Files
Open_Ultra_SAST/benchmarks/measurements/2026-09-08-module-audit.json
T
Marius CiepluchandClaude Opus 5.5 e6ed7854bb feat(learn): labels from ground truth with provenance (decision-engine task 4)
learn/sources.toml is the fail-closed source list: every read goes through one guard
that refuses an unlisted path or an [[excluded]] file name before opening it, and a
source whose evaluation record is missing cannot label. Population v3 is named only
as excluded, by file name, and is never opened (tested with a v3-named fixture and
open/read_text tracked).

learn/labels.py and `ousast learn labels` apply the design's rules: v2 declared
sites and v1 fix-range functions positive, the same function on the fixed pin
negative only when the fix changed it, introduce/repair delta units, benign control
pushes as conditional negatives; pairs vulnerable/fixed (unscorable and title tier
out, title as a sensitivity arm); dev-php recipe known functions; recorded
adjudications with their reasons. v2 rows are labels marked design_informed, as the
design says. Repository groups: normalised owner/name, merged by shared CVE/GHSA,
shared fix commits and [[alias]] rows.

assumed_benign (maintainer decision): ordinary commits of the population
repositories, >= 90 days from any fix, no later security commit touching their
files, weight 0.5, conditional, reported separately and never merged with verified
negatives. The security filter is multilingual (CJK, Korean, Russian, European and
other languages) plus CVE/GHSA/CWE references and dependency bumps; widened after
reading accepted pushes (validation, passwords, guards).

First snapshot, counts only (benchmarks/measurements/2026-09-30-decision-engine-
labels/labels.json): verified pin labels in positive/negative repository groups
injection 44/41, untrusted_destination 35/34, deserialization 20/20 (per-family),
output_encoding 15/15, path 15/14, access_control 12/12 (pooled), config_secrets 5/5,
memory 5/5 (insufficient). assumed_benign: 969 pushes in 27 groups from 36,000
commits scanned.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
2026-09-30 19:54:26 +02:00

1619 lines
43 KiB
JSON

{
"modules": 143,
"counts": {
"load_bearing": 136,
"standalone_capability": 7
},
"orphaned": [],
"standalone": {
"fusion": "two-panel adjudication engine; reached from the scan's report stage and used standalone",
"mcp": "narrow MCP server over stdio; its own `ousast mcp` entry point and OpenCode integration",
"push_inputs": "pre-push-safety-net task 1.2: offline input provenance validator; python -m openultrasast.push_inputs",
"push_scoring": "pre-push-safety-net task 1.3: frozen-profile diagnostic outcome scorer; python -m openultrasast.push_scoring",
"skills": "skill router; consumed by mcp and by the OpenCode integration, not by the scan path",
"slot_contract": "the slot/contract protocol stage_processors implements",
"stage_processors": "deterministic slot-contracted scan stages; pinned by the zero-dependency guard in test_gate"
},
"rows": [
{
"module": "benchmark",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"gate",
"improve.evolve",
"map_gate",
"mcp",
"pairs",
"plane.tasks.loop"
]
},
{
"module": "calibration",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli"
]
},
{
"module": "cli",
"classification": "load_bearing",
"reason": "entry point",
"importers": [
"mcp"
]
},
{
"module": "complexity",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"complexity.hints",
"complexity.ledger",
"complexity.map",
"map_gate",
"plane.tasks.verify",
"regress.candidate",
"semantic.prove_filter",
"tool_hunter"
]
},
{
"module": "complexity.hints",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"complexity",
"complexity.map"
]
},
{
"module": "complexity.ledger",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"complexity",
"complexity.map",
"regress.candidate"
]
},
{
"module": "complexity.map",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"complexity",
"complexity.hints",
"complexity.ledger",
"map_gate",
"plane.tasks.verify",
"regress.candidate",
"semantic.prove_filter",
"tool_hunter"
]
},
{
"module": "complexity.signals",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"complexity",
"complexity.hints",
"complexity.map"
]
},
{
"module": "config",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"harness",
"hunter_tools",
"model.endpoint",
"pairs",
"plane.memory",
"push.assistance",
"push.policy",
"push.runner",
"regress.candidate",
"regress.recipes",
"run"
]
},
{
"module": "contracts",
"classification": "load_bearing",
"reason": "pre-push-safety-net Req 7.3: strict shared manifest serialization, independent of push",
"importers": [
"config",
"cpg.artifact",
"model.contracts",
"push.cache",
"push.contracts",
"push.policy",
"push.vetoes"
]
},
{
"module": "cpg",
"classification": "load_bearing",
"reason": "model-grounded-detection Req 4: the CPG seam package",
"importers": [
"cli",
"cpg.artifact",
"cpg.backend",
"model.config_value",
"model.dominance",
"model.judge",
"model.partitions",
"model.pipeline",
"model.scan",
"model.taint",
"push.cache",
"push.eligibility",
"push.policy",
"push.reuse",
"push.runner"
]
},
{
"module": "cpg.artifact",
"classification": "load_bearing",
"reason": "pre-push-safety-net Req 4.3/7.3: backend graph identity and live lease contract; validation integration pending",
"importers": [
"cpg.backend",
"push.cache",
"push.eligibility",
"push.policy",
"push.reuse",
"push.runner"
]
},
{
"module": "cpg.backend",
"classification": "load_bearing",
"reason": "model-grounded-detection Req 4.1/4.5: the single Joern subprocess boundary",
"importers": [
"cli",
"cpg.artifact",
"model.config_value",
"model.dominance",
"model.judge",
"model.partitions",
"model.pipeline",
"model.scan",
"model.taint",
"push.cache",
"push.policy",
"push.reuse",
"push.runner"
]
},
{
"module": "cpg.capability",
"classification": "load_bearing",
"reason": "model-grounded-detection Req 4.2/4.3: the engine probe that degrades to suspicion",
"importers": [
"cpg.backend"
]
},
{
"module": "cpg.session",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cpg.backend"
]
},
{
"module": "findings",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"benchmark",
"calibration",
"cli",
"complexity.ledger",
"complexity.map",
"complexity.signals",
"fusion",
"gate",
"hunter",
"hunter_tools",
"improve.evolve",
"map_gate",
"model.ladder",
"model.report",
"pairs",
"plane.tasks.alerts",
"rank",
"regress.candidate",
"reports",
"scoring.project_score",
"semantic.obligations.check",
"semantic.overlay",
"semantic.prove_filter",
"stage_processors",
"tool_hunter",
"verification"
]
},
{
"module": "fusion",
"classification": "standalone_capability",
"reason": "two-panel adjudication engine; reached from the scan's report stage and used standalone",
"importers": [
"cli"
]
},
{
"module": "gate",
"classification": "load_bearing",
"reason": "entry point",
"importers": [
"cli",
"plane.tasks.loop"
]
},
{
"module": "harness",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"slot_contract"
]
},
{
"module": "hunter",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli"
]
},
{
"module": "hunter_tools",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"tool_hunter"
]
},
{
"module": "improve",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"improve.evolve",
"improve.memory",
"plane.tasks.loop"
]
},
{
"module": "improve.evolve",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"improve",
"plane.tasks.loop"
]
},
{
"module": "improve.journal",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"improve",
"improve.evolve",
"improve.memory",
"plane.tasks.loop"
]
},
{
"module": "improve.memory",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"improve.evolve",
"plane.tasks.loop"
]
},
{
"module": "improve.validator",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"improve",
"improve.evolve",
"improve.memory",
"plane.tasks.loop"
]
},
{
"module": "index",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"skills"
]
},
{
"module": "learn",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"learn.features",
"learn.roles",
"plane.tasks.features",
"plane.tasks.remember",
"plane.tasks.roles"
]
},
{
"module": "learn.features",
"classification": "load_bearing",
"reason": "imported by plane.tasks.features",
"importers": [
"plane.tasks.features"
]
},
{
"module": "learn.labels",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli"
]
},
{
"module": "learn.roles",
"classification": "load_bearing",
"reason": "imported by learn.features, plane.tasks.features, plane.tasks.roles",
"importers": [
"learn.features",
"plane.tasks.features",
"plane.tasks.roles"
]
},
{
"module": "learn.schema",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"learn.features",
"learn.roles",
"plane.tasks.remember",
"plane.tasks.roles"
]
},
{
"module": "map_gate",
"classification": "load_bearing",
"reason": "entry point",
"importers": []
},
{
"module": "mapping",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"gate",
"hunter_tools",
"improve.evolve",
"learn.features",
"map_gate",
"model.scan",
"pairs",
"plane.tasks.alerts",
"preprocess",
"push.runner",
"stage_processors"
]
},
{
"module": "mcp",
"classification": "standalone_capability",
"reason": "narrow MCP server over stdio; its own `ousast mcp` entry point and OpenCode integration",
"importers": [
"cli"
]
},
{
"module": "model",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"cpg.backend",
"cpg.session",
"learn.features",
"learn.labels",
"model.candidates",
"model.config_value",
"model.dominance",
"model.execution",
"model.judge",
"model.layout",
"model.partitions",
"model.pipeline",
"model.regions",
"model.report",
"model.scan",
"model.specs",
"model.taint",
"plane.budget",
"plane.generate",
"plane.tasks.features",
"plane.tasks.repo_facts",
"preprocess",
"push.assistance",
"push.cache",
"push.contracts",
"push.policy",
"push.report",
"push.reuse",
"push.runner",
"push.snapshot",
"push.vetoes",
"tool_hunter"
]
},
{
"module": "model.audit",
"classification": "load_bearing",
"reason": "model-grounded-detection Req 3: this classifier; run by the maintainer, not by the scan",
"importers": []
},
{
"module": "model.calibrate",
"classification": "load_bearing",
"reason": "model-grounded-detection Req 9: the corpus as the model's calibration set",
"importers": []
},
{
"module": "model.candidates",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"model.scan"
]
},
{
"module": "model.config_value",
"classification": "load_bearing",
"reason": "model-grounded-detection Req 6.3: constant abstraction for the configuration families",
"importers": [
"model.pipeline",
"model.scan"
]
},
{
"module": "model.contracts",
"classification": "load_bearing",
"reason": "pre-push-safety-net Req 4.1/7.3: generic deadline, change and exact scope contracts; integration pending",
"importers": [
"cli",
"cpg.backend",
"cpg.session",
"model.partitions",
"model.regions",
"model.scan",
"push.assistance",
"push.cache",
"push.contracts",
"push.policy",
"push.report",
"push.reuse",
"push.runner",
"push.snapshot",
"push.vetoes"
]
},
{
"module": "model.dominance",
"classification": "load_bearing",
"reason": "model-grounded-detection Req 6.2: guard dominance, the arbiter for bugs that never crash",
"importers": [
"model.pipeline",
"model.scan"
]
},
{
"module": "model.endpoint",
"classification": "load_bearing",
"reason": "model-grounded-detection Req 8: the judge client, wired by model/judge.py in group 3",
"importers": [
"cli",
"plane.budget",
"plane.generate",
"push.assistance",
"tool_hunter"
]
},
{
"module": "model.evidence",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"model.scan"
]
},
{
"module": "model.execution",
"classification": "load_bearing",
"reason": "model-grounded-detection Req 10: the deferred execution tier seam, adopted not built",
"importers": []
},
{
"module": "model.judge",
"classification": "load_bearing",
"reason": "model-grounded-detection Req 8: one bounded question, checked against the model",
"importers": []
},
{
"module": "model.ladder",
"classification": "load_bearing",
"reason": "model-grounded-detection Req 5: the evidence ladder every finding carries",
"importers": [
"model.config_value",
"model.dominance",
"model.execution",
"model.judge",
"model.pipeline",
"model.scan",
"model.taint",
"push.policy"
]
},
{
"module": "model.layout",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"model.partitions",
"model.scan",
"plane.tasks.repo_facts",
"preprocess",
"push.runner"
]
},
{
"module": "model.partitions",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"model.scan"
]
},
{
"module": "model.pipeline",
"classification": "load_bearing",
"reason": "model-grounded-detection Req 8: the enumerator proposes, the LLM answers, the model disposes",
"importers": [
"model.scan",
"push.policy"
]
},
{
"module": "model.regions",
"classification": "load_bearing",
"reason": "contributor-scan Req 2: regions from entry points, with the families each admits",
"importers": [
"cli",
"model.layout",
"model.scan",
"push.policy",
"push.reuse",
"push.runner"
]
},
{
"module": "model.report",
"classification": "load_bearing",
"reason": "model-grounded-detection Req 9.3/11.1: per-slice reporting with the overfitting gap",
"importers": [
"cli"
]
},
{
"module": "model.scan",
"classification": "load_bearing",
"reason": "contributor-scan Req 3: the repository driver -- one CPG, one budget, ranked spend",
"importers": [
"cli",
"push.policy",
"push.report",
"push.runner",
"push.vetoes"
]
},
{
"module": "model.shipped",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"push.runner"
]
},
{
"module": "model.specs",
"classification": "load_bearing",
"reason": "model-grounded-detection Req 7.2-7.4: the security vocabularies the CPG queries are parameterised by",
"importers": [
"model.config_value",
"model.dominance",
"model.judge",
"model.pipeline",
"model.regions",
"model.report",
"model.scan",
"model.taint",
"push.policy"
]
},
{
"module": "model.taint",
"classification": "load_bearing",
"reason": "model-grounded-detection Req 6.1: taint reachability over the CPG, the flow-family arbiter",
"importers": [
"model.judge",
"model.pipeline",
"model.scan"
]
},
{
"module": "model.taxonomy",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"learn.features",
"learn.labels",
"model.candidates",
"model.report",
"model.scan",
"model.specs",
"plane.tasks.features"
]
},
{
"module": "pair_gate",
"classification": "load_bearing",
"reason": "entry point",
"importers": [
"cli"
]
},
{
"module": "pairs",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"improve",
"improve.evolve",
"improve.memory",
"learn.labels",
"model.candidates",
"pair_gate",
"plane.tasks.loop"
]
},
{
"module": "plane",
"classification": "load_bearing",
"reason": "ai-service-plane Req 1-4: the service plane package; runner and reconciler integration in tasks 3-4",
"importers": [
"cli",
"improve.memory",
"plane.egress",
"plane.engine_alerts",
"plane.generate",
"plane.memory",
"plane.reconciler",
"plane.router",
"plane.runner",
"plane.tasks.loop",
"plane.tasks.remember",
"plane.tasks.roles",
"plane.tasks.verify",
"plane.workspaces"
]
},
{
"module": "plane.budget",
"classification": "load_bearing",
"reason": "ai-service-plane Req 2.3/2.4: metered chat client with usd and calls ceilings; task integration in tasks 3, 6",
"importers": [
"plane.generate",
"plane.tasks.roles",
"plane.tasks.verify"
]
},
{
"module": "plane.doctor",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"plane.reconciler"
]
},
{
"module": "plane.egress",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"plane.reconciler"
]
},
{
"module": "plane.engine_alerts",
"classification": "load_bearing",
"reason": "harnessx-removal Req 6.3: engine alerts where quick mode has no rules (PHP), on the host",
"importers": []
},
{
"module": "plane.generate",
"classification": "load_bearing",
"reason": "ai-service-plane task 7: an increment's Workspaces, per-case Tasks and Run from a recorded set",
"importers": [
"cli"
]
},
{
"module": "plane.manifests",
"classification": "load_bearing",
"reason": "ai-service-plane Req 1.1-1.4: ax-shaped Task/Workspace/Model and the Run kind, validated before anything runs",
"importers": [
"plane.egress",
"plane.generate",
"plane.reconciler",
"plane.router",
"plane.runner",
"plane.workspaces"
]
},
{
"module": "plane.memory",
"classification": "load_bearing",
"reason": "harnessx-removal Req 6.1/6.4: the memory store (file, MinIO), ingest and fact reuse; `ousast plane remember`",
"importers": [
"improve.memory",
"plane.generate",
"plane.tasks.loop",
"plane.tasks.remember"
]
},
{
"module": "plane.reconciler",
"classification": "load_bearing",
"reason": "ai-service-plane Req 3.1-3.5, 7.3: ax-backed Run execution, status attribution and doctor; `ousast plane`",
"importers": [
"plane.generate",
"plane.memory",
"plane.workspaces"
]
},
{
"module": "plane.router",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"plane.reconciler",
"plane.runner"
]
},
{
"module": "plane.runner",
"classification": "load_bearing",
"reason": "ai-service-plane Req 4.1-4.4: the ax-task-runner entrypoint (PID 1 of the task image); delivers the output directory",
"importers": []
},
{
"module": "plane.tasks",
"classification": "load_bearing",
"reason": "ai-service-plane Req 4.1: the task entrypoint package the runner imports by name; runner integration pending (task 3)",
"importers": [
"cli",
"learn.features",
"learn.labels",
"learn.roles",
"plane.engine_alerts",
"plane.generate",
"plane.memory",
"plane.tasks.agree",
"plane.tasks.alerts",
"plane.tasks.features",
"plane.tasks.remember",
"plane.tasks.roles"
]
},
{
"module": "plane.tasks.agree",
"classification": "load_bearing",
"reason": "ai-service-plane Req 5.3/2.1: agreement across two verify passes with per-candidate cost, turns and site match",
"importers": []
},
{
"module": "plane.tasks.alerts",
"classification": "load_bearing",
"reason": "harnessx-removal Req 6.3: quick-mode alerts on a case's vulnerable and fixed pins, model-free",
"importers": [
"learn.features",
"plane.engine_alerts",
"plane.tasks.features"
]
},
{
"module": "plane.tasks.features",
"classification": "load_bearing",
"reason": "learned-decision-engine Req 1.1-1.3/7.2: one allow-listed feature record per candidate, model-free",
"importers": []
},
{
"module": "plane.tasks.loop",
"classification": "load_bearing",
"reason": "harnessx-removal Req 6.3: the improvement loop's snapshot, measure, propose and improve steps",
"importers": [
"plane.memory"
]
},
{
"module": "plane.tasks.remember",
"classification": "load_bearing",
"reason": "harnessx-removal Req 6.1: a case's delivered artifacts as memory rows, model-free",
"importers": [
"cli"
]
},
{
"module": "plane.tasks.repo_facts",
"classification": "load_bearing",
"reason": "ai-service-plane Req 5.1/5.2: source-only functions and callers per file; runner integration pending",
"importers": [
"learn.features",
"learn.labels",
"learn.roles",
"plane.generate",
"plane.tasks.alerts",
"plane.tasks.features",
"plane.tasks.remember",
"plane.tasks.roles"
]
},
{
"module": "plane.tasks.roles",
"classification": "load_bearing",
"reason": "learned-decision-engine Req 8.1: model role classification per file chunk (model_sinks.py moved in); its Run template comes with the harvest (task 5)",
"importers": []
},
{
"module": "plane.tasks.verify",
"classification": "load_bearing",
"reason": "ai-service-plane Req 5.3/2.1-2.3/7.2: the batched hunt with known callers, metered and resumable per file hunt",
"importers": [
"plane.generate",
"plane.tasks.agree",
"plane.tasks.roles"
]
},
{
"module": "plane.workspaces",
"classification": "load_bearing",
"reason": "ai-service-plane task 4: Workspace manifests per case pin of a population; `ousast plane workspaces`",
"importers": [
"cli"
]
},
{
"module": "policy",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"findings",
"hunter",
"improve.evolve",
"improve.validator",
"plane.tasks.loop",
"scoring.project_score",
"semantic.overlay",
"stage_processors"
]
},
{
"module": "policy.verycode",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"policy"
]
},
{
"module": "preprocess",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"complexity.hints",
"complexity.map",
"complexity.signals",
"findings",
"gate",
"hunter",
"hunter_tools",
"improve.evolve",
"index",
"learn.features",
"learn.labels",
"learn.roles",
"map_gate",
"mapping",
"model.candidates",
"model.partitions",
"model.scan",
"pairs",
"plane.tasks.alerts",
"plane.tasks.features",
"plane.tasks.repo_facts",
"push.runner",
"rank",
"regress.candidate",
"semantic.overlay",
"skills",
"stage_processors"
]
},
{
"module": "profiling",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli"
]
},
{
"module": "provenance",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli"
]
},
{
"module": "provider",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"model.endpoint",
"tool_hunter"
]
},
{
"module": "provider.openrouter",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"model.endpoint",
"tool_hunter"
]
},
{
"module": "push",
"classification": "load_bearing",
"reason": "pre-push-safety-net Req 5.5/7.3: experimental push contract package; no hook installed",
"importers": [
"cli",
"push.assistance",
"push.eligibility",
"push.policy",
"push.report",
"push.reuse",
"push.runner",
"push.snapshot",
"push.vetoes"
]
},
{
"module": "push.assistance",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"push.runner"
]
},
{
"module": "push.cache",
"classification": "load_bearing",
"reason": "pre-push-safety-net task 6.2: bounded artifact publication and leased eviction; runner integration in 6.4",
"importers": [
"push.policy",
"push.reuse",
"push.runner"
]
},
{
"module": "push.contracts",
"classification": "load_bearing",
"reason": "pre-push-safety-net Req 5.5/7.3: immutable comparisons and independent result statuses; runner pending",
"importers": [
"push.policy",
"push.report",
"push.reuse",
"push.runner",
"push.snapshot",
"push.vetoes"
]
},
{
"module": "push.eligibility",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"push.runner"
]
},
{
"module": "push.policy",
"classification": "load_bearing",
"reason": "pre-push-safety-net Req 2.4/3.1/3.4/4.1: targeted same-semantics base comparison; replay integration pending",
"importers": [
"push.eligibility",
"push.report",
"push.runner",
"push.vetoes"
]
},
{
"module": "push.report",
"classification": "load_bearing",
"reason": "pre-push-safety-net Req 5.1/5.2/5.5/7.3: compact output and complete artifacts; runner integration pending",
"importers": [
"push.assistance",
"push.runner"
]
},
{
"module": "push.reuse",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"push.runner"
]
},
{
"module": "push.runner",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"push.assistance"
]
},
{
"module": "push.snapshot",
"classification": "load_bearing",
"reason": "pre-push-safety-net Req 1.1/1.3/1.4/7.1: local immutable ref resolution; runner integration pending",
"importers": [
"push.runner"
]
},
{
"module": "push.vetoes",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"push.runner"
]
},
{
"module": "push_inputs",
"classification": "standalone_capability",
"reason": "pre-push-safety-net task 1.2: offline input provenance validator; python -m openultrasast.push_inputs",
"importers": []
},
{
"module": "push_scoring",
"classification": "standalone_capability",
"reason": "pre-push-safety-net task 1.3: frozen-profile diagnostic outcome scorer; python -m openultrasast.push_scoring",
"importers": [
"push.eligibility"
]
},
{
"module": "rank",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"calibration",
"cli",
"findings",
"gate",
"hunter",
"hunter_tools",
"improve.evolve",
"map_gate",
"pairs",
"plane.tasks.alerts",
"stage_processors"
]
},
{
"module": "redaction",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"harness",
"model.judge",
"model.pipeline",
"push.assistance",
"push.report",
"reports",
"semantic.obligations.intent"
]
},
{
"module": "regress",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"regress.candidate"
]
},
{
"module": "regress.candidate",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"regress"
]
},
{
"module": "regress.recipes",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"regress",
"regress.candidate"
]
},
{
"module": "regress.safety",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"regress",
"regress.candidate"
]
},
{
"module": "regress.verdict",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"regress",
"regress.candidate"
]
},
{
"module": "reports",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli"
]
},
{
"module": "repos",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"push_inputs"
]
},
{
"module": "ruleset",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"findings",
"hunter",
"improve.evolve",
"improve.memory",
"improve.validator",
"learn.features",
"learn.labels",
"learn.roles",
"pairs",
"plane.tasks.alerts",
"plane.tasks.features",
"plane.tasks.loop",
"ruleset.store",
"semantic.facts",
"stage_processors"
]
},
{
"module": "ruleset.frameworks",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"learn.labels",
"learn.roles",
"ruleset.store",
"semantic.facts"
]
},
{
"module": "ruleset.store",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"improve.validator",
"ruleset"
]
},
{
"module": "run",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"reports"
]
},
{
"module": "sandbox",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"regress.candidate",
"regress.recipes",
"regress.safety",
"regress.verdict"
]
},
{
"module": "sandbox.probe",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"sandbox"
]
},
{
"module": "sandbox.runner",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"regress.candidate",
"regress.recipes",
"regress.safety",
"sandbox"
]
},
{
"module": "scoring",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"improve.evolve",
"stage_processors"
]
},
{
"module": "scoring.project_score",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"scoring"
]
},
{
"module": "semantic",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"cpg.capability",
"hunter_tools",
"learn.features",
"learn.roles",
"mapping",
"model.candidates",
"model.layout",
"model.scan",
"model.specs",
"pairs",
"semantic.cst",
"semantic.engines",
"semantic.functions",
"semantic.ir",
"semantic.obligations.check",
"semantic.obligations.facts",
"semantic.obligations.operations",
"semantic.obligations.shapes",
"semantic.overlay",
"semantic.prove_filter",
"semantic.taint"
]
},
{
"module": "semantic.cst",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"semantic.ir"
]
},
{
"module": "semantic.engines",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cpg.capability",
"semantic",
"semantic.overlay"
]
},
{
"module": "semantic.extra",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"semantic",
"semantic.cst",
"semantic.engines"
]
},
{
"module": "semantic.facts",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"hunter_tools",
"learn.features",
"learn.roles",
"mapping",
"model.candidates",
"model.layout",
"model.scan",
"model.specs",
"pairs",
"semantic",
"semantic.obligations.check",
"semantic.obligations.facts",
"semantic.obligations.operations",
"semantic.obligations.shapes",
"semantic.overlay",
"semantic.taint"
]
},
{
"module": "semantic.functions",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"hunter_tools",
"pairs",
"semantic.obligations.shapes",
"semantic.overlay"
]
},
{
"module": "semantic.ir",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"hunter_tools",
"model.candidates",
"pairs",
"semantic.cst",
"semantic.functions",
"semantic.obligations.check",
"semantic.obligations.operations",
"semantic.obligations.shapes",
"semantic.overlay",
"semantic.taint"
]
},
{
"module": "semantic.obligations",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"hunter_tools",
"model.candidates",
"model.specs",
"pairs",
"semantic.obligations.check",
"semantic.obligations.dominance",
"semantic.obligations.intent",
"semantic.obligations.operations",
"semantic.obligations.policy",
"semantic.obligations.shapes",
"semantic.obligations.siblings"
]
},
{
"module": "semantic.obligations.check",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"semantic.obligations",
"semantic.obligations.intent"
]
},
{
"module": "semantic.obligations.dominance",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"hunter_tools",
"pairs",
"semantic.obligations.check"
]
},
{
"module": "semantic.obligations.facts",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"model.specs",
"pairs",
"semantic.obligations",
"semantic.obligations.check",
"semantic.obligations.operations",
"semantic.obligations.policy",
"semantic.obligations.shapes",
"semantic.obligations.siblings"
]
},
{
"module": "semantic.obligations.intent",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli"
]
},
{
"module": "semantic.obligations.operations",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"model.candidates",
"semantic.obligations.check",
"semantic.obligations.dominance",
"semantic.obligations.siblings"
]
},
{
"module": "semantic.obligations.policy",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli",
"semantic.obligations.check"
]
},
{
"module": "semantic.obligations.shapes",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"semantic.obligations",
"semantic.obligations.operations"
]
},
{
"module": "semantic.obligations.siblings",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"semantic.obligations.check"
]
},
{
"module": "semantic.overlay",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"semantic",
"semantic.prove_filter"
]
},
{
"module": "semantic.prove_filter",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"semantic"
]
},
{
"module": "semantic.taint",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"semantic.overlay"
]
},
{
"module": "skills",
"classification": "standalone_capability",
"reason": "skill router; consumed by mcp and by the OpenCode integration, not by the scan path",
"importers": [
"hunter"
]
},
{
"module": "slot_contract",
"classification": "standalone_capability",
"reason": "the slot/contract protocol stage_processors implements",
"importers": [
"stage_processors"
]
},
{
"module": "stage_processors",
"classification": "standalone_capability",
"reason": "deterministic slot-contracted scan stages; pinned by the zero-dependency guard in test_gate",
"importers": []
},
{
"module": "stages",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"cli"
]
},
{
"module": "tool_hunter",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"model.endpoint",
"plane.budget",
"plane.tasks.roles",
"plane.tasks.verify"
]
},
{
"module": "verification",
"classification": "load_bearing",
"reason": "reachable from gate, map_gate, pair_gate or the CLI",
"importers": [
"calibration",
"cli",
"fusion",
"reports"
]
}
]
}