From c8d2fefbb82f876f3d0a13f7d71941b20fbd193e Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Fri, 2 Oct 2026 08:19:48 +0200 Subject: [PATCH] docs(kiro): archive the superseded roadmap; status notes on specs A4: roadmap-2026-09-04.md moves to .kiro/archive/steering/ so it no longer loads as steering (roadmap.md and safety-net.md replaced it); roadmap.md's pointer follows it. overview.md's spec table is recounted from tasks.md and spec.json (adds ai-service-plane, harnessx-removal, learned-decision-engine, pre-push-safety-net; drops the stale "active one"), and the module line now cites the regenerated audit: 150 modules, 145 load-bearing, 5 standalone, 0 orphaned; 1,964 tests collected. A5: a dated status note at the top of the requirements (or brief) of 16 specs: retired, superseded, dormant or complete, and for model-grounded-detection the removal of judge/calibrate/execution (closing the Req 10 execution-tier option). spec.json phase corrected to implementation-complete where every task is checked (model-grounded- detection, propose-adjudicate-prove, tree-sitter-overlay-extra, corpus-seeded-mechanisms, pair-corpus-honesty); openrouter-sast-harness gets a spec.json with status retired. Nothing deleted, no spec moved. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo --- .../steering/roadmap-2026-09-04.md | 0 .../authorization-obligations/requirements.md | 2 ++ .../constrained-detector/requirements.md | 2 ++ .../corpus-seeded-mechanisms/requirements.md | 2 ++ .../specs/corpus-seeded-mechanisms/spec.json | 4 ++-- .kiro/specs/flow-aware-ranking/brief.md | 2 ++ .../requirements.md | 2 ++ .kiro/specs/ir-consolidation/brief.md | 2 ++ .kiro/specs/learning-harness/requirements.md | 2 ++ .../model-grounded-detection/requirements.md | 2 ++ .../specs/model-grounded-detection/spec.json | 4 ++-- .../openrouter-sast-harness/requirements.md | 2 ++ .kiro/specs/openrouter-sast-harness/spec.json | 7 ++++++ .../specs/pair-corpus-honesty/requirements.md | 2 ++ .kiro/specs/pair-corpus-honesty/spec.json | 4 ++-- .../propose-adjudicate-prove/requirements.md | 2 ++ .../specs/propose-adjudicate-prove/spec.json | 4 ++-- .../reachability-flow-model/requirements.md | 2 ++ .../real-world-vfc-slice/requirements.md | 2 ++ .kiro/specs/three-stage-scan/requirements.md | 2 ++ .../tree-sitter-overlay-extra/requirements.md | 2 ++ .../specs/tree-sitter-overlay-extra/spec.json | 4 ++-- .kiro/specs/zero-with-a-reason/brief.md | 2 ++ .kiro/steering/overview.md | 23 ++++++++++++------- .kiro/steering/roadmap.md | 2 +- 25 files changed, 65 insertions(+), 19 deletions(-) rename .kiro/{ => archive}/steering/roadmap-2026-09-04.md (100%) create mode 100644 .kiro/specs/openrouter-sast-harness/spec.json diff --git a/.kiro/steering/roadmap-2026-09-04.md b/.kiro/archive/steering/roadmap-2026-09-04.md similarity index 100% rename from .kiro/steering/roadmap-2026-09-04.md rename to .kiro/archive/steering/roadmap-2026-09-04.md diff --git a/.kiro/specs/authorization-obligations/requirements.md b/.kiro/specs/authorization-obligations/requirements.md index 6f4f116..8f76430 100644 --- a/.kiro/specs/authorization-obligations/requirements.md +++ b/.kiro/specs/authorization-obligations/requirements.md @@ -1,5 +1,7 @@ # Requirements Document +> **Status 2026-10-02:** dormant. Tasks were approved but none of the 24 was started; the absence-bug case it targets is handled in practice by the dominance arbiter (`model/dominance.py`) and `semantic/obligations/`. Reopen it only with a measured gap the arbiter misses. + ## Introduction AppSec engineers and maintainers of OpenUltraSAST scan web code, increasingly vibe-coded or agent-written, in which the dominant bugs are absences rather than flows: a handler queries a user-owned record without constraining it to the caller, a privileged route has no guard on its path, an identity is read from the request body instead of the authenticated context, a security control stays at its permissive default. Today the detector, the overlay, and the variant search model only source-to-sink flows, so these pairs score zero and cannot teach a mechanism (6 of 19 non-teaching vibe-py pairs; 15 of 29 agent-vfc rows carry absence labels). This spec adds obligations: an operation that must be discharged by a guard, an identity constraint, or a safe value before it is reached. The application's own policy, recovered from the consistency of its sibling handlers and optionally declared in a versioned file, says which operations carry which obligations. Violations are reported with the missing discharger and its evidence, measured leave-one-out on the absence pairs, and admitted into the detector through the existing improve-loop gate. diff --git a/.kiro/specs/constrained-detector/requirements.md b/.kiro/specs/constrained-detector/requirements.md index f76b752..9c1ff8d 100644 --- a/.kiro/specs/constrained-detector/requirements.md +++ b/.kiro/specs/constrained-detector/requirements.md @@ -1,5 +1,7 @@ # Requirements Document +> **Status 2026-10-02:** superseded by `model-grounded-detection` (spec.json `superseded_by`). 4 of 20 tasks were done and the tasks were never approved; none will be. Kept as decision history; nothing in src, tests or CI points here. + ## Introduction The detector's instability is structural, not statistical. Measured on 2026-09-06 over twelve injection pairs at diff --git a/.kiro/specs/corpus-seeded-mechanisms/requirements.md b/.kiro/specs/corpus-seeded-mechanisms/requirements.md index 2d642c1..69b08b5 100644 --- a/.kiro/specs/corpus-seeded-mechanisms/requirements.md +++ b/.kiro/specs/corpus-seeded-mechanisms/requirements.md @@ -1,5 +1,7 @@ # Requirements Document +> **Status 2026-10-02:** complete, 17 of 17 tasks (spec.json phase corrected to `implementation-complete`). Its `[variants]` config keys were retired on 2026-10-02: the variant search they configured (`semantic/variants.py`) had already been deleted. + ## Introduction OpenUltraSAST's labeled pair corpus measures the detector but does not improve it, and its mechanism memory is empty because only sandbox-proven findings may write to it. This spec turns every trusted pair into a mechanism record, adds a structural variant search that proposes matches on any scanned tree, measures the corpus's own detection rate leave-one-out, and gives the improve loop a lever that can raise recall under the existing false-positive ceiling and per-profile holdout gate. diff --git a/.kiro/specs/corpus-seeded-mechanisms/spec.json b/.kiro/specs/corpus-seeded-mechanisms/spec.json index 2fa9d26..7085857 100644 --- a/.kiro/specs/corpus-seeded-mechanisms/spec.json +++ b/.kiro/specs/corpus-seeded-mechanisms/spec.json @@ -1,9 +1,9 @@ { "feature_name": "corpus-seeded-mechanisms", "created_at": "2026-09-05T06:18:31Z", - "updated_at": "2026-09-05T16:30:00Z", + "updated_at": "2026-10-02T00:00:00Z", "language": "en", - "phase": "implementation", + "phase": "implementation-complete", "approvals": { "requirements": { "generated": true, diff --git a/.kiro/specs/flow-aware-ranking/brief.md b/.kiro/specs/flow-aware-ranking/brief.md index 2ce9fc3..f2a4fb4 100644 --- a/.kiro/specs/flow-aware-ranking/brief.md +++ b/.kiro/specs/flow-aware-ranking/brief.md @@ -1,5 +1,7 @@ # Brief: flow-aware-ranking — spend the expensive query where the cheap evidence is strongest +> **Status 2026-10-02:** dormant. Brief only and unapproved; its 2026-09-12 amendment placed ranking inside the pre-push safety net, where the ranker now lives. + **Status:** brief only, unapproved. ## Current amendment — 2026-09-12 diff --git a/.kiro/specs/harnessx-self-improving-rulesets/requirements.md b/.kiro/specs/harnessx-self-improving-rulesets/requirements.md index 1cf674c..46cc369 100644 --- a/.kiro/specs/harnessx-self-improving-rulesets/requirements.md +++ b/.kiro/specs/harnessx-self-improving-rulesets/requirements.md @@ -1,5 +1,7 @@ # Requirements Document +> **Status 2026-10-02:** retired with HarnessX (see the note below). Its task 6.3 modules `stage_processors.py` and `slot_contract.py` were deleted on 2026-10-02: nothing imported them. Kept as decision history; nothing in src, tests or CI points here. + > **Retired 2026-09-30:** HarnessX was removed by `harnessx-removal`; the agentic plane is ax > (`ai-service-plane`), and evolutionary proposals come from the plane memory. History below is unchanged. diff --git a/.kiro/specs/ir-consolidation/brief.md b/.kiro/specs/ir-consolidation/brief.md index b2ad9fa..fc3bd1d 100644 --- a/.kiro/specs/ir-consolidation/brief.md +++ b/.kiro/specs/ir-consolidation/brief.md @@ -1,5 +1,7 @@ # Brief: ir-consolidation — stop maintaining an IR we did not need, and adopt one we do +> **Status 2026-10-02:** dormant. Brief only and unapproved. The subtraction it asks for still needs a measured recall comparison before the flat IR goes. + **Status:** brief only, unapproved. ## Why now diff --git a/.kiro/specs/learning-harness/requirements.md b/.kiro/specs/learning-harness/requirements.md index 93ba62a..844d1ee 100644 --- a/.kiro/specs/learning-harness/requirements.md +++ b/.kiro/specs/learning-harness/requirements.md @@ -1,5 +1,7 @@ # Requirements Document +> **Status 2026-10-02:** retired, superseded by `model-grounded-detection` (spec.json `superseded_by`). 30 of 33 tasks were done; the open three will not be. Kept as decision history; nothing in src, tests or CI points here. + > **Retired 2026-09-30:** HarnessX was removed by `harnessx-removal`; the agentic plane is ax > (`ai-service-plane`), and evolutionary proposals come from the plane memory. History below is unchanged. diff --git a/.kiro/specs/model-grounded-detection/requirements.md b/.kiro/specs/model-grounded-detection/requirements.md index a27d3dc..9468369 100644 --- a/.kiro/specs/model-grounded-detection/requirements.md +++ b/.kiro/specs/model-grounded-detection/requirements.md @@ -1,5 +1,7 @@ # Requirements Document: model-grounded-detection +> **Status 2026-10-02:** complete, 16 of 16 tasks (spec.json phase corrected to `implementation-complete`). On 2026-10-02 three of its modules were deleted because nothing imported them: `model/judge.py` (Req 8; `model/pipeline.py` does the judging), `model/calibrate.py` (Req 9; the decision engine's `learn/calibrate.py` is the live calibration) and `model/execution.py`. Deleting `execution.py` closes the Req 10 execution-tier option: a future execution tier is a new design, not this seam. + ## Introduction This feature supersedes `learning-harness` and `constrained-detector`. It replaces the assumption that the LLM diff --git a/.kiro/specs/model-grounded-detection/spec.json b/.kiro/specs/model-grounded-detection/spec.json index 83b4d93..b904778 100644 --- a/.kiro/specs/model-grounded-detection/spec.json +++ b/.kiro/specs/model-grounded-detection/spec.json @@ -1,9 +1,9 @@ { "feature_name": "model-grounded-detection", "created_at": "2026-09-08T00:00:00Z", - "updated_at": "2026-09-08T10:00:00Z", + "updated_at": "2026-10-02T00:00:00Z", "language": "en", - "phase": "implementation", + "phase": "implementation-complete", "approvals": { "requirements": { "generated": true, diff --git a/.kiro/specs/openrouter-sast-harness/requirements.md b/.kiro/specs/openrouter-sast-harness/requirements.md index 48cd012..2bb5b54 100644 --- a/.kiro/specs/openrouter-sast-harness/requirements.md +++ b/.kiro/specs/openrouter-sast-harness/requirements.md @@ -1,5 +1,7 @@ # Requirements: OpenRouter SAST Harness +> **Status 2026-10-02:** retired (see the note below). Its OpenCode skill `openultrasast-kiro-impl`, which still sent agents to this tasks.md, was deleted. Kept as decision history; nothing in src, tests or CI points here. + > **Retired 2026-09-30:** HarnessX was removed by `harnessx-removal`; the agentic plane is ax > (`ai-service-plane`), and evolutionary proposals come from the plane memory. History below is unchanged. diff --git a/.kiro/specs/openrouter-sast-harness/spec.json b/.kiro/specs/openrouter-sast-harness/spec.json new file mode 100644 index 0000000..cdd6815 --- /dev/null +++ b/.kiro/specs/openrouter-sast-harness/spec.json @@ -0,0 +1,7 @@ +{ + "feature_name": "openrouter-sast-harness", + "language": "en", + "status": "retired", + "updated_at": "2026-10-02T00:00:00Z", + "retired_note": "2026-09-30: HarnessX was removed by harnessx-removal; this spec had no spec.json before 2026-10-02 and is kept as decision history." +} diff --git a/.kiro/specs/pair-corpus-honesty/requirements.md b/.kiro/specs/pair-corpus-honesty/requirements.md index d5ce930..7aeca12 100644 --- a/.kiro/specs/pair-corpus-honesty/requirements.md +++ b/.kiro/specs/pair-corpus-honesty/requirements.md @@ -1,5 +1,7 @@ # Requirements Document +> **Status 2026-10-02:** complete, 32 of 32 tasks (spec.json phase corrected to `implementation-complete`). + ## Introduction Engineers evolving OpenUltraSAST's overlay cannot trust the pair scoreboard: coverage detections are dropped, vfc labels mostly say `sink = "unknown"`, a quarter of the vfc corpus fails to parse because excerpts start mid-comment, two sast pairs are unlabelable as vendored, and there is no Node/TypeScript/Python web corpus and no agent-authored corpus. This spec makes the scoreboard honest per slice, per mechanism, and per provenance, adds three web and agent-authored slices, and lets the improve loop accept a change only when no provenance profile regresses. It supersedes `real-world-vfc-slice` for the corpus and scorer plane. diff --git a/.kiro/specs/pair-corpus-honesty/spec.json b/.kiro/specs/pair-corpus-honesty/spec.json index d2a53fc..f3a4c8b 100644 --- a/.kiro/specs/pair-corpus-honesty/spec.json +++ b/.kiro/specs/pair-corpus-honesty/spec.json @@ -1,9 +1,9 @@ { "feature_name": "pair-corpus-honesty", "created_at": "2026-09-04T16:12:17Z", - "updated_at": "2026-09-05T12:30:00Z", + "updated_at": "2026-10-02T00:00:00Z", "language": "en", - "phase": "implementation", + "phase": "implementation-complete", "supersedes": [ "real-world-vfc-slice" ], diff --git a/.kiro/specs/propose-adjudicate-prove/requirements.md b/.kiro/specs/propose-adjudicate-prove/requirements.md index c179bbe..78cf323 100644 --- a/.kiro/specs/propose-adjudicate-prove/requirements.md +++ b/.kiro/specs/propose-adjudicate-prove/requirements.md @@ -1,5 +1,7 @@ # Requirements Document +> **Status 2026-10-02:** complete, 22 of 22 tasks (spec.json phase corrected to `implementation-complete`). + ## Introduction OpenUltraSAST users scan **working trees they are writing**: mixed files, incomplete edits, generated code, framework wrappers, and no labels. Today the harness still *decides* with pattern inventory. The complexity map ranks; the sandbox can run; neither adjudicates “this sink is fed by a source” versus “this sink is hardcoded, sanitized, or unreadable.” diff --git a/.kiro/specs/propose-adjudicate-prove/spec.json b/.kiro/specs/propose-adjudicate-prove/spec.json index 489c2a8..cdfb021 100644 --- a/.kiro/specs/propose-adjudicate-prove/spec.json +++ b/.kiro/specs/propose-adjudicate-prove/spec.json @@ -1,9 +1,9 @@ { "feature_name": "propose-adjudicate-prove", "created_at": "2026-09-04T10:58:28Z", - "updated_at": "2026-09-04T12:00:00Z", + "updated_at": "2026-10-02T00:00:00Z", "language": "en", - "phase": "implementation", + "phase": "implementation-complete", "approvals": { "requirements": { "generated": true, diff --git a/.kiro/specs/reachability-flow-model/requirements.md b/.kiro/specs/reachability-flow-model/requirements.md index b0975b8..a43bc49 100644 --- a/.kiro/specs/reachability-flow-model/requirements.md +++ b/.kiro/specs/reachability-flow-model/requirements.md @@ -1,5 +1,7 @@ # Requirements Document +> **Status 2026-10-02:** dormant. 23 tasks generated, nothing approved; adopting Joern (`cpg/`, `model/taint.py`) delivered most of what it asked for. Reopen it only for a reachability gap Joern's taint does not cover. + ## Introduction OpenUltraSAST cannot yet steer effort where risk is reduced because it has no model of how an entry point reaches a sink. Reachability today means "inside a handler," taint is one hop inside one file, the LLM hunter cannot create a sandbox candidate, and the improve loop cannot add the facts that would raise recall. This spec adds a call graph and composed taint summaries over the existing `FunctionIR` records, attaches path-based reachability to findings and ranking, puts the hunter on paths with one checkable question per gap, turns model answers into gated facts, and ranks fix points by reachable risk removed. Concolic execution is out of scope; the sandbox remains the only place target code runs. diff --git a/.kiro/specs/real-world-vfc-slice/requirements.md b/.kiro/specs/real-world-vfc-slice/requirements.md index 2473083..9387009 100644 --- a/.kiro/specs/real-world-vfc-slice/requirements.md +++ b/.kiro/specs/real-world-vfc-slice/requirements.md @@ -1,5 +1,7 @@ # Requirements Document +> **Status 2026-10-02:** superseded by `pair-corpus-honesty` (spec.json `superseded_by`); its 12 tasks were done and the vfc pairs live on in that spec's corpus. Kept as decision history; nothing in src, tests or CI points here. + ## Introduction AppSec engineers cannot tell whether OpenUltraSAST improved on real product code. The labeled pair slices today are in-tree fixtures (`local`), small GitHub/SVEN functions (`github`), and textbook OWASP/Juliet files (`sast`). Operators care whether the harness fires on a real buggy snapshot of OpenSSL, Firefox, or Chromium and stays quiet after the patch. This spec adds a reviewed, isolated-function **vfc** slice drawn from public vulnerability-fixing commits in those projects, scored as an honesty dashboard (not a merge gate), so the tool can be evolved against labeled product code instead of cheat-sheet recall. diff --git a/.kiro/specs/three-stage-scan/requirements.md b/.kiro/specs/three-stage-scan/requirements.md index 200aa9b..4c0394c 100644 --- a/.kiro/specs/three-stage-scan/requirements.md +++ b/.kiro/specs/three-stage-scan/requirements.md @@ -1,5 +1,7 @@ # Requirements Document +> **Status 2026-10-02:** retired (see the note below); all 31 tasks were done before HarnessX was removed. Kept as decision history; nothing in src, tests or CI points here. + > **Retired 2026-09-30:** HarnessX was removed by `harnessx-removal`; the agentic plane is ax > (`ai-service-plane`), and evolutionary proposals come from the plane memory. History below is unchanged. diff --git a/.kiro/specs/tree-sitter-overlay-extra/requirements.md b/.kiro/specs/tree-sitter-overlay-extra/requirements.md index 7030dd0..96296ac 100644 --- a/.kiro/specs/tree-sitter-overlay-extra/requirements.md +++ b/.kiro/specs/tree-sitter-overlay-extra/requirements.md @@ -1,5 +1,7 @@ # Requirements Document +> **Status 2026-10-02:** complete, 13 of 13 tasks (spec.json phase corrected from `tasks-generated` to `implementation-complete`). + ## Introduction AppSec engineers scanning mixed working trees need overlay adjudication on Python, JavaScript, C/C++, and Java, not only on files a Python stdlib parse can read. Today a `standard` or `deep` scan leaves JS/C/Java inventory as `language_unsupported` even when a host parser CLI is present, so those proposals never promote or demote. This spec makes an **optional semantic extra** the way to turn on a real structured parse for those languages, while `quick` stays usable with no extra packages and a missing extra stays fail-closed. diff --git a/.kiro/specs/tree-sitter-overlay-extra/spec.json b/.kiro/specs/tree-sitter-overlay-extra/spec.json index fe3f2c5..637776d 100644 --- a/.kiro/specs/tree-sitter-overlay-extra/spec.json +++ b/.kiro/specs/tree-sitter-overlay-extra/spec.json @@ -1,9 +1,9 @@ { "feature_name": "tree-sitter-overlay-extra", "created_at": "2026-09-04T14:00:00Z", - "updated_at": "2026-09-04T15:00:00Z", + "updated_at": "2026-10-02T00:00:00Z", "language": "en", - "phase": "tasks-generated", + "phase": "implementation-complete", "approvals": { "requirements": { "generated": true, diff --git a/.kiro/specs/zero-with-a-reason/brief.md b/.kiro/specs/zero-with-a-reason/brief.md index 9df495f..bd2c69e 100644 --- a/.kiro/specs/zero-with-a-reason/brief.md +++ b/.kiro/specs/zero-with-a-reason/brief.md @@ -1,5 +1,7 @@ # Brief: zero-with-a-reason — a finding count is meaningless without a denominator +> **Status 2026-10-02:** dormant. Brief only and unapproved; not touched since 2026-09-10. + **Status:** brief only, unapproved. ## Why now diff --git a/.kiro/steering/overview.md b/.kiro/steering/overview.md index 237bd27..779082f 100644 --- a/.kiro/steering/overview.md +++ b/.kiro/steering/overview.md @@ -163,18 +163,25 @@ function-level pairs could not see any of them, and a repository showed all nine ## Where the specs stand +Counted 2026-10-02 from each spec's `tasks.md` checkboxes and `spec.json`. + | spec | phase | state | |---|---|---| -| `contributor-scan` | implementation | 14 done, 15 open — **the active one** | +| `learned-decision-engine` | implementation | 11 of 17 tasks done | +| `pre-push-safety-net` | implementation | 67 of 79 tasks done | +| `contributor-scan` | implementation | 27 of 51 tasks done | +| `ai-service-plane` | implementation | 11 of 11 tasks done; the ax plane is the agentic path | +| `harnessx-removal` | complete | 8 of 8; HarnessX removed 2026-09-30 | | `finding-feedback-loop` | design | requirements approved, design awaiting approval | -| `model-grounded-detection` | complete | 16/16; built the arbiter this all rests on | -| `authorization-obligations` | tasks approved | 24 open — superseded in practice by the dominance arbiter | -| `constrained-detector` | tasks | 4 of 20, tasks unapproved | -| `reachability-flow-model` | tasks generated | 23 open, nothing approved — largely delivered by adopting Joern | -| `learning-harness` | implementation | 30 done, 3 open | -| six others | complete | `pair-corpus-honesty`, `corpus-seeded-mechanisms`, `propose-adjudicate-prove`, `three-stage-scan`, `real-world-vfc-slice`, `harnessx-self-improving-rulesets`, `tree-sitter-overlay-extra` | +| `model-grounded-detection` | complete | 16 of 16; built the arbiter this all rests on | +| `authorization-obligations` | dormant | tasks approved, 0 of 24 started; superseded in practice by the dominance arbiter | +| `reachability-flow-model` | dormant | 23 tasks generated, nothing approved; largely delivered by adopting Joern | +| `flow-aware-ranking`, `zero-with-a-reason`, `ir-consolidation` | dormant | brief only, unapproved | +| four others | complete | `pair-corpus-honesty`, `corpus-seeded-mechanisms`, `propose-adjudicate-prove`, `tree-sitter-overlay-extra` | +| six others | retired or superseded | `openrouter-sast-harness`, `three-stage-scan`, `harnessx-self-improving-rulesets`, `learning-harness` (retired with HarnessX), `constrained-detector`, `real-world-vfc-slice` (superseded) | > **Retired 2026-09-30:** HarnessX was removed by `harnessx-removal`; the agentic plane is ax (`ai-service-plane`), > and evolutionary proposals come from the plane memory. The HarnessX specs in the table above are history. -97 source modules, 90 load-bearing and 7 standalone capabilities; 814 tests. +150 source modules, 145 load-bearing and 5 standalone capabilities, 0 orphaned +(`benchmarks/measurements/2026-09-08-module-audit.json`, regenerated 2026-10-02); 1,964 tests collected. diff --git a/.kiro/steering/roadmap.md b/.kiro/steering/roadmap.md index 1c25741..307c2fb 100644 --- a/.kiro/steering/roadmap.md +++ b/.kiro/steering/roadmap.md @@ -79,7 +79,7 @@ supersede this accepted sequence. Blocking deployment follows a later explicit d The sections below preserve prior plans and measurements. Statements about the current bottleneck, PHP coverage, rollout order or feature readiness are superseded by the current section above. -**Rewritten 2026-09-09.** The previous version (kept as `roadmap-2026-09-04.md`) described a pre-Joern world — +**Rewritten 2026-09-09.** The previous version (kept as `.kiro/archive/steering/roadmap-2026-09-04.md`, outside steering) described a pre-Joern world — "adjudication is still Python-`ast` plus a tree-sitter CLI stub", "Joern-as-required deferred". Joern was adopted, the model layer was built, wired and measured, and two repositories have been scanned. See `overview.md` for what is true today; this is what happens next and in what order.