Marius CiepluchandClaude Opus 5.5
bd74ba63b2
Nothing in src reads config.dynamic, config.evidence or config.variants, and
[models] patcher was only echoed into harness.json. They now go through the
existing RETIRED_KEYS mechanism and fail with RetiredConfigError naming why
("retired 2026-10-02 because nothing ever read it: ..."); RETIRED_KEYS now
carries the full reason per key so the HarnessX entries keep their wording.
- DynamicConfig, EvidenceConfig, VariantsConfig and their loaders removed;
ModelConfig.patcher removed. resolved_config.json loses those sections.
- harness.json keeps its shape: model_roles.patcher is always null.
- RELEASE_NOTES "Unreleased" lists the keys and the output shape change.
- Delete .opencode/skills/openultrasast-kiro-impl: it pointed agents at the
retired openrouter-sast-harness tasks.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
4.4 KiB
Unreleased
Unread config keys retired (2026-10-02)
These keys loaded but nothing ever read them. They now fail with RetiredConfigError (the
CLI prints it and exits 2), naming why. Remove them from your config:
[models] patcher: no patching stage calls a model.[dynamic] enabled,[dynamic] network_scope: no dynamic or deep tier exists yet.[evidence] minimum_report_verified,minimum_exploit,minimum_patch: evidence tiers come from the program model's ladder, not from configuration.[variants] enabled,[variants] max_mechanisms: the variant search they configured was deleted earlier.
Output shape. resolved_config.json no longer has the dynamic, evidence and
variants sections or models.patcher. harness.json keeps its shape:
model_roles.patcher is always null, like model_roles.verifier.
HarnessX removed; the ax plane is the agentic path (2026-09-30)
HarnessX, the optional agentic extra (openultrasast[harnessx]), is removed with its code,
packaging extra and lock entries (retired 2026-09-30). Agentic work runs on the ax plane:
ousast plane run|status|doctor|remember, with one Model and one usd/calls budget per
task, deny-by-default egress per task, and the provider key sent only in the task's start
request. See ops/ax/README.md. Deterministic outputs (pair replay,
quick benchmark, standard scan, improve --dry-run) are byte-identical before and after.
Retired config keys (retired 2026-09-30):
[models] verifierfails withRetiredConfigError(the CLI prints it and exits 2): LLM verification runs on the plane (verify+agree). Remove the key.[fusion] panel_modeland[fusion] decider_modelfail the same way: fusion is deterministic; independent LLM agreement is the plane'sagreetask. Remove the keys.- A
[harnessx]section (retired 2026-09-30) loads with one warning naming the plane and is otherwise ignored.
Silent change for [models] hunter. If you set [models] hunter and had the extra
installed, a standard scan ran two LLM hunters: the MAP-stage tool hunter and the
HarnessX hunter pool (findings with ids hx-hunter:<path>:<line>). The key is still
valid and still enables the tool hunter, so nothing fails and nothing warns, but the
second hunter's findings no longer appear. Repository-wide LLM hunting runs on the plane
(verify passes and agree).
The LLM judge, the LLM fusion panels and the in-loop hosting of deterministic stages are
retired without a local replacement. ousast improve --memory now proposes rule-status
edits from the plane memory, through the unchanged validator and gate.
v1.2.0-alpha.1
Experimental pre-push security safety net for AI-accelerated development. Python package
version: 1.2.0a1. This alpha is not a rollout GO; no real hook capability is enabled.
- Analyze immutable pushed commits across refs without changing the working tree or replacing existing hooks. Share one deadline across preparation, analysis and reporting.
- Keep the existing ranker responsible for scope and physically exclude vendor code from graph inputs. Reuse only compatible, complete immutable graph and answer artifacts.
- Gate advisory and blocking alerts on the same actionable change/witness/repair evidence. Preserve explicit incomplete coverage; optional model assistance cannot create evidence.
- Add frozen runtime and PHP/Node/Python evaluation records with honest populations, missing-target accounting and versioned eligibility that rejects stale evidence.
- Repair the pinned JavaScript frontend's Gruntfile omission and incomplete-census handling. The real NodeGoat input now retains 44/44 files; native PHP/JavaScript smoke passes.
Implementation verification: 1321 tests passed, nine skipped; detector/map/local-pair gates and packaged partition smoke passed. These checks verify implementation contracts, not useful hook precision, recall or latency.
Rollout remains blocked by representative changed-code latency/completion, VAmPI query/context/transitive evidence and independent reviewed per-capability populations. The earlier eligibility artifact is stale under the repaired identities and enables nothing. See current spec status for the owners, unchanged thresholds and required revalidation. Pre-push implementation stands at 26/27 tasks; task 8.3 remains blocked. C arithmetic/bounds detection is unsupported.