sourcecode 1.63.0__tar.gz → 1.64.0__tar.gz

{sourcecode-1.63.0 → sourcecode-1.64.0}/CHANGELOG.md

@@ -1,5 +1,56 @@
 # Changelog
 
+## [1.64.0] — 2026-06-30
+
+### Fixed — zero false-positive blockers (`migrate-check` / `endpoints`)
+
+A Pro audit of a real enterprise repo (Alfresco Content Services Community, 6,549
+classes) surfaced false blockers that would have invalidated a ~2 person-month
+budget decision. A migration blocker is a high-cost claim: if the tool cannot
+**prove** it from resolved AST/dependency signals, it must not be declared. This
+release enforces that — blockers operate on parsed imports / fully-qualified type
+references, never on a substring inside a comment, Javadoc, string literal, or
+classpath resource path. The `hibernate` sub-`schema_version` is now **2.1**.
+
+- **Phantom Hibernate eliminated.** Hibernate detection now requires real evidence:
+  an `org.hibernate:*` build dependency, a parsed `import org.hibernate.*`, or a
+  parsed `import {jakarta,javax}.persistence.*`. Absent all three →
+  `hibernate.detected = false`, no `hibernate_rewrite` headline, no phantom effort.
+  All scanning runs on source with comments + string/char literals stripped (line
+  numbers preserved), so an `org.hibernate.dialect.*` substring in Javadoc or an
+  iBatis resource path can no longer trigger a verdict. Over-generic Criteria tokens
+  (`Predicate`, `Root<`, `Criterion`, `Conjunction`, `Disjunction`) were dropped —
+  they collide with project-owned domain classes. SPI bare-name matches
+  (`implements XInterceptor`, `extends XEventListener`) now require an
+  `org.hibernate` import in the same file; FQN-anchored SPI matches still count
+  on their own. New `hibernate.evidence{}` records the proof + `confidence`.
+- **MIG-004 / jakarta rules respect a JDK allowlist.** `javax.transaction.xa.*`
+  (the Java SE `java.transaction.xa` module), `javax.annotation.processing.*`,
+  `javax.sql.*`, `javax.xml.parsers/transform/...`, `javax.management.*`,
+  `javax.crypto.*`, and the other permanent JDK/JSR `javax` namespaces no longer
+  count as jakarta-migration findings. App-level `javax.transaction.Transactional`,
+  `javax.annotation.PostConstruct`, etc. are still flagged (true positives kept).
+  Matching is by fully-qualified import prefix, not simple name or partial token.
+- **`readiness_score` no longer sinks on an N/A dimension.** A dimension that does
+  not apply (e.g. Hibernate on a repo with no Hibernate) is reported as N/A
+  (`score: null`), never as 0. New `applicable_dimensions{}` and `readiness_note`
+  make the aggregate's derivation explicit — read the per-dimension breakdown +
+  `blocking_count`, not the single number.
+- **`endpoints` never implies "no API".** When the Spring-MVC surface is empty but
+  another REST framework is present (Alfresco WebScripts via `*.desc.xml` +
+  `AbstractWebScript`/`DeclarativeWebScript`, JAX-RS, or mapped Servlets),
+  `security_model` becomes `"undetermined"` (not `"unknown"`), a
+  `non_spring_rest_surface{}` block is emitted, and a warning states the surface is
+  unmodeled — so `total: 0` is never read as "this app exposes no endpoints".
+
+### Tests
+
+- New `tests/test_falsepositive_fixes.py` — positive **and** negative fixtures per
+  bug (phantom comment-only repo, project-owned `Dialect`/`Criteria`/`Interceptor`
+  classes, `javax.transaction.xa`, WebScripts) alongside the true positives that
+  must be preserved (real Hibernate, `javax.transaction.Transactional`,
+  `@RestController`). Full suite: 2827 passed.
+
 ## [1.63.0] — 2026-06-29
 
 ### Added — actionable Hibernate rewrite targets (`migrate-check`)

{sourcecode-1.63.0 → sourcecode-1.64.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.63.0
+Version: 1.64.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -377,6 +377,8 @@ Extracts all Spring MVC (`@GetMapping`, `@PostMapping`, `@RequestMapping`, etc.)
 
 **Functional / WebFlux routing (honest limitation).** Routes registered via the functional DSL — `route().GET("/path", handler)` / `RouterFunction` / `CustomEndpoint`, common in reactive Spring apps — are **not** modeled (their real paths depend on `nest()`/group-version prefixes that can't be resolved statically). Rather than emit partial paths that would mislead, the output reports a `functional_routing` block (`files`, `route_registrations`, `modeled: false`) plus a warning. When the annotation surface is empty but functional routes exist, the warning explicitly tells you not to read it as "no endpoints". Annotation-based (MVC/JAX-RS) repos are unaffected.
 
+**Non-Spring REST frameworks (never "no API").** When the Spring-MVC surface is empty but the repo exposes REST another way — Alfresco WebScripts (`*.desc.xml` descriptors + classes extending `AbstractWebScript`/`DeclarativeWebScript`), JAX-RS, or mapped Servlets — `security_model` is reported as `"undetermined"` (never `"unknown"`, which downstream reads as "no security"), a `non_spring_rest_surface` block names the detected frameworks, and a warning states the surface is unmodeled. `total: 0` therefore can never be read as "this application exposes no API".
+
 **Custom security annotations.** Enterprise repos often guard endpoints with a bespoke annotation instead of `@PreAuthorize`/`@Secured`. Drop a `sourcecode.config.json` at the repo root to teach the scanner about it — otherwise those endpoints report `policy: "none_detected"`:
 
 ```json
@@ -663,7 +665,17 @@ A Hibernate major upgrade is **not** a single dependency bump for systems that u
 dynamic persistence. `migrate-check` stratifies Hibernate exposure into four
 independent migration domains — never one aggregated score — and emits **actionable,
 machine-readable rewrite targets** so a migration agent can consume the output
-directly instead of re-parsing the repo. Sub-`schema_version`: `2.0`.
+directly instead of re-parsing the repo. Sub-`schema_version`: `2.1`.
+
+> **Evidence-gated (no false blockers).** Hibernate detection requires real proof —
+> an `org.hibernate:*` build dependency, a parsed `import org.hibernate.*`, or a
+> parsed `import {jakarta,javax}.persistence.*`. Absent all three,
+> `hibernate.detected` is `false` (no `hibernate_rewrite` headline, no phantom
+> effort). Scanning runs on source with comments + string/char literals stripped, so
+> an `org.hibernate.*` substring in Javadoc or a classpath resource path never
+> triggers a verdict; bare-name SPI matches (`implements XInterceptor`) require an
+> `org.hibernate` import in the same file. The proof is recorded under
+> `hibernate.evidence{}` with a `confidence`.
 
 **Four layers** (each on its own risk axis):
 
@@ -704,6 +716,12 @@ Hibernate is an orthogonal rewrite axis, so it does not sink the headline
 `readiness_score`; instead, in a rewrite zone the top-level `headline_blocker` is set
 to `"hibernate_rewrite"` so a reader of the headline score is not misled.
 
+A dimension that does not apply (e.g. Hibernate on a repo with no Hibernate) is
+reported as **N/A** (`score: null`), never as `0`. The top-level
+`applicable_dimensions{}` records which dimensions apply and `readiness_note`
+states that `readiness_score` is a derived aggregate over applicable dimensions
+only — for decisions, read the per-dimension breakdown + `blocking_count`.
+
 ```bash
 # inspect only the Hibernate rewrite targets
 sourcecode migrate-check . --format json | jq '.hibernate.rewrite_targets[]'

{sourcecode-1.63.0 → sourcecode-1.64.0}/README.md

@@ -339,6 +339,8 @@ Extracts all Spring MVC (`@GetMapping`, `@PostMapping`, `@RequestMapping`, etc.)
 
 **Functional / WebFlux routing (honest limitation).** Routes registered via the functional DSL — `route().GET("/path", handler)` / `RouterFunction` / `CustomEndpoint`, common in reactive Spring apps — are **not** modeled (their real paths depend on `nest()`/group-version prefixes that can't be resolved statically). Rather than emit partial paths that would mislead, the output reports a `functional_routing` block (`files`, `route_registrations`, `modeled: false`) plus a warning. When the annotation surface is empty but functional routes exist, the warning explicitly tells you not to read it as "no endpoints". Annotation-based (MVC/JAX-RS) repos are unaffected.
 
+**Non-Spring REST frameworks (never "no API").** When the Spring-MVC surface is empty but the repo exposes REST another way — Alfresco WebScripts (`*.desc.xml` descriptors + classes extending `AbstractWebScript`/`DeclarativeWebScript`), JAX-RS, or mapped Servlets — `security_model` is reported as `"undetermined"` (never `"unknown"`, which downstream reads as "no security"), a `non_spring_rest_surface` block names the detected frameworks, and a warning states the surface is unmodeled. `total: 0` therefore can never be read as "this application exposes no API".
+
 **Custom security annotations.** Enterprise repos often guard endpoints with a bespoke annotation instead of `@PreAuthorize`/`@Secured`. Drop a `sourcecode.config.json` at the repo root to teach the scanner about it — otherwise those endpoints report `policy: "none_detected"`:
 
 ```json
@@ -625,7 +627,17 @@ A Hibernate major upgrade is **not** a single dependency bump for systems that u
 dynamic persistence. `migrate-check` stratifies Hibernate exposure into four
 independent migration domains — never one aggregated score — and emits **actionable,
 machine-readable rewrite targets** so a migration agent can consume the output
-directly instead of re-parsing the repo. Sub-`schema_version`: `2.0`.
+directly instead of re-parsing the repo. Sub-`schema_version`: `2.1`.
+
+> **Evidence-gated (no false blockers).** Hibernate detection requires real proof —
+> an `org.hibernate:*` build dependency, a parsed `import org.hibernate.*`, or a
+> parsed `import {jakarta,javax}.persistence.*`. Absent all three,
+> `hibernate.detected` is `false` (no `hibernate_rewrite` headline, no phantom
+> effort). Scanning runs on source with comments + string/char literals stripped, so
+> an `org.hibernate.*` substring in Javadoc or a classpath resource path never
+> triggers a verdict; bare-name SPI matches (`implements XInterceptor`) require an
+> `org.hibernate` import in the same file. The proof is recorded under
+> `hibernate.evidence{}` with a `confidence`.
 
 **Four layers** (each on its own risk axis):
 
@@ -666,6 +678,12 @@ Hibernate is an orthogonal rewrite axis, so it does not sink the headline
 `readiness_score`; instead, in a rewrite zone the top-level `headline_blocker` is set
 to `"hibernate_rewrite"` so a reader of the headline score is not misled.
 
+A dimension that does not apply (e.g. Hibernate on a repo with no Hibernate) is
+reported as **N/A** (`score: null`), never as `0`. The top-level
+`applicable_dimensions{}` records which dimensions apply and `readiness_note`
+states that `readiness_score` is a derived aggregate over applicable dimensions
+only — for decisions, read the per-dimension breakdown + `blocking_count`.
+
 ```bash
 # inspect only the Hibernate rewrite targets
 sourcecode migrate-check . --format json | jq '.hibernate.rewrite_targets[]'

{sourcecode-1.63.0 → sourcecode-1.64.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.63.0"
+version = "1.64.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.63.0 → sourcecode-1.64.0}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.63.0"
+__version__ = "1.64.0"

{sourcecode-1.63.0 → sourcecode-1.64.0}/src/sourcecode/hibernate_strat.py

@@ -36,7 +36,7 @@ from typing import Optional
 
 
 # Sub-schema version for the `hibernate` output section. Bump on shape changes.
-HIBERNATE_SCHEMA_VERSION = "2.0"
+HIBERNATE_SCHEMA_VERSION = "2.1"
 
 
 # ---------------------------------------------------------------------------
@@ -107,14 +107,24 @@ _JPA_DEPRECATED_RE = re.compile(
 )
 
 # Layer 2 — JPA Criteria API + legacy Hibernate Criteria.
+# BUG #1: dropped over-generic tokens (\bPredicate\b, \bRoot\s*<, \bCriterion\b,
+# \bConjunction\b, \bDisjunction\b) that collide with project-owned domain classes
+# (e.g. Alfresco's own query model has Predicate / Conjunction / Disjunction /
+# Criterion classes with NO Hibernate dependency). Real JPA Criteria code always
+# carries CriteriaBuilder / CriteriaQuery, so detection is preserved via those.
 _CRITERIA_JPA_RE = re.compile(
     r"\bCriteriaBuilder\b|\bCriteriaQuery\b|\bCriteriaUpdate\b|"
-    r"\bCriteriaDelete\b|\bRoot\s*<|\bPredicate\b|persistence\.criteria"
+    r"\bCriteriaDelete\b|persistence\.criteria"
 )
+# Legacy Hibernate Criteria. org.hibernate.Criteria / org.hibernate.criterion.*
+# are FQN-anchored (safe). The bare-name tokens (createCriteria, Restrictions,
+# Projections, DetachedCriteria) only count when the file actually imports
+# org.hibernate (see _file_imports_hibernate gate) — they are otherwise common
+# enough to collide with unrelated builder APIs.
 _CRITERIA_LEGACY_RE = re.compile(
-    r"org\.hibernate\.Criteria\b|\.createCriteria\s*\(|\bDetachedCriteria\b|"
-    r"\bRestrictions\.|\bProjections\.|\bCriterion\b|"
-    r"\bConjunction\b|\bDisjunction\b"
+    r"org\.hibernate\.Criteria\b|org\.hibernate\.criterion\b|"
+    r"\.createCriteria\s*\(|\bDetachedCriteria\b|"
+    r"\bRestrictions\.|\bProjections\."
 )
 
 # Layer 3 — HQL / native string queries. createQuery requires a string literal so
@@ -131,20 +141,118 @@ _HQL_CONCAT_RE = re.compile(
 )
 
 # Layer 4 — Hibernate SPI / internal API (CRITICAL blocker).
-_SPI_RE = re.compile(
-    r"\b(?:implements|extends)\s+\w*(?:UserType|CompositeUserType|UserCollectionType)\b|"
-    r"\bimplements\s+\w*UserType\b|"
+# BUG #1: split into FQN-anchored matches (proof of Hibernate origin — always
+# counted) and bare-name matches (e.g. `implements XInterceptor`, `extends
+# XEventListener`) that collide with project-owned AOP interceptors / event
+# listeners. Bare-name matches only count when the file actually imports
+# org.hibernate (see _file_imports_hibernate gate).
+_SPI_FQN_RE = re.compile(
     r"\borg\.hibernate\.(?:type|engine|internal|persister|metamodel|"
-    r"boot\.spi|boot\.internal|event|tuple|property\.access|loader|sql\.ast)\b|"
+    r"boot\.spi|boot\.internal|event|tuple|property\.access|loader|sql\.ast|"
+    r"usertype)\b|"
     r"\bEmptyInterceptor\b|"
+    r"\bSessionFactoryImpl\b|\bSessionImplementor\b|"
+    r"\bSharedSessionContractImplementor\b"
+)
+_SPI_SIMPLE_RE = re.compile(
+    r"\b(?:implements|extends)\s+\w*(?:UserType|CompositeUserType|UserCollectionType)\b|"
     r"\bimplements\s+\w*Interceptor\b|"
     r"\b(?:implements|extends)\s+\w*EventListener\b|"
-    r"\bSessionFactoryImpl\b|\bSessionImplementor\b|"
-    r"\bSharedSessionContractImplementor\b|"
     r"\bsetPropertyAccessStrategy\b|\bPropertyAccessStrategy\b|"
     r"\bImplicitNamingStrategy\b|\bPhysicalNamingStrategy\b"
 )
 
+# ---------------------------------------------------------------------------
+# BUG #1 — comment/string stripping + real-import & dependency evidence
+# ---------------------------------------------------------------------------
+#
+# A Hibernate 5→6 verdict is a high-cost blocker. It must be PROVEN from resolved
+# AST signals, never from a substring inside a comment, Javadoc, string literal,
+# or classpath resource path. Two guards enforce this:
+#   1. _strip_comments_strings() — all pattern scanning runs on code with comments
+#      and string/char literal CONTENT removed (quotes/newlines preserved so line
+#      numbers and call-shape tokens survive).
+#   2. _collect_hibernate_evidence() — detection only proceeds when there is real
+#      evidence: an org.hibernate:* build dependency, a parsed `import org.hibernate.*`,
+#      or a parsed `import {jakarta,javax}.persistence.*` (JPA provider in play).
+
+_JAVA_TOKEN_RE = re.compile(
+    r"(//[^\n]*)"                       # line comment
+    r"|(/\*.*?\*/)"                     # block comment
+    r"|(\"(?:\\.|[^\"\\\n])*\")"        # string literal
+    r"|('(?:\\.|[^'\\\n])*')",          # char literal
+    re.DOTALL,
+)
+
+
+def _strip_comments_strings(src: str) -> str:
+    """Remove comment and string/char-literal CONTENT, preserving line count.
+
+    Line comments are blanked in place (the trailing newline is outside the match,
+    so line numbers are unaffected). Block comments are replaced by an equal number
+    of newlines. String/char literals collapse to empty `""` / `''` tokens so that
+    call-shape detection (e.g. createQuery("...")) and concatenation (`"" + x`) still
+    match, but no pattern can match a substring that lived inside a literal.
+    """
+    def _repl(m: re.Match) -> str:
+        if m.group(1) is not None:
+            return ""
+        if m.group(2) is not None:
+            return "\n" * m.group(2).count("\n")
+        if m.group(3) is not None:
+            return '""'
+        if m.group(4) is not None:
+            return "''"
+        return m.group(0)
+    return _JAVA_TOKEN_RE.sub(_repl, src)
+
+
+# Real `import org.hibernate.*` — anchored to an import statement, not a substring.
+_REAL_HIBERNATE_IMPORT_RE = re.compile(
+    r"^[ \t]*import\s+(?:static\s+)?org\.hibernate\.", re.MULTILINE
+)
+# Real JPA import (jakarta or javax persistence) — a JPA provider is in play.
+_JPA_IMPORT_RE = re.compile(
+    r"^[ \t]*import\s+(?:static\s+)?(?:jakarta|javax)\.persistence\.", re.MULTILINE
+)
+# org.hibernate:* coordinate in a Maven/Gradle build descriptor.
+_HIBERNATE_DEP_RE = re.compile(
+    r"<groupId>\s*org\.hibernate(?:\.orm)?\s*</groupId>"
+    r"|['\"]org\.hibernate(?:\.orm)?:",
+    re.IGNORECASE,
+)
+_BUILD_FILE_NAMES: tuple[str, ...] = ("pom.xml", "build.gradle", "build.gradle.kts")
+_SKIP_BUILD_SCAN_DIRS: frozenset[str] = frozenset(
+    {"target", "build", ".git", ".gradle", "node_modules", "__pycache__", "out", "dist", "bin"}
+)
+
+
+def _file_imports_hibernate(stripped_source: str) -> bool:
+    return bool(_REAL_HIBERNATE_IMPORT_RE.search(stripped_source))
+
+
+def _scan_build_dependency(root: Path) -> tuple[bool, list[str]]:
+    """Return (org.hibernate dependency present, sample coordinate strings)."""
+    import os
+    samples: list[str] = []
+    found = False
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in _SKIP_BUILD_SCAN_DIRS]
+        for fname in filenames:
+            if fname not in _BUILD_FILE_NAMES:
+                continue
+            try:
+                text = (Path(dirpath) / fname).read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                continue
+            text = _strip_comments_strings(text) if fname.endswith((".gradle", ".kts")) else text
+            for m in _HIBERNATE_DEP_RE.finditer(text):
+                found = True
+                snippet = m.group(0).strip()
+                if snippet not in samples and len(samples) < 5:
+                    samples.append(snippet)
+    return found, samples
+
 # Escalation markers — dynamic / reflection-based persistence construction.
 _ABSTRACTION_CLASS_RE = re.compile(
     r"\b(DynamicEntityDao|DynamicEntityDaoImpl|BasicPersistenceModule|"
@@ -294,11 +402,16 @@ class HibernateStratification:
     total_effort_range_days: dict = field(default_factory=dict)
     effort_model: dict = field(default_factory=dict)
     findings: list[HibernateFinding] = field(default_factory=list)
+    # BUG #1: auditable proof behind the detected verdict. confidence is "high"
+    # when backed by a build dependency or a parsed org.hibernate import, "none"
+    # when detection was vetoed for lack of evidence.
+    evidence: dict = field(default_factory=dict)
 
     def to_dict(self) -> dict:
         return {
             "schema_version": HIBERNATE_SCHEMA_VERSION,
             "detected": self.detected,
+            "evidence": self.evidence,
             "classification": self.classification,
             "classification_label": self.classification_label,
             "stratified": True,
@@ -607,15 +720,71 @@ def analyze_hibernate(file_paths: list[str], root: Path) -> HibernateStratificat
     concat_query_global = False
     incompatible: set[str] = set()
 
+    # ── BUG #1: evidence gate ───────────────────────────────────────────────
+    # Pre-read each Java source ONCE, strip comments + string/char literals, and
+    # record real-import evidence. Detection only proceeds when there is genuine
+    # proof of Hibernate/JPA — never a substring inside a comment or a classpath
+    # resource path (e.g. Alfresco's "org.hibernate.dialect.MySQLInnoDBDialect"
+    # appears only in Javadoc + iBatis resource directory names).
+    parsed: list[tuple[str, str, bool]] = []  # (rel_path, stripped_source, imports_hibernate)
+    any_hibernate_import = False
+    any_jpa_import = False
+    hibernate_import_sample: Optional[str] = None
     for rel_path in sorted(file_paths):
         if not rel_path.endswith(".java"):
             continue
         abs_path = root / rel_path
         try:
-            source = abs_path.read_text(encoding="utf-8", errors="replace")
+            raw = abs_path.read_text(encoding="utf-8", errors="replace")
         except OSError:
             continue
+        source = _strip_comments_strings(raw)
+        imports_hib = _file_imports_hibernate(source)
+        if imports_hib:
+            any_hibernate_import = True
+            if hibernate_import_sample is None:
+                hm = _REAL_HIBERNATE_IMPORT_RE.search(source)
+                # capture the full import line for the evidence record
+                line = source[hm.start():].split("\n", 1)[0].strip().rstrip(";")
+                hibernate_import_sample = line
+        if _JPA_IMPORT_RE.search(source):
+            any_jpa_import = True
+        parsed.append((rel_path, source, imports_hib))
+
+    # No Java sources → nothing to stratify; skip the (potentially large) build walk.
+    if not parsed:
+        strat = HibernateStratification()
+        strat.detected = False
+        strat.classification = CLASS_NONE
+        strat.classification_label = _CLASS_LABELS[CLASS_NONE]
+        strat.evidence = {"dependency_present": False, "dependency_coordinates": [],
+                          "hibernate_import_present": False, "hibernate_import_sample": None,
+                          "jpa_import_present": False, "confidence": "none"}
+        return strat
+
+    dep_present, dep_samples = _scan_build_dependency(root)
 
+    has_evidence = dep_present or any_hibernate_import or any_jpa_import
+    evidence: dict = {
+        "dependency_present": dep_present,
+        "dependency_coordinates": dep_samples,
+        "hibernate_import_present": any_hibernate_import,
+        "hibernate_import_sample": hibernate_import_sample,
+        "jpa_import_present": any_jpa_import,
+        "confidence": "high" if has_evidence else "none",
+    }
+
+    if not has_evidence:
+        # No resolved Hibernate/JPA evidence → never a blocker. Any org.hibernate
+        # substring lives in comments/strings/classpath paths only.
+        strat = HibernateStratification()
+        strat.detected = False
+        strat.classification = CLASS_NONE
+        strat.classification_label = _CLASS_LABELS[CLASS_NONE]
+        strat.evidence = evidence
+        return strat
+
+    for rel_path, source, file_imports_hib in parsed:
         nl = _line_index(source)
         src_lines = source.split("\n")
         classes, methods = _index_symbols(source, nl)
@@ -736,7 +905,16 @@ def analyze_hibernate(file_paths: list[str], root: Path) -> HibernateStratificat
                                  "Hibernate 6 HQL parser changes")
 
         # ── Layer 4: Hibernate SPI / internal ──────────────────────────────
-        spi_matches = list(_SPI_RE.finditer(source))
+        # FQN-anchored SPI matches are proof on their own. Bare-name matches
+        # (`implements XInterceptor`, `extends XEventListener`) only count when
+        # the file actually imports org.hibernate — otherwise they are the
+        # project's own AOP interceptors / event listeners (BUG #1).
+        spi_matches = list(_SPI_FQN_RE.finditer(source))
+        if file_imports_hib:
+            spi_matches = sorted(
+                spi_matches + list(_SPI_SIMPLE_RE.finditer(source)),
+                key=lambda m: m.start(),
+            )
         if spi_matches:
             spi_global = True
             mod["has_spi"] = True
@@ -780,6 +958,7 @@ def analyze_hibernate(file_paths: list[str], root: Path) -> HibernateStratificat
 
     strat = HibernateStratification()
     strat.findings = findings
+    strat.evidence = evidence
     strat.rewrite_targets = sorted(
         targets, key=lambda t: (t.source_file, t.line_start, t.layer, t.id)
     )
@@ -789,6 +968,8 @@ def analyze_hibernate(file_paths: list[str], root: Path) -> HibernateStratificat
     )[:25]
 
     if not findings:
+        # Evidence existed (dependency/import) but no concrete migration pattern
+        # fired — Hibernate present yet nothing in the rewrite/upgrade surface.
         strat.detected = False
         strat.classification = CLASS_NONE
         strat.classification_label = _CLASS_LABELS[CLASS_NONE]

{sourcecode-1.63.0 → sourcecode-1.64.0}/src/sourcecode/migrate_check.py

@@ -541,6 +541,47 @@ _ALL_RULES: list[_Rule] = (
 
 SEVERITY_ORDER: dict[str, int] = {"critical": 0, "high": 1, "medium": 2, "low": 3}
 
+# BUG #2 — javax.* packages that are JDK / permanent JSR namespaces and do NOT
+# migrate to jakarta. A jakarta-migration rule matching `javax.transaction` or
+# `javax.annotation` must NOT fire on these FQN prefixes (e.g. javax.transaction.xa
+# is the Java SE java.transaction.xa module; javax.annotation.processing is the
+# annotation-processing API). The allowlist is keyed on fully-qualified import
+# prefixes, never on simple class names or partial tokens.
+_JAKARTA_NO_MIGRATE_PREFIXES: tuple[str, ...] = (
+    "javax.transaction.xa.",
+    "javax.annotation.processing.",
+    "javax.xml.parsers.",
+    "javax.xml.transform.",
+    "javax.xml.xpath.",
+    "javax.xml.stream.",
+    "javax.xml.datatype.",
+    "javax.xml.namespace.",
+    "javax.xml.validation.",
+    "javax.xml.catalog.",
+    "javax.xml.crypto.",
+    "javax.sql.",
+    "javax.management.",
+    "javax.naming.",
+    "javax.crypto.",
+    "javax.net.",
+    "javax.security.auth.",
+    "javax.security.cert.",
+    "javax.security.sasl.",
+    "javax.cache.",
+    "javax.tools.",
+    "javax.imageio.",
+    "javax.sound.",
+    "javax.print.",
+    "javax.accessibility.",
+    "javax.swing.",
+    "javax.lang.model.",
+)
+
+
+def _is_no_migrate_javax(fqn: str) -> bool:
+    """True if a javax FQN belongs to a JDK/permanent namespace (no jakarta move)."""
+    return any(fqn.startswith(p) for p in _JAKARTA_NO_MIGRATE_PREFIXES)
+
 # G-1: cap on total readiness deduction from low-severity (advisory, non-blocking)
 # findings, so optional modernization cleanups cannot collapse the migration-readiness
 # headline on a repo with zero blockers. See MigrationReport.finalize.
@@ -1061,6 +1102,11 @@ class MigrationReport:
     # Names the dominant blocker class when one dimension dwarfs the headline
     # score (e.g. "hibernate_rewrite") so a reader of readiness_score is not misled.
     headline_blocker: Optional[str] = None
+    # BUG #3: which readiness dimensions actually APPLY to this repo. A dimension
+    # that does not apply (e.g. hibernate on a repo with no Hibernate) is N/A and
+    # is excluded from the aggregate — it is never counted as 0. Maps dimension →
+    # {"applicable": bool, "score": int|None, "reason": str}.
+    applicable_dimensions: dict = field(default_factory=dict)
     blocking_count: int = 0
     estimated_effort_days: float = 0.0
     # Tri-state: True = Boot 2 confirmed, False = Boot 3+ confirmed,
@@ -1142,11 +1188,32 @@ class MigrationReport:
         # Hibernate is its own rewrite axis (orthogonal to jakarta/Boot3); it does
         # NOT sink the headline readiness_score, but is surfaced as a dimension and,
         # in a rewrite zone, as the headline_blocker so 62/100 is not read as "easy".
-        if self.hibernate is not None and self.hibernate.detected:
+        _hibernate_applies = self.hibernate is not None and self.hibernate.detected
+        if _hibernate_applies:
             self.hibernate_readiness = self.hibernate.readiness
             if self.hibernate.classification == "rewrite_zone":
                 self.headline_blocker = "hibernate_rewrite"
 
+        # BUG #3: declare which dimensions apply. jakarta/boot3/jdk are always
+        # applicable to a Java/Spring repo; hibernate applies only when a real
+        # Hibernate dependency/import was found. An inapplicable dimension is N/A
+        # (score=None) and is excluded from the aggregate — never scored as 0.
+        self.applicable_dimensions = {
+            "jakarta": {"applicable": True, "score": self.jakarta_readiness,
+                        "reason": "javax→jakarta namespace migration"},
+            "boot3": {"applicable": True, "score": self.boot3_readiness,
+                      "reason": "Spring Boot 2→3 / Security 6 migration"},
+            "jdk_modernization": {"applicable": True, "score": self.jdk_modernization,
+                                  "reason": "orthogonal JDK modernization debt"},
+            "hibernate": {
+                "applicable": _hibernate_applies,
+                "score": self.hibernate_readiness if _hibernate_applies else None,
+                "reason": ("Hibernate 5→6 rewrite axis"
+                           if _hibernate_applies
+                           else "N/A — no Hibernate dependency or import detected"),
+            },
+        }
+
         self.estimated_effort_days = round(
             len(critical_files) * 0.5
             + len(high_files) * 0.25
@@ -1175,6 +1242,12 @@ class MigrationReport:
             "boot3_readiness": self.boot3_readiness,
             "jdk_modernization": self.jdk_modernization,
             "hibernate_readiness": self.hibernate_readiness,
+            "applicable_dimensions": self.applicable_dimensions,
+            "readiness_note": (
+                "readiness_score is a DERIVED aggregate over applicable dimensions only "
+                "(N/A dimensions excluded, never counted as 0). For migration decisions read "
+                "the per-dimension breakdown + blocking_count, not the single number."
+            ),
             "headline_blocker": self.headline_blocker,
             "blocking_count": self.blocking_count,
             "estimated_effort_days": self.estimated_effort_days,
@@ -1256,6 +1329,11 @@ def _scan_file(
 
         if rule.import_pattern is not None:
             matches = list(rule.import_pattern.finditer(source))
+            # BUG #2: for jakarta-migration rules, drop imports whose FQN belongs
+            # to a JDK/permanent javax namespace (javax.transaction.xa.*,
+            # javax.annotation.processing.*, ...). These do NOT migrate to jakarta.
+            if matches and rule.migration_target == "jakarta":
+                matches = [m for m in matches if not _is_no_migrate_javax(m.group(1).strip())]
             if matches:
                 import_first_line = source[: matches[0].start()].count("\n") + 1
                 matched_imports = [m.group(1) for m in matches]

{sourcecode-1.63.0 → sourcecode-1.64.0}/src/sourcecode/repository_ir.py

@@ -4011,6 +4011,18 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     _fn_route_files: set[str] = set()
     _fn_route_count = 0
 
+    # BUG #4: detect REST surfaces exposed by NON-Spring-MVC frameworks. These are
+    # NOT modeled by the annotation surface, so when the Spring surface is empty we
+    # must still tell the consumer "REST present, just not Spring-annotated" rather
+    # than let them infer "no API". Signal counts per framework.
+    _WEBSCRIPT_RE = _re.compile(
+        r"\bextends\s+\w*(?:AbstractWebScript|DeclarativeWebScript)\b"
+        r"|org\.springframework\.extensions\.webscripts"
+    )
+    _JAXRS_PATH_RE = _re.compile(r"^[ \t]*import\s+(?:jakarta|javax)\.ws\.rs\.", _re.MULTILINE)
+    _SERVLET_RE = _re.compile(r"\bextends\s+\w*HttpServlet\b")
+    _nonspring: dict[str, int] = {"webscripts": 0, "jax_rs": 0, "servlets": 0}
+
     for jf in java_files:
         try:
             source = jf.read_text(encoding="utf-8", errors="replace")
@@ -4025,6 +4037,12 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
             if _fn_hits:
                 _fn_route_files.add(rel)
                 _fn_route_count += _fn_hits
+        if _WEBSCRIPT_RE.search(source):
+            _nonspring["webscripts"] += 1
+        if _JAXRS_PATH_RE.search(source) and "@Path" in source:
+            _nonspring["jax_rs"] += 1
+        if _SERVLET_RE.search(source):
+            _nonspring["servlets"] += 1
         _, symbols, _ = _extract_symbols(source, rel, extra_capture=_extra_capture)
         for sym in symbols:
             all_symbols.append(sym)
@@ -4253,6 +4271,58 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
                 "do NOT read it as 'no endpoints'; the app's HTTP surface is unmodeled."
             )
         result.setdefault("warnings", []).append(_fr_msg)
+
+    # BUG #4: non-Spring-MVC REST frameworks. Count Alfresco WebScript descriptors
+    # (*.desc.xml: <url>/<authentication>/<transaction>) in addition to the Java
+    # signals gathered above.
+    _webscript_descriptors = 0
+    for _df in root.rglob("*.desc.xml"):
+        if "target/" in str(_df).replace("\\", "/"):
+            continue
+        try:
+            _dt = _df.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        if "<url>" in _dt or "<webscript" in _dt:
+            _webscript_descriptors += 1
+    if _webscript_descriptors:
+        _nonspring["webscripts"] += _webscript_descriptors
+
+    _nonspring_total = sum(_nonspring.values())
+    if _nonspring_total:
+        _frameworks = [k for k, v in _nonspring.items() if v]
+        result["non_spring_rest_surface"] = {
+            "detected": True,
+            "frameworks": {k: v for k, v in _nonspring.items() if v},
+            "webscript_descriptors": _webscript_descriptors,
+            "modeled": False,
+        }
+        _fw_names = {
+            "webscripts": "Alfresco WebScripts",
+            "jax_rs": "JAX-RS",
+            "servlets": "mapped Servlets",
+        }
+        _fw_label = ", ".join(_fw_names[f] for f in _frameworks)
+        # When the Spring surface is empty, the security model is genuinely
+        # UNDETERMINED — never "unknown" (which downstream reads as "no security")
+        # and never let "total: 0" be read as "no API".
+        if not endpoints:
+            if security_model in ("unknown", "xml_or_filter_chain"):
+                security_model = "undetermined"
+                result["security_model"] = security_model
+            _msg = (
+                f"REST surface present but NOT Spring-MVC-annotated: detected {_fw_label}. "
+                f"Static endpoint extraction is not supported for these frameworks, so this "
+                f"surface is EMPTY — do NOT read 'total: 0' as 'this app exposes no API'. "
+                f"security_model is 'undetermined', not 'unsecured'."
+            )
+        else:
+            _msg = (
+                f"Additional REST surface present outside Spring MVC: detected {_fw_label}. "
+                f"These endpoints are NOT modeled here; the count covers Spring-MVC-annotated "
+                f"endpoints only."
+            )
+        result.setdefault("warnings", []).append(_msg)
     return result