Commit Graph

Select branches

Hide Pull Requests

main

archive/engine-change-scoped-evidence-pass

archive/engine-typescript

archive/fix-mechanisms

archive/trained-classifier

archive/unseen-eval

v0.1.0

v1.0.0

v1.1.0

v1.2.0-alpha.1

v2.0.0

v2.0.1

Mono Color

• ae22136c08 measure(g2): CORRECT pilot diagnosis -- engine produced zero vuln-family findings; anchoring is a red herring Marius CiepluchandClaude Opus 4.8 2026-10-12 09:19:04 +02:00
• a5a37374a7 measure(g2): engine-on pilot -- regex 1/5, engine 0/5 on clean host; budget hypothesis refuted Marius CiepluchandClaude Opus 4.8 2026-10-12 08:53:38 +02:00
• 4c4b7d375a measure(g2): E1/E2 clean-host results -- the engine 'query=0 wall' was contention, not intrinsic Marius CiepluchandClaude Opus 4.8 2026-10-12 08:20:16 +02:00
• e901640f3f measure(g0): record 07 — slice-1 unseen-repo baseline (G0 exit) Marius CiepluchandClaude Opus 4.8 2026-10-11 22:30:58 +02:00
• e716e3beab docs(g2): record-07 baseline is regex-only; prioritize semantic detection + barrier analysis Marius CiepluchandClaude Opus 4.8 2026-10-11 15:05:51 +02:00
• df09fe4030 docs(g2): engine-arm wall diagnosed -- ~200s fixed overhead, change-scoping insufficient Marius CiepluchandClaude Opus 4.8 2026-10-11 13:31:55 +02:00
• f36165a4ed wip(g2): park change-scoped attempt + full diagnosis (NOT the fix) archive/engine-change-scoped-evidence-pass Marius CiepluchandClaude Opus 4.8 2026-10-11 13:31:54 +02:00
• 7558951493 feat(g2): change-scoped, budget-bounded evidence pass (unblock push analysis) Marius CiepluchandClaude Opus 4.8 2026-10-11 12:28:35 +02:00
• 15992d3090 docs(g2): increment 2 measured -- the 236s is 99.9% the evidence-tier pass Marius CiepluchandClaude Opus 4.8 2026-10-11 12:11:57 +02:00
• a0637f2f9d docs(g2): correct increment 2 -- preserve reach-into-unchanged, measure the 236s split first Marius CiepluchandClaude Opus 4.8 2026-10-11 11:50:41 +02:00
• 9580ad1e30 docs(g2): increment 1 located -- regions are discovered whole-repo, never change-scoped Marius CiepluchandClaude Opus 4.8 2026-10-11 11:24:43 +02:00
• 7a1e47e0cc docs(g2): increment 0 confirmed -- CPG build cheap, candidate enumeration is the overspend Marius CiepluchandClaude Opus 4.8 2026-10-11 11:21:33 +02:00
• dc23151022 Merge engine-change-scoped-workstream: open the G2 change-scoped-analysis workstream Marius CiepluchandClaude Opus 4.8 2026-10-11 11:10:26 +02:00
• 9f312177ce docs(g2): open the change-scoped engine-analysis workstream (brief + roadmap) Marius CiepluchandClaude Opus 4.8 2026-10-11 11:10:26 +02:00
• c39fbb8457 Merge push-correspondence-run-aware: run-aware base/head line-correspondence Marius CiepluchandClaude Opus 4.8 2026-10-11 10:12:03 +02:00
• abb2058a54 push(snapshot): run-aware base/head line-correspondence (stop discarding intra-run anchors) Marius CiepluchandClaude Opus 4.8 2026-10-11 10:12:03 +02:00
• c657c2219b Merge doc-g0-readiness-2026-10-11: G0 state, readiness plan, bucket-first docs Marius CiepluchandClaude Opus 4.8 2026-10-11 08:17:06 +02:00
• d03590148f docs(g0): record the 2026-10-11 state and readiness plan; bucket-first + image provenance Marius CiepluchandClaude Opus 4.8 2026-10-11 08:17:06 +02:00
• 7b711a6150 Merge unseen-getrepo-cache: bucket-cache get_repo (one-time used-set canonicalization) Marius CiepluchandClaude Opus 4.8 2026-10-10 17:10:19 +02:00
• a3a38f1b9f unseen: bucket-cache get_repo (kill the repeated used-set canonicalization tax) Marius CiepluchandClaude Opus 4.8 2026-10-10 17:10:19 +02:00
• 21aebe8538 Merge unseen-resolution-cache: cache enumeration + resolution to ousast-corpus Marius CiepluchandClaude Opus 4.8 2026-10-10 16:33:29 +02:00
• 06b8a40c46 unseen: cache enumeration + resolution to ousast-corpus (restarts skip the ~26-min prefix) Marius CiepluchandClaude Opus 4.8 2026-10-10 16:33:29 +02:00
• 857263d975 Merge unseen-corpus-bank: durable decision bank in ousast-corpus (stream + resume) Marius CiepluchandClaude Opus 4.8 2026-10-10 16:09:47 +02:00
• 4aa612253a unseen: durable decision bank in ousast-corpus (stream + resume, retires the local journal) Marius CiepluchandClaude Opus 4.8 2026-10-10 16:09:47 +02:00
• 95bed7005c Merge unseen-fetch-bulk: full-objects clone, no per-blob lazy fetch Marius CiepluchandClaude Opus 4.8 2026-10-10 15:53:05 +02:00
• 00a1fdb30f unseen: full-objects clone instead of blob:none promisor (bulk pack, no lazy per-blob fetch) Marius CiepluchandClaude Opus 4.8 2026-10-10 15:53:05 +02:00
• f712b2cffa Merge unseen-parse-deadline: wall-clock deadline for the Python parse phase Marius CiepluchandClaude Opus 4.8 2026-10-10 14:46:18 +02:00
• a49b15b720 unseen: bound the per-repo Python parse phase (--parse-deadline) Marius CiepluchandClaude Opus 4.8 2026-10-10 14:46:18 +02:00
• c4c08d1ca1 Merge unseen-pool-size: configurable pool size / slices Marius CiepluchandClaude Opus 4.8 2026-10-10 07:54:49 +02:00
• 5ea28ca9f8 unseen: configurable pool size and slice count (--pool-size / --slices) Marius CiepluchandClaude Opus 4.8 2026-10-10 07:54:49 +02:00
• f0bcbe08b5 Merge unseen-revert-materialize: lazy blob fetch, drop broken prefetch Marius CiepluchandClaude Opus 4.8 2026-10-10 05:06:24 +02:00
• 0023f61ff8 unseen: revert the batched-blob materialize (it failed git fetch on ~half of repos) Marius CiepluchandClaude Opus 4.8 2026-10-10 05:06:24 +02:00
• 40bfdb8e18 Merge unseen-guard-and-gitexit1: guard + tolerant fix-fetch Marius CiepluchandClaude Opus 4.8 2026-10-09 23:54:08 +02:00
• 44311ff2fa unseen: fix systemic-guard miscalibration + the batched-fetch yield regression Marius CiepluchandClaude Opus 4.8 2026-10-09 23:54:08 +02:00
• a9be42b5f8 Merge unseen-extract-ascompleted: saturate the extraction pool Marius CiepluchandClaude Opus 4.8 2026-10-09 20:15:54 +02:00
• 2cf4caa959 unseen: keep the extraction pool saturated (as-completed, not oldest-first) Marius CiepluchandClaude Opus 4.8 2026-10-09 20:15:54 +02:00
• 192b2b7e7c steering: stream run artifacts to RustFS, one bucket per purpose Marius CiepluchandClaude Opus 4.8 2026-10-09 19:43:26 +02:00
• 1b0b2bdf31 Merge unseen-freeze: freeze p1 (bisect guard, freeze writer, protocol) Marius CiepluchandClaude Opus 4.8 2026-10-09 19:23:26 +02:00
• 197fe8a19c unseen: implement freeze p1 (group 3: bisect guard, freeze writer, protocol) Marius CiepluchandClaude Opus 4.8 2026-10-09 19:23:26 +02:00
• 23ede07608 Merge unseen-extract-processes: process-pool extraction for true multicore Marius CiepluchandClaude Opus 4.8 2026-10-09 19:08:01 +02:00
• 79f04400f6 unseen: extract in processes, not threads (GIL was the ceiling) Marius CiepluchandClaude Opus 4.8 2026-10-09 19:08:01 +02:00
• 9f078fe7d0 Merge unseen-extract-parallel: concurrent extraction + batched blobs Marius CiepluchandClaude Opus 4.8 2026-10-09 17:37:05 +02:00
• 65714405eb unseen: parallelize extraction + batch per-repo blob fetch Marius CiepluchandClaude Opus 4.8 2026-10-09 17:37:05 +02:00
• 4f7eedddf1 Merge search-executor-command-once: upload command once per task Marius CiepluchandClaude Opus 4.8 2026-10-09 14:03:30 +02:00
• b9f7958414 search: upload the executor command once, not on every poll Marius CiepluchandClaude Opus 4.8 2026-10-09 14:03:30 +02:00
• 6773c63634 steering: operator Discord notifications for OpenUltraSAST process status Marius CiepluchandClaude Opus 4.8 2026-10-09 11:58:10 +02:00
• aae586de69 unseen: decide phase skips a per-candidate HTTP failure too Marius CiepluchandClaude Opus 4.8 2026-10-08 18:54:46 +02:00
• 1f89f04fcf Merge unseen-resilient-draw: skip bad repos, abort on systemic failure Marius CiepluchandClaude Opus 4.8 2026-10-08 17:19:36 +02:00
• b59dd651d8 unseen: resilient draw -- a bad repo skips, a broken instrument aborts Marius CiepluchandClaude Opus 4.8 2026-10-08 17:19:36 +02:00
• ec7bb64378 Merge unseen-extract-deadline: per-repo extraction time bound Marius CiepluchandClaude Opus 4.8 2026-10-08 13:22:23 +02:00
• b074cf7f89 unseen: bound per-repo extraction time; a slow repo skips, never aborts Marius CiepluchandClaude Opus 4.8 2026-10-08 13:22:22 +02:00
• 23c8644a37 docs: README reflects the dynamic proof arm and unseen-repo release gate Marius CiepluchandClaude Opus 4.8 2026-10-08 12:51:35 +02:00
• f4c7143525 unseen: make clone disk-size guard tolerate git's mid-walk churn Marius CiepluchandClaude Opus 4.8 2026-10-08 11:16:13 +02:00
• 0a637e8989 Merge unseen-cursor-pagination: follow Link rel=next cursors Marius CiepluchandClaude Opus 4.8 2026-10-08 10:26:11 +02:00
• 5620165540 unseen: cursor pagination for advisory enumeration Marius CiepluchandClaude Opus 4.8 2026-10-08 10:26:11 +02:00
• 2d8f4f9e22 Merge unseen-sourcing-filter: server-side advisory filtering Marius CiepluchandClaude Opus 4.8 2026-10-08 08:19:30 +02:00
• 90e2400e6f unseen: filter advisory enumeration server-side (ecosystem/date/cwes) Marius CiepluchandClaude Opus 4.8 2026-10-08 08:19:30 +02:00
• d7bf0ba750 unseen: sourcing robustness -- retry transient HTTP/connection errors, shrink the advisory journal Marius CiepluchandClaude Opus 4.8 2026-10-07 18:23:40 +02:00
• 56cde9f535 spec(proof-arm-opencode): OpenCode MCP is the endpoint for PoC AND fix [skip ci] Marius CiepluchandClaude Opus 4.8 2026-10-07 17:34:52 +02:00
• 7f8a492857 docs: use-case reference -- catch, prove, fix, re-verify absence (+ GitHub Actions example) [skip ci] Marius CiepluchandClaude Opus 4.8 2026-10-07 17:34:06 +02:00
• dfc0956086 docs: frame the proof as prioritization evidence for busy devs [skip ci] Marius CiepluchandClaude Opus 4.8 2026-10-07 17:30:14 +02:00
• c49f334651 docs: developer-facing pre-push security guide + mcp-shift-left-agent brief [skip ci] Marius CiepluchandClaude Opus 4.8 2026-10-07 17:28:49 +02:00
• 7bfe6fff7e merge(search-with-proof): verification-architecture doc + proof-arm-opencode brief [skip ci] Marius CiepluchandClaude Opus 4.8 2026-10-07 16:06:56 +02:00
• 60617a92ba docs(search-with-proof): verification architecture + proof-arm-opencode follow-up brief Marius CiepluchandClaude Opus 4.8 2026-10-07 16:06:56 +02:00
• b1a050e16b merge(search-with-proof): reproducible npm builds via --before commit date [skip ci] Marius CiepluchandClaude Opus 4.8 2026-10-07 13:37:23 +02:00
• c30dd9126a search-with-proof: reproducible npm builds for old lockless projects (--before commit date) Marius CiepluchandClaude Opus 4.8 2026-10-07 13:37:23 +02:00
• 8de0c2732b spec+docs(search-with-proof): record first cluster demonstration + fixed-side negative [skip ci] Marius CiepluchandClaude Opus 4.8 2026-10-07 13:25:52 +02:00
• ecd1372568 measurements: FIRST cluster demonstration (xiaomusic prefix-bypass path traversal) [skip ci] Marius CiepluchandClaude Opus 4.8 2026-10-07 12:41:01 +02:00
• 1ec4ee4c55 merge(search-with-proof): served-root control-signal feedback to the agent [skip ci] Marius CiepluchandClaude Opus 4.8 2026-10-07 12:03:45 +02:00
• 20c5742d84 search-with-proof: feed the control signal back to the agent (served-root hint) Marius CiepluchandClaude Opus 4.8 2026-10-07 12:03:45 +02:00
• d1fe78987b measurements: xiaomusic vuln search -- oracle fix landed (agent targets prefix-sibling) but served-dir wiring missed this run [skip ci] Marius CiepluchandClaude Opus 4.8 2026-10-07 11:52:19 +02:00
• 84509fbdc0 merge(search-with-proof): path oracle covers prefix-check-bypass class [skip ci] Marius CiepluchandClaude Opus 4.8 2026-10-07 11:24:31 +02:00
• 6c7d6bb1d9 search-with-proof: path oracle covers the prefix-check-bypass class (sibling canary) Marius CiepluchandClaude Opus 4.8 2026-10-07 11:24:31 +02:00
• 4c356caa21 measurements: py re-validation 2 -- served-root fix works (demo now wires ${served_root}); still inconclusive, budget-bound [skip ci] Marius CiepluchandClaude Opus 4.8 2026-10-07 11:05:07 +02:00
• ec09a39deb merge(search-with-proof): path demo must serve ${served_root} [skip ci] Marius CiepluchandClaude Opus 4.8 2026-10-07 10:29:40 +02:00
• 00d1c26f5f search-with-proof: require the path demo to serve ${served_root} (via arg/env/config) Marius CiepluchandClaude Opus 4.8 2026-10-07 10:29:40 +02:00
• e387ca16a2 measurements: py re-validation -- budget fix works (18 verify tasks, 0 before); demo didn't wire served_root [skip ci] Marius CiepluchandClaude Opus 4.8 2026-10-07 09:23:33 +02:00
• f3ce5be8c4 merge(search-with-proof): per-search fair-share pilot budget [skip ci] Marius CiepluchandClaude Opus 4.8 2026-10-07 08:35:24 +02:00
• 2c0c45fd1f search-with-proof: per-search fair-share pilot budget (stop one search starving the rest) Marius CiepluchandClaude Opus 4.8 2026-10-07 08:35:24 +02:00
• e01fb513f2 measurements: validation of explore-trap fix (ts now authors a demo; py analysis complete but out of budget) [skip ci] Marius CiepluchandClaude Opus 4.8 2026-10-07 08:28:37 +02:00
• e8e6637833 merge(search-with-proof): verify-time-only observable guidance (fix explore-time reachability trap) [skip ci] Marius CiepluchandClaude Opus 4.8 2026-10-07 07:43:29 +02:00
• 563d006c77 search-with-proof: tell the agent the oracle observable is verify-time-only (fix the explore-time reachability trap) Marius CiepluchandClaude Opus 4.8 2026-10-07 07:43:13 +02:00
• 7c220307d4 measurements: path-family pilot after keystone + target-parity (0 demos, parity validated) [skip ci] Marius CiepluchandClaude Opus 4.8 2026-10-06 19:35:42 +02:00
• dc307c7d2e search-with-proof: path-oracle agent guidance to parity with command/ssrf (name the observable) Marius CiepluchandClaude Opus 4.8 2026-10-06 18:06:00 +02:00
• 70553cb7c6 measurements: first search-with-proof demonstrated (glance ceiling proof, $0 local) [skip ci] Marius CiepluchandClaude Fable 5.1 2026-10-06 17:54:47 +02:00
• de2771997a merge(search-with-proof): positive control for path oracle [skip ci] Marius CiepluchandClaude Fable 5.1 2026-10-06 17:54:47 +02:00
• 328406ad41 search-with-proof: positive control for path oracle — honest serve signal, no false negatives Marius CiepluchandClaude Opus 4.8 2026-10-06 17:07:24 +02:00
• d17ceb0e0c spec(search-with-proof): handoff -- plumbing cleared, open question is demo attack step vs oracle capture [skip ci] Marius CiepluchandClaude Opus 4.8 2026-10-06 15:14:45 +02:00
• 918b1f5eec tests: a timed-out AX attempt may carry its reason instead of None [skip ci] Marius CiepluchandClaude Fable 5.1 2026-10-06 14:51:07 +02:00
• af6a68691c merge(search-with-proof): demo replay tool [skip ci] Marius CiepluchandClaude Fable 5.1 2026-10-06 14:50:14 +02:00
• eb05ed18da search-with-proof: no-model demo replay (executor + verifier on a stored demo) Marius CiepluchandClaude Fable 5.1 2026-10-06 14:50:14 +02:00
• cc2d0b3d1f merge(search-with-proof): one interpreter, sys.path root, node_modules path [skip ci] Marius CiepluchandClaude Fable 5.1 2026-10-06 14:40:15 +02:00
• 630603ee28 search-with-proof: one interpreter for pip and apps; checkout root on sys.path; real node_modules path Marius CiepluchandClaude Fable 5.1 2026-10-06 14:37:58 +02:00
• b227e74da8 merge(search-with-proof): oracle placeholders and venv interpreter [skip ci] Marius CiepluchandClaude Fable 5.1 2026-10-06 12:43:11 +02:00
• 7a91cc1482 search-with-proof: oracle placeholders for demos; Python apps run under the venv interpreter Marius CiepluchandClaude Fable 5.1 2026-10-06 12:43:11 +02:00
• dcbaec0043 merge(search-with-proof): archive parts, isolated pip, verifier module paths [skip ci] Marius CiepluchandClaude Fable 5.1 2026-10-06 11:15:09 +02:00
• 0d3e6df31c search-with-proof: split compressed verifier archives, isolated pip installs, verifier module paths Marius CiepluchandClaude Fable 5.1 2026-10-06 11:15:09 +02:00
• c9bd1ec152 merge(search-with-proof): readiness probe, longer tool turns, 40-step tasks [skip ci] Marius Ciepluch 2026-10-06 09:41:57 +02:00
• da804472b9 search-with-proof: readiness from the budget with a probe, 4096-token tool turns, 40-step tasks Marius CiepluchandClaude Fable 5.1 2026-10-06 09:37:47 +02:00
• a4ec526039 tests: verify task identities are plain ids; the prefix is the workload kind [skip ci] Marius CiepluchandClaude Fable 5.1 2026-10-06 08:21:37 +02:00