mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5
8c387306be
The pair corpus scores excerpts: a vulnerable function and its fixed twin, handed to the engine with the answer already narrowed down. Nothing in it exercises a repository -- region ranking, the budget, one CPG over thousands of files, or whether a verdict that holds on fifteen lines still holds when the source, the sink and the guard live in three modules. benchmarks/repos/<name>.toml names a real checkout: url, a full 40-char commit SHA, licence, and every known vulnerability with its file, function and line. `ousast repos` lists them; `--fetch` materialises one; CI does neither, and conftest clears the switch and redirects the cache so a developer with warm checkouts cannot read them by accident. Three rules the loader enforces rather than documents: - A branch or tag is rejected. Either would make the same recipe mean different code next month while the baseline it produced kept the old numbers. - `in_scope` must be stated per vulnerability, never defaulted. It decides whether "not found" is a miss or a non-question, which is the most important thing about the result. - A recipe that declares `detection` must name something in scope to detect. `ousast repos` does not trust a recipe either: against a materialised checkout it checks HEAD against the pin, that the licence file is there, and that each declared function appears above its declared line. That earned its place immediately -- the first libpng recipe named LICENSE.md, which is the filename at HEAD today and not at the pinned commit, where it is still LICENSE. Two checkouts, verified against the real repositories: - vampi (MIT, 520 lines) is the DETECTION checkout. Excerpts of it are already in the pair corpus, including the update_password miss diagnosed earlier, so a whole-repository run says directly whether a verdict survives the move off the excerpt. Its routes register through an OpenAPI operationId, so it exercises registration-based entry-point mapping rather than the decorator path. - libpng (libpng-2.0, 91k lines of C) is the ENVELOPE checkout, pinned at the parent of the commit that added the missing clamp. Its CVE is marked out of scope: an out-of-bounds read is not a family this engine arbitrates, and recording "not found" against it as a miss is the easiest way to make a measurement lie. Nothing is vendored; the recipe records the licence so an artifact can say what it ran against. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
1033 lines
28 KiB
JSON
1033 lines
28 KiB
JSON
{
|
|
"counts": {
|
|
"load_bearing": 89,
|
|
"standalone_capability": 7
|
|
},
|
|
"generated": "2026-09-09 (regenerated after contributor-scan 2.1 added the pinned-checkout recipes)",
|
|
"kept_with_a_lever_stripped": {
|
|
"improve/evolve.py + improve/validator.py": "the design's Removed list named these whole, but each is a mix: the mechanism lever (removed) and the deterministic rule-status improve loop that `ousast improve` still runs from benchmark evidence, which has no LLM in it and is not what this feature supersedes. Deleting the files would have taken a retained capability with them."
|
|
},
|
|
"modules": 96,
|
|
"note": "Classification of every source module after the group-1 subtraction. load_bearing = reachable from a gate, the CLI, or named by a surviving requirement; standalone_capability = its own entry point or protocol, deliberately off the scan path; orphaned = no importer, no entry point, no surviving requirement -- removed, never carried.",
|
|
"orphaned": [],
|
|
"removed_in_this_pass": {
|
|
"learning/ (16 modules)": "the noise architecture: rounds, acceptance, proposer, journal, canaries, verifiers, difficulty, scoring, classify, detectors, split, publish. Taxonomy, candidates and endpoint were re-homed to model/ first.",
|
|
"semantic/loo.py": "leave-one-out scoring of the mechanism store",
|
|
"semantic/mechanisms.py": "the mechanism store and the shape search that fed the optimisation loop",
|
|
"semantic/prove_budget.py": "embedding-ordered promotion budget, driven by the mechanism store",
|
|
"semantic/seed.py": "the mechanism exporter",
|
|
"semantic/variant_search.py": "variant search over the mechanism store",
|
|
"semantic/variants.py": "the shape-derivation optimisation surface; its guard vocabulary was ported verbatim to model/specs.py first, and trailing_name re-homed to semantic/ir.py",
|
|
"vectorstore.py": "a vector-store bakeoff harness with no production caller and no CLI entry, kept alive only by its own test -- the one genuine orphan the audit found"
|
|
},
|
|
"rows": [
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"gate",
|
|
"improve.evolve",
|
|
"map_gate",
|
|
"mcp",
|
|
"pairs"
|
|
],
|
|
"module": "benchmark",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "calibration",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"mcp"
|
|
],
|
|
"module": "cli",
|
|
"reason": "entry point"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"complexity.hints",
|
|
"complexity.ledger",
|
|
"complexity.map",
|
|
"map_gate",
|
|
"regress.candidate",
|
|
"semantic.prove_filter",
|
|
"tool_hunter"
|
|
],
|
|
"module": "complexity",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"complexity",
|
|
"complexity.map"
|
|
],
|
|
"module": "complexity.hints",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"complexity",
|
|
"complexity.map",
|
|
"regress.candidate"
|
|
],
|
|
"module": "complexity.ledger",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"complexity",
|
|
"complexity.hints",
|
|
"complexity.ledger",
|
|
"map_gate",
|
|
"regress.candidate",
|
|
"semantic.prove_filter",
|
|
"tool_hunter"
|
|
],
|
|
"module": "complexity.map",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"complexity",
|
|
"complexity.hints",
|
|
"complexity.map"
|
|
],
|
|
"module": "complexity.signals",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"harness",
|
|
"hunter_tools",
|
|
"model.endpoint",
|
|
"pairs",
|
|
"regress.candidate",
|
|
"regress.recipes",
|
|
"run"
|
|
],
|
|
"module": "config",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cpg.backend",
|
|
"model.config_value",
|
|
"model.dominance",
|
|
"model.judge",
|
|
"model.pipeline",
|
|
"model.taint"
|
|
],
|
|
"module": "cpg",
|
|
"reason": "model-grounded-detection Req 4: the CPG seam package"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.config_value",
|
|
"model.dominance",
|
|
"model.judge",
|
|
"model.pipeline",
|
|
"model.taint"
|
|
],
|
|
"module": "cpg.backend",
|
|
"reason": "model-grounded-detection Req 4.1/4.5: the single Joern subprocess boundary"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cpg.backend"
|
|
],
|
|
"module": "cpg.capability",
|
|
"reason": "model-grounded-detection Req 4.2/4.3: the engine probe that degrades to suspicion"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"benchmark",
|
|
"calibration",
|
|
"cli",
|
|
"complexity.ledger",
|
|
"complexity.map",
|
|
"complexity.signals",
|
|
"fusion",
|
|
"gate",
|
|
"hunter",
|
|
"hunter_harness",
|
|
"hunter_tools",
|
|
"improve.evolve",
|
|
"map_gate",
|
|
"model.ladder",
|
|
"model.report",
|
|
"pairs",
|
|
"rank",
|
|
"regress.candidate",
|
|
"reports",
|
|
"scoring.project_score",
|
|
"semantic.obligations.check",
|
|
"semantic.overlay",
|
|
"semantic.prove_filter",
|
|
"stage_processors",
|
|
"tool_hunter",
|
|
"verification",
|
|
"verify_judge"
|
|
],
|
|
"module": "findings",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "standalone_capability",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "fusion",
|
|
"reason": "two-panel adjudication engine; reached from the scan's report stage and used standalone"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "gate",
|
|
"reason": "entry point"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"slot_contract"
|
|
],
|
|
"module": "harness",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "standalone_capability",
|
|
"importers": [
|
|
"cli",
|
|
"fusion",
|
|
"hunter_harness",
|
|
"stage_processors",
|
|
"verify_judge"
|
|
],
|
|
"module": "harness_ext",
|
|
"reason": "HarnessX extension surface; loaded by name when the optional harness is present"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"hunter_harness"
|
|
],
|
|
"module": "hunter",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "standalone_capability",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "hunter_harness",
|
|
"reason": "harness wiring for the tool hunter; used by the hunter path and by mcp"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"tool_hunter"
|
|
],
|
|
"module": "hunter_tools",
|
|
"reason": "imported by tool_hunter"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"improve.evolve"
|
|
],
|
|
"module": "improve",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"improve"
|
|
],
|
|
"module": "improve.evolve",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"improve",
|
|
"improve.evolve"
|
|
],
|
|
"module": "improve.journal",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"improve",
|
|
"improve.evolve"
|
|
],
|
|
"module": "improve.validator",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"skills"
|
|
],
|
|
"module": "index",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [],
|
|
"module": "map_gate",
|
|
"reason": "entry point"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"gate",
|
|
"hunter_tools",
|
|
"improve.evolve",
|
|
"map_gate",
|
|
"pairs",
|
|
"preprocess",
|
|
"stage_processors"
|
|
],
|
|
"module": "mapping",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "standalone_capability",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "mcp",
|
|
"reason": "narrow MCP server over stdio; its own `ousast mcp` entry point and OpenCode integration"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"model.candidates",
|
|
"model.config_value",
|
|
"model.dominance",
|
|
"model.execution",
|
|
"model.judge",
|
|
"model.pipeline",
|
|
"model.regions",
|
|
"model.scan",
|
|
"model.specs",
|
|
"model.taint"
|
|
],
|
|
"module": "model",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [],
|
|
"module": "model.audit",
|
|
"reason": "model-grounded-detection Req 3: this classifier; run by the maintainer, not by the scan"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [],
|
|
"module": "model.calibrate",
|
|
"reason": "model-grounded-detection Req 9: the corpus as the model's calibration set"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"model.scan"
|
|
],
|
|
"module": "model.candidates",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.pipeline"
|
|
],
|
|
"module": "model.config_value",
|
|
"reason": "model-grounded-detection Req 6.3: constant abstraction for the configuration families"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.pipeline"
|
|
],
|
|
"module": "model.dominance",
|
|
"reason": "model-grounded-detection Req 6.2: guard dominance, the arbiter for bugs that never crash"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [],
|
|
"module": "model.endpoint",
|
|
"reason": "model-grounded-detection Req 8: the judge client, wired by model/judge.py in group 3"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [],
|
|
"module": "model.execution",
|
|
"reason": "model-grounded-detection Req 10: the deferred execution tier seam, adopted not built"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [],
|
|
"module": "model.judge",
|
|
"reason": "model-grounded-detection Req 8: one bounded question, checked against the model"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.config_value",
|
|
"model.dominance",
|
|
"model.execution",
|
|
"model.judge",
|
|
"model.pipeline",
|
|
"model.scan",
|
|
"model.taint"
|
|
],
|
|
"module": "model.ladder",
|
|
"reason": "model-grounded-detection Req 5: the evidence ladder every finding carries"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.scan"
|
|
],
|
|
"module": "model.pipeline",
|
|
"reason": "model-grounded-detection Req 8: the enumerator proposes, the LLM answers, the model disposes"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.scan"
|
|
],
|
|
"module": "model.regions",
|
|
"reason": "contributor-scan Req 2: regions from entry points, with the families each admits"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [],
|
|
"module": "model.report",
|
|
"reason": "model-grounded-detection Req 9.3/11.1: per-slice reporting with the overfitting gap"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [],
|
|
"module": "model.scan",
|
|
"reason": "contributor-scan Req 3: the repository driver -- one CPG, one budget, ranked spend"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.config_value",
|
|
"model.dominance",
|
|
"model.judge",
|
|
"model.pipeline",
|
|
"model.regions",
|
|
"model.scan",
|
|
"model.taint"
|
|
],
|
|
"module": "model.specs",
|
|
"reason": "model-grounded-detection Req 7.2-7.4: the security vocabularies the CPG queries are parameterised by"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.judge",
|
|
"model.pipeline"
|
|
],
|
|
"module": "model.taint",
|
|
"reason": "model-grounded-detection Req 6.1: taint reachability over the CPG, the flow-family arbiter"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"model.candidates",
|
|
"model.scan",
|
|
"model.specs"
|
|
],
|
|
"module": "model.taxonomy",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "pair_gate",
|
|
"reason": "entry point"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"improve",
|
|
"improve.evolve",
|
|
"model.candidates",
|
|
"pair_gate"
|
|
],
|
|
"module": "pairs",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"findings",
|
|
"hunter",
|
|
"hunter_harness",
|
|
"improve.evolve",
|
|
"improve.validator",
|
|
"scoring.project_score",
|
|
"semantic.overlay",
|
|
"stage_processors"
|
|
],
|
|
"module": "policy",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"policy"
|
|
],
|
|
"module": "policy.verycode",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"complexity.hints",
|
|
"complexity.map",
|
|
"complexity.signals",
|
|
"findings",
|
|
"gate",
|
|
"hunter",
|
|
"hunter_harness",
|
|
"hunter_tools",
|
|
"improve.evolve",
|
|
"index",
|
|
"map_gate",
|
|
"mapping",
|
|
"model.candidates",
|
|
"pairs",
|
|
"rank",
|
|
"regress.candidate",
|
|
"semantic.overlay",
|
|
"skills",
|
|
"stage_processors"
|
|
],
|
|
"module": "preprocess",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "provenance",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.endpoint",
|
|
"tool_hunter"
|
|
],
|
|
"module": "provider",
|
|
"reason": "imported by model.endpoint, tool_hunter"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.endpoint",
|
|
"tool_hunter"
|
|
],
|
|
"module": "provider.openrouter",
|
|
"reason": "imported by model.endpoint, tool_hunter"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"calibration",
|
|
"cli",
|
|
"findings",
|
|
"gate",
|
|
"hunter",
|
|
"hunter_harness",
|
|
"hunter_tools",
|
|
"improve.evolve",
|
|
"map_gate",
|
|
"pairs",
|
|
"stage_processors"
|
|
],
|
|
"module": "rank",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"harness",
|
|
"model.judge",
|
|
"model.pipeline",
|
|
"reports",
|
|
"semantic.obligations.intent"
|
|
],
|
|
"module": "redaction",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"regress.candidate"
|
|
],
|
|
"module": "regress",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"regress"
|
|
],
|
|
"module": "regress.candidate",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"regress",
|
|
"regress.candidate"
|
|
],
|
|
"module": "regress.recipes",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"regress",
|
|
"regress.candidate"
|
|
],
|
|
"module": "regress.safety",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"regress",
|
|
"regress.candidate"
|
|
],
|
|
"module": "regress.verdict",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "reports",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"findings",
|
|
"hunter",
|
|
"hunter_harness",
|
|
"improve.evolve",
|
|
"improve.validator",
|
|
"pairs",
|
|
"stage_processors"
|
|
],
|
|
"module": "ruleset",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"improve.validator",
|
|
"ruleset"
|
|
],
|
|
"module": "ruleset.store",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"reports"
|
|
],
|
|
"module": "run",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"regress.candidate",
|
|
"regress.recipes",
|
|
"regress.safety",
|
|
"regress.verdict"
|
|
],
|
|
"module": "sandbox",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"sandbox"
|
|
],
|
|
"module": "sandbox.probe",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"regress.candidate",
|
|
"regress.recipes",
|
|
"regress.safety",
|
|
"sandbox"
|
|
],
|
|
"module": "sandbox.runner",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"improve.evolve",
|
|
"stage_processors"
|
|
],
|
|
"module": "scoring",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"scoring"
|
|
],
|
|
"module": "scoring.project_score",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"cpg.capability",
|
|
"hunter_tools",
|
|
"model.candidates",
|
|
"model.specs",
|
|
"pairs",
|
|
"semantic.cst",
|
|
"semantic.engines",
|
|
"semantic.functions",
|
|
"semantic.ir",
|
|
"semantic.obligations.check",
|
|
"semantic.obligations.operations",
|
|
"semantic.obligations.shapes",
|
|
"semantic.overlay",
|
|
"semantic.prove_filter",
|
|
"semantic.taint"
|
|
],
|
|
"module": "semantic",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"semantic.ir"
|
|
],
|
|
"module": "semantic.cst",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cpg.capability",
|
|
"semantic",
|
|
"semantic.overlay"
|
|
],
|
|
"module": "semantic.engines",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"semantic",
|
|
"semantic.cst",
|
|
"semantic.engines"
|
|
],
|
|
"module": "semantic.extra",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"hunter_tools",
|
|
"model.candidates",
|
|
"model.specs",
|
|
"pairs",
|
|
"semantic",
|
|
"semantic.obligations.check",
|
|
"semantic.obligations.operations",
|
|
"semantic.obligations.shapes",
|
|
"semantic.overlay",
|
|
"semantic.taint"
|
|
],
|
|
"module": "semantic.facts",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"hunter_tools",
|
|
"pairs",
|
|
"semantic.obligations.shapes",
|
|
"semantic.overlay"
|
|
],
|
|
"module": "semantic.functions",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"hunter_tools",
|
|
"model.candidates",
|
|
"pairs",
|
|
"semantic.cst",
|
|
"semantic.functions",
|
|
"semantic.obligations.check",
|
|
"semantic.obligations.operations",
|
|
"semantic.obligations.shapes",
|
|
"semantic.overlay",
|
|
"semantic.taint"
|
|
],
|
|
"module": "semantic.ir",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"hunter_tools",
|
|
"model.candidates",
|
|
"model.specs",
|
|
"pairs",
|
|
"semantic.obligations.check",
|
|
"semantic.obligations.dominance",
|
|
"semantic.obligations.intent",
|
|
"semantic.obligations.operations",
|
|
"semantic.obligations.policy",
|
|
"semantic.obligations.shapes",
|
|
"semantic.obligations.siblings"
|
|
],
|
|
"module": "semantic.obligations",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"semantic.obligations",
|
|
"semantic.obligations.intent"
|
|
],
|
|
"module": "semantic.obligations.check",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"hunter_tools",
|
|
"pairs",
|
|
"semantic.obligations.check"
|
|
],
|
|
"module": "semantic.obligations.dominance",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.specs",
|
|
"pairs",
|
|
"semantic.obligations",
|
|
"semantic.obligations.check",
|
|
"semantic.obligations.operations",
|
|
"semantic.obligations.policy",
|
|
"semantic.obligations.shapes",
|
|
"semantic.obligations.siblings"
|
|
],
|
|
"module": "semantic.obligations.facts",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "semantic.obligations.intent",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.candidates",
|
|
"semantic.obligations.check",
|
|
"semantic.obligations.dominance",
|
|
"semantic.obligations.siblings"
|
|
],
|
|
"module": "semantic.obligations.operations",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli",
|
|
"semantic.obligations.check"
|
|
],
|
|
"module": "semantic.obligations.policy",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"semantic.obligations",
|
|
"semantic.obligations.operations"
|
|
],
|
|
"module": "semantic.obligations.shapes",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"semantic.obligations.check"
|
|
],
|
|
"module": "semantic.obligations.siblings",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"semantic",
|
|
"semantic.prove_filter"
|
|
],
|
|
"module": "semantic.overlay",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"semantic"
|
|
],
|
|
"module": "semantic.prove_filter",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"semantic.overlay"
|
|
],
|
|
"module": "semantic.taint",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "standalone_capability",
|
|
"importers": [
|
|
"hunter",
|
|
"hunter_harness"
|
|
],
|
|
"module": "skills",
|
|
"reason": "skill router; consumed by mcp and by the OpenCode integration, not by the scan path"
|
|
},
|
|
{
|
|
"classification": "standalone_capability",
|
|
"importers": [
|
|
"stage_processors"
|
|
],
|
|
"module": "slot_contract",
|
|
"reason": "the slot/contract protocol stage_processors implements"
|
|
},
|
|
{
|
|
"classification": "standalone_capability",
|
|
"importers": [],
|
|
"module": "stage_processors",
|
|
"reason": "HarnessX slot-contracted scan stages; pinned by the zero-dependency guard in test_gate"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "stages",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"model.endpoint"
|
|
],
|
|
"module": "tool_hunter",
|
|
"reason": "imported by model.endpoint"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"calibration",
|
|
"cli",
|
|
"fusion",
|
|
"reports",
|
|
"verify_judge"
|
|
],
|
|
"module": "verification",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
},
|
|
{
|
|
"classification": "load_bearing",
|
|
"importers": [
|
|
"cli"
|
|
],
|
|
"module": "verify_judge",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI"
|
|
}
|
|
],
|
|
"spec": "model-grounded-detection Req 3 (the outgrowth audit)",
|
|
"standalone": {
|
|
"fusion": "two-panel adjudication engine; reached from the scan's report stage and used standalone",
|
|
"harness_ext": "HarnessX extension surface; loaded by name when the optional harness is present",
|
|
"hunter_harness": "harness wiring for the tool hunter; used by the hunter path and by mcp",
|
|
"mcp": "narrow MCP server over stdio; its own `ousast mcp` entry point and OpenCode integration",
|
|
"skills": "skill router; consumed by mcp and by the OpenCode integration, not by the scan path",
|
|
"slot_contract": "the slot/contract protocol stage_processors implements",
|
|
"stage_processors": "HarnessX slot-contracted scan stages; pinned by the zero-dependency guard in test_gate"
|
|
}
|
|
}
|