Open_Ultra_SAST/RELEASE_NOTES.md

v2.0.1 (2026-10-02)

v2.0.0 was tagged but never published: its release job stopped at the format check (see below). v2.0.1 is the first published 2.x release and carries everything listed under v2.0.0 plus the following.

• Licence: Apache-2.0. LICENSE added; pyproject.toml declares license = "Apache-2.0"; both images carry the org.opencontainers.image.licenses label.
• Container images on GHCR. Each version tag pushes ghcr.io/norandom/openultrasast (the scan image: Joern and php-cli) and ghcr.io/norandom/openultrasast-runner (the plane's task runner), tagged with the version and, for full releases, latest. The digests are in the release job's summary; pin by digest (Agent Substrate rejects tags).
• CI green again. CI and the release job check formatting and lint over the whole repository; eight benchmark scripts had drifted. They were reformatted (two noqa comments, one renamed loop variable; no script computes anything differently), and the local gate now runs the same whole-tree commands.
• Front-door README. Install in four tiers (quick scan without Docker; standard and deep with the scan image; the plane on kind; Kubernetes on k3s, planned), every claim checked against the CLI, and links to every documentation page.

Also in this release (previously listed as Unreleased)

• Documentation audited against v2.0.0 (no behaviour change). New docs/deployment.md: where the plane runs today, this host's setup, and step-by-step guidance for a separate Kubernetes cluster with what is implemented and what is planned; no cluster deployment has been made, and the kube context (kind-$KIND_CLUSTER_NAME) and doctor's registry check (localhost:5001) are still hard-coded. The decision-engine pages state slice 2 (six families, benchmarks/measurements/2026-10-02-decision-engine-slice-2/record.json: pooled AUC 0.77-0.96, within-pair 0.72-0.93, BLOCK offered nowhere, canary below 0.9 for three families) and that the engine is not adopted. The model layer's residual question is documented at model/pipeline.py (model/judge.py was deleted); a missing provider key is described as it behaves (no question asked, entailed findings reported), not as a recorded degradation. The .env reference lists the memory-store variables; ousast plane memory-normalise is listed.
• Removed: the unused vector index, ousast index and [embeddings] (legacy cleanup, 2026-10-02). index.py keeps only the text chunker the skill router uses; the VectorIndex half had no caller, and nothing read the chunks.json the subcommand wrote. [embeddings] model/store fail to load with the reason, like the other retired keys; OPENROUTER_EMBEDDING_MODEL is no longer read (ousast learn memory embed --model names the model).
• Retired three config keys nothing read (2026-10-02): [sandbox] network, [sandbox] workspace_readonly and [complexity] top_k now fail to load naming why. The sandbox always ran with --network none and a read-only workspace regardless of the first two; no stage read top_k. memory_mb, timeout_seconds, pids_limit and max_hunter_hotspots are read and stay.

v2.0.0 (2026-10-02)

A new major release: the agentic plane runs on google/ax, HarnessX is gone, detection decisions move toward a trained-by-memory AI classifier, and the plane memory lives in an S3-compatible store.

• Agentic plane on ax (ousast plane run|status|doctor|workspaces|remember|alerts-engine|harvest): tasks run in gVisor sandboxes on Agent Substrate; one Model and one budget per task; token attribution per task and model; credentials only in the start request; per-task egress policies. First increment measured: 16/20 declared sites agreed at $0.0205 per candidate (benchmarks/independent/plane-increment-2.json).
• HarnessX removed. Retired config keys fail with a reason; [harnessx] warns. Deterministic outputs proven byte-identical (benchmarks/measurements/2026-09-30-harnessx-removal-equality/).
• Memory store (OUSAST_MEMORY): local files or any S3-compatible store with versioning, lifecycle, tags and S3 Select; RustFS is the tested server (docs/rustfs.md). The store verifies its bucket at startup and never falls back; every row carries its kind's queryable fields. New extra s3 (boto3).
• Decision engine (in development, not adopted): an in-house DSPy-style AI classifier with local memory; labels from ground truth; repository-grouped evaluation. Slice 2 on six families: out-of-repo AUC 0.77-0.96 (within-pair 0.72-0.93); BLOCK not offered anywhere; see benchmarks/measurements/2026-10-02-decision-engine-slice-2/record.json and docs/memory-and-detection.md.
• Improvement from memory: ousast improve --memory; the loop as a plane Run.
• PHP quick-mode rules (in-sample measurement only) beside the Joern engine; framework knowledge tagged as optional priors (ruleset/frameworks.toml).
• Populations: v3 (PHP, 15 cases) frozen and untouched as the one-time final check; 97 advisory-fix pairs added for negatives; licences of published cases verified (v1's OpenCVE case is BUSL-1.1).
• Removed legacy: dead modules (model.judge, model.execution, model.calibrate, stage_processors, slot_contract); unread config keys [dynamic], [evidence], [variants], [models] patcher retired (resolved_config.json loses those sections); reference-only scripts under benchmarks/archive/; the module audit now classifies by real imports.
• Docs: MkDocs site (mkdocs serve), including token ergonomics and the RustFS setup.

Detailed notes for this release follow.

PHP quick-mode rules (2026-09-30)

ruleset/php/rules.toml adds 18 PHP rules (SQL injection, command injection, file inclusion, path, open redirect, SSRF; code eval, unserialize and echo XSS as shadow). They were written on the development corpus, so their numbers are in-sample only (benchmarks/measurements/2026-09-30-php-quick-rules/measurement.json); PHP is not part of the detection gate. ousast plane alerts-engine produces a Run's alerts for PHP from the Joern engine image on the host.

Framework knowledge as optional priors (2026-09-30)

Rule and taint-fact entries that know a framework or library carry a framework/library tag naming a row of ruleset/frameworks.toml; the loaders take priors ("all" by default, unchanged behaviour; "off"; or a set of ids). Scan output is unchanged.

Decision engine, in development (2026-10-01)

The learned decision engine (signals from every instrument, labels from ground truth, an AI classifier with local memory compiled in house) is in development and not adopted: no scan, pre-push check or report uses it. New maintainer commands: ousast learn labels|memory|compile| evaluate|curve|audit-leaks and ousast plane harvest; new plane tasks features and roles; the advisory-fixes pair source (97 advisory fix commits). First slice (injection, 110 out-of-repository candidates): ADVISORY recall 0.90, precision 0.54, BLOCK not offered (benchmarks/measurements/2026-10-01-decision-engine-injection-slice/record.json; docs/decision-engine.md).

Documentation (2026-10-02)

The README is reduced to user-facing material; scan internals moved to docs/architecture.md and measured results to docs/evaluation.md. Removed references to commands that no longer exist (ousast mechanisms export, ousast pairs --loo) and corrected the description of deep mode, which runs sandboxed regression snippets when Docker is available.

Unread config keys retired (2026-10-02)

These keys loaded but nothing ever read them. They now fail with RetiredConfigError (the CLI prints it and exits 2), naming why. Remove them from your config:

• [models] patcher: no patching stage calls a model.
• [dynamic] enabled, [dynamic] network_scope: no dynamic or deep tier exists yet.
• [evidence] minimum_report_verified, minimum_exploit, minimum_patch: evidence tiers come from the program model's ladder, not from configuration.
• [variants] enabled, [variants] max_mechanisms: the variant search they configured was deleted earlier. Output shape. resolved_config.json no longer has the dynamic, evidence and variants sections or models.patcher. harness.json keeps its shape: model_roles.patcher is always null, like model_roles.verifier.

HarnessX removed; the ax plane is the agentic path (2026-09-30)

HarnessX, the optional agentic extra (openultrasast[harnessx]), is removed with its code, packaging extra and lock entries (retired 2026-09-30). Agentic work runs on the ax plane: ousast plane run|status|doctor|remember, with one Model and one usd/calls budget per task, deny-by-default egress per task, and the provider key sent only in the task's start request. See ops/ax/README.md. Deterministic outputs (pair replay, quick benchmark, standard scan, improve --dry-run) are byte-identical before and after.

Retired config keys (retired 2026-09-30):

• [models] verifier fails with RetiredConfigError (the CLI prints it and exits 2): LLM verification runs on the plane (verify + agree). Remove the key.
• [fusion] panel_model and [fusion] decider_model fail the same way: fusion is deterministic; independent LLM agreement is the plane's agree task. Remove the keys.
• A [harnessx] section (retired 2026-09-30) loads with one warning naming the plane and is otherwise ignored.

Silent change for [models] hunter. If you set [models] hunter and had the extra installed, a standard scan ran two LLM hunters: the MAP-stage tool hunter and the HarnessX hunter pool (findings with ids hx-hunter:<path>:<line>). The key is still valid and still enables the tool hunter, so nothing fails and nothing warns, but the second hunter's findings no longer appear. Repository-wide LLM hunting runs on the plane (verify passes and agree).

The LLM judge, the LLM fusion panels and the in-loop hosting of deterministic stages are retired without a local replacement. ousast improve --memory now proposes rule-status edits from the plane memory, through the unchanged validator and gate.

v1.2.0-alpha.1

Experimental pre-push security safety net for AI-accelerated development. Python package version: 1.2.0a1. This alpha is not a rollout GO; no real hook capability is enabled.

• Analyze immutable pushed commits across refs without changing the working tree or replacing existing hooks. Share one deadline across preparation, analysis and reporting.
• Keep the existing ranker responsible for scope and physically exclude vendor code from graph inputs. Reuse only compatible, complete immutable graph and answer artifacts.
• Gate advisory and blocking alerts on the same actionable change/witness/repair evidence. Preserve explicit incomplete coverage; optional model assistance cannot create evidence.
• Add frozen runtime and PHP/Node/Python evaluation records with honest populations, missing-target accounting and versioned eligibility that rejects stale evidence.
• Repair the pinned JavaScript frontend's Gruntfile omission and incomplete-census handling. The real NodeGoat input now retains 44/44 files; native PHP/JavaScript smoke passes.

Implementation verification: 1321 tests passed, nine skipped; detector/map/local-pair gates and packaged partition smoke passed. These checks verify implementation contracts, not useful hook precision, recall or latency.

Rollout remains blocked by representative changed-code latency/completion, VAmPI query/context/transitive evidence and independent reviewed per-capability populations. The earlier eligibility artifact is stale under the repaired identities and enables nothing. See current spec status for the owners, unchanged thresholds and required revalidation. Pre-push implementation stands at 26/27 tasks; task 8.3 remains blocked. C arithmetic/bounds detection is unsupported.