sourcecode 1.69.0__tar.gz → 1.71.0__tar.gz

{sourcecode-1.69.0 → sourcecode-1.71.0}/CHANGELOG.md

@@ -1,5 +1,129 @@
 # Changelog
 
+## [1.71.0] — 2026-07-01
+
+### Fixed — framework-framing & migration reliability on a large non-Boot Spring repo (Jenkins core field test)
+
+A migration/architecture audit of **jenkins-ci/jenkins** (`e7eef8d2cf`, branch
+`master`; ~1,900 production Java classes, Maven multi-module, uses
+`spring-security-web` but **no Spring MVC, no Spring Boot, no DI container** —
+Jenkins runs on its own Stapler web framework and ACL/SecurityRealm security SPI)
+surfaced five reproducible defects. In every case the engine already computed the
+*correct* internal signal (downgraded confidence, `spring_present`, `not_detected`,
+a prose `coverage_note`) but that signal did not propagate to the high-level field
+an automated consumer reads first. Each fix targets the root cause and adds
+regression coverage. All findings were verified against direct `grep` over the same
+repo.
+
+- **Framework detection — phantom "Spring MVC / Spring AOP" from pom exclusion blocks (BUG #1).**
+  `_frameworks_from_pom` serialized the *entire* pom to text and substring-matched
+  framework tokens, so `<exclude>org.springframework:spring-web</exclude>` and
+  `<exclude>…:spring-aop</exclude>` inside an enforcer bytecode rule in
+  `war/pom.xml` (artifact **exclusions**, not dependencies) read as "uses Spring
+  MVC / Spring AOP". Detection is now restricted to real dependency / plugin /
+  parent **coordinates** (`<exclusion>`/`<exclude>` and comments carry none) — the
+  same discipline the Gradle path already applied (JobRunr fix). The Spring Security
+  token was also broadened to the true-positive `spring-security-web` /
+  `-config` coordinates (Jenkins' real dep), so the honest label survives while the
+  phantoms disappear.
+- **`architecture_summary` — categorical "MVC pattern with … view layers" on a repo with zero controllers (BUG #1).**
+  The `mvc` pattern is a directory-name heuristic. On a Java/Kotlin repo it is now
+  cross-checked against the canonical endpoint extractor in the same run; with no
+  HTTP controllers detected it degrades to a directory-derived "Layered code
+  organization (… — no HTTP controllers detected)" note, dropping the unverified
+  "view" claim rather than asserting MVC.
+- **`migrate-check` — `boot3` dimension applicable without any Spring Boot (BUG #2).**
+  The Boot 2→3 axis was gated on `spring_present` (any `org.springframework.*`
+  coordinate), so a repo carrying only `spring-security-web` received a
+  contaminated `readiness_score` from a migration that does not exist. Applicability
+  now requires **positive evidence**: a `spring-boot*` coordinate / Gradle plugin
+  (`@SpringBootApplication` always ships one), **or** a concrete `spring_boot_3` /
+  `spring_security_6` finding in main code. jakarta findings alone no longer enable
+  boot3. A new `spring_boot_present` flag is surfaced; when N/A the dimension is
+  excluded from the aggregate with a clear reason.
+- **`migrate-check` — `MIG-002` (javax.servlet) counted `@Deprecated` frozen-legacy shims as high blockers (BUG #3).**
+  A namespace-migration finding on a **class-level `@Deprecated`** type (kept for
+  binary compat, with a live replacement — Jenkins `ChainedServletFilter` →
+  `ChainedServletFilter2`) is now classified `code_context="deprecated_shim"` and
+  excluded from `blocking_count`, readiness, and effort, alongside the existing
+  test/generated buckets. A `@Deprecated` **method** on a live class stays blocking.
+  On Jenkins this dropped `blocking_count` from 6 to 2.
+- **`repo-ir` — `security_model` was a bare `"unknown"` string with no reason (BUG #4).**
+  A structured `security_model_detail` companion now mirrors the `not_detected`
+  pattern used elsewhere: `status`, `spring_security_filter_chain_detected`,
+  `annotation_policies_detected`, `custom_spi_detected`, and a `reason` that
+  explicitly notes absence of a *recognized* pattern is not evidence the repo is
+  unsecured (Jenkins uses a custom ACL/SecurityRealm SPI).
+- **`export --integrations` — low count carried no structured coverage flag (BUG #5).**
+  The honest coverage caveat lived only in the prose `coverage_note`. A structured
+  `coverage_confidence` (`low` / `partial` / `high`) plus `coverage_confidence_reason`
+  is now emitted: a large repo (≥300 source files) with <10 recognized constructs is
+  flagged `low` so a consumer cannot read a low count as low external coupling
+  (Jenkins' custom remoting/SCM/Update-Center SPIs are invisible to static matching).
+
+New regression coverage across five suites; full suite green (2,900+ tests).
+
+## [1.70.0] — 2026-07-01
+
+### Fixed — reliability & internal-consistency on a large Spring 5 / Hibernate 5 repo (openmrs-core field test)
+
+A full migration audit of **openmrs-core** (`7c0144ad2`, branch `2.9.x`; ~866
+production files, Maven multi-module, Spring Framework 5 + Hibernate 5, classic
+WAR, **no Spring Boot**) surfaced four reproducible defects where a headline value
+was wrong or internally contradictory. Each fix targets the **root cause** and,
+where certainty is not achievable, degrades to an explicit low-confidence / `null`
+signal rather than asserting a concrete-but-false value. New regression coverage
+across four suites.
+
+- **`migrate-check` — Hibernate version confused a sibling artifact's version (BUG #1, CRITICAL).**
+  Hibernate ORM was resolved by scanning for *any* `<hibernate*version>` property
+  and keeping the **newest**, so on openmrs `${hibernateSearchVersion}=6.2.4.Final`
+  (Hibernate **Search**, a different artifact) beat `${hibernateVersion}=5.6.15.Final`
+  (Hibernate **ORM**). The tool declared the repo "already on Hibernate 6", set
+  `migration_applicable:false`, and silently **dropped the 28.9–95.6 person-day**
+  rewrite range from `estimated_effort_days` (under-reporting 1.5–2.6×). Resolution
+  is now **anchored to the `hibernate-core`/`hibernate-orm` dependency** — the
+  `<version>` on that coordinate, resolving a `${property}` to the *specific*
+  referenced property, and the Gradle coordinate. The property fallback (BOM-managed
+  repos) **excludes sibling artifacts** (Search/Validator/Envers/OGM/…). openmrs now
+  resolves `5.6.15.Final` / major 5 / `migration_applicable:true`, and
+  `estimated_effort_days` includes the Hibernate rewrite range via a new
+  `effort_breakdown` block. The same-name contradiction (`hibernate_readiness:100`
+  at root vs `0` nested) is removed: the nested field is renamed
+  **`rewrite_zone_readiness`** (raw rewrite-zone score, independent of applicability),
+  leaving the document-root `hibernate_readiness` as the single authoritative,
+  applicability-gated score.
+
+- **`impact-chain` — a class's own methods counted as "direct callers" (BUG #2, HIGH).**
+  For a class-level seed, the BFS folds in every method key of the class, so internal
+  method→method calls leaked into `direct_callers`. On `ConceptServiceImpl` this
+  reported **24 direct callers (22 of them own members)**, inflating `risk_score` to
+  `20.0`/`high` — ~12× the real blast radius. Callers whose owning class is a seed
+  class are now excluded (they are *members*, not external callers); the count is
+  surfaced as `self_referential_excluded` plus an `analysis_warnings` entry.
+  `ConceptServiceImpl` now reports **2 external callers**, `risk_score` recomputed to
+  `8.5`/`medium`.
+
+- **`export --integrations` — a user class classified as a JDK API by bare name (BUG #3, MEDIUM).**
+  `org.openmrs.util.HttpClient` (a thin wrapper over `java.net.HttpURLConnection`)
+  was labeled `jdk-httpclient` purely because its simple name matches
+  `java.net.http.HttpClient`. The client is now resolved by the **fully-qualified
+  import** — `jdk-httpclient` only when `java.net.http.HttpClient` is actually
+  imported and the file does not declare its own — otherwise it degrades to a
+  low-confidence **`custom-http-wrapper`**. Pure type-declaration sites (field,
+  parameter, return type such as `setImplementationIdHttpClient(HttpClient c)`) are
+  no longer emitted as network-invocation evidence; only constructions / static calls
+  count.
+
+- **`--compact` — "rest api" headline unsupported by the `endpoints` command (BUG #4, LOW).**
+  The `architecture_summary` label is driven by HTTP-framework **presence** (Spring
+  MVC on the classpath), so openmrs was headlined "Java rest api" while the
+  authoritative `endpoints` command found **only 3 endpoints** (one a test module,
+  one medium-confidence `router_dsl`). The summary now consults the same endpoint
+  extractor and, below a high-confidence-endpoint threshold, degrades to a qualified,
+  consistent phrasing ("HTTP framework present; only N endpoints detected — see
+  `endpoints`") instead of overclaiming (Java/Kotlin repos only).
+
 ## [1.69.0] — 2026-06-30
 
 ### Fixed — framing & symbol-graph fidelity on a non-framework Java library (JobRunr field test)
@@ -57,8 +181,16 @@ suites.
   emits the misleading "No stereotype detected — may be a plain class or utility" for
   a structurally central non-annotated class: it infers a low-confidence stereotype
   from in-degree, lifecycle methods, and naming (e.g. `BackgroundJobServer` →
-  "Likely server/orchestrator … lifecycle methods detected (start/stop)"). JobRunr
-  `project_type` "api" → "library", `frameworks` `["Quarkus"]` → `[]`.
+  "Likely server/orchestrator … lifecycle methods detected (start/stop)"). Finally
+  the `architecture_summary` no longer prints a phantom "MVC pattern with
+  controller, model, view layers" for a non-web library: MVC now requires a real
+  View layer (it was inferred from a `handlers` dir + a `model` dir with no view),
+  a bundled SPA under `src/main/resources/.../frontend` is no longer counted as a
+  backend view layer, `testFixtures` source roots are excluded, and View detection
+  recognizes template files (`.html`/etc.) that the code-extension filter dropped.
+  JobRunr `project_type` "api" → "library", `frameworks` `["Quarkus"]` → `[]`,
+  architecture "MVC … controller, model, view" → "Layered … controller, repository,
+  infrastructure".
 
 ## [1.68.0] — 2026-06-30
 

{sourcecode-1.69.0 → sourcecode-1.71.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.69.0
+Version: 1.71.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -411,7 +411,7 @@ Emits **structured, tool-agnostic** codebase views as plain JSON/YAML — the ki
 |------|--------|
 | `--by-directory` | One group per source directory, each symbol with a `source_file:line` reference. |
 | `--module-graph` | `{nodes, edges, summary}` — directories as modules, inter-module dependencies rolled up from class-level relation edges with hit counts + edge types. |
-| `--integrations` | Outbound integrations across Spring **and** plain-Java/Jakarta stacks: HTTP (`RestTemplate`, `WebClient`, `@FeignClient`, JDK `HttpClient`, Apache, OkHttp), LDAP (`LdapTemplate`, JNDI `InitialDirContext`/`LdapContext`), SMTP (`JavaMailSender`, JavaMail `Transport`/`MimeMessage`), and JMS — with `file:line` evidence and a literal `target` when present. Emits an explicit `confidence` (`observed` / `not_analyzed`) + `coverage_note`: a count of `0` means "no client construct found", **not** "no integrations" (runtime/DI-wired clients are not statically visible). |
+| `--integrations` | Outbound integrations across Spring **and** plain-Java/Jakarta stacks: HTTP (`RestTemplate`, `WebClient`, `@FeignClient`, JDK `HttpClient`, Apache, OkHttp), LDAP (`LdapTemplate`, JNDI `InitialDirContext`/`LdapContext`), SMTP (`JavaMailSender`, JavaMail `Transport`/`MimeMessage`), and JMS — with `file:line` evidence and a literal `target` when present. Emits an explicit `confidence` (`observed` / `not_analyzed`), a structured `coverage_confidence` (`low` / `partial` / `high`) with `coverage_confidence_reason`, and a prose `coverage_note`: a count of `0` — or a low count on a large repo (≥300 files, <10 constructs) — is flagged `low`, so a low count is never read as low external coupling (custom protocol/SPI clients are not statically visible). |
 | `--c4` | Unified document: `c4.{context, containers, components, code}` + `api_surface` + a `manifest` with per-directory content hashes for **incremental** consumers (skip directories whose hash is unchanged). `components.module_roots` rolls leaf source dirs up to architectural module roots and classifies each `layered` (DDD: ≥2 of `domain`/`application`/`infrastructure`) vs `flat` (legacy/flat package), with a verifiable `module_count` — so a consumer enumerates real modules instead of inferring boundaries from leaf directories. |
 
 The section flags compose (pass several for one multi-section document); `--c4` assembles the full export on its own. URLs assembled at runtime yield `target: null` (honest absence, never a guess); containers are derived from build files (Maven/Gradle) and reported as a limitation when none are found.
@@ -734,9 +734,20 @@ evidence. `migrate-check` enforces:
   `hibernate_rewrite` headline. An **unresolved** version degrades to a
   low-confidence hypothesis with no headline blocker. See
   `hibernate.effective_version` / `version_major` / `version_confidence`.
-- **Boot3 auto-disables without Spring.** `boot3.applicable` tracks real Spring
-  usage; Quarkus / Micronaut / Helidon / Jakarta-pure repos report `boot3` as N/A
-  (`spring_present: false`), not a contradictory `applicable: true`.
+- **Boot3 needs Spring _Boot_, not just Spring.** `boot3.applicable` requires
+  positive Spring Boot evidence — a `spring-boot*` coordinate / Gradle plugin (or
+  `@SpringBootApplication`), **or** a concrete `spring_boot_3` / `spring_security_6`
+  finding. A repo that merely carries a Spring library (e.g. `spring-security-web`
+  with no Boot — Jenkins core) reports `boot3` as N/A with a reason and is excluded
+  from the aggregate; `spring_present: true` but `spring_boot_present: false`. Quarkus
+  / Micronaut / Helidon / Jakarta-pure repos likewise report `boot3` N/A. jakarta
+  findings alone never enable boot3.
+- **Frozen-legacy `@Deprecated` shims aren't blockers.** A `javax→jakarta` finding
+  on a **class-level `@Deprecated`** type (kept for binary compat, replaced
+  elsewhere) is classified `code_context: "deprecated_shim"` and excluded from
+  `blocking_count` / readiness / effort — surfaced under `non_blocking` with a
+  "verify before removing" note. A `@Deprecated` **method** on a live class still
+  blocks.
 - **Permanent `javax.*` are never jakarta debt.** JDK/JSR namespaces
   (`javax.cache`, `javax.sql`, `javax.xml` JAXP, `javax.crypto`, `javax.naming`,
   `javax.management`, `javax.security.auth`, `javax.annotation.processing`, …) are

{sourcecode-1.69.0 → sourcecode-1.71.0}/README.md

@@ -373,7 +373,7 @@ Emits **structured, tool-agnostic** codebase views as plain JSON/YAML — the ki
 |------|--------|
 | `--by-directory` | One group per source directory, each symbol with a `source_file:line` reference. |
 | `--module-graph` | `{nodes, edges, summary}` — directories as modules, inter-module dependencies rolled up from class-level relation edges with hit counts + edge types. |
-| `--integrations` | Outbound integrations across Spring **and** plain-Java/Jakarta stacks: HTTP (`RestTemplate`, `WebClient`, `@FeignClient`, JDK `HttpClient`, Apache, OkHttp), LDAP (`LdapTemplate`, JNDI `InitialDirContext`/`LdapContext`), SMTP (`JavaMailSender`, JavaMail `Transport`/`MimeMessage`), and JMS — with `file:line` evidence and a literal `target` when present. Emits an explicit `confidence` (`observed` / `not_analyzed`) + `coverage_note`: a count of `0` means "no client construct found", **not** "no integrations" (runtime/DI-wired clients are not statically visible). |
+| `--integrations` | Outbound integrations across Spring **and** plain-Java/Jakarta stacks: HTTP (`RestTemplate`, `WebClient`, `@FeignClient`, JDK `HttpClient`, Apache, OkHttp), LDAP (`LdapTemplate`, JNDI `InitialDirContext`/`LdapContext`), SMTP (`JavaMailSender`, JavaMail `Transport`/`MimeMessage`), and JMS — with `file:line` evidence and a literal `target` when present. Emits an explicit `confidence` (`observed` / `not_analyzed`), a structured `coverage_confidence` (`low` / `partial` / `high`) with `coverage_confidence_reason`, and a prose `coverage_note`: a count of `0` — or a low count on a large repo (≥300 files, <10 constructs) — is flagged `low`, so a low count is never read as low external coupling (custom protocol/SPI clients are not statically visible). |
 | `--c4` | Unified document: `c4.{context, containers, components, code}` + `api_surface` + a `manifest` with per-directory content hashes for **incremental** consumers (skip directories whose hash is unchanged). `components.module_roots` rolls leaf source dirs up to architectural module roots and classifies each `layered` (DDD: ≥2 of `domain`/`application`/`infrastructure`) vs `flat` (legacy/flat package), with a verifiable `module_count` — so a consumer enumerates real modules instead of inferring boundaries from leaf directories. |
 
 The section flags compose (pass several for one multi-section document); `--c4` assembles the full export on its own. URLs assembled at runtime yield `target: null` (honest absence, never a guess); containers are derived from build files (Maven/Gradle) and reported as a limitation when none are found.
@@ -696,9 +696,20 @@ evidence. `migrate-check` enforces:
   `hibernate_rewrite` headline. An **unresolved** version degrades to a
   low-confidence hypothesis with no headline blocker. See
   `hibernate.effective_version` / `version_major` / `version_confidence`.
-- **Boot3 auto-disables without Spring.** `boot3.applicable` tracks real Spring
-  usage; Quarkus / Micronaut / Helidon / Jakarta-pure repos report `boot3` as N/A
-  (`spring_present: false`), not a contradictory `applicable: true`.
+- **Boot3 needs Spring _Boot_, not just Spring.** `boot3.applicable` requires
+  positive Spring Boot evidence — a `spring-boot*` coordinate / Gradle plugin (or
+  `@SpringBootApplication`), **or** a concrete `spring_boot_3` / `spring_security_6`
+  finding. A repo that merely carries a Spring library (e.g. `spring-security-web`
+  with no Boot — Jenkins core) reports `boot3` as N/A with a reason and is excluded
+  from the aggregate; `spring_present: true` but `spring_boot_present: false`. Quarkus
+  / Micronaut / Helidon / Jakarta-pure repos likewise report `boot3` N/A. jakarta
+  findings alone never enable boot3.
+- **Frozen-legacy `@Deprecated` shims aren't blockers.** A `javax→jakarta` finding
+  on a **class-level `@Deprecated`** type (kept for binary compat, replaced
+  elsewhere) is classified `code_context: "deprecated_shim"` and excluded from
+  `blocking_count` / readiness / effort — surfaced under `non_blocking` with a
+  "verify before removing" note. A `@Deprecated` **method** on a live class still
+  blocks.
 - **Permanent `javax.*` are never jakarta debt.** JDK/JSR namespaces
   (`javax.cache`, `javax.sql`, `javax.xml` JAXP, `javax.crypto`, `javax.naming`,
   `javax.management`, `javax.security.auth`, `javax.annotation.processing`, …) are

{sourcecode-1.69.0 → sourcecode-1.71.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.69.0"
+version = "1.71.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.69.0 → sourcecode-1.71.0}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.69.0"
+__version__ = "1.71.0"

{sourcecode-1.69.0 → sourcecode-1.71.0}/src/sourcecode/architecture_analyzer.py

@@ -38,7 +38,15 @@ _CODE_EXTENSIONS = {
 }
 _GENERIC_NAMES = {"utils", "helpers", "common", "shared", "misc", "core", "root", ""}
 
-_TEST_DIRS: frozenset[str] = frozenset({"tests", "test", "spec", "specs", "__tests__", "e2e"})
+_TEST_DIRS: frozenset[str] = frozenset({
+    "tests", "test", "spec", "specs", "__tests__", "e2e",
+    # Gradle/Maven test-fixture source roots are test code, not runtime architecture.
+    "testfixtures", "testfixture",
+})
+# Always-vendored asset trees — never a backend code layer at any depth.
+_ASSET_DIRS: frozenset[str] = frozenset({
+    "node_modules", "bower_components",
+})
 _BENCHMARK_DIRS: frozenset[str] = frozenset({
     "benchmark", "benchmarks", "bench",
     "example", "examples",
@@ -50,7 +58,7 @@ _BENCHMARK_DIRS: frozenset[str] = frozenset({
 _DOCS_DIRS: frozenset[str] = frozenset({"docs", "doc", "documentation", "wiki"})
 _TOOLING_DIRS: frozenset[str] = frozenset({"scripts", "script", "tools", "tool", "ci"})
 # All dirs that are not part of the runtime source architecture
-_NON_SOURCE_DIRS: frozenset[str] = _TEST_DIRS | _BENCHMARK_DIRS | _DOCS_DIRS | _TOOLING_DIRS
+_NON_SOURCE_DIRS: frozenset[str] = _TEST_DIRS | _BENCHMARK_DIRS | _DOCS_DIRS | _TOOLING_DIRS | _ASSET_DIRS
 
 # Exact file stems that signal a specific architectural layer
 _LAYER_STEM_EXACT: dict[str, str] = {
@@ -150,6 +158,15 @@ LAYER_PATTERNS: dict[str, dict[str, list[str]]] = {
     },
 }
 
+# Layer keys a pattern MUST match to qualify, regardless of score. BUG (JobRunr
+# field test): "mvc" was inferred from a controller-ish dir (`handlers`) plus a
+# `model` dir, with NO view layer — that is not MVC (a library with no templates/
+# pages/components is at most layered). MVC's defining trait is the View, so require
+# it; without it the pattern falls through to layered / a weaker match.
+_PATTERN_REQUIRED_KEYS: dict[str, frozenset[str]] = {
+    "mvc": frozenset({"view"}),
+}
+
 # Higher value = wins when score ties
 _PATTERN_PRIORITY: dict[str, int] = {
     "cqrs":               8,
@@ -245,8 +262,12 @@ class ArchitectureAnalyzer:
         # Step 2: domain clustering
         domains = self._cluster_domains(filtered)
 
-        # Step 3: layer detection
-        pattern, layers = self._detect_layers(filtered)
+        # Step 3: layer detection. Feed the FULL path list (not the code-extension
+        # `filtered` set): a View layer is template files (.html/.jinja/.ejs…) that
+        # `filtered` would drop, hiding the very layer that distinguishes MVC.
+        # _detect_layers applies its own non-source/asset/test dir filtering, so
+        # bundled frontend trees and test fixtures are still excluded.
+        pattern, layers = self._detect_layers(sm.file_paths)
         if pattern in (None, "flat", "unknown"):
             if pattern == "flat":
                 limitations.append("Layer pattern not detected: project has a flat directory structure")
@@ -518,10 +539,18 @@ class ArchitectureAnalyzer:
         return domains
 
     def _detect_layers(self, paths: list[str]) -> tuple[str, list[ArchitectureLayer]]:
-        # Exclude non-source paths (tests, benchmarks, docs, tooling) from layer scoring
+        # Exclude non-source paths (tests, benchmarks, docs, tooling, vendored assets)
+        # from layer scoring. Also exclude anything under a `resources/` segment: in
+        # Maven/Gradle layouts `src/main/resources/**` is bundled config/assets — e.g.
+        # JobRunr ships a React dashboard SPA at
+        # `core/src/main/resources/org/jobrunr/dashboard/frontend/src/components`, whose
+        # `components` dir would otherwise be miscounted as a backend MVC "view" layer.
         source_paths = [
             p for p in paths
-            if not any(part.lower() in _NON_SOURCE_DIRS for part in p.replace("\\", "/").split("/"))
+            if not any(
+                part.lower() in _NON_SOURCE_DIRS or part.lower() == "resources"
+                for part in p.replace("\\", "/").split("/")
+            )
         ]
         if not source_paths:
             return "unknown", []
@@ -544,6 +573,10 @@ class ArchitectureAnalyzer:
                 matched_dirs = [d for d in dir_names if d in keywords]
                 if matched_dirs:
                     matched[layer_key] = matched_dirs
+            # A pattern with unmet required keys cannot qualify (e.g. mvc needs a view).
+            required = _PATTERN_REQUIRED_KEYS.get(pattern_name)
+            if required and not required.issubset(matched.keys()):
+                continue
             score = len(matched)
             priority = _PATTERN_PRIORITY.get(pattern_name, 0)
             if (score, priority) > (best_score, best_priority):

{sourcecode-1.69.0 → sourcecode-1.71.0}/src/sourcecode/architecture_summary.py

@@ -23,6 +23,14 @@ _JAVA_EXTENSIONS = {".java", ".kt", ".scala"}
 
 _CORE_DETECTION_MODULES = {"scanner", "detectors", "classifier", "workspace"}
 
+# BUG #4 (v1.70.0): the "REST API" project-type label is driven by HTTP-framework
+# PRESENCE (Spring MVC / JAX-RS on the classpath), not by an actual endpoint count.
+# The `--compact` summary is the first (often only) thing an agent reads, so it must
+# not assert "rest api" when the authoritative `endpoints` command finds almost no
+# high-confidence surface. Below this many high-confidence endpoints we degrade the
+# headline to a qualified, consistent phrasing instead of overclaiming.
+_MIN_REST_ENDPOINTS_FOR_LABEL = 5
+
 _OPTIONAL_LABEL_MAP: dict[str, str] = {
     "DependencyAnalyzer": "dependencias",
     "GraphAnalyzer": "grafo de módulos",
@@ -41,6 +49,7 @@ class ArchitectureSummarizer:
 
     def __init__(self, root: Path) -> None:
         self.root = root
+        self._endpoint_support_cache: tuple[int, int] | None = None
 
     def generate(self, sm: SourceMap) -> str | None:
         try:
@@ -133,6 +142,7 @@ class ArchitectureSummarizer:
         # Line 2: architecture pattern + layers
         if arch and arch.pattern not in (None, "unknown", "flat"):
             arch_line = self._describe_arch_pattern(arch)
+            arch_line = self._qualify_web_pattern(arch, arch_line, sm)
             if arch_line:
                 lines.append(arch_line)
 
@@ -185,9 +195,65 @@ class ArchitectureSummarizer:
 
         fw_str = f" using {', '.join(fw_names)}" if fw_names else ""
         if runtime:
+            # BUG #4: never assert "rest api" in the headline unless the endpoints
+            # command actually backs it (Java/Kotlin only — that is where we have an
+            # authoritative extractor). Degrade to a qualified, consistent phrasing.
+            if sm.project_type == "api" and primary.stack in {"java", "kotlin"}:
+                total, high = self._endpoint_support()
+                if high < _MIN_REST_ENDPOINTS_FOR_LABEL:
+                    plural = "s" if total != 1 else ""
+                    return (
+                        f"{stack_label} application{fw_str} "
+                        f"(HTTP framework present; only {total} endpoint{plural} "
+                        f"detected — see `endpoints`)."
+                    )
             return f"{stack_label} {runtime.lower()}{fw_str}."
         return f"{stack_label} project{fw_str}."
 
+    def _endpoint_support(self) -> tuple[int, int]:
+        """Return (total, high_confidence) endpoint counts from the canonical
+        Java endpoint extractor — the same source the `endpoints` command uses,
+        so the summary cannot diverge from it. Cached; failure degrades to (0, 0)."""
+        if self._endpoint_support_cache is not None:
+            return self._endpoint_support_cache
+        total, high = 0, 0
+        try:
+            from sourcecode.repository_ir import extract_java_endpoints
+            data = extract_java_endpoints(self.root)
+            eps = data.get("endpoints", [])
+            total = data.get("total", len(eps))
+            high = sum(1 for e in eps if (e.get("confidence") or "high") == "high")
+        except Exception:
+            total, high = 0, 0
+        self._endpoint_support_cache = (total, high)
+        return self._endpoint_support_cache
+
+    def _qualify_web_pattern(self, arch: Any, arch_line: str, sm: SourceMap) -> str:
+        """BUG #1 (Jenkins field test): the "mvc" pattern is a directory-name
+        heuristic (dirs matching controller/model/view keywords). On a Java/Kotlin
+        repo, do not assert "MVC pattern with ... view layers" in prose when the
+        canonical endpoint extractor finds no HTTP controllers in the same run —
+        Jenkins (Stapler web framework) matches model/view-ish dirs but declares
+        zero Spring MVC controllers. Cross-check against `endpoints` and degrade to
+        a consistent, non-committal phrasing instead of a categorical MVC claim."""
+        if not arch_line or arch.pattern not in ("mvc", "spring_mvc_layered"):
+            return arch_line
+        primary = next((s for s in sm.stacks if s.primary), sm.stacks[0] if sm.stacks else None)
+        if primary is None or primary.stack not in {"java", "kotlin"}:
+            return arch_line
+        _total, high = self._endpoint_support()
+        if high >= _MIN_REST_ENDPOINTS_FOR_LABEL:
+            return arch_line
+        # No controller backing → the MVC/view claim is unverified. Report the
+        # directory-derived layers without the framework label or the "view" claim.
+        layer_names = [l.name for l in arch.layers[:4] if l.name != "view"] if arch.layers else []
+        if layer_names:
+            return (
+                f"Layered code organization ({', '.join(layer_names)}; "
+                f"directory-based — no HTTP controllers detected)."
+            )
+        return ""
+
     def _describe_arch_pattern(self, arch: Any) -> str:
         pattern_labels = {
             "clean": "Clean Architecture",

{sourcecode-1.69.0 → sourcecode-1.71.0}/src/sourcecode/detectors/java.py

@@ -284,10 +284,43 @@ class JavaDetector(AbstractDetector):
             if parent_artifact == "spring-boot-starter-parent":
                 sb_version = (parent_elem.findtext(f"{ns}version") or "").strip() or None
 
-        text = ElementTree.tostring(root_elem, encoding="unicode").lower()
+        # BUG #1 (Jenkins field test): framework tokens must be matched only inside
+        # genuine dependency / plugin / parent coordinates, never anywhere in the
+        # serialized pom. Jenkins' war/pom.xml lists `<exclude>...:spring-web</exclude>`
+        # and `<exclude>...:spring-aop</exclude>` in an enforcer-plugin bytecode rule
+        # — those are exclusions of transitive artifacts, not declared dependencies.
+        # Serializing the whole tree let them read as "uses Spring MVC / Spring AOP".
+        # Restrict the scan to real dependency/plugin/parent artifact coordinates;
+        # `<exclusion>` and `<exclude>` elements carry neither.
+        text = self._pom_coordinate_text(root_elem, ns)
         frameworks = self._detect_jvm_frameworks(text, "pom.xml", sb_version=sb_version)
         return frameworks
 
+    def _pom_coordinate_text(self, root_elem: ElementTree.Element, ns: str) -> str:
+        """Collect groupId:artifactId coordinates from real dependency, plugin, and
+        parent declarations only. Skips `<exclusion>`/`<exclude>` (transitive-artifact
+        removals) and comments, which must never be read as usage signal."""
+        coords: list[str] = []
+
+        def _coord(elem: ElementTree.Element) -> None:
+            gid = (elem.findtext(f"{ns}groupId") or "").strip()
+            aid = (elem.findtext(f"{ns}artifactId") or "").strip()
+            if aid:
+                coords.append(f"{gid}:{aid}" if gid else aid)
+
+        # <dependency> nodes anywhere (dependencies, dependencyManagement, profiles).
+        # ElementTree never yields <dependency> under <exclusions> (those are
+        # <exclusion>), so exclusion coordinates are structurally excluded.
+        for dep in root_elem.iter(f"{ns}dependency"):
+            _coord(dep)
+        for plugin in root_elem.iter(f"{ns}plugin"):
+            _coord(plugin)
+        parent_elem = root_elem.find(f"{ns}parent")
+        if parent_elem is not None:
+            _coord(parent_elem)
+
+        return "\n".join(coords).lower()
+
     def _frameworks_from_gradle(self, path: Path) -> list[FrameworkDetection]:
         original = "\n".join(read_text_lines(path))
         content = original.lower()
@@ -361,7 +394,12 @@ class JavaDetector(AbstractDetector):
             frameworks.append(FrameworkDetection(name="Thymeleaf", source=source))
         if "freemarker" in text:
             frameworks.append(FrameworkDetection(name="FreeMarker", source=source))
-        if "spring-boot-starter-security" in text or "spring-security-core" in text:
+        if (
+            "spring-boot-starter-security" in text
+            or "spring-security-core" in text
+            or "spring-security-web" in text
+            or "spring-security-config" in text
+        ):
             frameworks.append(FrameworkDetection(name="Spring Security", source=source))
         if "spring-boot-starter-data-jpa" in text or "spring-data-jpa" in text:
             frameworks.append(FrameworkDetection(name="Spring Data JPA", source=source))