marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-20 05:29:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

spec: name the fact tables an ontology, and commit to a general-purpose hook

Browse Source 
The source, sink, sanitizer, operation, discharger and layout rows are not a pattern list. They are an
ontology of program elements and their security relations, and nearly all of this tool accuracy lives
there: the family census found five of seven families establishing nothing, every one for an ontology
reason with the flow engine ready and nothing to aim at.

The hook is general-purpose, not application-specific. The ontology describes libraries, frameworks
and language constructs; it does not describe repositories. An entry names an API and is justified by
what that API does, carries provenance and a weakness class, and may not encode a path or identifier
peculiar to one project -- a plugin bundled library tree was measured and declined on exactly that
ground. A measured gap is a candidate, never an entry: accretion by subject is how a general tool
becomes a fixture of its benchmark.

contributor-scan owns the ontology, so its design carries that statement and a new group 7 makes
growth measurable rather than anecdotal: report what a repository calls that nothing models, key
sanitizers to the weakness they prevent, skip arbitration where the evidence says there is nothing to
find, share one matcher across the queries, require a degradation to declare its scope, and commit
golden findings so a silent change cannot pass.

pre-push-safety-net carries the general-purpose test for its own reviews, and a task for harnesses
that report the cause of their own failure -- named by a week in which three separate causes looked
identical as one count.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-09-21 16:29:23 +02:00
co-authored by Claude Opus 5
parent 3a18d025f4
commit e245040855
3 changed files with 94 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/specs/pre-push-safety-net/design.md
+15
View File
@@ -24,6 +24,21 @@ an irrelevant old defect, or an unactionable witness can still produce noise.
- Do not build a second ranker/scope heuristic, an incremental CPG engine, a daemon, an automatic fixer,
or a mandatory model service. Do not scan intermediate pushed history in this feature.
## What this hook is, and is not — 2026-09-21
A general-purpose pre-commit hook, not an application-specific one. It may be measured on WordPress
plugins and Node applications, and it may not become a tool that only works on them. The practical
test at review time: would this change still be correct on a repository nobody here has seen? A path,
a directory name or an identifier peculiar to one project fails that test, and one was declined on
exactly this ground when a plugin's bundled library tree would have fixed a single subject while
claiming something false about every other.
The fact tables are an ontology of libraries, frameworks and language constructs, and
`contributor-scan` owns it. Its design records how it may grow and its group 7 makes growth
measurable rather than anecdotal. Nearly all of this tool's accuracy lives there: the 2026-09 family
census found five of seven families establishing nothing, every one of them for an ontology reason
with the flow engine ready and nothing to aim at.
## Two invariants this project keeps rediscovering
Added 2026-09-21 after the same two defects appeared eleven times between them. Each instance was