sourcecode 1.69.0__py3-none-any.whl → 1.71.0__py3-none-any.whl

sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.69.0"
+__version__ = "1.71.0"

sourcecode/architecture_analyzer.py

@@ -38,7 +38,15 @@ _CODE_EXTENSIONS = {
 }
 _GENERIC_NAMES = {"utils", "helpers", "common", "shared", "misc", "core", "root", ""}
 
-_TEST_DIRS: frozenset[str] = frozenset({"tests", "test", "spec", "specs", "__tests__", "e2e"})
+_TEST_DIRS: frozenset[str] = frozenset({
+    "tests", "test", "spec", "specs", "__tests__", "e2e",
+    # Gradle/Maven test-fixture source roots are test code, not runtime architecture.
+    "testfixtures", "testfixture",
+})
+# Always-vendored asset trees — never a backend code layer at any depth.
+_ASSET_DIRS: frozenset[str] = frozenset({
+    "node_modules", "bower_components",
+})
 _BENCHMARK_DIRS: frozenset[str] = frozenset({
     "benchmark", "benchmarks", "bench",
     "example", "examples",
@@ -50,7 +58,7 @@ _BENCHMARK_DIRS: frozenset[str] = frozenset({
 _DOCS_DIRS: frozenset[str] = frozenset({"docs", "doc", "documentation", "wiki"})
 _TOOLING_DIRS: frozenset[str] = frozenset({"scripts", "script", "tools", "tool", "ci"})
 # All dirs that are not part of the runtime source architecture
-_NON_SOURCE_DIRS: frozenset[str] = _TEST_DIRS | _BENCHMARK_DIRS | _DOCS_DIRS | _TOOLING_DIRS
+_NON_SOURCE_DIRS: frozenset[str] = _TEST_DIRS | _BENCHMARK_DIRS | _DOCS_DIRS | _TOOLING_DIRS | _ASSET_DIRS
 
 # Exact file stems that signal a specific architectural layer
 _LAYER_STEM_EXACT: dict[str, str] = {
@@ -150,6 +158,15 @@ LAYER_PATTERNS: dict[str, dict[str, list[str]]] = {
     },
 }
 
+# Layer keys a pattern MUST match to qualify, regardless of score. BUG (JobRunr
+# field test): "mvc" was inferred from a controller-ish dir (`handlers`) plus a
+# `model` dir, with NO view layer — that is not MVC (a library with no templates/
+# pages/components is at most layered). MVC's defining trait is the View, so require
+# it; without it the pattern falls through to layered / a weaker match.
+_PATTERN_REQUIRED_KEYS: dict[str, frozenset[str]] = {
+    "mvc": frozenset({"view"}),
+}
+
 # Higher value = wins when score ties
 _PATTERN_PRIORITY: dict[str, int] = {
     "cqrs":               8,
@@ -245,8 +262,12 @@ class ArchitectureAnalyzer:
         # Step 2: domain clustering
         domains = self._cluster_domains(filtered)
 
-        # Step 3: layer detection
-        pattern, layers = self._detect_layers(filtered)
+        # Step 3: layer detection. Feed the FULL path list (not the code-extension
+        # `filtered` set): a View layer is template files (.html/.jinja/.ejs…) that
+        # `filtered` would drop, hiding the very layer that distinguishes MVC.
+        # _detect_layers applies its own non-source/asset/test dir filtering, so
+        # bundled frontend trees and test fixtures are still excluded.
+        pattern, layers = self._detect_layers(sm.file_paths)
         if pattern in (None, "flat", "unknown"):
             if pattern == "flat":
                 limitations.append("Layer pattern not detected: project has a flat directory structure")
@@ -518,10 +539,18 @@ class ArchitectureAnalyzer:
         return domains
 
     def _detect_layers(self, paths: list[str]) -> tuple[str, list[ArchitectureLayer]]:
-        # Exclude non-source paths (tests, benchmarks, docs, tooling) from layer scoring
+        # Exclude non-source paths (tests, benchmarks, docs, tooling, vendored assets)
+        # from layer scoring. Also exclude anything under a `resources/` segment: in
+        # Maven/Gradle layouts `src/main/resources/**` is bundled config/assets — e.g.
+        # JobRunr ships a React dashboard SPA at
+        # `core/src/main/resources/org/jobrunr/dashboard/frontend/src/components`, whose
+        # `components` dir would otherwise be miscounted as a backend MVC "view" layer.
         source_paths = [
             p for p in paths
-            if not any(part.lower() in _NON_SOURCE_DIRS for part in p.replace("\\", "/").split("/"))
+            if not any(
+                part.lower() in _NON_SOURCE_DIRS or part.lower() == "resources"
+                for part in p.replace("\\", "/").split("/")
+            )
         ]
         if not source_paths:
             return "unknown", []
@@ -544,6 +573,10 @@ class ArchitectureAnalyzer:
                 matched_dirs = [d for d in dir_names if d in keywords]
                 if matched_dirs:
                     matched[layer_key] = matched_dirs
+            # A pattern with unmet required keys cannot qualify (e.g. mvc needs a view).
+            required = _PATTERN_REQUIRED_KEYS.get(pattern_name)
+            if required and not required.issubset(matched.keys()):
+                continue
             score = len(matched)
             priority = _PATTERN_PRIORITY.get(pattern_name, 0)
             if (score, priority) > (best_score, best_priority):

sourcecode/architecture_summary.py

@@ -23,6 +23,14 @@ _JAVA_EXTENSIONS = {".java", ".kt", ".scala"}
 
 _CORE_DETECTION_MODULES = {"scanner", "detectors", "classifier", "workspace"}
 
+# BUG #4 (v1.70.0): the "REST API" project-type label is driven by HTTP-framework
+# PRESENCE (Spring MVC / JAX-RS on the classpath), not by an actual endpoint count.
+# The `--compact` summary is the first (often only) thing an agent reads, so it must
+# not assert "rest api" when the authoritative `endpoints` command finds almost no
+# high-confidence surface. Below this many high-confidence endpoints we degrade the
+# headline to a qualified, consistent phrasing instead of overclaiming.
+_MIN_REST_ENDPOINTS_FOR_LABEL = 5
+
 _OPTIONAL_LABEL_MAP: dict[str, str] = {
     "DependencyAnalyzer": "dependencias",
     "GraphAnalyzer": "grafo de módulos",
@@ -41,6 +49,7 @@ class ArchitectureSummarizer:
 
     def __init__(self, root: Path) -> None:
         self.root = root
+        self._endpoint_support_cache: tuple[int, int] | None = None
 
     def generate(self, sm: SourceMap) -> str | None:
         try:
@@ -133,6 +142,7 @@ class ArchitectureSummarizer:
         # Line 2: architecture pattern + layers
         if arch and arch.pattern not in (None, "unknown", "flat"):
             arch_line = self._describe_arch_pattern(arch)
+            arch_line = self._qualify_web_pattern(arch, arch_line, sm)
             if arch_line:
                 lines.append(arch_line)
 
@@ -185,9 +195,65 @@ class ArchitectureSummarizer:
 
         fw_str = f" using {', '.join(fw_names)}" if fw_names else ""
         if runtime:
+            # BUG #4: never assert "rest api" in the headline unless the endpoints
+            # command actually backs it (Java/Kotlin only — that is where we have an
+            # authoritative extractor). Degrade to a qualified, consistent phrasing.
+            if sm.project_type == "api" and primary.stack in {"java", "kotlin"}:
+                total, high = self._endpoint_support()
+                if high < _MIN_REST_ENDPOINTS_FOR_LABEL:
+                    plural = "s" if total != 1 else ""
+                    return (
+                        f"{stack_label} application{fw_str} "
+                        f"(HTTP framework present; only {total} endpoint{plural} "
+                        f"detected — see `endpoints`)."
+                    )
             return f"{stack_label} {runtime.lower()}{fw_str}."
         return f"{stack_label} project{fw_str}."
 
+    def _endpoint_support(self) -> tuple[int, int]:
+        """Return (total, high_confidence) endpoint counts from the canonical
+        Java endpoint extractor — the same source the `endpoints` command uses,
+        so the summary cannot diverge from it. Cached; failure degrades to (0, 0)."""
+        if self._endpoint_support_cache is not None:
+            return self._endpoint_support_cache
+        total, high = 0, 0
+        try:
+            from sourcecode.repository_ir import extract_java_endpoints
+            data = extract_java_endpoints(self.root)
+            eps = data.get("endpoints", [])
+            total = data.get("total", len(eps))
+            high = sum(1 for e in eps if (e.get("confidence") or "high") == "high")
+        except Exception:
+            total, high = 0, 0
+        self._endpoint_support_cache = (total, high)
+        return self._endpoint_support_cache
+
+    def _qualify_web_pattern(self, arch: Any, arch_line: str, sm: SourceMap) -> str:
+        """BUG #1 (Jenkins field test): the "mvc" pattern is a directory-name
+        heuristic (dirs matching controller/model/view keywords). On a Java/Kotlin
+        repo, do not assert "MVC pattern with ... view layers" in prose when the
+        canonical endpoint extractor finds no HTTP controllers in the same run —
+        Jenkins (Stapler web framework) matches model/view-ish dirs but declares
+        zero Spring MVC controllers. Cross-check against `endpoints` and degrade to
+        a consistent, non-committal phrasing instead of a categorical MVC claim."""
+        if not arch_line or arch.pattern not in ("mvc", "spring_mvc_layered"):
+            return arch_line
+        primary = next((s for s in sm.stacks if s.primary), sm.stacks[0] if sm.stacks else None)
+        if primary is None or primary.stack not in {"java", "kotlin"}:
+            return arch_line
+        _total, high = self._endpoint_support()
+        if high >= _MIN_REST_ENDPOINTS_FOR_LABEL:
+            return arch_line
+        # No controller backing → the MVC/view claim is unverified. Report the
+        # directory-derived layers without the framework label or the "view" claim.
+        layer_names = [l.name for l in arch.layers[:4] if l.name != "view"] if arch.layers else []
+        if layer_names:
+            return (
+                f"Layered code organization ({', '.join(layer_names)}; "
+                f"directory-based — no HTTP controllers detected)."
+            )
+        return ""
+
     def _describe_arch_pattern(self, arch: Any) -> str:
         pattern_labels = {
             "clean": "Clean Architecture",

sourcecode/detectors/java.py

@@ -284,10 +284,43 @@ class JavaDetector(AbstractDetector):
             if parent_artifact == "spring-boot-starter-parent":
                 sb_version = (parent_elem.findtext(f"{ns}version") or "").strip() or None
 
-        text = ElementTree.tostring(root_elem, encoding="unicode").lower()
+        # BUG #1 (Jenkins field test): framework tokens must be matched only inside
+        # genuine dependency / plugin / parent coordinates, never anywhere in the
+        # serialized pom. Jenkins' war/pom.xml lists `<exclude>...:spring-web</exclude>`
+        # and `<exclude>...:spring-aop</exclude>` in an enforcer-plugin bytecode rule
+        # — those are exclusions of transitive artifacts, not declared dependencies.
+        # Serializing the whole tree let them read as "uses Spring MVC / Spring AOP".
+        # Restrict the scan to real dependency/plugin/parent artifact coordinates;
+        # `<exclusion>` and `<exclude>` elements carry neither.
+        text = self._pom_coordinate_text(root_elem, ns)
         frameworks = self._detect_jvm_frameworks(text, "pom.xml", sb_version=sb_version)
         return frameworks
 
+    def _pom_coordinate_text(self, root_elem: ElementTree.Element, ns: str) -> str:
+        """Collect groupId:artifactId coordinates from real dependency, plugin, and
+        parent declarations only. Skips `<exclusion>`/`<exclude>` (transitive-artifact
+        removals) and comments, which must never be read as usage signal."""
+        coords: list[str] = []
+
+        def _coord(elem: ElementTree.Element) -> None:
+            gid = (elem.findtext(f"{ns}groupId") or "").strip()
+            aid = (elem.findtext(f"{ns}artifactId") or "").strip()
+            if aid:
+                coords.append(f"{gid}:{aid}" if gid else aid)
+
+        # <dependency> nodes anywhere (dependencies, dependencyManagement, profiles).
+        # ElementTree never yields <dependency> under <exclusions> (those are
+        # <exclusion>), so exclusion coordinates are structurally excluded.
+        for dep in root_elem.iter(f"{ns}dependency"):
+            _coord(dep)
+        for plugin in root_elem.iter(f"{ns}plugin"):
+            _coord(plugin)
+        parent_elem = root_elem.find(f"{ns}parent")
+        if parent_elem is not None:
+            _coord(parent_elem)
+
+        return "\n".join(coords).lower()
+
     def _frameworks_from_gradle(self, path: Path) -> list[FrameworkDetection]:
         original = "\n".join(read_text_lines(path))
         content = original.lower()
@@ -361,7 +394,12 @@ class JavaDetector(AbstractDetector):
             frameworks.append(FrameworkDetection(name="Thymeleaf", source=source))
         if "freemarker" in text:
             frameworks.append(FrameworkDetection(name="FreeMarker", source=source))
-        if "spring-boot-starter-security" in text or "spring-security-core" in text:
+        if (
+            "spring-boot-starter-security" in text
+            or "spring-security-core" in text
+            or "spring-security-web" in text
+            or "spring-security-config" in text
+        ):
             frameworks.append(FrameworkDetection(name="Spring Security", source=source))
         if "spring-boot-starter-data-jpa" in text or "spring-data-jpa" in text:
             frameworks.append(FrameworkDetection(name="Spring Data JPA", source=source))

sourcecode/hibernate_strat.py

@@ -262,15 +262,33 @@ def _scan_build_dependency(root: Path) -> tuple[bool, list[str]]:
 # ≥ 6 the 5→6 axis does NOT apply (the migration is already done). When it cannot
 # be resolved the axis degrades to a low-confidence hypothesis (no headline).
 _HIB_VER = r"(\d+\.\d+(?:\.\d+)?(?:[.\-][\w]+)*)"  # 6.2.13.Final, 5.6.15, 6.2
+_HIB_VER_ANCHORED = re.compile(r"^" + _HIB_VER + r"$")
 _HIB_PROP_RE = re.compile(
     r"<((?:[\w.\-]*hibernate[\w.\-]*?)\.?version)>\s*" + _HIB_VER + r"\s*</\1>",
     re.IGNORECASE,
 )
-_HIB_COORD_VERSION_RE = re.compile(
-    r"<artifactId>\s*hibernate-(?:core|orm)\s*</artifactId>\s*"
-    r"(?:<[^>]+>[^<]*</[^>]+>\s*)*?<version>\s*" + _HIB_VER,
+# A Hibernate property is ONLY a proxy for the ORM version when it is not the
+# version of a sibling Hibernate artifact (Search, Validator, Envers, OGM, …).
+# Those ship on their own version line (e.g. hibernate-search 6.x on a
+# hibernate-core 5.x project) and must never be mistaken for the ORM version.
+# BUG #1 (v1.70.0): openmrs pinned hibernate-core to 5.6.15 via ${hibernateVersion}
+# while ${hibernateSearchVersion}=6.2.4 — the old "newest wins" scan picked the
+# Search version and declared the project already on Hibernate 6.
+_HIB_NON_CORE_PROP_RE = re.compile(
+    r"search|validator|envers|ogm|reactive|spatial|jpamodelgen|"
+    r"jpa-?model|gradle|tool|commons|metamodel",
+    re.IGNORECASE,
+)
+# Anchor: capture the <version> declared inside the hibernate-core/orm
+# <dependency> block (the value may be a literal or a ${property} reference).
+_HIB_CORE_DEP_RE = re.compile(
+    r"<dependency>(?P<body>(?:(?!</dependency>).)*?"
+    r"<artifactId>\s*hibernate-(?:core|orm)\s*</artifactId>"
+    r"(?:(?!</dependency>).)*?)</dependency>",
     re.IGNORECASE | re.DOTALL,
 )
+_VERSION_TAG_RE = re.compile(r"<version>\s*([^<]+?)\s*</version>", re.IGNORECASE)
+_PROP_REF_RE = re.compile(r"^\$\{([^}]+)\}$")
 _HIB_GRADLE_VERSION_RE = re.compile(
     r"org\.hibernate(?:\.orm)?:hibernate-(?:core|orm):" + _HIB_VER,
     re.IGNORECASE,
@@ -290,37 +308,88 @@ def _ver_key(full: str) -> tuple[int, int]:
     return (major, minor)
 
 
+def _lookup_maven_property(texts: list[str], name: str) -> Optional[str]:
+    """Resolve a single Maven property by exact tag name across build files."""
+    pat = re.compile(
+        r"<" + re.escape(name) + r">\s*([^<]+?)\s*</" + re.escape(name) + r">",
+        re.IGNORECASE,
+    )
+    for t in texts:
+        m = pat.search(t)
+        if m:
+            return m.group(1).strip()
+    return None
+
+
+def _resolve_version_expr(texts: list[str], expr: str, depth: int = 0) -> Optional[str]:
+    """Resolve a <version> value that may be a literal or a ${property} chain."""
+    expr = expr.strip()
+    ref = _PROP_REF_RE.match(expr)
+    if ref:
+        if depth > 5:
+            return None
+        val = _lookup_maven_property(texts, ref.group(1))
+        if val is None:
+            return None
+        return _resolve_version_expr(texts, val, depth + 1)
+    return expr if _HIB_VER_ANCHORED.match(expr) else None
+
+
 def _resolve_hibernate_version(root: Path) -> tuple[Optional[str], Optional[int], str]:
     """Return (full_version_string, major, confidence) for the effective Hibernate.
 
-    confidence is "high" when a version was resolved from a build descriptor,
-    "none" when none could be determined (degrade to hypothesis). The newest
-    declared Hibernate wins in a multi-module build.
+    Resolution order (BUG #1 — never trust a same-named-but-different artifact):
+      1. The <version> anchored to the hibernate-core / hibernate-orm dependency
+         (literal, or a ${property} resolved to that specific property), and the
+         Gradle org.hibernate(.orm):hibernate-(core|orm) coordinate. HIGH conf.
+      2. Fallback: a <hibernate*version> property that is NOT a sibling-artifact
+         version (Search/Validator/Envers/…). HIGH conf.
+      3. None resolvable → degrade to hypothesis (confidence "none").
+    The newest qualifying version wins in a multi-module build.
     """
     import os
-    best_full: Optional[str] = None
+    texts: list[str] = []
     for dirpath, dirnames, filenames in os.walk(root):
         dirnames[:] = [d for d in dirnames if d not in _SKIP_BUILD_SCAN_DIRS]
         for fname in filenames:
             if fname not in _BUILD_FILE_NAMES:
                 continue
             try:
-                text = (Path(dirpath) / fname).read_text(encoding="utf-8", errors="replace")
+                texts.append(
+                    (Path(dirpath) / fname).read_text(encoding="utf-8", errors="replace")
+                )
             except OSError:
                 continue
-            fulls: list[str] = []
-            for m in _HIB_PROP_RE.finditer(text):
-                fulls.append(m.group(2))
-            for m in _HIB_COORD_VERSION_RE.finditer(text):
-                fulls.append(m.group(1))
-            for m in _HIB_GRADLE_VERSION_RE.finditer(text):
-                fulls.append(m.group(1))
-            for full in fulls:
-                if best_full is None or _ver_key(full) > _ver_key(best_full):
-                    best_full = full
-    if best_full is None:
+    if not texts:
         return None, None, "none"
-    return best_full, _ver_key(best_full)[0], "high"
+
+    # 1. Anchored to the hibernate-core / hibernate-orm coordinate.
+    anchored: list[str] = []
+    for text in texts:
+        for dep in _HIB_CORE_DEP_RE.finditer(text):
+            vm = _VERSION_TAG_RE.search(dep.group("body"))
+            if vm:
+                resolved = _resolve_version_expr(texts, vm.group(1))
+                if resolved:
+                    anchored.append(resolved)
+        for m in _HIB_GRADLE_VERSION_RE.finditer(text):
+            anchored.append(m.group(1))
+    if anchored:
+        best = max(anchored, key=_ver_key)
+        return best, _ver_key(best)[0], "high"
+
+    # 2. Fallback: a Hibernate *property* that is not a sibling-artifact version.
+    prop_cands: list[str] = []
+    for text in texts:
+        for m in _HIB_PROP_RE.finditer(text):
+            if _HIB_NON_CORE_PROP_RE.search(m.group(1)):
+                continue
+            prop_cands.append(m.group(2))
+    if prop_cands:
+        best = max(prop_cands, key=_ver_key)
+        return best, _ver_key(best)[0], "high"
+
+    return None, None, "none"
 
 # Escalation markers — dynamic / reflection-based persistence construction.
 _ABSTRACTION_CLASS_RE = re.compile(
@@ -495,7 +564,13 @@ class HibernateStratification:
             "classification": self.classification,
             "classification_label": self.classification_label,
             "stratified": True,
-            "hibernate_readiness": self.readiness,
+            # BUG #1 (v1.70.0): renamed from "hibernate_readiness" to avoid a
+            # same-name contradiction with the document-level migrate-check field.
+            # This is the RAW 5→6 rewrite-zone readiness (independent of whether the
+            # axis applies). The authoritative, applicability-gated migration score
+            # lives at the document root as "hibernate_readiness"; consult that one
+            # for decisions. They diverge by design when the axis is N/A.
+            "rewrite_zone_readiness": self.readiness,
             "risk_matrix": [r.to_dict() for r in self.risk_matrix],
             "module_exposure_map": self.module_exposure,
             "incompatible_patterns": self.incompatible_patterns,

sourcecode/integration_detector.py

@@ -58,6 +58,13 @@ _ATTR_URL_RE = re.compile(r'url\s*=\s*"([^"]*)"')
 _ATTR_NAME_RE = re.compile(r'(?:name|value)\s*=\s*"([^"]*)"')
 _FIRST_LITERAL_RE = re.compile(r'^\s*"([^"]*)"')
 
+# BUG #5 (Jenkins field test): thresholds for the structured coverage_confidence
+# signal. A repo at/above _LARGE_REPO_FILE_THRESHOLD source files with fewer than
+# _LOW_COVERAGE_COUNT recognized integration constructs is flagged "low" coverage —
+# the count almost certainly under-represents custom-protocol/SPI integrations.
+_LARGE_REPO_FILE_THRESHOLD: int = 300
+_LOW_COVERAGE_COUNT: int = 10
+
 # token -> (kind, client). Matched as whole-word usage outside imports/comments.
 # Covers Spring AND plain-Java/Jakarta stacks (Quarkus, Micronaut, Keycloak SPI):
 # the detector must not be Spring-centric, or a non-Spring repo with real LDAP /
@@ -200,6 +207,27 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
         has_mail_import = bool(_MAIL_IMPORT_RE.search(text))
         naming_factory = _classify_naming_factory(text)
 
+        # BUG #3 (v1.70.0): "HttpClient" is a simple name that collides with
+        # user-defined classes (e.g. org.openmrs.util.HttpClient, a thin wrapper over
+        # java.net.HttpURLConnection — a completely different API from the JDK 11+
+        # java.net.http.HttpClient). Resolve the JDK client by its FULLY-QUALIFIED
+        # import, never by the bare class name. When the file imports/declares a
+        # different HttpClient (or none can be resolved), degrade to a low-confidence
+        # "custom-http-wrapper" rather than asserting a JDK client that isn't there.
+        import_fqns = set(
+            re.findall(r"^\s*import\s+(?:static\s+)?([\w.]+)\s*;", text, re.MULTILINE)
+        )
+        http_jdk_imported = (
+            "java.net.http.HttpClient" in import_fqns or "java.net.http.*" in import_fqns
+        )
+        declares_own_httpclient = bool(
+            re.search(r"\b(?:class|interface|enum)\s+HttpClient\b", text)
+        )
+        http_other_import = any(
+            fqn.endswith(".HttpClient") and not fqn.startswith("java.net.http.")
+            for fqn in import_fqns
+        )
+
         # Token clients — per line, skipping imports/package/comment noise.
         # First pass records the declaration site and any variable name bound to
         # the client, so a later call site (where the URL literal usually lives)
@@ -241,6 +269,27 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
                         kind, client, confidence = (
                             "naming-directory-unknown", "jndi-dircontext", "low",
                         )
+                # BUG #3: resolve the ambiguous bare "HttpClient" by its import, and
+                # suppress pure type-declaration sites (field / parameter / return
+                # type) — only a construction or static call is a real network site.
+                if client == "jdk-httpclient":
+                    if not (http_jdk_imported and not declares_own_httpclient):
+                        # Not the JDK client (own class, third-party, or unresolvable).
+                        client, confidence = "custom-http-wrapper", "low"
+                        if declares_own_httpclient or http_other_import:
+                            confidence = "low"
+                    is_construction = bool(
+                        re.search(r"\bnew\s+HttpClient\b", line)
+                    ) or bool(re.search(r"\bHttpClient\s*\.", line))
+                    if not is_construction:
+                        # Type-declaration only (e.g. `HttpClient field;`,
+                        # `void setX(HttpClient c)`): track the var for the URL
+                        # second pass but do NOT emit it as an invocation site.
+                        tok = m.group(0)
+                        decl = re.search(re.escape(tok) + r"\s+(\w+)\b", line)
+                        if decl:
+                            var_to_client[decl.group(1)] = (kind, client)
+                        continue
                 _add(kind, client, _extract_target(line), rel, lineno, confidence)
                 tok = m.group(0)
                 # `Type name` (field/local decl) and `name = new Type(` forms.
@@ -274,11 +323,50 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
     # clients (DI, config-driven endpoints, JCA connectors) are invisible to static
     # text matching. Report that explicitly instead of an authoritative "0".
     confidence = "observed" if records else "not_analyzed"
+
+    # BUG #5 (Jenkins field test): the coverage caveat lived only inside the prose
+    # `coverage_note`. Propagate it as a STRUCTURED signal so an automated consumer
+    # does not read a low `count` as "low external coupling". A large repo with few
+    # recognized constructs (Jenkins: custom remoting/SCM/Update-Center SPIs, not
+    # RestTemplate/WebClient) is under-counted, not loosely coupled.
+    _repo_size = len(file_paths)
+    _large_repo = _repo_size >= _LARGE_REPO_FILE_THRESHOLD
+    if not records:
+        coverage_confidence = "low"
+        _cov_reason = (
+            "no recognized client-library construct found; custom protocol/SPI-based "
+            "or DI-wired integrations are not statically detectable by this analyzer. "
+            "A count of 0 does not imply the system has no outbound integrations."
+        )
+    elif _large_repo and len(records) < _LOW_COVERAGE_COUNT:
+        coverage_confidence = "low"
+        _cov_reason = (
+            f"only {len(records)} recognized construct(s) across {_repo_size} source "
+            "files; count reflects only recognized client-library patterns "
+            "(RestTemplate/WebClient/JDK/Apache/OkHttp/LDAP/JMS/…). Custom protocol/"
+            "SPI-based integrations are likely under-counted — do not read a low count "
+            "as low external coupling."
+        )
+    elif len(records) < _LOW_COVERAGE_COUNT:
+        coverage_confidence = "partial"
+        _cov_reason = (
+            "recognized client-library constructs detected; custom protocol/SPI-based "
+            "or DI-wired integrations, if any, are not statically visible."
+        )
+    else:
+        coverage_confidence = "high"
+        _cov_reason = (
+            "recognized client-library constructs cover the observable integration "
+            "surface; runtime/DI-wired clients remain out of static scope."
+        )
+
     return {
         "integrations": records,
         "by_kind": {k: by_kind[k] for k in sorted(by_kind)},
         "count": len(records),
         "confidence": confidence,
+        "coverage_confidence": coverage_confidence,
+        "coverage_confidence_reason": _cov_reason,
         "coverage_note": (
             "Detects HTTP (RestTemplate/WebClient/JDK/Apache/OkHttp), LDAP (Spring "
             "+ JNDI), DNS (JNDI DirContext w/ DnsContextFactory), SMTP (JavaMail, "

sourcecode/migrate_check.py

@@ -652,6 +652,13 @@ def _classify_code_context(finding: "MigrationFinding") -> str:
         imp.rsplit(".", 1)[-1] == "Generated" for imp in finding.imports_found
     ):
         return "generated"
+    # BUG #3 (Jenkins field test): a namespace-migration finding (javax→jakarta,
+    # e.g. javax.servlet) on a class-level @Deprecated type is a frozen-legacy
+    # compatibility shim — kept for binary compat, with a live replacement elsewhere
+    # (Jenkins ChainedServletFilter → ChainedServletFilter2). Not an active blocker:
+    # segregate it out of blocking_count like test/generated, with its own label.
+    if finding.enclosing_deprecated and finding.migration_target in _JAKARTA_TARGETS:
+        return "deprecated_shim"
     return "main"
 
 
@@ -1181,6 +1188,11 @@ class MigrationFinding:
     # harness), or "generated" (autogenerated source). Only "main" counts toward
     # blocking_count / readiness; test+generated are reported in a separate bucket.
     code_context: str = "main"
+    # BUG #3 (Jenkins field test): the enclosing top-level TYPE carries a class-level
+    # @Deprecated annotation. A namespace-migration finding on such a class is a
+    # frozen-legacy compatibility shim (kept for binary compat, replaced elsewhere),
+    # not an active migration blocker — reclassified out of blocking_count.
+    enclosing_deprecated: bool = False
 
     @staticmethod
     def make_id(rule_id: str, source_file: str) -> str:
@@ -1287,12 +1299,19 @@ class MigrationReport:
     readiness_aggregate: dict = field(default_factory=dict)
     blocking_count: int = 0
     estimated_effort_days: float = 0.0
+    effort_breakdown: dict = field(default_factory=dict)
     # Tri-state: True = Boot 2 confirmed, False = Boot 3+ confirmed,
     # None = could not determine. Absence of evidence is never reported as True.
     spring_boot_2_detected: Optional[bool] = None
     spring_boot_version_detected: Optional[str] = None
     # BUG #2: whether Spring is used AT RUNTIME. The Boot3 dimension is N/A without it.
     spring_present: bool = True
+    # BUG #2 (Jenkins field test): whether the repo is a Spring BOOT application
+    # (spring-boot* coordinate / @SpringBootApplication), as opposed to merely having
+    # a Spring library (e.g. spring-security-web) on the classpath. The boot3 (Boot
+    # 2→3) migration dimension is applicable ONLY to Boot repos — a non-Boot Spring
+    # repo has no Boot upgrade axis and must not receive a contaminated readiness.
+    spring_boot_present: bool = False
     # BUG #1/#2: Spring appears ONLY as a test dependency (e.g. spring-test). Reported
     # so a consumer can see WHY boot3 is N/A despite an org.springframework coordinate.
     spring_test_only: bool = False
@@ -1365,7 +1384,19 @@ class MigrationReport:
         self.jakarta_readiness = _dimension_score(main_findings, _JAKARTA_TARGETS)
         self.boot3_readiness = _dimension_score(main_findings, _BOOT3_MIGRATION_TARGETS)
         self.jdk_modernization = _dimension_score(main_findings, None)
-        if not self.spring_present:
+        # BUG #2 (Jenkins field test): the boot3 axis applies only with POSITIVE
+        # evidence — a Spring BOOT repo (spring-boot* coordinate / @SpringBootApplication),
+        # OR a concrete Boot-3 / Security-6 migration finding in main code. A repo that
+        # merely carries a Spring library (spring-security-web) with no Boot and no
+        # Boot/Security migration findings (Jenkins) has no boot3 axis — jakarta-shaped
+        # findings must not masquerade as a boot3 readiness deficit. Note: jakarta
+        # findings do NOT make boot3 applicable; only genuine boot3/security-6 targets do.
+        _boot3_migration_findings = any(
+            f.migration_target in (_BOOT3_MIGRATION_TARGETS - _JAKARTA_TARGETS)
+            for f in main_findings
+        )
+        _boot3_applies = self.spring_boot_present or _boot3_migration_findings
+        if not _boot3_applies:
             self.boot3_readiness = 100
 
         # BUG #3/#4: the jakarta dimension is applicable ONLY with POSITIVE evidence the
@@ -1441,14 +1472,23 @@ class MigrationReport:
                            else "N/A — no migratable javax.* imports detected"),
             },
             "boot3": {
-                "applicable": self.spring_present,
-                "score": self.boot3_readiness if self.spring_present else None,
-                "reason": ("Spring Boot 2→3 / Security 6 migration"
-                           if self.spring_present
-                           else ("N/A — Spring present only as a TEST dependency "
-                                 "(spring-test); no runtime Spring"
-                                 if self.spring_test_only
-                                 else "N/A — no Spring usage detected (non-Spring stack)")),
+                "applicable": _boot3_applies,
+                "score": self.boot3_readiness if _boot3_applies else None,
+                "reason": (
+                    "Spring Boot 2→3 / Security 6 migration"
+                    if self.spring_boot_present
+                    else "Spring Security 6 migration (spring_security_6 / spring_boot_3 "
+                         "findings present) — no Spring Boot detected"
+                    if _boot3_applies
+                    else "N/A — Spring present only as a TEST dependency (spring-test); "
+                         "no runtime Spring, no Spring Boot"
+                    if self.spring_test_only
+                    else "N/A — Spring library on the classpath but no spring-boot "
+                         "dependency / @SpringBootApplication and no Boot/Security-6 "
+                         "migration finding — not a Spring Boot application"
+                    if self.spring_present
+                    else "N/A — no Spring usage detected (non-Spring stack)"
+                ),
             },
             "jdk_modernization": {"applicable": True, "score": self.jdk_modernization,
                                   "reason": "orthogonal JDK modernization debt (excluded from "
@@ -1499,13 +1539,32 @@ class MigrationReport:
 
         # BUG #5: effort over MAIN findings only — N/A axes (Hibernate-6 phantom,
         # test fixtures) no longer pad the estimate.
-        self.estimated_effort_days = round(
+        _file_effort = (
             len(critical_files) * 0.5
             + len(high_files) * 0.25
             + len(medium_files) * 0.1
-            + len(low_files) * 0.05,
-            1,
+            + len(low_files) * 0.05
         )
+        # BUG #1 (v1.70.0): when the Hibernate 5→6 axis APPLIES, fold its measured
+        # rewrite effort (risk_matrix → total_effort_range_days) into the headline
+        # estimate. Previously a Hibernate-5 project whose ${hibernateVersion} was
+        # misread as 6 set migration_applicable=False, which silently DROPPED this
+        # 28.9–95.6 person-day range from estimated_effort_days, under-reporting the
+        # real cost 1.5–2.6×. We add the range midpoint and expose the breakdown.
+        _hib_effort = 0.0
+        if _hibernate_applies and hib is not None:
+            _r = hib.total_effort_range_days or {}
+            _lo, _hi = _r.get("low"), _r.get("high")
+            if isinstance(_lo, (int, float)) and isinstance(_hi, (int, float)):
+                _hib_effort = (float(_lo) + float(_hi)) / 2.0
+        self.estimated_effort_days = round(_file_effort + _hib_effort, 1)
+        self.effort_breakdown = {
+            "findings_effort_days": round(_file_effort, 1),
+            "hibernate_rewrite_effort_days": round(_hib_effort, 1),
+            "hibernate_rewrite_range": (
+                hib.total_effort_range_days if (_hibernate_applies and hib is not None) else None
+            ),
+        }
 
         # BUG #6 / #8: hygiene + non-blocking buckets, surfaced separately.
         self.hygiene_findings = sum(
@@ -1522,8 +1581,11 @@ class MigrationReport:
             "count": sum(_nb_by_ctx.values()),
             "by_context": _nb_by_ctx,
             "by_rule": _nb_by_rule,
-            "note": ("Findings in test/fixture harnesses or autogenerated sources. "
-                     "Excluded from blocking_count, readiness, and effort."),
+            "note": ("Findings in test/fixture harnesses, autogenerated sources, or "
+                     "class-level @Deprecated frozen-legacy shims (code_context="
+                     "\"deprecated_shim\" — kept for binary compat with a live "
+                     "replacement; verify before removing). Excluded from "
+                     "blocking_count, readiness, and effort."),
         }
 
         self.summary = {
@@ -1561,9 +1623,11 @@ class MigrationReport:
             "headline_blocker": self.headline_blocker,
             "blocking_count": self.blocking_count,
             "estimated_effort_days": self.estimated_effort_days,
+            "effort_breakdown": self.effort_breakdown,
             "hygiene_findings": self.hygiene_findings,
             "non_blocking": self.non_blocking,
             "spring_present": self.spring_present,
+            "spring_boot_present": self.spring_boot_present,
             "spring_test_only": self.spring_test_only,
             "spring_boot_2_detected": self.spring_boot_2_detected,
             "spring_boot_version_detected": self.spring_boot_version_detected,
@@ -1725,12 +1789,35 @@ def _neutralize_non_spring_explanation(text: str) -> str:
     return text
 
 
+# BUG #3 (Jenkins field test): the primary top-level type declaration in a .java
+# file. Used to test whether a class-level @Deprecated annotation precedes it.
+_PRIMARY_TYPE_DECL_RE: re.Pattern = re.compile(
+    r"(?m)^[ \t]*(?:public\s+|final\s+|abstract\s+|sealed\s+|non-sealed\s+|strictfp\s+)*"
+    r"(?:class|interface|enum|record)\s+\w"
+)
+
+
+def _primary_type_is_deprecated(source: str) -> bool:
+    """True iff the file's primary top-level type carries a class-level @Deprecated
+    annotation. Scoped to the region between the last import and the type keyword so
+    a @Deprecated on a METHOD (below the class declaration) never counts — that is a
+    live class with a deprecated member, not a frozen-legacy shim."""
+    m = _PRIMARY_TYPE_DECL_RE.search(source)
+    if not m:
+        return False
+    head = source[: m.start()]
+    last_import = head.rfind("\nimport ")
+    window = head[last_import:] if last_import != -1 else head
+    return "@Deprecated" in window
+
+
 def _scan_file(
     source: str,
     rel_path: str,
     rules: list[_Rule],
 ) -> list[MigrationFinding]:
     findings: list[MigrationFinding] = []
+    type_deprecated = _primary_type_is_deprecated(source)
 
     for rule in rules:
         matched_imports: list[str] = []
@@ -1799,6 +1886,7 @@ def _scan_file(
                 fix_hint=rule.fix_hint,
                 migration_target=rule.migration_target,
                 openrewrite_recipe=rule.openrewrite_recipe,
+                enclosing_deprecated=type_deprecated,
             )
         )
 
@@ -1920,6 +2008,7 @@ def run_migrate_check(
     spring_present, spring_test_only = _detect_spring_usage(
         root, spring_runtime_import_seen, spring_test_import_seen
     )
+    spring_boot_present = _detect_spring_boot_present(root)
 
     # BUG #8: classify each finding's code context (main / test / generated) so the
     # report can keep test fixtures and autogenerated sources out of blocking_count.
@@ -1944,6 +2033,7 @@ def run_migrate_check(
         spring_boot_2_detected=spring_boot_2,
         spring_boot_version_detected=spring_boot_version,
         spring_present=spring_present,
+        spring_boot_present=spring_boot_present,
         spring_test_only=spring_test_only,
         jakarta_namespace_adopted=jakarta_import_count > 0,
         findings=all_findings,
@@ -2044,6 +2134,46 @@ def _extract_boot_versions(text: str) -> tuple[set[int], Optional[str]]:
     return majors, full
 
 
+# BUG #2 (Jenkins field test): strip XML comments and exclusion/exclude blocks
+# before scanning for a spring-boot coordinate, so a `<exclude>...:spring-boot</…>`
+# or a comment never reads as "this repo uses Spring Boot" — the same exclusion
+# poison that produced phantom Spring MVC/AOP in framework detection.
+_XML_COMMENT_RE: re.Pattern = re.compile(r"<!--.*?-->", re.DOTALL)
+_XML_EXCLUSION_EL_RE: re.Pattern = re.compile(r"<exclusion\b.*?</exclusion\s*>", re.DOTALL | re.IGNORECASE)
+_XML_EXCLUDE_EL_RE: re.Pattern = re.compile(r"<exclude\b.*?</exclude\s*>", re.DOTALL | re.IGNORECASE)
+# A spring-boot* Maven/Gradle artifact coordinate (starter, BOM, dependency, plugin).
+_SPRING_BOOT_ARTIFACT_RE: re.Pattern = re.compile(r"\bspring-boot(?:-[a-z0-9.\-]+)?\b", re.IGNORECASE)
+
+
+def _strip_xml_exclusions(text: str) -> str:
+    """Remove XML comments and exclusion/exclude elements so their coordinates are
+    not mistaken for declared dependencies."""
+    text = _XML_COMMENT_RE.sub(" ", text)
+    text = _XML_EXCLUSION_EL_RE.sub(" ", text)
+    text = _XML_EXCLUDE_EL_RE.sub(" ", text)
+    return text
+
+
+def _detect_spring_boot_present(root: Path) -> bool:
+    """True iff there is POSITIVE Spring Boot evidence — a spring-boot* build
+    coordinate (parent / BOM / dependency / plugin) or the Spring Boot Gradle
+    plugin. Distinguishes a Spring Boot application from a repo that merely has a
+    Spring library on the classpath (e.g. Jenkins' spring-security-web). Gates the
+    boot3 (Boot 2→3) migration dimension. @SpringBootApplication is not scanned
+    separately: its annotation class ships in spring-boot-autoconfigure, so a Boot
+    app always carries a spring-boot* coordinate."""
+    for abs_path, _rel in _find_build_files(root):
+        try:
+            text = abs_path.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        if _SPRING_BOOT_PLUGIN_RE.search(text):
+            return True
+        if _SPRING_BOOT_ARTIFACT_RE.search(_strip_xml_exclusions(text)):
+            return True
+    return False
+
+
 def _detect_spring_boot(root: Path, jakarta_import_count: int) -> tuple[Optional[bool], Optional[str]]:
     """Tri-state Spring Boot 2 detection. Returns (spring_boot_2_detected, version).
 

sourcecode/repository_ir.py

@@ -2872,12 +2872,35 @@ def _assemble(
     else:
         _security_model_asm = "unknown"
 
+    # BUG #4 (Jenkins field test): the bare "unknown" string carried no reason or
+    # sub-structure — inconsistent with the not_detected+reason pattern used
+    # elsewhere (migrate-check hibernate). Emit a structured companion so a consumer
+    # sees WHY, and never reads "unknown" as "unsecured". A repo with a custom
+    # security SPI (Jenkins ACL/SecurityRealm) simply matched no RECOGNIZED pattern.
+    _security_model_detail_asm = {
+        "model": _security_model_asm,
+        "status": "detected" if _security_model_asm != "unknown" else "not_detected",
+        "spring_security_filter_chain_detected": _filter_based_asm,
+        "annotation_policies_detected": _has_ann_sec_asm,
+        "custom_spi_detected": [],
+        "reason": (
+            "recognized security model: " + _security_model_asm
+            if _security_model_asm != "unknown"
+            else "N/A — no Spring Security filter chain, no annotation-based policy, "
+                 "and no recognized custom security SPI matched. Absence of a "
+                 "recognized pattern is not evidence the repo is unsecured — it may "
+                 "use a framework-specific or custom access-control model this "
+                 "analyzer does not model."
+        ),
+    }
+
     return {
         **_base,
         "route_surface": _route_surface,
         "spring_events": _spring_events,
         "analysis_gaps": _analysis_gaps,
         "security_model": _security_model_asm,
+        "security_model_detail": _security_model_detail_asm,
         "audit": {
             "dropped_fields": dropped_fields,
         },
@@ -3510,6 +3533,15 @@ def build_repo_ir(
             ir["security_model"] = "xml_or_filter_chain"
         elif _sec_model in ("annotation_based", "mixed"):
             ir["security_model"] = "mixed"
+        # BUG #4: keep the structured detail consistent with the rewritten string.
+        _detail = ir.get("security_model_detail")
+        if isinstance(_detail, dict):
+            _detail["model"] = ir["security_model"]
+            _detail["status"] = "detected"
+            _detail["spring_security_filter_chain_detected"] = True
+            _detail["reason"] = ("XML/filter-chain security configuration detected "
+                                 "(declarative filter mapping in web.xml or Spring "
+                                 "security XML)")
         # Retag route_surface entries that have no security (would become none_detected in CIR)
         for _r in ir.get("route_surface") or []:
             _r_sec = _r.get("security_annotations")

sourcecode/spring_impact.py

@@ -121,6 +121,8 @@ class ImpactChainResult:
     resolution: str = "not_found"              # "exact" | "class_expanded" | "partial" | "not_found"
     direct_callers: list[str] = field(default_factory=list)
     indirect_callers: list[str] = field(default_factory=list)
+    # BUG #2: count of own-class members dropped from callers (members, not callers).
+    self_referential_excluded: int = 0
     implementations: list[str] = field(default_factory=list)  # in-repo subtypes of queried interface/base
     endpoints_affected: list[AffectedEndpoint] = field(default_factory=list)
     transaction_boundary: Optional[dict] = None   # TransactionBoundary.to_dict() or None
@@ -144,6 +146,7 @@ class ImpactChainResult:
             "resolution": self.resolution,
             "direct_callers": self.direct_callers,
             "indirect_callers": self.indirect_callers,
+            "self_referential_excluded": self.self_referential_excluded,
             "implementations": self.implementations,
             "endpoints_affected": [ep.to_dict() for ep in self.endpoints_affected],
             "transaction_boundary": self.transaction_boundary,
@@ -471,6 +474,15 @@ def _bfs_callers(
     indirect: list[str] = []
     was_truncated = False
 
+    # BUG #2 (v1.70.0): a class's OWN members are not "callers" of that class — they
+    # are members. When the seed is a class node, _edges_for folds in every method
+    # key of that class, so internal method→method calls (e.g.
+    # ConceptServiceImpl#purgeConcept → ConceptServiceImpl#saveConcept) were leaking
+    # into direct_callers and inflating the blast radius ~12×. Exclude any caller
+    # whose owning class is one of the seed classes.
+    seed_classes: set[str] = {normalize_owner_fqn(s) for s in seed_fqns}
+    self_excluded: int = 0
+
     # BUG-004: index class FQN → list of method-level keys in reverse_graph.
     # Callers of Foo#doWork are stored under reverse_graph["Foo#doWork"], never
     # under reverse_graph["Foo"].  Without this index, BFS silently terminates
@@ -506,7 +518,9 @@ def _bfs_callers(
     for seed in seed_fqns:
         for etype, fqn_list in _edges_for(seed):
             if etype not in _SKIP_EDGE_TYPES:
-                unique_direct_callers.update(fqn_list)
+                unique_direct_callers.update(
+                    c for c in fqn_list if normalize_owner_fqn(c) not in seed_classes
+                )
 
     effective_depth = 1 if len(unique_direct_callers) > _BFS_CALLER_CAP else max_depth
     if effective_depth < max_depth:
@@ -516,8 +530,14 @@ def _bfs_callers(
     queue: list[tuple[str, int]] = [(s, 0) for s in seed_fqns]
 
     def _add_caller(caller: str, depth: int) -> None:
+        nonlocal self_excluded
         if caller in visited:
             return
+        # BUG #2: a member of a seed class is not an external caller — drop it.
+        if normalize_owner_fqn(caller) in seed_classes:
+            visited.add(caller)
+            self_excluded += 1
+            return
         visited.add(caller)
         if depth == 0:
             direct.append(caller)
@@ -542,7 +562,7 @@ def _bfs_callers(
                 else:
                     _add_caller(caller, depth)
 
-    return direct, indirect, was_truncated
+    return direct, indirect, was_truncated, self_excluded
 
 
 # ---------------------------------------------------------------------------
@@ -888,9 +908,15 @@ class ImpactOrchestrator:
                 )
 
         # ── 2. BFS through reverse graph ─────────────────────────────────
-        direct_callers, indirect_callers, truncated = _bfs_callers(
+        direct_callers, indirect_callers, truncated, self_excluded = _bfs_callers(
             seed_fqns, cir.reverse_graph, depth, impl_graph=impl_graph
         )
+        if self_excluded:
+            warnings.append(
+                f"Self-referential exclusion (BUG #2): {self_excluded} member(s) of the "
+                f"analyzed class were dropped from callers — a class's own methods are "
+                f"members, not external callers (they do not count toward blast radius)."
+            )
         if truncated:
             warnings.append(
                 "Hub-class guard active: symbol has > 500 direct callers — "
@@ -1083,6 +1109,7 @@ class ImpactOrchestrator:
             resolution=resolution,
             direct_callers=direct_callers,
             indirect_callers=indirect_callers,
+            self_referential_excluded=self_excluded,
             implementations=sorted(subtype_classes_added),
             endpoints_affected=endpoints_affected,
             transaction_boundary=tx_boundary,

{sourcecode-1.69.0.dist-info → sourcecode-1.71.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.69.0
+Version: 1.71.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -411,7 +411,7 @@ Emits **structured, tool-agnostic** codebase views as plain JSON/YAML — the ki
 |------|--------|
 | `--by-directory` | One group per source directory, each symbol with a `source_file:line` reference. |
 | `--module-graph` | `{nodes, edges, summary}` — directories as modules, inter-module dependencies rolled up from class-level relation edges with hit counts + edge types. |
-| `--integrations` | Outbound integrations across Spring **and** plain-Java/Jakarta stacks: HTTP (`RestTemplate`, `WebClient`, `@FeignClient`, JDK `HttpClient`, Apache, OkHttp), LDAP (`LdapTemplate`, JNDI `InitialDirContext`/`LdapContext`), SMTP (`JavaMailSender`, JavaMail `Transport`/`MimeMessage`), and JMS — with `file:line` evidence and a literal `target` when present. Emits an explicit `confidence` (`observed` / `not_analyzed`) + `coverage_note`: a count of `0` means "no client construct found", **not** "no integrations" (runtime/DI-wired clients are not statically visible). |
+| `--integrations` | Outbound integrations across Spring **and** plain-Java/Jakarta stacks: HTTP (`RestTemplate`, `WebClient`, `@FeignClient`, JDK `HttpClient`, Apache, OkHttp), LDAP (`LdapTemplate`, JNDI `InitialDirContext`/`LdapContext`), SMTP (`JavaMailSender`, JavaMail `Transport`/`MimeMessage`), and JMS — with `file:line` evidence and a literal `target` when present. Emits an explicit `confidence` (`observed` / `not_analyzed`), a structured `coverage_confidence` (`low` / `partial` / `high`) with `coverage_confidence_reason`, and a prose `coverage_note`: a count of `0` — or a low count on a large repo (≥300 files, <10 constructs) — is flagged `low`, so a low count is never read as low external coupling (custom protocol/SPI clients are not statically visible). |
 | `--c4` | Unified document: `c4.{context, containers, components, code}` + `api_surface` + a `manifest` with per-directory content hashes for **incremental** consumers (skip directories whose hash is unchanged). `components.module_roots` rolls leaf source dirs up to architectural module roots and classifies each `layered` (DDD: ≥2 of `domain`/`application`/`infrastructure`) vs `flat` (legacy/flat package), with a verifiable `module_count` — so a consumer enumerates real modules instead of inferring boundaries from leaf directories. |
 
 The section flags compose (pass several for one multi-section document); `--c4` assembles the full export on its own. URLs assembled at runtime yield `target: null` (honest absence, never a guess); containers are derived from build files (Maven/Gradle) and reported as a limitation when none are found.
@@ -734,9 +734,20 @@ evidence. `migrate-check` enforces:
   `hibernate_rewrite` headline. An **unresolved** version degrades to a
   low-confidence hypothesis with no headline blocker. See
   `hibernate.effective_version` / `version_major` / `version_confidence`.
-- **Boot3 auto-disables without Spring.** `boot3.applicable` tracks real Spring
-  usage; Quarkus / Micronaut / Helidon / Jakarta-pure repos report `boot3` as N/A
-  (`spring_present: false`), not a contradictory `applicable: true`.
+- **Boot3 needs Spring _Boot_, not just Spring.** `boot3.applicable` requires
+  positive Spring Boot evidence — a `spring-boot*` coordinate / Gradle plugin (or
+  `@SpringBootApplication`), **or** a concrete `spring_boot_3` / `spring_security_6`
+  finding. A repo that merely carries a Spring library (e.g. `spring-security-web`
+  with no Boot — Jenkins core) reports `boot3` as N/A with a reason and is excluded
+  from the aggregate; `spring_present: true` but `spring_boot_present: false`. Quarkus
+  / Micronaut / Helidon / Jakarta-pure repos likewise report `boot3` N/A. jakarta
+  findings alone never enable boot3.
+- **Frozen-legacy `@Deprecated` shims aren't blockers.** A `javax→jakarta` finding
+  on a **class-level `@Deprecated`** type (kept for binary compat, replaced
+  elsewhere) is classified `code_context: "deprecated_shim"` and excluded from
+  `blocking_count` / readiness / effort — surfaced under `non_blocking` with a
+  "verify before removing" note. A `@Deprecated` **method** on a live class still
+  blocks.
 - **Permanent `javax.*` are never jakarta debt.** JDK/JSR namespaces
   (`javax.cache`, `javax.sql`, `javax.xml` JAXP, `javax.crypto`, `javax.naming`,
   `javax.management`, `javax.security.auth`, `javax.annotation.processing`, …) are

{sourcecode-1.69.0.dist-info → sourcecode-1.71.0.dist-info}/RECORD

@@ -1,7 +1,7 @@
-sourcecode/__init__.py,sha256=mxqKQ416I6lEnKsI6lwjPPRQY5VpPWrIc3-FB4IRfK8,103
+sourcecode/__init__.py,sha256=y7H6BpC2bXN93kgVpSIJ6MrHneDY6yl0VNPo_qOu4Ts,103
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
-sourcecode/architecture_analyzer.py,sha256=liCwQmLgb5vplohy8arjYxs_HOIv5C9MjLh_gY6bc5Q,44115
-sourcecode/architecture_summary.py,sha256=z34_6v7cSwy98cof2UVciGho7SCrZ93tiqMmq5WNzRQ,20405
+sourcecode/architecture_analyzer.py,sha256=r_xf-SWXwUm3nVQMCSXHJ3M8zKsQP7Ze8Nqf6TVLRq8,45998
+sourcecode/architecture_summary.py,sha256=UaxmUU77oTlWxttMU3c6PxHrU-Q6q5N31TeU_NWWTdU,24297
 sourcecode/ast_extractor.py,sha256=sa6CmLpn-k5G3_Hzxn8hAlZ5-TS-EVzXDD0Gvxd2jzs,50613
 sourcecode/cache.py,sha256=1V3vsaODAa2UBJAC0xpvxpmRdriCezQx5Q8JCcfgziE,31892
 sourcecode/canonical_ir.py,sha256=DEwucOPJguLsVtg5cV8mWXNi112l5jmBhv73KGGebVk,24849
@@ -28,13 +28,13 @@ sourcecode/format_contract.py,sha256=1cTNqwP8geA2hbQoBHUPgX3_vSh3l8guJT_jmgEnFF8
 sourcecode/fqn_utils.py,sha256=XLU7zDkNBXz_RZkIUNfpPmp1nekWtqP-fxV92tDV1vg,2158
 sourcecode/git_analyzer.py,sha256=JStxTQXNjBWi_wLdwhsZs9mT-v50cSJIz4Agzn6Kh9I,13362
 sourcecode/graph_analyzer.py,sha256=DHR8fY69oU_Pi4SYaWboX6EoEFrctQKB9dsjpqwGMzw,62403
-sourcecode/hibernate_strat.py,sha256=ZyI0sikxh7IemU8uqn1Z73z-tHeFeCJuYhJnyQL8pzU,57765
-sourcecode/integration_detector.py,sha256=ygZwXHJXJ4QM6oiqKb5S6WIfElByDYdz9moyuFlZpYI,12997
+sourcecode/hibernate_strat.py,sha256=h0leIhlWvSjYq3F99LxvLIDLrJ-xPYxWAREG4LkqZ-4,61190
+sourcecode/integration_detector.py,sha256=HlVdiVki7i62t3pJ0lRjTQQ7WZqPDcPLTqBGAfjFjVQ,17883
 sourcecode/jdk_exports.py,sha256=fCrlwNAXUT9gge_joq6kMnY3zJxYB2pxqy-0w3o3MJI,874
 sourcecode/license.py,sha256=wckiLuiwaE35KMCStUf1gYzleJuFe6qsSyxUQJvit3s,23500
 sourcecode/mcp_nudge.py,sha256=5ELU_ixzh6uA83NXLOZT8h00OhL53okfQdji3jyKOjg,2917
 sourcecode/metrics_analyzer.py,sha256=m0ENgtqKeBL17kUIK3fmGkgo7UfXBNHxCMj0H_Y5K7c,22750
-sourcecode/migrate_check.py,sha256=QNyFmrEqYUSqmi0iIQ1P6oI63g8prOluSvYA5fUJ7Ow,95040
+sourcecode/migrate_check.py,sha256=VyA-2n5J1Cqf1XxhQ143pf5Y7IvGwolMM1F4OCLOOaU,102628
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
 sourcecode/output_budget.py,sha256=Js9yUlfQtPhqBl9R6wn_9UHVjjJc3GtLcqyfjf5t50Q,9869
 sourcecode/path_filters.py,sha256=VnaD9jxZVNzluackNSTCdIddwzAqIseuSCs_A-gpCDM,6898
@@ -47,7 +47,7 @@ sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg,12965
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=tP9L8v9K2xg-xb93N1aELJP-pHHxww8537GZ7Sf0_94,229324
+sourcecode/repository_ir.py,sha256=tj3e_uxkVGTRWfzkf2YoGO-oGakSO4DmWrUQow0dFGk,231201
 sourcecode/ris.py,sha256=RcqLVwC-doFcKKViYDkCjZLBqf_wzLES7-F6vHEeWzE,20419
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=WdOQ78mMzjR1NjmKTlbxdgwinnCTfAhxCVLBEFQiFHU,8899
@@ -57,7 +57,7 @@ sourcecode/semantic_analyzer.py,sha256=4OdG6tTSnTvq3_dSWMbQu8Ad1ndSCKeG-b9qM4hIx
 sourcecode/serializer.py,sha256=MSxYZ-_UYDPKMvg-hVk-MnKN-TfrmxXL202siCssa9U,129110
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=G7Or2lKBUQbcTDqudLvSs9XvNg_YoAa-_lBOG_ULs8E,5457
-sourcecode/spring_impact.py,sha256=qLwLfItX_o9LU-k_qjhD2hFpTX3PpEQ85TsYTAArzvg,56016
+sourcecode/spring_impact.py,sha256=1Eu1vkdwTVsw92iBEJDe_i_FaSf4uGH9Rb0eSgIAAZc,57542
 sourcecode/spring_model.py,sha256=zOAgFmrRbG4a6KLm1TJl55aWMyPNsz3OS3FSczqPG6A,16594
 sourcecode/spring_security_audit.py,sha256=XtPJ1SXlZJ8k6VYmaWuAp7Bbir4UmreAL7doIGQ5I7o,20595
 sourcecode/spring_semantic.py,sha256=O1nKSGVzlukuxLHQVuCPxc-XrcrMFxwlHA20_dmEGgM,13307
@@ -76,7 +76,7 @@ sourcecode/detectors/elixir.py,sha256=jCpvt5Yi6jvplc80ovRtWh17q-11ZGo9qX7o8b57TJ
 sourcecode/detectors/go.py,sha256=2r66uRQfeTWsqxr4HDhT6vExZErby0t46QXLHVBRv9w,2782
 sourcecode/detectors/heuristic.py,sha256=7cRxrip4yIaggYzZJB6ef8yHKh-gHgiH_pXMFcjlyFU,3723
 sourcecode/detectors/hybrid.py,sha256=IGFRUVsAZ1ooRlFdznCeJAV6vy1yVDx-VyghvLtddXc,9101
-sourcecode/detectors/java.py,sha256=V9Eb2EMqEdonIhoegvFN2-z95R4Nu9q2y9G54baWShc,32298
+sourcecode/detectors/java.py,sha256=hyAlTo8_y-tzNVun3zvHmWN8RdG--sdLquCI7fQBAVc,34263
 sourcecode/detectors/jvm_ext.py,sha256=EgHJ5W8EE-ZTN9V607mVzohyKgZE8Mc2jCi-DF8RAZU,2616
 sourcecode/detectors/nodejs.py,sha256=Hg3Gmr7yIMJFiLoDwOTk2wtu00wxIs6kZf-oQujTFUA,13187
 sourcecode/detectors/parsers.py,sha256=ugPg8yNUf0Ai1gA7Fnn6wAkYGFjTxRodSP3IeViYJJ4,2290
@@ -104,8 +104,8 @@ sourcecode/telemetry/consent.py,sha256=H5z2Wu63pZqbaKucRPoJQJ0zCo4cke9ZlBrJC-MaW
 sourcecode/telemetry/events.py,sha256=LtzYfaX9Ilckj5PTvAcTpDa9mLqDsYPDUiDkRa58piY,2580
 sourcecode/telemetry/filters.py,sha256=NHa5T-6DaZduQPFuC34jOqHWQgSizM-Ygq8aZ4j19ng,5834
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-1.69.0.dist-info/METADATA,sha256=s7Ko18CIs4SrMOMsNrqCkc-nFZLcxTnC0M_r0zxXycU,47341
-sourcecode-1.69.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-1.69.0.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
-sourcecode-1.69.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-1.69.0.dist-info/RECORD,,
+sourcecode-1.71.0.dist-info/METADATA,sha256=w75cRYv8E561ZW0S1KTAry6BealPGHv20TwuZgW-NGM,48339
+sourcecode-1.71.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-1.71.0.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
+sourcecode-1.71.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-1.71.0.dist-info/RECORD,,