mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5.5
c8d2fefbb8
A4: roadmap-2026-09-04.md moves to .kiro/archive/steering/ so it no longer loads as steering (roadmap.md and safety-net.md replaced it); roadmap.md's pointer follows it. overview.md's spec table is recounted from tasks.md and spec.json (adds ai-service-plane, harnessx-removal, learned-decision-engine, pre-push-safety-net; drops the stale "active one"), and the module line now cites the regenerated audit: 150 modules, 145 load-bearing, 5 standalone, 0 orphaned; 1,964 tests collected. A5: a dated status note at the top of the requirements (or brief) of 16 specs: retired, superseded, dormant or complete, and for model-grounded-detection the removal of judge/calibrate/execution (closing the Req 10 execution-tier option). spec.json phase corrected to implementation-complete where every task is checked (model-grounded- detection, propose-adjudicate-prove, tree-sitter-overlay-extra, corpus-seeded-mechanisms, pair-corpus-honesty); openrouter-sast-harness gets a spec.json with status retired. Nothing deleted, no spec moved. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
29 lines
3.3 KiB
JSON
29 lines
3.3 KiB
JSON
{
|
|
"feature_name": "model-grounded-detection",
|
|
"created_at": "2026-09-08T00:00:00Z",
|
|
"updated_at": "2026-10-02T00:00:00Z",
|
|
"language": "en",
|
|
"phase": "implementation-complete",
|
|
"approvals": {
|
|
"requirements": {
|
|
"generated": true,
|
|
"approved": true
|
|
},
|
|
"design": {
|
|
"generated": true,
|
|
"approved": true
|
|
},
|
|
"tasks": {
|
|
"generated": true,
|
|
"approved": true
|
|
}
|
|
},
|
|
"ready_for_implementation": true,
|
|
"supersedes": [
|
|
"learning-harness",
|
|
"constrained-detector"
|
|
],
|
|
"depends_on": [],
|
|
"approval_note": "2026-09-08 corrective brief drafted at the maintainer's direction ('can you produce a corrective spec that supersedes the project and sets a course'). Written after the learning-harness evolve rounds produced zero decisions distinguishable from noise, and after researching Clearwing (/home/mc/Source/clearwing, fork norandom/deepwing), Google Big Sleep, and the DARPA AIxCC 2025 finals. Not approved; requirements not generated. The central recommendation is to adopt Clearwing as the execution substrate rather than rebuild, and to contribute the web/logic detection path (taxonomy + IR candidate enumeration + obligation checker + a differential web oracle) that Clearwing's crash-oracle model does not reach. ; 2026-09-08 renamed execution-grounded-detection -> model-grounded-detection after the maintainer's correction: execution is not possible for all SAST targets and the bugs we own do not crash, so the arbiter is a program model built deterministically from code (IR candidate enumeration, binding-chain dataflow, obligation/guard-dominance) that checks LLM claims, producing a static evidence ladder (suspicion -> model_corroborated -> model_entailed); execution is a deferred tier for memory-safety-in-C only, adopted from Clearwing when a class needs it. ; 2026-09-08 requirements generated at the maintainer's direction ('write the requirements, and include to throw away broken parts. include the reduction of tests to what makes sense. I think there is an outgrowth problem here'): subtraction is Req 1-3 (remove the noise architecture, reduce 832 tests to surviving behavior, audit 99 modules for orphans) and precedes adoption of the Joern CPG arbiter (Req 4-8), the corpus as calibration set (Req 9), and the deferred Clearwing execution tier (Req 10). ; 2026-09-08 requirements approved by the maintainer in session ('approve the requirements and run the design phase'); design generated: subtraction is phase 1 (gate-protected, ~5000 lines removed before any Joern), a Joern spike on the injection family is phase 2 and can end the design before the integration cost is paid. ; 2026-09-08 design approved and tasks generated ('approve the design and generate the tasks. add infos so that Opus can follow the tasks without running into complexity escalations'): tasks carry an agent-guidance preamble with the eighteen-defect lesson, the gate-baseline safety net, the zero-dep capability-detection pattern, and a full coupling map of every learning/mechanism touchpoint so the subtraction is not crash-driven discovery; group 1 is pure gate-protected subtraction, group 2 is a Joern go/no-go that gates groups 3-6. ; 2026-09-08 tasks approved by the maintainer in session ('approve the tasks and move to 1.) as a whole'); implementing group 1 (subtraction) as a whole."
|
|
}
|