sourcecode 2.1.0__tar.gz → 2.3.0__tar.gz

{sourcecode-2.1.0 → sourcecode-2.3.0}/CHANGELOG.md

@@ -1,5 +1,133 @@
 # Changelog
 
+## [2.3.0] — 2026-07-12
+
+**Module graph promoted to a first-class Evidence Provider for architectural
+characterization (ADR-0003 step 2).** The experimental `archetype` model can now
+derive architectural style from the *directed structure* of the module
+dependency graph rather than from directory names — names become secondary
+evidence. This consolidates a new evidence source; the legacy report wording is
+unchanged (no cutover) pending cross-repo validation.
+
+### Added
+
+- **`graph_evidence.py` — a pure, archetype-agnostic Graph Evidence Provider.**
+  Transforms a `ModuleGraph` into reusable topological evidence
+  (`ModuleGraph → metrics → GraphEvidence`). It knows graphs, not archetypes: it
+  never classifies, emits no prose, and does not import the scorer. Seven
+  name-free metrics, each O(V+E)/O(V log V): `scc_mass` (non-trivial
+  strongly-connected-component node fraction, iterative Tarjan), `cyclic_density`
+  (intra-SCC back-edges), `hub_concentration`, `module_centralization` (Freeman),
+  `downward_edge_ratio` and `dependency_inversion_ratio` (both via Martin
+  instability `I = out/(in+out)`), and `fan_in_gini`. Graphs below 4 nodes / 3
+  edges report `available=False` and degrade cleanly.
+- **`archetype` consumes topological evidence via a declarative `_GRAPH_MAP`.**
+  The map (`metric → [(dimension, label, weight, polarity, lo, hi)]`) is the only
+  place that couples graphs to archetypes; the scorer reads `Evidence` objects and
+  never traverses the graph. Polarity `-1` *refutes* (a dense cyclic core refutes
+  `layered`/`microkernel`/`hexagonal`). Architectural style now emerges from
+  structure: `layered` from downward flow + acyclicity, `engine` from a woven
+  cyclic core, `microkernel` from a stable hub, `hexagonal` from dependency
+  inversion into a distributed core.
+- **`ask archetype` builds a bounded `ModuleGraph`** (`GraphAnalyzer`) and feeds it
+  to the classifier, best-effort with graceful degradation to the previous
+  name-mass-only behaviour on failure or oversized trees. Output gains top-level
+  `graph_metrics` and `graph_*` entries in candidate evidence traces.
+
+### Changed
+
+- **Confidence is now tied to topological support for the winning label.**
+  `graph_backed` is true only when the winning candidate carries positive
+  `graph_*` evidence — so "high" confidence requires real structure behind *that*
+  conclusion, not merely that a graph exists. (The prior gate keyed on
+  `module_graph_summary` was effectively dead, since the command never populated
+  it.) A new absolute-score floor (`_MIN_CONFIDENT_SCORE`) keeps a near-floor lone
+  winner at "low".
+
+### Notes
+
+- **No report cutover.** Legacy `project_type` / `architecture.pattern` and the
+  report's first two lines are unchanged; `archetype` remains parallel and
+  experimental while the new evidence is validated across repositories.
+- Tests: `tests/test_graph_evidence.py` adds 12 synthetic-graph tests (no real
+  repository) covering metric ranges for layered/engine/microkernel/hexagonal
+  topologies and the archetype integration. Full battery: 3220 passed.
+
+## [2.2.0] — 2026-07-12
+
+**Field-validation hardening — narrative/reporting-layer correctness across the
+audit corpus.** A refute-first pass over ten real repositories fixed a batch of
+mislabeling and miscount bugs where the headline framing contradicted the
+structured output the engine had already produced. No Semantic IR change — every
+fix is in the reporting/narrative layer and reuses facts already extracted.
+
+### Fixed
+
+- **`endpoints` — modeled JAX-RS no longer double-reported as un-modeled surface
+  (A2).** `_build_route_surface` fully models JAX-RS, but `extract_java_endpoints`
+  also counted every `@Path` file into `non_spring_rest_surface{modeled:false}` and
+  warned "count covers Spring-MVC-annotated endpoints only" — contradicting the
+  JAX-RS routes just emitted (18 on eureka, 689 on keycloak). Modeled routes now
+  carry framework provenance (`jax_rs`/`spring_mvc`); when JAX-RS routes were
+  modeled, `jax_rs` is dropped from the un-modeled surface. Genuinely un-modeled
+  surfaces (WebScripts/Servlets, or JAX-RS that produced no route) still surface and
+  still warn.
+- **`spring-audit` — overloaded `@Transactional` methods counted separately (A1).**
+  `TransactionBoundaryIndex.by_symbol` is keyed by signature-less FQN, so overloaded
+  methods (`findAll()` / `findAll(Pageable)`) collapsed to one entry and `stats()`
+  undercounted. A new `all_declared` list (one entry per site) drives the count
+  (petclinic 1→2, matching source); FQN-keyed lookups are unchanged.
+- **`spring-audit` — per-site TX overloads no longer hidden by `by_symbol` collapse
+  (A1-RESIDUAL).** TX-001 (proxy-bypass) and TX-005 (exception-swallow) are per-site
+  checks but iterated the collapsed FQN map; a non-risky overload could overwrite a
+  risky one sharing an FQN, silently dropping the finding. Both now iterate
+  `all_declared` with a dedupe guard. Corpus TX counts unchanged (the residual was
+  latent).
+- **`compact` — Spring Boot version surfaced from pom property (A3).** `--compact`
+  deployment omitted the Boot version when it lived in a `<spring.boot.version>`
+  property rather than the starter-parent, while `migrate-check` resolved it. The
+  serializer now falls back to the property-resolving detector (single source of
+  truth), gated on Boot presence so non-Boot repos gain no phantom version
+  (Broadleaf 3.5.14, consistent).
+- **`endpoints` — `Map.put("/", literal)` no longer treated as a router-DSL route
+  (B1).** The router-DSL detector matched an HTTP-verb name + `"/"` first arg; a
+  plain map write (`swapChars.put("/", "slash")`) was reported as a `PUT /`
+  endpoint. A negative lookahead now rejects a literal second argument — a handler
+  is never a bare literal (openmrs 3→2, jobrunr 12/12 kept).
+- **`endpoints` — test-suite module controllers excluded from entry points (B2).**
+  A scaffolding `@Controller` in openmrs' `test-suite` module (sources under
+  `src/main`) surfaced as a production entry point. Entry-point collection now uses
+  the broader `is_test_or_fixture_path`, and `test-suite`/`test-suites` are
+  recognized test-module segments (openmrs 19→18; petclinic/eureka/keycloak
+  unchanged).
+- **`stack` — JAX-RS API surfaced in the headline stack from source annotations
+  (C1).** Eureka reported `project_type=library` with an empty stack despite 18
+  JAX-RS routes, because the manifest scan has no Jersey/Guice/jsr311 vocabulary and
+  (for gradle) reads only the root build file. When the `.java` scan found JAX-RS
+  entry points and no Jakarta EE framework was inferred, the stack now surfaces
+  `Jakarta EE` from the `@Path`/`@GET` evidence (eureka → `Java rest api using
+  Jakarta EE`). Manifest-only jsr311 still infers nothing (honesty preserved).
+
+### Changed
+
+- **`modernize` — cyclic tangles distinguished from one-way deps in
+  `cross_module_tangles` (TANGLE-1).** A directional dependency is normal layering,
+  not a tangle. Each entry now carries `coupling_type` (`cyclic` when mutual, else
+  `directional`); the note and recommendation state only cyclic entries are real
+  tangles. The key is retained (mcp/USER_GUIDE/tests reference it); cyclic entries
+  still sort first.
+- **CLI — consistent progress spinner across all long-running commands (UX-1).** The
+  TTY-gated progress spinner ran on only 5 code paths; the slowest commands
+  (`spring-audit`, `validation`, `migrate-check`, `endpoints`, `export`,
+  `impact-chain`, `pr-impact`, `explain`) ran silent. All 9 now show the same
+  stderr-only, TTY/CI-gated indicator (never pollutes stdout JSON, zero cost in CI).
+
+### Notes
+
+- No breaking changes. All fixes are reporting/narrative-layer; the Semantic IR and
+  default JSON schemas are unchanged (`cross_module_tangles` gains an additive
+  `coupling_type` field). 3193 tests passing.
+
 ## [2.1.0] — 2026-07-10
 
 **Robustness & Security Inference — vendor-agnostic security & validation posture.**

{sourcecode-2.1.0 → sourcecode-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 2.1.0
+Version: 2.3.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -38,11 +38,11 @@ Description-Content-Type: text/markdown
 
 # ASK Engine
 
-> **Persistent structural intelligence for AI coding agents.**
+> **ASK — Actionable Software Knowledge.** Persistent structural intelligence for AI coding agents.
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-2.1.0-blue)
+![Version](https://img.shields.io/badge/version-2.3.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -84,7 +84,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 2.1.0
+ask version                    # ask 2.3.0
 ```
 
 > **Package vs. command.** The install package is named `sourcecode` this release

{sourcecode-2.1.0 → sourcecode-2.3.0}/README.md

@@ -1,10 +1,10 @@
 # ASK Engine
 
-> **Persistent structural intelligence for AI coding agents.**
+> **ASK — Actionable Software Knowledge.** Persistent structural intelligence for AI coding agents.
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-2.1.0-blue)
+![Version](https://img.shields.io/badge/version-2.3.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -46,7 +46,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 2.1.0
+ask version                    # ask 2.3.0
 ```
 
 > **Package vs. command.** The install package is named `sourcecode` this release

{sourcecode-2.1.0 → sourcecode-2.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "2.1.0"
+version = "2.3.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-2.1.0 → sourcecode-2.3.0}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "2.1.0"
+__version__ = "2.3.0"