mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 19:59:26 +00:00
Marius CiepluchandClaude Fable 5.1
51d064e381
The plane's memory store no longer names one vendor. `MinioStore`/`SdkClient`/ `minio_settings`/`MINIO_KEYS` become `S3Store`/`S3Client`/`s3_settings`/`S3_KEYS`; the URL scheme is `s3://<bucket>[/<prefix>]` (`s3://` alone uses `S3_BUCKET`); the settings are `S3_ENDPOINT` (a full URL), `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, optional `AWS_SESSION_TOKEN` and `S3_REGION`. The client is boto3 (extra `s3`, imported lazily): SigV4, path-style addressing, SDK checksum trailers off, paginated listing, versions and delete markers listed and deleted by version (`purge`, used by the contract tests' teardown so the bucket keeps nothing of a run). Behaviour is unchanged: the store never configures its bucket and verifies versioning, the `runs/` expiry rule, S3 Select and tag reads at startup; no local fallback; every row carries every queryable field with "" placeholders. The admin hints read `--endpoint-url "$S3_ENDPOINT"`. The fake client still reproduces RustFS's two Select failures (unbound leading-row field, null-typed column). Docs: rustfs.md stays the tested server's setup page (policy JSON unchanged, env names updated, any S3-compatible store with versioning, lifecycle, tags and Select works); memory.md, ops/ax/README.md, README.md, steering and the two current spec designs use the S3 naming. Retired specs and committed measurements are untouched. Real server (RustFS, OUSAST_MEMORY_TEST_S3=1): test_plane_memory + test_learn_compile 75 passed, 1 skipped. Store copy of the live local store to a temporary prefix: every count matched (776 row objects, 2982 rows, 22 facts, 788 excerpts, 2601 responses, 2 programs, 1793 index entries), 4190 versions purged afterwards. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
25 lines
1.1 KiB
Bash
25 lines
1.1 KiB
Bash
# Copy to .env and fill in. .env is gitignored and never committed.
|
|
# Note: values in .env never override variables already exported in your shell
|
|
# (e.g. from ~/.bashrc). Unset a stale export, or the shell value wins.
|
|
|
|
# LLM calls (verify, roles, the decision engine): DeepSeek.
|
|
DEEPSEEK_API_KEY=
|
|
# DEEPSEEK_BASE_URL=https://api.deepseek.com
|
|
|
|
# Embeddings only: OpenAI text-embedding-3-small through OpenRouter.
|
|
OPENROUTER_API_KEY=
|
|
OPENROUTER_EMBEDDING_MODEL=openai/text-embedding-3-small
|
|
|
|
# Plane memory store. Default is a local FileStore under ~/ousast-results/plane/memory.
|
|
# For an S3-compatible server (RustFS is the tested one): OUSAST_MEMORY=s3://<bucket>[/<prefix>], or
|
|
# OUSAST_MEMORY=s3:// to use S3_BUCKET. Needs the s3 extra (boto3). Example for a RustFS server:
|
|
# OUSAST_MEMORY=s3://sast-memory
|
|
# S3_ENDPOINT=https://files.example.com
|
|
# S3_REGION=us-east-1
|
|
# S3_BUCKET=sast-memory
|
|
# AWS_ACCESS_KEY_ID=
|
|
# AWS_SECRET_ACCESS_KEY=
|
|
# AWS_SESSION_TOKEN=
|
|
# The bucket must have versioning enabled, a lifecycle rule expiring runs/, S3 Select and readable object tags
|
|
# (see docs/rustfs.md); the store verifies them at startup and refuses to run otherwise.
|