mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 4.8
ef59c0ae3d
Adopt HarnessX at the hunter loop and verifier, capability-gated so the default
zero-dependency scan is byte-identical and CI (no extra) exercises the fallback.
- 6.1/6.2 build_sast() (single, lazy HarnessX composition site in harness_ext.py,
mirrors DocuHarnessX make_docgen) + HxScanOrchestrator (hunter_harness.py): a
drop-in for run_hunter_pool that runs one bounded HarnessX agent task per ranked
target (ModelConfig(main=AnthropicProvider).agentic(build_sast()).run(BaseTask)),
parses findings from a JSON structured-output contract, returns the existing
HunterPoolResult, maps scan_id->session_id and emits per-target exit_reason/cost/
steps to the outer trace.
- 6.4 verify_judge.verify_findings_dispatch: a drop-in superset of
verification.verify_findings — structural verifier verbatim by default (rejects
unknown reachability), HarnessX llm-judge (build_judge_prompt/parse_judge_response)
when the extra + a verifier model are present; verdict mapped to VerificationResult
evidence-gated (plausible>=0.6 accepted; unsupported/refused rejected; infra
failure never auto-rejects).
- 6.5 cli capability gate (hx_hunter/hx_verify): selects HxScanOrchestrator /
judge only in standard mode with a configured model AND has_harnessx(); otherwise
falls back and records a {stage,reason:harnessx_extra_unavailable} degradation in
the manifest (new append-only write_manifest degradations kwarg). With no model
configured the manifest stays byte-identical.
- pyproject: mypy override ignore_missing_imports for harnessx.* (absent in the
type-check env).
Verified the HarnessX path constructs against the real extra in a throwaway venv
(build_sast -> HarnessConfig; orchestrator -> Harness; build_judge_prompt/
parse_judge_response/verdict mapping) — only the live agent.run()/provider.complete()
LLM calls are offline-untestable and stay gated. 109 tests pass (2 construction
smokes skip without the extra), ruff + mypy clean, detection gate 93.6%/0% intact.
Tasks 6.1/6.2/6.4/6.5 done; 6.3 (deterministic stages as HarnessX processors) deferred.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
65 lines
1.9 KiB
TOML
65 lines
1.9 KiB
TOML
[build-system]
|
|
requires = ["uv_build>=0.8.13,<0.9.0"]
|
|
build-backend = "uv_build"
|
|
|
|
[project]
|
|
name = "openultrasast"
|
|
version = "0.1.0"
|
|
description = "OpenCode-oriented SAST harness for evidence-gated security analysis"
|
|
readme = "README.md"
|
|
requires-python = ">=3.11"
|
|
dependencies = []
|
|
|
|
[project.optional-dependencies]
|
|
# HarnessX is the optional agentic plane (LLM hunter/verifier + self-improvement).
|
|
# SHA-pinned for reproducibility; the heavy transitive footprint (see
|
|
# .kiro/specs/harnessx-self-improving-rulesets/dependency-audit.md) lands ONLY when
|
|
# this extra is installed. The core install stays zero-dependency and every HarnessX
|
|
# import is guarded by openultrasast.harness_ext (lazy). pip does not pull the
|
|
# recipe/verl_harnessX submodule (it is outside the packaged harnessx* modules).
|
|
harnessx = [
|
|
"harnessx @ git+https://github.com/Darwin-Agent/HarnessX.git@274c512eea67c64701f992d3b6fe06f0fd590ef0",
|
|
]
|
|
|
|
[project.scripts]
|
|
ousast = "openultrasast.cli:main"
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|
|
pythonpath = ["src"]
|
|
|
|
[tool.ruff]
|
|
line-length = 140
|
|
target-version = "py311"
|
|
# Benchmark fixtures are intentionally vulnerable, unformatted sample corpora;
|
|
# linting/formatting them would flag the planted bugs and shift ground-truth lines.
|
|
extend-exclude = ["benchmarks/fixtures"]
|
|
|
|
[tool.ruff.lint]
|
|
select = ["B", "E", "F", "I", "SIM", "UP"]
|
|
|
|
[tool.mypy]
|
|
python_version = "3.11"
|
|
files = ["src/openultrasast"]
|
|
check_untyped_defs = true
|
|
disallow_untyped_defs = true
|
|
no_implicit_optional = true
|
|
warn_redundant_casts = true
|
|
warn_return_any = true
|
|
warn_unused_configs = true
|
|
|
|
# HarnessX is an optional extra, absent in the type-check environment; its lazy
|
|
# imports inside guarded functions must not fail mypy.
|
|
[[tool.mypy.overrides]]
|
|
module = "harnessx.*"
|
|
ignore_missing_imports = true
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"dagger-io>=0.21.7",
|
|
"mypy>=2.1.0",
|
|
"pre-commit>=4.6.0",
|
|
"pytest>=8",
|
|
"ruff>=0.15.17",
|
|
]
|