marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: frame the proof as prioritization evidence for busy devs [skip ci]

Browse Source 
Revise the developer guide for engineers with full backlogs and no spare schedule:
a vague warning dies in the backlog, so the value of the demonstrated proof is the
prioritization conversation -- reproducible evidence (input, behavior, the one-line
fix difference) a dev takes to a product owner or the business to win capacity,
dropped into the ticket system as a location, repair direction, and reproduction.
mcp-shift-left-agent brief: the agent's return should be ticket-ready evidence.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-07 17:30:14 +02:00
co-authored by Claude Opus 4.8
parent c49f334651
commit dfc0956086
2 changed files with 29 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/specs/mcp-shift-left-agent/brief.md
+5 -1
View File
@@ -48,7 +48,11 @@ and lane-selected. Models and spend caps stay in `.env`.
static arm must be fast on a single diff. What is the time contract, and does
the large-repo latency problem block it?
2. Return contract: exactly what a coding agent gets back (findings, locations,
repair direction, optional proof) and how it decides pass/fail in oversight mode.
repair direction, optional proof) and how it decides pass/fail in oversight
mode. The return should be ticket-ready evidence a busy developer can paste
into the issue tracker to win capacity in a prioritization discussion with a
product owner, since a reproducible proof is what moves a security fix out of
the backlog.
3. Does oversight mode need a signed/attestable result so a reviewer can trust
that the agent actually ran the check?
4. Reuse: the `ousast mcp` tool set already exists; which tools are enough and