sourcecode 1.70.0__py3-none-any.whl → 1.72.0__py3-none-any.whl

sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.70.0"
+__version__ = "1.72.0"

sourcecode/architecture_summary.py

@@ -142,6 +142,7 @@ class ArchitectureSummarizer:
         # Line 2: architecture pattern + layers
         if arch and arch.pattern not in (None, "unknown", "flat"):
             arch_line = self._describe_arch_pattern(arch)
+            arch_line = self._qualify_web_pattern(arch, arch_line, sm)
             if arch_line:
                 lines.append(arch_line)
 
@@ -227,6 +228,32 @@ class ArchitectureSummarizer:
         self._endpoint_support_cache = (total, high)
         return self._endpoint_support_cache
 
+    def _qualify_web_pattern(self, arch: Any, arch_line: str, sm: SourceMap) -> str:
+        """BUG #1 (Jenkins field test): the "mvc" pattern is a directory-name
+        heuristic (dirs matching controller/model/view keywords). On a Java/Kotlin
+        repo, do not assert "MVC pattern with ... view layers" in prose when the
+        canonical endpoint extractor finds no HTTP controllers in the same run —
+        Jenkins (Stapler web framework) matches model/view-ish dirs but declares
+        zero Spring MVC controllers. Cross-check against `endpoints` and degrade to
+        a consistent, non-committal phrasing instead of a categorical MVC claim."""
+        if not arch_line or arch.pattern not in ("mvc", "spring_mvc_layered"):
+            return arch_line
+        primary = next((s for s in sm.stacks if s.primary), sm.stacks[0] if sm.stacks else None)
+        if primary is None or primary.stack not in {"java", "kotlin"}:
+            return arch_line
+        _total, high = self._endpoint_support()
+        if high >= _MIN_REST_ENDPOINTS_FOR_LABEL:
+            return arch_line
+        # No controller backing → the MVC/view claim is unverified. Report the
+        # directory-derived layers without the framework label or the "view" claim.
+        layer_names = [l.name for l in arch.layers[:4] if l.name != "view"] if arch.layers else []
+        if layer_names:
+            return (
+                f"Layered code organization ({', '.join(layer_names)}; "
+                f"directory-based — no HTTP controllers detected)."
+            )
+        return ""
+
     def _describe_arch_pattern(self, arch: Any) -> str:
         pattern_labels = {
             "clean": "Clean Architecture",

sourcecode/canonical_ir.py

@@ -16,6 +16,7 @@ from __future__ import annotations
 
 import hashlib
 import json
+import re
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any, Optional
@@ -37,6 +38,11 @@ IR_SCHEMA_VERSION = "1.0.0"
 # Edge types excluded from reverse graph (mirrors repository_ir._REVERSE_EXCLUDE)
 _REVERSE_EXCLUDE: frozenset[str] = frozenset({"annotated_with", "mapped_to"})
 
+# A route path that looks like a Java FQN is framework dynamic-admin routing, not a
+# real REST endpoint (mirrors the filter in repository_ir.extract_java_endpoints so
+# the CIR endpoint count reconciles with the `endpoints` command). See BUG #7.
+_FQN_PATH_RE: re.Pattern = re.compile(r"/(org|com|net|io|edu)\.[a-z][a-z0-9]*\.[a-zA-Z]")
+
 
 # ---------------------------------------------------------------------------
 # CanonicalSecurity
@@ -324,9 +330,17 @@ def ir_dict_to_canonical(
     # Build canonical endpoints from route_surface — stable ordering
     route_surface = ir.get("route_surface") or []
     # Deduplicate by endpoint id (route_surface can have duplicates from multi-prefix)
+    # BUG #7 (Broadleaf field test): the `endpoints` command (extract_java_endpoints)
+    # drops routes whose path looks like a Java FQN — framework dynamic-admin routing
+    # (Broadleaf @AdminSection registers entity class FQNs as URL segments) is not a
+    # real REST surface. The CIR endpoint list feeds `spring-audit` (endpoints_analyzed),
+    # `impact` and `validation`; it must apply the SAME filter so its count reconciles
+    # with `endpoints` instead of being silently inflated by those pseudo-routes.
     _seen_ids: set[str] = set()
     raw_endpoints: list[CanonicalEndpoint] = []
     for r in route_surface:
+        if _FQN_PATH_RE.search(r.get("path", "") or ""):
+            continue
         ep = _route_to_canonical_endpoint(r)
         if ep.id not in _seen_ids:
             _seen_ids.add(ep.id)

sourcecode/cli.py

@@ -5764,11 +5764,63 @@ def modernize_cmd(
         key=lambda h: (-h["hotspot_score"], h["fqn"]),
     )[:15]
 
-    # Cross-module tangles: subsystems with high member count
-    tangle_modules = sorted(
-        [s for s in subsystems if len(s.get("members") or []) >= 5],
-        key=lambda s: -len(s.get("members") or []),
-    )[:10]
+    # Cross-module tangles: actual inter-subsystem coupling measured from the
+    # dependency graph, NOT a re-labelled subsystem list. For every structural
+    # edge whose endpoints live in two different subsystems we tally a directed
+    # (from_subsystem → to_subsystem) coupling count; pairs coupled in BOTH
+    # directions are the real tangles (bidirectional/cyclic module coupling).
+    _graph_edges: list = (ir.get("graph") or {}).get("edges") or []
+    # Structural coupling edge types. annotated_with / mapped_to / event edges are
+    # excluded (metadata + separate topology, not module-decomposition coupling).
+    _TANGLE_EDGE_TYPES = frozenset({
+        "imports", "injects", "extends", "implements",
+        "references", "calls", "instantiates", "returns",
+    })
+    _fqn_to_pkg: dict[str, str] = {}
+    _pkg_to_label: dict[str, str] = {}
+    for _s in subsystems:
+        _pp = _s.get("package_prefix") or _s.get("pkg") or ""
+        if not _pp:
+            continue
+        _pkg_to_label[_pp] = _s.get("label") or _s.get("name") or _pp
+        for _m in (_s.get("members") or []):
+            _fqn_to_pkg[_m] = _pp
+
+    from collections import Counter as _Counter
+    _pair_counts: "_Counter[tuple[str, str]]" = _Counter()
+    _pair_example: dict[tuple[str, str], str] = {}
+    for _e in _graph_edges:
+        if _e.get("type") not in _TANGLE_EDGE_TYPES:
+            continue
+        _a = _fqn_to_pkg.get(_e.get("from"))
+        _b = _fqn_to_pkg.get(_e.get("to"))
+        if not _a or not _b or _a == _b:
+            continue
+        _pair_counts[(_a, _b)] += 1
+        _pair_example.setdefault((_a, _b), f"{_e.get('from')} → {_e.get('to')}")
+
+    _cross_module_tangles = []
+    for (_a, _b), _cnt in sorted(
+        _pair_counts.items(), key=lambda kv: (-kv[1], kv[0])
+    ):
+        _reverse = _pair_counts.get((_b, _a), 0)
+        _cross_module_tangles.append({
+            "from_subsystem": _pkg_to_label.get(_a, _a),
+            "to_subsystem": _pkg_to_label.get(_b, _b),
+            "from_package": _a,
+            "to_package": _b,
+            "edge_count": _cnt,
+            "reverse_edge_count": _reverse,
+            # A mutual (cyclic) dependency is the actual "tangle" — both modules
+            # reference each other, so neither can be extracted independently.
+            "mutual": _reverse > 0,
+            "example": _pair_example.get((_a, _b), ""),
+        })
+    # Surface mutual tangles first (highest decomposition risk), then by strength.
+    _cross_module_tangles.sort(
+        key=lambda t: (not t["mutual"], -t["edge_count"], t["from_package"])
+    )
+    _cross_module_tangles = _cross_module_tangles[:15]
 
     _summary = {
         "total_classes": len([n for n in graph_nodes if n.get("type") in ("class", "interface")]),
@@ -5837,6 +5889,17 @@ def modernize_cmd(
                 {"fqn": n["fqn"], "in_degree": n.get("in_degree", 0), "role": n.get("role", "other")}
                 for n in coupling_nodes
             ],
+            # BUG #6 (Broadleaf field test): make the in_degree metric self-describing
+            # so it is not confused with `explain`'s caller count. They differ by design.
+            "high_coupling_nodes_note": (
+                "in_degree = raw count of incoming graph edges across ALL edge types "
+                "(imports, injects, extends/implements, references, annotations), "
+                "counted at symbol level. This is deliberately larger than and NOT "
+                "equal to `sourcecode explain`'s caller count, which reports DISTINCT "
+                "dependent classes (DI dependents + reverse-call-graph callers, "
+                "deduplicated to class level). Use in_degree for blast-radius ranking, "
+                "explain's caller list for the concrete dependents to inspect."
+            ),
             "statically_unreferenced": [
                 {"fqn": n["fqn"], "type": n.get("type", ""), "role": n.get("role", "other")}
                 for n in dead_zones
@@ -5853,14 +5916,15 @@ def modernize_cmd(
             ],
             "subsystem_summary": _subsystem_summary,
             "subsystem_summary_note": _subsystem_summary_note,
-            "cross_module_tangles": [
-                {
-                    "label": s.get("label") or s.get("name") or "",
-                    "class_count": _class_count(s.get("members") or []),
-                    "member_count": len(s.get("members") or []),
-                }
-                for s in tangle_modules
-            ],
+            "cross_module_tangles": _cross_module_tangles,
+            "cross_module_tangles_note": (
+                "Directed inter-subsystem coupling measured from structural graph "
+                "edges (imports/injects/extends/implements/references/calls). "
+                "edge_count = edges from_package→to_package; mutual=true marks a "
+                "bidirectional (cyclic) dependency — the actual tangle that blocks "
+                "independent module extraction. Empty means no cross-subsystem "
+                "structural coupling was detected."
+            ),
             # BUG-05 fix: don't recommend "Start with hotspot_candidates" when the list is empty.
             "recommendation": (
                 (

sourcecode/detectors/java.py

@@ -284,10 +284,43 @@ class JavaDetector(AbstractDetector):
             if parent_artifact == "spring-boot-starter-parent":
                 sb_version = (parent_elem.findtext(f"{ns}version") or "").strip() or None
 
-        text = ElementTree.tostring(root_elem, encoding="unicode").lower()
+        # BUG #1 (Jenkins field test): framework tokens must be matched only inside
+        # genuine dependency / plugin / parent coordinates, never anywhere in the
+        # serialized pom. Jenkins' war/pom.xml lists `<exclude>...:spring-web</exclude>`
+        # and `<exclude>...:spring-aop</exclude>` in an enforcer-plugin bytecode rule
+        # — those are exclusions of transitive artifacts, not declared dependencies.
+        # Serializing the whole tree let them read as "uses Spring MVC / Spring AOP".
+        # Restrict the scan to real dependency/plugin/parent artifact coordinates;
+        # `<exclusion>` and `<exclude>` elements carry neither.
+        text = self._pom_coordinate_text(root_elem, ns)
         frameworks = self._detect_jvm_frameworks(text, "pom.xml", sb_version=sb_version)
         return frameworks
 
+    def _pom_coordinate_text(self, root_elem: ElementTree.Element, ns: str) -> str:
+        """Collect groupId:artifactId coordinates from real dependency, plugin, and
+        parent declarations only. Skips `<exclusion>`/`<exclude>` (transitive-artifact
+        removals) and comments, which must never be read as usage signal."""
+        coords: list[str] = []
+
+        def _coord(elem: ElementTree.Element) -> None:
+            gid = (elem.findtext(f"{ns}groupId") or "").strip()
+            aid = (elem.findtext(f"{ns}artifactId") or "").strip()
+            if aid:
+                coords.append(f"{gid}:{aid}" if gid else aid)
+
+        # <dependency> nodes anywhere (dependencies, dependencyManagement, profiles).
+        # ElementTree never yields <dependency> under <exclusions> (those are
+        # <exclusion>), so exclusion coordinates are structurally excluded.
+        for dep in root_elem.iter(f"{ns}dependency"):
+            _coord(dep)
+        for plugin in root_elem.iter(f"{ns}plugin"):
+            _coord(plugin)
+        parent_elem = root_elem.find(f"{ns}parent")
+        if parent_elem is not None:
+            _coord(parent_elem)
+
+        return "\n".join(coords).lower()
+
     def _frameworks_from_gradle(self, path: Path) -> list[FrameworkDetection]:
         original = "\n".join(read_text_lines(path))
         content = original.lower()
@@ -361,7 +394,12 @@ class JavaDetector(AbstractDetector):
             frameworks.append(FrameworkDetection(name="Thymeleaf", source=source))
         if "freemarker" in text:
             frameworks.append(FrameworkDetection(name="FreeMarker", source=source))
-        if "spring-boot-starter-security" in text or "spring-security-core" in text:
+        if (
+            "spring-boot-starter-security" in text
+            or "spring-security-core" in text
+            or "spring-security-web" in text
+            or "spring-security-config" in text
+        ):
             frameworks.append(FrameworkDetection(name="Spring Security", source=source))
         if "spring-boot-starter-data-jpa" in text or "spring-data-jpa" in text:
             frameworks.append(FrameworkDetection(name="Spring Data JPA", source=source))

sourcecode/explain.py

@@ -298,10 +298,15 @@ def _structural_purpose(
     head = f"Likely {role} (no DI annotations found)" if role else \
         "Likely a structurally significant class (no DI annotations found)"
     signals: list[str] = []
+    # BUG #6 (Broadleaf field test): this counts DISTINCT dependent classes (DI
+    # dependents + reverse-call-graph callers, deduped to class level), which is a
+    # different metric from modernize's node.in_degree (raw incoming-edge count
+    # across ALL edge types, symbol-level). Name it explicitly so the two numbers
+    # are not read as a contradiction when cross-referenced.
     if in_degree >= 3:
-        signals.append(f"high in-degree ({in_degree})")
+        signals.append(f"high fan-in ({in_degree} distinct caller classes)")
     elif in_degree:
-        signals.append(f"in-degree {in_degree}")
+        signals.append(f"{in_degree} distinct caller class{'es' if in_degree != 1 else ''}")
     if lifecycle:
         signals.append(f"lifecycle methods detected ({'/'.join(lifecycle)})")
     suffix = f" — {', '.join(signals)}" if signals else ""

sourcecode/integration_detector.py

@@ -58,6 +58,13 @@ _ATTR_URL_RE = re.compile(r'url\s*=\s*"([^"]*)"')
 _ATTR_NAME_RE = re.compile(r'(?:name|value)\s*=\s*"([^"]*)"')
 _FIRST_LITERAL_RE = re.compile(r'^\s*"([^"]*)"')
 
+# BUG #5 (Jenkins field test): thresholds for the structured coverage_confidence
+# signal. A repo at/above _LARGE_REPO_FILE_THRESHOLD source files with fewer than
+# _LOW_COVERAGE_COUNT recognized integration constructs is flagged "low" coverage —
+# the count almost certainly under-represents custom-protocol/SPI integrations.
+_LARGE_REPO_FILE_THRESHOLD: int = 300
+_LOW_COVERAGE_COUNT: int = 10
+
 # token -> (kind, client). Matched as whole-word usage outside imports/comments.
 # Covers Spring AND plain-Java/Jakarta stacks (Quarkus, Micronaut, Keycloak SPI):
 # the detector must not be Spring-centric, or a non-Spring repo with real LDAP /
@@ -76,6 +83,17 @@ _TOKEN_CLIENTS: "tuple[tuple[str, str, str], ...]" = (
     ("InitialLdapContext", "ldap", "jndi-ldap"),
     ("InitialDirContext", "ldap", "jndi-ldap"),
     ("LdapContext", "ldap", "jndi-ldap"),
+    # Spring Security LDAP authentication (BUG #5, Broadleaf field test): the
+    # idiomatic auth integration is a UserDetails mapper that extends
+    # LdapUserDetailsMapper and consumes DirContextOperations — neither uses
+    # LdapTemplate/ContextSource directly, so the connection-type tokens above
+    # miss it entirely. These types come from spring-security-ldap / spring-ldap
+    # and are unambiguous LDAP integration points.
+    ("LdapUserDetailsMapper", "ldap", "spring-security-ldap"),
+    ("DirContextOperations", "ldap", "spring-ldap"),
+    ("LdapContextSource", "ldap", "spring-ldap"),
+    ("DefaultSpringSecurityContextSource", "ldap", "spring-security-ldap"),
+    ("BindAuthenticator", "ldap", "spring-security-ldap"),
     # Mail / SMTP (JavaMail / Jakarta Mail)
     ("JavaMailSender", "smtp", "spring-mail"),
     ("MimeMessage", "smtp", "javamail"),
@@ -316,11 +334,50 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
     # clients (DI, config-driven endpoints, JCA connectors) are invisible to static
     # text matching. Report that explicitly instead of an authoritative "0".
     confidence = "observed" if records else "not_analyzed"
+
+    # BUG #5 (Jenkins field test): the coverage caveat lived only inside the prose
+    # `coverage_note`. Propagate it as a STRUCTURED signal so an automated consumer
+    # does not read a low `count` as "low external coupling". A large repo with few
+    # recognized constructs (Jenkins: custom remoting/SCM/Update-Center SPIs, not
+    # RestTemplate/WebClient) is under-counted, not loosely coupled.
+    _repo_size = len(file_paths)
+    _large_repo = _repo_size >= _LARGE_REPO_FILE_THRESHOLD
+    if not records:
+        coverage_confidence = "low"
+        _cov_reason = (
+            "no recognized client-library construct found; custom protocol/SPI-based "
+            "or DI-wired integrations are not statically detectable by this analyzer. "
+            "A count of 0 does not imply the system has no outbound integrations."
+        )
+    elif _large_repo and len(records) < _LOW_COVERAGE_COUNT:
+        coverage_confidence = "low"
+        _cov_reason = (
+            f"only {len(records)} recognized construct(s) across {_repo_size} source "
+            "files; count reflects only recognized client-library patterns "
+            "(RestTemplate/WebClient/JDK/Apache/OkHttp/LDAP/JMS/…). Custom protocol/"
+            "SPI-based integrations are likely under-counted — do not read a low count "
+            "as low external coupling."
+        )
+    elif len(records) < _LOW_COVERAGE_COUNT:
+        coverage_confidence = "partial"
+        _cov_reason = (
+            "recognized client-library constructs detected; custom protocol/SPI-based "
+            "or DI-wired integrations, if any, are not statically visible."
+        )
+    else:
+        coverage_confidence = "high"
+        _cov_reason = (
+            "recognized client-library constructs cover the observable integration "
+            "surface; runtime/DI-wired clients remain out of static scope."
+        )
+
     return {
         "integrations": records,
         "by_kind": {k: by_kind[k] for k in sorted(by_kind)},
         "count": len(records),
         "confidence": confidence,
+        "coverage_confidence": coverage_confidence,
+        "coverage_confidence_reason": _cov_reason,
         "coverage_note": (
             "Detects HTTP (RestTemplate/WebClient/JDK/Apache/OkHttp), LDAP (Spring "
             "+ JNDI), DNS (JNDI DirContext w/ DnsContextFactory), SMTP (JavaMail, "

sourcecode/migrate_check.py

@@ -645,6 +645,18 @@ def _classify_code_context(finding: "MigrationFinding") -> str:
     if is_test_or_fixture_path(path):
         return "test"
     norm = path.replace("\\", "/").lower()
+    # BUG #4 (Broadleaf field test): a Spring XML config file can live under
+    # src/main/resources yet be test-only scaffolding loaded exclusively by
+    # test @ContextConfiguration (e.g. bl-applicationContext-test-security.xml).
+    # is_test_or_fixture_path deliberately ignores the filename, so a `test`
+    # marker in the config file's own name is not seen. For XML config, a `test`
+    # token in the base filename is a strong, low-FP test-scope signal —
+    # production context files are not named `-test-`. Keep it out of
+    # blocking_count so test scaffolding never inflates the headline blocker.
+    if norm.endswith(".xml"):
+        base = norm.rsplit("/", 1)[-1]
+        if re.search(r"(?:^|[-_.])test(?:[-_.]|$)", base):
+            return "test"
     if any(frag in norm for frag in _GENERATED_PATH_FRAGMENTS):
         return "generated"
     # javax.annotation.Generated is the marker emitted into autogenerated code.
@@ -652,6 +664,13 @@ def _classify_code_context(finding: "MigrationFinding") -> str:
         imp.rsplit(".", 1)[-1] == "Generated" for imp in finding.imports_found
     ):
         return "generated"
+    # BUG #3 (Jenkins field test): a namespace-migration finding (javax→jakarta,
+    # e.g. javax.servlet) on a class-level @Deprecated type is a frozen-legacy
+    # compatibility shim — kept for binary compat, with a live replacement elsewhere
+    # (Jenkins ChainedServletFilter → ChainedServletFilter2). Not an active blocker:
+    # segregate it out of blocking_count like test/generated, with its own label.
+    if finding.enclosing_deprecated and finding.migration_target in _JAKARTA_TARGETS:
+        return "deprecated_shim"
     return "main"
 
 
@@ -929,6 +948,42 @@ def _find_non_java_files(
     return xml_files, build_files
 
 
+def _xml_explanation_for(rule: "_XmlRule", matches: list) -> str:
+    """Return an explanation reflecting the sub-pattern that actually matched.
+
+    BUG #4 (Broadleaf field test): MIG-031's pattern is an OR of two independent
+    triggers — old-style `<http auto-config="true">` and a versioned legacy schema
+    (spring-security-[2-5].x.xsd). The static template asserted BOTH, so a file
+    that only used auto-config (its schema line already being the unversioned
+    spring-security.xsd) got a factually wrong explanation claiming a versioned
+    schema. Emit only the condition(s) present in this file.
+    """
+    if rule.id != "MIG-031":
+        return rule.explanation
+    matched_text = " ".join(m.group(0).lower() for m in matches)
+    has_autoconfig = "auto-config" in matched_text
+    has_versioned_schema = bool(re.search(r"spring-security-[2345]\.", matched_text))
+    triggers: list[str] = []
+    if has_autoconfig:
+        triggers.append(
+            "uses the old-style <http auto-config='true'> shortcut, which was "
+            "removed in Spring Security 6"
+        )
+    if has_versioned_schema:
+        triggers.append(
+            "references a versioned legacy schema (spring-security-[2-5].x.xsd) "
+            "whose namespace attributes changed in Spring Security 6"
+        )
+    if not triggers:  # defensive — pattern matched but neither branch classified
+        return rule.explanation
+    return (
+        "XML-based Spring Security configuration in this file "
+        + " and ".join(triggers)
+        + ". Spring Security 6 (Spring Boot 3) requires migrating this to "
+        "Java-based @Configuration with a SecurityFilterChain @Bean."
+    )
+
+
 def _scan_xml_file(text: str, rel_path: str) -> list["MigrationFinding"]:
     """Apply XML rules to raw XML text. Returns one finding per matched rule."""
     findings: list[MigrationFinding] = []
@@ -940,6 +995,7 @@ def _scan_xml_file(text: str, rel_path: str) -> list["MigrationFinding"]:
             continue
         first_line = text[: matches[0].start()].count("\n") + 1
         snippets = [m.group(0)[:120].strip() for m in matches[:5]]
+        explanation = _xml_explanation_for(rule, matches)
         findings.append(
             MigrationFinding(
                 id=MigrationFinding.make_id(rule.id, rel_path),
@@ -949,7 +1005,7 @@ def _scan_xml_file(text: str, rel_path: str) -> list["MigrationFinding"]:
                 source_file=rel_path,
                 first_line=first_line,
                 imports_found=snippets,
-                explanation=rule.explanation,
+                explanation=explanation,
                 fix_hint=rule.fix_hint,
                 migration_target=rule.migration_target,
                 openrewrite_recipe=rule.openrewrite_recipe,
@@ -1181,6 +1237,11 @@ class MigrationFinding:
     # harness), or "generated" (autogenerated source). Only "main" counts toward
     # blocking_count / readiness; test+generated are reported in a separate bucket.
     code_context: str = "main"
+    # BUG #3 (Jenkins field test): the enclosing top-level TYPE carries a class-level
+    # @Deprecated annotation. A namespace-migration finding on such a class is a
+    # frozen-legacy compatibility shim (kept for binary compat, replaced elsewhere),
+    # not an active migration blocker — reclassified out of blocking_count.
+    enclosing_deprecated: bool = False
 
     @staticmethod
     def make_id(rule_id: str, source_file: str) -> str:
@@ -1294,6 +1355,12 @@ class MigrationReport:
     spring_boot_version_detected: Optional[str] = None
     # BUG #2: whether Spring is used AT RUNTIME. The Boot3 dimension is N/A without it.
     spring_present: bool = True
+    # BUG #2 (Jenkins field test): whether the repo is a Spring BOOT application
+    # (spring-boot* coordinate / @SpringBootApplication), as opposed to merely having
+    # a Spring library (e.g. spring-security-web) on the classpath. The boot3 (Boot
+    # 2→3) migration dimension is applicable ONLY to Boot repos — a non-Boot Spring
+    # repo has no Boot upgrade axis and must not receive a contaminated readiness.
+    spring_boot_present: bool = False
     # BUG #1/#2: Spring appears ONLY as a test dependency (e.g. spring-test). Reported
     # so a consumer can see WHY boot3 is N/A despite an org.springframework coordinate.
     spring_test_only: bool = False
@@ -1366,7 +1433,19 @@ class MigrationReport:
         self.jakarta_readiness = _dimension_score(main_findings, _JAKARTA_TARGETS)
         self.boot3_readiness = _dimension_score(main_findings, _BOOT3_MIGRATION_TARGETS)
         self.jdk_modernization = _dimension_score(main_findings, None)
-        if not self.spring_present:
+        # BUG #2 (Jenkins field test): the boot3 axis applies only with POSITIVE
+        # evidence — a Spring BOOT repo (spring-boot* coordinate / @SpringBootApplication),
+        # OR a concrete Boot-3 / Security-6 migration finding in main code. A repo that
+        # merely carries a Spring library (spring-security-web) with no Boot and no
+        # Boot/Security migration findings (Jenkins) has no boot3 axis — jakarta-shaped
+        # findings must not masquerade as a boot3 readiness deficit. Note: jakarta
+        # findings do NOT make boot3 applicable; only genuine boot3/security-6 targets do.
+        _boot3_migration_findings = any(
+            f.migration_target in (_BOOT3_MIGRATION_TARGETS - _JAKARTA_TARGETS)
+            for f in main_findings
+        )
+        _boot3_applies = self.spring_boot_present or _boot3_migration_findings
+        if not _boot3_applies:
             self.boot3_readiness = 100
 
         # BUG #3/#4: the jakarta dimension is applicable ONLY with POSITIVE evidence the
@@ -1442,14 +1521,23 @@ class MigrationReport:
                            else "N/A — no migratable javax.* imports detected"),
             },
             "boot3": {
-                "applicable": self.spring_present,
-                "score": self.boot3_readiness if self.spring_present else None,
-                "reason": ("Spring Boot 2→3 / Security 6 migration"
-                           if self.spring_present
-                           else ("N/A — Spring present only as a TEST dependency "
-                                 "(spring-test); no runtime Spring"
-                                 if self.spring_test_only
-                                 else "N/A — no Spring usage detected (non-Spring stack)")),
+                "applicable": _boot3_applies,
+                "score": self.boot3_readiness if _boot3_applies else None,
+                "reason": (
+                    "Spring Boot 2→3 / Security 6 migration"
+                    if self.spring_boot_present
+                    else "Spring Security 6 migration (spring_security_6 / spring_boot_3 "
+                         "findings present) — no Spring Boot detected"
+                    if _boot3_applies
+                    else "N/A — Spring present only as a TEST dependency (spring-test); "
+                         "no runtime Spring, no Spring Boot"
+                    if self.spring_test_only
+                    else "N/A — Spring library on the classpath but no spring-boot "
+                         "dependency / @SpringBootApplication and no Boot/Security-6 "
+                         "migration finding — not a Spring Boot application"
+                    if self.spring_present
+                    else "N/A — no Spring usage detected (non-Spring stack)"
+                ),
             },
             "jdk_modernization": {"applicable": True, "score": self.jdk_modernization,
                                   "reason": "orthogonal JDK modernization debt (excluded from "
@@ -1542,8 +1630,11 @@ class MigrationReport:
             "count": sum(_nb_by_ctx.values()),
             "by_context": _nb_by_ctx,
             "by_rule": _nb_by_rule,
-            "note": ("Findings in test/fixture harnesses or autogenerated sources. "
-                     "Excluded from blocking_count, readiness, and effort."),
+            "note": ("Findings in test/fixture harnesses, autogenerated sources, or "
+                     "class-level @Deprecated frozen-legacy shims (code_context="
+                     "\"deprecated_shim\" — kept for binary compat with a live "
+                     "replacement; verify before removing). Excluded from "
+                     "blocking_count, readiness, and effort."),
         }
 
         self.summary = {
@@ -1585,6 +1676,7 @@ class MigrationReport:
             "hygiene_findings": self.hygiene_findings,
             "non_blocking": self.non_blocking,
             "spring_present": self.spring_present,
+            "spring_boot_present": self.spring_boot_present,
             "spring_test_only": self.spring_test_only,
             "spring_boot_2_detected": self.spring_boot_2_detected,
             "spring_boot_version_detected": self.spring_boot_version_detected,
@@ -1746,12 +1838,35 @@ def _neutralize_non_spring_explanation(text: str) -> str:
     return text
 
 
+# BUG #3 (Jenkins field test): the primary top-level type declaration in a .java
+# file. Used to test whether a class-level @Deprecated annotation precedes it.
+_PRIMARY_TYPE_DECL_RE: re.Pattern = re.compile(
+    r"(?m)^[ \t]*(?:public\s+|final\s+|abstract\s+|sealed\s+|non-sealed\s+|strictfp\s+)*"
+    r"(?:class|interface|enum|record)\s+\w"
+)
+
+
+def _primary_type_is_deprecated(source: str) -> bool:
+    """True iff the file's primary top-level type carries a class-level @Deprecated
+    annotation. Scoped to the region between the last import and the type keyword so
+    a @Deprecated on a METHOD (below the class declaration) never counts — that is a
+    live class with a deprecated member, not a frozen-legacy shim."""
+    m = _PRIMARY_TYPE_DECL_RE.search(source)
+    if not m:
+        return False
+    head = source[: m.start()]
+    last_import = head.rfind("\nimport ")
+    window = head[last_import:] if last_import != -1 else head
+    return "@Deprecated" in window
+
+
 def _scan_file(
     source: str,
     rel_path: str,
     rules: list[_Rule],
 ) -> list[MigrationFinding]:
     findings: list[MigrationFinding] = []
+    type_deprecated = _primary_type_is_deprecated(source)
 
     for rule in rules:
         matched_imports: list[str] = []
@@ -1820,6 +1935,7 @@ def _scan_file(
                 fix_hint=rule.fix_hint,
                 migration_target=rule.migration_target,
                 openrewrite_recipe=rule.openrewrite_recipe,
+                enclosing_deprecated=type_deprecated,
             )
         )
 
@@ -1941,6 +2057,7 @@ def run_migrate_check(
     spring_present, spring_test_only = _detect_spring_usage(
         root, spring_runtime_import_seen, spring_test_import_seen
     )
+    spring_boot_present = _detect_spring_boot_present(root)
 
     # BUG #8: classify each finding's code context (main / test / generated) so the
     # report can keep test fixtures and autogenerated sources out of blocking_count.
@@ -1965,6 +2082,7 @@ def run_migrate_check(
         spring_boot_2_detected=spring_boot_2,
         spring_boot_version_detected=spring_boot_version,
         spring_present=spring_present,
+        spring_boot_present=spring_boot_present,
         spring_test_only=spring_test_only,
         jakarta_namespace_adopted=jakarta_import_count > 0,
         findings=all_findings,
@@ -2065,6 +2183,46 @@ def _extract_boot_versions(text: str) -> tuple[set[int], Optional[str]]:
     return majors, full
 
 
+# BUG #2 (Jenkins field test): strip XML comments and exclusion/exclude blocks
+# before scanning for a spring-boot coordinate, so a `<exclude>...:spring-boot</…>`
+# or a comment never reads as "this repo uses Spring Boot" — the same exclusion
+# poison that produced phantom Spring MVC/AOP in framework detection.
+_XML_COMMENT_RE: re.Pattern = re.compile(r"<!--.*?-->", re.DOTALL)
+_XML_EXCLUSION_EL_RE: re.Pattern = re.compile(r"<exclusion\b.*?</exclusion\s*>", re.DOTALL | re.IGNORECASE)
+_XML_EXCLUDE_EL_RE: re.Pattern = re.compile(r"<exclude\b.*?</exclude\s*>", re.DOTALL | re.IGNORECASE)
+# A spring-boot* Maven/Gradle artifact coordinate (starter, BOM, dependency, plugin).
+_SPRING_BOOT_ARTIFACT_RE: re.Pattern = re.compile(r"\bspring-boot(?:-[a-z0-9.\-]+)?\b", re.IGNORECASE)
+
+
+def _strip_xml_exclusions(text: str) -> str:
+    """Remove XML comments and exclusion/exclude elements so their coordinates are
+    not mistaken for declared dependencies."""
+    text = _XML_COMMENT_RE.sub(" ", text)
+    text = _XML_EXCLUSION_EL_RE.sub(" ", text)
+    text = _XML_EXCLUDE_EL_RE.sub(" ", text)
+    return text
+
+
+def _detect_spring_boot_present(root: Path) -> bool:
+    """True iff there is POSITIVE Spring Boot evidence — a spring-boot* build
+    coordinate (parent / BOM / dependency / plugin) or the Spring Boot Gradle
+    plugin. Distinguishes a Spring Boot application from a repo that merely has a
+    Spring library on the classpath (e.g. Jenkins' spring-security-web). Gates the
+    boot3 (Boot 2→3) migration dimension. @SpringBootApplication is not scanned
+    separately: its annotation class ships in spring-boot-autoconfigure, so a Boot
+    app always carries a spring-boot* coordinate."""
+    for abs_path, _rel in _find_build_files(root):
+        try:
+            text = abs_path.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        if _SPRING_BOOT_PLUGIN_RE.search(text):
+            return True
+        if _SPRING_BOOT_ARTIFACT_RE.search(_strip_xml_exclusions(text)):
+            return True
+    return False
+
+
 def _detect_spring_boot(root: Path, jakarta_import_count: int) -> tuple[Optional[bool], Optional[str]]:
     """Tri-state Spring Boot 2 detection. Returns (spring_boot_2_detected, version).