sourcecode 2.5.11__py3-none-any.whl → 2.5.13__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "2.5.11"
+__version__ = "2.5.13"

sourcecode/architecture_analyzer.py

@@ -286,6 +286,11 @@ class ArchitectureAnalyzer:
         # architecture claim". `_detect_layers` and its helpers append the
         # findings' sink-neutral detail here; drained into `limitations` below.
         self._refutations: list[str] = []
+        # Gap #2 (fail-open): a reconciliation rule that could not be evaluated
+        # is NOT a clean result — surfaced here as its own limitation, never as a
+        # refutation and never silently, so an unverified pattern cannot ship as
+        # confirmed.
+        self._reconciliation_errors: list[str] = []
 
         # Step 1: filter paths
         filtered = self._filter_paths(sm.file_paths)
@@ -498,6 +503,14 @@ class ArchitectureAnalyzer:
                 continue
             _seen.add(_detail)
             limitations.append(f"Architecture claim refuted on evidence: {_detail}")
+        # Fail-open sink: a rule that could not run is surfaced distinctly — the
+        # pattern it would have checked is reported UNVERIFIED, never certified.
+        _seen_err: set[str] = set()
+        for _detail in self._reconciliation_errors:
+            if _detail in _seen_err:
+                continue
+            _seen_err.add(_detail)
+            limitations.append(f"Architecture reconciliation could not run: {_detail}")
 
         return ArchitectureAnalysis(
             requested=True,
@@ -644,6 +657,24 @@ class ArchitectureAnalyzer:
         return domains
 
     def _detect_layers(self, paths: list[str]) -> tuple[str, list[ArchitectureLayer]]:
+        # Drop directory ENTRIES. `flatten_file_tree` emits every node — files AND
+        # the directories above them — so `sm.file_paths` carries `src`, `src/main`,
+        # `src/main/java/.../model` … A directory is not a file: counting it as a
+        # layer/module member makes it read as jvm-less in `runtime_census` (it holds
+        # no file OF ITS OWN, only children), and a directory that transitively holds
+        # all the Java is then refuted as "no jvm code" — the demonstrated
+        # contamination (petclinic phantom `orchestration` = `src/main`; the
+        # directory half of `data` = `.../model`). A path that is an ancestor of
+        # another path in the set is such an entry; leaf files (incl. template
+        # view-layers) are never ancestors and are kept untouched.
+        _norm = [p.replace("\\", "/") for p in paths]
+        _ancestors: set[str] = set()
+        for _p in _norm:
+            _segs = _p.split("/")
+            for _k in range(1, len(_segs)):
+                _ancestors.add("/".join(_segs[:_k]))
+        paths = [p for p, n in zip(paths, _norm) if n not in _ancestors]
+
         # Exclude non-source paths (tests, benchmarks, docs, tooling, vendored assets)
         # from layer scoring. Also exclude anything under a `resources/` segment: in
         # Maven/Gradle layouts `src/main/resources/**` is bundled config/assets — e.g.
@@ -721,6 +752,11 @@ class ArchitectureAnalyzer:
             for _f in reconcile_architecture_evidence(
                 pattern=pattern_name, layer_files=_layer_paths, repo_files=source_paths
             ):
+                if _f.error:
+                    # A rule that could not run is surfaced always (not tied to
+                    # whether this candidate wins) and never as a refutation.
+                    self._reconciliation_errors.append(_f.detail)
+                    continue
                 _refs.append(_f.detail)
                 if _f.rule == "composition_runtime_split":
                     # A claim that IS a runtime split must show one: JobRunr, a JVM
@@ -922,6 +958,9 @@ class ArchitectureAnalyzer:
         # pruning here directly shapes the returned result (fewer layers, or a
         # drop below 2 that falls through to flat/unknown) — surface it.
         for _f in reconcile_code_modules(layer_files=non_empty, repo_files=paths):
+            if _f.error:
+                self._reconciliation_errors.append(_f.detail)
+                continue
             for _bad in _f.symbols:
                 non_empty.pop(_bad, None)
             self._refutations.append(_f.detail)
@@ -957,6 +996,9 @@ class ArchitectureAnalyzer:
         # eureka "images" (five PNGs). The real modules survive untouched.
         # INV-F1-4: same as the layered path — surface each refuted module.
         for _f in reconcile_code_modules(layer_files=meaningful, repo_files=paths):
+            if _f.error:
+                self._reconciliation_errors.append(_f.detail)
+                continue
             for _bad in _f.symbols:
                 meaningful.pop(_bad, None)
             self._refutations.append(_f.detail)

sourcecode/architecture_summary.py

@@ -210,23 +210,38 @@ class ArchitectureSummarizer:
         # welds a foreign runtime's framework onto the primary's label. Drop what
         # the claimed stack does not attest, and never let the TYPE label — which
         # those same frameworks drove — survive its own evidence (P2-F).
-        from sourcecode.reconciliation import type_claim_unattested, unattested_frameworks
+        from sourcecode.reconciliation import (
+            has_execution_error,
+            reconcile_headline_evidence,
+            type_claim_unattested,
+        )
 
-        foreign = unattested_frameworks(primary.stack, sm.project_type, sm.stacks)
-        attested = [name for name in fw_names if name not in foreign]
-        dropped = [name for name in fw_names if name in foreign]
-        if dropped and not attested and type_claim_unattested(
+        _headline_findings = reconcile_headline_evidence(
             claimed_stack=primary.stack, project_type=sm.project_type, stacks=sm.stacks
-        ):
-            return self._describe_foreign_evidence(sm, stack_label, runtime, dropped)
-        fw_names = attested
+        )
+        if has_execution_error(_headline_findings):
+            # Fail-open guard (gap #2): the attestation rule could not run, and
+            # this prose surface has no gap channel to warn on. Rather than assert
+            # an unverified weld ("C#/.NET … using JAX-RS"), withhold the framework
+            # clause — the claim is not made when its check did not execute.
+            fw_names = []
+        else:
+            foreign = frozenset(s for f in _headline_findings for s in f.symbols)
+            attested = [name for name in fw_names if name not in foreign]
+            dropped = [name for name in fw_names if name in foreign]
+            if dropped and not attested and type_claim_unattested(
+                claimed_stack=primary.stack, project_type=sm.project_type, stacks=sm.stacks
+            ):
+                return self._describe_foreign_evidence(sm, stack_label, runtime, dropped)
+            fw_names = attested
 
         fw_str = f" using {', '.join(fw_names)}" if fw_names else ""
         if runtime:
             # BUG #4: never assert "rest api" in the headline unless the endpoints
-            # command actually backs it (Java/Kotlin only — that is where we have an
-            # authoritative extractor). Degrade to a qualified, consistent phrasing.
-            if sm.project_type == "api" and primary.stack in {"java", "kotlin"}:
+            # command actually backs it. Authority is Java ONLY: extract_java_endpoints
+            # reads *.java and is blind to .kt — a Kotlin REST API would otherwise
+            # degrade to "only 0 endpoints detected" over routes it cannot see.
+            if sm.project_type == "api" and primary.stack == "java":
                 total, high = self._endpoint_support()
                 if high < _MIN_REST_ENDPOINTS_FOR_LABEL:
                     plural = "s" if total != 1 else ""
@@ -310,23 +325,62 @@ class ArchitectureSummarizer:
 
     def _qualify_web_pattern(self, arch: Any, arch_line: str, sm: SourceMap) -> str:
         """BUG #1 (Jenkins field test): the "mvc" pattern is a directory-name
-        heuristic (dirs matching controller/model/view keywords). On a Java/Kotlin
-        repo, do not assert "MVC pattern with ... view layers" in prose when the
+        heuristic (dirs matching controller/model/view keywords). On a JVM repo,
+        do not assert "MVC pattern with ... view layers" in prose when the
         canonical endpoint extractor finds no HTTP controllers in the same run —
         Jenkins (Stapler web framework) matches model/view-ish dirs but declares
-        zero Spring MVC controllers. Cross-check against `endpoints` and degrade to
-        a consistent, non-committal phrasing instead of a categorical MVC claim."""
+        zero Spring MVC controllers.
+
+        This is a reconciliation rule (layer table × endpoint index), so the
+        judgement lives in F-1 (`reconcile_web_pattern_evidence`), not as an
+        ad-hoc `if` here (ADR-0005 §6.2/§8.4). The honest predicate is ZERO
+        modeled controllers, not `< 5`: with the old threshold, 1–4 real
+        controllers still degraded to the categorical "no HTTP controllers
+        detected" — a false statement. One controller backs the MVC claim; only
+        an empty index contradicts it.
+
+        **Authority = Java only.** The extractor (`extract_java_endpoints`) reads
+        `*.java`; it is blind to `.kt`/`.scala`/`.groovy`. So zero controllers is
+        a contradiction ONLY for a Java-primary repo. On Kotlin/Scala/Groovy an
+        empty index is the extractor's blindness, not absence of controllers —
+        degrading there asserted "no HTTP controllers detected" over real `.kt`
+        routes (INV-F1-1: never fire on absence of evidence). Gating the rule on
+        the JVM *family* was wrong; the boundary is the extractor's file coverage."""
+        from sourcecode.reconciliation import (
+            has_execution_error,
+            reconcile_web_pattern_evidence,
+        )
+
         if not arch_line or arch.pattern not in ("mvc", "spring_mvc_layered"):
             return arch_line
         primary = next((s for s in sm.stacks if s.primary), sm.stacks[0] if sm.stacks else None)
-        if primary is None or primary.stack not in {"java", "kotlin"}:
-            return arch_line
         _total, high = self._endpoint_support()
-        if high >= _MIN_REST_ENDPOINTS_FOR_LABEL:
-            return arch_line
-        # No controller backing → the MVC/view claim is unverified. Report the
-        # directory-derived layers without the framework label or the "view" claim.
+        # The endpoint extractor reads .java only — it is authoritative for a
+        # Java-primary repo, blind elsewhere.
+        _authoritative = bool(primary) and primary.stack == "java"
+        _findings = reconcile_web_pattern_evidence(
+            pattern=arch.pattern,
+            endpoint_evidence_authoritative=_authoritative,
+            modeled_endpoint_count=high,
+        )
         layer_names = [l.name for l in arch.layers[:4] if l.name != "view"] if arch.layers else []
+        if has_execution_error(_findings):
+            # Fail-open guard (gap #2): the cross-check could not run. Withhold the
+            # categorical MVC label AND the "no controllers" claim (both unverified);
+            # report only the directory-derived layers, or nothing.
+            if layer_names:
+                return (
+                    f"Layered code organization ({', '.join(layer_names)}; "
+                    "directory-based — endpoint cross-check unavailable)."
+                )
+            return ""
+        if not _findings:
+            # Non-Java (extractor blind), not a web pattern, or ≥1 controller backs
+            # the claim → keep. On Kotlin/Scala/Groovy the MVC label stays
+            # unverified rather than falsely negated.
+            return arch_line
+        # Contradiction: zero modeled controllers. Degrade — the claim is
+        # directory names, not routes; the "no HTTP controllers" wording is TRUE.
         if layer_names:
             return (
                 f"Layered code organization ({', '.join(layer_names)}; "

sourcecode/classifier.py

@@ -207,7 +207,7 @@ class TypeClassifier:
         # structured codebase (e.g. JobRunr: core + per-framework adapter modules).
         # This is checked BEFORE the weak `bin/`-directory CLI heuristic so a build
         # output / wrapper `bin/` dir does not mislabel a library as a CLI.
-        if stack_names & {"java", "kotlin", "scala"} and self._is_multi_module(file_tree):
+        if stack_names & _JVM_STACKS and self._is_multi_module(file_tree):
             return "library"
 
         # Weak CLI heuristic: a top-level bin/ directory (only when nothing stronger).

sourcecode/confidence_analyzer.py

@@ -120,6 +120,20 @@ class ConfidenceAnalyzer:
                 project_type=sm.project_type,
                 stacks=sm.stacks,
             ):
+                if _rf.error:
+                    # Fail-open guard (gap #2): the stack-attestation rule could
+                    # not run. Never let that read as "primary attests every
+                    # framework" — record it as an anomaly + gap, not silence.
+                    anomalies.append(
+                        "Stack/framework attestation could not be evaluated — "
+                        "primary-stack attribution is UNVERIFIED"
+                    )
+                    gaps.append(AnalysisGap(
+                        area="framework_stack_attestation",
+                        reason=_rf.detail,
+                        impact="medium",
+                    ))
+                    continue
                 anomalies.append(
                     f"{', '.join(_rf.symbols)} declared by another runtime, not by the "
                     f"{_primary.stack} primary stack"

sourcecode/path_filters.py

@@ -120,6 +120,54 @@ def is_test_or_fixture_path(path: str) -> bool:
     return False
 
 
+# Infrastructure words that, combined with a delimited "test" token in the same
+# directory segment, identify a module whose code is test scaffolding even though
+# it lives under src/main (e.g. "server-test-utils", "foo-testkit"). Kept narrow
+# on purpose: the "test" token must be present in the SAME segment, so packages
+# named "utils"/"support"/"tools" alone never match.
+_TEST_INFRA_TOKENS = frozenset({
+    "util", "utils", "fixture", "fixtures", "support",
+    "framework", "kit", "harness", "tools", "tool",
+    "helper", "helpers", "mock", "mocks", "stub", "stubs", "dummy",
+})
+
+# Glued (non-hyphenated) test-fixture module suffixes.
+_TEST_INFRA_SUFFIXES = (
+    "testutils", "testutil", "testkit", "testfixtures", "testfixture",
+    "testsupport", "testframework", "testharness", "testtools",
+    "testhelpers", "testmocks", "teststubs",
+)
+
+
+def is_test_fixture_module_path(path: str) -> bool:
+    """Return True when *path* belongs to a test-fixture / test-utility MODULE.
+
+    Structural, name-agnostic: a directory segment must contain a hyphen/underscore
+    -delimited ``test`` token together with an infrastructure word (util(s),
+    fixture(s), support, framework, kit, harness, tools, helper(s), mock(s),
+    stub(s), dummy) — e.g. ``server-test-utils``, ``foo-testkit``,
+    ``bar-test-support`` — or match a known test-module segment outright.
+
+    This is deliberately NARROWER than :func:`is_test_or_fixture_path`: it targets
+    modules that ship HTTP resources, JAX-RS ``@Path`` fixtures, or dummy
+    controllers under ``src/main`` so they are not misreported as production API
+    surface. Requiring both tokens in one segment keeps legitimate ``utils`` /
+    ``support`` / ``tools`` packages from ever matching.
+    """
+    norm = path.replace("\\", "/").lower()
+    parts = norm.split("/")
+    for part in parts[:-1]:  # skip the filename
+        bare = part.rstrip("/")
+        if bare in _TEST_MODULE_SEGMENTS:
+            return True
+        if bare.endswith(_TEST_INFRA_SUFFIXES):
+            return True
+        toks = bare.replace("_", "-").split("-")
+        if "test" in toks and any(t in _TEST_INFRA_TOKENS for t in toks):
+            return True
+    return False
+
+
 def is_vendor_path(path: str) -> bool:
     """Return True when *path* is inside a vendored / third-party directory.
 

sourcecode/prepare_context.py

@@ -1249,6 +1249,17 @@ class TaskContextBuilder:
                 [ws.path for ws in workspace_analysis.workspaces],
             )
 
+        # F-1 single-ownership (ADR-0005 §INV-F1-4): run the architecture analysis
+        # ONCE, here, and keep it on sm.architecture — the single owned analysis.
+        # ArchitectureSummarizer/ContextSummarizer reuse it instead of each computing
+        # (and discarding) a private copy, and its refutations are transported into
+        # `limitations` below (surface #3, F1-SURFACE-INTEGRATION-2026-07-18).
+        from sourcecode.architecture_analyzer import ArchitectureAnalyzer as _ArchAnalyzer
+        try:
+            sm.architecture = _ArchAnalyzer().analyze(self.root, sm)
+        except Exception:
+            sm.architecture = None
+
         project_summary = ProjectSummarizer(self.root).generate(sm)
         architecture_summary = ArchitectureSummarizer(self.root).generate(sm)
 
@@ -1306,6 +1317,19 @@ class TaskContextBuilder:
         key_dependencies: list[dict[str, Any]] = []
         limitations: list[str] = []
 
+        # INV-F1-4 transport: this surface narrates the architecture, so it must
+        # carry the owner's refutations — the same lines surface #1 (serializer)
+        # emits. Only the F-1 refutation / execution-error lines (their fixed
+        # prefixes); pattern-inference notes stay out of the onboard surface. The
+        # analysis is the single owned one (sm.architecture) — no re-run, no re-judge.
+        if sm.architecture is not None:
+            for _arch_lim in (sm.architecture.limitations or []):
+                if _arch_lim.startswith((
+                    "Architecture claim refuted on evidence:",
+                    "Architecture reconciliation could not run:",
+                )):
+                    limitations.append(_arch_lim)
+
         if spec.enable_dependencies:
             from dataclasses import asdict
             from sourcecode.dependency_analyzer import DependencyAnalyzer

sourcecode/reconciliation.py

@@ -62,17 +62,75 @@ from pathlib import Path
 
 @dataclass(frozen=True)
 class ReconciliationFinding:
-    """One positively-detected contradiction between two evidence views."""
+    """One reconciliation outcome that a consumer must not narrate away.
+
+    Two kinds ride this one type, distinguished by `error`:
+
+    - a **detected contradiction** (`error=False`, `symbols` non-empty): two
+      views positively disagree; the consumer degrades the claim and names it.
+    - an **execution error** (`error=True`, `symbols` empty): a rule could not be
+      evaluated. It exists so that a rule that raises is NEVER indistinguishable
+      from a rule that ran and found nothing — the fail-open that let an
+      exception silently certify the very claim the rule was meant to check.
+
+    A rule that is *not applicable*, or that ran and found the views consistent,
+    yields NO finding: both legitimately mean "no contradiction, the claim may
+    stand", and no consumer acts differently on them. Only the error case needed
+    a physical state of its own (ADR-0005 §8.2).
+    """
     rule: str                 # stable rule id, e.g. "endpoint_coverage"
     symbols: tuple[str, ...]  # symbols the contradiction is anchored to
     detail: str               # one-sentence human/agent-readable statement
+    error: bool = False       # True iff this marks a rule that could not run
 
     def to_dict(self) -> dict:
-        return {
+        d = {
             "rule": self.rule,
             "symbols": list(self.symbols),
             "detail": self.detail,
         }
+        # Healthy findings serialize byte-identically to before; the flag appears
+        # only when set, so no existing consumer/snapshot shifts.
+        if self.error:
+            d["error"] = True
+        return d
+
+
+def _execution_error(rule_id: str, exc: Exception) -> ReconciliationFinding:
+    """Build the finding that marks a rule which raised instead of running."""
+    return ReconciliationFinding(
+        rule=rule_id,
+        symbols=(),
+        error=True,
+        detail=(
+            f"the {rule_id} reconciliation rule could not be evaluated "
+            f"({type(exc).__name__}) — its consistency check did NOT run, so the "
+            "claim it guards is UNVERIFIED, not confirmed."
+        ),
+    )
+
+
+def _run_rule(rule_id: str, thunk) -> list[ReconciliationFinding]:
+    """Run one rule in isolation. On any exception, return an execution-error
+    finding instead of swallowing it — the core of the fail-open fix. Per-rule
+    (not per-surface) so one rule raising never blanks a sibling rule's finding.
+    """
+    try:
+        return list(thunk())
+    except Exception as exc:  # noqa: BLE001 — deliberate: convert, never swallow
+        return [_execution_error(rule_id, exc)]
+
+
+def execution_errors(
+    findings: "list[ReconciliationFinding]",
+) -> list[ReconciliationFinding]:
+    """The execution-error findings in a batch (empty if every rule ran)."""
+    return [f for f in findings if getattr(f, "error", False)]
+
+
+def has_execution_error(findings: "list[ReconciliationFinding]") -> bool:
+    """True iff any rule in the batch could not be evaluated."""
+    return any(getattr(f, "error", False) for f in findings)
 
 
 def http_handler_classes(cir) -> frozenset[str]:
@@ -142,14 +200,12 @@ def reconcile_impact_evidence(
         modeled_classes: classes the endpoint index has ≥1 route for
                          (endpoint_index.controller_fqns).
     """
-    findings: list[ReconciliationFinding] = []
-    try:
-        findings.extend(
-            _rule_endpoint_coverage(chain_classes, handler_classes, modeled_classes)
-        )
-    except Exception:
-        pass
-    return findings
+    return _run_rule(
+        "endpoint_coverage",
+        lambda: _rule_endpoint_coverage(
+            chain_classes, handler_classes, modeled_classes
+        ),
+    )
 
 
 # ---------------------------------------------------------------------------
@@ -387,11 +443,11 @@ def reconcile_code_modules(
         layer_files: {claimed module -> its files}.
         repo_files:  every source file, supplying the repo's own runtime.
     """
-    try:
+    def _run() -> list[ReconciliationFinding]:
         repo_runtimes = runtime_census({"_repo": list(repo_files)})["_repo"]
         return _rule_layer_code_attestation(runtime_census(layer_files), repo_runtimes)
-    except Exception:
-        return []
+
+    return _run_rule("layer_code_attestation", _run)
 
 
 def unattested_layers(
@@ -422,16 +478,22 @@ def reconcile_architecture_evidence(
         repo_files:  every source file considered — supplies the repo's own
                      runtime, the arbiter of which layers belong to the claim.
     """
-    findings: list[ReconciliationFinding] = []
     try:
         census = runtime_census(layer_files)
         repo_runtimes = runtime_census({"_repo": list(repo_files)})["_repo"]
-        findings.extend(
-            _rule_layer_language_coherence(pattern, census, repo_runtimes)
-        )
-        findings.extend(_rule_composition_runtime_split(pattern, census))
-    except Exception:
-        pass
+    except Exception as exc:
+        # Shared view prep failed — neither rule could run. One error finding,
+        # attributed to the primary architecture rule, carries that to the sink.
+        return [_execution_error("layer_language_coherence", exc)]
+    findings: list[ReconciliationFinding] = []
+    findings += _run_rule(
+        "layer_language_coherence",
+        lambda: _rule_layer_language_coherence(pattern, census, repo_runtimes),
+    )
+    findings += _run_rule(
+        "composition_runtime_split",
+        lambda: _rule_composition_runtime_split(pattern, census),
+    )
     return findings
 
 
@@ -487,6 +549,19 @@ _STACK_FAMILY: dict[str, str] = {
     "elixir": "beam", "erlang": "beam",
 }
 
+
+def stack_runtime_family(stack_id: str) -> str | None:
+    """Runtime family of a stack id (``jvm``/``js``/``python``/…), or None.
+
+    The single source of truth for "which stacks share a runtime". A consumer
+    that gates on JVM-ness (a Kotlin, Scala or Groovy repo is the SAME runtime as
+    a Java one) reads this instead of hardcoding ``{"java", "kotlin"}`` — which
+    silently dropped Scala and Groovy and let an unverified claim ship on them.
+    None means "unjudgeable", never a contradiction (INV-F1-1).
+    """
+    return _STACK_FAMILY.get(stack_id or "")
+
+
 # Project types that are SUPPOSED to span runtimes — their headline names a tier
 # split, so a framework from another runtime is the point, not a contradiction.
 # Same carve-out (and same names) as `_CROSS_RUNTIME_PATTERNS` for layer claims.
@@ -594,17 +669,13 @@ def reconcile_headline_evidence(
     """
     if project_type in _CROSS_RUNTIME_TYPES:
         return []
-    findings: list[ReconciliationFinding] = []
-    try:
-        findings.extend(
-            _rule_framework_stack_attestation(
-                _STACK_FAMILY.get(claimed_stack or ""),
-                framework_owner_families(stacks),
-            )
-        )
-    except Exception:
-        pass
-    return findings
+    return _run_rule(
+        "framework_stack_attestation",
+        lambda: _rule_framework_stack_attestation(
+            _STACK_FAMILY.get(claimed_stack or ""),
+            framework_owner_families(stacks),
+        ),
+    )
 
 
 def type_claim_unattested(
@@ -631,6 +702,12 @@ def type_claim_unattested(
             return False
         return not any(family in fams for fams in owners.values())
     except Exception:
+        # A bool predicate cannot carry an execution-error finding. It never
+        # decides alone: every caller runs `reconcile_headline_evidence` on the
+        # SAME stacks first (same `framework_owner_families` call), so an
+        # exception here has already surfaced as an execution-error finding
+        # there. Returning False adds NO extra clause — it does not certify a
+        # claim the paired findings call left unguarded.
         return False
 
 
@@ -646,6 +723,81 @@ def unattested_frameworks(
     return frozenset(out)
 
 
+# ---------------------------------------------------------------------------
+# Narrative reconciliation (web-pattern claim × endpoint index)
+# ---------------------------------------------------------------------------
+
+# Patterns that assert an HTTP/view tier. The claim is directory-derived (dirs
+# named controller/model/view); the endpoint index is the authoritative
+# controller evidence for the SAME run. They contradict when the pattern names a
+# web tier but the index modeled NO controller at all — Jenkins (Stapler)
+# matched model/view dirs and declared zero Spring MVC controllers.
+_WEB_PATTERNS: frozenset[str] = frozenset({"mvc", "spring_mvc_layered"})
+
+
+def _rule_web_pattern_attestation(
+    pattern: str, endpoint_evidence_authoritative: bool, modeled_endpoint_count: int
+) -> list[ReconciliationFinding]:
+    """A web/MVC pattern claim that the endpoint index does not back at all.
+
+    Provable ABSENCE, not a threshold: the rule fires only at ZERO modeled
+    controllers (`== 0`), never at "few". One controller backs the claim — the
+    pattern has real HTTP evidence and is not contradicted. The "< N is not
+    really a web app" judgement is a LABEL heuristic and stays in the consumer
+    (ADR-0005 limit 2: a rule may not carry a threshold).
+
+    **Authority gate (INV-F1-1).** Zero controllers is a CONTRADICTION only where
+    the endpoint extractor can actually see the code. The canonical extractor
+    reads `*.java` only — so on a Kotlin/Scala/Groovy repo an empty index is
+    *absence of evidence* (the extractor is blind to `.kt`/`.scala`/`.groovy`),
+    NOT a contradiction, and firing there is a false negative (measured: a Kotlin
+    `@RestController` with real routes read "no HTTP controllers detected"). The
+    caller passes `endpoint_evidence_authoritative`; when false, the rule stays
+    silent. The consumer decides authority (it owns the extractor fact), keeping
+    this rule free of any language/extractor coupling.
+    """
+    if pattern not in _WEB_PATTERNS or not endpoint_evidence_authoritative:
+        return []
+    if modeled_endpoint_count > 0:
+        return []
+    return [
+        ReconciliationFinding(
+            rule="web_pattern_endpoint_attestation",
+            symbols=(pattern,),
+            detail=(
+                f"the '{pattern}' claim names an HTTP/view tier but the endpoint "
+                "index modeled no controller — the layers are directory names, "
+                "not routes."
+            ),
+        )
+    ]
+
+
+def reconcile_web_pattern_evidence(
+    *,
+    pattern: str,
+    endpoint_evidence_authoritative: bool,
+    modeled_endpoint_count: int,
+) -> list[ReconciliationFinding]:
+    """Run the web-pattern attestation rule. Never raises.
+
+    Args:
+        pattern:                        the claimed architecture pattern.
+        endpoint_evidence_authoritative: True iff the endpoint extractor can see
+                                        this repo's controllers (it reads .java
+                                        only — the consumer owns this fact). When
+                                        False, zero endpoints is absence, not a
+                                        contradiction (INV-F1-1), and no finding.
+        modeled_endpoint_count:         high-confidence controllers modeled.
+    """
+    return _run_rule(
+        "web_pattern_endpoint_attestation",
+        lambda: _rule_web_pattern_attestation(
+            pattern, endpoint_evidence_authoritative, modeled_endpoint_count
+        ),
+    )
+
+
 def reconcile_extraction_evidence(
     *,
     type_decl_files: frozenset[str],
@@ -657,9 +809,7 @@ def reconcile_extraction_evidence(
         type_decl_files: files whose masked source declares a Java type.
         extracted_files: files symbol extraction produced ≥1 symbol for.
     """
-    findings: list[ReconciliationFinding] = []
-    try:
-        findings.extend(_rule_parse_coverage(type_decl_files, extracted_files))
-    except Exception:
-        pass
-    return findings
+    return _run_rule(
+        "parse_coverage",
+        lambda: _rule_parse_coverage(type_decl_files, extracted_files),
+    )

sourcecode/repository_ir.py

@@ -5584,7 +5584,7 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     """
     import re as _re
     from typing import Any as _Any
-    from sourcecode.path_filters import is_test_path
+    from sourcecode.path_filters import is_test_path, is_test_fixture_module_path
 
     _EXTENDS_FROM_SIG = _re.compile(r'\bextends\s+(\w+)')
 
@@ -5753,6 +5753,16 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     endpoint_warnings = _recovery["warnings"]
     _openapi_spec_path = _recovery["spec_path"]
 
+    # Map each declared class/interface FQN to its source file so an endpoint can be
+    # traced back to the MODULE that ships it. Used to flag endpoints that originate
+    # in a test-fixture / test-utility module (dummy web services, JAX-RS @Path
+    # fixtures) living under src/main — these are not production API surface.
+    _fqn_to_file: dict[str, str] = {
+        s.symbol: (s.source_file or s.declaring_file)
+        for s in all_symbols
+        if s.type in ("class", "interface")
+    }
+
     endpoints: list[dict] = []
     for route in routes:
         handler = (
@@ -5769,6 +5779,9 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
             "handler": handler,
             "return_type": route.get("return_type", "void"),
         }
+        _src = _fqn_to_file.get(route.get("effective_class", ""), "")
+        if _src and is_test_fixture_module_path(_src):
+            entry["scope"] = "test_util"
         # Use security_annotations already extracted by _build_route_surface
         # via the canonical _route_security_from_sym extractor.
         security_info = route.get("security_annotations")
@@ -5791,6 +5804,14 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     )
     endpoints = [e for e in endpoints if not _FQN_PATH_RE.search(e.get("path", ""))]
 
+    # Partition test-fixture/test-utility endpoints out of the production surface.
+    # They ship under src/main of a *-test-utils / *-testkit / test-framework module
+    # (dummy web services, JAX-RS @Path fixtures) and must not be reported as, or
+    # counted with, the real API surface — but they are preserved in their own bucket
+    # so nothing is silently dropped and the exclusion is auditable.
+    _test_util_endpoints = [e for e in endpoints if e.get("scope") == "test_util"]
+    endpoints = [e for e in endpoints if e.get("scope") != "test_util"]
+
     # "no_security_signal" = no recognized security annotation at method OR class level.
     # Note: repos may use framework-level security (e.g. Keycloak itself) with no
     # per-endpoint annotations — this count reflects annotation-based coverage only.
@@ -5919,6 +5940,16 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
         # Keep legacy field name for backward compat, now means same as no_security_signal
         "undocumented": no_security_signal,
     }
+    # Surface test-fixture endpoints excluded from the production surface above.
+    # Reported separately (not hidden) so the exclusion is transparent and auditable.
+    if _test_util_endpoints:
+        result["test_util_endpoints"] = _test_util_endpoints
+        result["test_util_excluded"] = len(_test_util_endpoints)
+        result.setdefault("notes", []).append(
+            f"{len(_test_util_endpoints)} endpoint(s) from test-fixture/test-utility "
+            f"module(s) under src/main were excluded from the production surface "
+            f"(see test_util_endpoints)."
+        )
     # Surface incomplete-endpoint warnings (interface-defined controllers) only when
     # present, to keep output backward-compatible for the common case.
     if endpoint_warnings:

sourcecode/spring_impact.py

@@ -1265,6 +1265,7 @@ class ImpactOrchestrator:
         # provably declares HTTP handlers but has no modeled route is a
         # positively-detected under-report of endpoints_affected.
         endpoint_coverage_blind_spot = False
+        reconciliation_error_blind_spot = False
         reconciliation_findings: list[dict] = []
         try:
             _chain_classes = frozenset(
@@ -1277,9 +1278,23 @@ class ImpactOrchestrator:
                 modeled_classes=frozenset(model.endpoint_index.controller_fqns),
             )
             reconciliation_findings = [f.to_dict() for f in _rec]
+            # Fail-open guard (gap #2): an execution-error finding means a rule
+            # could not run. It must NEVER be read as "no contradiction" — surface
+            # it as its own blind spot so an unevaluated endpoint check can't pass
+            # for a clean one. (The error finding carries rule="endpoint_coverage"
+            # too, hence the `not _f.error` on the contradiction branch below.)
+            _rec_errors = [f for f in _rec if f.error]
+            if _rec_errors:
+                reconciliation_error_blind_spot = True
+                warnings.append(
+                    "Evidence reconciliation could not run for this query — "
+                    + _rec_errors[0].detail
+                    + " The endpoint-coverage check did NOT execute; treat the "
+                    "endpoint list as unverified, not confirmed complete."
+                )
             _unmapped: list[str] = []
             for _f in _rec:
-                if _f.rule == "endpoint_coverage":
+                if _f.rule == "endpoint_coverage" and not _f.error:
                     endpoint_coverage_blind_spot = True
                     _unmapped = list(_f.symbols)
             if endpoint_coverage_blind_spot:
@@ -1294,8 +1309,16 @@ class ImpactOrchestrator:
                     "locator chains). Callers remain reliable; verify these classes' "
                     "exposure before treating the endpoint list as complete."
                 )
-        except Exception:
-            pass
+        except Exception as _rec_exc:
+            # Even assembling the reconciliation inputs failed (e.g.
+            # http_handler_classes traversing a malformed IR). Same invariant: an
+            # exception is not evidence of consistency — record a blind spot.
+            reconciliation_error_blind_spot = True
+            warnings.append(
+                "Evidence reconciliation could not run for this query "
+                f"({type(_rec_exc).__name__}) — the endpoint-coverage check did "
+                "NOT execute; treat the endpoint list as unverified."
+            )
 
         blind_spots = (
             # framework_di stops being a blind spot once CH-007 recovers callers
@@ -1305,6 +1328,7 @@ class ImpactOrchestrator:
             + (["method_scope_unproven"] if method_scope_blind_spot else [])
             + (["parse_coverage"] if parse_coverage_blind_spot else [])
             + (["endpoint_coverage_partial"] if endpoint_coverage_blind_spot else [])
+            + (["reconciliation_error"] if reconciliation_error_blind_spot else [])
         )
 
         confidence: str
@@ -1322,9 +1346,16 @@ class ImpactOrchestrator:
             or parse_coverage_blind_spot
         ):
             confidence = "low"
-        elif resolution == "partial" or confidence_reducing or endpoint_coverage_blind_spot:
+        elif (
+            resolution == "partial"
+            or confidence_reducing
+            or endpoint_coverage_blind_spot
+            or reconciliation_error_blind_spot
+        ):
             # endpoint_coverage: the callers are still trustworthy — only the
             # endpoint axis is provably incomplete, so cap at medium, not low.
+            # reconciliation_error: the endpoint check did not run at all, so we
+            # cannot claim "high" — same medium cap, callers still stand.
             confidence = "medium"
         else:
             confidence = "high"

sourcecode/summarizer.py

@@ -9,7 +9,10 @@ from pathlib import Path
 from typing import Any
 
 from sourcecode.architecture_analyzer import _LAYER_MIN_SHARE, _PATTERN_REQUIRED_KEYS
-from sourcecode.reconciliation import incoherent_layers, pattern_contradicted
+from sourcecode.reconciliation import (
+    has_execution_error,
+    reconcile_architecture_evidence,
+)
 from sourcecode.detectors.parsers import load_json_file, load_toml_file
 from sourcecode.tree_utils import safe_read_text
 from sourcecode.entrypoint_classifier import is_production_entry_point
@@ -437,9 +440,22 @@ class ProjectSummarizer:
             # SIM-3: same coherence rule the architecture prose applies — this
             # table is the headline's copy, and a fix applied to only one of the
             # two duplicated tables leaves the other one lying.
-            for _bad in incoherent_layers(pattern_name, layer_files, file_paths):
-                layer_files.pop(_bad, None)
-            if pattern_contradicted(pattern_name, layer_files, file_paths):
+            _arch_findings = reconcile_architecture_evidence(
+                pattern=pattern_name, layer_files=layer_files, repo_files=file_paths
+            )
+            # Fail-open guard (gap #2): this headline word has no gap channel. If
+            # the coherence/split check could not run, do not headline an
+            # unverified pattern — skip it, exactly as a contradiction would.
+            if has_execution_error(_arch_findings):
+                continue
+            _split_contradicted = False
+            for _f in _arch_findings:
+                if _f.rule == "composition_runtime_split":
+                    _split_contradicted = True
+                else:
+                    for _bad in _f.symbols:
+                        layer_files.pop(_bad, None)
+            if _split_contradicted:
                 continue
             # A pattern must show its defining trait here too, or the headline
             # contradicts the architecture prose that already enforces this.

{sourcecode-2.5.11.dist-info → sourcecode-2.5.13.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 2.5.11
+Version: 2.5.13
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-2.5.11.dist-info → sourcecode-2.5.13.dist-info}/RECORD

@@ -1,18 +1,18 @@
-sourcecode/__init__.py,sha256=dNBAjvpTNkiFYDXqXdJjx0saZlNREwHXUuF1drsfGuo,309
+sourcecode/__init__.py,sha256=M8eYjrmWCXZgccRJ042BhY9QS6VmNX4SDwD_gMX9cvo,309
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
 sourcecode/archetype.py,sha256=d7yoN6Tj4OBj-VgSMPEKg4WF9H8FypnZ5A6AkUh5oIE,34484
-sourcecode/architecture_analyzer.py,sha256=Bv6OYeAdK88PvHZuryO6CkR6NLJMUqvLy9WkGsw1Fa4,59072
-sourcecode/architecture_summary.py,sha256=oBkjx7hZxmpdKLt4EracjRKHJFOGuPTd6SadTyPxY7Q,29568
+sourcecode/architecture_analyzer.py,sha256=GFc4ek-s1IHWM7pl-0L32WahZ93AmDgrAMcOuBKA5Dk,61463
+sourcecode/architecture_summary.py,sha256=BVVRHd952cjRhjHnR6CPrvKgaa-tdM16l-pBi1yDCPs,32395
 sourcecode/ast_extractor.py,sha256=FEsYTsMCXbJfSYQZRk1k-I-PjUNGnKqO1IxMftsgA5U,51351
 sourcecode/cache.py,sha256=1V3vsaODAa2UBJAC0xpvxpmRdriCezQx5Q8JCcfgziE,31892
 sourcecode/call_surface.py,sha256=fiqYfHooxN1fX9oQoysq1LS3LoZcobhyUNjAGEZKpwk,4148
 sourcecode/caller_metrics.py,sha256=HG8RCOkpzzsEGdnMRob6byrwjoj5__t0TEsBj4yR7ks,2574
 sourcecode/canonical_ir.py,sha256=5hLAhhSpXNOdZAvPt-J-rXccJE6M3A6gVhmhU0Tym6Y,29269
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
-sourcecode/classifier.py,sha256=9olDN5joeKHcwG9vf73X-t_son16hLVNib0rBbqk1vc,18865
+sourcecode/classifier.py,sha256=rkMapdklDuIv3rXrNEwwL65UldkvTn8VuKa73GPoSDo,18849
 sourcecode/cli.py,sha256=mlMgyRukRoHXYdAYHBN4z06LszwdRo0QLdhs0KYtup8,323804
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
-sourcecode/confidence_analyzer.py,sha256=KCRg8B4WH15LpOB7oYhE4dD5nou9Xi48RT3vpaO6Ar4,20868
+sourcecode/confidence_analyzer.py,sha256=vnbPI-20FnHdjO6STxHW8fbaxmB4A7y58io63ibFZjc,21586
 sourcecode/context_cache.py,sha256=maws79rLKDwyZ7c9Q2LwlIxqZHRFlaKzErtO3mglWoA,25036
 sourcecode/context_graph.py,sha256=WFtUvfxoE8XtQxtRJLvaF4SJuS00ICjNoTk0sH2_V5U,44454
 sourcecode/context_scorer.py,sha256=QpChSpsmaAYz91rXA4Ue5xzQmNz_ZboZN09YOHScq1U,14679
@@ -45,18 +45,18 @@ sourcecode/metrics_analyzer.py,sha256=m0ENgtqKeBL17kUIK3fmGkgo7UfXBNHxCMj0H_Y5K7
 sourcecode/migrate_check.py,sha256=HJhvHuvXDGTJSRQU9_AMx0L94h2TImC1DCGs3m3RTu0,108199
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
 sourcecode/output_budget.py,sha256=Js9yUlfQtPhqBl9R6wn_9UHVjjJc3GtLcqyfjf5t50Q,9869
-sourcecode/path_filters.py,sha256=T1y0SJsmUJBju2Hh_-z40kURAowUEq42FpPgWLbOaY0,6931
+sourcecode/path_filters.py,sha256=809P9hj_QChNLg8wk4HuKcFUZmnDKNz0sKIMbmt_FNE,9138
 sourcecode/pr_comment_renderer.py,sha256=KmcjMruhR44gjzMDJwjBSkWP9QEvh8xWBLyxzxoRbj0,14542
 sourcecode/pr_impact.py,sha256=dCDVw83EDbyVf6F9ZmEQmsFz8ruVH7d4mpeKQCIZHM0,16805
-sourcecode/prepare_context.py,sha256=PYygAKL_jwz8gGElgM9mroUSih18UKSSjv08ndfl4aA,222877
+sourcecode/prepare_context.py,sha256=-Xu33qCETuqw-OFfT3ukvAtxde7krCjQpn7wR3pbdOg,224290
 sourcecode/progress.py,sha256=qn30sWaHOkjTgXsSBmiPkz7Rsbwc5oSlIe6JNEMYp_k,3149
 sourcecode/ranking_engine.py,sha256=ZAucq_YX2KkWUuAZf4P0lhtQ_38vEFnUhuGtSZd1S0E,12970
-sourcecode/reconciliation.py,sha256=NSGWsRQ-5l50aO_6YErDlu1kEbQB8zDtVf58h_Ro15c,26984
+sourcecode/reconciliation.py,sha256=GU-1PTcVr8zcbtC7BASfpHcZndP9AdboXPNQiBc0fzo,34251
 sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg,12965
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=F6lRgPoP8oTtnGpRgjoLw-dlxZRXH7XOcehtcNwufEY,309550
+sourcecode/repository_ir.py,sha256=bNSUKkWQEvFQ2wSZPRdn_9cZfx6TRcPzGtM2EgMm49M,311400
 sourcecode/ris.py,sha256=Hw8TakTQ6hku-Abf2k8954NwkrH_sP73_8wVH8x5khc,22079
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=WdOQ78mMzjR1NjmKTlbxdgwinnCTfAhxCVLBEFQiFHU,8899
@@ -70,12 +70,12 @@ sourcecode/semantic_services.py,sha256=nbUuPv-F01USTt_9CHT8iy_ucCIw3fz4W3Aquea_p
 sourcecode/serializer.py,sha256=FmQo7eojA_z3ptLW-Vgze5mrEJ6FabcZqiwbQWWTgFI,130056
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=EX7kLZLN74CFyR9iZPm3CI115BfFKNd4WRPuErNljZM,5729
-sourcecode/spring_impact.py,sha256=ayZtHZ2YCRSlZpKBACoM9M7tW0K1W_C0r8SGj3R-4vU,70603
+sourcecode/spring_impact.py,sha256=MkUI27OCOhkjvBoA4f9X1eDBIY0SmyPuLVCWIfZgOcE,72430
 sourcecode/spring_model.py,sha256=zOAgFmrRbG4a6KLm1TJl55aWMyPNsz3OS3FSczqPG6A,16594
 sourcecode/spring_security_audit.py,sha256=Rk-aSohezdc7YDYbSoJquVnwpkDB8ty1BCD-4Hc4R5A,22832
 sourcecode/spring_semantic.py,sha256=jteQ1PkY9ArFJv0embg_jBIdbOxqrk9mQ2Xz8OF_FKA,14214
 sourcecode/spring_tx_analyzer.py,sha256=QMXkxa_hrqDVN3D8WJsd0nT7vfdZCT1E8ZWNoFFbvgU,34692
-sourcecode/summarizer.py,sha256=E70QILQ8cCNIH485c7lVMv5dXOpUn8qx1habi1_cn6o,26340
+sourcecode/summarizer.py,sha256=SWj-y5BJ_Qw89ljLg-KXaLsvU87usOw-raTckPutCk4,26976
 sourcecode/tree_utils.py,sha256=8GAkIfQAsvtEudIeW1l4ooH_oRtrWR8cpJQJsEa_Pfw,2093
 sourcecode/type_usage_surface.py,sha256=51IrKRQoIoRnlsiDjHnqpJBn2rc6E59aRhgS0HTzAF0,4428
 sourcecode/validation_inference.py,sha256=UtmYv-d4TEzT1ihGEipAhtXDrwq0XtVtjMpb3i7NsNc,10815
@@ -137,8 +137,8 @@ sourcecode/telemetry/consent.py,sha256=LIAO9ohJZF8OuZwM4u1VWtALlYfTCCKq4wV3Vwc7i
 sourcecode/telemetry/events.py,sha256=LtzYfaX9Ilckj5PTvAcTpDa9mLqDsYPDUiDkRa58piY,2580
 sourcecode/telemetry/filters.py,sha256=NHa5T-6DaZduQPFuC34jOqHWQgSizM-Ygq8aZ4j19ng,5834
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-2.5.11.dist-info/METADATA,sha256=6j_zA5-pJ01V4qnmyhPDb3FtyvH5bqAccNhHVP6tO5s,10852
-sourcecode-2.5.11.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-2.5.11.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-2.5.11.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-2.5.11.dist-info/RECORD,,
+sourcecode-2.5.13.dist-info/METADATA,sha256=hAqH0Dxo8V6o4vDdpqalzX3njpQNvHIO8-t5zglFo68,10852
+sourcecode-2.5.13.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-2.5.13.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-2.5.13.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-2.5.13.dist-info/RECORD,,