Roadmap: origin-precision candidates for 0.3.2 - #88
Merged
Merged
Conversation
Two measured origin-analysis gaps found running luad 0.3.1 over a private OpenWrt-derived Lua 5.1 LNUM32 firmware corpus as the fact engine under a downstream security-analysis pipeline: - Emit a bounded `alternatives` set instead of the opaque `control-flow-conflict` where the reaching set is finite. The 0.3.1 loop-widening fix (PR #85) widens loop-carried slots to `control-flow-conflict`, which blocks their resolvable sibling expressions downstream. `control-flow-conflict` sits behind 99 of 175 unresolved sink-argument origins. - Make the origin unknown-reason cap explicit (B-9): two unknown-reason totals saturate at exactly 2000 corpus-wide, a silent clamp that makes the counts unusable as a release-over-release measurement. Both carry machine-testable acceptance criteria pairing a public fixture with a re-measurement against the private corpus. Bumps the ROADMAP freshness date in the README index. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FtirLUpUr9aWq57opQ3WVi
…irst Codex review (P1): the exactly-2000 saturation was asserted as a silent luad cap, but handle_origins serializes every call and export caps per-file via max_facts_per_file with truncation surfaced through file_end.is_truncated. No corpus-wide cap exists in luad, so the claim overstated a root cause the code disagrees with. Reword to an observation whose first acceptance condition is reproducing it across raw luad output and the consumer aggregation to find the responsible layer. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FtirLUpUr9aWq57opQ3WVi
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Plain English
Running luad 0.3.1 over a real OpenWrt-derived firmware corpus turned up two things worth fixing next, so this records them on the roadmap. No code changes.
control-flow-conflict. When luad hits a branch join or a loop, it marks the valuecontrol-flow-conflict, which a downstream tool cannot see through. Where the set of possible values is actually finite, luad should list them (alternatives) instead. The 0.3.1 loop fix made this sharper: it widens loop values tocontrol-flow-conflict, and those are often the neighbours of a value a security pipeline needs. This blocks 99 of 175 unresolved argument origins that reach shell and file sinks.Both items have machine-testable acceptance criteria: a public fixture plus a re-measurement against the private corpus.
Detail
origins.rsanalysis constants; the item points the next maintainer at the export and records/dedup path.ROADMAP.mdbumped in the README doc index.🤖 Generated with Claude Code
https://claude.ai/code/session_01FtirLUpUr9aWq57opQ3WVi