sourcecode 2.5.2__tar.gz → 2.5.4__tar.gz

{sourcecode-2.5.2 → sourcecode-2.5.4}/CHANGELOG.md

@@ -1,5 +1,186 @@
 # Changelog
 
+## [2.5.4] — 2026-07-16
+
+**Evidence reconciliation + the endpoint axis.** The keycloak real-use simulacro
+confirmed the caller graph (28/28 verified callers, 0 false positives) and exposed
+the remaining lie: HTTP exposure. The impact chain could contain a REST resource
+while the endpoint index had no route for it, and nothing compared the two views
+before answering. This release introduces the Evidence Reconciliation Layer —
+consistency rules that run BETWEEN evidence and narrative — and closes the
+extraction gaps its first two rules uncovered, including Java `record` support.
+
+### Added
+
+- **Evidence Reconciliation Layer** (`reconciliation.py`, new module): rules are pure
+  functions over evidence-view sets that fire only on a *provable* self-contradiction
+  between two views — never on absence alone — and downgrade confidence while naming
+  the gap. Two rules ship:
+  - **`endpoint_coverage`** (SIM-2, `spring_impact.py`): a class in the call chain
+    declares HTTP handler methods (open-standard Spring MVC / JAX-RS annotations) but
+    the endpoint index has NO modeled route for it → the endpoint list provably
+    under-reports exposure. Emits `blind_spots: ["endpoint_coverage_partial"]`, caps
+    confidence at medium (callers stay verified — only the endpoint axis is
+    incomplete), names the unmapped classes, and carries the structured finding in
+    `metadata.reconciliation`. keycloak `RedirectUtils#areWildcardsAllowed` had
+    reported *"2 endpoints exposed"* at confidence=high while the OAuth authorization
+    surface sat invisible in its own verified chain. Fires only on total index
+    absence — a controller contributing a subset of its endpoints is the intentional
+    method-precision rule, not a contradiction. Zero false positives across
+    Broadleaf/petclinic/openmrs/eureka.
+  - **`parse_coverage`** (P1-E, `repository_ir.py`): a Java file whose comment/string-
+    masked source declares a type but yielded ZERO symbols is silently invisible to
+    the graph, callers and endpoints. Now an `analysis_gaps` entry
+    (`area: parse_coverage`, impact high, file list); impact-chain consumes it — an
+    empty blast radius gains `blind_spots: ["parse_coverage"]` + confidence low (a
+    caller could live in an unmodeled file), a not-found symbol gains a hint that it
+    may be defined in one. Non-empty results stay untouched. On first contact with
+    real repos this rule *discovered* the two extraction defects below.
+
+### Fixed
+
+- **Java `record` declarations produced no symbols (P1-F)** (`repository_ir.py`):
+  `public record X(...)` was not in the type-declaration grammar — 52 whole files
+  invisible in keycloak alone (protostream entities, connection providers), on any
+  modern-Java repo. Records now extract as `type="class"` / `symbol_kind="record"`
+  (existing consumers unaffected: class-level scope falls through the `#`-heuristic),
+  carry the component list in the signature, resolve component types into
+  `imports_used`, and register components as implicit final fields in `field_types`
+  so `component.method()` receivers bind like ordinary injected fields. Multiline
+  record headers ride the existing continuation-join pass. `record` stays a
+  contextual keyword: binding requires `Name(` plus a body brace, so identifiers
+  named `record` never match. keycloak: 131 record symbols now in the graph.
+
+- **Declarations glued to comments were silently dropped (P1-G)**
+  (`repository_ir.py`): any line containing a block-comment marker was discarded
+  whole, erasing real declarations — `public class Proc /* implements ... */{`
+  (openmrs `HL7InQueueProcessor`) and `*/public class X {` (keycloak
+  `JWKSServerUtils`) extracted nothing. Fixing that naively exposed the deeper bug:
+  the marker check ignored string literals, so `@Consumes("*/*")` (eureka
+  `DiscoveryJerseyProvider`) would poison the comment state and swallow the rest of
+  the file. New `_scan_line_comments` is string-literal-aware — markers inside
+  strings are code, block-comment spans and `//` tails are removed, the residue is
+  processed. Fast-path gated: lines without a marker pay nothing (openmrs 2.4s /
+  keycloak 13.9s cold builds, unchanged). Symbols gained: eureka +17, openmrs +22,
+  keycloak +38.
+
+- **JAX-RS sub-resource locator chains under-resolved (SIM-1)** (`repository_ir.py`):
+  keycloak's OAuth authorization endpoint had ZERO endpoints and 39 endpoints across
+  25 classes collapsed to path `/`. Two precise gaps, not a missing resolver:
+  (a) a locator declaring `Object` while its body does `return new X(...)`
+  (`@Path("auth") public Object auth() { return new AuthorizationEndpoint(...); }`)
+  never bound the child — `_extract_symbols` now records instantiated return types
+  per method and the locator map falls back to them when the declared type is
+  unusable, but only when UNAMBIGUOUS (a multi-branch locator like keycloak's
+  `resolveExtension` stays unresolved); (b) a chain whose head is dynamically
+  mounted (`getProtocol` resolves the protocol service via an SPI factory) was
+  dropped whole by the impl-duplicate guard — `_resolve_jaxrs_prefixes` now splits
+  rooted vs unrooted compositions: rooted still wins (impl-duplicate short paths
+  still suppressed), and when nothing is rooted the RELATIVE composition is emitted:
+  `GET /auth`, `POST /token`, `GET /userinfo` instead of an undifferentiated `/`.
+  keycloak: `AuthorizationEndpoint` 0→2 endpoints, path-`/` routes 39→10 (all
+  genuine roots); eureka/petclinic/Broadleaf route surfaces unchanged. With the
+  index fixed, the `endpoint_coverage` blind spot on the simulacro query
+  self-clears: confidence=high, `blind_spots: []`, risk critical with the real
+  endpoint set — the two evidence views now agree.
+
+- **"Jakarta EE" over-label (P1-C)** (`detectors/java.py`, `classifier.py`): using
+  the JAX-RS spec (`javax.ws.rs-api`/`jakarta.ws.rs`/resteasy coordinates, or
+  `@Path`/`@GET` annotations) labeled the repo "Jakarta EE" — the platform — so
+  eureka (Guice) and keycloak (Quarkus) read as Jakarta EE application servers. The
+  spec now labels "JAX-RS"; only an umbrella artifact (`javaee-api`,
+  `jakartaee-api`, `jakarta.platform`) claims the platform. Boot 3 apps pulling
+  individual `jakarta.*` specs transitively are NOT relabeled (pinned by test —
+  the previously suggested "require multiple specs" fix would have mislabeled
+  every Boot 3 app).
+
+- **Hallucinated architecture layers (P1-D)** (`architecture_analyzer.py`,
+  `summarizer.py`): directory-name keyword matching asserted layers with no code
+  mass behind them (neo4j: "controller" from 0.1%-mass dirs) and from keywords that
+  don't attest the role (`api`→controller at 16–95% mass, `store`→repository,
+  `db`→infrastructure). A 1% mass gate (calibrated on real repos — 5% would erase
+  Broadleaf's genuine 4.68% controller layer) plus removal of the non-attesting
+  keywords, applied to both duplicated tables (analyzer prose + summarizer
+  headline). Residue tracked: polyglot monorepos and the modular fallback.
+
+## [2.5.3] — 2026-07-16
+
+**impact-chain caller resolution — three false-confident zeros closed.** All three
+defects produced the same dangerous shape: a method-scoped query returning
+`0 callers, risk=low, confidence=high, "isolated"` for a method with real call sites
+in source. Continuation of the 12-repo adversarial audit that drove 2.5.2. A fourth
+fix removes the reporting redundancy the third one introduced.
+
+### Fixed
+
+- **Ambiguous field types dropped receiver-typed edges (P1-A)** (`repository_ir.py`):
+  `_receiver_typed_call_edges` resolved a field's declared type by **simple name only**,
+  so when two in-repo classes shared that name the lookup was ambiguous and the edge was
+  dropped — even though the owning file's `import` said exactly which type it held.
+  Broadleaf declares two `AdminSecurityService`, so
+  `impact-chain AdminSecurityService#sendResetPasswordNotification` reported an isolated
+  low-risk change for a method reached from the public `POST /sendResetPassword` handler.
+  `_extract_field_types` now records the import-resolved FQN and `_resolve_declared_type`
+  finishes resolution per Java scoping (an explicit import shadows a same-package type,
+  JLS 6.4.1). A name that is neither stays unresolved rather than guessed. `field_types`
+  values are now an FQN when the declaring file imported the type, else a simple name as
+  before; both consumers accept either shape, so a cached CIR from an older version still
+  resolves. Verified: query above → `AdminLoginController` / `POST /sendResetPassword`,
+  risk=medium; Broadleaf +40 edges, 0 lost; openmrs −2 edges, both phantom
+  (`import java.util.Iterator` bound by simple name to an in-repo nested `Iterator`).
+
+- **Static calls never landed on the method node (P1-B2)** (`repository_ir.py`): the
+  per-file static-call scan discards the callee name and attributes the call to every
+  class in the file, so it could only emit `CallerClass --calls--> TargetClass`. No
+  method-scoped query on a static utility could ever resolve a caller, however many call
+  sites existed (`BroadleafCurrencyUtils#getNumberFormatFromCache` → 0 callers, 5+ real
+  static call sites). A repo-wide post-pass now joins facts already extracted (no new
+  parse): the invocation atom carries receiver/callee for `Type.method(...)`, the owner
+  file's imports resolve the receiver via P1-A's `_resolve_declared_type`, and the symbol
+  table supplies that type's methods. Field receivers, lower-case variables and library
+  types stay unresolved. Verified: the query above returns 4 callers (all 4 confirmed in
+  source), high confidence, risk=medium; Broadleaf +1265 edges, openmrs +1487, 0 edges
+  lost anywhere; class-level results unchanged (75 unique caller classes, risk critical);
+  build time flat.
+
+- **Method-scoped empty blast claimed high confidence (P1-B)** (`spring_impact.py`):
+  every blind-spot guard was gated on `class_level_seed`, so a `Class#method` query never
+  reached one and an empty method blast was always narrated as
+  *"No callers or endpoints found. Low-risk isolated change."* — making the tool
+  contradict itself across granularity, silently, with the narrower and more natural
+  query being the less trustworthy one. When a method-scoped blast is empty but the
+  declaring class has inbound injects/imports, the result is now marked
+  `blind_spots: ["method_scope_unproven"]`, confidence drops to low, and the explanation
+  points at the class-level re-query. The method may well be uncalled; what is unproven is
+  the *emptiness* — so this warns rather than inventing callers, and risk stays as
+  computed (CH-005/CH-003/G-2 precedent). The "Low-risk isolated change" sentence is also
+  suppressed whenever *any* blind spot fired, which it already contradicted for the three
+  pre-existing class-level guards. Broadleaf survey (300 sampled methods, 197 empty
+  blasts): the guard fires on 42% of empty results, spot-checked true — static utility
+  callers, annotation attribute uses, ORM/serialization setters.
+
+- **A static caller was reported at two granularities (P1-B3)** (`spring_impact.py`): the
+  edges P1-B2 adds are additive by design — the coarse class edge and the precise method
+  edge are both kept, because a static call in a field initializer or static block yields
+  no body fact, so only the class edge carries it (superseding it was implemented,
+  measured, and reverted: `BroadleafCurrencyUtils` lost 1325→561 transitive reach and all
+  20 affected endpoints). The cost was that one caller landed in the report twice, as `X`
+  and as `X#m` — 153 direct entries for 75 unique caller classes on Broadleaf. Each entry
+  is true, but the pair reads as two callers and `len(direct_callers)` double-counted it
+  into `_compute_risk`. The reported and scored lists now collapse the pair (the class
+  entry is dropped when a method entry of the same class is present; a class entry with no
+  method sibling is kept). This is a view, not an edge deletion: endpoint and finding
+  mapping still consume both granularities, since a class node reaches every handler of a
+  controller while a method node reaches only its own. The hub-cap guard keeps counting
+  raw nodes deliberately — it guards BFS cost, and BFS does expand from both. Verified by
+  A/B over Broadleaf/openmrs/petclinic: caller **class** sets, endpoints, confidence,
+  blind spots and findings identical on every query; entries drop only where the duplicate
+  existed (Broadleaf 153→118 direct, 1300→1206 indirect, 21 endpoints unchanged; openmrs
+  `ValidateUtil` 107→55 — every one of its 55 caller classes had been listed twice); risk
+  de-inflates only below the caller-score cap (petclinic `OwnerRepository` 57.0→51.0, level
+  still critical). `ask impact` / `retrieve` were unaffected — they already normalize
+  callers to class level.
+
 ## [2.5.2] — 2026-07-14
 
 **impact-chain correctness + cold-scan performance.** Two fixes surfaced by an

{sourcecode-2.5.2 → sourcecode-2.5.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 2.5.2
+Version: 2.5.4
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-2.5.2 → sourcecode-2.5.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "2.5.2"
+version = "2.5.4"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-2.5.2 → sourcecode-2.5.4}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "2.5.2"
+__version__ = "2.5.4"

{sourcecode-2.5.2 → sourcecode-2.5.4}/src/sourcecode/architecture_analyzer.py

@@ -31,7 +31,14 @@ _TOOLING_PREFIXES = (
     "dist/",
     "build/",
 )
-_SRC_TRANSPARENT = {"src", "lib", "app", "pkg"}
+# Structural wrappers to walk THROUGH when looking for a module: they are build
+# layout, never a module name. "main" and the language dirs come from the Maven /
+# Gradle source-set convention (src/main/java/...) — without them a Maven repo with
+# no other signal offers "main" as one of its modules (P1-D, spring-petclinic).
+_SRC_TRANSPARENT = {
+    "src", "lib", "app", "pkg",
+    "main", "java", "kotlin", "scala", "groovy",
+}
 _CODE_EXTENSIONS = {
     ".py", ".js", ".ts", ".tsx", ".jsx", ".mjs", ".cjs",
     ".go", ".java", ".kt", ".rs", ".rb",
@@ -56,7 +63,13 @@ _BENCHMARK_DIRS: frozenset[str] = frozenset({
     "sandbox",
 })
 _DOCS_DIRS: frozenset[str] = frozenset({"docs", "doc", "documentation", "wiki"})
-_TOOLING_DIRS: frozenset[str] = frozenset({"scripts", "script", "tools", "tool", "ci"})
+# Tooling/CI config, never runtime architecture. The dot-dirs are conventional: a
+# leading dot marks tooling config across ecosystems, and without them `.github`
+# was offered as a neo4j "module" alongside community/ and packaging/ (P1-D).
+_TOOLING_DIRS: frozenset[str] = frozenset({
+    "scripts", "script", "tools", "tool", "ci",
+    ".github", ".circleci", ".mvn", ".idea", ".vscode",
+})
 # All dirs that are not part of the runtime source architecture
 _NON_SOURCE_DIRS: frozenset[str] = _TEST_DIRS | _BENCHMARK_DIRS | _DOCS_DIRS | _TOOLING_DIRS | _ASSET_DIRS
 
@@ -137,11 +150,25 @@ LAYER_PATTERNS: dict[str, dict[str, list[str]]] = {
         "model":      ["model", "models", "entity", "entities", "domain"],
         "view":       ["views", "templates", "pages", "components"],
     },
+    # P1-D: a keyword may only name a layer it actually ATTESTS. The dropped
+    # synonyms below are naming conventions that say nothing about a layer role,
+    # and they were the engine of the fabricated claims — mass alone cannot filter
+    # them out, because in the repos they mislabel they are large:
+    #   * "api" — a Java `foo/api/` package is a public API surface (interfaces),
+    #     not an HTTP controller layer. It manufactured neo4j's controller layer
+    #     (925 files, 16.5%, and neo4j has no controller dir at all) and openmrs's
+    #     (821 files, 94.8% — that is `org/openmrs/api/`, the service API).
+    #   * "store"/"storage" — a storage ENGINE is not a repository/DAO layer
+    #     (neo4j's `store` is exactly that).
+    #   * "db"/"database" — a database package is not an infrastructure layer.
+    # Kept are the names that state their role: controller/handlers/routes/endpoints,
+    # repository/repo/dao, infra/infrastructure/persistence. Broadleaf keeps all four
+    # of its layers on those alone.
     "layered": {
-        "controller":     ["controller", "controllers", "api", "routes", "handlers", "endpoints"],
+        "controller":     ["controller", "controllers", "routes", "handlers", "endpoints"],
         "service":        ["service", "services", "usecase", "usecases", "application"],
-        "repository":     ["repository", "repositories", "repo", "repos", "store", "storage", "dao"],
-        "infrastructure": ["infra", "infrastructure", "persistence", "db", "database"],
+        "repository":     ["repository", "repositories", "repo", "repos", "dao"],
+        "infrastructure": ["infra", "infrastructure", "persistence"],
     },
     "hexagonal": {
         "port":    ["port", "ports", "interface", "interfaces"],
@@ -154,7 +181,11 @@ LAYER_PATTERNS: dict[str, dict[str, list[str]]] = {
     },
     "fullstack": {
         "frontend": ["frontend", "client", "web", "ui", "pages", "components", "app"],
-        "backend":  ["backend", "server", "api", "services"],
+        # P1-D: "api" dropped — a `foo/api/` package is a public API surface, not
+        # evidence of a backend TIER. With it, openmrs (94.8% `org/openmrs/api/`)
+        # and jobrunr fell straight from a fabricated "layered" into a fabricated
+        # "fullstack" instead. Same conflation, same fix.
+        "backend":  ["backend", "server", "services"],
     },
 }
 
@@ -167,6 +198,28 @@ _PATTERN_REQUIRED_KEYS: dict[str, frozenset[str]] = {
     "mvc": frozenset({"view"}),
 }
 
+# Minimum share of source files a matched layer must hold to count as a LAYER
+# (P1-D, neo4j field test). Matching was pure name PRESENCE over the set of every
+# directory name in the repo, so one incidental dir minted a whole layer: neo4j — a
+# graph engine with no controller, repository or infrastructure directory anywhere —
+# reported "Layered Architecture with controller, service, repository, infrastructure
+# layers", synthesized from `api`, `service` (7 files), `store`/`storage` and
+# `database`. Presence does not scale: the bigger the repo, the likelier some
+# directory somewhere matches a keyword, so large systems were the most confidently
+# mislabelled.
+#
+# A layer is a place where a real share of the code lives. Same reasoning the
+# archetype engine already applies to the same question ("a 0.3% `api/` dir does not
+# manufacture a controller layer", _architectural_style).
+#
+# Calibrated against the field-test repos rather than copied from archetype's 5%,
+# which scores a web+service+repository triplet and is too coarse to erase a single
+# layer with: Broadleaf's controller layer is a real 4.68% (it has a literal
+# `controller/` dir) and 5% deleted it. The phantoms all sit an order of magnitude
+# lower — jenkins 0.72% (`handlers`, and it has no HTTP controllers at all), ofbiz
+# 0.19%, neo4j's service layer 7 files at 0.12% — so 1% separates them cleanly.
+_LAYER_MIN_SHARE = 0.01
+
 # Higher value = wins when score ties
 _PATTERN_PRIORITY: dict[str, int] = {
     "cqrs":               8,
@@ -555,24 +608,44 @@ class ArchitectureAnalyzer:
         if not source_paths:
             return "unknown", []
 
-        dir_names: set[str] = set()
-        for p in source_paths:
-            parts = p.replace("\\", "/").split("/")
-            for part in parts[:-1]:
-                dir_names.add(part.lower())
+        # Index each directory NAME to the source files under it, so a matched layer
+        # can be weighed by the code it actually holds instead of counted as present
+        # (P1-D). Built once; every pattern below reads it.
+        dir_files: dict[str, set[int]] = {}
+        for i, p in enumerate(source_paths):
+            for part in p.replace("\\", "/").split("/")[:-1]:
+                dir_files.setdefault(part.lower(), set()).add(i)
+        dir_names: set[str] = set(dir_files)
+        total_files = len(source_paths)
+
+        def _layer_files(matched_dirs: list[str]) -> set[int]:
+            files: set[int] = set()
+            for d in matched_dirs:
+                files |= dir_files.get(d, set())
+            return files
 
         # 1. Classical keyword-based pattern matching
         best_pattern = ""
         best_score = 0
         best_priority = -1
         best_matched: dict[str, list[str]] = {}
+        best_layer_files: dict[str, set[int]] = {}
 
         for pattern_name, layer_keys in LAYER_PATTERNS.items():
             matched: dict[str, list[str]] = {}
+            layer_files: dict[str, set[int]] = {}
             for layer_key, keywords in layer_keys.items():
                 matched_dirs = [d for d in dir_names if d in keywords]
-                if matched_dirs:
-                    matched[layer_key] = matched_dirs
+                if not matched_dirs:
+                    continue
+                # P1-D: a layer is where a real share of the code lives. An incidental
+                # directory that merely matches a keyword is not one — neo4j's 7-file
+                # `service/` dir (0.12%) never made it a service layer.
+                files = _layer_files(matched_dirs)
+                if total_files and len(files) / total_files < _LAYER_MIN_SHARE:
+                    continue
+                matched[layer_key] = matched_dirs
+                layer_files[layer_key] = files
             # A pattern with unmet required keys cannot qualify (e.g. mvc needs a view).
             required = _PATTERN_REQUIRED_KEYS.get(pattern_name)
             if required and not required.issubset(matched.keys()):
@@ -584,18 +657,13 @@ class ArchitectureAnalyzer:
                 best_priority = priority
                 best_pattern = pattern_name
                 best_matched = matched
+                best_layer_files = layer_files
 
         if best_score >= 2:
             layer_confidence: Literal["high", "medium", "low"] = "medium" if best_score >= 3 else "low"
             layers: list[ArchitectureLayer] = []
             for layer_key, matched_dirs in best_matched.items():
-                matched_files = [
-                    p for p in source_paths
-                    if any(
-                        seg.lower() in matched_dirs
-                        for seg in p.replace("\\", "/").split("/")[:-1]
-                    )
-                ]
+                matched_files = [source_paths[i] for i in sorted(best_layer_files[layer_key])]
                 layers.append(ArchitectureLayer(
                     name=layer_key,
                     pattern=best_pattern,
@@ -716,6 +784,14 @@ class ArchitectureAnalyzer:
         - orchestration: cli.py, main.py, *_handler.py, *_controller.py
         - processing:    *_analyzer.py, *_processor.py, *_parser.py, *_detector.py, *_scanner.py
         - data:          schema.py, model.py, *_repository.py, *_serializer.py, config.py, …
+
+        P1-D: weighed by share, like the directory-name patterns. Matching on file
+        stems alone let a handful of incidentally-named files mint logical layers:
+        neo4j's "orchestration, processing, data" rested on ~6 files out of 5616
+        (0.05% each) — one `Main.java`, a `Config.java`, a `Serializer.java`, and two
+        `Server.java` that are model classes under `topology/model/`, "orchestration"
+        only because of their stem. Three layers named off 0.1% of a codebase is a
+        description of nothing.
         """
         layer_files: dict[str, list[str]] = {"orchestration": [], "processing": [], "data": []}
         for p in paths:
@@ -728,7 +804,11 @@ class ArchitectureAnalyzer:
                     layer_files[layer].append(p)
                     break
 
-        non_empty = {k: v for k, v in layer_files.items() if v}
+        total = len(paths)
+        non_empty = {
+            k: v for k, v in layer_files.items()
+            if v and (not total or len(v) / total >= _LAYER_MIN_SHARE)
+        }
         if len(non_empty) >= 2:
             return "layered", [
                 ArchitectureLayer(name=k, pattern="layered", files=v, confidence="low")

{sourcecode-2.5.2 → sourcecode-2.5.4}/src/sourcecode/canonical_ir.py

@@ -253,8 +253,9 @@ class CanonicalRepositoryIR:
 
     @property
     def field_types(self) -> dict[str, dict[str, str]]:
-        """{class_fqn -> {field_name -> declared_type_simple_name}} for every field
-        (annotated or plain). Binds an invocation receiver to a typed dependency —
+        """{class_fqn -> {field_name -> declared_type}} for every field (annotated or
+        plain); the type is import-resolved to an FQN when the declaring file imported
+        it, else a simple name. Binds an invocation receiver to a typed dependency —
         covers plain setter/XML-injected fields the injection graph cannot see. A
         projection over field declarations, no new symbols/edges. Present only when
         built via build_canonical_ir; not a cir_hash input."""

{sourcecode-2.5.2 → sourcecode-2.5.4}/src/sourcecode/classifier.py

@@ -25,7 +25,9 @@ _API_FRAMEWORKS = {
     "Micronaut",
     "Vert.x",
     "Quarkus",
-    "Jakarta EE",   # JAX-RS / Jakarta REST — pure JAX-RS projects must not fall to "unknown"
+    "JAX-RS",       # Jakarta REST — pure JAX-RS projects must not fall to "unknown"
+    "Jakarta EE",   # platform umbrella artifact (jakartaee-api); implies a web profile
+    "Java EE",      # javax.* umbrella artifact (javaee-api)
     "Laravel",
     "Symfony",
     "Ktor",
@@ -42,7 +44,7 @@ _API_STACKS = {"python", "go", "java", "php", "ruby", "dotnet", "kotlin", "scala
 # guard because they are repo-wide (no locatable minority module):
 #   * a jakarta.ws.rs / javax.ws.rs-api coordinate pinned in a BOM/parent pom's
 #     <dependencyManagement> (a version pin, not usage), and
-#   * a source-annotation "Jakarta EE" marker synthesized from @Path resources
+#   * a source-annotation "JAX-RS" marker synthesized from @Path resources
 #     (detected_via carries no file path).
 # So on a repo large enough to HAVE a distinct center of gravity, require the API
 # surface to occupy a real share of the code (or the dominant module) before we

{sourcecode-2.5.2 → sourcecode-2.5.4}/src/sourcecode/detectors/java.py

@@ -185,17 +185,22 @@ class JavaDetector(AbstractDetector):
         # build.gradle files are not scanned at all — yet it ships 18 @Path resource
         # classes. Without this the headline read "Java library / package" while the
         # endpoints command listed a full JAX-RS API. When the annotation scan found
-        # JAX-RS entry points and no Jakarta-EE framework was inferred from the
+        # JAX-RS entry points and no JAX-RS framework was inferred from the
         # manifest, surface it so the stack (and project_type) reflect the REST API
         # the endpoints already prove. Structural (VAI): reasons from the JAX-RS
         # entry points found in source, not from a vendor dependency-name allowlist.
         # detected_via carries no path form, so it is treated as repo-wide evidence
         # (never localized to an adapter submodule).
-        if not any(f.name == "Jakarta EE" for f in frameworks) and any(
+        # P1-C: @Path/@GET resources prove JAX-RS — the one spec they belong to —
+        # and nothing about the rest of the Jakarta EE platform. Eureka (Jersey 1.x
+        # + Guice, no EE container) read "Java rest api using Jakarta EE" on this
+        # path alone. The API framing this exists to deliver is unchanged; only the
+        # claim narrows to what the annotations attest.
+        if not any(f.name == "JAX-RS" for f in frameworks) and any(
             ep.kind in ("jax_rs_controller", "jax_rs_provider") for ep in entry_points
         ):
             frameworks.append(FrameworkDetection(
-                name="Jakarta EE", source="annotation", detected_via=["jax_rs_endpoints"],
+                name="JAX-RS", source="annotation", detected_via=["jax_rs_endpoints"],
             ))
 
         transactional_classes = self._collect_transactional_classes(context, all_paths)
@@ -436,15 +441,27 @@ class JavaDetector(AbstractDetector):
             frameworks.append(FrameworkDetection(name="Micronaut", source=source))
         if "io.vertx" in text or "vertx" in text:
             frameworks.append(FrameworkDetection(name="Vert.x", source=source))
+        # P1-C: name the spec that is actually evidenced, not the platform that
+        # contains it. "Jakarta EE" is a platform of ~40 specs; a JAX-RS coordinate
+        # attests ONE of them. Claiming the platform from it told neo4j (a graph
+        # engine with an HTTP API) and jobrunr (a job library with RESTEasy on the
+        # test path) that they were Jakarta EE applications.
+        #
+        # Only an aggregate platform artifact — the coordinate that IS the platform
+        # umbrella — attests the platform itself. Counting distinct jakarta.* specs
+        # instead would misfire: Spring Boot 3 pulls jakarta.servlet, .validation and
+        # .persistence transitively (Broadleaf ships the first two), so any threshold
+        # low enough to catch a real EE app relabels every Boot 3 app.
+        if "javaee-api" in text:            # javax.* umbrella (pre-EE 9)
+            frameworks.append(FrameworkDetection(name="Java EE", source=source))
+        if "jakartaee-api" in text or "jakarta.platform" in text or "jakarta.ee" in text:
+            frameworks.append(FrameworkDetection(name="Jakarta EE", source=source))
         if (
-            "jakarta.ee" in text
-            or "javax.ws.rs-api" in text   # JAX-RS 2.x spec; excludes jsr311-api (1.x API-only jar)
-            or "jakarta.ws.rs" in text      # Jakarta namespace (EE 9+)
-            or "javaee-api" in text         # full Java EE platform
-            or "jakartaee-api" in text      # full Jakarta EE platform
-            or "resteasy" in text           # RESTEasy (JBoss JAX-RS impl)
+            "javax.ws.rs-api" in text   # JAX-RS 2.x spec; excludes jsr311-api (1.x API-only jar)
+            or "jakarta.ws.rs" in text  # Jakarta namespace (EE 9+)
+            or "resteasy" in text       # RESTEasy — a JAX-RS implementation
         ):
-            frameworks.append(FrameworkDetection(name="Jakarta EE", source=source))
+            frameworks.append(FrameworkDetection(name="JAX-RS", source=source))
         if "mybatis" in text:
             frameworks.append(FrameworkDetection(name="MyBatis", source=source))
         if "thymeleaf" in text: