fix(ci): run ruff format, and record run 5 at 90% pair-correct

CI was red on `ruff format --check`: 23 files. I ran `ruff check` after every
change this session and never once ran `ruff format --check`, though CI runs
both. Lint passing is not formatting passing, and I treated one as evidence for
the other for the whole session.

Formatting applied. The full CI sequence now reproduces locally: format, lint,
mypy over 94 files, 735 tests, three gates byte-identical, compileall, and the
semantic job's 16 marked tests.

Also records run 5 of the pipeline measurement, which the vampi fix lifted as
predicted:

                       hunter (K=5)   pipeline (K=1)
  pair-correct              76.7%          90.0%
  leak                      12.3%           6.7%
  detection                    --          96.7%
  cost                     ~$0.69        $0.0068

27 of 30 pairs. Five runs, each step from a measurement contradicting an
assumption: 73.3 (no pipeline path) -> 73.3 (routing fixed, IDENTICAL, which
exposed the discarded verdict) -> 80.0 (residual question matched to its
arbiter) -> 86.7 (aiohttp settings) -> 90.0 (dominance question no longer
contradicting its own evidence).

One miss left: dsvpwa-dsvpwa-main, whose setting is an argparse --ssl default
rather than a security-setting call. Out of reach before the settings work and
still is; contorting the arbiter around one pair would be worse than the miss.

The caveat is recorded beside the number: 30 pairs of one slice, and the slice
iterated against all session. The +16% overfitting gap against vfc-js is why
contributor-scan Req 8.1/8.2 exist.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

src/openultrasast/improve/evolve.py

@@ -234,9 +234,7 @@ def run_round(
         regressed,
         small,
     )
-    outcome = _outcome(
-        round_index, accepted=accepted, reason=reason, edits=edits, before=before, after=after, degradations=refusals
-    )
+    outcome = _outcome(round_index, accepted=accepted, reason=reason, edits=edits, before=before, after=after, degradations=refusals)
     return RoundOutcome(
         **{
             **outcome.__dict__,

src/openultrasast/model/calibrate.py

@@ -24,6 +24,7 @@ class FamilyGaps(TypedDict):
     pairs: int
     reasons: dict[str, int]
 
+
 # Ascending, matching `ladder.Rung`. A pair is split when the vulnerable side outranks its fix.
 _ORDER = {"none": 0, "": 0, "suspicion": 0, "model_corroborated": 1, "model_entailed": 2, "execution_confirmed": 3}
 
@@ -82,15 +83,18 @@ class CalibrationReport:
 
     def to_markdown(self) -> str:
         """Per-slice rows first; there is no headline here that is not backed by them (Req 9.3, 11.1)."""
-        lines = ["## Model calibration", "", "Coverage is a pair the model *splits*: a strictly higher rung on",
-                 "the vulnerable side than on its fix. Everything else is a named gap.", "",
-                 "| slice | pairs | covered | gaps | coverage |", "|---|---|---|---|---|"]
+        lines = [
+            "## Model calibration",
+            "",
+            "Coverage is a pair the model *splits*: a strictly higher rung on",
+            "the vulnerable side than on its fix. Everything else is a named gap.",
+            "",
+            "| slice | pairs | covered | gaps | coverage |",
+            "|---|---|---|---|---|",
+        ]
         for slice_name, block in sorted(self.per_slice.items()):
             pairs = block["pairs"] or 1
-            lines.append(
-                f"| {slice_name} | {block['pairs']} | {block['covered']} | {block['gaps']} | "
-                f"{block['covered'] / pairs:.0%} |"
-            )
+            lines.append(f"| {slice_name} | {block['pairs']} | {block['covered']} | {block['gaps']} | {block['covered'] / pairs:.0%} |")
         by_family = self.gaps_by_family()
         if by_family:
             lines += ["", "### Gaps by family", ""]
@@ -116,8 +120,9 @@ def calibrate(outcomes: Iterable[PairOutcome]) -> CalibrationReport:
         if split:
             covered.append(outcome.pair)
         else:
-            gaps.append(ModelGap(pair=outcome.pair, family=outcome.family, slice=outcome.slice,
-                                 reason=outcome.reason or _default_reason(outcome)))
+            gaps.append(
+                ModelGap(pair=outcome.pair, family=outcome.family, slice=outcome.slice, reason=outcome.reason or _default_reason(outcome))
+            )
     return CalibrationReport(
         covered=tuple(sorted(covered)),
         gaps=tuple(sorted(gaps, key=lambda g: (g.family, g.pair))),

src/openultrasast/model/judge.py

@@ -79,11 +79,14 @@ def judge(
 
     said_vulnerable = _ask(client, model, spec, answer.witness, function)
     if said_vulnerable is None:
-        return Verdict(rung=Rung.SUSPICION, family=spec.family, witness=answer.witness,
-                       contradiction="the judge returned no usable answer")
+        return Verdict(rung=Rung.SUSPICION, family=spec.family, witness=answer.witness, contradiction="the judge returned no usable answer")
     if not said_vulnerable:
-        return Verdict(rung=Rung.SUSPICION, family=spec.family, witness=answer.witness,
-                       contradiction="the judge held the sanitizer on this path sufficient")
+        return Verdict(
+            rung=Rung.SUSPICION,
+            family=spec.family,
+            witness=answer.witness,
+            contradiction="the judge held the sanitizer on this path sufficient",
+        )
     return answer  # CORROBORATED: a real flow the judge agrees is not neutralised
 
 
@@ -96,8 +99,13 @@ def _ask(client: Any, model: str, spec: TaintSpec, witness: str, function: str)
         line = tail.split(",")[0].strip(") ")
     prompt = redact_secrets(
         QUESTION.format(
-            language=spec.language, source=source.strip(), sink=sink.strip(), line=line or "?",
-            function=function or "?", sanitized="yes", family=spec.family,
+            language=spec.language,
+            source=source.strip(),
+            sink=sink.strip(),
+            line=line or "?",
+            function=function or "?",
+            sanitized="yes",
+            family=spec.family,
         )
     )
     try:

src/openultrasast/model/pipeline.py

@@ -64,9 +64,7 @@ class ModelFinding:
     contradiction: str = ""
 
 
-def _arbitrate(
-    cpg: CpgResult, spec: TaintSpec | DominanceSpec | ConfigSpec, *, function: str, parameter_sources: bool
-) -> Verdict | None:
+def _arbitrate(cpg: CpgResult, spec: TaintSpec | DominanceSpec | ConfigSpec, *, function: str, parameter_sources: bool) -> Verdict | None:
     """Route a family to the arbiter that can actually decide it.
 
     Dispatching on the spec type rather than on a family name keeps this honest: a family without an arbiter
@@ -96,8 +94,7 @@ def scan_region(
 
     if answer is not None and answer.rung is Rung.ENTAILED:
         # The graph decided. No model call, and no candidate needs asking about: this region has its finding.
-        return [ModelFinding(site=_site(function, answer.witness), family=spec.family, rung=Rung.ENTAILED,
-                             witness=answer.witness)]
+        return [ModelFinding(site=_site(function, answer.witness), family=spec.family, rung=Rung.ENTAILED, witness=answer.witness)]
 
     if answer is not None:
         # A real flow through a sanitizer. Whether it suffices is the residual, and the model HAS coverage
@@ -106,8 +103,7 @@ def scan_region(
             return []
         said = _ask(client, model, residual_question(spec, answer.witness, function))
         if said:
-            return [ModelFinding(site=_site(function, answer.witness), family=spec.family,
-                                 rung=Rung.CORROBORATED, witness=answer.witness)]
+            return [ModelFinding(site=_site(function, answer.witness), family=spec.family, rung=Rung.CORROBORATED, witness=answer.witness)]
         return []
 
     # The model resolved nothing. It is SILENT, not negative — so the enumerator's candidates are put to the

src/openultrasast/model/report.py

@@ -56,15 +56,16 @@ def render(rows: Sequence[SliceRow], *, development: str = "", deciding: str = "
 
     total_pairs = sum(row.pairs for row in rows)
     total_covered = sum(row.covered for row in rows)
-    lines += ["", f"Across every slice: {total_covered}/{total_pairs} = {total_covered / total_pairs:.0%} "
-                  "— read the rows above it, not this line."]
+    lines += [
+        "",
+        f"Across every slice: {total_covered}/{total_pairs} = {total_covered / total_pairs:.0%} — read the rows above it, not this line.",
+    ]
 
     gap = overfitting_gap(rows, development=development, deciding=deciding)
     if gap is not None:
         lines += [
             "",
-            f"**Overfitting gap: {gap:+.0%}** — `{development}` (development) minus `{deciding}`, "
-            f"which is the deciding real-world slice.",
+            f"**Overfitting gap: {gap:+.0%}** — `{development}` (development) minus `{deciding}`, which is the deciding real-world slice.",
         ]
     elif development or deciding:
         lines += ["", f"**Overfitting gap: not measurable** — `{development}` or `{deciding}` is absent from this run."]

src/openultrasast/model/specs.py

@@ -190,6 +190,7 @@ def taint_specs(
     scoped = (facts if facts is not None else load_facts()).for_language(language)
     families = taxonomy if taxonomy is not None else load_families()
     sources = tuple(sorted({pattern for fact in scoped.sources for pattern in fact.patterns}))
+
     # A shape qualifier means "this sink is safe in this form", never "this call cleans the value".
     def _is_shape(fact: object) -> bool:
         return bool(getattr(fact, "parameterized", False)) or getattr(fact, "literal_format_arg", None) is not None

src/openultrasast/model/taint.py

@@ -67,17 +67,19 @@ def _flows(rows: object, *, function: str) -> list[dict[str, object]]:
             continue
         if function and not _in_scope(row, function):
             continue
-        kept.append({
-            "sink": str(row.get("sink", "")),
-            "sinkArity": row.get("sinkArity"),
-            "sinkArg0Literal": row.get("sinkArg0Literal"),
-            "inLabeledScope": row.get("inLabeledScope"),
-            "sinkLine": str(row.get("sinkLine", "")),
-            "sinkMethod": str(row.get("sinkMethod", "")),
-            "source": str(row.get("source", "")),
-            "sanitized": bool(row.get("sanitized", False)),
-            "length": _as_int(row.get("length")),
-        })
+        kept.append(
+            {
+                "sink": str(row.get("sink", "")),
+                "sinkArity": row.get("sinkArity"),
+                "sinkArg0Literal": row.get("sinkArg0Literal"),
+                "inLabeledScope": row.get("inLabeledScope"),
+                "sinkLine": str(row.get("sinkLine", "")),
+                "sinkMethod": str(row.get("sinkMethod", "")),
+                "source": str(row.get("source", "")),
+                "sanitized": bool(row.get("sanitized", False)),
+                "length": _as_int(row.get("length")),
+            }
+        )
     return kept
 
 

src/openultrasast/pairs.py

@@ -100,7 +100,6 @@ _DEFAULT_PROVENANCE = {"sast": "synthetic", "local": "human", "github": "human",
 _MANIFEST_MECHANISM = "source_reaches_sink"  # cheat-sheet fixtures referenced via expected_from
 
 
-
 class CatalogError(ValueError):
     """Raised when a pair catalog violates the label schema."""