feat(plane): increment manifests for the 46-candidate validation run (task 7)

Model deepseek-flash (declared provider extension, endpoint prices in
parameters, secretKey naming the DEEPSEEK_API_KEY secret), digest-pinned
Task templates repo-facts / verify / agree, and a generator
(plane/generate.py, `ousast plane workspaces --validation-set ...`) that
emits per case the vulnerable-pin Workspace, a files-only inputs Workspace
(recorded candidates after the recorded triage, declared sites, triage),
per-case Tasks and one Run validation-46: facts -> verify a, verify b ->
agree for the 15 cases, 46 candidates (43 kept), budgets 1.5x the recorded
per-pass share. A Run entry cannot add a binding or env, and Run.inputs
names only task artifacts, so the case is fixed by per-case Tasks.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

plane/tasks/agree.yaml

@@ -0,0 +1,18 @@
+# agree (ai-service-plane Req 5.3, 2.1): agreement across the two verify passes, per-candidate cost and turns,
+# declared-site match. No model. This is the template the per-case Tasks of a Run are generated from (bound to the
+# case's inputs Workspace for the candidates and declared sites). The image is digest-pinned.
+apiVersion: ax.io/v1alpha1
+kind: Task
+metadata:
+  name: agree
+  atespace: default
+spec:
+  image: "localhost:5001/ousast-runner@sha256:318cbe019c1155b43fe59e47368d99e78f6f6011b7c822292251de53cf567bf3"
+  command: ["agree"]
+  resources:
+    requests:
+      cpu: "100m"
+      memory: "256Mi"
+    limits:
+      cpu: "1"
+      memory: "512Mi"

plane/tasks/repo-facts.yaml

@@ -0,0 +1,19 @@
+# repo-facts (ai-service-plane Req 5.1/5.2): source only, no model. This is the template the per-case Tasks of a
+# Run are generated from (`ousast plane workspaces --validation-set ...` binds the case's pinned Workspace and its
+# inputs Workspace, and sets the paths as env). The image is digest-pinned: Agent Substrate rejects tags.
+# Heavy for the host (a full-tree scan of the case at 1 CPU / 1.5 GiB per gVisor worker): the Run serializes it.
+apiVersion: ax.io/v1alpha1
+kind: Task
+metadata:
+  name: repo-facts
+  atespace: default
+spec:
+  image: "localhost:5001/ousast-runner@sha256:318cbe019c1155b43fe59e47368d99e78f6f6011b7c822292251de53cf567bf3"
+  command: ["repo-facts"]
+  resources:
+    requests:
+      cpu: "250m"
+      memory: "512Mi"
+    limits:
+      cpu: "1"
+      memory: "1280Mi"

plane/tasks/verify.yaml

@@ -0,0 +1,21 @@
+# verify (ai-service-plane Req 5.3, 2.1-2.3, 7.2): one batched hunt per file with the known callers from
+# repo-facts in the prompt. Bound to its Model by the `openultrasast.io/model` annotation, which the reconciler
+# strips and renders as OUSAST_MODEL / OUSAST_MODEL_PARAMS. This is the template the per-case, per-pass Tasks of a
+# Run are generated from (the pass is OUSAST_PASS=a|b in their env). The image is digest-pinned.
+apiVersion: ax.io/v1alpha1
+kind: Task
+metadata:
+  name: verify
+  atespace: default
+  annotations:
+    openultrasast.io/model: deepseek-flash
+spec:
+  image: "localhost:5001/ousast-runner@sha256:318cbe019c1155b43fe59e47368d99e78f6f6011b7c822292251de53cf567bf3"
+  command: ["verify"]
+  resources:
+    requests:
+      cpu: "250m"
+      memory: "384Mi"
+    limits:
+      cpu: "1"
+      memory: "1Gi"