mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Fable 5.1
8b66d5cb75
Add release-milestones.md as the executable outcome contract: prove one useful Node detection, make it fast, verify PHP/Python transfer, qualify on untouched cases, then enable a narrow advisory rollout. Link it from the roadmap, safety-net steering, requirements, tasks, status and spec.json. Split M1 after review. The raw NodeGoat <lambda>2 witness already exists in the 2026-09-14 post-census bundle; four admission vetoes discard it. M1a runs the vulnerable/fixed/unchanged revisions under a task-local experimental flag that records each veto instead of applying it, with a one-week box and a kill criterion if the fixed twin is not quiet. M1b repairs only the vetoes that fired and reruns through production rules. Existing approvals and thresholds unchanged. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo