Marius CiepluchandClaude Opus 5.5 d1aabf0f66 ci: green again -- format and lint the whole tree; push the scan and runner images to GHCR on tags ...

CI and the release job check `ruff format --check .` and `ruff check .` over the
whole repository, while the local gate checked only src and tests, so eight
benchmark scripts drifted and the v2.0.0 release job stopped before building.
The fixes are formatting, two noqa comments and one renamed loop variable; no
script computes anything differently. The local gate now checks the whole tree.

The release workflow gains an images job: Dockerfile -> ghcr.io/<owner>/openultrasast,
plane/Dockerfile.runner -> ghcr.io/<owner>/openultrasast-runner, tagged with the
version, and the digests written to the job summary.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

2026-10-02 20:09:28 +02:00

..

candidates-v3-php.json

bench(independent): reserve population v3 (PHP, 16 cases) by rule

2026-09-30 18:03:07 +02:00

evaluate.py

ci: green again -- format and lint the whole tree; push the scan and runner images to GHCR on tags

2026-10-02 20:09:28 +02:00

freeze-v1.json

spec(pre-push-safety-net): freeze the independent population v1 (15.1)

2026-09-24 16:43:32 +02:00

freeze-v2.json

spec(pre-push-safety-net): freeze the independent population v2

2026-09-26 18:02:03 +02:00

freeze-v3-php.json

bench(independent): freeze population v3 (PHP)

2026-09-30 18:15:52 +02:00

freeze.py

ci: green again -- format and lint the whole tree; push the scan and runner images to GHCR on tags

2026-10-02 20:09:28 +02:00

hunter-protocol-v2.md

spec(pre-push-safety-net): pre-register the hunter experiment on population v2

2026-09-28 09:10:02 +02:00

plane-increment-1.json

bench(plane): correct the increment reading -- 17/20 flagged in either pass, not 19

2026-09-30 08:20:50 +02:00

plane-increment-2.json

bench(plane): increment gate met after the tie-break -- 16/20 agreed at $0.0205/candidate

2026-09-30 08:35:41 +02:00

population-v1.toml

bench(independent): OpenCVE case licence checked (BUSL-1.1); published by maintainer decision

2026-10-02 09:12:22 +02:00

population-v2.toml

bench(independent): verify the licences of five v2 cases before publishing

2026-10-02 09:02:58 +02:00

population-v3-php.toml

bench(independent): freeze population v3 (PHP)

2026-09-30 18:15:52 +02:00

protocol-v1.md

bench(independent): OpenCVE case licence checked (BUSL-1.1); published by maintainer decision

2026-10-02 09:12:22 +02:00

protocol-v2.md

bench(independent): verify the licences of five v2 cases before publishing

2026-10-02 09:02:58 +02:00

protocol-v3.md

bench(independent): protocol v3 budget and shadow-rule choices confirmed by the maintainer

2026-09-30 18:23:09 +02:00

research-2026-09-24.md

spec(pre-push-safety-net): reserve the independent population v1 (15.1), unscanned

2026-09-24 16:12:22 +02:00

research-2026-09-26.md

spec(pre-push-safety-net): reserve the independent population v2 (17 cases, unscanned)

2026-09-26 17:53:51 +02:00

research-2026-09-30-php.md

bench(independent): reserve population v3 (PHP, 16 cases) by rule

2026-09-30 18:03:07 +02:00

results-v1.json

measure(independent): first evaluation on the frozen population -- fails every M4 gate

2026-09-25 09:56:26 +02:00

results-v2-hunter.json

measure(independent): the unchanged tool hunter on population v2 -- recall 1/17, and why

2026-09-28 11:36:32 +02:00

results-v2-model-pipeline.json

docs(pre-push-safety-net): record the model-driven pipeline result on v2 and stop

2026-09-29 11:29:06 +02:00

results-v2.json

measure(independent): evaluation of population v2 under protocol v2 -- fails every M4 gate

2026-09-28 08:52:53 +02:00

selection-v2-model-sinks.json

measure(independent): model-classified sinks put the vulnerable function in scope in 15/17

2026-09-28 13:21:41 +02:00

verifier-batched-check-2026-09-29.json

measure(independent): triage + per-file batching + two-pass agreement -- 16/20 sites, flicker cut 26 -> 9, 34% cheaper

2026-09-29 10:22:11 +02:00

verifier-check-2026-09-29.json

measure(independent): known-answer check of the verifier -- 11/15 sites, unstable verdicts, escalation costs more

2026-09-29 10:10:33 +02:00