mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-20 13:39:27 +00:00
42 lines
2.4 KiB
Markdown
42 lines
2.4 KiB
Markdown
# Group 4 implementation and verification
|
||
|
||
Date: 2026-09-13. The maintainer authorized group 4 as a whole. Scope is tasks
|
||
4.1–4.3: targeted novelty comparison, actionability admission and compact reporting.
|
||
Groups 1–3 are verified at `6ba2b06`; full transaction replay remains task 5.1.
|
||
|
||
Status: implementation in progress. Task completion requires independent review
|
||
and fresh evidence. No production capability is enabled for normal hook alerts;
|
||
capability admission still requires task 8.3 evaluation.
|
||
|
||
## Verification boundary
|
||
|
||
Exercise production policy functions with immutable Git snapshots and actual engine
|
||
answers, plus deterministic error-path and equivalent-origin controls. Prove source
|
||
bytes were read before interpreting empty answers. Synthetic evaluated capabilities
|
||
exercise admission mechanics only and never establish real capability eligibility.
|
||
The established gates protect detector regressions; these controls do not establish
|
||
production hook latency, broad alert precision or feature-level readiness.
|
||
|
||
## Task 4.1 verification
|
||
|
||
VERIFIED (TASK scope), independent review APPROVED. Full suite: 1,167 passed,
|
||
nine skipped in 122.44 seconds; global Ruff/format (233 files), mypy (110 source
|
||
files), all three regression gates and diff checks passed. The first OFF control
|
||
failed on novelty behavior. Review regressions reproduced false NEW classifications
|
||
from wrong-mechanism base rows and non-string operations; both now stay unknown.
|
||
|
||
`benchmarks/measurements/2026-09-13-delta-comparison-smoke.json` records actual
|
||
JavaScript guard removal as worsened, unchanged backlog moved by comments as
|
||
unchanged, and a PHP source newly connected to a mapped unchanged sink as new.
|
||
All inputs were read and both sides' questions completed. Current reviewed policy
|
||
was independently rechecked against captured actual answers after the schema-only
|
||
repair; the artifact preserves exact source hashes and that narrower provenance.
|
||
Concurrent lab costs were 214.81, 214.52 and 291.01 seconds respectively under
|
||
900-second budgets. These are not hook latency measurements.
|
||
|
||
Automatic dominance-only change-context projection remains an explicit upstream
|
||
limitation for the later replay integration. These controls use declared questions
|
||
and Git context directly; no missing-coverage result was erased. Ambiguous source
|
||
and identifier changes remain unknown. Task 4.1 brings progress to 12/27 tasks;
|
||
admission and rendering remain pending within this authorized group.
|