marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
108dc2e5f31f92f670c8bdb10a7ab8f0880bfa67
Open_Ultra_SAST/.kiro/breadth.toml
T
Marius CiepluchandClaude Fable 5.1 062a7b780e refactor(p1): one source-facts module owns function ranges, callers, declaration tables and language aliases 
src/openultrasast/source.py replaces the copies in semantic/functions.py,
plane/tasks/repo_facts.py, learn/features.py, learn/excerpt.py and
plane/tasks/verify.py. Two engines share one sentinel (<module>), one
DECLARATION/KEYWORDS/RESERVED set and one alias map: the parser engine
(ranges, enclosing, bounds, call_sites, callers_of, facts_for) for the
scorer, the overlay and the hunter's annotations; the line-pattern engine
(declared_functions, enclosing_at, function_span, function_bounds, the brace
matcher) that labels, features, roles, excerpts and plane facts were built
on. learn no longer imports plane.tasks. Frozen records that store the old
sentinel are mapped on read (module_function).

Gate: labels rebuilt before and after are identical, 7,921 rows, after
sentinel normalisation (benchmarks/measurements/2026-10-13-source-module-
label-diff/record.json). 490 targeted tests pass; 3,312 collect. Net: 657
lines deleted, 212 added. benchmarks/unseen keeps <global> for its own
frozen manifests.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
2026-10-13 12:00:37 +02:00

255 lines
9.8 KiB
TOML
Raw Blame History

# Breadth ledger: every spec and every top-level capability, with a status and the deletion that closes it.
# Draft 2026-10-13 from the 22 spec.json files and the Pathfinder feature inventory (PATHFINDER-2026-10-13/).
# Nothing here changes code; it records decisions so a gate can hold the line.
#
# status values
# active = on one of the four lines in .kiro/steering/overview.md (2026-10-13); work may land
# done = implemented and closed; the code it produced is owned by a capability below
# parked = no work lands; scaffolding (stubs, unused flags, dead task modules) is removed; spec stays as history
# retiring = the "closes" deletion is scheduled; the spec directory goes with it
# review = Pathfinder 2026-10-13 decides between parked and retiring
# removed = the "closes" deletion has run; the entry stays one release as the record of what went
#
# open_fronts (the weekly number) = specs with status active or review
# + capabilities with status review or retiring whose "closes" has not run.
#
# gate (to implement after the map is approved):
# fail when a spec.json reaches phase "tasks-generated" without an entry here;
# fail when a new directory under src/openultrasast/ lands without a [capability.*] entry;
# fail when an entry has status "retiring" for more than 14 days with its "closes" unexecuted.
[meta]
drafted = "2026-10-13"
spec_count = 22
open_fronts = 0 # filled by the gate script once it exists
# ---------------------------------------------------------------- specs
[spec.hunter-learning-loop]
status = "active"
line = "hunter-learning-loop"
phase = "requirements-generated"
owner = ["src/openultrasast/learn", "src/openultrasast/tool_hunter.py", "src/openultrasast/hunter_tools.py"]
closes = "n/a (active)"
[spec.pre-push-safety-net]
status = "active"
line = "pre-push-safety-net"
phase = "implementation (77 of 87 tasks)"
owner = ["src/openultrasast/push"]
closes = "n/a (active)"
[spec.search-with-proof]
status = "active"
line = "search-with-proof"
phase = "tasks-generated (11 of 24 done)"
owner = ["src/openultrasast/search", "src/openultrasast/sandbox"]
closes = "n/a (active)"
[spec.proof-arm-opencode]
status = "active"
line = "search-with-proof"
phase = "brief"
owner = ["src/openultrasast/search"]
closes = "n/a (active)"
[spec.engine-change-scoped-analysis]
status = "active"
line = "engine-change-scoped-analysis"
phase = "brief"
owner = ["src/openultrasast/cpg", "src/openultrasast/model", "src/openultrasast/semantic"]
closes = "n/a (active)"
[spec.valid-detection-benchmark]
status = "active"
line = "hunter-learning-loop" # the benchmark every line is measured on
phase = "tasks (18 of 24 done)"
owner = ["benchmarks/valid", "benchmarks/unseen/replay.py", "benchmarks/unseen/score.py"]
closes = "n/a (active)"
[spec.learned-decision-engine]
status = "parked"
phase = "implementation (20 of 47 tasks)"
owner = ["src/openultrasast/learn"]
note = "the classifier it built is the second stage of the hunter arm and stays; new learn work goes through hunter-learning-loop, not here"
closes = "mark remaining 27 tasks superseded by hunter-learning-loop; no code deletion"
[spec.plane-on-kubernetes]
status = "parked"
phase = "implementation (14 of 43 tasks)"
owner = ["src/openultrasast/plane"]
note = "kube move paused after groups 1-2 (2026-10-02); the ax lane is blocked on the gVisor checkpoint path (operator-owned)"
closes = "when the ax lane is restored: finish; otherwise delete plane/runner.py container path and ops/k8s"
[spec.contributor-scan]
status = "parked"
phase = "implementation (27 of 51 tasks), paused since 2026-09-23"
owner = ["src/openultrasast/model", "src/openultrasast/cpg"]
closes = "fold the open census/family-context tasks into engine-change-scoped-analysis; close this spec"
[spec.mcp-shift-left-agent]
status = "parked"
phase = "brief"
owner = ["src/openultrasast/mcp.py", "src/openultrasast/skills.py", "src/openultrasast/index.py"]
note = "follow-up to the pre-push hook; waits for a hook that catches something"
closes = "if not started by 2026-12-01: delete mcp.py, skills.py, index.py and their tests"
[spec.authorization-obligations]
status = "review"
phase = "tasks-generated (0 of 24)"
owner = ["src/openultrasast/semantic/obligations"]
note = "overview.md calls it superseded in practice by the dominance arbiter; obligations code exists and is called from scan (cli.py:1388)"
closes = "Pathfinder U5 decides: keep obligations as an annotation producer for the hunter, or delete semantic/obligations and its tests"
[spec.finding-feedback-loop]
status = "retiring"
phase = "design, dormant since 2026-09-09"
owner = []
closes = "delete .kiro/specs/finding-feedback-loop (no code was written)"
[spec.reachability-flow-model]
status = "retiring"
phase = "tasks-generated (0 of 23), dormant"
owner = []
note = "largely delivered by adopting Joern (overview.md)"
closes = "delete .kiro/specs/reachability-flow-model"
[spec.flow-aware-ranking]
status = "retiring"
phase = "brief"
owner = []
closes = "delete .kiro/specs/flow-aware-ranking; keep the one sentence it owns in safety-net.md"
[spec.zero-with-a-reason]
status = "retiring"
phase = "brief"
owner = []
note = "its idea (coverage gaps are reported, never a clean verdict) is already a product principle in safety-net.md"
closes = "delete .kiro/specs/zero-with-a-reason"
[spec.ir-consolidation]
status = "retiring"
phase = "brief"
owner = []
closes = "delete .kiro/specs/ir-consolidation"
[spec.ai-service-plane]
status = "done"
owner = ["src/openultrasast/plane"]
[spec.model-grounded-detection]
status = "done"
owner = ["src/openultrasast/model", "src/openultrasast/cpg"]
[spec.pair-corpus-honesty]
status = "done"
owner = ["src/openultrasast/pairs.py", "benchmarks/pairs"]
[spec.corpus-seeded-mechanisms]
status = "done"
owner = ["src/openultrasast/learn"]
[spec.propose-adjudicate-prove]
status = "done"
owner = ["src/openultrasast/semantic", "src/openultrasast/ruleset"]
[spec.tree-sitter-overlay-extra]
status = "done"
owner = ["src/openultrasast/semantic"]
# ---------------------------------------------------------------- capabilities (top-level code)
[capability.push]
status = "active"
spec = "pre-push-safety-net"
lines = 5074
[capability.engine]
status = "active"
spec = "engine-change-scoped-analysis"
modules = ["cpg", "model (minus endpoint.py)"]
lines = 7764
[capability.semantic]
status = "active"
spec = "engine-change-scoped-analysis"
modules = ["semantic", "complexity"]
lines = 4301
note = "complexity/ hotspots feed the hunter; obligations under review (see spec.authorization-obligations)"
[capability.llm-hunter-and-client]
status = "active"
spec = "hunter-learning-loop"
modules = ["tool_hunter.py", "hunter_tools.py", "provider/openrouter.py", "model/endpoint.py", "plane/budget.py"]
lines = 1700
note = "four never-enabled hunter tools removed 2026-10-13 (P0); P2 collapses the client stack to one client, one meter, one resolver"
[capability.learn]
status = "active"
spec = "hunter-learning-loop"
modules = ["learn", "plane/memory.py", "plane/tasks (fact producers)"]
lines = 11350
[capability.search-with-proof]
status = "active"
spec = "search-with-proof"
modules = ["search", "sandbox"]
lines = 4803
[capability.core]
status = "active"
modules = ["cli.py", "config.py", "contracts.py", "preprocess.py", "source.py", "findings.py", "rank.py", "mapping.py", "ruleset", "policy", "reports.py", "stages.py", "run.py", "provenance.py", "profiling.py"]
# source.py (P1, 2026-10-13) owns function ranges, enclosing function, bounds, call sites, product files, declaration
# tables and language aliases; learn no longer imports plane.tasks
note = "hunter.py is the regex quick-rule pool and should be renamed"
[capability.pairs-and-benchmarks]
status = "active"
spec = "valid-detection-benchmark"
modules = ["pairs.py", "benchmark.py", "repos.py"]
note = "pairs.py label functions feed learn/labels.py; the `ousast pairs` CLI surface is under review (U10)"
[capability.plane-executor]
status = "review"
spec = "plane-on-kubernetes"
modules = ["plane (reconciler, runner, generate, manifests, harvest, egress, delivery, router, doctor, profile, engine_alerts, workspaces)"]
lines = 4885
closes = "Pathfinder U8 lists which modules only the retired HarnessX loop used (engine_alerts, harvest, workspaces, profile are the suspects); delete those"
[capability.regress]
status = "removed" # f5a904b, 2026-10-13: deep mode records regress_retired; proof is the search line
modules = ["regress"]
lines = 549
closes = "Pathfinder U9: if search/ covers the triggerable verdict, delete regress/ and the deep-mode REGRESS branch in cli.py:839-880"
[capability.improve]
status = "removed" # 94e96c6, 2026-10-13
modules = ["improve"]
lines = 1175
note = "HarnessX-era improve lever; no active spec names it"
closes = "delete improve/, `ousast improve` (cli.py:237, 433, 1106), plane/tasks/loop.py lazy imports, tests/test_cli_improve.py, tests/test_improve_*.py"
[capability.scan-extras]
status = "review"
modules = ["fusion.py", "verification.py", "calibration.py", "scoring"] # harness.py processor machinery removed 2026-10-13
closes = "U1 found fusion decisions never reach findings or score, verification runs before MAP, processors unreachable; decide keep-and-fix or delete per module"
[capability.mcp-and-skills]
status = "parked"
spec = "mcp-shift-left-agent"
modules = ["mcp.py"] # skills.py and index.py removed f5a904b, 2026-10-13
lines = 830
closes = "see spec.mcp-shift-left-agent"
[capability.gates]
status = "review"
modules = ["gate.py", "map_gate.py", "pair_gate.py"]
lines = 428
closes = "U10: keep gate.py (CI + plane loop); delete map_gate.py and pair_gate.py if CI does not need them"
[capability.push-evaluation-instruments]
status = "review"
modules = ["push_scoring.py"] # push_inputs.py moved to benchmarks/push 2026-10-13; push_scoring stays (eligibility.py:18)
lines = 462
closes = "U3: move under benchmarks/push or delete if only tests use them"
Reference in New Issue View Git Blame Copy Permalink