sourcecode 1.70.0__tar.gz → 1.72.0__tar.gz

{sourcecode-1.70.0 → sourcecode-1.72.0}/CHANGELOG.md

@@ -1,5 +1,130 @@
 # Changelog
 
+## [1.72.0] — 2026-07-01
+
+### Fixed — correctness on a large real-world Spring Boot 3 monolith (Broadleaf Commerce CE field test)
+
+A downstream architecture audit of **BroadleafCommerce** (`97705634ac`, branch
+`develop-7.0.x`; ~3,000 Java classes, 13 Maven poms, Spring Boot 3.5 / Spring 6.2 /
+Hibernate 5.6) hand-verified against source surfaced seven reproducible
+correctness defects across `modernize`, `spring-audit`, `migrate-check`, and
+`export --integrations`. Each fix targets the root cause and adds regression
+coverage; all were re-verified against the live repo.
+
+- **`spring-audit` TX-005 — 100% false-positive rate (4/4) on expected-exception idioms.**
+  The "swallowed exception in `@Transactional`" rule flagged the standard JPA
+  control-flow idiom (`Query.getSingleResult()` → `catch (NoResultException)` →
+  insert; tolerant insert → `catch (EntityExistsException)`) and catches carrying an
+  explicit `// do nothing — acceptable condition` intent comment. TX-005 now skips
+  catches whose caught type is a well-known expected-control-flow exception
+  (`NoResultException`, `NonUniqueResultException`, `EntityExistsException`,
+  `EmptyResultDataAccessException`, …) and catches whose body documents a deliberate
+  no-op, while still flagging a genuine unexpected-exception swallow.
+- **`modernize` `statically_unreferenced` — ~95% false positives on annotation-constant nested classes.**
+  Two compounding defects: (a) the pre-scan fast path emitted nested types as
+  `pkg.Inner`, dropping the enclosing class, so distinct nested types with the same
+  simple name (Broadleaf has 25 `GroupName`s) collapsed onto one colliding FQN;
+  (b) static-constant reads inside annotation arguments
+  (`@AdminPresentation(group = GroupName.General)`, incl. the fully-qualified
+  `Outer.Nested.CONST` form and class-level annotations) were never counted as
+  references, so the constant holders read as zero-caller dead code. Now: nested
+  symbols are binary-qualified (`Outer.Inner`); a new `references` edge pass resolves
+  annotation-value reads (bare, inherited-nested via supertypes, and qualified
+  chains) in both parsed and pre-scan-skipped files. Presentation-holder false
+  positives on Broadleaf went 11→0 (the survivors are genuinely-unused declarations).
+- **`modernize` `cross_module_tangles` — re-emitted the subsystem list instead of coupling.**
+  The field echoed `{label, class_count, member_count}` per subsystem with no edge
+  data. It now measures real directed inter-subsystem coupling from structural graph
+  edges, with `edge_count`, `reverse_edge_count`, and `mutual` (bidirectional/cyclic
+  = the actual tangle) — e.g. Broadleaf `profile↔common` is now correctly flagged
+  mutual.
+- **`migrate-check` MIG-031 — test-scope config counted as a production blocker + wrong explanation.**
+  A test-only `bl-applicationContext-test-security.xml` (under `src/main/resources`,
+  loaded only by test `@ContextConfiguration`) inflated `blocking_count`; XML config
+  with a `test` filename marker is now classified `code_context: "test"`
+  (blocking_count 1→0). The explanation was a static OR-template asserting both
+  triggers; it now reports only the sub-pattern that actually matched (auto-config
+  vs versioned legacy schema).
+- **`export --integrations` — missed in-code Spring Security LDAP (false negative).**
+  Subclassing `LdapUserDetailsMapper` and using `DirContextOperations` — the
+  idiomatic Spring Security LDAP auth mapper — was undetected (Broadleaf reported 0
+  LDAP). Added `LdapUserDetailsMapper` / `DirContextOperations` / context-source
+  tokens; Broadleaf now reports 5 LDAP integration points.
+- **`explain` vs `modernize` in-degree — silently contradictory numbers.**
+  The same class showed different fan-in in the two commands with no explanation.
+  Both metrics are now self-describing: `modernize.high_coupling_nodes` documents
+  `in_degree` as the raw all-edge-type incoming count; `explain` labels its value
+  as "N distinct caller classes".
+- **`spring-audit` vs `endpoints` — unreconcilable endpoint counts.**
+  The canonical IR (feeding `spring-audit`, `impact`, `validation`) did not apply the
+  `endpoints` command's filter for framework dynamic-admin FQN-shaped paths, so its
+  count was silently inflated. The filter is now shared; `endpoints_analyzed` is
+  documented as the deduplicated canonical count (≤ `endpoints` total, difference =
+  multi-prefix collapse), reconciling 225 vs 220 on Broadleaf.
+
+## [1.71.0] — 2026-07-01
+
+### Fixed — framework-framing & migration reliability on a large non-Boot Spring repo (Jenkins core field test)
+
+A migration/architecture audit of **jenkins-ci/jenkins** (`e7eef8d2cf`, branch
+`master`; ~1,900 production Java classes, Maven multi-module, uses
+`spring-security-web` but **no Spring MVC, no Spring Boot, no DI container** —
+Jenkins runs on its own Stapler web framework and ACL/SecurityRealm security SPI)
+surfaced five reproducible defects. In every case the engine already computed the
+*correct* internal signal (downgraded confidence, `spring_present`, `not_detected`,
+a prose `coverage_note`) but that signal did not propagate to the high-level field
+an automated consumer reads first. Each fix targets the root cause and adds
+regression coverage. All findings were verified against direct `grep` over the same
+repo.
+
+- **Framework detection — phantom "Spring MVC / Spring AOP" from pom exclusion blocks (BUG #1).**
+  `_frameworks_from_pom` serialized the *entire* pom to text and substring-matched
+  framework tokens, so `<exclude>org.springframework:spring-web</exclude>` and
+  `<exclude>…:spring-aop</exclude>` inside an enforcer bytecode rule in
+  `war/pom.xml` (artifact **exclusions**, not dependencies) read as "uses Spring
+  MVC / Spring AOP". Detection is now restricted to real dependency / plugin /
+  parent **coordinates** (`<exclusion>`/`<exclude>` and comments carry none) — the
+  same discipline the Gradle path already applied (JobRunr fix). The Spring Security
+  token was also broadened to the true-positive `spring-security-web` /
+  `-config` coordinates (Jenkins' real dep), so the honest label survives while the
+  phantoms disappear.
+- **`architecture_summary` — categorical "MVC pattern with … view layers" on a repo with zero controllers (BUG #1).**
+  The `mvc` pattern is a directory-name heuristic. On a Java/Kotlin repo it is now
+  cross-checked against the canonical endpoint extractor in the same run; with no
+  HTTP controllers detected it degrades to a directory-derived "Layered code
+  organization (… — no HTTP controllers detected)" note, dropping the unverified
+  "view" claim rather than asserting MVC.
+- **`migrate-check` — `boot3` dimension applicable without any Spring Boot (BUG #2).**
+  The Boot 2→3 axis was gated on `spring_present` (any `org.springframework.*`
+  coordinate), so a repo carrying only `spring-security-web` received a
+  contaminated `readiness_score` from a migration that does not exist. Applicability
+  now requires **positive evidence**: a `spring-boot*` coordinate / Gradle plugin
+  (`@SpringBootApplication` always ships one), **or** a concrete `spring_boot_3` /
+  `spring_security_6` finding in main code. jakarta findings alone no longer enable
+  boot3. A new `spring_boot_present` flag is surfaced; when N/A the dimension is
+  excluded from the aggregate with a clear reason.
+- **`migrate-check` — `MIG-002` (javax.servlet) counted `@Deprecated` frozen-legacy shims as high blockers (BUG #3).**
+  A namespace-migration finding on a **class-level `@Deprecated`** type (kept for
+  binary compat, with a live replacement — Jenkins `ChainedServletFilter` →
+  `ChainedServletFilter2`) is now classified `code_context="deprecated_shim"` and
+  excluded from `blocking_count`, readiness, and effort, alongside the existing
+  test/generated buckets. A `@Deprecated` **method** on a live class stays blocking.
+  On Jenkins this dropped `blocking_count` from 6 to 2.
+- **`repo-ir` — `security_model` was a bare `"unknown"` string with no reason (BUG #4).**
+  A structured `security_model_detail` companion now mirrors the `not_detected`
+  pattern used elsewhere: `status`, `spring_security_filter_chain_detected`,
+  `annotation_policies_detected`, `custom_spi_detected`, and a `reason` that
+  explicitly notes absence of a *recognized* pattern is not evidence the repo is
+  unsecured (Jenkins uses a custom ACL/SecurityRealm SPI).
+- **`export --integrations` — low count carried no structured coverage flag (BUG #5).**
+  The honest coverage caveat lived only in the prose `coverage_note`. A structured
+  `coverage_confidence` (`low` / `partial` / `high`) plus `coverage_confidence_reason`
+  is now emitted: a large repo (≥300 source files) with <10 recognized constructs is
+  flagged `low` so a consumer cannot read a low count as low external coupling
+  (Jenkins' custom remoting/SCM/Update-Center SPIs are invisible to static matching).
+
+New regression coverage across five suites; full suite green (2,900+ tests).
+
 ## [1.70.0] — 2026-07-01
 
 ### Fixed — reliability & internal-consistency on a large Spring 5 / Hibernate 5 repo (openmrs-core field test)

{sourcecode-1.70.0 → sourcecode-1.72.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.70.0
+Version: 1.72.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -411,7 +411,7 @@ Emits **structured, tool-agnostic** codebase views as plain JSON/YAML — the ki
 |------|--------|
 | `--by-directory` | One group per source directory, each symbol with a `source_file:line` reference. |
 | `--module-graph` | `{nodes, edges, summary}` — directories as modules, inter-module dependencies rolled up from class-level relation edges with hit counts + edge types. |
-| `--integrations` | Outbound integrations across Spring **and** plain-Java/Jakarta stacks: HTTP (`RestTemplate`, `WebClient`, `@FeignClient`, JDK `HttpClient`, Apache, OkHttp), LDAP (`LdapTemplate`, JNDI `InitialDirContext`/`LdapContext`), SMTP (`JavaMailSender`, JavaMail `Transport`/`MimeMessage`), and JMS — with `file:line` evidence and a literal `target` when present. Emits an explicit `confidence` (`observed` / `not_analyzed`) + `coverage_note`: a count of `0` means "no client construct found", **not** "no integrations" (runtime/DI-wired clients are not statically visible). |
+| `--integrations` | Outbound integrations across Spring **and** plain-Java/Jakarta stacks: HTTP (`RestTemplate`, `WebClient`, `@FeignClient`, JDK `HttpClient`, Apache, OkHttp), LDAP (`LdapTemplate`, JNDI `InitialDirContext`/`LdapContext`), SMTP (`JavaMailSender`, JavaMail `Transport`/`MimeMessage`), and JMS — with `file:line` evidence and a literal `target` when present. Emits an explicit `confidence` (`observed` / `not_analyzed`), a structured `coverage_confidence` (`low` / `partial` / `high`) with `coverage_confidence_reason`, and a prose `coverage_note`: a count of `0` — or a low count on a large repo (≥300 files, <10 constructs) — is flagged `low`, so a low count is never read as low external coupling (custom protocol/SPI clients are not statically visible). |
 | `--c4` | Unified document: `c4.{context, containers, components, code}` + `api_surface` + a `manifest` with per-directory content hashes for **incremental** consumers (skip directories whose hash is unchanged). `components.module_roots` rolls leaf source dirs up to architectural module roots and classifies each `layered` (DDD: ≥2 of `domain`/`application`/`infrastructure`) vs `flat` (legacy/flat package), with a verifiable `module_count` — so a consumer enumerates real modules instead of inferring boundaries from leaf directories. |
 
 The section flags compose (pass several for one multi-section document); `--c4` assembles the full export on its own. URLs assembled at runtime yield `target: null` (honest absence, never a guess); containers are derived from build files (Maven/Gradle) and reported as a limitation when none are found.
@@ -734,9 +734,20 @@ evidence. `migrate-check` enforces:
   `hibernate_rewrite` headline. An **unresolved** version degrades to a
   low-confidence hypothesis with no headline blocker. See
   `hibernate.effective_version` / `version_major` / `version_confidence`.
-- **Boot3 auto-disables without Spring.** `boot3.applicable` tracks real Spring
-  usage; Quarkus / Micronaut / Helidon / Jakarta-pure repos report `boot3` as N/A
-  (`spring_present: false`), not a contradictory `applicable: true`.
+- **Boot3 needs Spring _Boot_, not just Spring.** `boot3.applicable` requires
+  positive Spring Boot evidence — a `spring-boot*` coordinate / Gradle plugin (or
+  `@SpringBootApplication`), **or** a concrete `spring_boot_3` / `spring_security_6`
+  finding. A repo that merely carries a Spring library (e.g. `spring-security-web`
+  with no Boot — Jenkins core) reports `boot3` as N/A with a reason and is excluded
+  from the aggregate; `spring_present: true` but `spring_boot_present: false`. Quarkus
+  / Micronaut / Helidon / Jakarta-pure repos likewise report `boot3` N/A. jakarta
+  findings alone never enable boot3.
+- **Frozen-legacy `@Deprecated` shims aren't blockers.** A `javax→jakarta` finding
+  on a **class-level `@Deprecated`** type (kept for binary compat, replaced
+  elsewhere) is classified `code_context: "deprecated_shim"` and excluded from
+  `blocking_count` / readiness / effort — surfaced under `non_blocking` with a
+  "verify before removing" note. A `@Deprecated` **method** on a live class still
+  blocks.
 - **Permanent `javax.*` are never jakarta debt.** JDK/JSR namespaces
   (`javax.cache`, `javax.sql`, `javax.xml` JAXP, `javax.crypto`, `javax.naming`,
   `javax.management`, `javax.security.auth`, `javax.annotation.processing`, …) are

{sourcecode-1.70.0 → sourcecode-1.72.0}/README.md

@@ -373,7 +373,7 @@ Emits **structured, tool-agnostic** codebase views as plain JSON/YAML — the ki
 |------|--------|
 | `--by-directory` | One group per source directory, each symbol with a `source_file:line` reference. |
 | `--module-graph` | `{nodes, edges, summary}` — directories as modules, inter-module dependencies rolled up from class-level relation edges with hit counts + edge types. |
-| `--integrations` | Outbound integrations across Spring **and** plain-Java/Jakarta stacks: HTTP (`RestTemplate`, `WebClient`, `@FeignClient`, JDK `HttpClient`, Apache, OkHttp), LDAP (`LdapTemplate`, JNDI `InitialDirContext`/`LdapContext`), SMTP (`JavaMailSender`, JavaMail `Transport`/`MimeMessage`), and JMS — with `file:line` evidence and a literal `target` when present. Emits an explicit `confidence` (`observed` / `not_analyzed`) + `coverage_note`: a count of `0` means "no client construct found", **not** "no integrations" (runtime/DI-wired clients are not statically visible). |
+| `--integrations` | Outbound integrations across Spring **and** plain-Java/Jakarta stacks: HTTP (`RestTemplate`, `WebClient`, `@FeignClient`, JDK `HttpClient`, Apache, OkHttp), LDAP (`LdapTemplate`, JNDI `InitialDirContext`/`LdapContext`), SMTP (`JavaMailSender`, JavaMail `Transport`/`MimeMessage`), and JMS — with `file:line` evidence and a literal `target` when present. Emits an explicit `confidence` (`observed` / `not_analyzed`), a structured `coverage_confidence` (`low` / `partial` / `high`) with `coverage_confidence_reason`, and a prose `coverage_note`: a count of `0` — or a low count on a large repo (≥300 files, <10 constructs) — is flagged `low`, so a low count is never read as low external coupling (custom protocol/SPI clients are not statically visible). |
 | `--c4` | Unified document: `c4.{context, containers, components, code}` + `api_surface` + a `manifest` with per-directory content hashes for **incremental** consumers (skip directories whose hash is unchanged). `components.module_roots` rolls leaf source dirs up to architectural module roots and classifies each `layered` (DDD: ≥2 of `domain`/`application`/`infrastructure`) vs `flat` (legacy/flat package), with a verifiable `module_count` — so a consumer enumerates real modules instead of inferring boundaries from leaf directories. |
 
 The section flags compose (pass several for one multi-section document); `--c4` assembles the full export on its own. URLs assembled at runtime yield `target: null` (honest absence, never a guess); containers are derived from build files (Maven/Gradle) and reported as a limitation when none are found.
@@ -696,9 +696,20 @@ evidence. `migrate-check` enforces:
   `hibernate_rewrite` headline. An **unresolved** version degrades to a
   low-confidence hypothesis with no headline blocker. See
   `hibernate.effective_version` / `version_major` / `version_confidence`.
-- **Boot3 auto-disables without Spring.** `boot3.applicable` tracks real Spring
-  usage; Quarkus / Micronaut / Helidon / Jakarta-pure repos report `boot3` as N/A
-  (`spring_present: false`), not a contradictory `applicable: true`.
+- **Boot3 needs Spring _Boot_, not just Spring.** `boot3.applicable` requires
+  positive Spring Boot evidence — a `spring-boot*` coordinate / Gradle plugin (or
+  `@SpringBootApplication`), **or** a concrete `spring_boot_3` / `spring_security_6`
+  finding. A repo that merely carries a Spring library (e.g. `spring-security-web`
+  with no Boot — Jenkins core) reports `boot3` as N/A with a reason and is excluded
+  from the aggregate; `spring_present: true` but `spring_boot_present: false`. Quarkus
+  / Micronaut / Helidon / Jakarta-pure repos likewise report `boot3` N/A. jakarta
+  findings alone never enable boot3.
+- **Frozen-legacy `@Deprecated` shims aren't blockers.** A `javax→jakarta` finding
+  on a **class-level `@Deprecated`** type (kept for binary compat, replaced
+  elsewhere) is classified `code_context: "deprecated_shim"` and excluded from
+  `blocking_count` / readiness / effort — surfaced under `non_blocking` with a
+  "verify before removing" note. A `@Deprecated` **method** on a live class still
+  blocks.
 - **Permanent `javax.*` are never jakarta debt.** JDK/JSR namespaces
   (`javax.cache`, `javax.sql`, `javax.xml` JAXP, `javax.crypto`, `javax.naming`,
   `javax.management`, `javax.security.auth`, `javax.annotation.processing`, …) are

{sourcecode-1.70.0 → sourcecode-1.72.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.70.0"
+version = "1.72.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.70.0 → sourcecode-1.72.0}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.70.0"
+__version__ = "1.72.0"

{sourcecode-1.70.0 → sourcecode-1.72.0}/src/sourcecode/architecture_summary.py

@@ -142,6 +142,7 @@ class ArchitectureSummarizer:
         # Line 2: architecture pattern + layers
         if arch and arch.pattern not in (None, "unknown", "flat"):
             arch_line = self._describe_arch_pattern(arch)
+            arch_line = self._qualify_web_pattern(arch, arch_line, sm)
             if arch_line:
                 lines.append(arch_line)
 
@@ -227,6 +228,32 @@ class ArchitectureSummarizer:
         self._endpoint_support_cache = (total, high)
         return self._endpoint_support_cache
 
+    def _qualify_web_pattern(self, arch: Any, arch_line: str, sm: SourceMap) -> str:
+        """BUG #1 (Jenkins field test): the "mvc" pattern is a directory-name
+        heuristic (dirs matching controller/model/view keywords). On a Java/Kotlin
+        repo, do not assert "MVC pattern with ... view layers" in prose when the
+        canonical endpoint extractor finds no HTTP controllers in the same run —
+        Jenkins (Stapler web framework) matches model/view-ish dirs but declares
+        zero Spring MVC controllers. Cross-check against `endpoints` and degrade to
+        a consistent, non-committal phrasing instead of a categorical MVC claim."""
+        if not arch_line or arch.pattern not in ("mvc", "spring_mvc_layered"):
+            return arch_line
+        primary = next((s for s in sm.stacks if s.primary), sm.stacks[0] if sm.stacks else None)
+        if primary is None or primary.stack not in {"java", "kotlin"}:
+            return arch_line
+        _total, high = self._endpoint_support()
+        if high >= _MIN_REST_ENDPOINTS_FOR_LABEL:
+            return arch_line
+        # No controller backing → the MVC/view claim is unverified. Report the
+        # directory-derived layers without the framework label or the "view" claim.
+        layer_names = [l.name for l in arch.layers[:4] if l.name != "view"] if arch.layers else []
+        if layer_names:
+            return (
+                f"Layered code organization ({', '.join(layer_names)}; "
+                f"directory-based — no HTTP controllers detected)."
+            )
+        return ""
+
     def _describe_arch_pattern(self, arch: Any) -> str:
         pattern_labels = {
             "clean": "Clean Architecture",

{sourcecode-1.70.0 → sourcecode-1.72.0}/src/sourcecode/canonical_ir.py

@@ -16,6 +16,7 @@ from __future__ import annotations
 
 import hashlib
 import json
+import re
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any, Optional
@@ -37,6 +38,11 @@ IR_SCHEMA_VERSION = "1.0.0"
 # Edge types excluded from reverse graph (mirrors repository_ir._REVERSE_EXCLUDE)
 _REVERSE_EXCLUDE: frozenset[str] = frozenset({"annotated_with", "mapped_to"})
 
+# A route path that looks like a Java FQN is framework dynamic-admin routing, not a
+# real REST endpoint (mirrors the filter in repository_ir.extract_java_endpoints so
+# the CIR endpoint count reconciles with the `endpoints` command). See BUG #7.
+_FQN_PATH_RE: re.Pattern = re.compile(r"/(org|com|net|io|edu)\.[a-z][a-z0-9]*\.[a-zA-Z]")
+
 
 # ---------------------------------------------------------------------------
 # CanonicalSecurity
@@ -324,9 +330,17 @@ def ir_dict_to_canonical(
     # Build canonical endpoints from route_surface — stable ordering
     route_surface = ir.get("route_surface") or []
     # Deduplicate by endpoint id (route_surface can have duplicates from multi-prefix)
+    # BUG #7 (Broadleaf field test): the `endpoints` command (extract_java_endpoints)
+    # drops routes whose path looks like a Java FQN — framework dynamic-admin routing
+    # (Broadleaf @AdminSection registers entity class FQNs as URL segments) is not a
+    # real REST surface. The CIR endpoint list feeds `spring-audit` (endpoints_analyzed),
+    # `impact` and `validation`; it must apply the SAME filter so its count reconciles
+    # with `endpoints` instead of being silently inflated by those pseudo-routes.
     _seen_ids: set[str] = set()
     raw_endpoints: list[CanonicalEndpoint] = []
     for r in route_surface:
+        if _FQN_PATH_RE.search(r.get("path", "") or ""):
+            continue
         ep = _route_to_canonical_endpoint(r)
         if ep.id not in _seen_ids:
             _seen_ids.add(ep.id)

{sourcecode-1.70.0 → sourcecode-1.72.0}/src/sourcecode/cli.py

@@ -5764,11 +5764,63 @@ def modernize_cmd(
         key=lambda h: (-h["hotspot_score"], h["fqn"]),
     )[:15]
 
-    # Cross-module tangles: subsystems with high member count
-    tangle_modules = sorted(
-        [s for s in subsystems if len(s.get("members") or []) >= 5],
-        key=lambda s: -len(s.get("members") or []),
-    )[:10]
+    # Cross-module tangles: actual inter-subsystem coupling measured from the
+    # dependency graph, NOT a re-labelled subsystem list. For every structural
+    # edge whose endpoints live in two different subsystems we tally a directed
+    # (from_subsystem → to_subsystem) coupling count; pairs coupled in BOTH
+    # directions are the real tangles (bidirectional/cyclic module coupling).
+    _graph_edges: list = (ir.get("graph") or {}).get("edges") or []
+    # Structural coupling edge types. annotated_with / mapped_to / event edges are
+    # excluded (metadata + separate topology, not module-decomposition coupling).
+    _TANGLE_EDGE_TYPES = frozenset({
+        "imports", "injects", "extends", "implements",
+        "references", "calls", "instantiates", "returns",
+    })
+    _fqn_to_pkg: dict[str, str] = {}
+    _pkg_to_label: dict[str, str] = {}
+    for _s in subsystems:
+        _pp = _s.get("package_prefix") or _s.get("pkg") or ""
+        if not _pp:
+            continue
+        _pkg_to_label[_pp] = _s.get("label") or _s.get("name") or _pp
+        for _m in (_s.get("members") or []):
+            _fqn_to_pkg[_m] = _pp
+
+    from collections import Counter as _Counter
+    _pair_counts: "_Counter[tuple[str, str]]" = _Counter()
+    _pair_example: dict[tuple[str, str], str] = {}
+    for _e in _graph_edges:
+        if _e.get("type") not in _TANGLE_EDGE_TYPES:
+            continue
+        _a = _fqn_to_pkg.get(_e.get("from"))
+        _b = _fqn_to_pkg.get(_e.get("to"))
+        if not _a or not _b or _a == _b:
+            continue
+        _pair_counts[(_a, _b)] += 1
+        _pair_example.setdefault((_a, _b), f"{_e.get('from')} → {_e.get('to')}")
+
+    _cross_module_tangles = []
+    for (_a, _b), _cnt in sorted(
+        _pair_counts.items(), key=lambda kv: (-kv[1], kv[0])
+    ):
+        _reverse = _pair_counts.get((_b, _a), 0)
+        _cross_module_tangles.append({
+            "from_subsystem": _pkg_to_label.get(_a, _a),
+            "to_subsystem": _pkg_to_label.get(_b, _b),
+            "from_package": _a,
+            "to_package": _b,
+            "edge_count": _cnt,
+            "reverse_edge_count": _reverse,
+            # A mutual (cyclic) dependency is the actual "tangle" — both modules
+            # reference each other, so neither can be extracted independently.
+            "mutual": _reverse > 0,
+            "example": _pair_example.get((_a, _b), ""),
+        })
+    # Surface mutual tangles first (highest decomposition risk), then by strength.
+    _cross_module_tangles.sort(
+        key=lambda t: (not t["mutual"], -t["edge_count"], t["from_package"])
+    )
+    _cross_module_tangles = _cross_module_tangles[:15]
 
     _summary = {
         "total_classes": len([n for n in graph_nodes if n.get("type") in ("class", "interface")]),
@@ -5837,6 +5889,17 @@ def modernize_cmd(
                 {"fqn": n["fqn"], "in_degree": n.get("in_degree", 0), "role": n.get("role", "other")}
                 for n in coupling_nodes
             ],
+            # BUG #6 (Broadleaf field test): make the in_degree metric self-describing
+            # so it is not confused with `explain`'s caller count. They differ by design.
+            "high_coupling_nodes_note": (
+                "in_degree = raw count of incoming graph edges across ALL edge types "
+                "(imports, injects, extends/implements, references, annotations), "
+                "counted at symbol level. This is deliberately larger than and NOT "
+                "equal to `sourcecode explain`'s caller count, which reports DISTINCT "
+                "dependent classes (DI dependents + reverse-call-graph callers, "
+                "deduplicated to class level). Use in_degree for blast-radius ranking, "
+                "explain's caller list for the concrete dependents to inspect."
+            ),
             "statically_unreferenced": [
                 {"fqn": n["fqn"], "type": n.get("type", ""), "role": n.get("role", "other")}
                 for n in dead_zones
@@ -5853,14 +5916,15 @@ def modernize_cmd(
             ],
             "subsystem_summary": _subsystem_summary,
             "subsystem_summary_note": _subsystem_summary_note,
-            "cross_module_tangles": [
-                {
-                    "label": s.get("label") or s.get("name") or "",
-                    "class_count": _class_count(s.get("members") or []),
-                    "member_count": len(s.get("members") or []),
-                }
-                for s in tangle_modules
-            ],
+            "cross_module_tangles": _cross_module_tangles,
+            "cross_module_tangles_note": (
+                "Directed inter-subsystem coupling measured from structural graph "
+                "edges (imports/injects/extends/implements/references/calls). "
+                "edge_count = edges from_package→to_package; mutual=true marks a "
+                "bidirectional (cyclic) dependency — the actual tangle that blocks "
+                "independent module extraction. Empty means no cross-subsystem "
+                "structural coupling was detected."
+            ),
             # BUG-05 fix: don't recommend "Start with hotspot_candidates" when the list is empty.
             "recommendation": (
                 (

{sourcecode-1.70.0 → sourcecode-1.72.0}/src/sourcecode/detectors/java.py

@@ -284,10 +284,43 @@ class JavaDetector(AbstractDetector):
             if parent_artifact == "spring-boot-starter-parent":
                 sb_version = (parent_elem.findtext(f"{ns}version") or "").strip() or None
 
-        text = ElementTree.tostring(root_elem, encoding="unicode").lower()
+        # BUG #1 (Jenkins field test): framework tokens must be matched only inside
+        # genuine dependency / plugin / parent coordinates, never anywhere in the
+        # serialized pom. Jenkins' war/pom.xml lists `<exclude>...:spring-web</exclude>`
+        # and `<exclude>...:spring-aop</exclude>` in an enforcer-plugin bytecode rule
+        # — those are exclusions of transitive artifacts, not declared dependencies.
+        # Serializing the whole tree let them read as "uses Spring MVC / Spring AOP".
+        # Restrict the scan to real dependency/plugin/parent artifact coordinates;
+        # `<exclusion>` and `<exclude>` elements carry neither.
+        text = self._pom_coordinate_text(root_elem, ns)
         frameworks = self._detect_jvm_frameworks(text, "pom.xml", sb_version=sb_version)
         return frameworks
 
+    def _pom_coordinate_text(self, root_elem: ElementTree.Element, ns: str) -> str:
+        """Collect groupId:artifactId coordinates from real dependency, plugin, and
+        parent declarations only. Skips `<exclusion>`/`<exclude>` (transitive-artifact
+        removals) and comments, which must never be read as usage signal."""
+        coords: list[str] = []
+
+        def _coord(elem: ElementTree.Element) -> None:
+            gid = (elem.findtext(f"{ns}groupId") or "").strip()
+            aid = (elem.findtext(f"{ns}artifactId") or "").strip()
+            if aid:
+                coords.append(f"{gid}:{aid}" if gid else aid)
+
+        # <dependency> nodes anywhere (dependencies, dependencyManagement, profiles).
+        # ElementTree never yields <dependency> under <exclusions> (those are
+        # <exclusion>), so exclusion coordinates are structurally excluded.
+        for dep in root_elem.iter(f"{ns}dependency"):
+            _coord(dep)
+        for plugin in root_elem.iter(f"{ns}plugin"):
+            _coord(plugin)
+        parent_elem = root_elem.find(f"{ns}parent")
+        if parent_elem is not None:
+            _coord(parent_elem)
+
+        return "\n".join(coords).lower()
+
     def _frameworks_from_gradle(self, path: Path) -> list[FrameworkDetection]:
         original = "\n".join(read_text_lines(path))
         content = original.lower()
@@ -361,7 +394,12 @@ class JavaDetector(AbstractDetector):
             frameworks.append(FrameworkDetection(name="Thymeleaf", source=source))
         if "freemarker" in text:
             frameworks.append(FrameworkDetection(name="FreeMarker", source=source))
-        if "spring-boot-starter-security" in text or "spring-security-core" in text:
+        if (
+            "spring-boot-starter-security" in text
+            or "spring-security-core" in text
+            or "spring-security-web" in text
+            or "spring-security-config" in text
+        ):
             frameworks.append(FrameworkDetection(name="Spring Security", source=source))
         if "spring-boot-starter-data-jpa" in text or "spring-data-jpa" in text:
             frameworks.append(FrameworkDetection(name="Spring Data JPA", source=source))

{sourcecode-1.70.0 → sourcecode-1.72.0}/src/sourcecode/explain.py

@@ -298,10 +298,15 @@ def _structural_purpose(
     head = f"Likely {role} (no DI annotations found)" if role else \
         "Likely a structurally significant class (no DI annotations found)"
     signals: list[str] = []
+    # BUG #6 (Broadleaf field test): this counts DISTINCT dependent classes (DI
+    # dependents + reverse-call-graph callers, deduped to class level), which is a
+    # different metric from modernize's node.in_degree (raw incoming-edge count
+    # across ALL edge types, symbol-level). Name it explicitly so the two numbers
+    # are not read as a contradiction when cross-referenced.
     if in_degree >= 3:
-        signals.append(f"high in-degree ({in_degree})")
+        signals.append(f"high fan-in ({in_degree} distinct caller classes)")
     elif in_degree:
-        signals.append(f"in-degree {in_degree}")
+        signals.append(f"{in_degree} distinct caller class{'es' if in_degree != 1 else ''}")
     if lifecycle:
         signals.append(f"lifecycle methods detected ({'/'.join(lifecycle)})")
     suffix = f" — {', '.join(signals)}" if signals else ""

{sourcecode-1.70.0 → sourcecode-1.72.0}/src/sourcecode/integration_detector.py

@@ -58,6 +58,13 @@ _ATTR_URL_RE = re.compile(r'url\s*=\s*"([^"]*)"')
 _ATTR_NAME_RE = re.compile(r'(?:name|value)\s*=\s*"([^"]*)"')
 _FIRST_LITERAL_RE = re.compile(r'^\s*"([^"]*)"')
 
+# BUG #5 (Jenkins field test): thresholds for the structured coverage_confidence
+# signal. A repo at/above _LARGE_REPO_FILE_THRESHOLD source files with fewer than
+# _LOW_COVERAGE_COUNT recognized integration constructs is flagged "low" coverage —
+# the count almost certainly under-represents custom-protocol/SPI integrations.
+_LARGE_REPO_FILE_THRESHOLD: int = 300
+_LOW_COVERAGE_COUNT: int = 10
+
 # token -> (kind, client). Matched as whole-word usage outside imports/comments.
 # Covers Spring AND plain-Java/Jakarta stacks (Quarkus, Micronaut, Keycloak SPI):
 # the detector must not be Spring-centric, or a non-Spring repo with real LDAP /
@@ -76,6 +83,17 @@ _TOKEN_CLIENTS: "tuple[tuple[str, str, str], ...]" = (
     ("InitialLdapContext", "ldap", "jndi-ldap"),
     ("InitialDirContext", "ldap", "jndi-ldap"),
     ("LdapContext", "ldap", "jndi-ldap"),
+    # Spring Security LDAP authentication (BUG #5, Broadleaf field test): the
+    # idiomatic auth integration is a UserDetails mapper that extends
+    # LdapUserDetailsMapper and consumes DirContextOperations — neither uses
+    # LdapTemplate/ContextSource directly, so the connection-type tokens above
+    # miss it entirely. These types come from spring-security-ldap / spring-ldap
+    # and are unambiguous LDAP integration points.
+    ("LdapUserDetailsMapper", "ldap", "spring-security-ldap"),
+    ("DirContextOperations", "ldap", "spring-ldap"),
+    ("LdapContextSource", "ldap", "spring-ldap"),
+    ("DefaultSpringSecurityContextSource", "ldap", "spring-security-ldap"),
+    ("BindAuthenticator", "ldap", "spring-security-ldap"),
     # Mail / SMTP (JavaMail / Jakarta Mail)
     ("JavaMailSender", "smtp", "spring-mail"),
     ("MimeMessage", "smtp", "javamail"),
@@ -316,11 +334,50 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
     # clients (DI, config-driven endpoints, JCA connectors) are invisible to static
     # text matching. Report that explicitly instead of an authoritative "0".
     confidence = "observed" if records else "not_analyzed"
+
+    # BUG #5 (Jenkins field test): the coverage caveat lived only inside the prose
+    # `coverage_note`. Propagate it as a STRUCTURED signal so an automated consumer
+    # does not read a low `count` as "low external coupling". A large repo with few
+    # recognized constructs (Jenkins: custom remoting/SCM/Update-Center SPIs, not
+    # RestTemplate/WebClient) is under-counted, not loosely coupled.
+    _repo_size = len(file_paths)
+    _large_repo = _repo_size >= _LARGE_REPO_FILE_THRESHOLD
+    if not records:
+        coverage_confidence = "low"
+        _cov_reason = (
+            "no recognized client-library construct found; custom protocol/SPI-based "
+            "or DI-wired integrations are not statically detectable by this analyzer. "
+            "A count of 0 does not imply the system has no outbound integrations."
+        )
+    elif _large_repo and len(records) < _LOW_COVERAGE_COUNT:
+        coverage_confidence = "low"
+        _cov_reason = (
+            f"only {len(records)} recognized construct(s) across {_repo_size} source "
+            "files; count reflects only recognized client-library patterns "
+            "(RestTemplate/WebClient/JDK/Apache/OkHttp/LDAP/JMS/…). Custom protocol/"
+            "SPI-based integrations are likely under-counted — do not read a low count "
+            "as low external coupling."
+        )
+    elif len(records) < _LOW_COVERAGE_COUNT:
+        coverage_confidence = "partial"
+        _cov_reason = (
+            "recognized client-library constructs detected; custom protocol/SPI-based "
+            "or DI-wired integrations, if any, are not statically visible."
+        )
+    else:
+        coverage_confidence = "high"
+        _cov_reason = (
+            "recognized client-library constructs cover the observable integration "
+            "surface; runtime/DI-wired clients remain out of static scope."
+        )
+
     return {
         "integrations": records,
         "by_kind": {k: by_kind[k] for k in sorted(by_kind)},
         "count": len(records),
         "confidence": confidence,
+        "coverage_confidence": coverage_confidence,
+        "coverage_confidence_reason": _cov_reason,
         "coverage_note": (
             "Detects HTTP (RestTemplate/WebClient/JDK/Apache/OkHttp), LDAP (Spring "
             "+ JNDI), DNS (JNDI DirContext w/ DnsContextFactory), SMTP (JavaMail, "