marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(push): a gap from another language partition no longer blocks admission

Browse Source 
_blocking_degradations already exempted declared exclusions. It now also ignores a gap another
language partition raised, because a JavaScript file missing from the JavaScript graph cannot make a
PHP answer wrong. Treating it as though it could left a WordPress plugin -- PHP plus its admin
JavaScript, which is every plugin -- unable to admit a finding it had already established.

A gap that names no partition still reaches everything, and so does every gap when the claim own
language is unknown, because unknown scope is not evidence of independence. The control asserts all
four directions.

With this and the scan fixes, task 13.4 is verified on the subject that motivated it: PMPro completes
120 of 127 questions where it completed none, its 19 findings unchanged, and the seven still
unresolved are the JavaScript partition own questions, which is the correct answer.

1,420 tests pass, eighteen skipped.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-09-21 13:50:38 +02:00
co-authored by Claude Opus 5
parent d105d2f84a
commit a487d1dfb5
3 changed files with 51 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_push_policy.py
+23
View File
@@ -600,3 +600,26 @@ def test_a_candidate_without_an_operation_reports_no_dependency_gaps():
candidate = replace(delta(scan(), scan(rows=inventory_rows(), findings=False), changed_line_context()), head_operation=None)
assert dependency_gaps(candidate, context=changed_line_context(), head=scan()) == ()
def test_a_gap_from_another_language_partition_does_not_block_admission():
"""A JavaScript file missing from the JavaScript graph cannot make a PHP answer wrong.
A partitioned scan records a gap per graph, and treating one partition's gap as evidence against every
claim left a WordPress plugin -- PHP plus its admin JavaScript, which is every plugin -- unable to admit a
finding it had already established. Measured 2026-09-21: four build artefacts against 4,425 PHP regions.
"""
from openultrasast.push.policy import _blocking_degradations
elsewhere = {"stage": "model", "reason": "partition_file_census_incomplete", "census_language": "javascript"}
here = {"stage": "model", "reason": "partition_file_census_incomplete", "census_language": "php"}
unplaced = {"stage": "model", "reason": "partition_file_census_incomplete"}
def scan(*degradations):
return ModelScanResult(findings=(), degradations=tuple(degradations))
assert _blocking_degradations(scan(elsewhere), language="php") == ()
assert _blocking_degradations(scan(here), language="php") == ("partition_file_census_incomplete",)
# Unknown scope is not evidence of independence, in either direction.
assert _blocking_degradations(scan(unplaced), language="php") == ("partition_file_census_incomplete",)
assert _blocking_degradations(scan(elsewhere), language="") == ("partition_file_census_incomplete",)