mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 4.8
60617a92ba
verification-architecture.md documents the existing two-stage design: the Cairn-inspired search (brain + model calls on the VM) and the DAST proof (gVisor AX tasks in kube-ax), the trust boundary (secrets VM-only, cluster tasks secret-free with restricted egress), and the three verify lanes (ax=cluster default, vm=local Bubblewrap for $0 proofs, docker=replay). Clarifies the proof is dynamic, not abstract interpretation: AI triage stays the static backbone, proof earns the block by execution. proof-arm-opencode/ is a follow-up brief: drive proof-authoring with OpenCode MCP, an abliterated/GLM proof model (DeepSeek stays the search model), DSPy-optimized from OpenObserve traces, to beat the safety-classifier refusals and nondeterministic wiring. Flags the trust-domain decision that must come first (A: scoped key + egress inside the cluster; B: brain on VM, only DAST in gVisor — recommended to start). Credentials live in .env by name only (ABLITERATION_*, OPENOBSERVE_*); no secret value is in any tracked file. Co-Authored-By: Claude Opus 4.8 <[email protected]>