mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5.5
1d67412e2b
20 development pairs, one per repository, 4 per language, 5 per family; identities in a gitignored manifest, counts and digest committed. Executor smoke drives one executor task end to end without a model and fails loudly on an unread clone. kube-ax operator constraints as steering. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2.2 KiB
2.2 KiB
kube-ax operator constraints
Verified by the operator on 2026-10-05. These constraints apply across all workloads.
- Two workers, one task per worker, at most two tasks in flight cluster-wide. AX has no
queue: a third apply returns
no free workers available. Treat this as back-pressure, retry the same task/lane with 15–30 seconds of jitter until its deadline, and never count it as a sandbox failure or trigger VM fallback. The host dispatcher shares a two-slot reservation across workload instances and long-lived search executors. /and/tmpare RAM-backed and consume the worker's 3 GiB./workspaceis the only disk-backed path, with about 2 GiB usable per task. Executor and verifier entrypoints use/workspace/tmp,/workspace/.npm,/workspace/.m2,/workspace/.composer,/workspace/.pip, and/workspace/.gradlethrough the respective tool environment variables. Builds and extracted checkouts live under/workspacetoo. The default aggregate workspace scratch guard is 2 GiB;OUSAST_SCRATCH_BYTESconfigures it. Exceeding it returnscould_not_build, reasonscratch limit. The guard polls during child execution and checks after exit; it is not an instantaneous filesystem quota or a replacement for the worker memory limit.ousast-engine-search-verify-*tasks have no egress. The requested exception forfiles.because-security.com:443is pending, not operationally verified. They receive one presigned archive containingcheckout/,products/, andspec.json, built/exported by an executor. OnlyVERIFY_INPUT_URLandRESULT_URLcross the verifier boundary. Verifiers reject build recipes and do not install dependencies or fetch repositories. Executors finish and release their slots before verifier repetitions start. Both task types must be provisioned without model credentials.- All tasks share one public IP. Repository acquisition uses HTTPS git clone from
github.comor archives fromcodeload.github.com, neverapi.github.com. Host-side metadata queries are a separate concern. Search tasks receive checkout archives; executor tool guidance carries the same acquisition rule. Retain the 60-second first-download retry for delayed task egress policy activation.