sourcecode 1.31.20__tar.gz → 1.31.21__tar.gz

sourcecode-1.31.21/.continue-here.md

@@ -0,0 +1,87 @@
+# Handoff — sesión 22
+**Date:** 2026-05-25T09:10:25Z  
+**Branch:** master  
+**Last commit:** `f1e80b6 feat(cache): introduce two-layer cache (L1 core + L2 view)`  
+**Suite:** 1510 passed, 3 skipped — all green
+
+---
+
+## What was done this session
+
+### Credibility audit (`AUDIT_REAL_REPOS.md`)
+Full adversarial audit of `sourcecode` against Keycloak (7885 Java files) and BroadleafCommerce (2985 Java files). Findings logged in `AUDIT_REAL_REPOS.md` at repo root. Key bugs fixed in prior sessions (P0-01 Spring DI bridging, P0-02 repo-ir boundedness).
+
+### Two-layer cache architecture (this session)
+
+**Problem:** cache key was `(commit, ALL_flags)` → N flag combos × M commits = N×M full snapshots. Same commit with `--compact` vs `--agent` ran the full analysis pipeline twice.
+
+**Solution implemented:**
+- **L1 core** `core-<sha>-<analysis_hash>.json.gz` → pre-computed view data, keyed by analysis-affecting flags only
+- **L2 view** `view-<core_hash16>-<view_hash>.json.gz` → rendered string, keyed by view-affecting flags  
+- Lookup: L2 hit → L1 hit + view rebuild → full analysis (skip analysis on L1 hit)
+
+**Files changed:**
+| File | What |
+|------|------|
+| `src/sourcecode/serializer.py` | Added `core_view(sm)` + `build_view_from_core()` + `CORE_VIEW_VERSION` |
+| `src/sourcecode/cache.py` | Added `read_core/write_core`, `read_view/write_view`, `_gc_views()`, updated `_gc()` |
+| `src/sourcecode/cli.py` | Replaced single-key cache block with 2-layer lookup + write; split flags into core vs view |
+| `tests/test_cache.py` | +12 new tests: TestCoreCache, TestViewCache, TestGCLayered (44 total cache tests) |
+
+**Flag split:**
+- Core (analysis): `dep/gm/docs/fm/sem/arch/gc/em/cn/mode/exclude/depth` + version
+- View (presentation): `compact/agent/format/full/no_tree/tree/rank_by/symbol/entrypoints_only/no_redact/graph_detail/docs_depth/max_nodes/graph_edges/max_importers/emit_graph`
+
+---
+
+## Current state
+
+Working tree is **clean** — everything committed.
+
+GSD state: milestone v1.0, 13 phases all complete (100%). No pending todos in `.planning/STATE.md`.
+
+Outstanding work from `AUDIT_REAL_REPOS.md` (NOT yet implemented — only audit findings logged):
+
+### P1 remaining (from audit):
+- **BUG-P1-01** Risk score inconsistency: `OrderServiceImpl` 0 callers → risk_level: low vs `OrderDaoImpl` 0 callers → risk_level: high. Same root cause, different heuristics fire.
+- **BUG-P1-02** `project_summary` copies README blurb instead of generating from code structure
+- **BUG-P1-03** `fix-bug` returns 426 relevant files for generic NPE symptom — no score field, no cap
+- **BUG-P1-04** `indirect_callers: 0` for KeycloakSession (1992 direct callers) — BFS exhausts at level 1
+
+### P2 remaining:
+- BUG-P2-01 `bounded_contexts` detection wrong (uses utility packages, not Maven modules)
+- BUG-P2-02 `role: unknown` for all modernize high_coupling_nodes
+- BUG-P2-03 `no_security_signal` always 100% for filter-based security (JAX-RS/XML)
+- BUG-P2-04 JAX-RS sub-resource paths not composed with parent `@Path`
+- BUG-P2-05 Broadleaf admin paths mixed into REST endpoints
+- BUG-P2-06 Architecture confidence inconsistent between `--compact` and `--agent`
+- BUG-P2-07 `entry_points.controllers.methods: 21` vs endpoints finding 130 (unexplained gap)
+- BUG-P2-08 `--format`/`--no-cache` inconsistently available across subcommands
+
+### Cosmetic:
+- Code notes URLs truncated (`s.webkit.org/...`)
+- `truncated: None` vs `truncated: false` inconsistency
+- `--deep` flag referenced in output but absent from `--help`
+- `--compact --help` claims 1000-3000 tokens; measured 2856-4031
+
+---
+
+## Next session: where to start
+
+**Option A** — tackle P1 bugs from audit (highest credibility impact):
+1. P1-01: risk score consistency when direct_callers=0 (Spring impl detection)
+2. P1-02: `project_summary` generation from code structure not README
+
+**Option B** — write integration tests for 2-layer cache (verify cli.py actually hits L1 on second run with different view flags)
+
+**Option C** — version bump + changelog (v1.32.0) with 2-layer cache as headline
+
+**Recommended: Option A → P1-01 first** (user-visible correctness, shortest fix).
+
+---
+
+## Resume
+
+```
+cat .continue-here.md
+```

{sourcecode-1.31.20 → sourcecode-1.31.21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.31.20
+Version: 1.31.21
 Summary: Deterministic codebase context for AI coding agents
 License:                                  Apache License
                                    Version 2.0, January 2004
@@ -225,7 +225,7 @@ Description-Content-Type: text/markdown
 
 **AI-ready change intelligence for Java/Spring enterprise monoliths.**
 
-![Version](https://img.shields.io/badge/version-1.31.20-blue)
+![Version](https://img.shields.io/badge/version-1.31.21-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -263,7 +263,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.31.20
+# sourcecode 1.31.21
 ```
 
 ---

{sourcecode-1.31.20 → sourcecode-1.31.21}/README.md

@@ -2,7 +2,7 @@
 
 **AI-ready change intelligence for Java/Spring enterprise monoliths.**
 
-![Version](https://img.shields.io/badge/version-1.31.20-blue)
+![Version](https://img.shields.io/badge/version-1.31.21-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -40,7 +40,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.31.20
+# sourcecode 1.31.21
 ```
 
 ---

{sourcecode-1.31.20 → sourcecode-1.31.21}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.31.20"
+version = "1.31.21"
 description = "Deterministic codebase context for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.31.20 → sourcecode-1.31.21}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.31.20"
+__version__ = "1.31.21"

{sourcecode-1.31.20 → sourcecode-1.31.21}/src/sourcecode/cli.py

@@ -1776,8 +1776,21 @@ def main(
         if changed_only and _allowed_changed_files:
             # GAP-5: preserve full entry_points for architecture context even in
             # --changed-only mode. Only filter file_paths and code_notes.
+            # ALWAYS-INCLUDE: security-const files must stay in file_paths even when
+            # not in the git diff — they resolve Java constant references used in
+            # @M3FiltroSeguridad annotations (read-only anchors, not diff output).
+            def _is_always_include_ref(p: str) -> bool:
+                name = p.rsplit("/", 1)[-1].rsplit("\\", 1)[-1]
+                if name.endswith("Const.java") or name.endswith("Constants.java"):
+                    return True
+                parts = p.replace("\\", "/").lower().split("/")
+                return any(seg in ("security", "seguridad", "constantes") for seg in parts)
+
             sm = _replace(sm,
-                file_paths=[p for p in sm.file_paths if p in _allowed_changed_files],
+                file_paths=[
+                    p for p in sm.file_paths
+                    if p in _allowed_changed_files or _is_always_include_ref(p)
+                ],
                 code_notes=[n for n in sm.code_notes if n.path in _allowed_changed_files],
             )
         data = compact_view(sm, no_tree=no_tree, full=full)

{sourcecode-1.31.20 → sourcecode-1.31.21}/src/sourcecode/contract_pipeline.py

@@ -242,7 +242,27 @@ class ContractPipeline:
         ]
 
         if changed_only:
-            src_paths = [p for p in src_paths if p in changed_files]
+            def _is_always_include_ref(p: str) -> bool:
+                """Always include security-const files regardless of diff status.
+
+                These are read-only reference anchors: they resolve Java constant
+                references (e.g. SeguridadRecursosConst.REC_X) used in security
+                annotations.  They do NOT appear in diff output because
+                contract.is_changed is set from ``changed_files`` only (line below).
+                Criteria per bug-spec:
+                  - name ends with Const.java or Constants.java
+                  - any path segment is: security | seguridad | constantes
+                """
+                name = p.rsplit("/", 1)[-1].rsplit("\\", 1)[-1]
+                if name.endswith("Const.java") or name.endswith("Constants.java"):
+                    return True
+                parts = p.replace("\\", "/").lower().split("/")
+                return any(seg in ("security", "seguridad", "constantes") for seg in parts)
+
+            src_paths = [
+                p for p in src_paths
+                if p in changed_files or _is_always_include_ref(p)
+            ]
 
         # Apply max_files cap — bypass when symbol search to ensure defining files are found.
         # A symbol query over a large repo needs all files; result set is small after filtering.

{sourcecode-1.31.20 → sourcecode-1.31.21}/src/sourcecode/mcp/server.py

@@ -10,10 +10,12 @@ data is the parsed JSON object from the CLI output, not a shell string.
 """
 from __future__ import annotations
 
+import json
 import os
 from typing import Any
 
 from mcp.server.fastmcp import FastMCP
+from mcp.types import CallToolResult, TextContent
 
 from sourcecode import __version__ as _sourcecode_version
 from sourcecode.mcp.runner import run_command
@@ -30,15 +32,35 @@ def _ok(data: Any) -> dict:
     return {"success": True, "data": data, "error": None}
 
 
-def _err(message: str, code: str = "EXECUTION_FAILED") -> dict:
-    return {"success": False, "data": None, "error": {"code": code, "message": message}}
+def _err(message: str, code: str = "EXECUTION_FAILED") -> CallToolResult:
+    """Return an MCP tool-error result with isError=True per MCP spec §tool-result."""
+    payload = {"success": False, "data": None, "error": {"code": code, "message": message}}
+    return CallToolResult(
+        content=[TextContent(type="text", text=json.dumps(payload))],
+        isError=True,
+    )
 
 
-def _execute(args: list[str]) -> dict:
+def _execute(args: list[str]) -> dict | CallToolResult:
     try:
-        return _ok(run_command(args))
+        result = run_command(args)
     except RuntimeError as exc:
         return _err(str(exc))
+    # If CLI output itself signals failure via success:false, propagate as isError=True
+    if isinstance(result, dict) and result.get("success") is False:
+        payload = {
+            "success": False,
+            "data": None,
+            "error": result.get("error") or {
+                "code": "EXECUTION_FAILED",
+                "message": "Command returned success=false",
+            },
+        }
+        return CallToolResult(
+            content=[TextContent(type="text", text=json.dumps(payload))],
+            isError=True,
+        )
+    return _ok(result)
 
 
 @mcp.tool()

{sourcecode-1.31.20 → sourcecode-1.31.21}/tests/test_bug_fixes_v16.py

@@ -248,3 +248,85 @@ def test_fix_bug_why_field_populated(tmp_path: Path) -> None:
     assert "FIXME" in top.why or "annotation" in top.why, (
         f"Expected FIXME signal in why, got: {top.why!r}"
     )
+
+
+# ---------------------------------------------------------------------------
+# Bug 5 — --changed-only always includes security-const files
+# ---------------------------------------------------------------------------
+
+def test_contract_pipeline_changed_only_always_includes_const_files(tmp_path: Path) -> None:
+    """--changed-only must include *Const.java files regardless of diff status.
+
+    These are read-only reference anchors: included in the analysis to resolve
+    constant references but not marked as is_changed (not part of diff output).
+    """
+    from sourcecode.contract_pipeline import ContractPipeline
+
+    changed = ["src/OrderService.java"]
+    const_file = "src/security/SeguridadRecursosConst.java"
+    all_files = changed + [const_file]
+
+    for f in all_files:
+        p = tmp_path / f
+        p.parent.mkdir(parents=True, exist_ok=True)
+        p.write_text("public class Placeholder {}")
+
+    cp = ContractPipeline(max_files=100)
+    contracts, _ = cp.run(
+        tmp_path,
+        all_files,
+        changed_only=True,
+        allowed_changed_files=set(changed),
+    )
+
+    contract_paths = {c.path for c in contracts}
+    assert const_file in contract_paths, (
+        "Const file must be always-included even when absent from diff"
+    )
+    # Read-only anchor — must NOT be marked as changed
+    const_contract = next(c for c in contracts if c.path == const_file)
+    assert not const_contract.is_changed, "Const file is read-only anchor: is_changed must be False"
+
+
+def test_changed_only_resource_names_unresolved_le5(tmp_path: Path) -> None:
+    """With --changed-only active, resource_names_unresolved must be <= 5.
+
+    The always-include logic ensures *Const.java files remain in file_paths for
+    constant resolution even when they are absent from the git diff.
+    """
+    from sourcecode.serializer import _security_surface_from_eps
+
+    # Create the const file on disk (not in the git diff)
+    const_dir = tmp_path / "src" / "security"
+    const_dir.mkdir(parents=True)
+    (const_dir / "SeguridadRecursosConst.java").write_text(
+        "public class SeguridadRecursosConst {\n"
+        '    public static final String REC_PEDIDOS = "PEDIDOS";\n'
+        '    public static final String REC_USUARIOS = "USUARIOS";\n'
+        '    public static final String REC_FACTURAS = "FACTURAS";\n'
+        "}\n"
+    )
+    rel_const = "src/security/SeguridadRecursosConst.java"
+
+    class _MockEP:
+        def __init__(self, evidence: str) -> None:
+            self.evidence = evidence
+
+    eps = [
+        _MockEP('nombreRecurso="SeguridadRecursosConst.REC_PEDIDOS"'),
+        _MockEP('nombreRecurso="SeguridadRecursosConst.REC_USUARIOS"'),
+        _MockEP('nombreRecurso="SeguridadRecursosConst.REC_FACTURAS"'),
+    ]
+
+    # Baseline (--changed-only WITHOUT always-include): const file absent → unresolved
+    without = _security_surface_from_eps(eps, root=tmp_path, file_paths=[])
+    n_without = len((without or {}).get("resource_names_unresolved", []))
+    assert n_without >= 1, "Baseline: absent const file must produce unresolved names"
+
+    # After fix (always-include): const file in file_paths → resolved
+    with_const = _security_surface_from_eps(eps, root=tmp_path, file_paths=[rel_const])
+    n_with = len((with_const or {}).get("resource_names_unresolved", []))
+    assert n_with <= 5, (
+        f"resource_names_unresolved must be <=5 when const file is always-included, got {n_with}"
+    )
+    assert n_with == 0, f"All 3 constants must resolve, got {n_with} unresolved"

{sourcecode-1.31.20 → sourcecode-1.31.21}/tests/test_mcp_tools.py

@@ -1,19 +1,23 @@
 """Contract tests for sourcecode.mcp.server MCP tools.
 
-All tools must return the canonical output contract:
+Success contract (dict returned, FastMCP wraps with isError=False):
   {"success": bool, "data": dict | str | None, "error": {"code": str, "message": str} | None}
 
-data is the parsed JSON object from the CLI output, not a shell string.
+Failure contract (CallToolResult with isError=True per MCP spec §tool-result):
+  CallToolResult.isError == True
+  CallToolResult.content[0].text == JSON{"success": false, "data": null, "error": {...}}
 
 Requires: pip install sourcecode[mcp]
 """
 import json
+from typing import Any
 from unittest.mock import patch
 
 import pytest
 
 mcp_pkg = pytest.importorskip("mcp", reason="mcp extra not installed — skip MCP tool tests")
 
+from mcp.types import CallToolResult, TextContent  # noqa: E402
 from sourcecode.mcp import server  # noqa: E402 — after importorskip guard
 
 _PARSED_OUTPUT = {"project": {"primary_stack": "python"}}
@@ -30,17 +34,23 @@ def _assert_success(result: dict) -> None:
     json.dumps(result)
 
 
-def _assert_failure(result: dict, expected_code: str | None = None) -> None:
-    assert isinstance(result, dict)
-    assert set(result.keys()) == _SUCCESS_KEYS, f"unexpected keys: {set(result.keys())}"
-    assert result["success"] is False
-    assert result["data"] is None
-    assert isinstance(result["error"], dict)
-    assert "code" in result["error"]
-    assert "message" in result["error"]
+def _assert_failure(result: Any, expected_code: str | None = None) -> None:
+    """Assert tool returned CallToolResult with isError=True per MCP spec §tool-result."""
+    assert isinstance(result, CallToolResult), (
+        f"expected CallToolResult, got {type(result).__name__}"
+    )
+    assert result.isError is True, "isError must be True for tool failures"
+    assert len(result.content) == 1, "failure result must carry exactly one content item"
+    text = result.content[0]
+    assert isinstance(text, TextContent), f"content[0] must be TextContent, got {type(text).__name__}"
+    payload = json.loads(text.text)
+    assert payload["success"] is False
+    assert payload["data"] is None
+    assert isinstance(payload["error"], dict)
+    assert "code" in payload["error"]
+    assert "message" in payload["error"]
     if expected_code:
-        assert result["error"]["code"] == expected_code
-    json.dumps(result)
+        assert payload["error"]["code"] == expected_code
 
 
 # --- get_compact_context ---
@@ -82,7 +92,8 @@ def test_get_compact_context_failure():
     with patch(_RUNNER_PATH, side_effect=RuntimeError("boom")):
         result = server.get_compact_context("/some/repo")
     _assert_failure(result, "EXECUTION_FAILED")
-    assert "boom" in result["error"]["message"]
+    payload = json.loads(result.content[0].text)
+    assert "boom" in payload["error"]["message"]
 
 
 # --- get_agent_context ---
@@ -328,11 +339,32 @@ def test_no_extra_keys_on_success():
 
 
 def test_no_extra_keys_on_failure():
+    """Runtime failures return CallToolResult with isError=True per MCP spec §tool-result."""
     with patch(_RUNNER_PATH, side_effect=RuntimeError("x")):
         r = server.get_compact_context("/p")
-    assert set(r.keys()) == _SUCCESS_KEYS
+    assert isinstance(r, CallToolResult)
+    assert r.isError is True
 
 
 def test_no_extra_keys_on_validation_error():
+    """Validation failures return CallToolResult with isError=True per MCP spec §tool-result."""
     r = server.get_module_context("/p", "")
-    assert set(r.keys()) == _SUCCESS_KEYS
+    assert isinstance(r, CallToolResult)
+    assert r.isError is True
+
+
+def test_get_impact_context_nonexistent_class_returns_is_error():
+    """Tool call with nonexistent class returns isError=True per MCP spec §tool-result.
+
+    When the subprocess exits non-zero (class not found), the MCP response must
+    carry isError=True so AI agents distinguish errors from successful results.
+    """
+    with patch(_RUNNER_PATH, side_effect=RuntimeError("class 'NonExistentClass12345' not found")):
+        result = server.get_impact_context("/some/repo", target="NonExistentClass12345")
+    assert isinstance(result, CallToolResult), (
+        f"expected CallToolResult, got {type(result).__name__}"
+    )
+    assert result.isError is True, "isError must be True when target class does not exist"
+    payload = json.loads(result.content[0].text)
+    assert payload["success"] is False
+    assert "NonExistentClass12345" in payload["error"]["message"]

sourcecode-1.31.20/.continue-here.md

@@ -1,134 +0,0 @@
-# Continue Here — atlas-cli sesión 21
-
-**Paused:** 2026-05-24
-**Repo:** `/Users/user/Documents/workspace/atlas-cli`
-**Branch:** master
-**Version:** sourcecode 1.31.17
-
----
-
-## Objetivo de esta sesión
-
-Continuar corrección de bugs post-auditoría v1.31.16 (adversarial audit contra Keycloak + Broadleaf).
-Sesión 21 atacó los dos P0s. Quedan P1s y P2s.
-
----
-
-## Trabajo completado esta sesión
-
-### P0-01 — `impact OrderServiceImpl` → 0 callers FIXED ✅
-
-**Root cause:** `_build_reverse_adjacency` descartaba edges `implements` cuando `to` era
-nombre corto no-resuelto (`"OrderService"` en vez de FQN). El `reverse_graph["OrderService"]`
-no tenía clave `"implements"` → scan desde reverse side imposible.
-
-**Fix:** Escanear `graph.edges` forward para `type=implements` FROM matched classes.
-Resolver `to` (short/FQN) contra claves de `reverse_graph` via suffix match.
-Callers de la interfaz se añaden a `direct_callers`. Output incluye `via_interface_resolution`
-y `via_interface_note`.
-
-**Resultado:** `impact OrderServiceImpl` en Broadleaf: 0 callers → **74 callers**, risk LOW → **HIGH**.
-
-### P0-02 — `reverse_graph` unbounded por `--max-nodes`/`--max-edges` FIXED ✅
-
-**Root cause:** `apply_ir_size_limits` sólo acotaba `graph.nodes`/`graph.edges`.
-`reverse_graph` emitía 2685 claves (~3MB) aunque se pidieran 200 nodos.
-
-**Fix:** Cuando `max_nodes` activo: restringir `reverse_graph` a `kept_fqns` + cap inner
-caller lists a `max(20, max_nodes//4)`. Cuando sólo `max_edges`: cap a `max_edges` claves
-por in-degree. Añade `reverse_graph_note` cuando trimmed.
-
-**Resultado:** `--max-nodes 200 --max-edges 500`: 3.85MB → **939KB** (76% reducción).
-
-### Commit esta sesión
-
-```
-e5fba19  fix(ir): resolve Spring DI interface bridging and bound reverse_graph
-```
-
----
-
-## Estado archivos sin commitear
-
-```
-?? AUDIT_REAL_REPOS.md          — auditoría 22 secciones (de sesión 20, no tocar)
-?? docs/PRODUCT_TIERS.md        — de sesión anterior (no tocar esta sesión)
-```
-
-Commitear estos docs antes de continuar con fixes:
-```bash
-git add AUDIT_REAL_REPOS.md docs/PRODUCT_TIERS.md
-git commit -m "docs(audit): adversarial audit v1.31.16 — real benchmarks, P0/P1/P2 findings"
-```
-
----
-
-## Bugs pendientes por ROI
-
-### P1 — Altos
-
-| # | Bug | Archivo | Tiempo est. |
-|---|-----|---------|-------------|
-| **P1-01** | Risk score inconsistente para 0-caller impls: `OrderServiceImpl`→low vs `OrderDaoImpl`→high (mismo 0 callers, distinta heurística). POST P0-01 fix: verificar si aún aplica o si interface bridging ya lo resuelve. | `repository_ir.py` → `compute_blast_radius` | 30 min |
-| **P1-02** | `project_summary` = primera línea del README (license/marketing). Debe generarse de código: "N-module Spring Boot — M classes, K endpoints, J txn boundaries" | `serializer.py` o `summarizer.py` | 1h |
-| **P1-03** | `fix-bug` devuelve 426 archivos para NPE genérico (14% repo, sin `score` field) | `prepare_context.py` → `fix_bug` | 30 min |
-| **P1-04** | `indirect_callers:0` para KeycloakSession (1992 direct callers) — BFS para en nivel 1 por hub guard | `repository_ir.py` → `compute_blast_radius` hub guard logic | 45 min |
-| **P1-05** | `fix-bug` 23s cold en Keycloak | profiling needed | ~1h |
-
-### P2 — Medios (batch)
-
-- `bounded_contexts: ["dto","file"]` Broadleaf — WRONG. Fix: usar Maven module names
-- `role: unknown` para todos `high_coupling_nodes` en modernize — nunca clasifica annotation/interface/entity
-- `no_security_signal: 100%` en ambos repos — filter-based security nunca detectado
-- JAX-RS sub-resource paths no compuestos con parent `@Path`
-- `hotspot_candidates: []` siempre — git churn ignorado
-- `--format`/`--no-cache` ausentes en `impact`, `endpoints`, `fix-bug`, `onboard`, `modernize`, `review-pr`
-- Architecture confidence diferente entre `--compact` y `--agent` mismo repo
-
----
-
-## Primera acción al retomar
-
-```bash
-cd /Users/user/Documents/workspace/atlas-cli
-
-# 1. Commitear docs pendientes
-git add AUDIT_REAL_REPOS.md docs/PRODUCT_TIERS.md
-git commit -m "docs(audit): adversarial audit v1.31.16 — Keycloak + Broadleaf findings"
-
-# 2. Verificar si P1-01 aún existe post-fix P0-01:
-sourcecode impact OrderDaoImpl ~/Documents/workspace/BroadleafCommerce 2>&1 | python3 -m json.tool | grep -E 'risk_level|confidence_level|direct_callers|via_interface'
-# Si risk_level sigue siendo inconsistente → fix P1-01
-# Si interface bridging ya lo resuelve → skip a P1-02
-
-# 3. Si P1-01 persiste:
-# En compute_blast_radius: cuando direct_callers=0 Y no hay interface bridging Y
-# clase es @Service/@Repository impl → bajar confidence, añadir gap en explanation
-```
-
----
-
-## Archivos clave del codebase
-
-```
-src/sourcecode/
-  repository_ir.py    — impact analysis, blast radius, interface bridging (P0-01/02 fixeados aquí)
-  prepare_context.py  — fix-bug, onboard, review-pr output (P1-03 aquí)
-  serializer.py       — compact/agent output, project_summary (P1-02 aquí)
-  summarizer.py       — ProjectSummarizer (P1-02 posiblemente aquí)
-  cli.py              — top-level commands, cache logic
-tests/
-  test_enterprise_benchmarks.py
-```
-
----
-
-## Contexto de versiones
-
-- v1.31.16: bugs auditados en sesión 20
-- v1.31.17: versión actual (bumpeada en 0cf28b1 por el usuario)
-- Fixes P0-01/P0-02: commit e5fba19 (sesión 21)
-
----
-
-*Pausado 2026-05-24 — gsd:pause-work (sesión 21)*