sourcecode 2.5.16__tar.gz → 2.5.18__tar.gz

{sourcecode-2.5.16 → sourcecode-2.5.18}/CHANGELOG.md

@@ -1,5 +1,78 @@
 # Changelog
 
+## [2.5.18] — 2026-07-20
+
+**Engineering Decision Support — Part A, F1: standalone OpenAPI specs now reach the
+validation surface.** First correctness-foundation fix of the capability milestone
+(`docs/DEVELOPMENT-ROADMAP.md`): trust-critical, stability-permitted (consumer-wiring
+over an existing producer, no new inference). A repo shipping a plain `openapi.yml`
+with no openapi-generator interface-controller was reported "No OpenAPI spec found" —
+a confirmed false negative that would launder into any downstream decision. Full suite
+(3538 passed, 5 skipped) confirms confinement.
+
+### Fixed
+
+- **F1 — standalone-spec discovery reaches the validation surface.** `extract_java_endpoints`
+  only links a spec when an `@RestController implements XxxApi` interface-controller
+  matches it; a repo with a plain `openapi.yml` and no such controller fell through to
+  "No OpenAPI spec found". The validation surface now consults the existing
+  `openapi_surface.build_openapi_surface` producer directly in that branch: a discovered
+  spec's body operations (POST/PUT/PATCH) contribute their declared constraints as
+  `source="openapi-spec"` routes (deduped against source-annotated routes by
+  method+path), the `openapi_spec` claim flips from `null` to the spec path, and the
+  note explains the standalone discovery. Genuinely absent specs are unchanged — the
+  `null` claim and source-DTO recovery path stand. New `TestStandaloneSpecRecovery`
+  regression class (4 tests).
+- **F1 — `zero_result_reason` on genuine absence.** When no spec is on disk and no
+  in-repo DTO constraints are recoverable, the validation surface now carries a
+  machine-readable `zero_result_reason = "no_openapi_spec_and_no_source_dto_constraints"`
+  beside the prose note, so a consumer can distinguish an attested negative ("looked,
+  found nothing") from an un-run analysis. Absent on any positive result.
+
+### Notes
+
+- **Reconciliation rule deliberately NOT added for F1.** The roadmap's F1 strategy
+  suggested a "spec-present vs spec-absent" reconciliation rule as the honesty guard.
+  The flip was instead achieved at the true source (the validation surface now reads
+  the spec), and the two sibling surfaces that also report spec presence
+  (`serializer` arch_reasons, `confidence_analyzer` api_contract gap) were verified to
+  already detect a standalone `openapi.yml` via their filename check — so **no surface
+  makes the false "no spec" claim**, leaving the reconciliation layer no provable
+  contradiction to fire on. Adding a rule that never fires on any real repo violates
+  the layer's own contract (fire only on contradiction, EPV). Recorded here so the
+  roadmap item is closed by decision, not oversight.
+
+## [2.5.17] — 2026-07-19
+
+**Semantic Stability cleanup: dead code removed and a scanner fork collapsed, with
+zero behavioural change.** Per `docs/DEVELOPMENT-ROADMAP.md` the 2.5.x line is scoped
+to documentation, cleanup, small bugs and profiling — no new inference. This release
+is pure internal hygiene; every user-facing surface is byte-for-byte unchanged and the
+full suite (3534 passed, 5 skipped) confirms it.
+
+### Removed
+
+- **8 dead module-level private helpers** (−151 lines), each verified to have zero
+  references across `src` + `tests` (call sites, string names, and dynamic lookups) and
+  confirmed long-orphaned (all last touched May 2026, superseded since):
+  `repository_ir._resolve_type`, `repository_ir._common_package_prefix`,
+  `ast_extractor._find_all`, `ast_extractor._named_children`,
+  `coverage_parser._decode_numbits`, `spring_tx_analyzer._extract_method_body`,
+  `serializer._tiered_display_score`, `env_analyzer._replace_required`.
+  Kept `perf._reset_for_tests` and `migrate_check._find_xml_config_files` — both live
+  via tests.
+
+### Changed
+
+- **Collapsed the `FileScanner` / `AdaptiveScanner` fork duplication.** AdaptiveScanner
+  was forked from FileScanner and carried three byte-identical method bodies
+  (`find_manifests`, `_get_or_create_node`, `_is_excluded_by_gitignore`) — one of which
+  documented "Identical logic to FileScanner.find_manifests()". The shared logic now
+  lives as three module-level free functions in `scanner.py`
+  (`find_manifest_paths` / `get_or_create_tree_node` / `match_gitignore`) and both
+  classes delegate. No new coupling (AdaptiveScanner already imported from `scanner`),
+  no circular import; dropped its now-unused `cast` / `MANIFEST_NAMES` imports.
+
 ## [2.5.16] — 2026-07-19
 
 **Performance campaign close-out: one real algorithmic win, cost-per-symbol

{sourcecode-2.5.16 → sourcecode-2.5.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 2.5.16
+Version: 2.5.18
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-2.5.16 → sourcecode-2.5.18}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "2.5.16"
+version = "2.5.18"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-2.5.16 → sourcecode-2.5.18}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "2.5.16"
+__version__ = "2.5.18"

{sourcecode-2.5.16 → sourcecode-2.5.18}/src/sourcecode/adaptive_scanner.py

@@ -14,12 +14,18 @@ interface, same output format (None = file, dict = directory).
 
 import os
 from pathlib import Path
-from typing import Any, Optional, cast
+from typing import Any, Optional
 
 from pathspec import GitIgnoreSpec
 
 from sourcecode.repo_classifier import RepoTopology
-from sourcecode.scanner import DEFAULT_EXCLUDES, EXCLUDED_FILE_SUFFIXES, MANIFEST_NAMES
+from sourcecode.scanner import (
+    DEFAULT_EXCLUDES,
+    EXCLUDED_FILE_SUFFIXES,
+    find_manifest_paths,
+    get_or_create_tree_node,
+    match_gitignore,
+)
 
 
 class AdaptiveScanner:
@@ -100,9 +106,7 @@ class AdaptiveScanner:
         return self._gitignore_spec
 
     def _is_excluded_by_gitignore(self, rel_path: str, is_dir: bool) -> bool:
-        spec = self._load_gitignore_spec()
-        path_to_match = rel_path + "/" if is_dir else rel_path
-        return spec.match_file(path_to_match)
+        return match_gitignore(self._load_gitignore_spec(), rel_path, is_dir)
 
     # ------------------------------------------------------------------
     # Depth budget computation — the core of adaptive traversal
@@ -224,40 +228,12 @@ class AdaptiveScanner:
     def _get_or_create_node(
         self, tree: dict[str, Any], parts: tuple[str, ...]
     ) -> dict[str, Any]:
-        node = tree
-        for part in parts:
-            if part not in node or node[part] is None:
-                node[part] = {}
-            node = cast(dict[str, Any], node[part])
-        return node
+        return get_or_create_tree_node(tree, parts)
 
     # ------------------------------------------------------------------
     # Manifest discovery — same interface as FileScanner
     # ------------------------------------------------------------------
 
     def find_manifests(self) -> list[str]:
-        """Find manifest files at depth 0-1.
-
-        Identical logic to FileScanner.find_manifests() — depth-0 root
-        manifests plus depth-1 sub-package manifests, hidden dirs excluded.
-        """
-        manifests: list[str] = []
-        for name in MANIFEST_NAMES:
-            candidate = self.root / name
-            if candidate.exists() and not candidate.is_symlink():
-                manifests.append(str(candidate))
-        try:
-            for child in self.root.iterdir():
-                if (
-                    child.is_dir()
-                    and not child.is_symlink()
-                    and child.name not in self._excludes
-                    and not child.name.startswith(".")
-                ):
-                    for name in MANIFEST_NAMES:
-                        candidate = child / name
-                        if candidate.exists() and not candidate.is_symlink():
-                            manifests.append(str(candidate))
-        except PermissionError:
-            pass
-        return manifests
+        """Find manifest files at depth 0-1 (delegates to the shared helper)."""
+        return find_manifest_paths(self.root, self._excludes)

{sourcecode-2.5.16 → sourcecode-2.5.18}/src/sourcecode/ast_extractor.py

@@ -176,18 +176,10 @@ def _find_child(node: Any, *types: str) -> Optional[Any]:
     return None
 
 
-def _find_all(node: Any, *types: str) -> list[Any]:
-    return [child for child in node.children if child.type in types]
-
-
 def _text(node: Any, src: bytes) -> str:
     return src[node.start_byte:node.end_byte].decode("utf-8", errors="replace")
 
 
-def _named_children(node: Any) -> list[Any]:
-    return [c for c in node.children if c.is_named]
-
-
 # ---------------------------------------------------------------------------
 # Tree-sitter TS/JS extraction
 # ---------------------------------------------------------------------------

{sourcecode-2.5.16 → sourcecode-2.5.18}/src/sourcecode/coverage_parser.py

@@ -39,20 +39,6 @@ def _safe_int(value: Optional[str]) -> Optional[int]:
         return None
 
 
-def _decode_numbits(blob: bytes) -> list[int]:
-    """Decodifica bitset little-endian de coverage.py .coverage SQLite.
-
-    Byte i, bit j set => linea (i*8 + j + 1) ejecutada.
-    Ejemplo: bytes([0b00000101]) => [1, 3]
-    """
-    return [
-        i * 8 + j + 1
-        for i, byte in enumerate(blob)
-        for j in range(8)
-        if byte & (1 << j)
-    ]
-
-
 # ---------------------------------------------------------------------------
 # CoverageParser
 # ---------------------------------------------------------------------------

{sourcecode-2.5.16 → sourcecode-2.5.18}/src/sourcecode/env_analyzer.py

@@ -534,8 +534,3 @@ class EnvAnalyzer:
 def _replace_description(record, description: str):
     from dataclasses import replace
     return replace(record, description=description)
-
-
-def _replace_required(record, required: bool, default: Optional[str]):
-    from dataclasses import replace
-    return replace(record, required=required, default=default if not record.default else record.default)

{sourcecode-2.5.16 → sourcecode-2.5.18}/src/sourcecode/repository_ir.py

@@ -807,11 +807,6 @@ def _pop_closed(class_stack: list[tuple[str, int]], depth: int) -> None:
         class_stack.pop()
 
 
-def _resolve_type(simple: str, import_map: dict[str, str]) -> Optional[str]:
-    base = re.sub(r'<.*', '', simple).strip().split('.')[-1]
-    return import_map.get(base)
-
-
 def _resolve_types_from_text(text: str, import_map: dict[str, str]) -> list[str]:
     resolved = []
     for token in re.findall(r'\b([A-Z]\w*)\b', text):
@@ -3597,40 +3592,6 @@ def _build_evidence_bundles(
     return bundles
 
 
-def _common_package_prefix(fqns: list[str]) -> str:
-    """Longest common dot-separated package prefix across a list of FQNs."""
-    if not fqns:
-        return ""
-    # Strip class/method suffix — keep only package parts (lowercase segments)
-    def pkg_parts(fqn: str) -> list[str]:
-        parts = fqn.split(".")
-        # Drop trailing class/method names (PascalCase or after '#')
-        result = []
-        for p in parts:
-            if "#" in p:
-                break
-            if p and p[0].isupper():
-                break
-            result.append(p)
-        return result
-
-    segs = [pkg_parts(f) for f in fqns if pkg_parts(f)]
-    if not segs:
-        return fqns[0].rsplit(".", 1)[0] if "." in fqns[0] else fqns[0]
-    common = segs[0]
-    for s in segs[1:]:
-        new_common = []
-        for a, b in zip(common, s):
-            if a == b:
-                new_common.append(a)
-            else:
-                break
-        common = new_common
-        if not common:
-            break
-    return ".".join(common) if common else fqns[0].rsplit(".", 1)[0]
-
-
 def _subsystem_label(package_prefix: str) -> str:
     """Derive short human label enforcing minimum meaningful depth.
 

{sourcecode-2.5.16 → sourcecode-2.5.18}/src/sourcecode/scanner.py

@@ -115,6 +115,57 @@ def classify_manifest(manifest_path: str, root: Path) -> str:
     return "auxiliary"
 
 
+# ── Shared scan primitives (used by both FileScanner and AdaptiveScanner) ────
+# AdaptiveScanner was forked from FileScanner and carried byte-identical copies of
+# these three; they live here as the single source of truth, each class method a
+# thin delegate.
+
+def find_manifest_paths(root: Path, excludes: frozenset[str]) -> list[str]:
+    """Manifest files at depth 0–1 (SCAN-04): root manifests plus depth-1
+    sub-package manifests, with hidden/excluded dirs and symlinks skipped."""
+    manifests: list[str] = []
+    # Depth 0: root
+    for name in MANIFEST_NAMES:
+        candidate = root / name
+        if candidate.exists() and not candidate.is_symlink():
+            manifests.append(str(candidate))
+    # Depth 1: first level (hidden dirs excluded — tooling, not project)
+    try:
+        for child in root.iterdir():
+            if (
+                child.is_dir()
+                and not child.is_symlink()
+                and child.name not in excludes
+                and not child.name.startswith(".")
+            ):
+                for name in MANIFEST_NAMES:
+                    candidate = child / name
+                    if candidate.exists() and not candidate.is_symlink():
+                        manifests.append(str(candidate))
+    except PermissionError:
+        pass
+    return manifests
+
+
+def get_or_create_tree_node(
+    tree: dict[str, Any], parts: tuple[str, ...]
+) -> dict[str, Any]:
+    """Navigate/create the nested-dict tree node for a path's parts."""
+    node = tree
+    for part in parts:
+        if part not in node or node[part] is None:
+            node[part] = {}
+        node = cast(dict[str, Any], node[part])
+    return node
+
+
+def match_gitignore(spec: GitIgnoreSpec, rel_path: str, is_dir: bool) -> bool:
+    """True if a root-relative path is excluded by ``spec``. GitIgnoreSpec expects
+    a trailing '/' for directories."""
+    path_to_match = rel_path + "/" if is_dir else rel_path
+    return spec.match_file(path_to_match)
+
+
 class FileScanner:
     """Escanea un directorio de proyecto y produce un arbol de ficheros filtrado.
 
@@ -148,10 +199,7 @@ class FileScanner:
 
     def _is_excluded_by_gitignore(self, rel_path: str, is_dir: bool) -> bool:
         """Comprueba si una ruta relativa (a self.root) esta excluida por .gitignore."""
-        spec = self._load_gitignore_spec()
-        # GitIgnoreSpec espera rutas con / al final para directorios
-        path_to_match = rel_path + "/" if is_dir else rel_path
-        return spec.match_file(path_to_match)
+        return match_gitignore(self._load_gitignore_spec(), rel_path, is_dir)
 
     def scan_tree(self) -> dict[str, Any]:
         """Construye el arbol JSON anidado del proyecto.
@@ -223,38 +271,8 @@ class FileScanner:
         self, tree: dict[str, Any], parts: tuple[str, ...]
     ) -> dict[str, Any]:
         """Navega/crea el nodo del arbol para la ruta indicada."""
-        node = tree
-        for part in parts:
-            if part not in node or node[part] is None:
-                node[part] = {}
-            node = cast(dict[str, Any], node[part])
-        return node
+        return get_or_create_tree_node(tree, parts)
 
     def find_manifests(self) -> list[str]:
-        """Encuentra ficheros de manifiesto en profundidad 0-1 (SCAN-04).
-
-        Retorna:
-            Lista de paths absolutos de manifiestos encontrados.
-        """
-        manifests: list[str] = []
-        # Profundidad 0: raiz
-        for name in MANIFEST_NAMES:
-            candidate = self.root / name
-            if candidate.exists() and not candidate.is_symlink():
-                manifests.append(str(candidate))
-        # Profundidad 1: primer nivel (excluir directorios ocultos — son tooling, no proyecto)
-        try:
-            for child in self.root.iterdir():
-                if (
-                    child.is_dir()
-                    and not child.is_symlink()
-                    and child.name not in self._excludes
-                    and not child.name.startswith(".")
-                ):
-                    for name in MANIFEST_NAMES:
-                        candidate = child / name
-                        if candidate.exists() and not candidate.is_symlink():
-                            manifests.append(str(candidate))
-        except PermissionError:
-            pass
-        return manifests
+        """Encuentra ficheros de manifiesto en profundidad 0-1 (SCAN-04)."""
+        return find_manifest_paths(self.root, self._excludes)

{sourcecode-2.5.16 → sourcecode-2.5.18}/src/sourcecode/serializer.py

@@ -913,67 +913,6 @@ def _jndi_datasources(sm: "SourceMap") -> "Optional[list[dict[str, Any]]]":
     return datasources
 
 
-def _tiered_display_score(
-    pre_bonus_combined: float,
-    file_class: Any,
-    path: str,
-    entry_paths: set,
-    has_structural_signals: bool = False,
-) -> float:
-    """Evidence-tiered display score [0.0, 1.0].
-
-    Tiers enforce: strong evidence > medium evidence > filesystem/path only.
-    M3 sort bonuses must NOT be included in pre_bonus_combined — they are for
-    ordering only and must not inflate the displayed score.
-
-    Tier ceilings:
-      T1  confirmed production entrypoint           0.92–1.00
-      T2  entrypoint (weaker category)              0.80–0.91
-      T3  annotation-confirmed stereotype           0.40–0.90  (table-calibrated)
-      T4  framework import evidence                 0.55–0.79
-      T5  code definitions + imports                0.38–0.54
-      T6  build manifest / tooling / test           0.25–0.45
-      T7  path/filesystem signal only               0.10–0.39
-    """
-    from sourcecode.file_classifier import JAVA_STEREOTYPE_CATEGORIES
-
-    cat = file_class.category if file_class else None
-    base_rel = file_class.relevance if file_class else 0.0
-
-    # T1: confirmed production entrypoint
-    if path in entry_paths and cat in ("runtime_core", "cli_entrypoint"):
-        return round(min(1.0, max(0.92, base_rel)), 3)
-
-    # T2: in entry_paths but weaker evidence category
-    if path in entry_paths:
-        return round(min(0.91, max(0.80, pre_bonus_combined / 2.0)), 3)
-
-    # T3: annotation-confirmed stereotype — table values are already calibrated
-    if file_class and cat in JAVA_STEREOTYPE_CATEGORIES:
-        return round(base_rel, 3)
-
-    # T4: framework import evidence (medium strength)
-    if cat in ("api_layer", "database_layer", "infrastructure"):
-        return round(min(0.79, max(0.55, pre_bonus_combined / 2.0)), 3)
-
-    # T5: code definitions with imports (medium-low)
-    if cat in ("application_logic", "domain_model"):
-        return round(min(0.54, max(0.38, pre_bonus_combined / 2.0)), 3)
-
-    # T6: build manifest / tooling / test
-    if cat == "build_system":
-        return round(min(0.45, base_rel), 3)
-    if cat in ("tests", "tooling"):
-        return round(min(0.35, base_rel), 3)
-
-    # T7: no content classification — filesystem/structural signals only
-    # has_structural_signals: fan_in, churn, export — allows up to 0.54
-    # pure path/filename only — hard cap 0.39
-    if has_structural_signals:
-        return round(min(0.54, max(0.10, pre_bonus_combined / 2.0)), 3)
-    return round(min(0.39, max(0.10, pre_bonus_combined / 2.0)), 3)
-
-
 def _build_file_signals(
     file_class: Any,
     path: str,

{sourcecode-2.5.16 → sourcecode-2.5.18}/src/sourcecode/spring_tx_analyzer.py

@@ -112,30 +112,6 @@ def _caught_types(catch_header_inner: str) -> list[str]:
     return types
 
 
-def _extract_method_body(source: str, method_name: str) -> str:
-    """Extract the first method body matching method_name using brace counting.
-
-    Returns the text from '{' to the matching '}', or empty string if not found.
-    Needed to scope TX-005 regex to the specific method instead of the whole file.
-    """
-    pattern = re.compile(r'\b' + re.escape(method_name) + r'\s*\(')
-    for m in pattern.finditer(source):
-        brace_pos = source.find('{', m.end())
-        if brace_pos < 0:
-            continue
-        depth = 1
-        i = brace_pos + 1
-        while i < len(source) and depth > 0:
-            c = source[i]
-            if c == '{':
-                depth += 1
-            elif c == '}':
-                depth -= 1
-            i += 1
-        return source[brace_pos:i]
-    return ""
-
-
 # ---------------------------------------------------------------------------
 # Pattern protocol
 # ---------------------------------------------------------------------------

{sourcecode-2.5.16 → sourcecode-2.5.18}/src/sourcecode/validation_surface.py

@@ -363,6 +363,98 @@ def _recover_source_endpoints(
     return routes, total
 
 
+def _recover_spec_endpoints(
+    root: Path,
+    existing_keys: "set[tuple[Any, Any]]",
+    catalog: "dict[str, Any]",
+    custom_used: "set[str]",
+) -> "tuple[Optional[str], list[dict[str, Any]], int]":
+    """Recover validation routes from a standalone OpenAPI spec on disk.
+
+    F1: ``extract_java_endpoints`` only links a spec when an openapi-generator
+    interface-controller (``@RestController implements XxxApi``) matches it. A
+    repo that ships a plain ``openapi.yml`` with no such controller therefore
+    reported "No OpenAPI spec found" — a confirmed false negative. This consults
+    the existing :func:`build_openapi_surface` producer directly so a discovered
+    spec's body operations contribute their declared constraints and flip the
+    "no spec" claim.
+
+    Returns ``(spec_path, routes, validated_field_count)``; ``spec_path`` is None
+    when no parseable spec with operations is present.
+    """
+    from sourcecode.openapi_surface import build_openapi_surface
+
+    surface = build_openapi_surface(root)
+    if surface is None or not surface.operations:
+        return None, [], 0
+
+    routes: "list[dict[str, Any]]" = []
+    total = 0
+    for op in surface.operations:
+        if str(op.method).upper() not in ("POST", "PUT", "PATCH"):
+            continue
+        key = (op.method, op.path)
+        if key in existing_keys:
+            continue  # already surfaced from source — dedupe by method+path
+        schema = surface.schemas.get(op.request_body_schema) if op.request_body_schema else None
+        constraints = [f.to_dict() for f in schema.fields] if schema is not None else []
+        validated = _validated_fields_from_constraints(constraints, catalog, custom_used)
+        total += len(validated)
+        route: "dict[str, Any]" = {
+            "method": op.method,
+            "path": op.path,
+            "controller": None,
+            "handler": op.operation_id or "(operation)",
+            "schema": op.request_body_schema,
+            "source": "openapi-spec",
+            "confidence": "high",
+            "validatedFields": validated,
+        }
+        routes.append(route)
+        existing_keys.add(key)
+    return surface.spec_path, routes, total
+
+
+def _validated_fields_from_constraints(
+    constraints: "list[Any]",
+    catalog: "dict[str, Any]",
+    custom_used: "set[str]",
+) -> "list[dict[str, Any]]":
+    """Render a schema's constraint dicts into ``validatedFields`` entries.
+
+    Mirrors the built-in-rule + custom-validator linkage the main loop applies to
+    OpenAPI request bodies; shared so the standalone-spec path (F1) stays byte-
+    consistent with the interface-controller path."""
+    out: "list[dict[str, Any]]" = []
+    for fc in constraints:
+        if not isinstance(fc, dict):
+            continue
+        rules = _field_rules(fc)
+        customs: "list[dict[str, Any]]" = []
+        for ann in fc.get("extraAnnotations", []) or []:
+            cc = catalog.get(ann)
+            entry: "dict[str, Any]" = {"annotation": ann}
+            if cc is not None:
+                custom_used.add(ann)
+                if cc.validators:
+                    entry["validators"] = cc.validators
+                if cc.message is not None:
+                    entry["message"] = cc.message
+                entry["resolved"] = True
+            else:
+                entry["resolved"] = False
+            customs.append(entry)
+        if not rules and not customs:
+            continue
+        field_entry: "dict[str, Any]" = {"name": fc.get("name")}
+        if rules:
+            field_entry["rules"] = rules
+        if customs:
+            field_entry["customValidators"] = customs
+        out.append(field_entry)
+    return out
+
+
 def _field_rules(fieldc: "dict[str, Any]") -> "list[dict[str, Any]]":
     """Render a constraint dict's built-in rules as a list of {kind, value}."""
     rules: "list[dict[str, Any]]" = []
@@ -491,6 +583,36 @@ def build_validation_surface(
     if spec_path:
         result["openapi_spec"] = spec_path
     else:
+        # No spec linked by extract_java_endpoints (no openapi-generator
+        # interface-controller matched). F1: consult the standalone-spec
+        # producer directly — a plain openapi.yml shipped in the repo is a real
+        # spec, so its body operations contribute constraints and flip the
+        # "no spec found" claim instead of reporting a false negative.
+        existing_keys = {(r.get("method"), r.get("path")) for r in out_endpoints}
+        spec_path2, spec_routes, spec_fields = _recover_spec_endpoints(
+            root, existing_keys, catalog, custom_used
+        )
+        if spec_path2 is not None:
+            result["openapi_spec"] = spec_path2
+            out_endpoints.extend(spec_routes)
+            total_validated_fields += spec_fields
+            spec_keys = {(r.get("method"), r.get("path")) for r in spec_routes}
+            gaps = [g for g in gaps if (g.get("method"), g.get("path")) not in spec_keys]
+            result["endpoints"] = out_endpoints
+            result["gaps"] = gaps
+            result["custom_validators"] = [catalog[k].to_dict() for k in sorted(catalog)]
+            result["summary"]["endpoints_with_body"] = len(out_endpoints)
+            result["summary"]["validated_fields"] = total_validated_fields
+            result["summary"]["custom_validators_linked"] = len(custom_used)
+            result["summary"]["gaps"] = len(gaps)
+            result["summary"]["spec_derived_routes"] = len(spec_routes)
+            result["note"] = (
+                "OpenAPI spec discovered on disk (standalone, not linked to a "
+                "generated interface-controller); body operations contributed "
+                "their declared constraints. Response shapes and non-body "
+                "operations are not modeled here."
+            )
+            return result
         # No OpenAPI spec on disk / under target/generated-sources. Recover
         # declarative constraints from the graph's DTO field nodes (bean-
         # validation annotations on @Valid/@Validated handler bodies), so a
@@ -525,6 +647,12 @@ def build_validation_surface(
                 "partial; OpenAPI-carried constraints would be more complete."
             )
         else:
+            # Genuine absence — no spec on disk AND no in-repo DTO constraints.
+            # Emit a machine-readable zero_result_reason (F1) so a consumer can
+            # tell "we looked and found nothing" from "we did not look": an empty
+            # surface here is an attested negative, not a missing-validation
+            # finding.
+            result["zero_result_reason"] = "no_openapi_spec_and_no_source_dto_constraints"
             result["note"] = (
                 "No OpenAPI spec found and no source DTO constraints recovered "
                 "(no handler validates an in-repo DTO via @Valid/@Validated, or "