8ac9ddb175
- skills/fold-sast: rename to skill-fold-sast and expand the scan/precision guidance for C++/Rust/Swift lanes - docs/architecture: record call-graph phase decomposition and the optimization-loop TP/FP/TN/FN evidence policy - docs/mcp-tools + README: update budget/per-query defaults (1800s/6000ms) and note the OpenGrep pre-push hook
38 lines
1.8 KiB
Markdown
38 lines
1.8 KiB
Markdown
# Binary-lane detector research state (sequential loop)
|
|
|
|
Tracked by the single research loop. One gap at a time; update this file after
|
|
each fire so the loop resumes where it left off.
|
|
|
|
```yaml
|
|
current_gap: done # all three gaps' bounded paths resolved
|
|
fixture_recipe: zig # gcc x86-64 cross-link works via Docker (build-linux.sh)
|
|
iteration: 8
|
|
fixture_recipe_evaluated: true
|
|
# RETAINED (F1=1.000): oob-access, div-by-zero, use-after-free (P1 P-Code heap model).
|
|
# EXHAUSTED (bounded paths rejected, remaining = deeper features):
|
|
# null-deref (interprocedural null-const propagation), int-overflow (source->sink taint-track).
|
|
```
|
|
|
|
## Order of operations (each fire)
|
|
|
|
1. Read this state file.
|
|
2. If `fixture_recipe_evaluated` is false, evaluate the clang/gcc fixture-recipe
|
|
hypothesis FIRST (it unblocks all three gaps): rebuild one fixture (e.g.
|
|
`cwe190_overflow`) with `clang`/`gcc` instead of `zig cc`, and re-measure the
|
|
runtime noise (does the ~153-site checked-arithmetic FP disappear?). Record
|
|
the result; set `fixture_recipe_evaluated: true`.
|
|
3. For the current gap, run the signal-to-noise pre-check (fire the candidate
|
|
signal against `clean.elf`; if it fires there, it is toolchain noise).
|
|
4. Implement one bounded sub-hypothesis; validate (`ninja -C build/release`,
|
|
`bench/score_binary.py`, binary tests); retain only on F1 gain with no
|
|
oob/div0 regression and no clean.elf FP; else revert + document in
|
|
`docs/research/binary-detector-research.md`.
|
|
5. When a gap is exhausted (all paths retained/rejected), advance
|
|
`current_gap` to the next in sequence.
|
|
|
|
## Lessons (do not repeat)
|
|
|
|
- Rejected for toolchain noise (do NOT retry without a taint filter or a non-zig
|
|
recipe): forward interprocedural null-deref summary (§19), UAF pcode_scan
|
|
wiring (§20), carry-flag int-overflow (iteration 1, §iteration-log).
|
|
EOF
|