marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-18 04:29:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(pre-push-safety-net): record frontend retention prerequisite

Browse Source
This commit is contained in:
Marius Ciepluch
2026-09-13 11:05:44 +02:00
parent ebad83009e
commit d02406e758
14 changed files with 387 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/steering/roadmap.md
+7 -5
View File
@@ -46,14 +46,16 @@ engine are out of scope.
- [ ] pre-push-safety-net — Immutable pushed tips, existing-ranker integration, compatible artifact
reuse, total deadline, change attribution, actionability admission and compact hook behavior.
Dependencies: contributor-scan. Requirements/design approved 2026-09-12; tasks generated
(8 groups, 27 executable subtasks), independently reviewed and approved; groups 1 and 2 are complete (7/27 tasks).
(8 groups, 27 executable subtasks), independently reviewed and approved; groups 1 and 2 and tasks 3.1–3.3 are complete (10/27 tasks); 3.4 is blocked.
### Next concrete step
Groups 1 and 2 have passed independent review: reproducible runtime, pinned inputs, honest scoring,
shared contracts, immutable push snapshots and lexical change context. Continue with group 3: one
execution budget, exact ranker scope, affected relationships and vendor/language partitions. See
`pre-push-safety-net/implementation-group-2.md` for evidence and limits.
Groups 1 and 2 and tasks 3.1–3.3 have passed independent review: runtime, inputs,
scoring, snapshots, shared deadline, exact ranker scope and change-context evidence.
Task 3.4 is blocked: real Joern graphs omit first-party JavaScript tests even though
filtered inputs contain them. Review `contributor-scan/frontend-retention-prerequisite.md`,
repair that foundation contract, then rerun the partition census and independent review.
See `pre-push-safety-net/implementation-group-3.md` for evidence and limits.
The first complete experiment is 5.2, before persistent caching and hook
installation work. Keep PMPro as the primary core-optimization example, then freeze the core and
prove a changed security flow and its fixed twin on a JavaScript/Express Node API workload through
.kiro/steering/safety-net.md
+3 -1
View File
@@ -80,5 +80,7 @@ The product direction above is user-requested. The amended requirements, design
evaluation profile in `pre-push-safety-net` were approved for task generation on 2026-09-12
("ok, next kiro phase"). The maintainer then approved the task plan and starting group 1
("approve.") and then group 2 ("ok, next kiro phase, approved"). Groups 1 and 2 are now verified
complete. Implementation is authorized under that plan; task completion still requires
complete, as are group 3 tasks 3.1–3.3 (10/27 total). Task 3.4 is blocked on a
confirmed frontend test-retention gap; review the proposed contributor-scan
frontend-retention prerequisite before resuming it. Implementation is authorized under that plan; task completion still requires
independent review and fresh evidence. Hook performance and capability admission remain unproven.