marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 11:49:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(learn): v1 withholds verify.flag_b and ms.operation (plane-profile leak audit)

Browse Source 
Maintainer decision 2026-10-02. Not pushed with the release; main is otherwise
at v2.0.0.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-10-02 15:25:21 +02:00
co-authored by Claude Fable 5.1
parent 838638a692
commit a90e570f48
2 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_learn_leaks.py
+10
View File
@@ -113,3 +113,13 @@ def test_v1_withholds_function_length_from_prompts_and_distance() -> None:
assert "facts.function_lines: 42" in render_signals(a["x"], a["instruments"], "static", inputs="full")
assert gower(a["x"], a["instruments"], b["x"], b["instruments"], "static") == 0.0
assert gower(a["x"], a["instruments"], b["x"], b["instruments"], "static", inputs="full") > 0.0
def test_v1_withholds_the_plane_profile_leak_signals() -> None:
"""Slice-2 leak audit (2026-10-02): verify.flag_b and ms.operation track the pair label in the plane profile;
v1 renders neither and the distance ignores both, while ``full`` keeps them."""
from openultrasast.learn.schema import withheld
hidden = withheld("v1")
assert {"verify.flag_b", "ms.operation", "engine", "facts.function_lines"} <= hidden
assert withheld("full") == frozenset()