mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 4.8
60617a92ba
verification-architecture.md documents the existing two-stage design: the Cairn-inspired search (brain + model calls on the VM) and the DAST proof (gVisor AX tasks in kube-ax), the trust boundary (secrets VM-only, cluster tasks secret-free with restricted egress), and the three verify lanes (ax=cluster default, vm=local Bubblewrap for $0 proofs, docker=replay). Clarifies the proof is dynamic, not abstract interpretation: AI triage stays the static backbone, proof earns the block by execution. proof-arm-opencode/ is a follow-up brief: drive proof-authoring with OpenCode MCP, an abliterated/GLM proof model (DeepSeek stays the search model), DSPy-optimized from OpenObserve traces, to beat the safety-classifier refusals and nondeterministic wiring. Flags the trust-domain decision that must come first (A: scoped key + egress inside the cluster; B: brain on VM, only DAST in gVisor — recommended to start). Credentials live in .env by name only (ABLITERATION_*, OPENOBSERVE_*); no secret value is in any tracked file. Co-Authored-By: Claude Opus 4.8 <[email protected]>
11 lines
628 B
JSON
11 lines
628 B
JSON
{
|
|
"feature_name": "proof-arm-opencode",
|
|
"created_at": "2026-10-07T14:40:00Z",
|
|
"updated_at": "2026-10-07T14:40:00Z",
|
|
"language": "en",
|
|
"phase": "brief",
|
|
"approvals": {"requirements": {"generated": false, "approved": false}, "design": {"generated": false, "approved": false}, "tasks": {"generated": false, "approved": false}},
|
|
"ready_for_implementation": false,
|
|
"summary": "OpenCode-MCP proof-authoring arm for search-with-proof: abliterated/GLM proof model, DSPy-optimized from OpenObserve traces; trust-domain decision (A scoped-key-in-cluster vs B brain-on-VM) must be resolved first. Creds in .env by name."
|
|
}
|