af66058f3a
Backlog #5 (operator-confirmed). chromium_source.json and sage_rust.json were validated but unwired. This adds: - reviewed dispositions (5 parallel review subagents): chromium 11 (10 FP/1 accepted-risk — deliberate modular arithmetic in base/file_path.cc); sage 2714 (9 actionable uncontained path-join reads in skill install/daemon library/model-downloader; 890 FP; 1815 accepted-risk quality bulk) - wall/RSS baselines for both corpora Measured both corpora produce finding drift run-to-run (chromium Z3 fingerprint drifts; sage +5 findings) and chromium's wall swings up to ~2x under load — so they are wired as STRESS/DIVERSITY corpora: a new additive evaluation.max_new_findings override lets a manifest declare its finding-drift tolerance (CLI default unchanged for fold/yams), allow_finding_drift is on, and chromium's wall/RSS thresholds are relaxed. Final: both evals pass. Also fixes a pre-existing /tmp-literal default (now platform tempdir) in run_project_eval.py.
39 lines
No EOL
898 B
JSON
39 lines
No EOL
898 B
JSON
{
|
|
"schema_version": 1,
|
|
"project": "sage",
|
|
"lane": "rust",
|
|
"corpus": {
|
|
"path": "../../../../../crypto/sage-protocol/packages/sage",
|
|
"missing_corpus": "fail"
|
|
},
|
|
"analysis": {
|
|
"detectors": [
|
|
"complexity",
|
|
"clone",
|
|
"dead",
|
|
"rust-unsafe-api",
|
|
"rust-unchecked-index",
|
|
"rust-path-traversal",
|
|
"rust-command-injection",
|
|
"rust-crypto-misuse"
|
|
],
|
|
"processes": 1,
|
|
"rust_toolchain": "nightly-2026-05-28",
|
|
"extra_args": [
|
|
"--complexity-threshold",
|
|
"20",
|
|
"--rust-allow-build-code"
|
|
]
|
|
},
|
|
"evaluation": {
|
|
"repeats": 1,
|
|
"wall_regression_pct": 20.0,
|
|
"rss_regression_pct": 20.0,
|
|
"min_functions": 1,
|
|
"z3_timeout_budget": 0,
|
|
"dispositions": "../sage/rust_dispositions.json",
|
|
"baseline": "baselines/sage_rust.json",
|
|
"allow_finding_drift": true,
|
|
"max_new_findings": 64
|
|
}
|
|
} |