From d02406e7580c316bb233c0c6ee8299b4addafc5d Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Sun, 13 Sep 2026 11:05:44 +0200 Subject: [PATCH] docs(pre-push-safety-net): record frontend retention prerequisite --- .../frontend-retention-prerequisite.md | 56 ++++++++ .kiro/specs/contributor-scan/spec.json | 9 +- .kiro/specs/contributor-scan/tasks.md | 8 ++ .kiro/specs/pre-push-safety-net/brief.md | 2 +- .kiro/specs/pre-push-safety-net/design.md | 12 ++ .../implementation-group-3.md | 45 +++++- .kiro/specs/pre-push-safety-net/research.md | 12 +- .kiro/specs/pre-push-safety-net/spec.json | 12 +- .kiro/specs/pre-push-safety-net/tasks.md | 3 +- .kiro/steering/roadmap.md | 12 +- .kiro/steering/safety-net.md | 4 +- ...026-09-13-partition-retention-blocker.json | 74 ++++++++++ ops/README.md | 21 +++ ops/smoke_partitions.py | 130 ++++++++++++++++++ 14 files changed, 387 insertions(+), 13 deletions(-) create mode 100644 .kiro/specs/contributor-scan/frontend-retention-prerequisite.md create mode 100644 benchmarks/measurements/2026-09-13-partition-retention-blocker.json create mode 100644 ops/smoke_partitions.py diff --git a/.kiro/specs/contributor-scan/frontend-retention-prerequisite.md b/.kiro/specs/contributor-scan/frontend-retention-prerequisite.md new file mode 100644 index 0000000..d893ee3 --- /dev/null +++ b/.kiro/specs/contributor-scan/frontend-retention-prerequisite.md @@ -0,0 +1,56 @@ +# Frontend input retention prerequisite + +Date: 2026-09-13. Status: proposed prerequisite, awaiting maintainer review. +Owner: contributor-scan. Blocks pre-push-safety-net task 3.4. + +## Confirmed problem + +The partition adapter supplies readable, original first-party JavaScript files, +including tests, but Joern 4.0.625 silently removes tests during graph generation. +The packaged probe read `server/api.js` (51 bytes) and `tests/probe.js` (41 bytes) +from the physical frontend input. The resulting graph contained only the server +file and its handler. Both autodetection and direct `jssrc2cpg` invocation failed +the same assertion. This is separate from the earlier PHP closure/query failure. + +Two upstream layers filter tests: + +- Pinned ASTGen 3.50.1 excludes test directories independently of user exclusions: + [defaults](https://raw.githubusercontent.com/joernio/astgen-monorepo/javascript-astgen/v3.50.1/javascript-astgen/src/Defaults.ts) + and [application](https://raw.githubusercontent.com/joernio/astgen-monorepo/javascript-astgen/v3.50.1/javascript-astgen/src/FileUtils.ts). +- Joern also unconditionally filters `.test.js`, `.spec.js`, `.mock.js` and `.e2e.js`: + [pinned frontend implementation](https://raw.githubusercontent.com/joernio/joern/v4.0.625/joern-cli/frontends/jssrc2cpg/src/main/scala/io/joern/jssrc2cpg/utils/AstGenRunner.scala). + +Installed help and versioned configuration provide no supported inclusion override. +Failure evidence is retained in +`benchmarks/measurements/2026-09-13-partition-retention-blocker.json`. +An independent Kiro debug investigation returned `STOP_FOR_HUMAN`: a foundation +prerequisite is missing from the approved downstream implementation sequence. + +## Proposed prerequisite for approval + +Establish a reproducible frontend input policy that retains explicitly supplied +first-party JavaScript source, including test directories and filename patterns. +The foundation owns any versioned dependency adaptation required in both ASTGen +and jssrc2cpg. Record the exact sources, checksums, build recipe and invocation +policy; a frontend upgrade or patch must preserve the existing native PHP and +JavaScript engine regressions. Prefer a supported upstream inclusion mechanism if +one becomes available; the pinned version currently has none. + +Keep source paths, bytes, imports and graph semantics intact. Do not rename test +files, split them into disconnected graphs, restore vendor code, or weaken the +retention criterion to make a smoke pass. Continue treating tests as unshipped +ranker candidates. Report actual frontend omissions as incomplete coverage. + +## Acceptance and handoff + +1. A packaged census proves exact file and method nodes for ordinary first-party + source, `tests/` contents and `.test.js`, `.spec.js`, `.mock.js`, `.e2e.js` files. + The fixture must read and print the original input byte counts first. +2. Declared vendor and node_modules paths and their unique methods remain absent. +3. Existing native PHP/JavaScript graph, query, context and deadline regressions + pass; unsupported constructs still produce explicit coverage limits. +4. Rebuild the image and rerun `ops/smoke_partitions.py`, then independently review + and verify pre-push task 3.4 before checking it off or starting dependent work. + +This proposal changes the dependency work required before task 3.4 can complete. +It does not approve a new engine version, a dependency patch or capability admission. diff --git a/.kiro/specs/contributor-scan/spec.json b/.kiro/specs/contributor-scan/spec.json index f6ae709..6bf7e1a 100644 --- a/.kiro/specs/contributor-scan/spec.json +++ b/.kiro/specs/contributor-scan/spec.json @@ -1,7 +1,7 @@ { "feature_name": "contributor-scan", "created_at": "2026-09-08T20:00:00Z", - "updated_at": "2026-09-12T15:35:00Z", + "updated_at": "2026-09-13T09:04:09.994054+00:00", "language": "en", "phase": "implementation", "approvals": { @@ -30,6 +30,13 @@ "topic": "Pre-push integration: shared deadline, reusable graph lease, exact ranker scope and provenance; preserve vendor exclusion.", "approved": false, "ready_for_implementation": false + }, + { + "date": "2026-09-13", + "document": "frontend-retention-prerequisite.md", + "topic": "Retain declared first-party JavaScript tests through ASTGen and jssrc2cpg; prerequisite for pre-push-safety-net 3.4.", + "approved": false, + "ready_for_implementation": false } ] } diff --git a/.kiro/specs/contributor-scan/tasks.md b/.kiro/specs/contributor-scan/tasks.md index 69a66f3..8fbf041 100644 --- a/.kiro/specs/contributor-scan/tasks.md +++ b/.kiro/specs/contributor-scan/tasks.md @@ -1185,3 +1185,11 @@ integration. They now live in `.kiro/specs/finding-feedback-loop/`, at brief, un Three requirements amendments this group argues for are drafted at the end of `requirements.md`, also unapproved: what a report may repeat, a family stating a class it cannot decide, and Req 4.1 requiring a checkout that can actually demonstrate detection. + +## Proposed prerequisite awaiting review — 2026-09-13 + +`frontend-retention-prerequisite.md` records a confirmed dependency gap blocking +pre-push-safety-net task 3.4: pinned JavaScript frontend filters remove declared +first-party tests. Its dependency adaptation and acceptance checks are proposed, +not added to the approved executable task list. Review this prerequisite before +resuming downstream partition completion. diff --git a/.kiro/specs/pre-push-safety-net/brief.md b/.kiro/specs/pre-push-safety-net/brief.md index 57de10b..24dcc54 100644 --- a/.kiro/specs/pre-push-safety-net/brief.md +++ b/.kiro/specs/pre-push-safety-net/brief.md @@ -1,6 +1,6 @@ # Brief: pre-push-safety-net -Status: requirements, design and tasks approved on 2026-09-12; groups 1 and 2 verified complete (7/27 subtasks); groups 3–8 pending. Language: English. +Status: requirements, design and tasks approved on 2026-09-12; groups 1 and 2 plus tasks 3.1–3.3 verified complete (10/27 subtasks); task 3.4 blocked on frontend test retention; groups 4–8 pending. Language: English. ## Problem diff --git a/.kiro/specs/pre-push-safety-net/design.md b/.kiro/specs/pre-push-safety-net/design.md index d1e71fe..7102f9f 100644 --- a/.kiro/specs/pre-push-safety-net/design.md +++ b/.kiro/specs/pre-push-safety-net/design.md @@ -241,6 +241,18 @@ modeled graph/facts/scope; unanswered evidence is never tier 0. ### Cache and Engine Boundary +The initial driver uses a generic `model/partitions.py` graph handle to route existing +question requests to physically filtered frontend inputs. It does not select questions: +one existing ranker order, region budget and `ScopeDecision` cover all partitions. +`PartitionCoverage` records language, frontend, input paths and byte count, excluded +paths, unshipped test paths, build status and capability boundaries. Query locations +return to repository-relative paths before change-context matching. Projection and +cleanup consume the same execution deadline and cancellation allowance as the backend. +Runtime origin is `unspecified` when no declaration establishes browser/server scope; +JavaScript presence alone does not admit an Express capability. TypeScript and C/C++ +retain explicit capability limits. These records prepare later artifact manifests; +they do not implement persistent graph storage. + Graph key: digest of every included blob/path and applicable declarations, frontend/engine version, overlay semantics/options, language, and exclusions. Query key additionally includes graph key, question/context/depth, facts/sanitizers, query code and relevant analysis configuration. Result key diff --git a/.kiro/specs/pre-push-safety-net/implementation-group-3.md b/.kiro/specs/pre-push-safety-net/implementation-group-3.md index c476c80..4977e16 100644 --- a/.kiro/specs/pre-push-safety-net/implementation-group-3.md +++ b/.kiro/specs/pre-push-safety-net/implementation-group-3.md @@ -15,7 +15,10 @@ coverage limits. ## Verification state -Implementation is in progress. No group-level completion claim is made yet. +Tasks 3.1–3.3 are independently approved and verified (10/27 tasks overall). +Task 3.4 is blocked on a confirmed frontend retention prerequisite; group 3 is +not complete. The proposed foundation repair is in +`../contributor-scan/frontend-retention-prerequisite.md`. ## Baseline @@ -126,3 +129,43 @@ These are controlled change-to-question/witness checks, not proof that the remov line enforced security, that the defect is new, or that a hook meets its latency bar. Ten of 27 tasks are now complete; task 3.4 remains for this group. + +## Task 3.4 blocked verification + +Claim type TASK; status NOT_VERIFIED. The implementer returned BLOCKED, and an +independent fresh-context Kiro debug investigation returned STOP_FOR_HUMAN with +high confidence: the approved sequence lacks a contributor-scan frontend input +retention prerequisite. There is no task completion or reviewer approval claim. + +The work in progress physically filters declared vendor inputs, routes explicit +language partitions through one existing ranker and deadline, and reports input, +excluded/test paths and unsupported coverage. Tests cover stale region paths, +symlink substitution, shared limits, partial census, normalized witness paths and +CLI propagation. Direct JavaScript frontend invocation establishes which engine +is called, but does not override its built-in input filters. + +The fresh full suite passed 1,138 tests with nine skipped in 106.05 seconds. Global +Ruff, formatting (227 files), mypy (109 source files), compileall and diff checks +passed. Detection (44/47, zero false positives in 44 controls), split-sink map and +local pair gates passed. The final direct frontend change required adapting one +budget-test runner to recognize its `-o` output argument; the test still verifies +deadline retention. Unit success does not override the failing real graph check. + +`benchmarks/measurements/2026-09-13-partition-retention-blocker.json` records exact +packaged source hashes, readable input witnesses, frontend help and failures. The +direct frontend input contained `server/api.js` (51 bytes) and `tests/probe.js` +(41 bytes), with original hashes verified. The graph contained only the server +file and handler. Both autodetection and direct `jssrc2cpg` probes exited 1 on the +retention assertion. The instrument correctly refused to report a passing smoke. +PHP and remaining end-of-scan assertions were not reached in this failing run. + +Pinned ASTGen 3.50.1 unconditionally excludes test directories; Joern 4.0.625 also +filters test filename suffixes. Installed/versioned options provide no supported +inclusion override. The upstream sources and concrete repair acceptance checks +are linked in the proposed prerequisite. Do not mark task 3.4 complete by moving +test files or declaring frontend omission acceptable. Its implementation remains +uncommitted pending the foundation repair, review and fresh runtime verification. + +The packaged failure preceded a comment-only clarification in `cpg/backend.py` +removing the disproven attribution to legacy frontend autodetection. No executable +backend behavior changed after that measurement. diff --git a/.kiro/specs/pre-push-safety-net/research.md b/.kiro/specs/pre-push-safety-net/research.md index ca4572f..6ae5397 100644 --- a/.kiro/specs/pre-push-safety-net/research.md +++ b/.kiro/specs/pre-push-safety-net/research.md @@ -6,7 +6,7 @@ - User direction: a scalable pre-push safety net as AI accelerates development; WordPress is one case. - Clarifications: advisory must be actionable, not SAST noise; the ranker is the scope mechanism; third-party vendor code must remain outside targets and graphs. -- Requirements, design and tasks are now approved, and groups 1 and 2 are verified complete; see +- Requirements, design and tasks are now approved, and groups 1 and 2 plus tasks 3.1–3.3 are verified complete; task 3.4 is blocked on JavaScript frontend test retention; see `tasks.md` for verified completion. The discovery log below preserves the earlier drafting state and measurements. No hook latency claim is made. @@ -157,3 +157,13 @@ setting environment variables alone is not evidence of either property. The snapshot adapter provides change evidence, not a second region selector. Source materialization, changed spans, and correspondence must remain language agnostic; unknown parser or correspondence boundaries cannot become a successful negative. + +### Group 3: frontend census invalidates completion + +Tasks 3.1–3.3 passed independent review and real engine checks. Task 3.4 passed +projection/ranking unit checks but failed a packaged graph census: 92 readable +JavaScript source bytes included a 41-byte test file that never reached the graph. +Direct frontend invocation reproduced the omission. Two unconditional upstream +test filters require an owning foundation repair; see +`../contributor-scan/frontend-retention-prerequisite.md`. The runtime failure is +not overridden by passing mocks, static checks or a populated server graph. diff --git a/.kiro/specs/pre-push-safety-net/spec.json b/.kiro/specs/pre-push-safety-net/spec.json index 5b749f6..47ae9aa 100644 --- a/.kiro/specs/pre-push-safety-net/spec.json +++ b/.kiro/specs/pre-push-safety-net/spec.json @@ -1,7 +1,7 @@ { "feature_name": "pre-push-safety-net", "created_at": "2026-09-12T15:35:00Z", - "updated_at": "2026-09-13T08:41:28.781759+00:00", + "updated_at": "2026-09-13T09:04:09.984662+00:00", "language": "en", "phase": "implementation", "approvals": { @@ -81,6 +81,14 @@ "implementation-group-2.md", "implementation-group-3.md" ], - "next_group": 3 + "next_group": 3, + "blocked_tasks": [ + { + "task": "3.4", + "reason": "Pinned JavaScript frontend silently excludes first-party tests; missing contributor-scan prerequisite.", + "record": "../contributor-scan/frontend-retention-prerequisite.md", + "next_action": "review_prerequisite" + } + ] } } diff --git a/.kiro/specs/pre-push-safety-net/tasks.md b/.kiro/specs/pre-push-safety-net/tasks.md index b428b67..1e6ad07 100644 --- a/.kiro/specs/pre-push-safety-net/tasks.md +++ b/.kiro/specs/pre-push-safety-net/tasks.md @@ -1,7 +1,7 @@ # Implementation Plan: pre-push-safety-net Status: task plan approved by the maintainer's "approve." on 2026-09-12. Groups 1 and 2 (tasks 1.1–2.3) -are complete after independent review and fresh verification. Group 3 is in progress (3.1–3.3 verified); groups 4–8 remain pending; +are complete after independent review and fresh verification. Group 3 has 3.1–3.3 verified; 3.4 is blocked on frontend test retention. Groups 4–8 remain pending; the hook and capability admission are not yet implemented. See `implementation-group-1.md` and `implementation-group-2.md`. ## Execution contract @@ -104,6 +104,7 @@ the hook and capability admission are not yet implemented. See `implementation-g - _Requirements: 2.1, 2.2, 2.4, 8.1, 8.2_ - _Verified 2026-09-13:_ independent review APPROVED after an unknown-call boundary repair; fresh suite 1,128 passed, nine skipped; global Ruff/format/mypy passed. Real PHP/JavaScript Git guard-removal snapshots reached unchanged helper-file witnesses with local dirty state preserved. Production negative regression reproduced then fixed unknown(req.body) being pruned as tier zero: modeled arguments no longer summarize unknown consumers. Existing ranking and detector semantics unchanged; unsupported projections remain explicit. Evidence: `benchmarks/measurements/2026-09-13-change-context-smoke.json`. Lexical attribution is not semantic novelty or alert admission. - [ ] 3.4 Apply vendor exclusion and explicit language partitions + - _Blocked:_ Joern 4.0.625/ASTGen 3.50.1 omit first-party JavaScript tests despite readable filtered inputs. Independent debug returned STOP_FOR_HUMAN; review the owning `contributor-scan/frontend-retention-prerequisite.md` before resuming. Implementation remains uncommitted and unapproved; runtime evidence: `benchmarks/measurements/2026-09-13-partition-retention-blocker.json`. - Reuse declared layout exclusions before target enumeration and graph build; retain unshipped first-party tests and separate browser/server or language capability coverage. - Build supported frontend partitions explicitly; preserve unknown cross-language and vendor semantics without restoring excluded sources. - Done when PHP and Node graphs/targets contain no declared vendor code, first-party callers remain visible, and unsupported partitions appear as coverage limits rather than clean results. diff --git a/.kiro/steering/roadmap.md b/.kiro/steering/roadmap.md index 6da404c..8365b00 100644 --- a/.kiro/steering/roadmap.md +++ b/.kiro/steering/roadmap.md @@ -46,14 +46,16 @@ engine are out of scope. - [ ] pre-push-safety-net — Immutable pushed tips, existing-ranker integration, compatible artifact reuse, total deadline, change attribution, actionability admission and compact hook behavior. Dependencies: contributor-scan. Requirements/design approved 2026-09-12; tasks generated - (8 groups, 27 executable subtasks), independently reviewed and approved; groups 1 and 2 are complete (7/27 tasks). + (8 groups, 27 executable subtasks), independently reviewed and approved; groups 1 and 2 and tasks 3.1–3.3 are complete (10/27 tasks); 3.4 is blocked. ### Next concrete step -Groups 1 and 2 have passed independent review: reproducible runtime, pinned inputs, honest scoring, -shared contracts, immutable push snapshots and lexical change context. Continue with group 3: one -execution budget, exact ranker scope, affected relationships and vendor/language partitions. See -`pre-push-safety-net/implementation-group-2.md` for evidence and limits. +Groups 1 and 2 and tasks 3.1–3.3 have passed independent review: runtime, inputs, +scoring, snapshots, shared deadline, exact ranker scope and change-context evidence. +Task 3.4 is blocked: real Joern graphs omit first-party JavaScript tests even though +filtered inputs contain them. Review `contributor-scan/frontend-retention-prerequisite.md`, +repair that foundation contract, then rerun the partition census and independent review. +See `pre-push-safety-net/implementation-group-3.md` for evidence and limits. The first complete experiment is 5.2, before persistent caching and hook installation work. Keep PMPro as the primary core-optimization example, then freeze the core and prove a changed security flow and its fixed twin on a JavaScript/Express Node API workload through diff --git a/.kiro/steering/safety-net.md b/.kiro/steering/safety-net.md index d220077..3c68a29 100644 --- a/.kiro/steering/safety-net.md +++ b/.kiro/steering/safety-net.md @@ -80,5 +80,7 @@ The product direction above is user-requested. The amended requirements, design evaluation profile in `pre-push-safety-net` were approved for task generation on 2026-09-12 ("ok, next kiro phase"). The maintainer then approved the task plan and starting group 1 ("approve.") and then group 2 ("ok, next kiro phase, approved"). Groups 1 and 2 are now verified -complete. Implementation is authorized under that plan; task completion still requires +complete, as are group 3 tasks 3.1–3.3 (10/27 total). Task 3.4 is blocked on a +confirmed frontend test-retention gap; review the proposed contributor-scan +frontend-retention prerequisite before resuming it. Implementation is authorized under that plan; task completion still requires independent review and fresh evidence. Hook performance and capability admission remain unproven. diff --git a/benchmarks/measurements/2026-09-13-partition-retention-blocker.json b/benchmarks/measurements/2026-09-13-partition-retention-blocker.json new file mode 100644 index 0000000..7f129fb --- /dev/null +++ b/benchmarks/measurements/2026-09-13-partition-retention-blocker.json @@ -0,0 +1,74 @@ +{ + "recorded_at": "2026-09-13T09:02:43.918546+00:00", + "task": "3.4", + "verification": "NOT_VERIFIED", + "image_id": "sha256:81ba1ecb10a822ee5b7248573901529da55ae81ccc3ba642b69cec3ca751b941", + "build_exit_code": 0, + "runtime_smoke_exit_code": 1, + "packaged_source_hashes": { + "openultrasast.cpg.backend": "65c771a7f1218cbad37860dc1f8946c5dbf7df675720da9f64d027e546ff9a91", + "openultrasast.model.scan": "ad6f134c8fae43aa102b61d99f273b467415193d0b27fb634cae2586cb3c43ae", + "openultrasast.model.partitions": "c91970dbf536d4811e1980415a37e80348f38fbf9284ba469dfbac41c8215ac6", + "openultrasast.model.layout": "50a1a163459f8802037faae750bc1f99a0ab81912b571b40303675590794d27c", + "openultrasast.preprocess": "0d0b1f22fd2024be3e50dc1a9ff947eed7f8f60f67644277e344b83697aaefc8", + "openultrasast.cli": "79608d4a74bcceb5bd41b149cf806d25c4f71d8b3201d710217395941169bdc2" + }, + "script_sha256": "f42ca8ff8cc2c108eff69878a3bb9f4803493bc777e37c4f146db8378b8d1bab", + "runtime_read_and_graph_witnesses": [ + { + "frontend": "javascript", + "projected_inputs": { + "tests/probe.js": { + "bytes": 41, + "sha256": "182f7cb37514b7fc6afbba045a9d1b3ca5dc297c35bb98b9f34c18cfd02864f5" + }, + "server/api.js": { + "bytes": 51, + "sha256": "a9f1b897b9361d0d30250f82aebec987cfd99e66308c9ea889d5b6211e3cad5e" + } + } + }, + { + "frontend": "javascript", + "graph_witness": { + "files": [ + "server/api.js" + ], + "methods": [ + "js_handler", + ":program", + "eval", + ".fieldAccess", + ".assignment" + ] + } + } + ], + "runtime_failure": "{\"frontend\": \"javascript\", \"projected_inputs\": {\"tests/probe.js\": {\"bytes\": 41, \"sha256\": \"182f7cb37514b7fc6afbba045a9d1b3ca5dc297c35bb98b9f34c18cfd02864f5\"}, \"server/api.js\": {\"bytes\": 51, \"sha256\": \"a9f1b897b9361d0d30250f82aebec987cfd99e66308c9ea889d5b6211e3cad5e\"}}}\n{\"frontend\": \"javascript\", \"graph_witness\": {\"files\": [\"server/api.js\"], \"methods\": [\"js_handler\", \":program\", \"eval\", \".fieldAccess\", \".assignment\"]}}\nTraceback (most recent call last):\n File \"\", line 130, in \n File \"\", line 100, in main\n File \"/app/src/openultrasast/model/scan.py\", line 172, in scan_repository\n result = _scan_repository_impl(\n ^^^^^^^^^^^^^^^^^^^^^^\n File \"/app/src/openultrasast/model/scan.py\", line 234, in _scan_repository_impl\n cpg = build_partitions(\n ^^^^^^^^^^^^^^^^^\n File \"/app/src/openultrasast/model/partitions.py\", line 222, in build_partitions\n built = build(scratch, frontend) if complete else None\n ^^^^^^^^^^^^^^^^^^^^^^^^\n File \"/app/src/openultrasast/model/scan.py\", line 236, in \n lambda source, language: _build(backend, source, language, execution_budget=execution_budget),\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n File \"/app/src/openultrasast/model/scan.py\", line 815, in _build\n return backend.build(root, language=language, exclude=excluded, execution_budget=execution_budget)\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n File \"\", line 84, in build\nAssertionError: {'files': ['server/api.js'], 'methods': ['js_handler', ':program', 'eval', '.fieldAccess', '.assignment']}\n", + "installed_frontend_help": "ERROR StatusConsoleListener Could not determine local host name\n java.net.UnknownHostException: 85973dc1b7a6: 85973dc1b7a6: Temporary failure in name resolution\n\tat java.base/java.net.InetAddress.getLocalHost(Unknown Source)\n\tat org.apache.logging.log4j.core.util.NetUtils.getLocalHostname(NetUtils.java:56)\n\tat org.apache.logging.log4j.core.LoggerContext.lambda$setConfiguration$0(LoggerContext.java:615)\n\tat java.base/java.util.concurrent.ConcurrentHashMap.computeIfAbsent(Unknown Source)\n\tat org.apache.logging.log4j.core.LoggerContext.setConfiguration(LoggerContext.java:615)\n\tat org.apache.logging.log4j.core.LoggerContext.reconfigure(LoggerContext.java:694)\n\tat org.apache.logging.log4j.core.LoggerContext.reconfigure(LoggerContext.java:711)\n\tat org.apache.logging.log4j.core.LoggerContext.start(LoggerContext.java:253)\n\tat org.apache.logging.log4j.core.impl.Log4jContextFactory.getContext(Log4jContextFactory.java:155)\n\tat org.apache.logging.log4j.core.impl.Log4jContextFactory.getContext(Log4jContextFactory.java:47)\n\tat org.apache.logging.log4j.LogManager.getContext(LogManager.java:196)\n\tat org.apache.logging.log4j.spi.AbstractLoggerAdapter.getContext(AbstractLoggerAdapter.java:137)\n\tat org.apache.logging.slf4j.Log4jLoggerFactory.getContext(Log4jLoggerFactory.java:61)\n\tat org.apache.logging.log4j.spi.AbstractLoggerAdapter.getLogger(AbstractLoggerAdapter.java:47)\n\tat org.apache.logging.slf4j.Log4jLoggerFactory.getLogger(Log4jLoggerFactory.java:33)\n\tat org.slf4j.LoggerFactory.getLogger(LoggerFactory.java:447)\n\tat org.slf4j.LoggerFactory.getLogger(LoggerFactory.java:472)\n\tat io.joern.x2cpg.passes.frontend.XTypeRecoveryConfig$.(XTypeRecovery.scala:28)\n\tat io.joern.jssrc2cpg.Frontend$.(Main.scala:41)\n\tat io.joern.jssrc2cpg.Main$.(Main.scala:47)\n\tat io.joern.jssrc2cpg.Main$.(Main.scala:47)\n\tat io.joern.jssrc2cpg.Main.main(Main.scala)\nCaused by: java.net.UnknownHostException: 85973dc1b7a6: Temporary failure in name resolution\n\tat java.base/java.net.Inet6AddressImpl.lookupAllHostAddr(Native Method)\n\tat java.base/java.net.Inet6AddressImpl.lookupAllHostAddr(Unknown Source)\n\tat java.base/java.net.InetAddress$PlatformResolver.lookupByName(Unknown Source)\n\tat java.base/java.net.InetAddress.getAddressesFromNameService(Unknown Source)\n\tat java.base/java.net.InetAddress$NameServiceAddresses.get(Unknown Source)\n\tat java.base/java.net.InetAddress.getAllByName0(Unknown Source)\n\t... 22 more\nUsage: jssrc2cpg [options] input-dir\n\n input-dir source directory\n -o, --output output filename\n --exclude files or folders to exclude during CPG generation (paths relative to or absolute paths)\n --exclude-regex a regex specifying files to exclude during CPG generation (paths relative to are matched)\n --enable-early-schema-checking\n enables early schema validation during AST creation (disabled by default)\n --enable-file-content add the raw source code to the content field of FILE nodes to allow for method source retrieval via offset fields (disabled by default)\n --help display this help message\n", + "prior_autodetection_failure": "Traceback (most recent call last):\n File \"\", line 120, in \n File \"\", line 90, in main\n File \"/app/src/openultrasast/model/scan.py\", line 172, in scan_repository\n result = _scan_repository_impl(\n ^^^^^^^^^^^^^^^^^^^^^^\n File \"/app/src/openultrasast/model/scan.py\", line 234, in _scan_repository_impl\n cpg = build_partitions(\n ^^^^^^^^^^^^^^^^^\n File \"/app/src/openultrasast/model/partitions.py\", line 222, in build_partitions\n built = build(scratch, frontend) if complete else None\n ^^^^^^^^^^^^^^^^^^^^^^^^\n File \"/app/src/openultrasast/model/scan.py\", line 236, in \n lambda source, language: _build(backend, source, language, execution_budget=execution_budget),\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n File \"/app/src/openultrasast/model/scan.py\", line 815, in _build\n return backend.build(root, language=language, exclude=excluded, execution_budget=execution_budget)\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n File \"\", line 74, in build\nAssertionError: {'files': ['server/api.js'], 'methods': ['js_handler', ':program', 'eval', '.fieldAccess', '.assignment']}\n", + "blocked_claim": "Declared first-party JavaScript tests remain in frontend graphs.", + "unreached_checks": [ + "PHP partition census", + "whole mixed-language scan result and global region limit", + "unsupported partition output" + ], + "limits": "Failure evidence, not a passing partition smoke, detection score, actionability result or latency measurement.", + "sources": [ + "https://raw.githubusercontent.com/joernio/joern/v4.0.625/joern-cli/frontends/jssrc2cpg/src/main/scala/io/joern/jssrc2cpg/utils/AstGenRunner.scala", + "https://raw.githubusercontent.com/joernio/astgen-monorepo/javascript-astgen/v3.50.1/javascript-astgen/src/Defaults.ts", + "https://raw.githubusercontent.com/joernio/astgen-monorepo/javascript-astgen/v3.50.1/javascript-astgen/src/FileUtils.ts" + ], + "packaged_sources_match_workspace_at_measurement": true, + "post_measurement_changes": [ + "Comment-only backend clarification: direct frontend routing does not override built-in test filters." + ], + "local_verification": { + "pytest": "1138 passed, 9 skipped in 106.05s", + "exit_code": 0, + "ruff": "PASS", + "format": "227 files", + "mypy": "109 source files PASS", + "task_completion": "NOT_VERIFIED" + } +} diff --git a/ops/README.md b/ops/README.md index 32daab2..be10aba 100644 --- a/ops/README.md +++ b/ops/README.md @@ -165,3 +165,24 @@ The smoke reads committed PHP/JavaScript bytes from a dirty, non-HEAD checkout, checks rename/deletion and declared configuration context, and verifies scratch cleanup and unchanged live state. Its JSON reports snapshot preparation only; it does not run the detector, install a hook, or establish hook latency. + +## Vendor and frontend partition smoke + +After rebuilding the image, inspect real PHP and JavaScript graphs from one mixed +source tree: + +```bash +docker run --rm -i --network none --entrypoint python openultrasast:dev - < ops/smoke_partitions.py +``` + +The script reads each fixture before measurement, then checks graph file and method +nodes: declared vendor code is absent, first-party source and tests remain, and an +unsupported Go partition is reported explicitly. One ranker decision and one region +limit cover both supported frontends. The shared 900-second budget is a lab allowance; +this check establishes neither production hook latency nor framework admission. + +Current status (2026-09-13): this is a failing regression on Joern 4.0.625. The +projected JavaScript test file is readable but absent from the resulting graph. +See `benchmarks/measurements/2026-09-13-partition-retention-blocker.json` and the +proposed contributor-scan frontend-retention prerequisite. An exit 1 is expected +until that engine contract is repaired; do not treat it as a passing partition smoke. diff --git a/ops/smoke_partitions.py b/ops/smoke_partitions.py new file mode 100644 index 0000000..38e08a5 --- /dev/null +++ b/ops/smoke_partitions.py @@ -0,0 +1,130 @@ +"""Real mixed-language graph input and global ranker smoke; no hook quality claim.""" + +from __future__ import annotations + +import hashlib +import json +import sys +import tempfile +import time +from dataclasses import asdict +from pathlib import Path + +from openultrasast.cpg.backend import JoernBackend +from openultrasast.model.contracts import ExecutionBudget +from openultrasast.model.regions import ScanRegion +from openultrasast.model.scan import ScanBudget, scan_repository + + +def main() -> None: + deadline = ExecutionBudget(time.monotonic() + 900, 2.0) + records: list[dict[str, object]] = [] + with tempfile.TemporaryDirectory(prefix="ousast-partitions-smoke-") as temporary: + base = Path(temporary) + root = base / "source" + queries = base / "queries" + queries.mkdir() + (queries / "partition_witness.sc").write_text("""@main def exec(cpgFile: String) = { + importCpg(cpgFile) + println("---OUSAST-CPG-BEGIN---") + println(ujson.write(ujson.Obj( + "files" -> ujson.Arr.from(cpg.file.name.l), + "methods" -> ujson.Arr.from(cpg.method.name.l) + ))) + println("---OUSAST-CPG-END---") +} +""") + sources = { + "src/api.php": "