sourcecode 2.4.0__tar.gz → 2.5.1__tar.gz

{sourcecode-2.4.0 → sourcecode-2.5.1}/CHANGELOG.md

@@ -1,5 +1,93 @@
 # Changelog
 
+## [2.5.1] — 2026-07-14
+
+**impact-chain correctness fix — field-injected callers are no longer lost.** A service
+method reached only through an injected sibling (`someService.doWork(...)`, a lowercase
+field receiver) was reported as an isolated, zero-caller *low-risk* change — a dangerous
+false negative. The static call-graph resolved intra-class and static (`Type.method()`)
+invocations but never an instance call through a typed field, so no `calls` edge reached
+the target and the blast radius came back empty at `confidence=high`.
+
+### Fixed
+
+- **Receiver-typed call edges (IC-RTC)** (`repository_ir.py`): a repo-wide post-pass
+  emits method-level `calls` edges for instance invocations through a typed field
+  receiver (`field.method(...)`), joining facts already extracted — the invocation atom
+  (`receiver`/`callee`), the field's declared type, and the target type's method index.
+  No new parse. Unresolved, ambiguous, local, or library receivers yield nothing (an
+  unresolved fact stays unresolved rather than being guessed). Recovers the injected
+  cross-service caller the reverse graph previously missed.
+- **Method-scoped impact expansion** (`spring_impact.py`): a method-level query
+  (`Impl#foo`) now expands impl↔interface (CH-001a/b) to the **same-named** member only,
+  not the entire interface — so a change to `foo` no longer inherits the callers of a
+  sibling method `bar`. Class-level (whole-service) queries stay broad. Now that precise
+  `field.method(...)` edges exist, this removes latent caller over-reporting (measured:
+  a petclinic-rest method query dropped from 9 whole-controller false callers to the 6
+  real handler methods that call it).
+- **Inline-annotation field types** (`repository_ir.py`): `_extract_field_types` skipped
+  any line beginning with `@`, dropping single-line declarations such as
+  `@Autowired private Foo foo;`. Leading inline annotations are now stripped before the
+  field is read (brace counting runs on the stripped residual, so annotation string args
+  like `@GetMapping("/a/{id}")` cannot skew class-body depth).
+
+No public JSON contract changes; output stays deterministic. Regression coverage added in
+`tests/test_impact_receiver_typed_calls.py` (cross-service recovery, self-call exclusion,
+method-scope precision, `this.field` receivers, no phantom edges).
+
+## [2.5.0] — 2026-07-13
+
+**Semantic Retrieval Engine v1 — a declarative, agent-ready query layer over ASK's
+already-built knowledge.** Retrieval turns *"ask a typed question of the repository"*
+into a first-class, reusable operation (Layer 3.5, above the Knowledge Layer, below any
+presentation). It **queries** existing structured knowledge — it never extracts, parses,
+or computes new evidence: every answer is a composition of existing engines acquired
+through one shared, cached `KnowledgeContext`. Frozen as v1 in ADR-0004.
+
+### Added
+
+- **Semantic Retrieval Engine** (`src/sourcecode/retrieval/`): a typed `RetrievalRequest`
+  → `IntentResolver` → `QueryPlanner` → declarative `KnowledgeQuery` (a closed, serializable
+  Step algebra) → generic `QueryPlanRuntime` → structured `KnowledgeResult` (entities,
+  evidence, observations, confidence, structured explanation, provenance, executed plan).
+  Adding an intent is enum + plan + registered steps — the generic Runtime is unchanged;
+  this held across 11 phases and **29 intents / 9 domains**.
+- **29 experimental `ask retrieve …` intents** across Architecture, Impact, Transactions,
+  Security, Interfaces/Validation, Integrations, Subsystems, Dependencies, and Graph — each
+  a pure composition of an existing engine (ArchetypeClassifier, `compute_blast_radius`,
+  `SpringSemanticModel`, `run_tx_audit`, `run_security_audit`, `build_validation_surface`,
+  `SemanticIntegrationEngine`, `run_impact_chain`, the module graph). Cross-pack step reuse
+  (`ResolveTarget`, `ResolveEndpointRef`, `ResolveScope`, generic `BuildResult`).
+- **Consolidation (B1–B4):** lazy SourceMap acquisition; per-acquisition timing surfaced in
+  the runtime report; impact-pack evidence parity; the `limit` option activated (default
+  unbounded). `ADR-0004` + `DESIGN-knowledge-provider-integration.md` document the frozen
+  contract and the pattern for adding future knowledge providers.
+- **User guide — architecture chapters (EN + ES):** *How ASK works*, *The semantic engine*,
+  *Architectural intelligence*, *AI workflows* — the Semantic IR / Context Graph / Knowledge
+  Layer / evidence model that the guides previously did not cover.
+
+### Fixed
+
+- **Cold-path performance / apparent hang:** `ContextGraph.relations()`/`symbols()` were
+  re-converting every edge and re-sorting every node on each call, and per-file consumers
+  call them once per file — an O(files × edges) blow-up that made cold `ask --agent` take
+  minutes on large repositories. Memoizing the projections cut jobrunr cold ~21 s → ~4 s and
+  BroadleafCommerce cold `--agent` from a multi-minute hang to ~54 s. Benefits every command
+  that reads the graph.
+- **`archetype` library de-bias (P0):** consumable libraries were confidently labeled
+  `engine` (their internals are engine-like). Non-runnable artifacts (no app/server/servlet
+  entry) are now correctly distinguished from runnable engines — jobrunr `engine(high)` →
+  `library(low)`; real engines (Neo4j) unchanged. Implemented as transparent, auditable
+  evidence.
+- **`fix-bug` argument consistency (P0):** now accepts the sibling-consistent
+  `fix-bug <symptom> <path>` form (mirroring `impact <target> <path>`) instead of failing
+  with a raw usage error; `--symptom` and path-only forms remain unchanged.
+
+### Removed
+
+- All references to a proprietary third-party security annotation were scrubbed from code,
+  tests, and docs (ASK references nothing vendor-proprietary).
+
 ## [2.4.0] — 2026-07-12
 
 **AI Context Cache — a provider-agnostic cache for ASK's reusable Knowledge

{sourcecode-2.4.0 → sourcecode-2.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 2.4.0
+Version: 2.5.1
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-2.3.0-blue)
+![Version](https://img.shields.io/badge/version-2.5.1-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -84,7 +84,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 2.3.0
+ask version                    # ask 2.5.1
 ```
 
 > **Package vs. command.** The install package is named `sourcecode` this release
@@ -218,7 +218,7 @@ repo root (otherwise they report `policy: "none_detected"`):
 ```json
 {
   "customSecurityAnnotations": [
-    { "fullyQualifiedName": "com.example.security.M3FiltroSeguridad", "shortName": "M3FiltroSeguridad" }
+    { "fullyQualifiedName": "com.example.security.CustomSecurityAnnotation", "shortName": "CustomSecurityAnnotation" }
   ]
 }
 ```

{sourcecode-2.4.0 → sourcecode-2.5.1}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-2.3.0-blue)
+![Version](https://img.shields.io/badge/version-2.5.1-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -46,7 +46,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 2.3.0
+ask version                    # ask 2.5.1
 ```
 
 > **Package vs. command.** The install package is named `sourcecode` this release
@@ -180,7 +180,7 @@ repo root (otherwise they report `policy: "none_detected"`):
 ```json
 {
   "customSecurityAnnotations": [
-    { "fullyQualifiedName": "com.example.security.M3FiltroSeguridad", "shortName": "M3FiltroSeguridad" }
+    { "fullyQualifiedName": "com.example.security.CustomSecurityAnnotation", "shortName": "CustomSecurityAnnotation" }
   ]
 }
 ```

{sourcecode-2.4.0 → sourcecode-2.5.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "2.4.0"
+version = "2.5.1"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-2.4.0 → sourcecode-2.5.1}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "2.4.0"
+__version__ = "2.5.1"

{sourcecode-2.4.0 → sourcecode-2.5.1}/src/sourcecode/archetype.py

@@ -80,6 +80,17 @@ _MIN_PRIMARY_SCORE = 0.05
 # A winner must clear this absolute score (not just the top-2 margin) to earn
 # medium/high confidence — a near-floor lone candidate stays "low".
 _MIN_CONFIDENT_SCORE = 0.5
+# Fraction of engine's positive contribution discounted for a non-runnable artifact
+# (P0 library de-bias): an engine-like internal core is expected of a library, so it is not
+# discriminating. Tuned so a clear library (no app/server/servlet entry) is not confidently
+# labeled an engine, while runnable systems (which never trigger the gate) are untouched.
+_LIBRARY_ENGINE_DISCOUNT = 0.55
+# Entry kinds that make a repo a runnable system (an app/server/servlet/daemon) rather
+# than a consumable library. Used to gate the library de-bias (P0).
+_RUNNABLE_ENTRY_KINDS = frozenset({
+    "application", "bootstrap", "main", "server", "daemon", "worker",
+    "mvc_controller", "jax_rs_controller", "servlet", "security_filter", "filter",
+})
 
 
 @dataclass
@@ -389,6 +400,41 @@ class ArchetypeClassifier:
             f"{f.module_count} modules; distributed mass ≈ {cm['distributed']:.0%}",
             1.5, multi, max(cm["distributed"], 0.1))
         self._apply_graph_evidence("software_archetype", cands, f)
+        # ── Library de-bias (P0) ────────────────────────────────────────────────
+        # A consumable JVM artifact — `jar` packaging with no server/bootstrap/application
+        # entry — is a library, not a runnable system. But a library naturally exhibits
+        # engine-like topology: a few core API types with high fan-in, tightly-coupled
+        # internals (SCCs), hub concentration. Those graph metrics (`graph_*`) otherwise
+        # label every library an "engine" (observed: jobrunr → engine(high), library 0.3).
+        # Correct it transparently: (1) add a packaging-grounded library signal that does
+        # not depend on an `api/` package existing; (2) append a NAMED negative evidence row
+        # that discounts most of engine's graph-derived score, since topological hubness in
+        # a library is expected and therefore not discriminating for "engine".
+        # A runnable/web entry of ANY kind (an app bootstrap, an HTTP controller, a
+        # servlet, a daemon) means the repo is a system you run, not a library you depend
+        # on. Packaging is unreliable here (gradle libs report no packaging; maven
+        # aggregators report `pom`), so the entry-kind surface is the robust signal.
+        is_runnable = any(k in f.entry_kinds for k in _RUNNABLE_ENTRY_KINDS)
+        is_library_shaped = not is_runnable
+        if is_library_shaped:
+            add("library", "no_runnable_entry",
+                f"entry kinds {sorted(f.entry_kinds) or 'none'} — no app/server/servlet "
+                "bootstrap; a consumable artifact, not a runnable system",
+                3.0, 1.0, 0.7)
+            # A library legitimately owns an engine-like core (storage/kernel mass, hub
+            # topology, SCCs) — that is what a library *is*. Discount most of engine's
+            # positive evidence for a non-runnable artifact so its internal machinery does
+            # not, alone, promote it to "engine". Transparent: a named negative row.
+            engine_positive = sum(max(0.0, e.contribution) for e in cands["engine"])
+            if engine_positive > 0:
+                discount = engine_positive * _LIBRARY_ENGINE_DISCOUNT
+                cands["engine"].append(Evidence(
+                    "library_core_discount",
+                    "non-runnable artifact: an engine-like internal core (storage/kernel "
+                    "mass, hubs, SCCs) is expected of a library and is not, alone, evidence "
+                    "of an engine product",
+                    1.0, 1.0, 1.0, -discount,
+                ))
         return self._resolve("software_archetype", cands, f)
 
     def _architectural_style(self, f: _Features) -> DimensionResult: