both importers changed in one edit. Ported before deleting: the closed guard vocabulary (verbatim, nothing else holds it) into model/specs.py, which derives TaintSpec and DominanceSpec from the retained ruleset facts rather than copying them. Re-homed: families -> model/taxonomy, candidates -> model/candidates, endpoint -> model/endpoint, plus Region, labeled_family and labeled_spans. labeled_family no longer falls back to the LLM classifier -- an unlabeled pair is honestly unknown. Four deviations, each recorded in the spec notes with its reason. improve/ evolve.py and validator.py were stripped, not deleted: each mixes the mechanism lever (gone) with the deterministic rule-status loop `ousast improve` still runs, which has no LLM in it; a test now asserts the lever's absence by symbol so it cannot creep back. The learning CLI group became `model candidates`, because deleting it outright would have orphaned the retained enumerator by removing its only entry point. thinking moved from [learning] to [models]. A gap named rather than papered over: no retained sink fact routes by CWE to path, output_encoding, untrusted_destination or prototype -- the same hole the entailment ceiling diagnosed. The test asserts the seeded set and the gap set exactly, so task 4.2 must update it when it authors those sinks. The audit found exactly one genuine orphan: vectorstore.py, a bakeoff harness with no production caller and no CLI, alive only through its own test. The five named subsystems each carry an explicit decision. Manifest committed, with a test asserting the tree still matches it. Group 2 (the Joern go/no-go) has not started. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
This commit is contained in:
Marius Ciepluch
co-authored by
Claude Opus 5
Claude Opus 5
parent
fc4dab97fb
commit
9ed0e45c5f
@@ -0,0 +1,166 @@
|
||||
"""Module audit: what is load-bearing, what stands alone, and what is orphaned (Req 3).
|
||||
|
||||
The tool outgrew itself — 99 modules and 832 tests at the point this feature began, a large share of them
|
||||
serving an architecture its own measurements retired. This classifier exists so outgrowth is visible and
|
||||
checkable rather than a thing someone notices two specs later.
|
||||
|
||||
A module is:
|
||||
|
||||
load_bearing reachable from a gate, the scan CLI, or a surviving requirement
|
||||
standalone_capability its own entry point and users, not on the scan path
|
||||
orphaned no importer, no entry point, no requirement — it should not be in the tree
|
||||
|
||||
Pure stdlib, no imports of the package it audits: it reads the import graph with ``ast`` so a broken module
|
||||
is still classifiable.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import ast
|
||||
from collections.abc import Iterable, Mapping
|
||||
from dataclasses import dataclass
|
||||
from pathlib import Path
|
||||
|
||||
PACKAGE = "openultrasast"
|
||||
|
||||
# Entry points a module can be reachable from. The three gates are the contract; the CLI is the product.
|
||||
ROOTS = ("gate", "map_gate", "pair_gate", "cli", "__main__")
|
||||
|
||||
# Modules that stand alone: their own CLI subcommand or external protocol, deliberately off the scan path.
|
||||
SPEC_OWNED = {
|
||||
"model.specs": "model-grounded-detection Req 7.2-7.4: the security vocabularies the CPG queries are parameterised by",
|
||||
"model.endpoint": "model-grounded-detection Req 8: the judge client, wired by model/judge.py in group 3",
|
||||
"model.audit": "model-grounded-detection Req 3: this classifier; run by the maintainer, not by the scan",
|
||||
}
|
||||
|
||||
STANDALONE = {
|
||||
"mcp": "narrow MCP server over stdio; its own `ousast mcp` entry point and OpenCode integration",
|
||||
"skills": "skill router; consumed by mcp and by the OpenCode integration, not by the scan path",
|
||||
"fusion": "two-panel adjudication engine; reached from the scan's report stage and used standalone",
|
||||
"harness_ext": "HarnessX extension surface; loaded by name when the optional harness is present",
|
||||
"hunter_harness": "harness wiring for the tool hunter; used by the hunter path and by mcp",
|
||||
"stage_processors": "HarnessX slot-contracted scan stages; pinned by the zero-dependency guard in test_gate",
|
||||
"slot_contract": "the slot/contract protocol stage_processors implements",
|
||||
}
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class ModuleAudit:
|
||||
module: str
|
||||
classification: str # load_bearing | standalone_capability | orphaned
|
||||
reason: str
|
||||
importers: tuple[str, ...]
|
||||
|
||||
|
||||
def module_name(path: Path, root: Path) -> str:
|
||||
relative = path.relative_to(root).with_suffix("")
|
||||
parts = [part for part in relative.parts if part != "__init__"]
|
||||
return ".".join(parts)
|
||||
|
||||
|
||||
def import_graph(root: Path) -> dict[str, set[str]]:
|
||||
"""``module -> the modules it imports`` for every module under ``root``, resolved to package-relative names."""
|
||||
graph: dict[str, set[str]] = {}
|
||||
for path in sorted(root.rglob("*.py")):
|
||||
if "__pycache__" in path.parts:
|
||||
continue
|
||||
name = module_name(path, root)
|
||||
# For a package's `__init__`, the containing package *is* this module, so `from .x import y` resolves to
|
||||
# `<name>.x`; for a plain module it resolves against the parent. Getting this backwards made every module
|
||||
# a package re-exports look unimported.
|
||||
is_package = path.name == "__init__.py"
|
||||
imported: set[str] = set()
|
||||
try:
|
||||
tree = ast.parse(path.read_text())
|
||||
except (OSError, SyntaxError):
|
||||
graph[name] = imported
|
||||
continue
|
||||
package_parts = name.split(".") if is_package else name.split(".")[:-1]
|
||||
package_parts = [part for part in package_parts if part]
|
||||
for node in ast.walk(tree):
|
||||
if isinstance(node, ast.ImportFrom):
|
||||
if node.level:
|
||||
base = package_parts[: len(package_parts) - node.level + 1]
|
||||
target = ".".join([*base, node.module]) if node.module else ".".join(base)
|
||||
else:
|
||||
target = node.module or ""
|
||||
if target.startswith(f"{PACKAGE}."):
|
||||
target = target[len(PACKAGE) + 1 :]
|
||||
elif target == PACKAGE:
|
||||
target = ""
|
||||
else:
|
||||
continue
|
||||
if target:
|
||||
imported.add(target)
|
||||
elif isinstance(node, ast.Import):
|
||||
for alias in node.names:
|
||||
if alias.name.startswith(f"{PACKAGE}."):
|
||||
imported.add(alias.name[len(PACKAGE) + 1 :])
|
||||
graph[name] = imported
|
||||
return graph
|
||||
|
||||
|
||||
def _reachable(graph: Mapping[str, set[str]], roots: Iterable[str]) -> set[str]:
|
||||
seen: set[str] = set()
|
||||
stack = [root for root in roots if root in graph]
|
||||
while stack:
|
||||
current = stack.pop()
|
||||
if current in seen:
|
||||
continue
|
||||
seen.add(current)
|
||||
for target in graph.get(current, ()):
|
||||
# an import of `a.b` also keeps the package `a` alive
|
||||
for candidate in (target, target.rsplit(".", 1)[0]):
|
||||
if candidate in graph and candidate not in seen:
|
||||
stack.append(candidate)
|
||||
return seen
|
||||
|
||||
|
||||
def audit(root: Path) -> tuple[ModuleAudit, ...]:
|
||||
"""Classify every module under ``root``."""
|
||||
graph = import_graph(root)
|
||||
importers: dict[str, set[str]] = {name: set() for name in graph}
|
||||
for name, targets in graph.items():
|
||||
for target in targets:
|
||||
for candidate in (target, target.rsplit(".", 1)[0]):
|
||||
if candidate in importers and candidate != name:
|
||||
importers[candidate].add(name)
|
||||
live = _reachable(graph, ROOTS)
|
||||
results: list[ModuleAudit] = []
|
||||
for name in sorted(graph):
|
||||
if not name: # the package __init__ itself
|
||||
continue
|
||||
who = tuple(sorted(importers[name]))
|
||||
if name in SPEC_OWNED:
|
||||
results.append(ModuleAudit(name, "load_bearing", SPEC_OWNED[name], who))
|
||||
elif name in ROOTS:
|
||||
results.append(ModuleAudit(name, "load_bearing", "entry point", who))
|
||||
elif name in STANDALONE:
|
||||
results.append(ModuleAudit(name, "standalone_capability", STANDALONE[name], who))
|
||||
elif name in live:
|
||||
results.append(ModuleAudit(name, "load_bearing", f"reachable from {', '.join(ROOTS[:3])} or the CLI", who))
|
||||
elif who:
|
||||
results.append(ModuleAudit(name, "load_bearing", f"imported by {', '.join(who)}", who))
|
||||
else:
|
||||
results.append(ModuleAudit(name, "orphaned", "no importer, no entry point, no surviving requirement", who))
|
||||
return tuple(results)
|
||||
|
||||
|
||||
def to_dict(results: Iterable[ModuleAudit]) -> dict[str, object]:
|
||||
rows = list(results)
|
||||
counts: dict[str, int] = {}
|
||||
for row in rows:
|
||||
counts[row.classification] = counts.get(row.classification, 0) + 1
|
||||
return {
|
||||
"modules": len(rows),
|
||||
"counts": dict(sorted(counts.items())),
|
||||
"orphaned": [row.module for row in rows if row.classification == "orphaned"],
|
||||
"standalone": {row.module: row.reason for row in rows if row.classification == "standalone_capability"},
|
||||
"rows": [
|
||||
{"module": row.module, "classification": row.classification, "reason": row.reason, "importers": list(row.importers)}
|
||||
for row in rows
|
||||
],
|
||||
}
|
||||
|
||||
|
||||
__all__ = ["ModuleAudit", "SPEC_OWNED", "STANDALONE", "audit", "import_graph", "module_name", "to_dict"]
|
||||
Reference in New Issue
Block a user