sourcecode 1.67.0__tar.gz → 1.68.0__tar.gz

{sourcecode-1.67.0 → sourcecode-1.68.0}/CHANGELOG.md

@@ -1,5 +1,50 @@
 # Changelog
 
+## [1.68.0] — 2026-06-30
+
+### Fixed — narrative/structured-data parity on non-Spring DI repos (Netflix Eureka field test)
+
+A real audit of **Netflix Eureka** (Gradle multi-module, JAX-RS/Jersey 1.x + Google
+Guice, **no Spring, no Hibernate, no persistence layer**) surfaced six reliability
+defects that share one root cause: **prose that assumed a Spring/Hibernate/persistence
+context even though the same JSON's own structured fields already knew it did not
+apply.** A consumer trusting the narrative over the structured fields would have read
+false conclusions. Guiding principle applied throughout: **a narrative term (Spring,
+Guice, persistence, …) may only appear when the corresponding structured signal
+confirms it.** New regression coverage across four suites.
+
+- **SMTP false positive on a log string (BUG #1).** `export --integrations` reported
+  `kind=smtp` for `logger.warn("Transport initialization failure", e)` — the bare word
+  "Transport" in a log literal. The detector now (a) skips any token matched inside a
+  string literal and (b) gates the JavaMail tokens (`Transport`, `MimeMessage`) on a
+  `javax.mail`/`jakarta.mail`/`org.springframework.mail` import. Eureka SMTP hits 3 → 0.
+- **JNDI DNS mislabeled as LDAP (BUG #2).** `javax.naming.directory.{Dir,Initial}Context`
+  is protocol-agnostic; it is now classified by its `INITIAL_CONTEXT_FACTORY` —
+  `DnsContextFactory` → `kind=dns` (`client=jndi-dns`), `LdapCtxFactory` → `ldap`, and an
+  unresolvable factory → `kind=naming-directory-unknown` with `confidence=low`, never an
+  assumed LDAP. Eureka `DnsResolver` now reports `dns`.
+- **"Spring Boot 3" narrative on a non-Spring repo (BUG #3).** When `spring_present` is
+  `False`, every `migrate-check` finding's `explanation` is rewritten from Spring-Boot
+  framing into framework-neutral Jakarta-EE / servlet-container framing (the javax→jakarta
+  finding itself is unchanged). Guarantee: no explanation contains "Spring Boot" unless
+  the report confirms runtime Spring.
+- **Inconsistent DI-framework label (BUG #4).** `impact` emitted "Spring/CDI DI pattern"
+  in the short `explanation` but "Spring/CDI/Guice" in `via_interface_note` of the *same*
+  JSON, while `direct_callers` proved the framework was Guice. Both strings now derive
+  from one label computed from caller evidence — a `*.guice.*` caller yields "Guice".
+- **"persistence paths" for non-persistence mappers (BUG #5).** Eureka's `AzToRegionMapper`
+  classes (AWS topology, no data layer) were counted as "4 persistence paths". Each
+  `mappers_affected` entry now carries `mapper_kind` (`persistence` only for a confirmed
+  `@Repository` role or MyBatis `mapper_interface`; otherwise `name_heuristic`). The
+  explanation says "persistence path" only for confirmed entries and neutral
+  "data-mapping class" otherwise — the word "persistence" never appears for a repo with no
+  confirmed persistence signal.
+- **Ambiguous `member_count` unit in `modernize` (BUG #6).** `subsystem_summary.member_count`
+  counts all graph members (classes + methods + fields), ~5× the class count and not
+  comparable to repo-level `total_classes`. Each entry now also carries an unambiguous
+  `class_count` (class/interface declarations only, comparable to `total_classes`), with a
+  `subsystem_summary_note` documenting both units.
+
 ## [1.67.0] — 2026-06-30
 
 ### Fixed — framing accuracy on non-Spring repos (Apache OFBiz field test)

{sourcecode-1.67.0 → sourcecode-1.68.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.67.0
+Version: 1.68.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-1.67.0 → sourcecode-1.68.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.67.0"
+version = "1.68.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.67.0 → sourcecode-1.68.0}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.67.0"
+__version__ = "1.68.0"

{sourcecode-1.67.0 → sourcecode-1.68.0}/src/sourcecode/cli.py

@@ -5777,14 +5777,32 @@ def modernize_cmd(
         "statically_unreferenced": len(dead_zones),
         "framework_dispatched": len(framework_dispatched),
     }
+    # BUG #6 (v1.68.0): `member_count` counts ALL graph members in the subsystem —
+    # classes, methods AND fields — so it runs ~5x higher than the class count and
+    # is not comparable to the repo-level `total_classes` (which counts only
+    # class/interface nodes). Surface an unambiguous `class_count` alongside it,
+    # computed against the same class/interface node set as total_classes, so a
+    # reader does not have to reverse-engineer the unit. `member_count` is retained
+    # for backward compatibility but is now documented as the graph-member tally.
+    _class_fqns = {n["fqn"] for n in graph_nodes if n.get("type") in ("class", "interface")}
+
+    def _class_count(members: list) -> int:
+        return sum(1 for m in members if m in _class_fqns)
+
     _subsystem_summary = [
         {
             "label": s.get("label") or s.get("name") or "",
             "package_prefix": s.get("package_prefix") or s.get("pkg") or "",
+            "class_count": _class_count(s.get("members") or []),
             "member_count": len(s.get("members") or []),
         }
         for s in subsystems[:15]
     ]
+    _subsystem_summary_note = (
+        "class_count = class/interface declarations only (comparable to "
+        "summary.total_classes). member_count = all graph members in the subsystem "
+        "including methods and fields, so it is larger and not a class tally."
+    )
 
     if (not _mod_is_pro) and _mod_large(str(root)):
         # Large monolith, free tier: structural discovery preview only — no dead
@@ -5801,6 +5819,7 @@ def modernize_cmd(
             ),
             "summary": _summary,
             "subsystem_summary": _subsystem_summary,
+            "subsystem_summary_note": _subsystem_summary_note,
             "hotspot_candidates": hotspots[:3],
             "high_coupling_nodes": [
                 {"fqn": n["fqn"], "in_degree": n.get("in_degree", 0), "role": n.get("role", "other")}
@@ -5833,9 +5852,11 @@ def modernize_cmd(
                 for n in framework_dispatched
             ],
             "subsystem_summary": _subsystem_summary,
+            "subsystem_summary_note": _subsystem_summary_note,
             "cross_module_tangles": [
                 {
                     "label": s.get("label") or s.get("name") or "",
+                    "class_count": _class_count(s.get("members") or []),
                     "member_count": len(s.get("members") or []),
                 }
                 for s in tangle_modules

{sourcecode-1.67.0 → sourcecode-1.68.0}/src/sourcecode/integration_detector.py

@@ -7,8 +7,14 @@ deterministic source-text matching (same approach as the JNDI datasource scan in
 
 Covered clients:
 
-  * HTTP   — ``RestTemplate``, ``WebClient``, ``@FeignClient`` (declarative)
-  * LDAP   — ``LdapTemplate``
+  * HTTP   — ``RestTemplate``, ``WebClient``, ``@FeignClient`` (declarative),
+             JDK/Apache/OkHttp clients
+  * LDAP   — ``LdapTemplate``, JNDI ``InitialLdapContext``/``LdapContext``
+  * DNS    — JNDI ``DirContext`` configured with ``DnsContextFactory`` (BUG #2:
+             ``DirContext`` is protocol-agnostic and is classified by its
+             ``INITIAL_CONTEXT_FACTORY``, not assumed to be LDAP)
+  * SMTP   — JavaMail / Jakarta Mail (BUG #1: gated on a mail import so the bare
+             word "Transport" in a log string is not a false positive)
   * JMS    — ``JmsTemplate``, ActiveMQ connection factories
 
 Each hit is reported with a ``file:line`` evidence anchor and, when a literal URL
@@ -28,6 +34,24 @@ _URL_RE = re.compile(r'"((?:https?|ldaps?|tcp|amqp|jms|nio)://[^"]*)"')
 # First string literal on a line (fallback target, e.g. WebClient.create("x")).
 _STR_RE = re.compile(r'"([^"]+)"')
 
+# BUG #1 (v1.68.0): a JavaMail/Jakarta-Mail import is required before an SMTP token
+# (Transport, MimeMessage) is trusted. The bare word "Transport" is also a common
+# English noun that appears in log strings ( logger.warn("Transport initialization
+# failure") in non-mail code), so a mail-import gate plus a string-literal skip
+# stops those false positives.
+_MAIL_IMPORT_RE = re.compile(
+    r"^\s*import\s+(?:(?:javax|jakarta)\.mail|org\.springframework\.mail)\b",
+    re.MULTILINE,
+)
+
+# BUG #2 (v1.68.0): javax.naming.directory.{DirContext,InitialDirContext} is NOT
+# LDAP-specific — the actual protocol is decided by the value bound to
+# Context.INITIAL_CONTEXT_FACTORY. com.sun.jndi.dns.DnsContextFactory means DNS
+# (SRV/A record lookups), com.sun.jndi.ldap.LdapCtxFactory means LDAP. Classify by
+# the factory class present in the file instead of defaulting to LDAP.
+_DNS_FACTORY_RE = re.compile(r"jndi\.dns|DnsContextFactory", re.IGNORECASE)
+_LDAP_FACTORY_RE = re.compile(r"jndi\.ldap|LdapCtxFactory", re.IGNORECASE)
+
 # Declarative HTTP client. Attrs may span multiple lines, so matched on full text.
 _FEIGN_RE = re.compile(r"@FeignClient\s*\(([^)]*)\)", re.DOTALL)
 _ATTR_URL_RE = re.compile(r'url\s*=\s*"([^"]*)"')
@@ -82,6 +106,39 @@ def _extract_target(line: str) -> Optional[str]:
     return None
 
 
+def _in_string_literal(line: str, idx: int) -> bool:
+    """True if char offset ``idx`` falls inside a double-quoted string on ``line``.
+
+    BUG #1 (v1.68.0): a Java type token never legitimately appears inside a string
+    literal, so a match there (e.g. the word "Transport" in a log message) is noise,
+    not a real client construct. Counts unescaped quotes before ``idx``.
+    """
+    quote_count = 0
+    i = 0
+    while i < idx and i < len(line):
+        ch = line[i]
+        if ch == "\\":
+            i += 2
+            continue
+        if ch == '"':
+            quote_count += 1
+        i += 1
+    return quote_count % 2 == 1
+
+
+def _classify_naming_factory(text: str) -> Optional[str]:
+    """Classify a javax.naming.directory usage by its INITIAL_CONTEXT_FACTORY.
+
+    Returns ``"dns"``, ``"ldap"``, or ``None`` (factory not statically resolvable).
+    See BUG #2 — DirContext alone does not imply LDAP.
+    """
+    if _DNS_FACTORY_RE.search(text):
+        return "dns"
+    if _LDAP_FACTORY_RE.search(text):
+        return "ldap"
+    return None
+
+
 def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
     """Detect outbound integrations across ``file_paths`` (relative to ``root``).
 
@@ -93,18 +150,31 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
     seen: "set[tuple[str, str, Optional[str], str]]" = set()
     records: "list[dict]" = []
 
-    def _add(kind: str, client: str, target: Optional[str], rel: str, line: int) -> None:
+    def _add(
+        kind: str,
+        client: str,
+        target: Optional[str],
+        rel: str,
+        line: int,
+        confidence: Optional[str] = None,
+    ) -> None:
         evidence = f"{rel}:{line}"
         key = (kind, client, target, evidence)
         if key in seen:
             return
         seen.add(key)
-        records.append({
+        rec = {
             "kind": kind,
             "client": client,
             "target": target,
             "evidence": evidence,
-        })
+        }
+        # Per-record confidence is emitted only when the classification is uncertain
+        # (e.g. a JNDI DirContext whose factory could not be resolved). Confident hits
+        # stay schema-clean without the field.
+        if confidence is not None:
+            rec["confidence"] = confidence
+        records.append(rec)
 
     for rel in file_paths:
         try:
@@ -126,6 +196,10 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
             )
             _add("http", "feign", target, rel, _line_of(text, m.start()))
 
+        # Per-file context used to disambiguate / gate uncertain tokens (BUG #1/#2).
+        has_mail_import = bool(_MAIL_IMPORT_RE.search(text))
+        naming_factory = _classify_naming_factory(text)
+
         # Token clients — per line, skipping imports/package/comment noise.
         # First pass records the declaration site and any variable name bound to
         # the client, so a later call site (where the URL literal usually lives)
@@ -146,7 +220,28 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
                 m = token_re.search(line)
                 if not m:
                     continue
-                _add(kind, client, _extract_target(line), rel, lineno)
+                # BUG #1: a token matched inside a string literal (log message, doc
+                # comment text) is never a real client construct — skip it.
+                if _in_string_literal(line, m.start()):
+                    continue
+                confidence: Optional[str] = None
+                # BUG #1: SMTP tokens require a JavaMail/Jakarta-Mail import to be
+                # trusted — "Transport" / "MimeMessage" are too generic otherwise.
+                if kind == "smtp" and not has_mail_import:
+                    continue
+                # BUG #2: javax.naming.directory.{Dir,Initial}Context is protocol-
+                # agnostic. Reclassify by the configured context factory; default to
+                # an explicit low-confidence "unknown" rather than assuming LDAP.
+                if client == "jndi-ldap" and "Dir" in token_re.pattern:
+                    if naming_factory == "dns":
+                        kind, client = "dns", "jndi-dns"
+                    elif naming_factory == "ldap":
+                        kind, client = "ldap", "jndi-ldap"
+                    else:
+                        kind, client, confidence = (
+                            "naming-directory-unknown", "jndi-dircontext", "low",
+                        )
+                _add(kind, client, _extract_target(line), rel, lineno, confidence)
                 tok = m.group(0)
                 # `Type name` (field/local decl) and `name = new Type(` forms.
                 decl = re.search(re.escape(tok) + r"\s+(\w+)\b", line)
@@ -186,9 +281,13 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
         "confidence": confidence,
         "coverage_note": (
             "Detects HTTP (RestTemplate/WebClient/JDK/Apache/OkHttp), LDAP (Spring "
-            "+ JNDI), SMTP (JavaMail), and JMS client constructs by source-text "
-            "matching. A count of 0 means no such construct was found, not that the "
-            "system has no outbound integrations — runtime/DI-wired clients are not "
-            "statically visible."
+            "+ JNDI), DNS (JNDI DirContext w/ DnsContextFactory), SMTP (JavaMail, "
+            "import-gated), and JMS client constructs by source-text matching. JNDI "
+            "DirContext usage is classified by its INITIAL_CONTEXT_FACTORY (dns vs "
+            "ldap); when the factory is not statically resolvable the kind is "
+            "'naming-directory-unknown' with confidence='low', never assumed LDAP. A "
+            "count of 0 means no such construct was found, not that the system has no "
+            "outbound integrations — runtime/DI-wired clients are not statically "
+            "visible."
         ),
     }

{sourcecode-1.67.0 → sourcecode-1.68.0}/src/sourcecode/migrate_check.py

@@ -1631,6 +1631,53 @@ def _refine_mig006(matched_imports: list[str]) -> tuple[str, str]:
     )
 
 
+# ---------------------------------------------------------------------------
+# BUG #3 (v1.68.0): framework-gated narrative.
+# MIG-* explanations are written assuming a Spring Boot 2→3 upgrade because that is
+# the overwhelmingly common Jakarta-migration context. On a repo where the tool has
+# already determined spring_present=False (plain Jakarta EE, JAX-RS/Jersey, Quarkus,
+# Guice, ...), the underlying javax→jakarta finding is still valid, but prose that
+# says "Spring Boot 3 requires ..." is factually wrong for that repo and misleads any
+# reader who trusts the narrative over the structured spring_present field.
+#
+# Treat the narrative as a pure function of the structured data: when spring_present
+# is False, rewrite Spring-specific framing into framework-neutral Jakarta-EE /
+# servlet-container framing. Ordered phrase map first (keeps nice sentences for the
+# common phrasings), then a catch-all so no "Spring Boot" string can survive.
+# ---------------------------------------------------------------------------
+_NON_SPRING_EXPLANATION_SUBS: tuple[tuple[str, str], ...] = (
+    ("Spring Boot 3 bundles Jakarta Servlet 6.0.",
+     "Modern servlet containers (Jetty 12+, Tomcat 11+) require Jakarta Servlet 6.0."),
+    ("Spring Boot 3 requires Jakarta Servlet 5.0+",
+     "Jakarta EE 9+ servlet containers require Jakarta Servlet 5.0+"),
+    ("Spring Boot 3 uses Jakarta EE 9 which moved",
+     "Jakarta EE 9 moved"),
+    ("Spring Boot 3 uses Hibernate Validator 8.x which implements jakarta.validation.",
+     "Jakarta EE 9+ uses Hibernate Validator 8.x which implements jakarta.validation."),
+    ("Spring Boot 3 depends on Jakarta Transactions (jakarta.transaction).",
+     "Jakarta EE 9+ uses Jakarta Transactions (jakarta.transaction)."),
+    ("Spring Boot 3 requires Hibernate 6",
+     "Jakarta Persistence (JPA 3.x) requires Hibernate 6"),
+    ("Spring Boot 3 cache abstraction. Spring Boot 3 requires EhCache 3.x",
+     "Jakarta-EE cache abstraction. The modern JCache provider requires EhCache 3.x"),
+    # Catch-all: any remaining Spring-Boot framing → generic Jakarta EE 9+.
+    ("Spring Boot 3", "Jakarta EE 9+"),
+    ("Spring Boot 2", "the pre-Jakarta (javax) baseline"),
+)
+
+
+def _neutralize_non_spring_explanation(text: str) -> str:
+    """Rewrite Spring-specific migration prose into framework-neutral Jakarta framing.
+
+    Applied only when the report's spring_present is False. Deterministic phrase
+    substitution — no model, no guess. Guarantees the returned text contains no
+    "Spring Boot" framing that the structured data does not support.
+    """
+    for needle, repl in _NON_SPRING_EXPLANATION_SUBS:
+        text = text.replace(needle, repl)
+    return text
+
+
 def _scan_file(
     source: str,
     rel_path: str,
@@ -1822,6 +1869,15 @@ def run_migrate_check(
     for f in all_findings:
         f.code_context = _classify_code_context(f)
 
+    # BUG #3 (v1.68.0): on a non-Spring repo, rewrite Spring-Boot-specific framing in
+    # every finding's explanation into framework-neutral Jakarta-EE framing. The
+    # finding itself (javax→jakarta) stays; only the prose is corrected so it matches
+    # the structured spring_present=False signal in the same report.
+    if not spring_present:
+        for f in all_findings:
+            if f.explanation:
+                f.explanation = _neutralize_non_spring_explanation(f.explanation)
+
     # Hibernate 5→6 stratification (independent of min_severity — it is its own
     # risk model, not a severity-filtered finding stream).
     from sourcecode.hibernate_strat import analyze_hibernate

{sourcecode-1.67.0 → sourcecode-1.68.0}/src/sourcecode/repository_ir.py

@@ -20,7 +20,7 @@ import subprocess
 from collections import deque
 from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Any, Optional
+from typing import Any, Iterable, Optional
 
 from sourcecode.fqn_utils import normalize_owner_fqn as _normalize_owner_fqn
 from sourcecode.path_filters import is_test_path as _is_test_path
@@ -4700,9 +4700,16 @@ def compute_blast_radius(
         )
         if is_mapper and fqn not in _seen_mapper_fqns:
             _seen_mapper_fqns.add(fqn)
+            # BUG #5 (v1.68.0): distinguish a CONFIRMED persistence mapper (a
+            # @Repository/DAO role or a MyBatis @Mapper interface) from a class that
+            # only matched the name pattern (e.g. AzToRegionMapper — an AWS topology
+            # mapper with no data layer). Only confirmed entries may be described as
+            # "persistence" in the narrative.
+            _is_persistence = role in _MAPPER_ROLES or symbol_kind == "mapper_interface"
             _mapper_entry: dict = {
                 "fqn": fqn,
                 "role": role or ("mapper" if symbol_kind == "mapper_interface" else "repository"),
+                "mapper_kind": "persistence" if _is_persistence else "name_heuristic",
                 "source_file": node_dict.get("source_file") or "",
             }
             if canonical != fqn:
@@ -4841,18 +4848,33 @@ def compute_blast_radius(
         _parts.append(f"{n_ep} endpoint{'s' if n_ep != 1 else ''} exposed")
     if n_txn:
         _parts.append(f"{n_txn} transactional boundary{'s' if n_txn != 1 else ''} touched")
-    if n_mappers:
-        _parts.append(f"{n_mappers} persistence path{'s' if n_mappers != 1 else ''} in blast cone")
+    # BUG #5 (v1.68.0): only confirmed persistence mappers earn the word "persistence".
+    # Name-heuristic matches (e.g. *Mapper utility classes with no data layer) are
+    # surfaced as neutral "data-mapping class(es)" so the prose never invents a
+    # persistence tier the repo does not have.
+    _n_persist = sum(1 for m in mappers_affected if m.get("mapper_kind") == "persistence")
+    _n_heur = n_mappers - _n_persist
+    if _n_persist:
+        _parts.append(f"{_n_persist} persistence path{'s' if _n_persist != 1 else ''} in blast cone")
+    if _n_heur:
+        _parts.append(f"{_n_heur} data-mapping class{'es' if _n_heur != 1 else ''} in blast cone")
     if n_sec:
         _parts.append(f"{n_sec} security-gated endpoint{'s' if n_sec != 1 else ''} affected")
     if n_modules > 1:
         _parts.append(f"impact crosses {n_modules} modules")
 
+    # BUG #4 (v1.68.0): derive the DI-framework label ONCE from caller evidence and
+    # reuse it for both the short explanation and the long via_interface_note, so the
+    # two never disagree (the old code hardcoded "Spring/CDI" in one and "Spring/CDI/
+    # Guice" in the other). When the actual framework is identifiable from the caller
+    # FQNs (e.g. *.guice.* packages on a Guice repo), name it specifically instead of
+    # a generic guess.
+    _di_label = _detect_di_framework_label(direct_callers)
     if _iface_bridging:
         _iface_names = [b["interface"].split(".")[-1] for b in _iface_bridging]
         _parts.append(
             f"callers resolved via interface{'s' if len(_iface_names) > 1 else ''} "
-            f"({', '.join(_iface_names)}) — Spring/CDI DI pattern"
+            f"({', '.join(_iface_names)}) — {_di_label} DI pattern"
         )
 
     # Transparency: hub-class BFS truncation must appear in explanation so the
@@ -4924,9 +4946,9 @@ def compute_blast_radius(
     if _iface_bridging:
         out["via_interface_resolution"] = _iface_bridging
         out["via_interface_note"] = (
-            "Target is a concrete class injected via interface(s) in DI frameworks "
-            "(Spring/CDI/Guice). direct_callers includes callers of the implemented "
-            "interface(s) — these are the real production dependents."
+            "Target is a concrete class injected via interface(s) in a "
+            f"{_di_label} DI framework. direct_callers includes callers of the "
+            "implemented interface(s) — these are the real production dependents."
         )
     if _bfs_truncated:
         out["bfs_truncation_reason"] = "hub_class_depth_cap"
@@ -5106,3 +5128,31 @@ def _all_callers_from_rg(fqn: str, reverse_graph: dict[str, dict[str, list[str]]
 def _simple_name(fqn: str) -> str:
     """Extract the simple class name from a fully-qualified name."""
     return fqn.split(".")[-1].split("#")[0]
+
+
+def _detect_di_framework_label(caller_fqns: "Iterable[str]") -> str:
+    """Name the DI framework(s) evidenced by the caller FQNs (BUG #4, v1.68.0).
+
+    Returns a "/"-joined label of the frameworks actually identifiable from the
+    callers' package names (e.g. "Guice" when callers live under a ``*.guice.*``
+    package, "Spring" under ``org.springframework``). When nothing is identifiable
+    the label degrades to the generic "Spring/CDI/Guice" rather than asserting a
+    framework the evidence does not support. The same label feeds both the short
+    explanation and the long via_interface_note so they cannot disagree.
+    """
+    frameworks: set[str] = set()
+    for fqn in caller_fqns:
+        low = fqn.lower()
+        if "guice" in low or "com.google.inject" in low:
+            frameworks.add("Guice")
+        if "springframework" in low or ".spring." in low:
+            frameworks.add("Spring")
+        if "jakarta.enterprise" in low or "javax.enterprise" in low or ".cdi." in low:
+            frameworks.add("CDI")
+        if "micronaut" in low:
+            frameworks.add("Micronaut")
+        if "dagger" in low:
+            frameworks.add("Dagger")
+    if frameworks:
+        return "/".join(sorted(frameworks))
+    return "Spring/CDI/Guice"