sourcecode 2.4.0__py3-none-any.whl → 2.5.1__py3-none-any.whl

sourcecode/retrieval/steps_txsec.py

@@ -0,0 +1,351 @@
+"""TRANSACTIONS & SECURITY pack step handlers (Fase 6).
+
+Six intents (TRANSACTION_FLOW, TRANSACTION_ENTRYPOINTS, TRANSACTION_PROPAGATION,
+SECURITY_SURFACE, SECURITY_CHAIN, VALIDATION_POINTS) expressed purely as compositions of
+these projection steps. NO new analyzer: every step reuses an existing engine and projects
+its already-computed output.
+
+* Transactions → `SpringSemanticModel.tx_index` (structural boundaries) + `run_tx_audit`.
+* Security     → `run_security_audit` (+ the endpoint model for scoping).
+* Validation   → `build_validation_surface`.
+
+No step opens source or parses: the ContextGraph / SpringSemanticModel are acquired once by
+the shared `KnowledgeContext`; steps only read them. Ordering is deterministic; ranking
+reuses the engines' own severity/confidence (`spring_findings.SEVERITY_ORDER`).
+"""
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from sourcecode.spring_findings import SEVERITY_ORDER
+from sourcecode.retrieval.query import (
+    CollectSecurityEvidence,
+    RankByCriticality,
+    ResolvePropagation,
+    ResolveSecurityChain,
+    ResolveSecuritySurface,
+    ResolveTransactionEntrypoints,
+    ResolveTransactionFlow,
+    ResolveValidationPoints,
+    Step,
+)
+from sourcecode.retrieval.result import (
+    Explanation,
+    KnowledgeEntity,
+    Observation,
+    Provenance,
+    RetrievalEvidence,
+)
+from sourcecode.retrieval.steps import (
+    SLOT_CONFIDENCE,
+    SLOT_ENTITIES,
+    SLOT_EVIDENCE,
+    SLOT_EXPLANATION,
+    SLOT_OBSERVATIONS,
+    SLOT_PROVENANCE,
+)
+from sourcecode.retrieval.steps_impact import SLOT_TARGET
+
+if TYPE_CHECKING:
+    from sourcecode.retrieval.runtime import StepContext, StepRegistry
+
+SLOT_SERVICES = "txsec_services"
+_PROPAGATION_PATTERNS = frozenset({"TX-002", "TX-003", "TX-004"})
+_CONF_RANK = {"high": 0, "medium": 1, "low": 2}
+
+
+# ── transactions (structural: SpringSemanticModel.tx_index) ──────────────────────
+def resolve_transaction_flow(step: Step, ctx: "StepContext") -> None:
+    assert isinstance(step, ResolveTransactionFlow)
+    tx = ctx.knowledge.spring_model.tx_index
+    boundaries = list(tx.all_declared)
+    ctx.put(SLOT_ENTITIES, [_boundary_entity(b, "transaction_boundary") for b in boundaries])
+    ctx.put(SLOT_EVIDENCE, [_boundary_evidence(b) for b in boundaries])
+    ctx.put(SLOT_OBSERVATIONS, _stats_observations(tx))
+    ctx.put(SLOT_CONFIDENCE, _agg_conf([b.confidence for b in boundaries]))
+    _add_service(ctx, "SpringSemanticModel")
+
+
+def resolve_transaction_entrypoints(step: Step, ctx: "StepContext") -> None:
+    """Transactional boundaries whose enclosing class is a controller — where transactions
+    begin at the API surface. Reuses tx_index × the endpoint model's controller set."""
+    assert isinstance(step, ResolveTransactionEntrypoints)
+    model = ctx.knowledge.spring_model
+    controllers = set(model.endpoint_index.controller_fqns)
+    boundaries = [b for b in model.tx_index.all_declared if _enclosing_class(b.symbol) in controllers]
+    ctx.put(SLOT_ENTITIES, [_boundary_entity(b, "transaction_entrypoint") for b in boundaries])
+    ctx.put(SLOT_EVIDENCE, [_boundary_evidence(b) for b in boundaries])
+    ctx.put(SLOT_CONFIDENCE, _agg_conf([b.confidence for b in boundaries]))
+    _add_service(ctx, "SpringSemanticModel")
+
+
+def resolve_propagation(step: Step, ctx: "StepContext") -> None:
+    """Boundaries with non-default propagation + the propagation-risk tx audit findings.
+    Reuses tx_index + `run_tx_audit`."""
+    assert isinstance(step, ResolvePropagation)
+    from sourcecode.spring_tx_analyzer import run_tx_audit
+
+    model = ctx.knowledge.spring_model
+    non_default = [b for b in model.tx_index.all_declared if b.propagation != "REQUIRED"]
+    findings = [
+        f
+        for f in run_tx_audit(
+            ctx.knowledge.context_graph.cir, root=ctx.knowledge.root, model=model
+        ).findings
+        if f.pattern_id in _PROPAGATION_PATTERNS
+    ]
+    ctx.put(SLOT_ENTITIES, [_boundary_entity(b, "propagation_point") for b in non_default])
+    ctx.put(SLOT_EVIDENCE, [_boundary_evidence(b) for b in non_default] + [_finding_evidence(f) for f in findings])
+    ctx.put(SLOT_OBSERVATIONS, _stats_observations(model.tx_index))
+    ctx.put(SLOT_CONFIDENCE, _agg_conf([b.confidence for b in non_default] + [f.confidence for f in findings]))
+    _add_service(ctx, "SpringSemanticModel")
+    _add_service(ctx, "run_tx_audit")
+
+
+# ── security (reuse run_security_audit) ──────────────────────────────────────────
+def resolve_security_surface(step: Step, ctx: "StepContext") -> None:
+    assert isinstance(step, ResolveSecuritySurface)
+    findings = _security_findings(ctx)
+    ctx.put(SLOT_ENTITIES, [_finding_entity(f) for f in findings])
+    ctx.put(SLOT_EVIDENCE, [_finding_evidence(f) for f in findings])
+    ctx.put(SLOT_OBSERVATIONS, _severity_observations(findings))
+    ctx.put(SLOT_CONFIDENCE, _agg_conf([f.confidence for f in findings]))
+    _add_service(ctx, "run_security_audit")
+
+
+def resolve_security_chain(step: Step, ctx: "StepContext") -> None:
+    """Security findings scoped to a target (symbol / related / enclosing class). Reuses
+    `run_security_audit`; the target comes from the shared ResolveTarget step."""
+    assert isinstance(step, ResolveSecurityChain)
+    target = ctx.require(SLOT_TARGET)
+    scoped = [f for f in _security_findings(ctx) if _touches(f, target)]
+    ctx.put(SLOT_ENTITIES, [_finding_entity(f) for f in scoped])
+    ctx.put(SLOT_EVIDENCE, [_finding_evidence(f) for f in scoped])
+    ctx.put(SLOT_OBSERVATIONS, _severity_observations(scoped))
+    ctx.put(SLOT_CONFIDENCE, _agg_conf([f.confidence for f in scoped]))
+    _add_service(ctx, "run_security_audit")
+
+
+# ── validation (reuse build_validation_surface) ──────────────────────────────────
+def resolve_validation_points(step: Step, ctx: "StepContext") -> None:
+    assert isinstance(step, ResolveValidationPoints)
+    from sourcecode.validation_surface import build_validation_surface
+
+    surface = build_validation_surface(ctx.knowledge.root, graph=ctx.knowledge.context_graph)
+    endpoints = surface.get("endpoints", []) or []
+    gaps = surface.get("gaps", []) or []
+    entities = [
+        KnowledgeEntity(
+            identity=_route_id(ep),
+            kind="validation_point",
+            score=0.0,
+            attributes={k: v for k, v in ep.items() if k not in ("source_file", "line")},
+        )
+        for ep in endpoints
+    ] + [
+        KnowledgeEntity(identity=_route_id(g), kind="validation_gap", score=0.0, attributes=dict(g))
+        for g in gaps
+    ]
+    ctx.put(SLOT_ENTITIES, entities)
+    ctx.put(
+        SLOT_EVIDENCE,
+        [
+            RetrievalEvidence(
+                signal="validation",
+                detail=_route_id(ep),
+                weight=1.0,
+                strength=1.0,
+                mass=1.0,
+                contribution=1.0,
+                provider="build_validation_surface",
+                source_file=ep.get("source_file"),
+                source_line=ep.get("line"),
+            )
+            for ep in endpoints
+        ],
+    )
+    summary = surface.get("summary", {}) or {}
+    ctx.put(
+        SLOT_OBSERVATIONS,
+        [Observation(name=str(k), value=v, detail="validation surface summary") for k, v in summary.items()],
+    )
+    ctx.put(SLOT_CONFIDENCE, "high" if endpoints or gaps else "medium")
+    _add_service(ctx, "build_validation_surface")
+
+
+# ── ranking + terminal evidence (generic across the pack) ────────────────────────
+def rank_by_criticality(step: Step, ctx: "StepContext") -> None:
+    """Order entities by the engines' OWN severity then confidence then identity. No new
+    score is computed — SEVERITY_ORDER is the audit engines' own severity ranking."""
+    assert isinstance(step, RankByCriticality)
+    entities = ctx.get(SLOT_ENTITIES, [])
+
+    def key(e: KnowledgeEntity):
+        sev = SEVERITY_ORDER.get(e.attributes.get("severity"), 9)
+        conf = _CONF_RANK.get(e.attributes.get("confidence"), 9)
+        return (sev, conf, e.identity)
+
+    ctx.put(SLOT_ENTITIES, sorted(entities, key=key))
+
+
+def collect_security_evidence(step: Step, ctx: "StepContext") -> None:
+    """Assemble confidence, structured explanation (no synthesized prose), and provenance
+    from what the resolve steps produced. GENERIC across every tx/security intent."""
+    confidence = ctx.get(SLOT_CONFIDENCE, "medium")
+    ctx.put(
+        SLOT_EXPLANATION,
+        Explanation(
+            winner=None,
+            score=0.0,
+            confidence=confidence,
+            top_contributions=(),
+            runner_up=None,
+            engine_explanation="",
+        ),
+    )
+    ctx.put(
+        SLOT_PROVENANCE,
+        Provenance(
+            services=tuple(ctx.get(SLOT_SERVICES, [])),
+            signals_used=("tx_index", "endpoint_index", "security_audit", "validation_surface"),
+            signals_missing=(),
+            knowledge_source="SpringSemanticModel + audit/validation engines",
+        ),
+    )
+
+
+# ── helpers ──────────────────────────────────────────────────────────────────────
+def _security_findings(ctx: "StepContext") -> list:
+    from sourcecode.spring_security_audit import run_security_audit
+
+    return run_security_audit(
+        ctx.knowledge.context_graph.cir, root=ctx.knowledge.root, model=ctx.knowledge.spring_model
+    ).findings
+
+
+def _boundary_entity(b, kind: str) -> KnowledgeEntity:
+    return KnowledgeEntity(
+        identity=b.symbol,
+        kind=kind,
+        score=0.0,
+        attributes={
+            "scope": b.scope,
+            "propagation": b.propagation,
+            "isolation": b.isolation,
+            "read_only": b.read_only,
+            "proxy_bypass_risk": b.is_proxy_bypass_risk,
+            "confidence": b.confidence,
+        },
+    )
+
+
+def _boundary_evidence(b) -> RetrievalEvidence:
+    return RetrievalEvidence(
+        signal="transactional",
+        detail=f"@Transactional({b.propagation}, readOnly={b.read_only})",
+        weight=1.0,
+        strength=1.0,
+        mass=1.0,
+        contribution=1.0,
+        provider="SpringSemanticModel",
+        source_file=b.source_file or None,
+    )
+
+
+def _finding_entity(f) -> KnowledgeEntity:
+    return KnowledgeEntity(
+        identity=f.symbol,
+        kind="security_finding",
+        score=0.0,
+        attributes={
+            "pattern_id": f.pattern_id,
+            "severity": f.severity,
+            "confidence": f.confidence,
+            "title": f.title,
+        },
+    )
+
+
+def _finding_evidence(f) -> RetrievalEvidence:
+    file = line = None
+    sf = getattr(f, "source_file", "") or ""
+    if sf:
+        file = sf
+    return RetrievalEvidence(
+        signal=f.pattern_id,
+        detail=f.title,
+        weight=1.0,
+        strength=1.0,
+        mass=1.0,
+        contribution=1.0,
+        provider=f"audit:{f.category}",
+        source_file=file,
+        source_line=line,
+    )
+
+
+def _stats_observations(tx) -> list:
+    stats = tx.stats() if hasattr(tx, "stats") else {}
+    out = []
+    for k, v in stats.items():
+        if isinstance(v, dict):
+            out.append(Observation(name=k, value=sum(v.values()), detail=f"{k}: {v}"))
+        else:
+            out.append(Observation(name=str(k), value=v, detail="tx_index stats"))
+    return out
+
+
+def _severity_observations(findings) -> list:
+    hist: dict[str, int] = {}
+    for f in findings:
+        hist[f.severity] = hist.get(f.severity, 0) + 1
+    return [Observation(name=f"severity_{s}", value=n, detail="security finding count") for s, n in sorted(hist.items())]
+
+
+def _route_id(d: dict) -> str:
+    return (
+        d.get("route")
+        or d.get("path")
+        or f"{d.get('method', '')} {d.get('handler', '')}".strip()
+        or d.get("handler", "")
+        or "?"
+    )
+
+
+def _touches(f, target: str) -> bool:
+    return (
+        f.symbol == target
+        or target in (getattr(f, "related_symbols", []) or [])
+        or _enclosing_class(f.symbol) == target
+        or f.symbol.startswith(target)
+    )
+
+
+def _enclosing_class(symbol: str) -> str:
+    return symbol.split("#", 1)[0]
+
+
+def _agg_conf(confs) -> str:
+    ranked = [c for c in confs if c in _CONF_RANK]
+    if not ranked:
+        return "high"
+    return max(ranked, key=lambda c: _CONF_RANK[c])  # most conservative (lowest)
+
+
+def _add_service(ctx: "StepContext", name: str) -> None:
+    services = list(ctx.get(SLOT_SERVICES, []))
+    if name not in services:
+        services.append(name)
+    ctx.put(SLOT_SERVICES, services)
+
+
+def register_txsec_steps(registry: "StepRegistry") -> None:
+    """Register the TRANSACTIONS & SECURITY handlers (the sanctioned extension seam)."""
+    registry.register(ResolveTransactionFlow.kind, resolve_transaction_flow)
+    registry.register(ResolveTransactionEntrypoints.kind, resolve_transaction_entrypoints)
+    registry.register(ResolvePropagation.kind, resolve_propagation)
+    registry.register(ResolveSecuritySurface.kind, resolve_security_surface)
+    registry.register(ResolveSecurityChain.kind, resolve_security_chain)
+    registry.register(ResolveValidationPoints.kind, resolve_validation_points)
+    registry.register(RankByCriticality.kind, rank_by_criticality)
+    registry.register(CollectSecurityEvidence.kind, collect_security_evidence)

sourcecode/security_config.py

@@ -1,7 +1,7 @@
 """Custom security annotation configuration (BUG-3).
 
 Enterprise Spring projects routinely guard endpoints with bespoke authorization
-annotations (e.g. ``@M3FiltroSeguridad(nombreRecurso=..., nivelRequerido=...)``)
+annotations (e.g. ``@CustomSecurityAnnotation(nombreRecurso=..., nivelRequerido=...)``)
 instead of the standard ``@PreAuthorize`` / ``@Secured`` set. Without knowing
 those names, the endpoint surface reports ``policy: none_detected`` for every
 protected route, which makes ``endpoints`` / ``spring-audit`` blind in exactly
@@ -18,8 +18,8 @@ Config shape::
     {
       "customSecurityAnnotations": [
         {
-          "fullyQualifiedName": "com.example.security.M3FiltroSeguridad",
-          "shortName": "M3FiltroSeguridad",
+          "fullyQualifiedName": "com.example.security.CustomSecurityAnnotation",
+          "shortName": "CustomSecurityAnnotation",
           "resourceParam": "nombreRecurso",
           "levelParam": "nivelRequerido",
           "riskLevel": "custom"
@@ -41,7 +41,7 @@ CONFIG_FILENAME = "sourcecode.config.json"
 class CustomSecuritySpec:
     """One custom security annotation the analyzer should recognize."""
 
-    short_name: str            # e.g. "M3FiltroSeguridad" (no leading @)
+    short_name: str            # e.g. "CustomSecurityAnnotation" (no leading @)
     fqn: str = ""              # fully-qualified name (optional)
     resource_param: str = ""   # annotation attribute naming the protected resource
     level_param: str = ""      # annotation attribute naming the required level

sourcecode/spring_impact.py

@@ -443,6 +443,7 @@ def _bfs_callers(
     reverse_graph: dict[str, dict[str, list[str]]],
     max_depth: int,
     impl_graph: object | None = None,
+    method_scoped: bool = False,
 ) -> tuple[list[str], list[str], bool]:
     """BFS from seed FQNs through reverse_graph.
 
@@ -481,8 +482,22 @@ def _bfs_callers(
     # into direct_callers and inflating the blast radius ~12×. Exclude any caller
     # whose owning class is one of the seed classes.
     seed_classes: set[str] = {normalize_owner_fqn(s) for s in seed_fqns}
+    seed_set: set[str] = set(seed_fqns)
     self_excluded: int = 0
 
+    # P0-IMPACT-01 fix: distinguish self-recursion from same-class sibling calls.
+    # For a METHOD-scoped query ("Foo#doWork"), a *different* method on the same class
+    # (e.g. Foo#callWork → Foo#doWork) is a legitimate caller — the only true
+    # "self-reference" is the seed method invoking itself (recursion). The v1.70.0
+    # whole-class exclusion is correct ONLY for CLASS-scoped queries, where a class's
+    # own members are members, not external callers. Applying it to method queries
+    # silently discarded the intra-class caller edges built by _intra_class_call_edges,
+    # producing a false "0 callers / isolated" for private helpers.
+    def _is_self_reference(caller: str) -> bool:
+        if method_scoped:
+            return caller in seed_set          # only genuine recursion of a seed method
+        return normalize_owner_fqn(caller) in seed_classes
+
     # BUG-004: index class FQN → list of method-level keys in reverse_graph.
     # Callers of Foo#doWork are stored under reverse_graph["Foo#doWork"], never
     # under reverse_graph["Foo"].  Without this index, BFS silently terminates
@@ -519,7 +534,7 @@ def _bfs_callers(
         for etype, fqn_list in _edges_for(seed):
             if etype not in _SKIP_EDGE_TYPES:
                 unique_direct_callers.update(
-                    c for c in fqn_list if normalize_owner_fqn(c) not in seed_classes
+                    c for c in fqn_list if not _is_self_reference(c)
                 )
 
     effective_depth = 1 if len(unique_direct_callers) > _BFS_CALLER_CAP else max_depth
@@ -534,7 +549,8 @@ def _bfs_callers(
         if caller in visited:
             return
         # BUG #2: a member of a seed class is not an external caller — drop it.
-        if normalize_owner_fqn(caller) in seed_classes:
+        # (Method-scoped queries drop only true self-recursion; see _is_self_reference.)
+        if _is_self_reference(caller):
             visited.add(caller)
             self_excluded += 1
             return
@@ -855,6 +871,22 @@ class ImpactOrchestrator:
         original_seed_classes: set[str] = {_class_of(s) for s in seed_fqns}
         # Subtype classes surfaced to the caller as the impacted implementation set.
         subtype_classes_added: set[str] = set()
+
+        # Method-scoped query (e.g. "Impl#foo"): impl/interface expansion must preserve
+        # the queried method's identity. A change to `foo` does not affect callers of a
+        # sibling method `bar`, so the expanded SEED symbols are restricted to the same
+        # method name(s). Class-level queries (a class node with no '#' in the seed)
+        # expand to all members, as before. This bound became observable once precise
+        # `field.method(...)` call edges exist: without it a method query inherited the
+        # callers of every sibling method on the interface (blast-radius inflation).
+        _queried_methods: set[str] = {s.rsplit("#", 1)[1] for s in seed_fqns if "#" in s}
+        _method_scoped = bool(_queried_methods) and all("#" in s for s in seed_fqns)
+
+        def _member_in_scope(sym: str) -> bool:
+            if not _method_scoped:
+                return True
+            return "#" in sym and sym.rsplit("#", 1)[1] in _queried_methods
+
         if impl_graph is not None:
             seed_classes_ch001 = {_class_of(s) for s in seed_fqns}
             impl_seeds: list[str] = []
@@ -867,7 +899,8 @@ class ImpactOrchestrator:
                         continue
                     subtype_classes_added.add(impl_class)
                     for sym in cir.symbols:
-                        if _class_of(sym) == impl_class and sym not in set(seed_fqns):
+                        if (_class_of(sym) == impl_class and sym not in set(seed_fqns)
+                                and _member_in_scope(sym)):
                             impl_seeds.append(sym)
             if impl_seeds:
                 seed_fqns = list(dict.fromkeys(seed_fqns + impl_seeds))
@@ -896,7 +929,8 @@ class ImpactOrchestrator:
                         continue
                     iface_classes_added.add(iface_class)
                     for sym in cir.symbols:
-                        if _class_of(sym) == iface_class and sym not in set(seed_fqns):
+                        if (_class_of(sym) == iface_class and sym not in set(seed_fqns)
+                                and _member_in_scope(sym)):
                             iface_seeds.append(sym)
             if iface_seeds:
                 seed_fqns = list(dict.fromkeys(seed_fqns + iface_seeds))
@@ -909,14 +943,22 @@ class ImpactOrchestrator:
 
         # ── 2. BFS through reverse graph ─────────────────────────────────
         direct_callers, indirect_callers, truncated, self_excluded = _bfs_callers(
-            seed_fqns, cir.reverse_graph, depth, impl_graph=impl_graph
+            seed_fqns, cir.reverse_graph, depth, impl_graph=impl_graph,
+            method_scoped=_method_scoped,
         )
         if self_excluded:
-            warnings.append(
-                f"Self-referential exclusion (BUG #2): {self_excluded} member(s) of the "
-                f"analyzed class were dropped from callers — a class's own methods are "
-                f"members, not external callers (they do not count toward blast radius)."
-            )
+            if _method_scoped:
+                warnings.append(
+                    f"Self-recursion excluded: {self_excluded} recursive self-call(s) of the "
+                    f"queried method were dropped from callers (a method is not its own "
+                    f"caller). Same-class sibling methods ARE counted as callers."
+                )
+            else:
+                warnings.append(
+                    f"Self-referential exclusion (BUG #2): {self_excluded} member(s) of the "
+                    f"analyzed class were dropped from callers — a class's own methods are "
+                    f"members, not external callers (they do not count toward blast radius)."
+                )
         if truncated:
             warnings.append(
                 "Hub-class guard active: symbol has > 500 direct callers — "

{sourcecode-2.4.0.dist-info → sourcecode-2.5.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 2.4.0
+Version: 2.5.1
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-2.3.0-blue)
+![Version](https://img.shields.io/badge/version-2.5.1-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -84,7 +84,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 2.3.0
+ask version                    # ask 2.5.1
 ```
 
 > **Package vs. command.** The install package is named `sourcecode` this release
@@ -218,7 +218,7 @@ repo root (otherwise they report `policy: "none_detected"`):
 ```json
 {
   "customSecurityAnnotations": [
-    { "fullyQualifiedName": "com.example.security.M3FiltroSeguridad", "shortName": "M3FiltroSeguridad" }
+    { "fullyQualifiedName": "com.example.security.CustomSecurityAnnotation", "shortName": "CustomSecurityAnnotation" }
   ]
 }
 ```

{sourcecode-2.4.0.dist-info → sourcecode-2.5.1.dist-info}/RECORD

@@ -1,6 +1,6 @@
-sourcecode/__init__.py,sha256=1iN-frOfJr05mYoED0IYnoxSY-4xnA-sHP9MRe_9Qn4,308
+sourcecode/__init__.py,sha256=KLuqjzw229DS3vhMmuCKlXFinpcH1QG9fhcn7C3J2xg,308
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
-sourcecode/archetype.py,sha256=ezeyCR4E0VeZUUBPwmsWUUPAhIlqwwkc8qDieUx2JWA,31087
+sourcecode/archetype.py,sha256=d7yoN6Tj4OBj-VgSMPEKg4WF9H8FypnZ5A6AkUh5oIE,34484
 sourcecode/architecture_analyzer.py,sha256=6_wC4TYuBYxaqckZS0I1vBSMRPeH2vzlDB48gXwOOd4,46627
 sourcecode/architecture_summary.py,sha256=pkl6lIOnSy-poa9EzW43U0MkXhx2FDfAFh8pDXLpcTo,26630
 sourcecode/ast_extractor.py,sha256=FEsYTsMCXbJfSYQZRk1k-I-PjUNGnKqO1IxMftsgA5U,51351
@@ -10,11 +10,11 @@ sourcecode/caller_metrics.py,sha256=HG8RCOkpzzsEGdnMRob6byrwjoj5__t0TEsBj4yR7ks,
 sourcecode/canonical_ir.py,sha256=U69m8Vkr0p407xF1q5y1KguHXWEAubYw8NFHR9hDNJk,29178
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
 sourcecode/classifier.py,sha256=RhLMDR031FAiUcT3bsf2EL3KrFwl7KsWh_wXXR_Bumo,18729
-sourcecode/cli.py,sha256=xYrKelvgspWuus8LM4DcRroXGydbU47CAr-KV-8oysU,299977
+sourcecode/cli.py,sha256=46Chp0JsEWD_j0HUWOx4tOhrsXSWgWV8JhL5G8SyW4I,322078
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/confidence_analyzer.py,sha256=_jckZSxksV-OU38vbkxfVNBnWCtlCq8Vwfg23x1uspA,19054
 sourcecode/context_cache.py,sha256=maws79rLKDwyZ7c9Q2LwlIxqZHRFlaKzErtO3mglWoA,25036
-sourcecode/context_graph.py,sha256=8MVDu06bPhvRDTgUqWEvRME2fOw34bFLf4OUILZd13I,43527
+sourcecode/context_graph.py,sha256=WFtUvfxoE8XtQxtRJLvaF4SJuS00ICjNoTk0sH2_V5U,44454
 sourcecode/context_scorer.py,sha256=QpChSpsmaAYz91rXA4Ue5xzQmNz_ZboZN09YOHScq1U,14679
 sourcecode/context_summarizer.py,sha256=cI2TZMvEhl0BEma12VtPaX6z03ZVBAetVzuK5GaCOvg,6852
 sourcecode/contract_model.py,sha256=nRxJKPMs1VHwFTa8AVXhGmaLjti3Lr2sjHDpWgv1bfE,3917
@@ -55,12 +55,12 @@ sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg,12965
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=3DONydNhy-UU1R_1l-caePlBiUlZxkk9X5h92VXsQ34,284195
+sourcecode/repository_ir.py,sha256=Cyt7avInKNvayaOSgeSjJgWARcGnVXA-4EAmKSve_Jc,290150
 sourcecode/ris.py,sha256=aG2D4159gtpg968yD3PylYbIXhGFOwIlFBI0DSr84yY,20412
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=WdOQ78mMzjR1NjmKTlbxdgwinnCTfAhxCVLBEFQiFHU,8899
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
-sourcecode/security_config.py,sha256=_m8oQAy2gP7Ho2I-IIMTFFjFVWbJIGlLEOiAWK2TDjs,3503
+sourcecode/security_config.py,sha256=KblMEoRiEjrIE68YsPaUAFebxFp8UM7MS7lAk5CGD8U,3531
 sourcecode/security_posture.py,sha256=CAJw4oJD0aAW2yRewvd_fonkzi9_HpUjBZlIDZle00s,26034
 sourcecode/semantic_analyzer.py,sha256=bpgdC6m0_ftVtRf3rSdwhbhWjnZnGxRXaZVcfe4BbcQ,95414
 sourcecode/semantic_impact_engine.py,sha256=HpgjenY6DLPHPomP7Hw850zA-EBokf1S4O2sh8NegdI,20351
@@ -69,7 +69,7 @@ sourcecode/semantic_services.py,sha256=AO_p7PRfjc-AUh6ThvLMfm4iUGi0issL_frCf8sxG
 sourcecode/serializer.py,sha256=FmQo7eojA_z3ptLW-Vgze5mrEJ6FabcZqiwbQWWTgFI,130056
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=EX7kLZLN74CFyR9iZPm3CI115BfFKNd4WRPuErNljZM,5729
-sourcecode/spring_impact.py,sha256=1Eu1vkdwTVsw92iBEJDe_i_FaSf4uGH9Rb0eSgIAAZc,57542
+sourcecode/spring_impact.py,sha256=tjTxKAtmAvBqDVSSsC4ttCzbLaO55Wg4FJdOd_8MtO0,60077
 sourcecode/spring_model.py,sha256=zOAgFmrRbG4a6KLm1TJl55aWMyPNsz3OS3FSczqPG6A,16594
 sourcecode/spring_security_audit.py,sha256=Rk-aSohezdc7YDYbSoJquVnwpkDB8ty1BCD-4Hc4R5A,22832
 sourcecode/spring_semantic.py,sha256=jteQ1PkY9ArFJv0embg_jBIdbOxqrk9mQ2Xz8OF_FKA,14214
@@ -112,14 +112,32 @@ sourcecode/mcp/onboarding/applier.py,sha256=Z2ZqzPh7dTTzT7tfxDbfjDJKiBNQ18CPQCaR
 sourcecode/mcp/onboarding/backup.py,sha256=ihqGOR8QTX8HASRSEDyfFyXr5bkXrygPHamv4p9KTmk,1452
 sourcecode/mcp/onboarding/detector.py,sha256=kDc0U6kXMuq_GivqwKrgJzIVLVeoLr3RQl63ksW10I8,3327
 sourcecode/mcp/onboarding/planner.py,sha256=Fopg5f72FDiPfldF7NOxYjcBA_w8hi_jBJpSz39lPb8,1332
+sourcecode/retrieval/__init__.py,sha256=h5pKDzXOlu_NQy-YxOaqMSD6UDNoYsmsYSoNLRRZ5uM,5478
+sourcecode/retrieval/context.py,sha256=hjm_RxReZar6GZvVVg4XNR9sVMOUuilbi1Jt7iUoerU,11116
+sourcecode/retrieval/errors.py,sha256=U-zqxzlzCWe3NYCNOBASTSPn1xS8j9D7LfwpGBiznL4,1452
+sourcecode/retrieval/executor.py,sha256=H2-5by5UCYgX7lgJtmT8JJ73ldxp6xiBFEf6r__j_XA,2048
+sourcecode/retrieval/planner.py,sha256=9DPoutVHEYaGodDTmihZjqeNS6vFwJKtANnmO-4cvlU,13375
+sourcecode/retrieval/query.py,sha256=QoVKsuV-PYuunbw06MvV_HdHLAKbo_r-S9xEWFoAVB4,18406
+sourcecode/retrieval/request.py,sha256=gKK5iL5X7ScMz_HQ53FX4G6lbFdkhh0vNkIuxGDLt74,4023
+sourcecode/retrieval/resolution.py,sha256=boa9ybj3AQK5CEMYJn9jA8e0XRNyKKD9avRM5JAIwyA,7163
+sourcecode/retrieval/result.py,sha256=mx6ioA6y6bkNbF6SC3n0N99NTuNEy1uz_5YZQ2euflA,4726
+sourcecode/retrieval/retriever.py,sha256=YdnbaXaWhFKyShuuE6fj36GfgpuGetqOFzx7_D2A9CY,2654
+sourcecode/retrieval/runtime.py,sha256=ODQlPqyS4OfMtCb1oEA_0t7vK0uKPBLhB4K2CnytPUU,10822
+sourcecode/retrieval/steps.py,sha256=wyOiO84fuDgdd-HdugzGSEriN-lN891PTc3gU7lgcmI,9959
+sourcecode/retrieval/steps_endpoint.py,sha256=yOrTA9mWoIrEBVc_-do8m_AAGqjyFqR7jJ9w5LQXycM,12368
+sourcecode/retrieval/steps_graph.py,sha256=ZWA4i1hwCKiP0AOZ-4PJsLHH84abOYVVh6ERNkdE9v0,10050
+sourcecode/retrieval/steps_impact.py,sha256=M0AwU5Ue7nkj-A7DYgQI2BP0BV1b0TFZRrYIydF-Ajw,11605
+sourcecode/retrieval/steps_intf.py,sha256=Jx5Gnm7UT1jOE7YloD0ee3d8PuliX5FgpdvlHh36OBs,9341
+sourcecode/retrieval/steps_struct.py,sha256=jO9L49hziTlS_xhuhCGUavgyAL3ZAnJSOZB-UA4GaRM,13893
+sourcecode/retrieval/steps_txsec.py,sha256=ltyxFAFLHfUglGLGz7i3tY_bovBoKo1d6R2t1xZTcnk,13608
 sourcecode/telemetry/__init__.py,sha256=6wsJnXsgsL_BtMK4hr5Ae1GToHeWej53F4o_-Tc23MQ,3406
 sourcecode/telemetry/config.py,sha256=u_zctgmA1pVT3Ai5jm-pdLY_5kJTRg4Xq2bvIbGBQE4,3727
 sourcecode/telemetry/consent.py,sha256=LIAO9ohJZF8OuZwM4u1VWtALlYfTCCKq4wV3Vwc7i5Q,2194
 sourcecode/telemetry/events.py,sha256=LtzYfaX9Ilckj5PTvAcTpDa9mLqDsYPDUiDkRa58piY,2580
 sourcecode/telemetry/filters.py,sha256=NHa5T-6DaZduQPFuC34jOqHWQgSizM-Ygq8aZ4j19ng,5834
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-2.4.0.dist-info/METADATA,sha256=fairNRCqgRAaSicMGWcWQcPral9_3NeVBIDTrv2rHaI,10837
-sourcecode-2.4.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-2.4.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-2.4.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-2.4.0.dist-info/RECORD,,
+sourcecode-2.5.1.dist-info/METADATA,sha256=eQZ2Bo5Okcz-pi14-mRu9KvrxZzIwkq7WExZEz0pjPE,10851
+sourcecode-2.5.1.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-2.5.1.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-2.5.1.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-2.5.1.dist-info/RECORD,,