mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5
a91551e547
Access control and configuration could not complete their change context on any repository, which left 231 of 436 questions unresolved on the measured Node case and made two of the three shipped families unable to answer. The gap was larger than a missing query block. The evidence pass dispatches taint only, because only taint has an evidence vector to rank by, so these families were never asked for context at all. A new context pass asks each family with the flag set. Each query describes its own scope, which the owner research required and which matters: copying taint's projection would describe a reachability walk these queries never perform. Dominance exports the file's methods labelled operation, guard or sibling, because its claim is that a file contradicts itself. Configuration exports the file's methods labelled setting or sibling, because it asks what a file declares. Both report an empty scope explicitly rather than implying one. A family whose context query answers nothing keeps no context and stays unresolved, so none can complete on another family's context. A control asserts that directly. Confirmed on a real NodeGoat graph through the production backend: both families produce a context summary and seven scoped methods where they previously produced nothing. All seven are siblings for that file, which is the honest answer since it declares no access-control operation and no matched setting. 1,405 tests passed, nine skipped. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
60 lines
1.8 KiB
JSON
60 lines
1.8 KiB
JSON
{
|
|
"experiment": "per-family-context-v1",
|
|
"families": [
|
|
{
|
|
"query": "taint",
|
|
"seconds": 15.17,
|
|
"answered": true,
|
|
"row_kinds": {
|
|
"answer": 11,
|
|
"operation_inventory": 8,
|
|
"operation_inventory_complete": 1
|
|
},
|
|
"has_context_summary": false,
|
|
"context_methods": 0,
|
|
"relationships": {},
|
|
"boundaries": []
|
|
},
|
|
{
|
|
"query": "dominance",
|
|
"seconds": 11.87,
|
|
"answered": true,
|
|
"row_kinds": {
|
|
"context_summary": 1,
|
|
"context_method": 7
|
|
},
|
|
"has_context_summary": true,
|
|
"context_methods": 7,
|
|
"relationships": {
|
|
"sibling": 7
|
|
},
|
|
"boundaries": []
|
|
},
|
|
{
|
|
"query": "config",
|
|
"seconds": 10.96,
|
|
"answered": true,
|
|
"row_kinds": {
|
|
"context_summary": 1,
|
|
"context_method": 7
|
|
},
|
|
"has_context_summary": true,
|
|
"context_methods": 7,
|
|
"relationships": {
|
|
"sibling": 7
|
|
},
|
|
"boundaries": []
|
|
}
|
|
],
|
|
"build": {
|
|
"exit": 0,
|
|
"bytes": 883113
|
|
},
|
|
"milestone": "M1b task 12.2",
|
|
"finding": "Dominance and configuration now produce their own change context on a real graph: a context summary plus seven context methods each, scoped to the file the question is about. Taint shows no context here because its producer runs in the evidence pass, which this probe does not use; that is unchanged.",
|
|
"note_on_relationships": "All seven are 'sibling' because contributions.js declares no access-control operation and no matched configuration setting. That is the honest answer for that file, not an empty projection: the scope was described, and nothing in it is an operation of those families.",
|
|
"limits": [
|
|
"One file of one JavaScript tree; the end-to-end effect is measured by the replay, not here."
|
|
]
|
|
}
|