mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5.5
a35397c0ec
Model deepseek-flash (declared provider extension, endpoint prices in parameters, secretKey naming the DEEPSEEK_API_KEY secret), digest-pinned Task templates repo-facts / verify / agree, and a generator (plane/generate.py, `ousast plane workspaces --validation-set ...`) that emits per case the vulnerable-pin Workspace, a files-only inputs Workspace (recorded candidates after the recorded triage, declared sites, triage), per-case Tasks and one Run validation-46: facts -> verify a, verify b -> agree for the 15 cases, 46 candidates (43 kept), budgets 1.5x the recorded per-pass share. A Run entry cannot add a binding or env, and Run.inputs names only task artifacts, so the case is fixed by per-case Tasks. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
20 lines
795 B
YAML
20 lines
795 B
YAML
# repo-facts (ai-service-plane Req 5.1/5.2): source only, no model. This is the template the per-case Tasks of a
|
|
# Run are generated from (`ousast plane workspaces --validation-set ...` binds the case's pinned Workspace and its
|
|
# inputs Workspace, and sets the paths as env). The image is digest-pinned: Agent Substrate rejects tags.
|
|
# Heavy for the host (a full-tree scan of the case at 1 CPU / 1.5 GiB per gVisor worker): the Run serializes it.
|
|
apiVersion: ax.io/v1alpha1
|
|
kind: Task
|
|
metadata:
|
|
name: repo-facts
|
|
atespace: default
|
|
spec:
|
|
image: "localhost:5001/ousast-runner@sha256:318cbe019c1155b43fe59e47368d99e78f6f6011b7c822292251de53cf567bf3"
|
|
command: ["repo-facts"]
|
|
resources:
|
|
requests:
|
|
cpu: "250m"
|
|
memory: "512Mi"
|
|
limits:
|
|
cpu: "1"
|
|
memory: "1280Mi"
|