mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius CiepluchandClaude Fable 5.1
4866665e5e
Requirements 3.1, 3.2, 3.3, 3.4, 3.5, 2.2, 7.1, 7.3 of ai-service-plane. - plane/reconciler.py (492 lines, test-counted): a Run's tasks submitted to ax in dependency order through the injectable `ax` CLI (apply / get task / delete task), serialize labels never overlapping, --workers, state.json with pending|running|suspended|done|failed|unfinished, a PID lock per run, done tasks skipped on rerun, unfinished tasks holding their dependants, a failed task halting the run. Budgets, inputs, output dir, artifact URL and the bound Model (annotation openultrasast.io/model; identity and priced parameters) go to the task as env in the rendered Task; consumed artifacts travel as files of a generated Workspace bound under /workspace. A threaded HTTP receiver takes each task's tar delivery, validating run/task and rejecting traversal. Outcome comes from the delivered summary.json (done only when every unit finished), never from ax's phase alone. status prints the token attribution table per task and Model from the summaries' usage fields (n/a, never an estimate) and writes attribution.json; doctor runs the four host checks. - plane/workspaces.py: one Workspace manifest per case pin of a population. - CLI: ousast plane run|status|doctor|workspaces. - tests/test_plane_reconciler.py: a fake ax executable drives the DAG; tests/test_plane_ax_live.py (marker ax) applies ops/ax/smoke-task.yaml on a live cluster and skips unless doctor passes. - Module audit rows and regenerated manifest. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
90 lines
2.8 KiB
TOML
90 lines
2.8 KiB
TOML
[build-system]
|
|
requires = ["uv_build>=0.8.13,<0.9.0"]
|
|
build-backend = "uv_build"
|
|
|
|
[project]
|
|
name = "openultrasast"
|
|
version = "1.2.0a1"
|
|
description = "OpenCode-oriented SAST harness for evidence-gated security analysis"
|
|
readme = "README.md"
|
|
requires-python = ">=3.11"
|
|
dependencies = ["pyyaml>=6.0"]
|
|
|
|
[project.optional-dependencies]
|
|
# HarnessX is the optional agentic plane (LLM hunter/verifier + self-improvement).
|
|
# SHA-pinned for reproducibility; the heavy transitive footprint (see
|
|
# .kiro/specs/harnessx-self-improving-rulesets/dependency-audit.md) lands ONLY when
|
|
# this extra is installed. The core install declares only PyYAML (plane manifests) and every HarnessX
|
|
# import is guarded by openultrasast.harness_ext (lazy). pip does not pull the
|
|
# recipe/verl_harnessX submodule (it is outside the packaged harnessx* modules).
|
|
harnessx = [
|
|
"harnessx @ git+https://github.com/Darwin-Agent/HarnessX.git@274c512eea67c64701f992d3b6fe06f0fd590ef0",
|
|
]
|
|
# Structured parse for overlay (JS/C/C++/Java/Python). Core install stays empty.
|
|
# Wheels are MIT; import is lazy via openultrasast.semantic.extra.
|
|
semantic = [
|
|
"tree-sitter>=0.23,<0.27",
|
|
"tree-sitter-python>=0.23",
|
|
"tree-sitter-javascript>=0.23",
|
|
"tree-sitter-typescript>=0.23",
|
|
"tree-sitter-c>=0.23",
|
|
"tree-sitter-cpp>=0.23",
|
|
"tree-sitter-java>=0.23",
|
|
]
|
|
|
|
[project.scripts]
|
|
ousast = "openultrasast.cli:main"
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|
|
pythonpath = ["src"]
|
|
markers = [
|
|
"docker: requires a docker daemon",
|
|
"semantic: requires openultrasast[semantic] tree-sitter extra",
|
|
"ax: requires the live ax cluster of ops/ax/up.sh (skipped unless `ousast plane doctor` passes)",
|
|
]
|
|
|
|
[tool.ruff]
|
|
line-length = 140
|
|
target-version = "py311"
|
|
# Benchmark fixtures are intentionally vulnerable, unformatted sample corpora;
|
|
# linting/formatting them would flag the planted bugs and shift ground-truth lines.
|
|
extend-exclude = ["benchmarks/fixtures", "benchmarks/pairs"]
|
|
|
|
[tool.ruff.lint]
|
|
select = ["B", "E", "F", "I", "SIM", "UP"]
|
|
|
|
[tool.mypy]
|
|
python_version = "3.11"
|
|
files = ["src/openultrasast"]
|
|
check_untyped_defs = true
|
|
disallow_untyped_defs = true
|
|
no_implicit_optional = true
|
|
warn_redundant_casts = true
|
|
warn_return_any = true
|
|
warn_unused_configs = true
|
|
|
|
# HarnessX is an optional extra, absent in the type-check environment; its lazy
|
|
# imports inside guarded functions must not fail mypy.
|
|
[[tool.mypy.overrides]]
|
|
module = "harnessx.*"
|
|
ignore_missing_imports = true
|
|
|
|
[[tool.mypy.overrides]]
|
|
module = "tree_sitter"
|
|
ignore_missing_imports = true
|
|
|
|
# PyYAML ships no inline types and types-PyYAML is not a dev dependency.
|
|
[[tool.mypy.overrides]]
|
|
module = "yaml"
|
|
ignore_missing_imports = true
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"dagger-io>=0.21.7",
|
|
"mypy>=2.1.0",
|
|
"pre-commit>=4.6.0",
|
|
"pytest>=8",
|
|
"ruff>=0.15.17",
|
|
]
|