sourcecode 2.6.0__py3-none-any.whl → 2.6.2__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "2.6.0"
+__version__ = "2.6.2"

sourcecode/archetype.py

@@ -599,7 +599,18 @@ class ArchetypeClassifier:
             # winner barely above the evidence floor is "undetermined-ish" and must
             # not read as high/medium however lonely it is.
             confident_enough = top.score >= _MIN_CONFIDENT_SCORE
-            if confident_enough and rel_margin >= 0.4 and mass_backed and graph_backed:
+            # Signal diversity: "high" requires the label to be backed by MORE THAN ONE
+            # distinct signal. A lone dominant signal — however strong (e.g. a fan-in
+            # Gini alone labeling a REST API an "engine") — is a single point of view and
+            # must not read as high confidence (field-eval Fase 0).
+            distinct_signals = len({e.signal for e in top.evidence if e.contribution > 0})
+            if (
+                confident_enough
+                and rel_margin >= 0.4
+                and mass_backed
+                and graph_backed
+                and distinct_signals >= 2
+            ):
                 confidence = "high"
             elif confident_enough and rel_margin >= 0.25 and mass_backed:
                 confidence = "medium"

sourcecode/cli.py

@@ -160,10 +160,11 @@ def _build_help_text() -> str:
     text = f"""\
 [bold]ASK Engine[/bold]  [dim]· CLI: ask[/dim]   {plan_badge}
 
-Persistent structural context and ultra-fast repeated analysis for AI coding agents.
+Deterministic Java/Spring semantics and reusable structural context for AI coding agents.
 
-Cache warms on first scan; every subsequent call returns pre-built context in milliseconds.
-Cold scan: 2–10s depending on repo size. Warm cache: 0.3–0.6s.
+Cache warms on first scan; later calls reuse pre-built context instead of rescanning.
+Scan and warm time scale with repo size — small repos in seconds, large repos (thousands
+of files) in minutes. Semantic analysis itself is sub-second; repo indexing dominates.
 
 [bold]Primary usage:[/bold]
   ask --compact                  high-signal summary (~2,500–4,000 tokens)
@@ -725,6 +726,31 @@ DOCS_DEPTH_CHOICES = ["module", "symbols", "full"]
 # ── Module-level constants ─────────────────────────────────────────────────────
 _FREE_TIER_NODE_CAP: int = 50  # graph/semantic node cap — applies only to large repos on free tier
 _JAVA_MIN_SCAN_DEPTH: int = 12  # Maven src/main/java/<pkg>/<module>/File depth floor
+_LARGE_REPO_ADVISORY_FILES: int = 3000  # cold-scan advisory threshold (files); honest expectation-setting, not a speed claim
+
+
+def _cold_scan_advisory_message(
+    file_tree: dict,
+    *,
+    file_count: Optional[int] = None,
+) -> Optional[str]:
+    """Return the large-repo cold-scan advisory line, or ``None`` when the repo is
+    below :data:`_LARGE_REPO_ADVISORY_FILES`.
+
+    Honest expectation-setting (field-eval Fase 3, item E): it states the *shape* of
+    the cost — cold analysis scales with repo size, cached afterwards — and never
+    asserts a duration the tool cannot keep. Pure and TTY-agnostic: the caller owns
+    the ``sys.stderr.isatty()`` gate so this never reaches stdout (JSON) or an agent.
+    """
+    if file_count is None:
+        from sourcecode.tree_utils import flatten_file_tree as _flatten_ft
+        file_count = sum(1 for _p in _flatten_ft(file_tree) if Path(_p).suffix)
+    if file_count < _LARGE_REPO_ADVISORY_FILES:
+        return None
+    return (
+        f"[scan] large repository (~{file_count:,} files) — cold analysis scales with "
+        "repo size and may take a while; the result is cached, so later runs are fast."
+    )
 _JVM_STACKS: frozenset[str] = frozenset({"java", "kotlin", "scala", "groovy"})
 _IMPACT_PRIORITY_THRESHOLDS: list[tuple[float, str]] = [
     (0.60, "high"),
@@ -762,7 +788,7 @@ def _print_welcome_plain(tier: str) -> None:
     """Plain-text welcome — fallback when rich is unavailable."""
     lines = ["", f"  ASK Engine {__version__}   ·   {tier}   ·   CLI: ask",
              "  Actionable Software Knowledge Engine", "",
-             "  AI coding-agent context, instant.", "", "  Get started:"]
+             "  Deep Java/Spring semantics for AI coding agents.", "", "  Get started:"]
     for cmd, desc in _WELCOME_CMDS:
         lines.append(f"    {cmd.ljust(34)}{desc}")
     lines.append("")
@@ -812,7 +838,7 @@ def _print_welcome() -> None:
     t.append(_WELCOME_ENGINE, style="bold dim cyan")
     t.append("   Actionable Software Knowledge\n", style="dim")
 
-    t.append("\nAI coding-agent context, instant.\n\n", style="white")
+    t.append("\nDeep Java/Spring semantics for AI coding agents.\n\n", style="white")
 
     for cmd, desc in _WELCOME_CMDS:
         t.append("▸ ", style="cyan")
@@ -1483,23 +1509,60 @@ def main(
             # Step 1: try L1 to obtain the core_hash needed for L2 key
             _l1_result = _cache_mod.read_core(target, _core_key)
 
-            # P1-A: --env-map misses L1 when base (em=False) exists.
-            # Try the base key so env analysis can be injected lazily (<1 s)
-            # instead of triggering a 17 s full rescan.
+            # Additive overlays (--env-map / --git-context) miss L1 because they sit in
+            # the core key, yet neither changes the semantic core — env walks config
+            # files, git walks history; both only ATTACH a block. So when the base
+            # (em=False,gc=False) core exists, reuse it and inject the overlay lazily
+            # (<1 s each) instead of triggering a full rescan. (--changed-only is a
+            # different subsystem and is handled separately.)
+            # Try candidate bases that differ from the current flags only by having
+            # some subset of the requested overlays OFF, fewest flips first — so the
+            # RICHEST already-cached core wins (e.g. with --compact --git-context, the
+            # plain --compact core has em=True,gc=False, so we flip only gc and keep em).
+            # Injecting a flag whose base already has it ON would corrupt the reuse, so
+            # we inject exactly the overlays we flipped to land the hit.
             _l1_needs_env_inject = False
-            if _l1_result is None and env_map:
-                _base_flags = _core_flags_str.replace(",em=True,", ",em=False,")
-                _base_h8 = _hashlib.sha256(_base_flags.encode()).hexdigest()[:8]
+            _l1_needs_git_inject = False
+            if _l1_result is None and (env_map or git_context):
                 _sha_prefix = _git_sha if _git_sha else "nogit"
-                _base_key = f"{_sha_prefix}-{_base_h8}"
-                _base_result = _cache_mod.read_core(target, _base_key)
-                if _base_result is not None:
-                    _l1_result = _base_result
-                    _l1_needs_env_inject = True
+                _flippable = []
+                if git_context:
+                    _flippable.append("gc")   # inject git is cheap + additive
+                if env_map:
+                    _flippable.append("em")
+                # non-empty subsets, ascending size (fewest flips = richest base first)
+                import itertools as _it
+                _subsets = [
+                    s for n in range(1, len(_flippable) + 1)
+                    for s in _it.combinations(_flippable, n)
+                ]
+                for _subset in _subsets:
+                    _bf = _core_flags_str
+                    if "gc" in _subset:
+                        _bf = _bf.replace(",gc=True,", ",gc=False,")
+                    if "em" in _subset:
+                        _bf = _bf.replace(",em=True,", ",em=False,")
+                    _bk = f"{_sha_prefix}-{_hashlib.sha256(_bf.encode()).hexdigest()[:8]}"
+                    _br = _cache_mod.read_core(target, _bk)
+                    if _br is not None:
+                        _l1_result = _br
+                        _l1_needs_git_inject = "gc" in _subset
+                        _l1_needs_env_inject = "em" in _subset
+                        break
 
             if _l1_result is not None:
                 _core_dict_l1, _core_hash = _l1_result
                 _view_key = f"{_core_hash}-{_view_h}"
+                # On the lazy-inject path the core is a REUSED base whose _core_hash is
+                # shared with the base's overlay-free view — suffix the view key with the
+                # injected overlays so the injected body never collides with (or is served
+                # from) the base view. Non-inject runs keep their exact historical key, so
+                # existing cached views stay valid (no cross-version churn).
+                if _l1_needs_git_inject or _l1_needs_env_inject:
+                    _view_key = (
+                        f"{_view_key}-ov:gc{int(_l1_needs_git_inject)}"
+                        f"em{int(_l1_needs_env_inject)}"
+                    )
 
                 # Step 2: try L2 (exact view match).
                 # Skip L2 for --changed-only: the stored view is a previous
@@ -1553,6 +1616,23 @@ def main(
                                         ]
                             except Exception:
                                 pass  # env inject failed — continue without env data
+                        # P-gc: inject git context when a gc=False base L1 was reused.
+                        # GitAnalyzer walks history only — typically <1 s. Reuses the
+                        # serializer's own compact shaping (no duplication/drift).
+                        if _rebuilt is not None and _l1_needs_git_inject and compact:
+                            try:
+                                from types import SimpleNamespace as _NS_gc
+                                from sourcecode.git_analyzer import GitAnalyzer as _GitA_gc
+                                from sourcecode.serializer import _compact_git_context as _cgc
+                                _gc_obj = _GitA_gc().analyze(
+                                    target, depth=git_depth, days=git_days
+                                )
+                                _gc_block = _cgc(_NS_gc(git_context=_gc_obj))
+                                if _gc_block:
+                                    _rebuilt = dict(_rebuilt)
+                                    _rebuilt["git_context"] = _gc_block
+                            except Exception:
+                                pass  # git inject failed — continue without git data
                         if _rebuilt is not None:
                             # Apply redaction
                             if not no_redact:
@@ -1729,6 +1809,17 @@ def main(
     # 2. Filter .env and *.secret entries from file tree (SEC-02, all levels)
     file_tree = filter_sensitive_files(raw_tree, redactor)
     perf.stop("discovery", _perf_discovery)
+
+    # Cold-scan advisory (honest expectation-setting, NOT a speed claim). A cache
+    # hit short-circuits above (line ~1647) before this scan, so reaching here means
+    # a cold run: the full parse+analysis below scales with repo size. On a large
+    # repo, warn once on the TTY so the wait is expected — never on stdout (JSON) and
+    # never for agents/pipes. This does not assert a duration; it states the shape.
+    if sys.stderr.isatty() and not no_cache:
+        _advisory = _cold_scan_advisory_message(file_tree)
+        if _advisory:
+            typer.echo(_advisory, err=True)
+
     _perf_detection = perf.start()
     detector = ProjectDetector(build_default_detectors())
     workspace_analysis = WorkspaceAnalyzer().analyze(target, manifests)
@@ -5295,22 +5386,23 @@ def _render_spring_audit_github_comment(result: "SpringAuditResult", min_severit
         lines.append("")
 
     if not visible:
+        # No findings at/above severity — but a gate-coverage escape set (a separate
+        # signal, not a "finding") may still be worth surfacing before the footer.
         lines.append(f"_No findings at or above `{min_severity}` severity._")
-        return "\n".join(lines)
-
-    lines += [
-        "| Sev | Pattern | File | Symbol | Title |",
-        "|-----|---------|------|--------|-------|",
-    ]
-    for f in sorted(visible, key=lambda x: (SEVERITY_ORDER.get(x.severity, 3), x.source_file)):
-        icon = _ICONS.get(f.severity, "")
-        label = _LABELS.get(f.severity, f.severity.upper())
-        short_file = f.source_file.split("/")[-1] if "/" in f.source_file else f.source_file
-        short_sym = f.symbol.split(".")[-1] if "." in f.symbol else f.symbol
-        title_escaped = f.title.replace("|", "\\|")
-        lines.append(f"| {icon} {label} | `{f.pattern_id}` | `{short_file}` | `{short_sym}` | {title_escaped} |")
+    else:
+        lines += [
+            "| Sev | Pattern | File | Symbol | Title |",
+            "|-----|---------|------|--------|-------|",
+        ]
+        for f in sorted(visible, key=lambda x: (SEVERITY_ORDER.get(x.severity, 3), x.source_file)):
+            icon = _ICONS.get(f.severity, "")
+            label = _LABELS.get(f.severity, f.severity.upper())
+            short_file = f.source_file.split("/")[-1] if "/" in f.source_file else f.source_file
+            short_sym = f.symbol.split(".")[-1] if "." in f.symbol else f.symbol
+            title_escaped = f.title.replace("|", "\\|")
+            lines.append(f"| {icon} {label} | `{f.pattern_id}` | `{short_file}` | `{short_sym}` | {title_escaped} |")
 
-    lines.append("")
+        lines.append("")
 
     if visible:
         lines.append("<details>")
@@ -5327,6 +5419,8 @@ def _render_spring_audit_github_comment(result: "SpringAuditResult", min_severit
             lines.append("")
         lines.append("</details>")
 
+    lines += _render_gate_coverage_section(result)
+
     lines += [
         "",
         f"_Generated by [sourcecode](https://github.com/sourcecode-ai/sourcecode) · "
@@ -5335,6 +5429,57 @@ def _render_spring_audit_github_comment(result: "SpringAuditResult", min_severit
     return "\n".join(lines)
 
 
+_GATE_COVERAGE_RENDER_CAP = 25
+
+
+def _render_gate_coverage_section(result: "SpringAuditResult") -> list[str]:  # type: ignore[name-defined]
+    """Human-readable gate-coverage block: the controller handlers that do NOT carry
+    the auto-detected custom authorization gate — the escape set the JSON already
+    computes, surfaced so a reviewer sees it at a glance. Never says "unsecured": a
+    handler a servlet filter pattern covers is marked "possibly filter-covered", and the
+    unmatched ones are flagged for review, not condemned."""
+    gc = (result.security_posture or {}).get("gate_coverage")
+    if not gc:
+        return []
+    not_covered = gc.get("not_carrying_gate", 0)
+    gates = ", ".join(f"`{g}`" for g in gc.get("gate_annotations", [])) or "the detected gate"
+    total = gc.get("total_controller_handlers", 0)
+    lines: list[str] = ["", "---", ""]
+    if not_covered == 0:
+        lines.append(f"✅ **Gate coverage** — all {total} controller handlers carry {gates}.")
+        return lines
+
+    covered = gc.get("possibly_filter_covered", 0)
+    lines.append(
+        f"🔓 **Gate coverage** — {not_covered} of {total} controller handlers do not carry "
+        f"{gates}."
+    )
+    if gc.get("reconstructed_filter_patterns"):
+        lines.append(
+            f"_{covered} of those match a reconstructed servlet filter pattern "
+            f"(possibly filter-covered); {gc.get('no_matching_filter_pattern', 0)} match none._"
+        )
+    lines += ["", "<details>", "<summary>Handlers without the gate</summary>", ""]
+    lines += [
+        "| Method | Path | Filter pattern | Policy |",
+        "|--------|------|----------------|--------|",
+    ]
+    handlers = gc.get("handlers_without_gate", [])
+    for h in handlers[:_GATE_COVERAGE_RENDER_CAP]:
+        method = (h.get("method") or "").replace("|", "\\|")
+        path = (h.get("path") or "").replace("|", "\\|")
+        fpat = h.get("filter_pattern_match")
+        fcell = f"`{fpat}`" if fpat else "—"
+        policy = (h.get("policy") or "").replace("|", "\\|")
+        lines.append(f"| {method} | `{path}` | {fcell} | {policy} |")
+    if len(handlers) > _GATE_COVERAGE_RENDER_CAP:
+        lines.append(f"| … | _+{len(handlers) - _GATE_COVERAGE_RENDER_CAP} more_ | | |")
+    lines += ["", "</details>", ""]
+    if gc.get("note"):
+        lines.append(f"> {gc['note']}")
+    return lines
+
+
 @app.command("spring-audit")
 def spring_audit_cmd(
     path: Path = typer.Argument(
@@ -5804,7 +5949,14 @@ def impact_chain_cmd(
 
     _prog = Progress()
     _prog.start(f"analyzing impact ({len(file_list)} files)")
-    cir = ContextGraph.build(file_list, target).cir
+    # Reuse the shared context-cache CIR (same entry `cache warm` and `explain` use) so
+    # a warmed repo skips the expensive Java parse. Best-effort — any fault falls back to
+    # a fresh build, exactly as explain does, so impact-chain never breaks.
+    from sourcecode import context_cache as _ctxcache
+    try:
+        cir, _ = _ctxcache.get_or_build_cir(_resolve_repo_root(target), target, file_list)
+    except Exception:
+        cir = ContextGraph.build(file_list, target).cir
     _model = SpringSemanticModel.build(cir)
 
     if query_type == "events":
@@ -8215,6 +8367,22 @@ def cache_clear_cmd(
     typer.echo(f"Removed {removed} file(s).", err=True)
 
 
+def _warm_shared_cir(target: Path):
+    """Pre-populate the shared Canonical IR in the context cache (the entry explain and
+    other knowledge commands reuse). Returns the KnowledgeLookup, or None on any fault —
+    warming is best-effort and never fails the warm command."""
+    try:
+        from sourcecode.repository_ir import find_java_files as _fjf
+        from sourcecode import context_cache as _ctxcache
+        files = _fjf(target)
+        if not files:
+            return None
+        _cir, look = _ctxcache.get_or_build_cir(_resolve_repo_root(target), target, files)
+        return look
+    except Exception:
+        return None
+
+
 @cache_app.command("warm")
 def cache_warm_cmd(
     path: Path = typer.Argument(Path("."), help="Repository path to warm (default: current directory)"),
@@ -8245,6 +8413,18 @@ def cache_warm_cmd(
             typer.echo(result.stderr.strip(), err=True)
         raise typer.Exit(code=result.returncode)
 
+    # Also pre-populate the shared Canonical IR (context cache) — a DIFFERENT cache from
+    # the L1/L2 core cache warmed above. explain (and, going forward, other knowledge
+    # commands) reuse this CIR; without warming it here, the first explain rebuilds the
+    # expensive Java parse despite a "warm" cache (field-eval: explain MISS after warm).
+    _look = _warm_shared_cir(target)
+    if _look is not None:
+        typer.echo(
+            f"Shared CIR {'reused' if _look.hit else 'built'} "
+            "(explain/impact reuse this).",
+            err=True,
+        )
+
 
 @cache_app.command("freshness")
 def cache_freshness_cmd(
@@ -8386,6 +8566,23 @@ def _stderr_is_interactive() -> bool:
         return False
 
 
+def _force_utf8_streams() -> None:
+    """Force UTF-8 on stdout AND stderr so Unicode characters (em-dash, arrows, box
+    drawing) survive on Windows where the default console codec is cp1252 (BUG-1).
+
+    stderr matters as much as stdout: progress/warn/gap status text is emitted there,
+    and a cp1252 encoder turned its em-dashes into the replacement char (field-eval).
+    Best-effort and idempotent — a stream without ``reconfigure`` (already wrapped, or a
+    test buffer) is skipped silently.
+    """
+    for stream in (sys.stdout, sys.stderr):
+        if hasattr(stream, "reconfigure"):
+            try:
+                stream.reconfigure(encoding="utf-8")
+            except Exception:
+                pass
+
+
 def main_entry() -> None:
     """CLI entry point for both the canonical ``ask`` command and the deprecated
     ``sourcecode`` compat alias — one implementation, no duplication.
@@ -8395,13 +8592,7 @@ def main_entry() -> None:
     can consume them as positional arguments (which would prevent subcommand
     routing for tokens like 'version' or 'config').
     """
-    # Force UTF-8 on stdout so Unicode characters (arrows, etc.) survive on
-    # Windows where the default console codec is cp1252 (BUG-1).
-    if hasattr(sys.stdout, "reconfigure"):
-        try:
-            sys.stdout.reconfigure(encoding="utf-8")
-        except Exception:
-            pass
+    _force_utf8_streams()
     # Deprecation notice when invoked through the legacy `sourcecode` alias.
     # One line, and only on an interactive terminal — pipes/agents that still call
     # `sourcecode` keep clean stderr (error envelopes are JSON on stderr), so the

sourcecode/context_cache.py

@@ -620,6 +620,46 @@ def get_or_build_cir(
     return cir, KnowledgeLookup(hit=False, enabled=True, build_ms=build_ms)
 
 
+def peek_cir(
+    repo_root: Path,
+    *,
+    since: Optional[str] = None,
+) -> Optional[Any]:
+    """Return the shared ``CanonicalRepositoryIR`` **only if already cached**.
+
+    Get-only sibling of :func:`get_or_build_cir`: it never builds and never
+    writes. A caller that holds only a *bounded scope* of the repo (e.g. the
+    review-pr git-first path) must use this — routing a scoped build through
+    ``get_or_build_cir`` would store a truncated CIR under the repo-wide
+    knowledge key and poison every command that reads it. On a hit the caller
+    gets the full repo-wide CIR for free (O(1) reconstruction from raw IR); on
+    a miss it gets ``None`` and keeps its own scoped build, unshared.
+
+    The reconstructed CIR is left repo-consistent (``file_paths=None`` derives
+    the file list from the cached nodes, not from any caller scope).
+    """
+    from sourcecode.canonical_ir import ir_dict_to_canonical, validate_canonical_ir
+
+    cache = ContextCache.for_repo(repo_root)
+    if not cache.enabled:
+        return None
+    key = cache.knowledge_key(SCOPE_JAVA_CIR, options={"since": since} if since else None)
+    cached = cache.get(key)
+    if cached is None:
+        return None
+    raw = cached.payload.get("raw_ir")
+    if not isinstance(raw, dict):
+        return None
+    try:
+        cir = ir_dict_to_canonical(raw, file_paths=None)
+        # validate_canonical_ir returns a LIST of problems — empty means valid.
+        if not validate_canonical_ir(cir):
+            return cir
+    except Exception:
+        pass  # corrupt/incompatible payload — treat as miss
+    return None
+
+
 # ---------------------------------------------------------------------------
 # Module-level observability helper
 # ---------------------------------------------------------------------------

sourcecode/filter_surface.py

@@ -0,0 +1,173 @@
+"""filter_surface.py — servlet filter URL-pattern reconstruction (Fase 2).
+
+Reconstructs the URL patterns that servlet filters are mapped to, from the two
+**deterministic** sources the platform declares them in:
+
+  1. ``@WebFilter(urlPatterns=… / value=…)`` annotation arguments in ``.java``;
+  2. ``web.xml`` ``<filter-mapping><url-pattern>`` entries.
+
+This is an EXTRACTOR (it reads source / XML), deliberately separate from the
+Knowledge-Layer ``security_posture`` module (which never opens source). Its output
+is a set of servlet URL patterns that the security posture then crosses against the
+endpoint surface, so an endpoint that does NOT carry a per-method gate can still be
+reported as *possibly covered* by a filter whose pattern matches its path — rather
+than being over-flagged.
+
+**Explicit scope (a measured limitation, not a bug).** Three further pattern sources
+are NOT reconstructed here and are declared to the caller: Spring
+``FilterRegistrationBean.addUrlPatterns()``, the ``HttpSecurity``/``requestMatchers``
+DSL, and AspectJ ``@Aspect`` pointcuts (which are not URL patterns at all). Absence of
+a reconstructed pattern therefore never proves an endpoint is unprotected — it means
+"no *declarative servlet* pattern matched"; the caller frames it as review, never as
+"unsecured".
+"""
+from __future__ import annotations
+
+import re
+import xml.etree.ElementTree as ET
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Optional
+
+# @WebFilter(...) argument block. We capture the whole paren body and pull quoted
+# tokens from the urlPatterns/value members (both are the servlet-standard members).
+_WEBFILTER_RE = re.compile(r"@WebFilter\s*\((?P<body>[^)]*)\)", re.DOTALL)
+_QUOTED_RE = re.compile(r'"([^"]*)"')
+# urlPatterns=… or value=… member (either names the patterns). If neither member
+# name is present, a bare @WebFilter("/x") uses value implicitly → all quoted tokens.
+_MEMBER_RE = re.compile(r"(urlPatterns|value)\s*=", re.DOTALL)
+
+
+@dataclass
+class FilterSurface:
+    """Reconstructed servlet filter URL patterns + their provenance."""
+
+    patterns: list[str] = field(default_factory=list)
+    # pattern → list of human-readable sources (filter class / web.xml) — evidence only
+    provenance: dict[str, list[str]] = field(default_factory=dict)
+
+    def is_empty(self) -> bool:
+        return not self.patterns
+
+    def matching_pattern(self, path: Optional[str]) -> Optional[str]:
+        """The first reconstructed servlet pattern that covers ``path`` (servlet
+        matching semantics), or None. Deterministic: patterns are checked in sorted
+        order so the result is stable."""
+        if not path:
+            return None
+        for pat in sorted(self.patterns):
+            if _servlet_pattern_matches(pat, path):
+                return pat
+        return None
+
+    def to_dict(self) -> dict:
+        return {
+            "patterns": sorted(self.patterns),
+            "provenance": {k: sorted(v) for k, v in sorted(self.provenance.items())},
+        }
+
+
+def _servlet_pattern_matches(pattern: str, path: str) -> bool:
+    """Servlet-spec URL-pattern match (SRV.12.2), the semantics @WebFilter / web.xml
+    use — NOT Ant globbing:
+
+      * ``/*``            → matches every path (catch-all);
+      * ``/prefix/*``     → path-prefix: the prefix itself or anything under it;
+      * ``*.ext``         → extension match on the final path segment;
+      * exact string      → equality.
+
+    ``/`` (the default-servlet mapping) is treated as exact — it does not blanket
+    every path here, to avoid over-claiming coverage.
+    """
+    if not pattern:
+        return False
+    p = path if path.startswith("/") else "/" + path
+    if pattern == "/*":
+        return True
+    if pattern.endswith("/*"):
+        prefix = pattern[:-2]  # "/api/*" → "/api"
+        return p == prefix or p.startswith(prefix + "/")
+    if pattern.startswith("*."):
+        return p.rsplit("/", 1)[-1].endswith(pattern[1:])  # "*.do" → endswith ".do"
+    return p == pattern
+
+
+def _patterns_from_webfilter(source: str) -> list[str]:
+    """Servlet URL patterns declared in ``@WebFilter(...)`` annotations in one file."""
+    out: list[str] = []
+    for m in _WEBFILTER_RE.finditer(source):
+        body = m.group("body")
+        if not body.strip():
+            continue
+        # If the body names urlPatterns=/value=, take quoted tokens AFTER that member;
+        # else (bare @WebFilter("/x")) take all quoted tokens. servletNames are not URL
+        # patterns, but they are rare and never start with '/'/'*', so filtering by shape
+        # keeps them out.
+        mem = _MEMBER_RE.search(body)
+        segment = body[mem.end():] if mem else body
+        for tok in _QUOTED_RE.findall(segment):
+            if tok and (tok.startswith("/") or tok.startswith("*.")):
+                out.append(tok)
+    return out
+
+
+def _patterns_from_web_xml(xml_path: Path) -> list[str]:
+    """Servlet URL patterns from ``<filter-mapping><url-pattern>`` in one web.xml.
+    Namespace-agnostic; never raises on malformed XML (returns what it parsed)."""
+    out: list[str] = []
+    try:
+        root = ET.parse(str(xml_path)).getroot()
+    except Exception:
+        return out
+    for elem in root.iter():
+        tag = elem.tag.rsplit("}", 1)[-1]  # strip any namespace
+        if tag != "filter-mapping":
+            continue
+        for child in elem.iter():
+            if child.tag.rsplit("}", 1)[-1] == "url-pattern" and (child.text or "").strip():
+                out.append(child.text.strip())
+    return out
+
+
+def build_filter_surface(
+    root: Path, java_files: Optional[list[str]] = None
+) -> FilterSurface:
+    """Reconstruct the declarative servlet filter surface under ``root``.
+
+    ``java_files`` are repo-relative ``.java`` paths (as ``find_java_files`` yields);
+    when omitted they are discovered. web.xml files are located by glob. Best-effort:
+    an unreadable file is skipped, never fatal.
+    """
+    surface = FilterSurface()
+
+    if java_files is None:
+        try:
+            from sourcecode.repository_ir import find_java_files
+            java_files = find_java_files(root)
+        except Exception:
+            java_files = []
+
+    def _add(pattern: str, source: str) -> None:
+        if pattern not in surface.provenance:
+            surface.patterns.append(pattern)
+            surface.provenance[pattern] = []
+        if source not in surface.provenance[pattern]:
+            surface.provenance[pattern].append(source)
+
+    for rel in java_files:
+        abs_path = root / rel
+        try:
+            src = abs_path.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        if "@WebFilter" not in src:
+            continue
+        for pat in _patterns_from_webfilter(src):
+            _add(pat, f"@WebFilter:{rel}")
+
+    for xml_path in sorted(root.rglob("web.xml")):
+        rel = xml_path.relative_to(root).as_posix()
+        for pat in _patterns_from_web_xml(xml_path):
+            _add(pat, f"web.xml:{rel}")
+
+    return surface

sourcecode/migrate_check.py

@@ -2155,6 +2155,16 @@ def run_migrate_check(
         },
     )
 
+    # Stamp the shared, path-stable repo identity (the id the cache subsystem keys on)
+    # so migrate-check no longer emits an empty repo_id while every other command emits
+    # one. migrate-check is deliberately cir-free (its speed advantage), so it uses the
+    # cache repo_id rather than building a CanonicalIR just to hash it.
+    try:
+        from sourcecode.cache import repo_id as _repo_id
+        report.repo_id = _repo_id(root)
+    except Exception:
+        pass
+
     try:
         import subprocess as _sub
         _r = _sub.run(

sourcecode/prepare_context.py

@@ -1964,8 +1964,28 @@ class TaskContextBuilder:
         if task_name == "review-pr" and _delta_files:
             from sourcecode.context_graph import ContextGraph
             from sourcecode.semantic_impact_engine import SemanticImpactEngine
+            from sourcecode import context_cache as _ctxcache
             _changed_sorted = sorted(_delta_files)
-            _impact_engine = SemanticImpactEngine(ContextGraph.build(all_paths, self.root))
+            # Reuse the shared repo-wide CIR when it is ALREADY WARM: the review-pr
+            # path builds `all_paths` as a deliberately bounded scope (changed files
+            # + sibling dirs, no full-repo traversal), so a fresh build over it must
+            # never reach the shared cache — `peek_cir` only reads, never builds or
+            # stores, so it can never poison explain/impact. On a hit the engine runs
+            # over the full-repo graph (strictly more callers, closing the DI-mediated
+            # blind spot) at O(1); on a miss we keep the current scoped build.
+            _graph = None
+            try:
+                _repo_root = self.root.resolve()
+                while not (_repo_root / ".git").exists() and _repo_root.parent != _repo_root:
+                    _repo_root = _repo_root.parent
+                _cached_cir = _ctxcache.peek_cir(_repo_root)
+                if _cached_cir is not None:
+                    _graph = ContextGraph.from_cir(_cached_cir)
+            except Exception:
+                _graph = None
+            if _graph is None:
+                _graph = ContextGraph.build(all_paths, self.root)
+            _impact_engine = SemanticImpactEngine(_graph)
             _execution_paths = _impact_engine.execution_paths(_changed_sorted)
             _behavioral_impact = _impact_engine.behavioral_impact(_changed_sorted)
 

sourcecode/repository_ir.py

@@ -134,7 +134,13 @@ _ANN_WITH_ARGS_RE = re.compile(
 _CLASS_DECL_RE = re.compile(
     r'(?:^|(?<=\s))'
     r'(?P<kind>class|interface|enum|record|@interface)\s+'
-    r'(?P<name>[A-Z]\w*)'
+    # P1-H: Java identifiers may start lowercase — the uppercase-only start
+    # (PascalCase convention) silently dropped valid lowercase-initial types
+    # (Broadleaf `iFieldMetadata`, `i18nUpdateCartServiceExtensionHandler`).
+    # A literal type keyword + terminal `{` already gates the match, so widening
+    # the name-start does not admit prose/string phantoms the uppercase form
+    # was not already exposed to (verified fleet A/B, no new symbols on controls).
+    r'(?P<name>[A-Za-z]\w*)'
     r'(?:\s*<[^{;]*?(?=>|\{))?'
     # P1-F: record component list `record Point(int x, int y)`. `[^{;]*` is greedy
     # to the LAST ')' before the body brace, so annotated components with
@@ -663,7 +669,22 @@ _ANN_NAME_RE = re.compile(r'^@\w+\s*')
 _STRING_LITERAL_RE = re.compile(r'"(?:[^"\\]|\\.)*"|\'(?:[^\'\\]|\\.)*\'')
 
 # Module-level cache for class-keyword detection (avoids recompilation per _extract_symbols call)
-_CLASS_KW_RE = re.compile(r'\b(?:class|interface|enum|record)\s+[A-Z]')
+# P1-H: lowercase-initial start mirrors _CLASS_DECL_RE so multi-line lowercase-named
+# declarations (`class i18nHandler extends A\n implements B {`) are joined too.
+_CLASS_KW_RE = re.compile(r'\b(?:class|interface|enum|record)\s+[A-Za-z]')
+
+
+def _blank_string_literals(text: str) -> str:
+    """Return `text` with each string/char literal replaced by equal-length spaces.
+
+    P1-H: type-declaration scans (_CLASS_DECL_RE / _CLASS_KW_RE) run on lines whose
+    comments are stripped but whose STRING content survives. A log/message literal
+    such as `log.debug("... advice class for {} ...")` then matches `class for {`
+    and mints a phantom type `for`. Blanking the literal content (length-preserving,
+    so match offsets stay aligned with the original line) removes the false surface
+    without touching genuine declarations, which never live inside a string.
+    """
+    return _STRING_LITERAL_RE.sub(lambda m: ' ' * len(m.group(0)), text)
 
 
 # ---------------------------------------------------------------------------
@@ -958,7 +979,8 @@ def _extract_symbols(
         _start = _i  # 0-based source index where this joined entry begins
         _line = _raw_lines[_i]
         _stripped = _line.strip()
-        if (_CLASS_KW_RE.search(_stripped) and '{' not in _stripped
+        _kw_scan = _blank_string_literals(_stripped)
+        if (_CLASS_KW_RE.search(_kw_scan) and '{' not in _kw_scan
                 and not _stripped.startswith('//')
                 and not _stripped.startswith('*')):
             # Continuation: join until we hit a line containing '{'
@@ -1043,7 +1065,10 @@ def _extract_symbols(
             _pop_closed(class_stack, depth)
             continue
 
-        cls_m = _CLASS_DECL_RE.search(stripped)
+        # P1-H: search a string-blanked view so `class`/`interface` keywords that
+        # appear inside string literals (log messages, templates) do not mint a
+        # phantom type. Length-preserving, so cls_m offsets align with `stripped`.
+        cls_m = _CLASS_DECL_RE.search(_blank_string_literals(stripped))
         if cls_m:
             kind_kw = cls_m.group("kind")
             name = cls_m.group("name")
@@ -2311,7 +2336,9 @@ def _extract_field_types(
             package = stripped[8:].rstrip(";").strip()
             continue
         net = _count_net_braces(stripped)
-        cls_m = _CLASS_DECL_RE.search(stripped)
+        # P1-H: string-blanked search (see _blank_string_literals) — a keyword inside
+        # a literal must not push a phantom nesting frame onto class_stack.
+        cls_m = _CLASS_DECL_RE.search(_blank_string_literals(stripped))
         if cls_m:
             name = cls_m.group("name")
             fqn = f"{class_stack[-1][0]}.{name}" if class_stack else (

sourcecode/security_posture.py

@@ -452,6 +452,10 @@ def gate_bearing_handlers(
     }
 
 
+# Cap on the explicitly-listed escape set (rollup counts are always exact).
+_GATE_COVERAGE_LIST_CAP = 200
+
+
 @dataclass
 class SecurityPostureResult:
     """Repo-level security-posture projection (P1-A)."""
@@ -462,6 +466,11 @@ class SecurityPostureResult:
     endpoint_verdicts: list[dict] = field(default_factory=list)
     rollup: dict = field(default_factory=dict)
     limitations: list[str] = field(default_factory=list)
+    # Gate-coverage projection (P1-A follow-up): when a custom gate IS the detected
+    # mechanism, which controller handlers do NOT carry it and are not standard-guarded
+    # — the residue that relies solely on a centralized filter, if one exists. None when
+    # no custom gate was detected (the question does not apply). Never "unsecured".
+    gate_coverage: Optional[dict] = None
 
     def gate_simple_names(self) -> set[str]:
         out: set[str] = set()
@@ -481,6 +490,7 @@ class SecurityPostureResult:
             ),
             "endpoints": self.endpoint_verdicts,
             "rollup": self.rollup,
+            **({"gate_coverage": self.gate_coverage} if self.gate_coverage else {}),
             "limitations": list(self.limitations),
         }
 
@@ -490,6 +500,7 @@ def infer_security_posture(
     *,
     root: Optional[Path] = None,
     coverage_threshold: float = _DEFAULT_COVERAGE,
+    filter_surface: Optional[Any] = None,
 ) -> SecurityPostureResult:
     """Infer the repo's endpoint security posture (P1-A).
 
@@ -499,6 +510,12 @@ def infer_security_posture(
       3. upgrade any that a config file confirms (Likely → Verified);
       4. classify every endpoint into the 4-way posture with its confidence.
 
+    ``filter_surface`` (a :class:`filter_surface.FilterSurface`) is an optional
+    reconstruction of declarative servlet filter URL patterns; when absent it is built
+    from ``root`` (best-effort). It is used only to *sharpen* the gate-coverage escape
+    set — marking a gate-less handler whose path a filter pattern covers — never to
+    assert protection. Parsing lives in the extractor module, not here.
+
     Never raises; never emits a categorical "unsecured" verdict.
     """
     security_model = str(cir.metadata.get("security_model", "unknown"))
@@ -535,6 +552,9 @@ def infer_security_posture(
     verdicts: list[dict] = []
     rollup = {"protected_standard": 0, "protected_custom": 0,
               "coverage_unknown": 0, "probably_exposed": 0}
+    # escape set: handlers that do NOT carry the detected custom gate and have no
+    # standard guard of their own — the residue that relies solely on a filter.
+    escaping: list[dict] = []
 
     for ep in cir.endpoints:
         policy = ep.security.policy if ep.security is not None else "none_detected"
@@ -585,6 +605,22 @@ def infer_security_posture(
             "policy": policy,
         })
 
+        # escape set (only meaningful when a custom gate is the mechanism): a handler
+        # that neither carries the gate nor a standard guard nor a config-custom policy.
+        if (
+            has_custom_gate
+            and not carries_gate
+            and policy != "custom"
+            and not _is_standard_guard_policy(policy)
+        ):
+            escaping.append({
+                "endpoint_id": ep.id,
+                "method": ep.method,
+                "path": ep.path,
+                "handler_symbol": ep.handler_symbol,
+                "policy": policy,
+            })
+
     limitations = [
         "Posture is inferred from static structure; a runtime security config "
         "(WebSecurity DSL, XML) may protect routes this projection marks unknown.",
@@ -595,6 +631,65 @@ def infer_security_posture(
             "it are reported 'coverage_unknown', never 'unsecured'."
         )
 
+    # Gate-coverage projection: the escape set relative to the detected custom gate.
+    # Turns a "N endpoints none_detected" non-signal into a reviewable list of the
+    # handlers that do NOT carry the gate the rest of the surface uses. Honest framing:
+    # a centralized filter (if present) MAY still cover them — its per-URL patterns are
+    # not reconstructed in this increment, so the verdict is review, never "unsecured".
+    gate_coverage: Optional[dict] = None
+    if has_custom_gate:
+        # Reconstruct declarative servlet filter patterns (extractor; best-effort) and
+        # cross each escaping handler against them. A match => the handler MAY be filter-
+        # covered (still review — pattern presence is not proof of enforcement); no match
+        # => no declarative servlet pattern covers it (the sharper escape signal).
+        if filter_surface is None and root is not None:
+            try:
+                from sourcecode.filter_surface import build_filter_surface
+                filter_surface = build_filter_surface(root)
+            except Exception:
+                filter_surface = None
+
+        possibly_covered = 0
+        no_pattern = 0
+        for h in escaping:
+            match = filter_surface.matching_pattern(h.get("path")) if filter_surface else None
+            if match:
+                h["filter_pattern_match"] = match
+                possibly_covered += 1
+            else:
+                no_pattern += 1
+
+        total_handlers = len(cir.endpoints)
+        not_covered = len(escaping)
+        _patterns = (
+            filter_surface.patterns if filter_surface and not filter_surface.is_empty() else []
+        )
+        gate_coverage = {
+            "gate_annotations": sorted(gate_names),
+            "total_controller_handlers": total_handlers,
+            "gate_bearing": len(gate_bearers),
+            "not_carrying_gate": not_covered,
+            "interception_present": interception is not None,
+            "reconstructed_filter_patterns": sorted(_patterns),
+            "possibly_filter_covered": possibly_covered,
+            "no_matching_filter_pattern": no_pattern,
+            "confidence": (
+                Confidence.REQUIRES_MANUAL_REVIEW.value if not_covered else Confidence.VERIFIED.value
+            ),
+            "handlers_without_gate": sorted(
+                escaping, key=lambda d: (d["path"] or "", d["method"] or "")
+            )[:_GATE_COVERAGE_LIST_CAP],
+            "note": (
+                "Handlers that do not carry the detected custom gate and have no standard "
+                "guard. 'filter_pattern_match' marks those a declarative servlet filter "
+                "(@WebFilter / web.xml) pattern covers — still review, pattern presence is "
+                "not proof of enforcement. Spring FilterRegistrationBean / HttpSecurity DSL "
+                "/ AspectJ pointcuts are NOT reconstructed, so a missing match is not proof "
+                "of exposure."
+            ),
+            "truncated": not_covered > _GATE_COVERAGE_LIST_CAP,
+        }
+
     result = SecurityPostureResult(
         security_model=security_model,
         custom_gates=custom_gates,
@@ -602,6 +697,7 @@ def infer_security_posture(
         endpoint_verdicts=verdicts,
         rollup=rollup,
         limitations=limitations,
+        gate_coverage=gate_coverage,
     )
     # keep reference to suppress-set so callers (SEC-001) can dedupe false alarms
     result._gate_bearing_handlers = gate_bearers  # type: ignore[attr-defined]

sourcecode/spring_impact.py

@@ -119,7 +119,7 @@ class ImpactChainResult:
     """
     schema_version: str = _SCHEMA_VERSION
     symbol: str = ""                           # resolved FQN (or original input if not_found)
-    resolution: str = "not_found"              # "exact" | "class_expanded" | "partial" | "not_found"
+    resolution: str = "not_found"              # exact | class_expanded | method_resolved | partial | not_found
     direct_callers: list[str] = field(default_factory=list)
     indirect_callers: list[str] = field(default_factory=list)
     # BUG #2: count of own-class members dropped from callers (members, not callers).
@@ -378,12 +378,15 @@ def _resolve_symbol(
       4. Not found.
 
     Resolution values:
-      "exact"          — full FQN provided and matched exactly.
-      "class_expanded" — short class name matched one class by suffix; all its
-                         symbols included. Confidence stays high.
-      "partial"        — ambiguous (multiple classes matched) or method not found
-                         on matched class. Confidence degrades to medium.
-      "not_found"      — no match.
+      "exact"           — full FQN provided and matched exactly.
+      "class_expanded"  — short class name (no method) matched one class by suffix;
+                          all its symbols included. Confidence stays high.
+      "method_resolved" — short class name + method matched one method node by
+                          suffix; scope is method-precise (SIM-4: not an expansion).
+                          Confidence stays high.
+      "partial"         — ambiguous (multiple classes matched) or method not found
+                          on matched class. Confidence degrades to medium.
+      "not_found"       — no match.
 
     Returns (resolution, matched_fqns, warnings).
     Returned list is always deduplicated (preserving order).
@@ -437,7 +440,12 @@ def _resolve_symbol(
                 if f"{class_input}#{method_input}" in cir_symbols:
                     resolution = "exact"
                 elif len(method_matched_classes) == 1:
-                    resolution = "class_expanded"
+                    # SIM-4: the caller named a method and it resolved to exactly one
+                    # method node — the scope is method-precise, nothing was widened.
+                    # "class_expanded" wrongly signalled "I broadened your query to the
+                    # whole class" over a correct, narrow answer. Distinguish it from
+                    # the genuine class-expansion case (no method given, line above).
+                    resolution = "method_resolved"
                 else:
                     resolution = "partial"
                 return resolution, method_matched, []

{sourcecode-2.6.0.dist-info → sourcecode-2.6.2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 2.6.0
+Version: 2.6.2
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-2.6.0.dist-info → sourcecode-2.6.2.dist-info}/RECORD

@@ -1,6 +1,6 @@
-sourcecode/__init__.py,sha256=s8y5X8alEKKmNOYZLr8jO6piwAcBclhVBLSr-OgnCW8,308
+sourcecode/__init__.py,sha256=Xl4vKr6-4l-yWpoN7FzgqDyXd54m2LAMPUtDWX2CdD0,308
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
-sourcecode/archetype.py,sha256=d7yoN6Tj4OBj-VgSMPEKg4WF9H8FypnZ5A6AkUh5oIE,34484
+sourcecode/archetype.py,sha256=UrmiONHfqLl7UfGzjECoQBO28hcM_1rvzn0hCt0EtjU,35033
 sourcecode/architectural_baseline.py,sha256=7QzJri4pbL3nzAn9gNutZW6mZR8HHD6H2C2H1EEwYPE,17904
 sourcecode/architectural_delta.py,sha256=E6MkyjWl-1ZgR4KSKnI785gUAfc8nq-lK-jd_rupQBU,12496
 sourcecode/architecture_analyzer.py,sha256=GFc4ek-s1IHWM7pl-0L32WahZ93AmDgrAMcOuBKA5Dk,61463
@@ -13,12 +13,12 @@ sourcecode/canonical_ir.py,sha256=LdP_Ri3rl0M5p-MY0ypVvQwhq1WuUF1FmaHid7zyzEg,29
 sourcecode/change_plan.py,sha256=MNgNyu4zrLGvBBaXPwyCh-T2ZGaUQX3Hm4W87uuhZ3w,7750
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=9Uq_eC6eD01arQE3FLFUmTiZKPxmdbMx3_k3V74r-SI,349315
+sourcecode/cli.py,sha256=kivJiIF7Rw-Eal-3_m2CG5E9i66UUuOLLyquLgUM0N0,359485
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=jdePg0dNCxFpysiTGMsROL5XABLjy_zVUgVeySvdb0o,7514
 sourcecode/confidence_analyzer.py,sha256=vnbPI-20FnHdjO6STxHW8fbaxmB4A7y58io63ibFZjc,21586
 sourcecode/constraint_diff.py,sha256=hWIO5vsxvHjsgQx23K3r_JMy1W6wQ2Ca4DqB9R_iMnY,5831
-sourcecode/context_cache.py,sha256=maws79rLKDwyZ7c9Q2LwlIxqZHRFlaKzErtO3mglWoA,25036
+sourcecode/context_cache.py,sha256=bQiKlZKA-3xpvp1eWG6vOPADTl2YkYVIO434zGyl02c,26648
 sourcecode/context_graph.py,sha256=i2kOX3XiaCqcR20ojbUnqoX-hJbMyLNYc7rl-n15bwE,46426
 sourcecode/context_scorer.py,sha256=QpChSpsmaAYz91rXA4Ue5xzQmNz_ZboZN09YOHScq1U,14679
 sourcecode/context_summarizer.py,sha256=cI2TZMvEhl0BEma12VtPaX6z03ZVBAetVzuK5GaCOvg,6852
@@ -38,6 +38,7 @@ sourcecode/evidence_provider.py,sha256=GSSL44JEaouO5AHks2sB3d1YvC9xIKIld1yBYxZpX
 sourcecode/explain.py,sha256=HnHWVTNNf9fzeR3FP-A-eXKeKZvBcUEuODgIO3rJQkQ,22312
 sourcecode/file_chunker.py,sha256=3vkM3mDQ5eE_yTPvUgjyjpGFBIjkW6_mrBmIbrylnA8,16444
 sourcecode/file_classifier.py,sha256=A0fEABqtfVu1MfoaxnPAvGpZgneGgVXlJDhT74NYXxE,15314
+sourcecode/filter_surface.py,sha256=qunis3-yY_nhOIj5K3mVFtbSyKfc6ugIX23OSxTolwE,7079
 sourcecode/format_contract.py,sha256=U83J_LtrpMQSN3_H_HBBxpanlo7xnfvbZw7sP3ew8_M,3678
 sourcecode/fqn_utils.py,sha256=XLU7zDkNBXz_RZkIUNfpPmp1nekWtqP-fxV92tDV1vg,2158
 sourcecode/git_analyzer.py,sha256=JStxTQXNjBWi_wLdwhsZs9mT-v50cSJIz4Agzn6Kh9I,13362
@@ -48,14 +49,14 @@ sourcecode/jdk_exports.py,sha256=fCrlwNAXUT9gge_joq6kMnY3zJxYB2pxqy-0w3o3MJI,874
 sourcecode/license.py,sha256=keFuwNxdAtvK2Ds91Wl79GMYxuxWYnN5Wbw1qBpaoUI,24896
 sourcecode/mcp_nudge.py,sha256=yjwclsBVsDg1BtocGdEi6GYV4vzPo-SBlC9pIcNmlDM,2910
 sourcecode/metrics_analyzer.py,sha256=m0ENgtqKeBL17kUIK3fmGkgo7UfXBNHxCMj0H_Y5K7c,22750
-sourcecode/migrate_check.py,sha256=HJhvHuvXDGTJSRQU9_AMx0L94h2TImC1DCGs3m3RTu0,108199
+sourcecode/migrate_check.py,sha256=hsKNwipl-bSqRsYqG1O_CLbXpMlqtnN-Bif3hpHpnjg,108676
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
 sourcecode/output_budget.py,sha256=Js9yUlfQtPhqBl9R6wn_9UHVjjJc3GtLcqyfjf5t50Q,9869
 sourcecode/path_filters.py,sha256=qPKO7kRmVp2y9zjLNSuAVCbcpZrIInHE4QulLUlzPFI,10412
 sourcecode/perf.py,sha256=GAcEoouPIlPMCQIcHNToxK6K3WdIR-lj9aFg4prOYJI,9743
 sourcecode/pr_comment_renderer.py,sha256=KmcjMruhR44gjzMDJwjBSkWP9QEvh8xWBLyxzxoRbj0,14542
 sourcecode/pr_impact.py,sha256=dCDVw83EDbyVf6F9ZmEQmsFz8ruVH7d4mpeKQCIZHM0,16805
-sourcecode/prepare_context.py,sha256=-Xu33qCETuqw-OFfT3ukvAtxde7krCjQpn7wR3pbdOg,224290
+sourcecode/prepare_context.py,sha256=GkdI_a0RG8Y8dh8x6SpCNKZwWi7qs8sqAbFSYJegBxY,225473
 sourcecode/progress.py,sha256=qn30sWaHOkjTgXsSBmiPkz7Rsbwc5oSlIe6JNEMYp_k,3149
 sourcecode/ranking_engine.py,sha256=ZAucq_YX2KkWUuAZf4P0lhtQ_38vEFnUhuGtSZd1S0E,12970
 sourcecode/reconciliation.py,sha256=GU-1PTcVr8zcbtC7BASfpHcZndP9AdboXPNQiBc0fzo,34251
@@ -63,13 +64,13 @@ sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg,12965
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=WLOdF5iaxjj3EwQWQHl_DVweL-JL8fEJpgQkQy4O90A,319009
+sourcecode/repository_ir.py,sha256=9ZGRWy8g4_PH_XvdCm6i1UOHYX-qO3sxxodXytf3m0Q,320870
 sourcecode/ris.py,sha256=Hw8TakTQ6hku-Abf2k8954NwkrH_sP73_8wVH8x5khc,22079
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=z3CV0rcGunu0Y8mpNgp07wI7nxT0pxw1BkXRRtI0Rpo,9609
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
 sourcecode/security_config.py,sha256=KblMEoRiEjrIE68YsPaUAFebxFp8UM7MS7lAk5CGD8U,3531
-sourcecode/security_posture.py,sha256=CAJw4oJD0aAW2yRewvd_fonkzi9_HpUjBZlIDZle00s,26034
+sourcecode/security_posture.py,sha256=NNmYanFQZQ_hIIeTGQnvTAETMT6hxO5I56Bez0ABbBg,30945
 sourcecode/semantic_analyzer.py,sha256=bpgdC6m0_ftVtRf3rSdwhbhWjnZnGxRXaZVcfe4BbcQ,95414
 sourcecode/semantic_impact_engine.py,sha256=t09IirGC3JjQDy33JZd1_WKzQVKXkoNl3-XEUr5kjis,20563
 sourcecode/semantic_integration_engine.py,sha256=rxoCuP-uM_Y4-ELeBN0sz1a88e2eI1XTJDgsS57IOLI,15513
@@ -77,7 +78,7 @@ sourcecode/semantic_services.py,sha256=nbUuPv-F01USTt_9CHT8iy_ucCIw3fz4W3Aquea_p
 sourcecode/serializer.py,sha256=zmN3pOcfxaQdxCE-jKoKudFjof9Sc_q7jpcBzNIA0EY,129493
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=EX7kLZLN74CFyR9iZPm3CI115BfFKNd4WRPuErNljZM,5729
-sourcecode/spring_impact.py,sha256=MkUI27OCOhkjvBoA4f9X1eDBIY0SmyPuLVCWIfZgOcE,72430
+sourcecode/spring_impact.py,sha256=ATOa7jOg7kL78vW0uZiGBvtB-ph9bCiEGH0kRtABHxg,73108
 sourcecode/spring_model.py,sha256=zOAgFmrRbG4a6KLm1TJl55aWMyPNsz3OS3FSczqPG6A,16594
 sourcecode/spring_security_audit.py,sha256=Rk-aSohezdc7YDYbSoJquVnwpkDB8ty1BCD-4Hc4R5A,22832
 sourcecode/spring_semantic.py,sha256=jteQ1PkY9ArFJv0embg_jBIdbOxqrk9mQ2Xz8OF_FKA,14214
@@ -144,8 +145,8 @@ sourcecode/telemetry/consent.py,sha256=LIAO9ohJZF8OuZwM4u1VWtALlYfTCCKq4wV3Vwc7i
 sourcecode/telemetry/events.py,sha256=LtzYfaX9Ilckj5PTvAcTpDa9mLqDsYPDUiDkRa58piY,2580
 sourcecode/telemetry/filters.py,sha256=NHa5T-6DaZduQPFuC34jOqHWQgSizM-Ygq8aZ4j19ng,5834
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-2.6.0.dist-info/METADATA,sha256=feEoNfPCAvBT9uJ-dVf63qVTJTGr8BfYtFOKKgO8KBE,10851
-sourcecode-2.6.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-2.6.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-2.6.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-2.6.0.dist-info/RECORD,,
+sourcecode-2.6.2.dist-info/METADATA,sha256=7dMltG6Rgrg_RmRX5tEh13LJZIYv1ouwALVAcjHHY2I,10851
+sourcecode-2.6.2.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-2.6.2.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-2.6.2.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-2.6.2.dist-info/RECORD,,