mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Fable 5.1
c49eae4f30
policy_for(task, workspaces, model, store_host, receiver_host=None) emits one tlsPassthrough rule on 443 over the sorted union of the memory store's host, the bound Workspaces' https Git hosts and the bound Model's egress hosts. There is no http rule: an http Git repo is refused by name (it could not be reached), a store given as an address is refused naming S3_ENDPOINT (the gateway allows hostnames only). receiver_host adds the old receiver's http rule for the path group 2 keeps until 2.6; the reconciler passes it by keyword (passing the receiver's address positionally would have raised outside the worker's try and hung the run on the queue -- 2.4 hardens the worker). Tests: the store-only policy, the Model-bound policy, the two refusals, the receiver exception, and every committed template under plane/tasks/ rendering exactly the store plus, for verify and roles, the provider host. Gates: pytest 2027 passed, 42 skipped, exit 0; ruff check 0; ruff format 0; mypy 0. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo