mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-18 12:39:28 +00:00
Marius CiepluchandClaude Opus 5
2b973dc0db
The whole engine integration is one subprocess boundary: joern-parse builds a cpg.bin, joern --script runs a shipped CPGQL query that prints its JSON between fence markers, because Joern's stdout carries a banner and a REPL prompt around whatever a script emits. Nothing is imported in-process, so the core install keeps dependencies = [] -- a test walks the seam's AST to assert it imports only the standard library and names no JVM binding. Fail closed everywhere. A build or query that errors, times out, or prints something unparseable yields no verdict and the caller reports suspicion. The taint verdict distinguishes this from absence deliberately: a query returning None means "the engine could not decide", which is not "there is no flow", and conflating them is how a missing engine silently becomes a clean bill of health. The verdict is where the ladder earns its keep. An unsanitized source->sink path is model_entailed -- the graph establishes it and the LLM's claim is no longer load-bearing. A path a sanitizer may break is model_corroborated: the flow is real, but whether the sanitizer suffices is the semantic residual the LLM answers, checked against this verdict rather than averaged over runs. The chosen flow is picked by a total order (shortest, then lexicographic), so two runs over one CPG cannot disagree -- Req 6.4 asserted directly. The query itself is the part our flat IR could not do: reachableByFlows walks the PDG, so `q = "..." + request.args["x"]; execute(q)` is found, which is exactly the one-hop limit that held measured entailment at 2.2%. Capability detection reuses semantic/engines.joern_available rather than growing a second notion of "installed". The audit manifest is regenerated; the new modules are named by Req 4/5/6 rather than counted as orphans. Task 2.3, the go/no-go measurement, needs Joern installed and has not run. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
933 lines
26 KiB
JSON
933 lines
26 KiB
JSON
{
|
|
"counts": {
|
|
"load_bearing": 79,
|
|
"standalone_capability": 7
|
|
},
|
|
"generated": "2026-09-08 (regenerated after group 2 added the cpg/ seam)",
|
|
"kept_with_a_lever_stripped": {
|
|
"improve/evolve.py + improve/validator.py": "the design's Removed list named these whole, but each is a mix: the mechanism lever (removed) and the deterministic rule-status improve loop that `ousast improve` still runs from benchmark evidence, which has no LLM in it and is not what this feature supersedes. Deleting the files would have taken a retained capability with them."
|
|
},
|
|
"modules": 86,
|
|
"note": "Classification of every source module after the group-1 subtraction. load_bearing = reachable from a gate, the CLI, or named by a surviving requirement; standalone_capability = its own entry point or protocol, deliberately off the scan path; orphaned = no importer, no entry point, no surviving requirement -- removed, never carried.",
|
|
"orphaned": [],
|
|
"removed_in_this_pass": {
|
|
"learning/ (16 modules)": "the noise architecture: rounds, acceptance, proposer, journal, canaries, verifiers, difficulty, scoring, classify, detectors, split, publish. Taxonomy, candidates and endpoint were re-homed to model/ first.",
|
|
"semantic/loo.py": "leave-one-out scoring of the mechanism store",
|
|
"semantic/mechanisms.py": "the mechanism store and the shape search that fed the optimisation loop",
|
|
"semantic/prove_budget.py": "embedding-ordered promotion budget, driven by the mechanism store",
|
|
"semantic/seed.py": "the mechanism exporter",
|
|
"semantic/variant_search.py": "variant search over the mechanism store",
|
|
"semantic/variants.py": "the shape-derivation optimisation surface; its guard vocabulary was ported verbatim to model/specs.py first, and trailing_name re-homed to semantic/ir.py",
|
|
"vectorstore.py": "a vector-store bakeoff harness with no production caller and no CLI entry, kept alive only by its own test -- the one genuine orphan the audit found"
|
|
},
|
|
"rows": [
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"gate",
|
|
"improve.evolve",
|
|
"map_gate",
|
|
"mcp",
|
|
"pairs"
|
|
],
|
|
"module": "benchmark",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "calibration",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"mcp"
|
|
],
|
|
"module": "cli",
|
|
"reason": "entry point"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"complexity.hints",
|
|
"complexity.ledger",
|
|
"complexity.map",
|
|
"map_gate",
|
|
"regress.candidate",
|
|
"semantic.prove_filter",
|
|
"tool_hunter"
|
|
],
|
|
"module": "complexity",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"complexity",
|
|
"complexity.map"
|
|
],
|
|
"module": "complexity.hints",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"complexity",
|
|
"complexity.map",
|
|
"regress.candidate"
|
|
],
|
|
"module": "complexity.ledger",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"complexity",
|
|
"complexity.hints",
|
|
"complexity.ledger",
|
|
"map_gate",
|
|
"regress.candidate",
|
|
"semantic.prove_filter",
|
|
"tool_hunter"
|
|
],
|
|
"module": "complexity.map",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"complexity",
|
|
"complexity.hints",
|
|
"complexity.map"
|
|
],
|
|
"module": "complexity.signals",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"harness",
|
|
"hunter_tools",
|
|
"model.endpoint",
|
|
"pairs",
|
|
"regress.candidate",
|
|
"regress.recipes",
|
|
"run"
|
|
],
|
|
"module": "config",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cpg.backend",
|
|
"model.taint"
|
|
],
|
|
"module": "cpg",
|
|
"reason": "model-grounded-detection Req 4: the CPG seam package"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.taint"
|
|
],
|
|
"module": "cpg.backend",
|
|
"reason": "model-grounded-detection Req 4.1/4.5: the single Joern subprocess boundary"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cpg.backend"
|
|
],
|
|
"module": "cpg.capability",
|
|
"reason": "model-grounded-detection Req 4.2/4.3: the engine probe that degrades to suspicion"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"benchmark",
|
|
"calibration",
|
|
"cli",
|
|
"complexity.ledger",
|
|
"complexity.map",
|
|
"complexity.signals",
|
|
"fusion",
|
|
"gate",
|
|
"hunter",
|
|
"hunter_harness",
|
|
"hunter_tools",
|
|
"improve.evolve",
|
|
"map_gate",
|
|
"pairs",
|
|
"rank",
|
|
"regress.candidate",
|
|
"reports",
|
|
"scoring.project_score",
|
|
"semantic.obligations.check",
|
|
"semantic.overlay",
|
|
"semantic.prove_filter",
|
|
"stage_processors",
|
|
"tool_hunter",
|
|
"verification",
|
|
"verify_judge"
|
|
],
|
|
"module": "findings",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "standalone_capability",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "fusion",
|
|
"reason": "two-panel adjudication engine; reached from the scan's report stage and used standalone"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "gate",
|
|
"reason": "entry point"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"slot_contract"
|
|
],
|
|
"module": "harness",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "standalone_capability",
|
|
"importers": [
|
|
"cli",
|
|
"fusion",
|
|
"hunter_harness",
|
|
"stage_processors",
|
|
"verify_judge"
|
|
],
|
|
"module": "harness_ext",
|
|
"reason": "HarnessX extension surface; loaded by name when the optional harness is present"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"hunter_harness"
|
|
],
|
|
"module": "hunter",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "standalone_capability",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "hunter_harness",
|
|
"reason": "harness wiring for the tool hunter; used by the hunter path and by mcp"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"tool_hunter"
|
|
],
|
|
"module": "hunter_tools",
|
|
"reason": "imported by tool_hunter"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"improve.evolve"
|
|
],
|
|
"module": "improve",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"improve"
|
|
],
|
|
"module": "improve.evolve",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"improve",
|
|
"improve.evolve"
|
|
],
|
|
"module": "improve.journal",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"improve",
|
|
"improve.evolve"
|
|
],
|
|
"module": "improve.validator",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"skills"
|
|
],
|
|
"module": "index",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [],
|
|
"module": "map_gate",
|
|
"reason": "entry point"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"gate",
|
|
"hunter_tools",
|
|
"improve.evolve",
|
|
"map_gate",
|
|
"pairs",
|
|
"preprocess",
|
|
"stage_processors"
|
|
],
|
|
"module": "mapping",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "standalone_capability",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "mcp",
|
|
"reason": "narrow MCP server over stdio; its own `ousast mcp` entry point and OpenCode integration"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"model.specs",
|
|
"model.taint"
|
|
],
|
|
"module": "model",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [],
|
|
"module": "model.audit",
|
|
"reason": "model-grounded-detection Req 3: this classifier; run by the maintainer, not by the scan"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "model.candidates",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [],
|
|
"module": "model.endpoint",
|
|
"reason": "model-grounded-detection Req 8: the judge client, wired by model/judge.py in group 3"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.taint"
|
|
],
|
|
"module": "model.ladder",
|
|
"reason": "model-grounded-detection Req 5: the evidence ladder every finding carries"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.taint"
|
|
],
|
|
"module": "model.specs",
|
|
"reason": "model-grounded-detection Req 7.2-7.4: the security vocabularies the CPG queries are parameterised by"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [],
|
|
"module": "model.taint",
|
|
"reason": "model-grounded-detection Req 6.1: taint reachability over the CPG, the flow-family arbiter"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"model.specs"
|
|
],
|
|
"module": "model.taxonomy",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "pair_gate",
|
|
"reason": "entry point"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"improve",
|
|
"improve.evolve",
|
|
"model.candidates",
|
|
"pair_gate"
|
|
],
|
|
"module": "pairs",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"findings",
|
|
"hunter",
|
|
"hunter_harness",
|
|
"improve.evolve",
|
|
"improve.validator",
|
|
"scoring.project_score",
|
|
"semantic.overlay",
|
|
"stage_processors"
|
|
],
|
|
"module": "policy",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"policy"
|
|
],
|
|
"module": "policy.verycode",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"complexity.hints",
|
|
"complexity.map",
|
|
"complexity.signals",
|
|
"findings",
|
|
"gate",
|
|
"hunter",
|
|
"hunter_harness",
|
|
"hunter_tools",
|
|
"improve.evolve",
|
|
"index",
|
|
"map_gate",
|
|
"mapping",
|
|
"model.candidates",
|
|
"pairs",
|
|
"rank",
|
|
"regress.candidate",
|
|
"semantic.overlay",
|
|
"skills",
|
|
"stage_processors"
|
|
],
|
|
"module": "preprocess",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "provenance",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.endpoint",
|
|
"tool_hunter"
|
|
],
|
|
"module": "provider",
|
|
"reason": "imported by model.endpoint, tool_hunter"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.endpoint",
|
|
"tool_hunter"
|
|
],
|
|
"module": "provider.openrouter",
|
|
"reason": "imported by model.endpoint, tool_hunter"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"calibration",
|
|
"cli",
|
|
"findings",
|
|
"gate",
|
|
"hunter",
|
|
"hunter_harness",
|
|
"hunter_tools",
|
|
"improve.evolve",
|
|
"map_gate",
|
|
"pairs",
|
|
"stage_processors"
|
|
],
|
|
"module": "rank",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"harness",
|
|
"reports",
|
|
"semantic.obligations.intent"
|
|
],
|
|
"module": "redaction",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"regress.candidate"
|
|
],
|
|
"module": "regress",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"regress"
|
|
],
|
|
"module": "regress.candidate",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"regress",
|
|
"regress.candidate"
|
|
],
|
|
"module": "regress.recipes",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"regress",
|
|
"regress.candidate"
|
|
],
|
|
"module": "regress.safety",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"regress",
|
|
"regress.candidate"
|
|
],
|
|
"module": "regress.verdict",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "reports",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"findings",
|
|
"hunter",
|
|
"hunter_harness",
|
|
"improve.evolve",
|
|
"improve.validator",
|
|
"pairs",
|
|
"stage_processors"
|
|
],
|
|
"module": "ruleset",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"improve.validator",
|
|
"ruleset"
|
|
],
|
|
"module": "ruleset.store",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"reports"
|
|
],
|
|
"module": "run",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"regress.candidate",
|
|
"regress.recipes",
|
|
"regress.safety",
|
|
"regress.verdict"
|
|
],
|
|
"module": "sandbox",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"sandbox"
|
|
],
|
|
"module": "sandbox.probe",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"regress.candidate",
|
|
"regress.recipes",
|
|
"regress.safety",
|
|
"sandbox"
|
|
],
|
|
"module": "sandbox.runner",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"improve.evolve",
|
|
"stage_processors"
|
|
],
|
|
"module": "scoring",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"scoring"
|
|
],
|
|
"module": "scoring.project_score",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"cpg.capability",
|
|
"hunter_tools",
|
|
"model.candidates",
|
|
"model.specs",
|
|
"pairs",
|
|
"semantic.cst",
|
|
"semantic.engines",
|
|
"semantic.functions",
|
|
"semantic.ir",
|
|
"semantic.obligations.check",
|
|
"semantic.obligations.operations",
|
|
"semantic.obligations.shapes",
|
|
"semantic.overlay",
|
|
"semantic.prove_filter",
|
|
"semantic.taint"
|
|
],
|
|
"module": "semantic",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"semantic.ir"
|
|
],
|
|
"module": "semantic.cst",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cpg.capability",
|
|
"semantic",
|
|
"semantic.overlay"
|
|
],
|
|
"module": "semantic.engines",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"semantic",
|
|
"semantic.cst",
|
|
"semantic.engines"
|
|
],
|
|
"module": "semantic.extra",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"hunter_tools",
|
|
"model.candidates",
|
|
"model.specs",
|
|
"pairs",
|
|
"semantic",
|
|
"semantic.obligations.check",
|
|
"semantic.obligations.operations",
|
|
"semantic.obligations.shapes",
|
|
"semantic.overlay",
|
|
"semantic.taint"
|
|
],
|
|
"module": "semantic.facts",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"hunter_tools",
|
|
"pairs",
|
|
"semantic.obligations.shapes",
|
|
"semantic.overlay"
|
|
],
|
|
"module": "semantic.functions",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"hunter_tools",
|
|
"model.candidates",
|
|
"pairs",
|
|
"semantic.cst",
|
|
"semantic.functions",
|
|
"semantic.obligations.check",
|
|
"semantic.obligations.operations",
|
|
"semantic.obligations.shapes",
|
|
"semantic.overlay",
|
|
"semantic.taint"
|
|
],
|
|
"module": "semantic.ir",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"hunter_tools",
|
|
"model.candidates",
|
|
"model.specs",
|
|
"pairs",
|
|
"semantic.obligations.check",
|
|
"semantic.obligations.dominance",
|
|
"semantic.obligations.intent",
|
|
"semantic.obligations.operations",
|
|
"semantic.obligations.policy",
|
|
"semantic.obligations.shapes",
|
|
"semantic.obligations.siblings"
|
|
],
|
|
"module": "semantic.obligations",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"semantic.obligations",
|
|
"semantic.obligations.intent"
|
|
],
|
|
"module": "semantic.obligations.check",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"hunter_tools",
|
|
"pairs",
|
|
"semantic.obligations.check"
|
|
],
|
|
"module": "semantic.obligations.dominance",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.specs",
|
|
"pairs",
|
|
"semantic.obligations",
|
|
"semantic.obligations.check",
|
|
"semantic.obligations.operations",
|
|
"semantic.obligations.policy",
|
|
"semantic.obligations.shapes",
|
|
"semantic.obligations.siblings"
|
|
],
|
|
"module": "semantic.obligations.facts",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "semantic.obligations.intent",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.candidates",
|
|
"semantic.obligations.check",
|
|
"semantic.obligations.dominance",
|
|
"semantic.obligations.siblings"
|
|
],
|
|
"module": "semantic.obligations.operations",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"semantic.obligations.check"
|
|
],
|
|
"module": "semantic.obligations.policy",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"semantic.obligations",
|
|
"semantic.obligations.operations"
|
|
],
|
|
"module": "semantic.obligations.shapes",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"semantic.obligations.check"
|
|
],
|
|
"module": "semantic.obligations.siblings",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"semantic",
|
|
"semantic.prove_filter"
|
|
],
|
|
"module": "semantic.overlay",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"semantic"
|
|
],
|
|
"module": "semantic.prove_filter",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"semantic.overlay"
|
|
],
|
|
"module": "semantic.taint",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "standalone_capability",
|
|
"importers": [
|
|
"hunter",
|
|
"hunter_harness"
|
|
],
|
|
"module": "skills",
|
|
"reason": "skill router; consumed by mcp and by the OpenCode integration, not by the scan path"
|
|
},
|
|
{
|
|
"classification": "standalone_capability",
|
|
"importers": [
|
|
"stage_processors"
|
|
],
|
|
"module": "slot_contract",
|
|
"reason": "the slot/contract protocol stage_processors implements"
|
|
},
|
|
{
|
|
"classification": "standalone_capability",
|
|
"importers": [],
|
|
"module": "stage_processors",
|
|
"reason": "HarnessX slot-contracted scan stages; pinned by the zero-dependency guard in test_gate"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "stages",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.endpoint"
|
|
],
|
|
"module": "tool_hunter",
|
|
"reason": "imported by model.endpoint"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"calibration",
|
|
"cli",
|
|
"fusion",
|
|
"reports",
|
|
"verify_judge"
|
|
],
|
|
"module": "verification",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "verify_judge",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
}
|
|
],
|
|
"spec": "model-grounded-detection Req 3 (the outgrowth audit)",
|
|
"standalone": {
|
|
"fusion": "two-panel adjudication engine; reached from the scan's report stage and used standalone",
|
|
"harness_ext": "HarnessX extension surface; loaded by name when the optional harness is present",
|
|
"hunter_harness": "harness wiring for the tool hunter; used by the hunter path and by mcp",
|
|
"mcp": "narrow MCP server over stdio; its own `ousast mcp` entry point and OpenCode integration",
|
|
"skills": "skill router; consumed by mcp and by the OpenCode integration, not by the scan path",
|
|
"slot_contract": "the slot/contract protocol stage_processors implements",
|
|
"stage_processors": "HarnessX slot-contracted scan stages; pinned by the zero-dependency guard in test_gate"
|
|
}
|
|
}
|