mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-17 12:09:27 +00:00
Marius CiepluchandClaude Fable 5.1
88ada8e48c
flow-aware-ranking phase 0: measure before changing anything.
THE BASELINE, committed as benchmarks/ranking/baselines/2026-09-10-access-rank.json
from benchmarks/ranking/position.py, which sorts regions exactly as the scan does:
pmpro 4,463 regions 83.8% at 0.30 CVE at 390 budget_at_recall 391
mwwpform 983 regions 81.7% at 0.30 CVE at 512 budget_at_recall 513
wpstatistics 1,673 regions 75.3% at 0.30 CVE at 503 budget_at_recall 504
vampi 25 regions BOLA at 15, 10; SQLI reached transitively
That corrects the brief's own cross-assessment: "concentration, not inclusion"
was measured on pmpro alone. On the other two plugins the CVE sits OUTSIDE a
500-region budget and is never examined; the slices found those CVEs only
because a slice has too few regions to exclude anything.
THE INSTRUMENT: `evidenceOnly` mode on the taint query -- what is in scope,
which sink calls, what shape, whether a sanitizer wraps THEIR argument, whether
a source is local or reachable -- returning before reachableByFlows is ever
called. model/evidence.py turns its rows into a vector per (region, family)
and a tier; scan.py records every pair's tier on the result and acts on none of
it. Every later phase is measured against a record made by scans that did not
know they were being measured.
2,500 pairs in 98.9s incl. JVM load, ~40 ms per pair
tier 0 -- no sink of that family in reach: 2,161 of 2,500 = 86%
Two earlier attempts ran past an hour each with no payload, and both were my
fault: repository-wide walks repeated per request -- the sink scan, the
reachable-method BFS, familyInRepo. Memoised across the batch.
AND THE SAME FIX REACHES THE DATAFLOW MODE. sinkCalls and reachableMethods do
not depend on the family, and were recomputed for all 2,500 requests. The
identical 250-request set with both joins on:
2,026.3s -> 287.0s 8,105 -> 1,148 ms per request same 5,779 rows
Most of what 5.13 measured as "the base taint query" was never dataflow. A 7x
speedup with nothing about the analysis changed; both corrections recorded in
the specs. Combined with 86% tier 0, the whole-repository taint query that
timed out at 40 minutes is ~339 real requests at ~1.1s: about six minutes.
Also: the module audit manifest is regenerated (91 load-bearing, 7 standalone,
0 orphaned) because evidence.py is now imported by the scan, and the
failed-query test is order-independent since the evidence pass records its own
failure before taint's.
869 tests pass; query compile test 4 passed; gates byte-identical.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
1062 lines
28 KiB
JSON
1062 lines
28 KiB
JSON
{
|
|
"modules": 98,
|
|
"counts": {
|
|
"load_bearing": 91,
|
|
"standalone_capability": 7
|
|
},
|
|
"orphaned": [],
|
|
"standalone": {
|
|
"fusion": "two-panel adjudication engine; reached from the scan's report stage and used standalone",
|
|
"harness_ext": "HarnessX extension surface; loaded by name when the optional harness is present",
|
|
"hunter_harness": "harness wiring for the tool hunter; used by the hunter path and by mcp",
|
|
"mcp": "narrow MCP server over stdio; its own `ousast mcp` entry point and OpenCode integration",
|
|
"skills": "skill router; consumed by mcp and by the OpenCode integration, not by the scan path",
|
|
"slot_contract": "the slot/contract protocol stage_processors implements",
|
|
"stage_processors": "HarnessX slot-contracted scan stages; pinned by the zero-dependency guard in test_gate"
|
|
},
|
|
"rows": [
|
|
{
|
|
"module": "benchmark",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"gate",
|
|
"improve.evolve",
|
|
"map_gate",
|
|
"mcp",
|
|
"pairs"
|
|
]
|
|
},
|
|
{
|
|
"module": "calibration",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli"
|
|
]
|
|
},
|
|
{
|
|
"module": "cli",
|
|
"classification": "load_bearing",
|
|
"reason": "entry point",
|
|
"importers": [
|
|
"mcp"
|
|
]
|
|
},
|
|
{
|
|
"module": "complexity",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"complexity.hints",
|
|
"complexity.ledger",
|
|
"complexity.map",
|
|
"map_gate",
|
|
"regress.candidate",
|
|
"semantic.prove_filter",
|
|
"tool_hunter"
|
|
]
|
|
},
|
|
{
|
|
"module": "complexity.hints",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"complexity",
|
|
"complexity.map"
|
|
]
|
|
},
|
|
{
|
|
"module": "complexity.ledger",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"complexity",
|
|
"complexity.map",
|
|
"regress.candidate"
|
|
]
|
|
},
|
|
{
|
|
"module": "complexity.map",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"complexity",
|
|
"complexity.hints",
|
|
"complexity.ledger",
|
|
"map_gate",
|
|
"regress.candidate",
|
|
"semantic.prove_filter",
|
|
"tool_hunter"
|
|
]
|
|
},
|
|
{
|
|
"module": "complexity.signals",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"complexity",
|
|
"complexity.hints",
|
|
"complexity.map"
|
|
]
|
|
},
|
|
{
|
|
"module": "config",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"harness",
|
|
"hunter_tools",
|
|
"model.endpoint",
|
|
"pairs",
|
|
"regress.candidate",
|
|
"regress.recipes",
|
|
"run"
|
|
]
|
|
},
|
|
{
|
|
"module": "cpg",
|
|
"classification": "load_bearing",
|
|
"reason": "model-grounded-detection Req 4: the CPG seam package",
|
|
"importers": [
|
|
"cli",
|
|
"cpg.backend",
|
|
"model.config_value",
|
|
"model.dominance",
|
|
"model.judge",
|
|
"model.pipeline",
|
|
"model.scan",
|
|
"model.taint"
|
|
]
|
|
},
|
|
{
|
|
"module": "cpg.backend",
|
|
"classification": "load_bearing",
|
|
"reason": "model-grounded-detection Req 4.1/4.5: the single Joern subprocess boundary",
|
|
"importers": [
|
|
"cli",
|
|
"model.config_value",
|
|
"model.dominance",
|
|
"model.judge",
|
|
"model.pipeline",
|
|
"model.scan",
|
|
"model.taint"
|
|
]
|
|
},
|
|
{
|
|
"module": "cpg.capability",
|
|
"classification": "load_bearing",
|
|
"reason": "model-grounded-detection Req 4.2/4.3: the engine probe that degrades to suspicion",
|
|
"importers": [
|
|
"cpg.backend"
|
|
]
|
|
},
|
|
{
|
|
"module": "findings",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"benchmark",
|
|
"calibration",
|
|
"cli",
|
|
"complexity.ledger",
|
|
"complexity.map",
|
|
"complexity.signals",
|
|
"fusion",
|
|
"gate",
|
|
"hunter",
|
|
"hunter_harness",
|
|
"hunter_tools",
|
|
"improve.evolve",
|
|
"map_gate",
|
|
"model.ladder",
|
|
"model.report",
|
|
"pairs",
|
|
"rank",
|
|
"regress.candidate",
|
|
"reports",
|
|
"scoring.project_score",
|
|
"semantic.obligations.check",
|
|
"semantic.overlay",
|
|
"semantic.prove_filter",
|
|
"stage_processors",
|
|
"tool_hunter",
|
|
"verification",
|
|
"verify_judge"
|
|
]
|
|
},
|
|
{
|
|
"module": "fusion",
|
|
"classification": "standalone_capability",
|
|
"reason": "two-panel adjudication engine; reached from the scan's report stage and used standalone",
|
|
"importers": [
|
|
"cli"
|
|
]
|
|
},
|
|
{
|
|
"module": "gate",
|
|
"classification": "load_bearing",
|
|
"reason": "entry point",
|
|
"importers": [
|
|
"cli"
|
|
]
|
|
},
|
|
{
|
|
"module": "harness",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"slot_contract"
|
|
]
|
|
},
|
|
{
|
|
"module": "harness_ext",
|
|
"classification": "standalone_capability",
|
|
"reason": "HarnessX extension surface; loaded by name when the optional harness is present",
|
|
"importers": [
|
|
"cli",
|
|
"fusion",
|
|
"hunter_harness",
|
|
"stage_processors",
|
|
"verify_judge"
|
|
]
|
|
},
|
|
{
|
|
"module": "hunter",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"hunter_harness"
|
|
]
|
|
},
|
|
{
|
|
"module": "hunter_harness",
|
|
"classification": "standalone_capability",
|
|
"reason": "harness wiring for the tool hunter; used by the hunter path and by mcp",
|
|
"importers": [
|
|
"cli"
|
|
]
|
|
},
|
|
{
|
|
"module": "hunter_tools",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"tool_hunter"
|
|
]
|
|
},
|
|
{
|
|
"module": "improve",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"improve.evolve"
|
|
]
|
|
},
|
|
{
|
|
"module": "improve.evolve",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"improve"
|
|
]
|
|
},
|
|
{
|
|
"module": "improve.journal",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"improve",
|
|
"improve.evolve"
|
|
]
|
|
},
|
|
{
|
|
"module": "improve.validator",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"improve",
|
|
"improve.evolve"
|
|
]
|
|
},
|
|
{
|
|
"module": "index",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"skills"
|
|
]
|
|
},
|
|
{
|
|
"module": "map_gate",
|
|
"classification": "load_bearing",
|
|
"reason": "entry point",
|
|
"importers": []
|
|
},
|
|
{
|
|
"module": "mapping",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"gate",
|
|
"hunter_tools",
|
|
"improve.evolve",
|
|
"map_gate",
|
|
"model.scan",
|
|
"pairs",
|
|
"preprocess",
|
|
"stage_processors"
|
|
]
|
|
},
|
|
{
|
|
"module": "mcp",
|
|
"classification": "standalone_capability",
|
|
"reason": "narrow MCP server over stdio; its own `ousast mcp` entry point and OpenCode integration",
|
|
"importers": [
|
|
"cli"
|
|
]
|
|
},
|
|
{
|
|
"module": "model",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"model.candidates",
|
|
"model.config_value",
|
|
"model.dominance",
|
|
"model.execution",
|
|
"model.judge",
|
|
"model.pipeline",
|
|
"model.regions",
|
|
"model.report",
|
|
"model.scan",
|
|
"model.specs",
|
|
"model.taint"
|
|
]
|
|
},
|
|
{
|
|
"module": "model.audit",
|
|
"classification": "load_bearing",
|
|
"reason": "model-grounded-detection Req 3: this classifier; run by the maintainer, not by the scan",
|
|
"importers": []
|
|
},
|
|
{
|
|
"module": "model.calibrate",
|
|
"classification": "load_bearing",
|
|
"reason": "model-grounded-detection Req 9: the corpus as the model's calibration set",
|
|
"importers": []
|
|
},
|
|
{
|
|
"module": "model.candidates",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"model.scan"
|
|
]
|
|
},
|
|
{
|
|
"module": "model.config_value",
|
|
"classification": "load_bearing",
|
|
"reason": "model-grounded-detection Req 6.3: constant abstraction for the configuration families",
|
|
"importers": [
|
|
"model.pipeline",
|
|
"model.scan"
|
|
]
|
|
},
|
|
{
|
|
"module": "model.dominance",
|
|
"classification": "load_bearing",
|
|
"reason": "model-grounded-detection Req 6.2: guard dominance, the arbiter for bugs that never crash",
|
|
"importers": [
|
|
"model.pipeline",
|
|
"model.scan"
|
|
]
|
|
},
|
|
{
|
|
"module": "model.endpoint",
|
|
"classification": "load_bearing",
|
|
"reason": "model-grounded-detection Req 8: the judge client, wired by model/judge.py in group 3",
|
|
"importers": [
|
|
"cli"
|
|
]
|
|
},
|
|
{
|
|
"module": "model.evidence",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"model.scan"
|
|
]
|
|
},
|
|
{
|
|
"module": "model.execution",
|
|
"classification": "load_bearing",
|
|
"reason": "model-grounded-detection Req 10: the deferred execution tier seam, adopted not built",
|
|
"importers": []
|
|
},
|
|
{
|
|
"module": "model.judge",
|
|
"classification": "load_bearing",
|
|
"reason": "model-grounded-detection Req 8: one bounded question, checked against the model",
|
|
"importers": []
|
|
},
|
|
{
|
|
"module": "model.ladder",
|
|
"classification": "load_bearing",
|
|
"reason": "model-grounded-detection Req 5: the evidence ladder every finding carries",
|
|
"importers": [
|
|
"model.config_value",
|
|
"model.dominance",
|
|
"model.execution",
|
|
"model.judge",
|
|
"model.pipeline",
|
|
"model.scan",
|
|
"model.taint"
|
|
]
|
|
},
|
|
{
|
|
"module": "model.pipeline",
|
|
"classification": "load_bearing",
|
|
"reason": "model-grounded-detection Req 8: the enumerator proposes, the LLM answers, the model disposes",
|
|
"importers": [
|
|
"model.scan"
|
|
]
|
|
},
|
|
{
|
|
"module": "model.regions",
|
|
"classification": "load_bearing",
|
|
"reason": "contributor-scan Req 2: regions from entry points, with the families each admits",
|
|
"importers": [
|
|
"cli",
|
|
"model.scan"
|
|
]
|
|
},
|
|
{
|
|
"module": "model.report",
|
|
"classification": "load_bearing",
|
|
"reason": "model-grounded-detection Req 9.3/11.1: per-slice reporting with the overfitting gap",
|
|
"importers": [
|
|
"cli"
|
|
]
|
|
},
|
|
{
|
|
"module": "model.scan",
|
|
"classification": "load_bearing",
|
|
"reason": "contributor-scan Req 3: the repository driver -- one CPG, one budget, ranked spend",
|
|
"importers": [
|
|
"cli"
|
|
]
|
|
},
|
|
{
|
|
"module": "model.shipped",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli"
|
|
]
|
|
},
|
|
{
|
|
"module": "model.specs",
|
|
"classification": "load_bearing",
|
|
"reason": "model-grounded-detection Req 7.2-7.4: the security vocabularies the CPG queries are parameterised by",
|
|
"importers": [
|
|
"model.config_value",
|
|
"model.dominance",
|
|
"model.judge",
|
|
"model.pipeline",
|
|
"model.regions",
|
|
"model.report",
|
|
"model.scan",
|
|
"model.taint"
|
|
]
|
|
},
|
|
{
|
|
"module": "model.taint",
|
|
"classification": "load_bearing",
|
|
"reason": "model-grounded-detection Req 6.1: taint reachability over the CPG, the flow-family arbiter",
|
|
"importers": [
|
|
"model.judge",
|
|
"model.pipeline",
|
|
"model.scan"
|
|
]
|
|
},
|
|
{
|
|
"module": "model.taxonomy",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"model.candidates",
|
|
"model.report",
|
|
"model.scan",
|
|
"model.specs"
|
|
]
|
|
},
|
|
{
|
|
"module": "pair_gate",
|
|
"classification": "load_bearing",
|
|
"reason": "entry point",
|
|
"importers": [
|
|
"cli"
|
|
]
|
|
},
|
|
{
|
|
"module": "pairs",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"improve",
|
|
"improve.evolve",
|
|
"model.candidates",
|
|
"pair_gate"
|
|
]
|
|
},
|
|
{
|
|
"module": "policy",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"findings",
|
|
"hunter",
|
|
"hunter_harness",
|
|
"improve.evolve",
|
|
"improve.validator",
|
|
"scoring.project_score",
|
|
"semantic.overlay",
|
|
"stage_processors"
|
|
]
|
|
},
|
|
{
|
|
"module": "policy.verycode",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"policy"
|
|
]
|
|
},
|
|
{
|
|
"module": "preprocess",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"complexity.hints",
|
|
"complexity.map",
|
|
"complexity.signals",
|
|
"findings",
|
|
"gate",
|
|
"hunter",
|
|
"hunter_harness",
|
|
"hunter_tools",
|
|
"improve.evolve",
|
|
"index",
|
|
"map_gate",
|
|
"mapping",
|
|
"model.candidates",
|
|
"model.scan",
|
|
"pairs",
|
|
"rank",
|
|
"regress.candidate",
|
|
"semantic.overlay",
|
|
"skills",
|
|
"stage_processors"
|
|
]
|
|
},
|
|
{
|
|
"module": "provenance",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli"
|
|
]
|
|
},
|
|
{
|
|
"module": "provider",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"model.endpoint",
|
|
"tool_hunter"
|
|
]
|
|
},
|
|
{
|
|
"module": "provider.openrouter",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"model.endpoint",
|
|
"tool_hunter"
|
|
]
|
|
},
|
|
{
|
|
"module": "rank",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"calibration",
|
|
"cli",
|
|
"findings",
|
|
"gate",
|
|
"hunter",
|
|
"hunter_harness",
|
|
"hunter_tools",
|
|
"improve.evolve",
|
|
"map_gate",
|
|
"pairs",
|
|
"stage_processors"
|
|
]
|
|
},
|
|
{
|
|
"module": "redaction",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"harness",
|
|
"model.judge",
|
|
"model.pipeline",
|
|
"reports",
|
|
"semantic.obligations.intent"
|
|
]
|
|
},
|
|
{
|
|
"module": "regress",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"regress.candidate"
|
|
]
|
|
},
|
|
{
|
|
"module": "regress.candidate",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"regress"
|
|
]
|
|
},
|
|
{
|
|
"module": "regress.recipes",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"regress",
|
|
"regress.candidate"
|
|
]
|
|
},
|
|
{
|
|
"module": "regress.safety",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"regress",
|
|
"regress.candidate"
|
|
]
|
|
},
|
|
{
|
|
"module": "regress.verdict",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"regress",
|
|
"regress.candidate"
|
|
]
|
|
},
|
|
{
|
|
"module": "reports",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli"
|
|
]
|
|
},
|
|
{
|
|
"module": "repos",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli"
|
|
]
|
|
},
|
|
{
|
|
"module": "ruleset",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"findings",
|
|
"hunter",
|
|
"hunter_harness",
|
|
"improve.evolve",
|
|
"improve.validator",
|
|
"pairs",
|
|
"stage_processors"
|
|
]
|
|
},
|
|
{
|
|
"module": "ruleset.store",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"improve.validator",
|
|
"ruleset"
|
|
]
|
|
},
|
|
{
|
|
"module": "run",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"reports"
|
|
]
|
|
},
|
|
{
|
|
"module": "sandbox",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"regress.candidate",
|
|
"regress.recipes",
|
|
"regress.safety",
|
|
"regress.verdict"
|
|
]
|
|
},
|
|
{
|
|
"module": "sandbox.probe",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"sandbox"
|
|
]
|
|
},
|
|
{
|
|
"module": "sandbox.runner",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"regress.candidate",
|
|
"regress.recipes",
|
|
"regress.safety",
|
|
"sandbox"
|
|
]
|
|
},
|
|
{
|
|
"module": "scoring",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"improve.evolve",
|
|
"stage_processors"
|
|
]
|
|
},
|
|
{
|
|
"module": "scoring.project_score",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"scoring"
|
|
]
|
|
},
|
|
{
|
|
"module": "semantic",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"cpg.capability",
|
|
"hunter_tools",
|
|
"mapping",
|
|
"model.candidates",
|
|
"model.specs",
|
|
"pairs",
|
|
"semantic.cst",
|
|
"semantic.engines",
|
|
"semantic.functions",
|
|
"semantic.ir",
|
|
"semantic.obligations.check",
|
|
"semantic.obligations.operations",
|
|
"semantic.obligations.shapes",
|
|
"semantic.overlay",
|
|
"semantic.prove_filter",
|
|
"semantic.taint"
|
|
]
|
|
},
|
|
{
|
|
"module": "semantic.cst",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"semantic.ir"
|
|
]
|
|
},
|
|
{
|
|
"module": "semantic.engines",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cpg.capability",
|
|
"semantic",
|
|
"semantic.overlay"
|
|
]
|
|
},
|
|
{
|
|
"module": "semantic.extra",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"semantic",
|
|
"semantic.cst",
|
|
"semantic.engines"
|
|
]
|
|
},
|
|
{
|
|
"module": "semantic.facts",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"hunter_tools",
|
|
"mapping",
|
|
"model.candidates",
|
|
"model.specs",
|
|
"pairs",
|
|
"semantic",
|
|
"semantic.obligations.check",
|
|
"semantic.obligations.operations",
|
|
"semantic.obligations.shapes",
|
|
"semantic.overlay",
|
|
"semantic.taint"
|
|
]
|
|
},
|
|
{
|
|
"module": "semantic.functions",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"hunter_tools",
|
|
"pairs",
|
|
"semantic.obligations.shapes",
|
|
"semantic.overlay"
|
|
]
|
|
},
|
|
{
|
|
"module": "semantic.ir",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"hunter_tools",
|
|
"model.candidates",
|
|
"pairs",
|
|
"semantic.cst",
|
|
"semantic.functions",
|
|
"semantic.obligations.check",
|
|
"semantic.obligations.operations",
|
|
"semantic.obligations.shapes",
|
|
"semantic.overlay",
|
|
"semantic.taint"
|
|
]
|
|
},
|
|
{
|
|
"module": "semantic.obligations",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"hunter_tools",
|
|
"model.candidates",
|
|
"model.specs",
|
|
"pairs",
|
|
"semantic.obligations.check",
|
|
"semantic.obligations.dominance",
|
|
"semantic.obligations.intent",
|
|
"semantic.obligations.operations",
|
|
"semantic.obligations.policy",
|
|
"semantic.obligations.shapes",
|
|
"semantic.obligations.siblings"
|
|
]
|
|
},
|
|
{
|
|
"module": "semantic.obligations.check",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"semantic.obligations",
|
|
"semantic.obligations.intent"
|
|
]
|
|
},
|
|
{
|
|
"module": "semantic.obligations.dominance",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"hunter_tools",
|
|
"pairs",
|
|
"semantic.obligations.check"
|
|
]
|
|
},
|
|
{
|
|
"module": "semantic.obligations.facts",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"model.specs",
|
|
"pairs",
|
|
"semantic.obligations",
|
|
"semantic.obligations.check",
|
|
"semantic.obligations.operations",
|
|
"semantic.obligations.policy",
|
|
"semantic.obligations.shapes",
|
|
"semantic.obligations.siblings"
|
|
]
|
|
},
|
|
{
|
|
"module": "semantic.obligations.intent",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli"
|
|
]
|
|
},
|
|
{
|
|
"module": "semantic.obligations.operations",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"model.candidates",
|
|
"semantic.obligations.check",
|
|
"semantic.obligations.dominance",
|
|
"semantic.obligations.siblings"
|
|
]
|
|
},
|
|
{
|
|
"module": "semantic.obligations.policy",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli",
|
|
"semantic.obligations.check"
|
|
]
|
|
},
|
|
{
|
|
"module": "semantic.obligations.shapes",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"semantic.obligations",
|
|
"semantic.obligations.operations"
|
|
]
|
|
},
|
|
{
|
|
"module": "semantic.obligations.siblings",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"semantic.obligations.check"
|
|
]
|
|
},
|
|
{
|
|
"module": "semantic.overlay",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"semantic",
|
|
"semantic.prove_filter"
|
|
]
|
|
},
|
|
{
|
|
"module": "semantic.prove_filter",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"semantic"
|
|
]
|
|
},
|
|
{
|
|
"module": "semantic.taint",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"semantic.overlay"
|
|
]
|
|
},
|
|
{
|
|
"module": "skills",
|
|
"classification": "standalone_capability",
|
|
"reason": "skill router; consumed by mcp and by the OpenCode integration, not by the scan path",
|
|
"importers": [
|
|
"hunter",
|
|
"hunter_harness"
|
|
]
|
|
},
|
|
{
|
|
"module": "slot_contract",
|
|
"classification": "standalone_capability",
|
|
"reason": "the slot/contract protocol stage_processors implements",
|
|
"importers": [
|
|
"stage_processors"
|
|
]
|
|
},
|
|
{
|
|
"module": "stage_processors",
|
|
"classification": "standalone_capability",
|
|
"reason": "HarnessX slot-contracted scan stages; pinned by the zero-dependency guard in test_gate",
|
|
"importers": []
|
|
},
|
|
{
|
|
"module": "stages",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli"
|
|
]
|
|
},
|
|
{
|
|
"module": "tool_hunter",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"model.endpoint"
|
|
]
|
|
},
|
|
{
|
|
"module": "verification",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"calibration",
|
|
"cli",
|
|
"fusion",
|
|
"reports",
|
|
"verify_judge"
|
|
]
|
|
},
|
|
{
|
|
"module": "verify_judge",
|
|
"classification": "load_bearing",
|
|
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
|
|
"importers": [
|
|
"cli"
|
|
]
|
|
}
|
|
]
|
|
}
|