sourcecode 1.65.0__tar.gz → 1.67.0__tar.gz

{sourcecode-1.65.0 → sourcecode-1.67.0}/.gitignore

@@ -36,4 +36,6 @@ Thumbs.db
 .planning
 
 # Supabase local temp
-supabase/.temp/
+supabase/.temp/
+# Internal agent playbook (not distributed)
+docs/PLAYBOOK_V2.md

{sourcecode-1.65.0 → sourcecode-1.67.0}/CHANGELOG.md

@@ -1,5 +1,88 @@
 # Changelog
 
+## [1.67.0] — 2026-06-30
+
+### Fixed — framing accuracy on non-Spring repos (Apache OFBiz field test)
+
+A real audit of **Apache OFBiz** (release18.12, ~326k LOC, own framework + Service
+Engine + widgets, **no Spring**) exposed seven defects where the tool collapsed
+"absence of evidence" into high-confidence false framings — a less-critical LLM
+consumer would have emitted a FALSE report (recommending a non-existent migration).
+Guiding principle applied throughout: **degrade to N/A, never to a manufactured 0 or
+100; declare gaps instead of inventing certainty.** New golden fixture:
+`tests/test_ofbiz_framing_regression.py`.
+
+- **`spring-test` no longer implies runtime Spring (BUG #1/#2).** Spring presence is
+  now scope- and artifact-aware: a test support library (`spring-test`,
+  `spring-boot-*-test`, `spring-security-test`) — even declared under a legacy
+  `compile` block — and test-tree `org.springframework.test` imports are classified
+  `spring_test_only`, never runtime Spring. `migrate-check` reports `spring_present`
+  (runtime) vs `spring_test_only` separately.
+- **No phantom `boot3 0/100` dimension (BUG #3).** The Boot 2→3 axis is `applicable`
+  only with runtime Spring; otherwise it is N/A (`score: null`) and excluded from the
+  aggregate — it can no longer drag the readiness headline to 0.
+- **Applicability gating + N/A readiness (BUG #4).** `jakarta` is applicable only with
+  positive evidence (migratable `javax.*` imports, or the `jakarta.*` namespace already
+  adopted); a repo with no Spring, no migratable `javax.*`, and no Hibernate 5 now
+  reports `readiness_score: null` ("N/A — no migration target detected") instead of a
+  manufactured 100. A valid `javax.servlet` surface is kept and scored on the **Jakarta
+  EE / Tomcat 10** axis, not mislabeled "Spring Boot 3".
+- **`modernize` no longer reports framework-dispatched classes as dead code (BUG #5).**
+  Zero-static-caller classes are renamed `statically_unreferenced` (never a confident
+  "dead zone") and partitioned: classes with a dynamic-entry signature (OFBiz Service
+  Engine `Map<String,Object> name(DispatchContext, Map<…>)`, servlet/event handlers,
+  annotation-dispatched beans) or referenced from XML/SPI/properties config are listed
+  under `framework_dispatched` and excluded.
+- **Gradle dependency parsing fixed for glob strings (BUG #6).** A string-aware comment
+  stripper no longer treats `/*` inside an Ant-style glob (`'**/*.java'`) as a block
+  comment — which had silently eaten OFBiz's entire `dependencies {}` block (0 → 59
+  deps). When a `dependencies {}` block resolves to nothing, a GAP is reported instead
+  of a confident "0 dependencies".
+- **Vendored web assets excluded from code notes (BUG #7).** `is_vendor_path` now flags
+  vendored JS/CSS libraries by file name (`jquery-3.5.1.js`, `bootstrap.bundle.js`, …),
+  so third-party comments are no longer reported as the project's own notes.
+- **Vendor-neutral project-type label (BUG #1, `--compact`).** `web_mvc` (triggered by
+  server-side template engines such as FreeMarker/Thymeleaf) is labeled "Server-side
+  MVC web app", not "Spring MVC web app" — OFBiz now reads "Java server-side mvc web
+  app using FreeMarker" with no false Spring claim.
+
+No-regression: a genuine Spring Boot 2 repo keeps `boot3` applicable and a computed
+readiness; Keycloak/Petclinic golden fixtures still pass.
+
+## [1.66.0] — 2026-06-30
+
+### Fixed — Spring Petclinic (Boot 4.0.3 / Java 17) false positives + aggregate consistency
+
+A Pro audit of the canonical **Spring Petclinic** (Spring Boot 4.0.3, Java 17,
+jakarta namespace 100 %) surfaced three defects. Petclinic is now a golden
+regression fixture (`tests/test_migrate_check_petclinic_regression.py`).
+
+- **`javax.cache` no longer flagged as a jakarta migration risk (BUG #1).** A single
+  source of truth — `_JAVAX_PERMANENT_NAMESPACES` — lists JDK/JSR `javax.*` that keep
+  the `javax.*` prefix forever (`javax.cache` JSR-107, `javax.sql`, `javax.xml` JAXP,
+  `javax.naming`, `javax.management`, `javax.crypto`, `javax.net`, `javax.security.auth`,
+  `javax.annotation.processing`, `javax.tools`, `javax.lang.model`, …). The
+  `javax-to-jakarta-migration-risk` dependency flag now decides via **longest-prefix
+  match** across the renamed list and this allowlist, so `javax.xml.bind` (JAXB —
+  moved) still flags while `javax.xml` (JAXP) does not, and `javax.annotation`
+  (JSR-250 — moved) still flags while `javax.annotation.processing` (JSR-269) does not.
+  The allowlist can never silence a legitimate migration (`javax.persistence`,
+  `javax.servlet`, `javax.validation`, … still flag).
+- **Hibernate axis is version-driven, never a heuristic on absent data (BUG #2).**
+  When the Hibernate version is not declared, it is inferred from the Spring Boot BOM:
+  Boot ≥ 3 → Hibernate ORM ≥ 6 → **N/A** (`status: managed_ge6`); Boot 2 → Hibernate
+  5.x → **applicable** (`status: managed_h5`); no BOM → `status: unresolved`,
+  `applicable: false`, `score: null` — **never** a fabricated number like `91`. The
+  `reason` distinguishes "managed ≥ 6" from "unresolved". (Petclinic: hibernate N/A,
+  `managed_ge6` via Boot 4.0.3, no phantom 91.)
+- **`readiness_score` is now a traceable aggregate (BUG #3).** It is defined as
+  `min` over the applicable **migration** dimensions (`jakarta` / `boot3` / `hibernate`)
+  — `jdk_modernization` is an orthogonal upkeep axis, reported but **excluded** from
+  the headline. The exact inputs are surfaced in a new `readiness_aggregate{}` block,
+  and a consistency invariant (`readiness_score == min(applicable migration dims)`) is
+  asserted in `finalize()` and covered by a unit test. This removes the prior
+  contradiction (headline 100 while an applicable dimension scored 91).
+
 ## [1.65.0] — 2026-06-30
 
 ### Fixed — non-Spring / already-modernized repos no longer fabricate blockers (`migrate-check`)

{sourcecode-1.65.0 → sourcecode-1.67.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.65.0
+Version: 1.67.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -738,9 +738,21 @@ evidence. `migrate-check` enforces:
   usage; Quarkus / Micronaut / Helidon / Jakarta-pure repos report `boot3` as N/A
   (`spring_present: false`), not a contradictory `applicable: true`.
 - **Permanent `javax.*` are never jakarta debt.** JDK/JSR namespaces
-  (`javax.xml.*`, `javax.crypto.*`, `javax.naming.*`, `javax.sql.*`,
-  `javax.management.*`, `javax.security.auth.*`, …) are allowlisted across every
-  jakarta scorer.
+  (`javax.cache`, `javax.sql`, `javax.xml` JAXP, `javax.crypto`, `javax.naming`,
+  `javax.management`, `javax.security.auth`, `javax.annotation.processing`, …) are
+  allowlisted across every jakarta scorer (single source of truth:
+  `serializer._JAVAX_PERMANENT_NAMESPACES` + `migrate_check._JAKARTA_NO_MIGRATE_PREFIXES`).
+  The `javax→jakarta` dependency flag decides via **longest-prefix match**, so
+  `javax.xml.bind` (JAXB — moved) flags while `javax.xml` (JAXP) does not, and
+  `javax.annotation` (JSR-250 — moved) flags while `javax.annotation.processing`
+  (JSR-269) does not. The allowlist never silences a real migration.
+- **`readiness_score` is a traceable aggregate.** It is `min` over the applicable
+  **migration** dimensions (`jakarta` / `boot3` / `hibernate`); `jdk_modernization`
+  is orthogonal upkeep and is excluded. The exact inputs are in `readiness_aggregate{}`
+  and an invariant (`readiness_score == min(applicable migration dims)`) is asserted in
+  code. When the Hibernate version is undeclared it is inferred from the Spring Boot
+  BOM (Boot ≥3 → Hibernate ≥6 → N/A; Boot 2 → Hibernate 5 → applicable; no BOM →
+  `status: unresolved`, never a heuristic score).
 - **Three buckets: blocker ≠ hygiene ≠ test.** Only product (`main`) code counts
   toward `blocking_count`, readiness, and effort. Test harnesses
   (`testsuite/`, `test-framework/`, `integration-arquillian/`, `*-test*`,

{sourcecode-1.65.0 → sourcecode-1.67.0}/README.md

@@ -700,9 +700,21 @@ evidence. `migrate-check` enforces:
   usage; Quarkus / Micronaut / Helidon / Jakarta-pure repos report `boot3` as N/A
   (`spring_present: false`), not a contradictory `applicable: true`.
 - **Permanent `javax.*` are never jakarta debt.** JDK/JSR namespaces
-  (`javax.xml.*`, `javax.crypto.*`, `javax.naming.*`, `javax.sql.*`,
-  `javax.management.*`, `javax.security.auth.*`, …) are allowlisted across every
-  jakarta scorer.
+  (`javax.cache`, `javax.sql`, `javax.xml` JAXP, `javax.crypto`, `javax.naming`,
+  `javax.management`, `javax.security.auth`, `javax.annotation.processing`, …) are
+  allowlisted across every jakarta scorer (single source of truth:
+  `serializer._JAVAX_PERMANENT_NAMESPACES` + `migrate_check._JAKARTA_NO_MIGRATE_PREFIXES`).
+  The `javax→jakarta` dependency flag decides via **longest-prefix match**, so
+  `javax.xml.bind` (JAXB — moved) flags while `javax.xml` (JAXP) does not, and
+  `javax.annotation` (JSR-250 — moved) flags while `javax.annotation.processing`
+  (JSR-269) does not. The allowlist never silences a real migration.
+- **`readiness_score` is a traceable aggregate.** It is `min` over the applicable
+  **migration** dimensions (`jakarta` / `boot3` / `hibernate`); `jdk_modernization`
+  is orthogonal upkeep and is excluded. The exact inputs are in `readiness_aggregate{}`
+  and an invariant (`readiness_score == min(applicable migration dims)`) is asserted in
+  code. When the Hibernate version is undeclared it is inferred from the Spring Boot
+  BOM (Boot ≥3 → Hibernate ≥6 → N/A; Boot 2 → Hibernate 5 → applicable; no BOM →
+  `status: unresolved`, never a heuristic score).
 - **Three buckets: blocker ≠ hygiene ≠ test.** Only product (`main`) code counts
   toward `blocking_count`, readiness, and effort. Test harnesses
   (`testsuite/`, `test-framework/`, `integration-arquillian/`, `*-test*`,

{sourcecode-1.65.0 → sourcecode-1.67.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.65.0"
+version = "1.67.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.65.0 → sourcecode-1.67.0}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.65.0"
+__version__ = "1.67.0"

{sourcecode-1.65.0 → sourcecode-1.67.0}/src/sourcecode/cli.py

@@ -4896,7 +4896,8 @@ def migrate_check_cmd(
         output, output_path, copy,
         success_msg=(
             f"Migration check written to {output_path} "
-            f"(score: {report.readiness_score}/100, {_total} findings)"
+            f"(score: {report.readiness_score if report.readiness_score is not None else 'N/A'}"
+            f"{'/100' if report.readiness_score is not None else ''}, {_total} findings)"
         ),
     )
 
@@ -5524,6 +5525,91 @@ def fix_bug_cmd(
     )
 
 
+# Method signatures that are almost always FRAMEWORK ENTRY POINTS, not dead code —
+# invoked by a dispatcher (reflection / XML / SPI), invisible to a static Java
+# call-graph. Generalizes beyond any one framework.
+_DYNAMIC_ENTRY_SIGNATURE_RE = __import__("re").compile(
+    r"\(\s*DispatchContext\b"                       # OFBiz Service Engine service
+    r"|HttpServletRequest\s+\w+\s*,\s*HttpServletResponse"  # OFBiz event / servlet handler
+    r"|@(?:Scheduled|PostConstruct|PreDestroy|EventListener|Bean|"
+    r"RequestMapping|GetMapping|PostMapping|Path|GET|POST|Provider|"
+    r"ApplicationScoped|Singleton)\b",              # annotation-dispatched entry
+)
+# Config file extensions where a framework wires classes by name (XML/props/yaml).
+_CONFIG_REF_EXTS: frozenset = frozenset({".xml", ".properties", ".yml", ".yaml", ".groovy"})
+_CONFIG_SCAN_MAX_FILES: int = 12000
+_CONFIG_SCAN_MAX_BYTES: int = 256 * 1024
+
+
+def _partition_static_unreferenced(nodes: list[dict], root: Path) -> tuple[list[dict], list[dict]]:
+    """Split zero-degree classes into (truly_unreferenced, framework_dispatched).
+
+    A class with no static callers is NOT necessarily dead: frameworks invoke
+    classes via reflection, XML/SPI config, or annotations that a static call-graph
+    cannot see (e.g. Apache OFBiz Service Engine services, JAX-RS resources,
+    ServiceLoader providers, scheduled beans). We exclude a candidate when EITHER:
+      1. its source declares a dynamic-entry method signature, OR
+      2. its simple name / FQN is referenced from a non-Java config file.
+    Whatever survives is reported as *statically_unreferenced* — never a confident
+    "dead zone".
+    """
+    import os
+    if not nodes:
+        return [], []
+    by_simple: dict[str, list[dict]] = {}
+    for n in nodes:
+        simple = (n.get("fqn") or "").rsplit(".", 1)[-1]
+        if simple:
+            by_simple.setdefault(simple, []).append(n)
+
+    dispatched_fqns: set[str] = set()
+
+    # 1. Source-signature allowlist (bounded — candidate set is small).
+    for n in nodes:
+        src = n.get("source_file")
+        if not src:
+            continue
+        try:
+            txt = (root / src).read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        if _DYNAMIC_ENTRY_SIGNATURE_RE.search(txt):
+            dispatched_fqns.add(n["fqn"])
+
+    # 2. Config-reference scan — find candidate names wired from XML/props/yaml.
+    unresolved_simple = {s for s, ns in by_simple.items()
+                         if any(x["fqn"] not in dispatched_fqns for x in ns)}
+    if unresolved_simple:
+        files_scanned = 0
+        for dirpath, dirnames, filenames in os.walk(root):
+            dirnames[:] = [d for d in dirnames
+                           if d not in {".git", "build", "out", "target", "node_modules", ".gradle"}]
+            for fname in filenames:
+                ext = os.path.splitext(fname)[1].lower()
+                if ext not in _CONFIG_REF_EXTS:
+                    continue
+                if files_scanned >= _CONFIG_SCAN_MAX_FILES or not unresolved_simple:
+                    break
+                fpath = os.path.join(dirpath, fname)
+                try:
+                    with open(fpath, "r", encoding="utf-8", errors="replace") as fh:
+                        text = fh.read(_CONFIG_SCAN_MAX_BYTES)
+                except OSError:
+                    continue
+                files_scanned += 1
+                for simple in list(unresolved_simple):
+                    if simple in text:
+                        for x in by_simple.get(simple, []):
+                            dispatched_fqns.add(x["fqn"])
+                        unresolved_simple.discard(simple)
+            if files_scanned >= _CONFIG_SCAN_MAX_FILES or not unresolved_simple:
+                break
+
+    unreferenced = [n for n in nodes if n["fqn"] not in dispatched_fqns]
+    dispatched = [n for n in nodes if n["fqn"] in dispatched_fqns]
+    return unreferenced, dispatched
+
+
 @app.command("modernize")
 def modernize_cmd(
     path: Path = typer.Argument(
@@ -5625,13 +5711,21 @@ def modernize_cmd(
         key=lambda n: (-n.get("in_degree", 0), n.get("fqn", "")),
     )[:20]
 
-    # Dead zones: symbols with zero in-degree AND zero out-degree (isolated)
-    dead_zones = sorted(
+    # Statically-unreferenced zones: classes with zero in-degree AND zero out-degree
+    # in the Java call-graph. These are NOT necessarily dead — framework dispatch
+    # (reflection / XML / SPI / annotations) is invisible to a static graph — so we
+    # partition out framework-dispatched entry points before reporting, and never
+    # call the survivors "dead". (Defect 5: OFBiz Service-Engine services and event
+    # handlers were false-positive "dead zones".)
+    _zero_degree = sorted(
         [n for n in graph_nodes
          if n.get("in_degree", 0) == 0 and n.get("out_degree", 0) == 0
          and n.get("type") in ("class", "interface")],
         key=lambda n: n.get("fqn", ""),
-    )[:20]
+    )
+    dead_zones, framework_dispatched = _partition_static_unreferenced(_zero_degree, root)
+    dead_zones = dead_zones[:20]
+    framework_dispatched = framework_dispatched[:20]
 
     # Hotspot candidates: high in-degree service/repository/controller nodes,
     # ranked by composite score (in_degree × 2 + git_churn) for volatility signal.
@@ -5680,7 +5774,8 @@ def modernize_cmd(
         "total_classes": len([n for n in graph_nodes if n.get("type") in ("class", "interface")]),
         "total_subsystems": len(subsystems),
         "high_coupling_nodes": len(coupling_nodes),
-        "dead_zone_candidates": len(dead_zones),
+        "statically_unreferenced": len(dead_zones),
+        "framework_dispatched": len(framework_dispatched),
     }
     _subsystem_summary = [
         {
@@ -5723,10 +5818,20 @@ def modernize_cmd(
                 {"fqn": n["fqn"], "in_degree": n.get("in_degree", 0), "role": n.get("role", "other")}
                 for n in coupling_nodes
             ],
-            "dead_zone_candidates": [
+            "statically_unreferenced": [
                 {"fqn": n["fqn"], "type": n.get("type", ""), "role": n.get("role", "other")}
                 for n in dead_zones
             ],
+            "statically_unreferenced_note": (
+                "Zero static callers in the Java call-graph. NOT confirmed dead: verify "
+                "no framework dispatch (reflection, XML/SPI config, annotations) before "
+                "removing. Classes detected as framework-dispatched are listed separately "
+                "under framework_dispatched and excluded from this list."
+            ),
+            "framework_dispatched": [
+                {"fqn": n["fqn"], "type": n.get("type", ""), "role": n.get("role", "other")}
+                for n in framework_dispatched
+            ],
             "subsystem_summary": _subsystem_summary,
             "cross_module_tangles": [
                 {
@@ -5742,7 +5847,8 @@ def modernize_cmd(
                     if hotspots else
                     "high_coupling_nodes shows the most-referenced classes — start there. "
                 )
-                + "Dead zones are safe to remove or refactor. "
+                + "statically_unreferenced lists classes with no Java callers — review "
+                + "for framework dispatch (XML/reflection/SPI) before removing. "
                 + "Cross-module tangles indicate coupling worth decomposing."
             ),
         }

{sourcecode-1.65.0 → sourcecode-1.67.0}/src/sourcecode/context_summarizer.py

@@ -28,7 +28,11 @@ _STACK_LABELS: dict[str, str] = {
 
 _TYPE_LABELS: dict[str, str] = {
     "api": "REST API",
-    "web_mvc": "Spring MVC web app",
+    # Vendor-neutral: web_mvc is triggered by server-side template engines
+    # (Thymeleaf/FreeMarker), which are NOT exclusive to Spring (e.g. Apache OFBiz
+    # uses FreeMarker with its own framework). The detected frameworks list carries
+    # the actual stack; the type label must not assert "Spring".
+    "web_mvc": "Server-side MVC web app",
     "webapp": "Web app",
     "fullstack": "Full-stack app",
     "cli": "CLI tool",

{sourcecode-1.65.0 → sourcecode-1.67.0}/src/sourcecode/dependency_analyzer.py

@@ -1278,9 +1278,42 @@ class DependencyAnalyzer:
         return records, limitations
 
     def _strip_gradle_comments(self, content: str) -> str:
-        content = re.sub(r"/\*.*?\*/", "", content, flags=re.DOTALL)
-        content = re.sub(r"//[^\n]*", "", content)
-        return content
+        """Strip // and /* */ comments WITHOUT touching string literals.
+
+        A naive regex treats `/*` inside a string as a block-comment open. Gradle
+        build files routinely embed `/*` in Ant-style glob strings (e.g.
+        '**/*.java') and `//` in URL strings — a regex stripper then eats the entire
+        dependencies block up to the next literal `*/` (real defect on Apache OFBiz,
+        where ~100 deps vanished). This scanner skips quoted strings (single, double,
+        and triple-quoted, with backslash escapes) so only genuine comments are removed.
+        """
+        out: list[str] = []
+        i, n = 0, len(content)
+        quote: Optional[str] = None  # active string delimiter
+        while i < n:
+            if quote is not None:
+                # Inside a string literal — copy verbatim until the matching delimiter.
+                if len(quote) == 1 and content[i] == "\\" and i + 1 < n:
+                    out.append(content[i:i + 2]); i += 2; continue
+                if content.startswith(quote, i):
+                    out.append(quote); i += len(quote); quote = None; continue
+                out.append(content[i]); i += 1; continue
+            if content.startswith("//", i):
+                j = content.find("\n", i)
+                if j == -1:
+                    break
+                i = j; continue
+            if content.startswith("/*", i):
+                j = content.find("*/", i + 2)
+                if j == -1:
+                    break
+                i = j + 2; continue
+            for q in ('"""', "'''", '"', "'"):
+                if content.startswith(q, i):
+                    quote = q; out.append(q); i += len(q); break
+            else:
+                out.append(content[i]); i += 1
+        return "".join(out)
 
     def _analyze_gradle(self, root: Path) -> tuple[list[DependencyRecord], list[str]]:
         for filename in ("build.gradle", "build.gradle.kts"):
@@ -1307,7 +1340,20 @@ class DependencyAnalyzer:
                         except OSError:
                             pass
 
-                return self._dedupe(records), ["gradle: no compatible lockfile found; transitive dependencies unavailable"]
+                deduped = self._dedupe(records)
+                gradle_limitations = [
+                    "gradle: no compatible lockfile found; transitive dependencies unavailable"
+                ]
+                # Honest-zero guard: if the build file declares a dependencies block but
+                # nothing was resolved, report a GAP rather than a confident "0 deps".
+                if not deduped and re.search(r"\bdependencies\s*\{", content):
+                    jar_count = sum(1 for _ in root.glob("lib/**/*.jar"))
+                    gap = ("gradle: dependencies declared but none resolved by static "
+                           "parsing (non-standard declaration syntax)")
+                    if jar_count:
+                        gap += f"; {jar_count} jar(s) present under lib/ (not parsed)"
+                    gradle_limitations.append(gap)
+                return deduped, gradle_limitations
         return [], []
 
     def _parse_gradle_properties(self, root: Path, content: str) -> dict[str, str]:

{sourcecode-1.65.0 → sourcecode-1.67.0}/src/sourcecode/mcp/orchestrator.py

@@ -774,7 +774,7 @@ def run_migrate_flow_impl(repo_path: str, min_severity: str = "low") -> dict[str
     if not _is_java_repo(repo_path):
         quality_warnings.append(
             "not_a_java_repo: migration analysis targets Spring Boot / Java repos. "
-            "Result will be empty (readiness_score=100, no findings)."
+            "Result will be empty (readiness_score=null/N/A, no findings)."
         )
 
     report = _exec(["migrate-check", repo_path, "--min-severity", min_severity])

{sourcecode-1.65.0 → sourcecode-1.67.0}/src/sourcecode/mcp/registry.py

@@ -798,7 +798,7 @@ depth: BFS depth for indirect caller traversal (1–8, default: 4).
 Analyzes codebase for modernization opportunities: dead zones, hotspot scores, upgrade candidates.
 
 Maps to: sourcecode modernize <repo_path>
-Returns: hotspot_candidates (high fan-in + git churn), dead_zone_candidates (isolated classes),
+Returns: hotspot_candidates (high fan-in + git churn), statically_unreferenced (zero-caller classes — NOT confirmed dead; verify no framework dispatch) + framework_dispatched,
          high_coupling_nodes, subsystem_summary, cross_module_tangles, recommendation.
 
 Best for: refactor planning, identifying where to start, finding safe removal candidates.
@@ -1403,7 +1403,7 @@ Spring Boot 2→3 migration readiness: javax→jakarta namespace blockers. JAVA
 When to call: when asked about Spring Boot migration readiness, javax vs jakarta imports,
 or upgrading from Spring Boot 2.x to 3.x. Use BEFORE get_spring_audit when the goal
 is migration planning rather than ongoing Spring semantic audit.
-Do NOT call on non-Java repositories — returns readiness_score=100 with no findings.
+Do NOT call on non-Java repositories — returns readiness_score=null (N/A) with no findings.
 
 Rules detected:
   MIG-001 critical — javax.persistence imports (JPA; will not compile after migration)
@@ -1415,7 +1415,7 @@ Rules detected:
   MIG-007 medium   — javax.inject imports (DI annotations)
   MIG-008 medium   — javax.ws.rs imports (JAX-RS API)
 
-Returns: schema_version, readiness_score (0–100; 100=ready to migrate),
+Returns: schema_version, readiness_score (0–100, or null=N/A when no migration target applies; 100=ready to migrate),
   jakarta_readiness / boot3_readiness / jdk_modernization (per-dimension 0–100),
   blocking_count, estimated_effort_days, spring_boot_2_detected (true|false|null —
   null=undetermined, never assumed true), spring_boot_version_detected,

{sourcecode-1.65.0 → sourcecode-1.67.0}/src/sourcecode/mcp/server.py

@@ -517,7 +517,7 @@ def run_migrate_flow(repo_path: str = ".", min_severity: str = "low") -> dict:
     Primary high-value entry point for migration planning. Wraps migrate-check and
     lifts the headline numbers to the top level so the agent can plan a 2→3 upgrade
     without parsing the full report:
-      - readiness_score (0–100; 100 = ready), blocking_count, estimated_effort_days
+      - readiness_score (0–100, or null=N/A when no migration target applies; 100 = ready), blocking_count, estimated_effort_days
       - by_severity and by_target breakdown (jakarta / spring_security_6 / java_11)
 
     Use this instead of calling get_migration_readiness and interpreting it by hand.
@@ -788,10 +788,10 @@ def get_migration_readiness(repo_path: str = ".", min_severity: str = "low") ->
     When to call: when asked about Spring Boot migration readiness, javax vs jakarta imports,
     or upgrading from Spring Boot 2.x to 3.x. Call this BEFORE get_spring_audit when
     the goal is migration planning — not ongoing audit.
-    Do NOT call on non-Java repositories — returns readiness_score=100 with no findings.
+    Do NOT call on non-Java repositories — returns readiness_score=null (N/A) with no findings.
 
     Maps to: sourcecode migrate-check <repo_path> --min-severity <min_severity>
-    Returns: MigrationReport with schema_version, readiness_score (0–100; 100=ready to migrate),
+    Returns: MigrationReport with schema_version, readiness_score (0–100, or null=N/A when no migration target applies; 100=ready to migrate),
              jakarta_readiness / boot3_readiness / jdk_modernization / hibernate_readiness
              (per-dimension 0–100), headline_blocker (e.g. "hibernate_rewrite" or null),
              hibernate (Hibernate 5→6 stratified model: 4-layer risk_matrix, rewrite_targets[]
@@ -1335,7 +1335,7 @@ def modernize_context(repo_path: str = ".", format: str = "json") -> dict:
     """Analyzes codebase for modernization opportunities: dead zones, hotspot scores, upgrade candidates.
 
     Maps to: sourcecode modernize <repo_path>
-    Returns: hotspot_candidates (high fan-in + git churn), dead_zone_candidates (isolated classes),
+    Returns: hotspot_candidates (high fan-in + git churn), statically_unreferenced (zero-caller classes — NOT confirmed dead; verify no framework dispatch) + framework_dispatched,
              high_coupling_nodes, subsystem_summary, cross_module_tangles, recommendation.
 
     Best for: refactor planning, identifying where to start, finding safe removal candidates.