mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
plane(2.5): kind proof and record 02 -- artifacts through the store, one TLS rule
Live on kind with the runner image that carries 2.2 (ousast-runner@sha256:d2a55293...; templates and validation-46 Tasks repinned, 128 lines; kind-images.json updated): the smoke Run on store delivery finished in 26 s and 24 s; the tar was PUT to runs/ax-e2e-smoke/facts/output.tar (10240 B) and collected 2 s later; read back from the store its members (facts.json 451 B, summary.json 238 B, units.jsonl 291 B) equal the extracted files; facts.json, summary.json and done.json (149 B) re-put, state.json (350 B) mirrored; a rerun from an empty results root seeded state.json from the store and finished in 2 s without resubmitting. The actor's egress policy read back live: one tlsPassthrough rule on 443 naming the store host, nothing else. `ousast plane status ax-e2e-smoke` printed the table each time. Record: benchmarks/measurements/2026-10-02-k8s-02-store-delivery/record.json with the smoke outputs, store read-back and policy beside it. Task 2.6 (receiver removal) is paused by the maintainer's reprioritisation. Gates: pytest 2031 passed, 42 skipped, exit 0; ruff check 0; ruff format 0; mypy 0. (The first run, at 0.97 GiB free disk, failed 11 tests and errored 5 on the FileStore's 1 GiB free-space refusal; rerun after the disk was freed.) Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
co-authored by
Claude Opus 5.5
Claude Opus 5.5
parent
605b7af5ba
commit
c8b418c34c
@@ -0,0 +1,24 @@
|
||||
{
|
||||
"metadata": {
|
||||
"atespace": "default",
|
||||
"createTime": "2026-10-02T19:39:19.428045847Z",
|
||||
"name": "default",
|
||||
"uid": "741e52b7-aaf1-4a91-b4bf-fc3b20ba4a36",
|
||||
"updateTime": "2026-10-02T19:39:19.428045847Z",
|
||||
"version": "1"
|
||||
},
|
||||
"rules": [
|
||||
{
|
||||
"tlsPassthrough": {
|
||||
"hostnames": [
|
||||
"files.because-security.com"
|
||||
],
|
||||
"ports": {
|
||||
"numbers": [
|
||||
443
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,83 @@
|
||||
{
|
||||
"record": "k8s-02-store-delivery",
|
||||
"spec": "plane-on-kubernetes",
|
||||
"tasks": ["2.1", "2.2", "2.3", "2.4", "2.5", "2.6"],
|
||||
"date": "2026-10-02",
|
||||
"commits": {
|
||||
"2.1": "35d8032",
|
||||
"2.2": "9506a18",
|
||||
"2.3": "c49eae4",
|
||||
"2.4": "605b7af",
|
||||
"2.5": "the commit that adds this file (git log: plane(2.5))",
|
||||
"receiver_removed": "pending: task 2.6 (paused 2026-10-03 by the maintainer's reprioritisation; the receiver path still exists behind OUSAST_DELIVERY=receiver)"
|
||||
},
|
||||
"images": {
|
||||
"runner": "localhost:5001/ousast-runner@sha256:d2a55293999cc34581ef1f02a1ffb0c2dd8fc0cbe001ac952df81600e868f019",
|
||||
"built_by": "ops/ax/up.sh rerun (file up-sh-rebuild.txt): every step kept but the runner build; the image carries the 2.2 runner",
|
||||
"disk_gb_free_after_build": 1.3
|
||||
},
|
||||
"instrument_checks": {
|
||||
"code_under_test": "the worktree's src first on PYTHONPATH; `ousast` run as `python -m openultrasast.cli` from the worktree (ops/ax/smoke-run.sh with OUSAST_PYTHON)",
|
||||
"store_read_back": {
|
||||
"how": "scratch store_tar_check.py opens the store through the worktree code (verify_bucket runs), lists runs/ax-e2e-smoke/, downloads output.tar, compares its members with the files the reconciler extracted (file store-check.json)",
|
||||
"tar_bytes": 10240,
|
||||
"tar_members_bytes": {"facts.json": 451, "summary.json": 238, "units.jsonl": 291},
|
||||
"extracted_files_bytes": {"facts.json": 451, "summary.json": 238, "units.jsonl": 291},
|
||||
"members_equal_extracted": true,
|
||||
"member_bytes_total": 980,
|
||||
"note": "a tar is 512-byte blocks: 10240 B of tar carry 980 B of files; done.json records the tar's byte size"
|
||||
},
|
||||
"no_receiver_in_the_task": "the rendered task.yaml is 996 B against 1148 B on the receiver path: no OUSAST_ARTIFACT_URL/DIAL in the Task's env; the start body carries the URLs"
|
||||
},
|
||||
"smoke_runs": {
|
||||
"store_1": {
|
||||
"command": "ops/ax/smoke-run.sh (store delivery, the default after 2.4; OUSAST_DELIVERY unset)",
|
||||
"exit": 0,
|
||||
"seconds_submit_to_done": 26,
|
||||
"tar_put_at": "2026-10-02T19:37:24+00:00 (the object's LastModified)",
|
||||
"collected_at": "2026-10-02T19:37:26+00:00 (done.json finished)",
|
||||
"put_to_collect_seconds": 2,
|
||||
"poll_interval_seconds": 3,
|
||||
"file": "smoke-run-store-1.txt"
|
||||
},
|
||||
"seeded_rerun": {
|
||||
"command": "the same, with the local results root deleted and the store's runs/ax-e2e-smoke/ intact",
|
||||
"exit": 0,
|
||||
"seconds": 2,
|
||||
"what_happened": "state.json seeded from the store: every task done, nothing submitted to ax (plane-on-kubernetes 2.1, design section 2: a rerun from another machine resumes from the store)",
|
||||
"file": "smoke-run-seeded-rerun.txt"
|
||||
},
|
||||
"store_2": {
|
||||
"command": "the same, after deleting runs/ax-e2e-smoke/ from the store (5 objects) so the task executes again, with the egress policy polled",
|
||||
"exit": 0,
|
||||
"seconds_submit_to_done": 24,
|
||||
"tar_put_at": "2026-10-02T19:39:38+00:00",
|
||||
"collected_at": "2026-10-02T19:39:40+00:00",
|
||||
"put_to_collect_seconds": 2,
|
||||
"file": "smoke-run-store-2.txt"
|
||||
}
|
||||
},
|
||||
"objects_delivered_to_the_store": {
|
||||
"runs/ax-e2e-smoke/facts/output.tar": 10240,
|
||||
"runs/ax-e2e-smoke/facts/facts.json": 451,
|
||||
"runs/ax-e2e-smoke/facts/summary.json": 238,
|
||||
"runs/ax-e2e-smoke/facts/done.json": 149,
|
||||
"runs/ax-e2e-smoke/state.json": 350,
|
||||
"note": "units.jsonl is extracted locally but not a declared output of the smoke Run, so it is not re-put"
|
||||
},
|
||||
"egress_policy_read_back": {
|
||||
"how": "kubectl ate get egress-policy ax-e2e-smoke-facts -a default -o json, polled while the actor lived (file egress-policy-read-back.json)",
|
||||
"rules": [{"tlsPassthrough": {"hostnames": ["files.because-security.com"], "ports": {"numbers": [443]}}}],
|
||||
"reading": "one TLS rule naming the store host, no http rule; the model-free smoke task names no Git host and no Model host",
|
||||
"also": "Egress.apply reads every policy back and raises on a mismatch, so each completed Run is itself the equality check"
|
||||
},
|
||||
"status_table": "ousast plane status ax-e2e-smoke printed the attribution table (facts: done, calls 0) in every run; the table is in the smoke-run-*.txt files",
|
||||
"reconciler_lines": {"after_2_4": 549, "bound": 550, "note": "both paths coexist until 2.6; the receiver wiring goes then"},
|
||||
"gates": {
|
||||
"2.1": "pytest 2020 passed, 42 skipped, exit 0; ruff 0; format 0; mypy 0",
|
||||
"2.2": "pytest 2024 passed, 42 skipped, exit 0; ruff 0; format 0; mypy 0",
|
||||
"2.3": "pytest 2027 passed, 42 skipped, exit 0; ruff 0; format 0; mypy 0",
|
||||
"2.4": "pytest 2031 passed, 42 skipped, exit 0; ruff 0; format 0; mypy 0",
|
||||
"2.5": "pytest 2031 passed, 42 skipped, exit 0; ruff 0; format 0; mypy 0 (first attempt 2026-10-02: 11 failed + 5 errors, all the FileStore 1 GiB free-space refusal at 0.97 GiB free; rerun after the disk was freed)"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,9 @@
|
||||
run finished: done
|
||||
memory s3://sast-memory: ax-e2e-smoke: 0 tasks ingested, 0 already in the index; rows none
|
||||
run ax-e2e-smoke: done (/tmp/claude-1000/-home-mc-Source-OpenUltraSAST/c09e30b2-39a4-4564-bc31-6ea71ffaa198/scratchpad/k8s-impl/results/plane/ax-e2e-smoke)
|
||||
|
||||
TASK MODEL CALLS PROMPT CACHE-HIT OUTPUT USD
|
||||
facts - n/a n/a n/a n/a n/a [done]
|
||||
----------------------------------------------------------------------------------------------------
|
||||
total - n/a n/a n/a n/a n/a
|
||||
smoke exit=0 seconds=2
|
||||
@@ -0,0 +1,9 @@
|
||||
run finished: done
|
||||
memory s3://sast-memory: ax-e2e-smoke: 0 tasks ingested, 0 already in the index; rows none
|
||||
run ax-e2e-smoke: done (/tmp/claude-1000/-home-mc-Source-OpenUltraSAST/c09e30b2-39a4-4564-bc31-6ea71ffaa198/scratchpad/k8s-impl/results/plane/ax-e2e-smoke)
|
||||
|
||||
TASK MODEL CALLS PROMPT CACHE-HIT OUTPUT USD
|
||||
facts - 0 n/a n/a n/a n/a [done]
|
||||
----------------------------------------------------------------------------------------------------
|
||||
total - n/a n/a n/a n/a n/a
|
||||
smoke exit=0 seconds=26
|
||||
@@ -0,0 +1,9 @@
|
||||
run finished: done
|
||||
memory s3://sast-memory: ax-e2e-smoke: 0 tasks ingested, 0 already in the index; rows none
|
||||
run ax-e2e-smoke: done (/tmp/claude-1000/-home-mc-Source-OpenUltraSAST/c09e30b2-39a4-4564-bc31-6ea71ffaa198/scratchpad/k8s-impl/results/plane/ax-e2e-smoke)
|
||||
|
||||
TASK MODEL CALLS PROMPT CACHE-HIT OUTPUT USD
|
||||
facts - 0 n/a n/a n/a n/a [done]
|
||||
----------------------------------------------------------------------------------------------------
|
||||
total - n/a n/a n/a n/a n/a
|
||||
smoke exit=0 seconds=24
|
||||
@@ -0,0 +1,36 @@
|
||||
{
|
||||
"store": "s3://sast-memory",
|
||||
"objects_under_run": {
|
||||
"runs/ax-e2e-smoke/facts/done.json": 149,
|
||||
"runs/ax-e2e-smoke/facts/facts.json": 451,
|
||||
"runs/ax-e2e-smoke/facts/output.tar": 10240,
|
||||
"runs/ax-e2e-smoke/facts/summary.json": 238,
|
||||
"runs/ax-e2e-smoke/state.json": 350
|
||||
},
|
||||
"tar_bytes": 10240,
|
||||
"tar_members": {
|
||||
"facts.json": 451,
|
||||
"summary.json": 238,
|
||||
"units.jsonl": 291
|
||||
},
|
||||
"extracted_files": {
|
||||
"facts.json": 451,
|
||||
"units.jsonl": 291,
|
||||
"summary.json": 238
|
||||
},
|
||||
"members_equal_extracted": true,
|
||||
"member_bytes_total": 980,
|
||||
"extracted_bytes_total": 980,
|
||||
"done_json": {
|
||||
"bytes": 10240,
|
||||
"files": 3,
|
||||
"finished": "2026-10-02T19:39:40+00:00",
|
||||
"published": [
|
||||
"facts.json",
|
||||
"summary.json"
|
||||
],
|
||||
"status": "done",
|
||||
"task": "facts"
|
||||
},
|
||||
"tar_put_at_last_modified": "2026-10-02T19:39:38+00:00"
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
|
||||
== kind cluster 'ousast' (context kind-ousast) + registry localhost:5001 (21:36:18)
|
||||
cluster exists; kept
|
||||
|
||||
== agent substrate (ate-system) (21:36:18)
|
||||
substrate ready; kept
|
||||
NAME READY STATUS RESTARTS AGE
|
||||
ate-api-server-647bb6f8b6-c9k5k 1/1 Running 2 (13h ago) 3d1h
|
||||
ate-api-server-647bb6f8b6-dznjn 1/1 Running 1 (13h ago) 3d1h
|
||||
ate-controller-c95586684-g7nvn 1/1 Running 0 3d3h
|
||||
atelet-4f9c293-9zpfg 1/1 Running 0 3d3h
|
||||
atenet-egress-d74b8f6bf-8zmxj 1/1 Running 0 3d1h
|
||||
atenet-router-54887bc8f9-rqs6g 2/2 Running 2 (13h ago) 3d3h
|
||||
postgres-0 2/2 Running 3 (3d3h ago) 3d3h
|
||||
rustfs-6c4c677cb6-cqvhc 1/1 Running 3 (3d3h ago) 3d3h
|
||||
rustfs-bucket-init-nvfr6 0/1 Completed 0 3d3h
|
||||
|
||||
== egress gateway (atenet-egress, agentgateway variant: one prebuilt image, nothing built) (21:36:18)
|
||||
gateway present; kept
|
||||
|
||||
== ax control plane (ax-system) (21:36:19)
|
||||
ax ready; kept
|
||||
NAME READY STATUS RESTARTS AGE
|
||||
ax-redis-86df786c87-pz5tp 1/1 Running 0 3d3h
|
||||
ax-server-b479bdc76-hwkqb 1/1 Running 0 3d3h
|
||||
ousast-pool-6656b55f5b-5brkn 1/1 Running 0 66m
|
||||
ousast-pool-6656b55f5b-9wbrw 1/1 Running 0 3d3h
|
||||
|
||||
== artifact receiver Service (ousast-receiver.ax-system -> this host) (21:36:19)
|
||||
service/ousast-receiver unchanged
|
||||
endpointslice.discovery.k8s.io/ousast-receiver-host configured
|
||||
|
||||
== worker pool (gVisor): pools.default of the profile (21:36:20)
|
||||
pool ousast-pool exists (2/2 ready); kept
|
||||
pod/ousast-pool-6656b55f5b-5brkn condition met
|
||||
pod/ousast-pool-6656b55f5b-9wbrw condition met
|
||||
|
||||
== runner image localhost:5001/ousast-runner (21:36:21)
|
||||
sha256:0501baf180b29f7aa7bbb8888bebabfc5d62429b7bdaa7f5a62b5b188f8ad5f6
|
||||
localhost:5001/ousast-runner:dev
|
||||
runner image localhost:5001/ousast-runner@sha256:d2a55293999cc34581ef1f02a1ffb0c2dd8fc0cbe001ac952df81600e868f019 -> /home/mc/Source/OpenUltraSAST/.claude/worktrees/agent-a7d4724e0c0c407a8/ops/k8s/profiles/kind-images.json
|
||||
re-pin the templates with: ousast plane workspaces ... --runner-image /home/mc/Source/OpenUltraSAST/.claude/worktrees/agent-a7d4724e0c0c407a8/ops/k8s/profiles/kind-images.json (or ousast plane repin, task 4.3)
|
||||
|
||||
== ax CLI from the deployed checkout (a release CLI skews from the server) (21:36:32)
|
||||
ax CLI newer than the checkout; kept
|
||||
|
||||
== smoke task (21:36:32)
|
||||
task.ax.io/ousast-smoke created
|
||||
workspace.ax.io/ousast-smoke-ws unchanged
|
||||
task.ax.io/ousast-smoke resumed
|
||||
NAME ATESPACE PHASE ACTOR WORKER-IP AGE
|
||||
ousast-smoke default Running ousast-smoke 10.244.0.29 4s
|
||||
|
||||
== footprint (21:36:38)
|
||||
total used free shared buff/cache available
|
||||
Mem: 7877 5202 382 63 2903 2674
|
||||
kind-registry 32.45MiB / 7.693GiB 0.00%
|
||||
up.sh exit 0
|
||||
Reference in New Issue
Block a user