feat(learn): candidate feature schema and builders (decision-engine task 1)

learn/schema.py is the closed, typed allow-list of candidate features: 66 features over 11 instruments (language one-hot, quick rules with 23 mechanism buckets and a prior count, engine, repo-facts, source span, entry-point distance, roles, delta, verify, agree, model sinks), two profiles (static 57; plane adds verify, agree and model sinks for 66), schema_version and a feature-set digest. No repository, path, file, function, rule or commit identity is a feature; site_match, in_fix_range, fixed-pin alerts, case.json fields and costs are refused. Missing is not zero: each record carries per-instrument state (ran | none | failed | not_applicable), and every feature of an instrument that did not run is null. learn/features.py builds records on the host (build_for_scan, whole repository or base..head delta); plane/tasks/features.py builds them per case in a Run from the delivered artifacts, dropping site_match and in_fix_range on read and ignoring fixed-pin alerts. The generator adds a model-free `features` entry per case before `remember`, which stores the records as `features` rows (re-validated). memory KINDS gains features, label, decision, experiment, arm_outcome and experiment_result. The committed validation-46 manifests are regenerated (entries appended; the first Run's entries are unchanged). The runner image must be rebuilt and re-pinned before a Run executes the new task. Proof on real artifacts (scratch store, not committed): the recorded validation-46 run gives 75 feature records over 15 cases (43 verify candidates plus vulnerable-pin alerts), each case's vulnerable pin exported and read (0.5k-9k files); remember stored 75 features rows beside 43 verdict, 84 alert, 61 unit_cost, 15 facts and 8 coverage rows. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
2026-10-17 12:09:27 +00:00 · 2026-09-30 18:38:04 +02:00
parent edcf145b00
commit d1896cb8e7
17 changed files with 2129 additions and 31 deletions
@@ -0,0 +1,18 @@
+# features (learned-decision-engine design section 1): one allow-listed feature record per candidate. No model.
+# The template of the per-case Tasks (bound to the case's vulnerable Workspace for the functions' spans and the
+# entry-point distance); `remember` stores the records as `features` rows. The image is digest-pinned.
+apiVersion: ax.io/v1alpha1
+kind: Task
+metadata:
+  name: features
+  atespace: default
+spec:
+  image: "localhost:5001/ousast-runner@sha256:e9964977659c4dcea7d8b25390ca0e16368ac901dd076aa6138df8303a0bb699"
+  command: ["features"]
+  resources:
+    requests:
+      cpu: "250m"
+      memory: "512Mi"
+    limits:
+      cpu: "1"
+      memory: "1Gi"
@@ -2236,6 +2236,29 @@ spec:
 ---
 apiVersion: ax.io/v1alpha1
 kind: Task
+metadata:
+  name: features-budibase-mongo-template-nosqli
+  atespace: default
+spec:
+  image: localhost:5001/ousast-runner@sha256:e9964977659c4dcea7d8b25390ca0e16368ac901dd076aa6138df8303a0bb699
+  command:
+  - features
+  env:
+  - name: OUSAST_WORKSPACE_DIR
+    value: /workspace/case/repo
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: '1'
+      memory: 1Gi
+  workspaces:
+  - name: budibase-mongo-template-nosqli-vulnerable
+    path: /workspace/case
+---
+apiVersion: ax.io/v1alpha1
+kind: Task
 metadata:
  name: remember-budibase-mongo-template-nosqli
  atespace: default
@@ -2261,6 +2284,29 @@ spec:
 ---
 apiVersion: ax.io/v1alpha1
 kind: Task
+metadata:
+  name: features-cct-studio-server-cmdi
+  atespace: default
+spec:
+  image: localhost:5001/ousast-runner@sha256:e9964977659c4dcea7d8b25390ca0e16368ac901dd076aa6138df8303a0bb699
+  command:
+  - features
+  env:
+  - name: OUSAST_WORKSPACE_DIR
+    value: /workspace/case/repo
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: '1'
+      memory: 1Gi
+  workspaces:
+  - name: cct-studio-server-cmdi-vulnerable
+    path: /workspace/case
+---
+apiVersion: ax.io/v1alpha1
+kind: Task
 metadata:
  name: remember-cct-studio-server-cmdi
  atespace: default
@@ -2286,6 +2332,29 @@ spec:
 ---
 apiVersion: ax.io/v1alpha1
 kind: Task
+metadata:
+  name: features-contextforge-prompt-ssti
+  atespace: default
+spec:
+  image: localhost:5001/ousast-runner@sha256:e9964977659c4dcea7d8b25390ca0e16368ac901dd076aa6138df8303a0bb699
+  command:
+  - features
+  env:
+  - name: OUSAST_WORKSPACE_DIR
+    value: /workspace/case/repo
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: '1'
+      memory: 1Gi
+  workspaces:
+  - name: contextforge-prompt-ssti-vulnerable
+    path: /workspace/case
+---
+apiVersion: ax.io/v1alpha1
+kind: Task
 metadata:
  name: remember-contextforge-prompt-ssti
  atespace: default
@@ -2311,6 +2380,29 @@ spec:
 ---
 apiVersion: ax.io/v1alpha1
 kind: Task
+metadata:
+  name: features-froxlor-admin-ip-second-order-sqli
+  atespace: default
+spec:
+  image: localhost:5001/ousast-runner@sha256:e9964977659c4dcea7d8b25390ca0e16368ac901dd076aa6138df8303a0bb699
+  command:
+  - features
+  env:
+  - name: OUSAST_WORKSPACE_DIR
+    value: /workspace/case/repo
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: '1'
+      memory: 1Gi
+  workspaces:
+  - name: froxlor-admin-ip-second-order-sqli-vulnerable
+    path: /workspace/case
+---
+apiVersion: ax.io/v1alpha1
+kind: Task
 metadata:
  name: remember-froxlor-admin-ip-second-order-sqli
  atespace: default
@@ -2336,6 +2428,29 @@ spec:
 ---
 apiVersion: ax.io/v1alpha1
 kind: Task
+metadata:
+  name: features-fuxa-tdengine-escape-sqli
+  atespace: default
+spec:
+  image: localhost:5001/ousast-runner@sha256:e9964977659c4dcea7d8b25390ca0e16368ac901dd076aa6138df8303a0bb699
+  command:
+  - features
+  env:
+  - name: OUSAST_WORKSPACE_DIR
+    value: /workspace/case/repo
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: '1'
+      memory: 1Gi
+  workspaces:
+  - name: fuxa-tdengine-escape-sqli-vulnerable
+    path: /workspace/case
+---
+apiVersion: ax.io/v1alpha1
+kind: Task
 metadata:
  name: remember-fuxa-tdengine-escape-sqli
  atespace: default
@@ -2361,6 +2476,29 @@ spec:
 ---
 apiVersion: ax.io/v1alpha1
 kind: Task
+metadata:
+  name: features-lmdeploy-media-url-ssrf
+  atespace: default
+spec:
+  image: localhost:5001/ousast-runner@sha256:e9964977659c4dcea7d8b25390ca0e16368ac901dd076aa6138df8303a0bb699
+  command:
+  - features
+  env:
+  - name: OUSAST_WORKSPACE_DIR
+    value: /workspace/case/repo
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: '1'
+      memory: 1Gi
+  workspaces:
+  - name: lmdeploy-media-url-ssrf-vulnerable
+    path: /workspace/case
+---
+apiVersion: ax.io/v1alpha1
+kind: Task
 metadata:
  name: remember-lmdeploy-media-url-ssrf
  atespace: default
@@ -2386,6 +2524,29 @@ spec:
 ---
 apiVersion: ax.io/v1alpha1
 kind: Task
+metadata:
+  name: features-medplum-external-auth-open-redirect
+  atespace: default
+spec:
+  image: localhost:5001/ousast-runner@sha256:e9964977659c4dcea7d8b25390ca0e16368ac901dd076aa6138df8303a0bb699
+  command:
+  - features
+  env:
+  - name: OUSAST_WORKSPACE_DIR
+    value: /workspace/case/repo
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: '1'
+      memory: 1Gi
+  workspaces:
+  - name: medplum-external-auth-open-redirect-vulnerable
+    path: /workspace/case
+---
+apiVersion: ax.io/v1alpha1
+kind: Task
 metadata:
  name: remember-medplum-external-auth-open-redirect
  atespace: default
@@ -2411,6 +2572,29 @@ spec:
 ---
 apiVersion: ax.io/v1alpha1
 kind: Task
+metadata:
+  name: features-pgadmin-maintenance-sqli
+  atespace: default
+spec:
+  image: localhost:5001/ousast-runner@sha256:e9964977659c4dcea7d8b25390ca0e16368ac901dd076aa6138df8303a0bb699
+  command:
+  - features
+  env:
+  - name: OUSAST_WORKSPACE_DIR
+    value: /workspace/case/repo
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: '1'
+      memory: 1Gi
+  workspaces:
+  - name: pgadmin-maintenance-sqli-vulnerable
+    path: /workspace/case
+---
+apiVersion: ax.io/v1alpha1
+kind: Task
 metadata:
  name: remember-pgadmin-maintenance-sqli
  atespace: default
@@ -2436,6 +2620,29 @@ spec:
 ---
 apiVersion: ax.io/v1alpha1
 kind: Task
+metadata:
+  name: features-qwed-sympy-eval
+  atespace: default
+spec:
+  image: localhost:5001/ousast-runner@sha256:e9964977659c4dcea7d8b25390ca0e16368ac901dd076aa6138df8303a0bb699
+  command:
+  - features
+  env:
+  - name: OUSAST_WORKSPACE_DIR
+    value: /workspace/case/repo
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: '1'
+      memory: 1Gi
+  workspaces:
+  - name: qwed-sympy-eval-vulnerable
+    path: /workspace/case
+---
+apiVersion: ax.io/v1alpha1
+kind: Task
 metadata:
  name: remember-qwed-sympy-eval
  atespace: default
@@ -2461,6 +2668,29 @@ spec:
 ---
 apiVersion: ax.io/v1alpha1
 kind: Task
+metadata:
+  name: features-reactpress-findall-column-sqli
+  atespace: default
+spec:
+  image: localhost:5001/ousast-runner@sha256:e9964977659c4dcea7d8b25390ca0e16368ac901dd076aa6138df8303a0bb699
+  command:
+  - features
+  env:
+  - name: OUSAST_WORKSPACE_DIR
+    value: /workspace/case/repo
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: '1'
+      memory: 1Gi
+  workspaces:
+  - name: reactpress-findall-column-sqli-vulnerable
+    path: /workspace/case
+---
+apiVersion: ax.io/v1alpha1
+kind: Task
 metadata:
  name: remember-reactpress-findall-column-sqli
  atespace: default
@@ -2486,6 +2716,29 @@ spec:
 ---
 apiVersion: ax.io/v1alpha1
 kind: Task
+metadata:
+  name: features-unleash-addon-webhook-ssrf
+  atespace: default
+spec:
+  image: localhost:5001/ousast-runner@sha256:e9964977659c4dcea7d8b25390ca0e16368ac901dd076aa6138df8303a0bb699
+  command:
+  - features
+  env:
+  - name: OUSAST_WORKSPACE_DIR
+    value: /workspace/case/repo
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: '1'
+      memory: 1Gi
+  workspaces:
+  - name: unleash-addon-webhook-ssrf-vulnerable
+    path: /workspace/case
+---
+apiVersion: ax.io/v1alpha1
+kind: Task
 metadata:
  name: remember-unleash-addon-webhook-ssrf
  atespace: default
@@ -2511,6 +2764,29 @@ spec:
 ---
 apiVersion: ax.io/v1alpha1
 kind: Task
+metadata:
+  name: features-winml-cli-serve-cors
+  atespace: default
+spec:
+  image: localhost:5001/ousast-runner@sha256:e9964977659c4dcea7d8b25390ca0e16368ac901dd076aa6138df8303a0bb699
+  command:
+  - features
+  env:
+  - name: OUSAST_WORKSPACE_DIR
+    value: /workspace/case/repo
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: '1'
+      memory: 1Gi
+  workspaces:
+  - name: winml-cli-serve-cors-vulnerable
+    path: /workspace/case
+---
+apiVersion: ax.io/v1alpha1
+kind: Task
 metadata:
  name: remember-winml-cli-serve-cors
  atespace: default
@@ -2536,6 +2812,29 @@ spec:
 ---
 apiVersion: ax.io/v1alpha1
 kind: Task
+metadata:
+  name: features-wp-directorist-avatar-ssrf
+  atespace: default
+spec:
+  image: localhost:5001/ousast-runner@sha256:e9964977659c4dcea7d8b25390ca0e16368ac901dd076aa6138df8303a0bb699
+  command:
+  - features
+  env:
+  - name: OUSAST_WORKSPACE_DIR
+    value: /workspace/case/repo
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: '1'
+      memory: 1Gi
+  workspaces:
+  - name: wp-directorist-avatar-ssrf-vulnerable
+    path: /workspace/case
+---
+apiVersion: ax.io/v1alpha1
+kind: Task
 metadata:
  name: remember-wp-directorist-avatar-ssrf
  atespace: default
@@ -2561,6 +2860,29 @@ spec:
 ---
 apiVersion: ax.io/v1alpha1
 kind: Task
+metadata:
+  name: features-wp-gopay-log-filter-sqli
+  atespace: default
+spec:
+  image: localhost:5001/ousast-runner@sha256:e9964977659c4dcea7d8b25390ca0e16368ac901dd076aa6138df8303a0bb699
+  command:
+  - features
+  env:
+  - name: OUSAST_WORKSPACE_DIR
+    value: /workspace/case/repo
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: '1'
+      memory: 1Gi
+  workspaces:
+  - name: wp-gopay-log-filter-sqli-vulnerable
+    path: /workspace/case
+---
+apiVersion: ax.io/v1alpha1
+kind: Task
 metadata:
  name: remember-wp-gopay-log-filter-sqli
  atespace: default
@@ -2586,6 +2908,29 @@ spec:
 ---
 apiVersion: ax.io/v1alpha1
 kind: Task
+metadata:
+  name: features-wp-groundhogg-confirm-redirect
+  atespace: default
+spec:
+  image: localhost:5001/ousast-runner@sha256:e9964977659c4dcea7d8b25390ca0e16368ac901dd076aa6138df8303a0bb699
+  command:
+  - features
+  env:
+  - name: OUSAST_WORKSPACE_DIR
+    value: /workspace/case/repo
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: '1'
+      memory: 1Gi
+  workspaces:
+  - name: wp-groundhogg-confirm-redirect-vulnerable
+    path: /workspace/case
+---
+apiVersion: ax.io/v1alpha1
+kind: Task
 metadata:
  name: remember-wp-groundhogg-confirm-redirect
  atespace: default