mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5.5
b68fe27c74
`ousast plane workspaces --validation-set ... --loop` appends the loop to a Run:
per case `alerts` (plane/tasks/alerts.py: the quick-mode scan on the vulnerable
and the fixed pin, a fixed-pin Workspace per case, alerts attributed to their
enclosing function by the repo-facts patterns, `in_fix_range` from the fix's
old-side and new-side ranges, failing on an unread tree) feeding `remember`,
then `memory-snapshot` -> `loop-measure` -> `loop-propose` -> `loop-improve`
(plane/tasks/loop.py). Every new task binds no Model and has budget
{usd: 0, calls: 0}. The snapshot is the store's rows after the train-on-test
guard, written on the host by memory.seed (a sandboxed run of it fails loudly);
propose runs M1/M2 against this repository at the commit under test; improve
runs one unchanged evolve.run_round and delivers gate.json, journal.json, the
sidecar, rule_policy.json only when accepted, and proposal_outcome rows that
the host ingests. Adoption stays a maintainer commit.
`remember` is now a Run entry per case (the image contains it), with the facts
row keyed by the image the facts were computed on (repo-facts records it in
its summary; unknown -> the row is omitted, never guessed). Alert rows carry
their own pin; improve/memory.py counts a repeated alert once.
Runner image rebuilt (+0.39 MB: only the new modules; the quick scan needs no
extra and the rulesets were already in the package), pushed, plane/ re-pinned
and regenerated (validation-46: 105 entries). Fixture test runs the whole loop
graph through the fake ax, whose new `exec` mode runs the real task modules.
Live: one loop Run over three validation-46 cases on the local ax, recorded in
benchmarks/measurements/2026-09-30-harnessx-removal-loop/ (all done, $0 new
spend, 0 proposals, gate verdict no_proposals).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
28 lines
449 B
JSON
28 lines
449 B
JSON
{
|
|
"wp-gopay-log-filter-sqli": [
|
|
[
|
|
"admin/views/log.php",
|
|
"<global>"
|
|
]
|
|
],
|
|
"lmdeploy-media-url-ssrf": [
|
|
[
|
|
"lmdeploy/vl/media/connection.py",
|
|
"_load_http_url"
|
|
]
|
|
],
|
|
"froxlor-admin-ip-second-order-sqli": [
|
|
[
|
|
"lib/Froxlor/Api/Commands/Domains.php",
|
|
"validateIpAddresses"
|
|
],
|
|
[
|
|
"lib/Froxlor/Api/Commands/IpsAndPorts.php",
|
|
"listing"
|
|
],
|
|
[
|
|
"lib/Froxlor/Api/Commands/IpsAndPorts.php",
|
|
"listingCount"
|
|
]
|
|
]
|
|
} |