Marius CiepluchandClaude Opus 5.5 e492ebd16e fix(cpg): null-guard method access in the query scripts -- a class-level call aborted the whole taint batch ...

On real PHP source (CPS-IT/mailqueue) a call outside any method has a null
.method; inScope/nestedInLabeled dereferenced it (NullPointerException) and the
script exited 1, losing every taint answer for the repository. 16 sites in
taint/dominance/config/vocabulary.sc now treat a null method as out of scope;
non-null behaviour is unchanged (same outputs on the repro graph for the other
scripts). Static regression test added. Implemented with Codex.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-10-03 22:53:28 +02:00

..

complexity

feat(three-stage-scan): report map and honor fail-on worth-fixing

2026-09-04 00:18:33 +02:00

cpg

fix(cpg): null-guard method access in the query scripts -- a class-level call aborted the whole taint batch

2026-10-03 22:53:28 +02:00

improve

refactor(memory): S3-generic store on boto3; RustFS is the tested server (no MinIO naming)

2026-10-02 10:15:19 +02:00

learn

learn: exp-005 graph slice -- slice in the prompt (opt-in), program-arm fill, manifest and units

2026-10-03 15:06:08 +02:00

model

learn: trace-enabled Joern run over labelled units (opt-in trace in taint.sc, trace parsing, resumable runner)

2026-10-03 19:10:47 +02:00

plane

plane(2.4): reconciler on Delivery -- the start body carries the URLs, the store completes the task

2026-10-02 21:49:58 +02:00

policy

feat(governance): Phase 1 — CWE policy store + project score (zero-dep)

2026-06-22 12:31:35 +02:00

provider

feat(learn): metered embeddings and the cache (decision-engine 6.2)

2026-10-01 09:56:52 +02:00

push

pre-push(17.7): prove it on the audit's three repositories

2026-10-02 23:02:32 +02:00

regress

feat(learning-harness): canary snippets and the second judge

2026-09-06 10:06:57 +02:00

ruleset

feat(ruleset): tag framework-specific knowledge as optional priors (decision-engine task 2)

2026-09-30 18:49:05 +02:00

sandbox

feat(three-stage-scan): run or skip deep regression with visible degradation

2026-09-03 23:43:15 +02:00

scoring

feat(benchmark): Phase 2 (task 4) — actionable per-rule signals, ledger, FP knob

2026-06-22 15:41:17 +02:00

semantic

learn: in-function def-use slice from the tree-sitter layer + leak audit (\$0)

2026-10-03 14:56:52 +02:00

__init__.py

release: v2.0.1 -- Apache-2.0 licence, GHCR images, CI green, front-door README

2026-10-02 20:18:39 +02:00

benchmark.py

feat(learning-harness): corpus hygiene at load, with the defects it finds

2026-09-06 09:14:51 +02:00

calibration.py

feat(benchmark): Phase 2 (task 4) — actionable per-rule signals, ledger, FP knob

2026-06-22 15:41:17 +02:00

cli.py

merge(plane-on-kubernetes): groups 1-2 -- cluster profile, no host literals, delivery through the S3 store

2026-10-03 07:57:13 +02:00

config.py

chore(config): retire unread keys [sandbox] network, [sandbox] workspace_readonly, [complexity] top_k

2026-10-02 19:45:37 +02:00

contracts.py

feat(pre-push-safety-net): retain bounded change and rename context

2026-09-12 21:12:45 +02:00

findings.py

pre-push(17.2): name every skipped check in plain words

2026-10-02 22:10:33 +02:00

fusion.py

docs(src): refresh comments and docstrings

2026-10-02 08:36:31 +02:00

gate.py

docs(src): refresh comments and docstrings

2026-10-02 08:36:31 +02:00

harness.py

chore(config): retire unread keys [dynamic], [evidence], [variants], [models] patcher

2026-10-02 07:51:38 +02:00

hunter_tools.py

fix(hunter): bound every tool result; show the provider's reason for an HTTP error

2026-09-28 20:15:14 +02:00

hunter.py

feat(skills): Phase 14 — Trail of Bits skill index + router

2026-06-22 19:51:04 +02:00

index.py

chore(index): remove the unused vector index, the ousast index subcommand and the [embeddings] section

2026-10-02 19:32:46 +02:00

map_gate.py

feat(three-stage-scan): gate stage-2 maps against split-sink ranking

2026-09-04 11:53:06 +02:00

mapping.py

fix(mapping): record every callback of a register_rest_route call as a route

2026-09-24 11:08:22 +02:00

mcp.py

docs(src): refresh comments and docstrings

2026-10-02 08:36:31 +02:00

pair_gate.py

feat(pair-corpus-honesty): score non-vendored pointer pairs through a local cache

2026-09-05 10:45:43 +02:00

pairs.py

fix(ci): run ruff format, and record run 5 at 90% pair-correct

2026-09-08 19:46:58 +02:00

preprocess.py

fix(preprocess): read .gitignore with git's semantics; never ignore a tracked file

2026-09-25 15:29:43 +02:00

profiling.py

perf(push): drop per-entry cache fsync; let long runs profile themselves

2026-09-23 19:05:08 +02:00

provenance.py

chore(skills): repoint the remaining references to .agents/skills

2026-10-02 19:30:48 +02:00

push_inputs.py

feat(pre-push-safety-net): pin labeled evaluation inputs

2026-09-12 18:45:54 +02:00

push_scoring.py

feat(pre-push-safety-net): retain bounded change and rename context

2026-09-12 21:12:45 +02:00

rank.py

feat(authorization-obligations): reports and ranking name the obligation

2026-09-06 07:24:13 +02:00

redaction.py

docs(src): refresh comments and docstrings

2026-10-02 08:36:31 +02:00

reports.py

pre-push(17.2): name every skipped check in plain words

2026-10-02 22:10:33 +02:00

repos.py

feat(repos): pinned known-vulnerable checkouts, offline by default

2026-09-09 08:10:59 +02:00

run.py

feat(scan): add initial SAST pipeline

2026-06-17 21:13:51 +02:00

skills.py

docs(src): refresh comments and docstrings

2026-10-02 08:36:31 +02:00

stages.py

feat(three-stage-scan): keep quick as stage-1 inventory

2026-09-03 23:14:00 +02:00

tool_hunter.py

perf(hunter): cacheable message order; adaptive step budget in the sink verifier

2026-09-29 09:52:23 +02:00

verification.py

ci: add quality gates and release workflows

2026-06-18 10:06:21 +02:00