Issues

.d.ts declaration-only functions become analysis units and can be seeded as entry points — the TypeScript parser lacks the declaration-vs-definition split the C parser gets right

knostic/OpenAnt#806 · opened

on Oct 14, 2026

A resume's kept-set recomputation silently absorbs the prior run's unfinished work — errored units leave scope instead of retrying, orphaned checkpoints are counted nowhere, and the run reports degraded: false while its own error count falls

knostic/OpenAnt#802 · opened

on Oct 13, 2026

1

The discovery exclusions are per-language and leak for JavaScript — .github is only excluded by Python's hidden-directory rule, and .test.cjs evades the JS test-file skipper (a CI test file reached the paid kept set)

knostic/OpenAnt#801 · opened

on Oct 13, 2026

1

analyze and verify file every error under one hardcoded "api" bucket — a permanent context-overflow 400 is indistinguishable from a transient 402/429

knostic/OpenAnt#800 · opened

on Oct 13, 2026

The human summary states "No steps were skipped" on every --skip-dynamic-test run — the skip is recorded one pipeline step AFTER pipeline_output.json is written

knostic/OpenAnt#799 · opened

on Oct 13, 2026

The cost meter never reads the provider's own cost — OpenRouter returns usage.cost on every response and the unifier drops it; a 220.5M-token phase shipped as $0.00

knostic/OpenAnt#797 · opened

on Oct 13, 2026

cost_incomplete exists in every machine channel but no human-readable surface renders it — the operator-facing cost lines (scan summary, phase reporters, log_usage, the enhancer, the autopatcher tools) print an under-count as fact

knostic/OpenAnt#786 · opened

on Oct 12, 2026

1

The bare-name cross-package fabrication is ungated on the direct method-call paths (resolveMethodCall's fallback fires for b.view() and f := b.view; f() on a func-typed FIELD — filed from #746's review)

knostic/OpenAnt#781 · opened

on Oct 11, 2026

resolveSimpleCall's unqualified-name first-match-wins over map iteration flips //go:build-tagged edges (the #747 sibling class — filed from the #747 cycle's corpus control)

knostic/OpenAnt#777 · opened

on Oct 11, 2026

The Stage-1 verdict vocabulary has no definitions in the prompt and INCONCLUSIVE's disposition contradicts itself across surfaces — manual-review-recommended (docs, HTML legend, remediation) while disclosure-dropped and never Stage-2-verified; a semantics ruling

knostic/OpenAnt#744 · opened

on Sep 25, 2026

1

A SAFE rationale can rest on a factually false claim about the code — the cassandra username template 'strips CQL-special chars' but no transform strips the quote character — and Stage 2 never re-examines SAFE rows

knostic/OpenAnt#743 · opened

on Sep 25, 2026

1

An all-incomplete enhancement phase still rolls up as status success — incomplete_count never derives a step status

knostic/OpenAnt#742 · opened

on Sep 25, 2026

1

Enhance exception-path spend never reaches AgentResult.cost_usd — per-unit costs under-count ~8-10% and the tracker and the report disagree

knostic/OpenAnt#740 · opened

on Sep 25, 2026

1

--limit N selects units by file-walk order, not analysis priority — a limited run silently measures the least interesting code

knostic/OpenAnt#739 · opened

on Sep 25, 2026

--library-mode is not auto-applied (or suggested) when app-context classifies the target as a library — the classification arrives after the filter already pruned the public API

knostic/OpenAnt#738 · opened

on Sep 25, 2026

Stage-1 confidence is a free 0-1 field with no rubric and no decision consumer, yet it ships to the report and CSV as stage1_confidence — across 213 Stage-2-verified findings it barely separates agreed from refuted (AUC 0.57) — define it, consume it, or drop it

knostic/OpenAnt#736 · opened

on Sep 25, 2026

(likely cosmetic) The UNSUPPORTED remedy says 'create a manual OPENANT.md override file' but not what it must contain — and seven near-miss override shapes are skipped silently (only a missing key inside a parsed fence warns)

knostic/OpenAnt#735 · opened

on Sep 25, 2026

Vendored and generated inputs in scan scope: .yarn is absent from all three directory skip lists and no parser recognises generated-code headers — one bundled Yarn binary became 2,410 LR units and 249 Stage-1 units on one run; SwiftPM manifests are a second exhibit (a cost/policy ruling, not a wrong output)

knostic/OpenAnt#734 · opened

on Sep 25, 2026

1

The agent's read_file_section tool reads the whole file before slicing — a 2-line request against a 10 MB file allocates ~30 MB and a FIFO in the scanned tree blocks the enhance step; the bounded reader is not used here

knostic/OpenAnt#731 · opened

on Sep 25, 2026

1

The enhance agent discards all gathered context at the iteration limit — include_functions=[] sends the unit to analysis with no agent-gathered context

knostic/OpenAnt#730 · opened

on Sep 24, 2026

3

Swift lifecycle entry points are LLM-tier-gated with no structural seeding, and the unscoped gets-boundary heuristic over-seeds from comments

knostic/OpenAnt#729 · opened

on Sep 24, 2026

Disclosure generation abandons completed usages and leaks paid workers on one failure; refusal raises omit token usage and a stop-finished OpenAI refusal is misclassified

knostic/OpenAnt#728 · opened

on Sep 24, 2026

Usage history is lost across resume and retry: single-shot enhancement persists no per-unit usage and a verify retry overwrites the prior attempt's record

knostic/OpenAnt#727 · opened

on Sep 24, 2026

1

Status contract inconsistencies: a failed step enters the rank as a skip, app-context lands in both completed and skipped, and the envelope's vulnerable count carries no stage label

knostic/OpenAnt#726 · opened

on Sep 24, 2026

1

Caller/callee dedup can delete every finding in a cycle — removals are computed against the original set with no surviving representative

knostic/OpenAnt#725 · opened

on Sep 24, 2026

Navigation Menu

Repository navigation

Issues

.d.ts declaration-only functions become analysis units and can be seeded as entry points — the TypeScript parser lacks the declaration-vs-definition split the C parser gets right

A resume's kept-set recomputation silently absorbs the prior run's unfinished work — errored units leave scope instead of retrying, orphaned checkpoints are counted nowhere, and the run reports degraded: false while its own error count falls

The discovery exclusions are per-language and leak for JavaScript — .github is only excluded by Python's hidden-directory rule, and .test.cjs evades the JS test-file skipper (a CI test file reached the paid kept set)

analyze and verify file every error under one hardcoded "api" bucket — a permanent context-overflow 400 is indistinguishable from a transient 402/429

The human summary states "No steps were skipped" on every --skip-dynamic-test run — the skip is recorded one pipeline step AFTER pipeline_output.json is written

The cost meter never reads the provider's own cost — OpenRouter returns usage.cost on every response and the unifier drops it; a 220.5M-token phase shipped as $0.00

cost_incomplete exists in every machine channel but no human-readable surface renders it — the operator-facing cost lines (scan summary, phase reporters, log_usage, the enhancer, the autopatcher tools) print an under-count as fact

The bare-name cross-package fabrication is ungated on the direct method-call paths (resolveMethodCall's fallback fires for b.view() and f := b.view; f() on a func-typed FIELD — filed from #746's review)

resolveSimpleCall's unqualified-name first-match-wins over map iteration flips //go:build-tagged edges (the #747 sibling class — filed from the #747 cycle's corpus control)

The Stage-1 verdict vocabulary has no definitions in the prompt and INCONCLUSIVE's disposition contradicts itself across surfaces — manual-review-recommended (docs, HTML legend, remediation) while disclosure-dropped and never Stage-2-verified; a semantics ruling

A SAFE rationale can rest on a factually false claim about the code — the cassandra username template 'strips CQL-special chars' but no transform strips the quote character — and Stage 2 never re-examines SAFE rows

An all-incomplete enhancement phase still rolls up as status success — incomplete_count never derives a step status

Enhance exception-path spend never reaches AgentResult.cost_usd — per-unit costs under-count ~8-10% and the tracker and the report disagree

--limit N selects units by file-walk order, not analysis priority — a limited run silently measures the least interesting code

--library-mode is not auto-applied (or suggested) when app-context classifies the target as a library — the classification arrives after the filter already pruned the public API

Stage-1 confidence is a free 0-1 field with no rubric and no decision consumer, yet it ships to the report and CSV as stage1_confidence — across 213 Stage-2-verified findings it barely separates agreed from refuted (AUC 0.57) — define it, consume it, or drop it

(likely cosmetic) The UNSUPPORTED remedy says 'create a manual OPENANT.md override file' but not what it must contain — and seven near-miss override shapes are skipped silently (only a missing key inside a parsed fence warns)

The agent's read_file_section tool reads the whole file before slicing — a 2-line request against a 10 MB file allocates ~30 MB and a FIFO in the scanned tree blocks the enhance step; the bounded reader is not used here

The enhance agent discards all gathered context at the iteration limit — include_functions=[] sends the unit to analysis with no agent-gathered context

Swift lifecycle entry points are LLM-tier-gated with no structural seeding, and the unscoped gets-boundary heuristic over-seeds from comments

Disclosure generation abandons completed usages and leaks paid workers on one failure; refusal raises omit token usage and a stop-finished OpenAI refusal is misclassified

Usage history is lost across resume and retry: single-shot enhancement persists no per-unit usage and a verify retry overwrites the prior attempt's record

Status contract inconsistencies: a failed step enters the rank as a skip, app-context lands in both completed and skipped, and the envelope's vulnerable count carries no stage label

Caller/callee dedup can delete every finding in a cycle — removals are computed against the original set with no surviving representative