mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5
eaf9e3e370
Requirements approved in session. All 36 criteria trace to a component. The shape: a deterministic pass enumerates candidate sites from the semantic IR, shaped by family -- call sites for injection and path, operations with their guards for access control, bindings and literals for configuration. The model answers one bounded typed question per candidate with no tools and no choice of what to look at. The predicates that decide whether a finding counts are applied while it is being made, with one retry carrying the violation, and they come from a single definition that the scorer also uses, so the two cannot drift. Determinism is a design property, not a hope: candidates are ordered by (path, line, name) and batched at a fixed size, so two runs make an identical sequence of model calls. That is the direct answer to 120 runs producing 120 distinct trajectories. Phase 1 is the candidate ceiling, offline, no model call, measured on the real-project slices as well as the teaching one. If the ceiling on a deciding slice comes in below that slice's current detection rate, the design stops there having spent nothing. Building that in as the first phase is deliberate: the ruleset variant of this design would have capped recall at 12.1% against a 64.9% baseline, and only a measurement caught it. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG