Open_Ultra_SAST/benchmarks/measurements/2026-10-31-access-control-admission-unique-binding/NOTES.md

2026-10-31 access-control admission: unique-declaration member-call binding (final gated round)

Round authorization: maintainer strategy-review 2026-10-31 (commit 1481bb3) -- exactly one further gated round on operation facts and call resolution; a third admission NO-GO parks the arm permanently and the rule-11 fallback applies.

Lever (rule 12): resolution -- unique-declaration member-call binding in src/openultrasast/semantic/obligations/resolution.py (commit dc28325): x.method() binds complete iff exactly one same-name method declaration exists repository-wide; collisions stay finite candidate sets; module-level functions never bind. RED->GREEN with reviewer approval; keyword regression 856 passed (selection: obligation/prover/symbol/call_resolution/... entry/ core/handler union).

Measurement 1: in-family site funnel (before/after, frozen ac-admission-2 records)

Re-proved the three recognized (in-family) vulnerable sites with the binding at dc28325, same changes, same repos, same facts:

site	complete	incomplete	unresolved (before -> after)
matrix-org/matrix-appservice-bridge 3a80	1	0	75 -> 75
fastapi-users/fastapi-users 178f	15	0	286 -> 286
bytebase/dbhub f262	160	0	1173 -> 1173

Zero movement on every coverage and judgment field. Instrument proof per site: fresh runs, hook_bytes_read 301065 / 100846 / 677782 (nonzero), head+base verified, no failures.

Root cause (classifier replicating the prove pipeline over each whole product tree):

• matrix: variable-receiver calls with exactly-one same-name method = 0 (methods_named=0: 687)
• fastapi-users: 0 (methods_named=0: 146)
• dbhub: 0 (methods_named=0: 1182)
• dominant unresolved mass: member calls to framework/stdlib names with no repository declaration (variable:methods_named=0 total 2015) and bare calls whose name has no declaration in the calling module (207/134/818) -- imported or framework names.

Conclusion: the authorized resolution lever is disconnected from the recognized admission sites. The unresolved mass is a recognition/facts problem (callee names absent from the repository), not a member-call binding problem.

Screen: whole admission population (exact)

Re-proved all 264 admission records at dc28325 (fresh instrument run per record, nonzero hook_bytes_read asserted, 0 zero-reads):

• vulnerable: 0/12 records changed
• fixed: 0/12 records changed
• ordinary: 0/240 records changed

Therefore the formal admission run with the binding is byte-determined to reproduce run 2's report (numbers identical; only the stamped analyzer revision differs). Measurement 3 executes that run for the record.

(Fixed-side screen note: the first fixed-side screen attempt double-applied _fixed_side_change to already-swapped frozen records -- proving vulnerable trees -- and was discarded; the corrected screen strips stamped fields and proves the frozen fixed changes as-is. Control re-proves at pre-binding 1481bb3 confirmed the drift was the reconstruction bug, not the binding.)

Screen: dev pool (23 repos, classifier at HEAD worktrees)

The binding fires 23,112 times across the dev-pool repositories (variable-receiver calls with exactly one same-name method; largest: apache/seatunnel 14,198, kimai/kimai 3,182, shopperlabs/shopper 1,296). The dev funnel moves; measurement 2 is live.

(Two earlier dev-screen attempts were discarded as failed instruments under rule 8: the hist clones are bare and carry a sparse-checkout config, so passing them directly -- or worktree add without _verify_checkout -- reads zero bytes and silently reports plausible empty buckets. The discarded runs produced no numbers; the screen above proves nonzero bytes_read per repository.)

Measurement 2: dev-pool arm re-run

Bundle: HEAD code dc28325 + the 13.3 candidate facts (digest 3eb5bf699434, NO express entry pack -- the pack is a run-2 admission-gated delta, excluded here so the dev comparison isolates exactly the binding; the only fact delta vs HEAD is entries/express.json, verified). Configuration digest be6d0f688598 == 13.3. Output: ~/ousast-results/prover/ac-four-arm-2/cacfon.

RESULTS (483/483 records, 2 shards, 67.2 + 76.3 min, 0 instrument failures, all 483 records with nonzero instrument.hook_bytes_read):

• Lever's number: complete-calls share 11.9% -> 19.2% (589,520 -> 949,998 complete; incomplete 1,451,325 -> 1,090,847 -- an exact 360,478-call conservation, unresolved unchanged 2,908,559; 441/483 records moved resolution counts).
• Gates (must not regress vs 13.3): recall on fix changes 8/23 = 34.8% (identical); location recall 25/93 = 26.9% (identical); false alarms 5.2/100 pushes (identical, 24 flags on 460 ordinary in both arms); unguarded judgments 32 -> 32; instrument failures 0 -> 0.
• Judgment movement: 5 ordinary records none -> indeterminate (jenkinsci/database-plugin x2, jenkinsci/dependency-track-plugin x2, kimai/kimai x1); indeterminate 33 -> 38. No new alarms, no recall movement; the moved records are visible bounded silence, not flags.

Verdict: PASS -- the resolution lever moves the dev funnel materially without regressing dev recall or false alarms.

Measurement 3: fresh freeze + admission run ac-admission-3

Freeze: facts == HEAD == run 2 facts (digest equality asserted), population pool-valid (freeze guard 0), criteria byte-identical to runs 1-2 (asserted), analyzer dc28325. Output: ~/ousast-results/prover/ac-admission-3.

RESULTS (264/264 records fresh: all stamped dc28325, all nonzero hook reads, none stale; report 2026-10-31-access-control-admission-unique-binding/report.json):

• decision NO-GO; failed gates identical to run 2: min_fix_recall 0.0 < 0.5, min_pair_correctness 0/12 < 0.5, min_precision 0.0 < 0.25, min_verified_location_recall not measured (n=0); instrument failures 0.
• Per-repo comparison vs ac-admission-2: all 12 repositories identical on recognition, unguarded, indeterminate and findings (same table as the screen predicted).
• Elapsed 260 s for the full population.

Round verdict

Third admission NO-GO on the same pre-registered criteria. Under the maintainer's 2026-10-31 strategy-review decision (recorded in .kiro/steering/detection-quality.md) the access-control arm is PARKED PERMANENTLY: no further incremental rounds. The rule-11 fallback applies -- narrowed one-ecosystem advisory product (option C) plus proof-based BLOCK for demonstrated findings.

What the round established, for the parking record:

1. The authorized resolution lever is real where repository-defined names exist: dev-pool complete-calls share 11.9% -> 19.2% with dev recall/FA exactly unchanged (measurement 2). The binding ships (commit dc28325).
2. The lever is disconnected from the admission population: zero member calls with a unique repository declaration exist across all 12 admission repositories (screens + ac-admission-3 identical to run 2). The admission funnel dies on framework callee names with no repository declaration and on unrecognized entries -- a facts/recognition problem that the authorized levers could not reach, confirmed by three independent instruments (site classifier, whole-population re-prove screen, formal admission run).
3. Diagnosis for any future strategy review: the remaining admission gap is NOT call resolution. It is (a) entry recognition on 4/12 repositories (zero frameworks recognised; coverage 8/12) and (b) operation facts for framework-defined operations (orm-read exists but the checked-operation count is 0 everywhere because entries are unreached or frameworks unrecognised).