mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-21 14:09:27 +00:00
Marius CiepluchandClaude Fable 5.1
8b66d5cb75
Add release-milestones.md as the executable outcome contract: prove one useful Node detection, make it fast, verify PHP/Python transfer, qualify on untouched cases, then enable a narrow advisory rollout. Link it from the roadmap, safety-net steering, requirements, tasks, status and spec.json. Split M1 after review. The raw NodeGoat <lambda>2 witness already exists in the 2026-09-14 post-census bundle; four admission vetoes discard it. M1a runs the vulnerable/fixed/unchanged revisions under a task-local experimental flag that records each veto instead of applying it, with a one-week box and a kill criterion if the fixed twin is not quiet. M1b repairs only the vetoes that fired and reruns through production rules. Existing approvals and thresholds unchanged. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
84 lines
5.3 KiB
Markdown
84 lines
5.3 KiB
Markdown
# Pre-push safety net status — v1.2.0-alpha.1
|
||
|
||
Updated 2026-09-14. Phase: **implementation**. Requirements, design and tasks are
|
||
approved. **26/27 executable tasks complete; task 8.3 remains blocked.**
|
||
Rollout: **NO-GO**. The alpha tag publishes experimental implementation and evidence;
|
||
it does not approve normal hook capabilities or production enforcement.
|
||
|
||
## Next release milestone
|
||
|
||
**M1a: show the NodeGoat detection with every admission veto recorded rather than
|
||
applied, fixed twin analyzed and quiet, one-week time box. Then M1b: repair only the
|
||
vetoes that fired and rerun through production rules.** None of the five release
|
||
milestones is verified yet.
|
||
The 26/27 task count is implementation progress, not proximity to rollout. Follow the
|
||
accepted [release milestone spec](release-milestones.md): usefulness → speed → shared
|
||
PHP/Python transfer → independent qualification → narrow advisory rollout.
|
||
|
||
## Verified
|
||
|
||
Immutable pushed snapshots, shared multi-ref deadlines, ranker-owned scope, physical
|
||
vendor exclusion, compatible immutable graph/result reuse, actionability admission,
|
||
compact truthful reporting and non-destructive hook integration are implemented.
|
||
Advisory and blocking share the same evidence bar; optional model output cannot bypass it.
|
||
|
||
Contributor-scan task 2.19 is verified: the pinned frontend now retains the original
|
||
Gruntfile, bringing the real NodeGoat census from 43/44 to 44/44 files. Partial, absent
|
||
and malformed census no longer masquerade as a complete result or a falsely empty graph.
|
||
The final code verification recorded 1321 passed tests, nine skipped, passing canonical
|
||
gates and a packaged native PHP/JavaScript partition smoke. See
|
||
[owner verification](../contributor-scan/census-repair-verification.md).
|
||
|
||
## Rollout blockers
|
||
|
||
1. **Useful checks within the deadline are unproven.** The fresh post-census profile
|
||
completed all 21 measurements: all 18 changed/cold/growth/multi-ref transactions timed
|
||
out; the three identical-tip replays took 18.521–18.874s with valid graph/query reuse.
|
||
Still 0/24 declared target checks completed. Maximum observed cancellation/report
|
||
overrun was 0.874s, below the two-second allowance. After M1 establishes the useful
|
||
comparison, amortize engine startup/loading and rerun the frozen seven-class profile; require warm p95 <=30s and >=95% completed supported checks.
|
||
2. **Target and change-context evidence remains incomplete.** VAmPI preserves raw findings
|
||
at all three known sites, but the exact SQLI function question/transitive witness and
|
||
supported authorization context are unresolved. Raw findings or rank positions cannot
|
||
establish an actionable new regression. Repair this in the shared scan boundary and
|
||
verify the actual associated query/path evidence.
|
||
3. **Independent quality qualification is missing.** Freeze and review untouched Node API
|
||
vulnerable/fixed/benign cases, including middleware/module/async context. Ghost remains
|
||
reserved with missing reviewed inputs. PHP and Python need their own independent
|
||
language/framework/family populations; Node results cannot qualify them. Require >=95%
|
||
observed actionable precision with counts/intervals, >=90% supported recall, nonzero
|
||
reviewed emitted alerts/positive controls and zero known fixed/benign false alerts.
|
||
4. **No current capability is eligible.** The earlier registry is NO-GO and becomes stale
|
||
under the repaired runtime/core identities. Loading it enables zero capabilities.
|
||
After the preceding evidence passes together, regenerate exact-semantic eligibility
|
||
and rerun packaged acceptance validation. Do not relabel old measurements as current.
|
||
|
||
C/libpng arithmetic and bounds remain explicitly unsupported; this is not a C/C++
|
||
detection qualification. Advisory rollout cannot be justified by silence from an
|
||
unqualified registry.
|
||
|
||
## Ownership and revalidation
|
||
|
||
Engine lifecycle, source/census and context/witness normalization belong to
|
||
`contributor-scan`. The hook consumes those contracts; no second engine, source IR,
|
||
ranker priority exceptions or differential graph mutation is introduced here. Graph
|
||
mutation would need a separate cold-equivalence experiment.
|
||
|
||
After owner fixes, refreeze identities and rerun ordinary scan gates, Python regressions,
|
||
PHP-to-Node transfer, the representative cache/deadline profile, independent per-capability
|
||
quality evaluation and packaged hook validation. Keep task 8.3 unchecked and the feature
|
||
in implementation until those mandatory results are established.
|
||
|
||
Evidence: [group 8 validation](validation-group-8.md),
|
||
[post-census runtime scorecard](../../../benchmarks/measurements/2026-09-14-nodegoat-post-census-feasibility.json),
|
||
[census repair](../../../benchmarks/measurements/2026-09-14-node-census-repair.json).
|
||
|
||
The owner investigation now distinguishes missing family context producers, globally
|
||
propagated vendor/correspondence gaps, and query-to-operation identity. See
|
||
[remediation research](../contributor-scan/release-remediation-research.md). These are
|
||
next implementation prerequisites, not completed fixes or changed acceptance gates.
|
||
|
||
An isolated Joern session probe matched the full Node census with four warm requests in
|
||
0.221–0.467s and verified cancellation/reaping in 0.043s. It identifies a promising engine
|
||
lifecycle change; full-query equivalence and changed-code performance remain unverified.
|