mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 4.8
e716e3beab
Verified on the records: the push replay arms hardcode model="disabled", max_model_calls=0, cost_usd=0 (NO LLM) and engine_covered=0 (engine never ran, ~200s wall). So the measured catch~2.5% is the quick pattern-rule tier ALONE -- grep-with-structure. Pattern rules alone will never be enough. Reprioritize G2 after record 07 to an efficiency barrier analysis over the two tiers that carry detection and both sat out: - engine (Joern dataflow): E1 split the ~150s evidence-fixed (JVM/graph-load/ census); E2 does a warm session + graph preload at build kill it (decisive); E3 analysis per-pair; E4 build vs repo size. - LLM adjudication: L1 model latency + calls per push; L2 recall lift over regex+dataflow on the pool. Deliverable: a barrier table (budget x tier combo -> fits? measured recall/FP) for a realistic pre-push window (<=120s target, 300s hard) -> minimal releasable config. Change-scoping branch is a late add-on (trims only the per-pair tail), not the lever. Also fixed a stray </content> tag in the brief. Co-Authored-By: Claude Opus 4.8 <[email protected]>