mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
test(ranker): every question now completes on the real case (M1b 12.4)
Measured after scoping a registration-only region to its file. M1a, before group 12 0 of 436 head questions completed after per-family context 298 of 436 after region attribution 299 of 299, and 299 of 299 on the base The count falls from 436 to 299 because the mis-attributed function-scoped regions in a route-registration module are gone, replaced by file-scoped questions the graph can answer. Nothing is unresolved on either revision. Detections are unchanged: the vulnerable revision is still new with operation_absent_from_comparable_base, the fixed twin analyzed and quiet, the unchanged revision not a regression. What remains is recorded limits rather than failures: 210 bounded-reachability boundaries, each owned by the question that reported it, and one vendor exclusion. Neither blocks a comparison. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
co-authored by
Claude Opus 5
parent
573b764bbb
commit
fc5dc453b6
@@ -55,11 +55,15 @@ pinned NodeGoat revisions with detections unchanged throughout.
|
||||
parenthesis, so `const preTax = eval(...)` was the operation `const preTax = eval`, which no
|
||||
qualified declaration could ever name. It is now the trailing qualified callee, with receiver
|
||||
spelling preserved.
|
||||
- **Unresolved questions now say why.** The remaining 138 all report
|
||||
`context_function_unresolved`, each naming a function its file does not define, which is a
|
||||
region-attribution question for the ranker rather than a limit of the engine.
|
||||
- **Unresolved questions said why, and then there were none.** The remaining 138 each named a
|
||||
function its file does not define. A route-registration module registers handlers other modules
|
||||
define, and regions were scoped to methods those files do not hold. The entry record keeps the
|
||||
handler name, because the authorization question is cross-file by nature, and the region is now
|
||||
scoped to the file instead. **Every question the scan asks now completes on both revisions,
|
||||
299 of 299**, with detections unchanged.
|
||||
|
||||
Evidence: [group 12 final](../../../benchmarks/measurements/2026-09-17-group-12-final.json).
|
||||
Evidence: [group 12 final](../../../benchmarks/measurements/2026-09-17-group-12-final.json) and
|
||||
[region attribution](../../../benchmarks/measurements/2026-09-17-region-attribution.json).
|
||||
|
||||
## Verified
|
||||
|
||||
|
||||
Reference in New Issue
Block a user