sourcecode 2.6.10__tar.gz → 2.7.0__tar.gz

{sourcecode-2.6.10 → sourcecode-2.7.0}/CHANGELOG.md

@@ -1,5 +1,97 @@
 # Changelog
 
+## [2.7.0] — 2026-07-26
+
+**The analyzer reads facts it had been walking past, and stops spending the context budget
+it exists to save.** Driven by an external audit of 2.6.10 and validated by a field battery
+across eleven real repositories plus an A/B against the previous release.
+
+### Added
+
+- **Deployment prefix.** Neither `server.servlet.context-path` nor `spring.mvc.servlet.path`
+  was read anywhere, so an app deployed under `/app-server/api` was inventoried as `/v1/x` —
+  every URL wrong by the same constant, which is what makes the error invisible. Endpoints
+  now carry `effective_path` alongside the mapping-relative `path`, plus a
+  `deployment_prefix` block with per-source provenance. A value carrying a placeholder, or
+  declared only under a profile, is recorded but never imposed on every route.
+- **Two unread profile signals.** Profile names came from one signal — the
+  `application-{profile}.yml` filename convention. Multi-document activation
+  (`spring.config.activate.on-profile`) and `@Profile` on beans are read now, and
+  `profile_conditional_beans` says WHICH beans each profile switches — routinely the
+  security filter chain.
+- **A repo's own authorization gate on the endpoint surface.** Custom-gate detection fed
+  only the `spring-audit` posture block; every other surface reported `policy: none_detected`
+  for each endpoint of a repo whose authorization runs entirely through its own annotation.
+  Such endpoints now carry `policy: custom_gate_inferred` with the annotation as evidence,
+  and the model becomes `custom_annotation_based`. Coverage and specificity alone were
+  measured to be insufficient for a per-endpoint claim — they select caching and
+  documentation annotations — so the claim additionally requires an in-repo `@interface`
+  declaration. Structural, no name matching.
+- **`explain --limit`** (default 50), capping the list sections with the truncation and the
+  exact total stated in `warnings`. `--limit 0` restores the full lists.
+
+### Fixed
+
+- **Cross-file `String` constants were not folded.** `@RequestMapping(Routes.BASE)` resolved
+  to nothing and "nothing" was emitted as the empty path, collapsing every handler of a
+  controller onto `GET /`. A repo-wide constant table is built from the pass the assembler
+  already runs; a name declared twice with different values is dropped, not guessed; what
+  still cannot be resolved is published as `path_resolution: "unresolved"` with the
+  expression, instead of a fabricated `/`. On keycloak this recovers three real endpoints
+  (`AuthZen.EVALUATION_PATH`, `AdapterConstants.K_LOGOUT`) with no route newly unresolved.
+- **Types whose name sits on the line after the keyword** (`public class\n  Name {`) were
+  not extracted.
+- **Hibernate rewrite snippets quoted literal-blanked source**, emitting
+  `em.createNamedQuery("")` — dropping the query name, the one datum that makes the target
+  actionable.
+- **Confidence described the lookup, not the answer.** `retrieve endpoint-security` graded
+  "high" whenever the reference resolved, so an endpoint with no policy and no finding came
+  back maximally confident about nothing. It is high only when evidence attaches, and an
+  explicit `evidence_absent` observation says which case it is.
+- **Archetype counted signal diversity by cardinality**, which one dominant signal satisfies
+  trivially. "High" now also requires the top signal to supply at most 80% of the label's
+  score.
+- **Cycle counts read as one command contradicting another** (`modernize` 15 tangles vs
+  `subsystem-coupling` 0 import cycles). Both are right and measure different graphs; a
+  shared reconciliation note now travels with both numbers.
+- **`auth status` reported `pro: false`** while every Pro command ran under the
+  early-adoption unlock. It now reports the gating in force (`pro_gating`, `pro_effective`,
+  `pro_reason`).
+- **`transaction-entrypoints` counted only `@Transactional` declared ON a controller**, so a
+  repo with 129 boundaries reported 1 entrypoint. Boundaries reachable from a controller
+  within 3 call hops are reported alongside, each labelled with its `entrypoint_basis`.
+  Rows that a signature-free FQN made indistinguishable (overloads) collapse with the count
+  kept as `occurrences`; rows that differ in any attribute stay separate.
+- **`integration-inventory` said nothing four times**: identity keyed on
+  (kind, target-or-client) produced byte-identical rows. Rows collapse with `occurrences`,
+  and a null target carries the reason it is null. On Broadleaf: 9 rows → 4.
+- **`cache warm <subdir>` warmed the whole monorepo**, populating a cache for a different
+  target than `ask <subdir>` reads. It warms exactly the path given and says so when that
+  differs from the git root.
+- **`migrate-check --compact` shipped an empty `headline_blocker`**, forcing the reader back
+  into the full report. It names the weakest applicable axis, or says "none" /
+  "none_applicable". The guard against asserting a framework blocker without version
+  evidence is preserved.
+- **`impact-chain` enumerations were unbounded.** Lists are capped; every total stays exact
+  in `metadata` and `truncated_lists`.
+- **The profile signal was gated on the env-var scan**: a repo that declares profiles but
+  reads no environment variable published nothing about them — the exact shape the profile
+  signals were added for.
+
+### Changed
+
+- **`export --c4` omits the code level (C4 level 4) by default.** It enumerates every symbol
+  per directory and dominated the export: keycloak 18.6 MB → 2.5 MB, Broadleaf 9.7 MB →
+  1.1 MB. The omission is explicit in the payload (`included: false` with the reason and the
+  directory count) and `--c4-code` restores it.
+
+### Notes
+
+- Validated before release: full suite (3,869 passed), eleven repositories × eight commands
+  with no crash and valid JSON throughout, output identical across `PYTHONHASHSEED` values
+  on cold caches, and an A/B against 2.6.10 in which every difference maps to a change listed
+  above.
+
 ## [2.6.10] — 2026-07-25
 
 **Identical runs now produce identical output.** Found by a field battery across twelve

{sourcecode-2.6.10 → sourcecode-2.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 2.6.10
+Version: 2.7.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-2.6.10 → sourcecode-2.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "2.6.10"
+version = "2.7.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-2.6.10 → sourcecode-2.7.0}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "2.6.10"
+__version__ = "2.7.0"

{sourcecode-2.6.10 → sourcecode-2.7.0}/src/sourcecode/archetype.py

@@ -604,12 +604,23 @@ class ArchetypeClassifier:
             # Gini alone labeling a REST API an "engine") — is a single point of view and
             # must not read as high confidence (field-eval Fase 0).
             distinct_signals = len({e.signal for e in top.evidence if e.contribution > 0})
+            # Diversity by COUNT is satisfiable while one signal carries the
+            # verdict: an audited repo was labelled "engine" at high confidence on
+            # 1.500 of a 1.504 score — a fan-in Gini alone, with the second signal
+            # contributing 0.3%. Counting it as two views is a fiction, so a label
+            # whose top signal supplies almost all of its score cannot be "high"
+            # however many other signals nominally touch it.
+            _contributions = sorted(
+                (e.contribution for e in top.evidence if e.contribution > 0), reverse=True
+            )
+            top_signal_share = (_contributions[0] / top.score) if _contributions else 1.0
             if (
                 confident_enough
                 and rel_margin >= 0.4
                 and mass_backed
                 and graph_backed
                 and distinct_signals >= 2
+                and top_signal_share <= 0.8
             ):
                 confidence = "high"
             elif confident_enough and rel_margin >= 0.25 and mass_backed:

{sourcecode-2.6.10 → sourcecode-2.7.0}/src/sourcecode/caller_metrics.py

@@ -40,3 +40,22 @@ CALLER_METRIC_RECONCILIATION: str = (
     "references or DI-interface resolution). The top-level impact.direct_callers array "
     "may be truncated for output size — use stats.direct_caller_count for the true total."
 )
+
+
+# Cycle / tangle metrics come from TWO different graphs. Both are correct; they
+# answer different questions, and without saying so the pair reads as one command
+# contradicting another (external audit 2026-07-25: modernize reported 15 cyclic
+# tangles while retrieve subsystem-coupling reported import_cycles: 0).
+CYCLE_METRIC_RECONCILIATION: str = (
+    "Cycle metrics differ across commands BY DESIGN. modernize.cross_module_tangles "
+    "is computed over the SYMBOL dependency graph, aggregated to subsystem packages: "
+    "coupling_type=cyclic means two subsystems reference each other (a 2-cycle "
+    "between package groups). The module-graph metrics (import_cycles, cyclic_density, "
+    "scc_mass — used by archetype and the subsystem-coupling retrieval intent) are "
+    "computed over the MODULE/DIRECTORY graph, are bounded for cost (node/edge caps), "
+    "and count strongly-connected components among modules. A repo can therefore "
+    "show mutual package-level coupling (tangles > 0) with no module-level SCC "
+    "(import_cycles = 0): the coupling exists between package groups inside the same "
+    "module. Neither number invalidates the other — read tangles for decomposition "
+    "risk and import_cycles for module-graph topology."
+)

{sourcecode-2.6.10 → sourcecode-2.7.0}/src/sourcecode/cli.py

@@ -17,7 +17,10 @@ from sourcecode.error_schema import INVALID_INPUT_CODE, build_error_envelope
 from sourcecode.entrypoint_classifier import is_production_entry_point, normalize_entry_point
 from sourcecode.progress import Progress
 from sourcecode import perf
-from sourcecode.caller_metrics import CALLER_METRIC_RECONCILIATION
+from sourcecode.caller_metrics import (
+    CALLER_METRIC_RECONCILIATION,
+    CYCLE_METRIC_RECONCILIATION,
+)
 from sourcecode.repository_ir import extract_java_endpoints as _extract_java_endpoints
 
 
@@ -4472,6 +4475,7 @@ def _build_c4_export(
     endpoints: "list[dict]",
     integrations: "dict",
     endpoint_meta: "Optional[dict]" = None,
+    include_code_level: bool = False,
 ) -> "dict":
     """Assemble a unified, tool-agnostic C4 architecture export + incremental manifest.
 
@@ -4514,7 +4518,18 @@ def _build_c4_export(
             },
             "containers": containers,
             "components": module_graph,
-            "code": by_directory,
+            # C4 level 4 (code) is a per-directory enumeration of every symbol —
+            # 18 MB on a large repo, and by C4's own guidance a level you generate
+            # for a specific area rather than wholesale. Opt in with --c4-code.
+            "code": by_directory if include_code_level else {
+                "included": False,
+                "reason": (
+                    "C4 level 4 (code) omitted by default: it enumerates every "
+                    "symbol per directory and dominates the export size. Pass "
+                    "--c4-code to include it."
+                ),
+                "directory_count": len(by_directory),
+            },
         },
         "api_surface": api_surface,
         "manifest": {
@@ -4561,9 +4576,14 @@ def export_cmd(
     ),
     c4: bool = typer.Option(
         False, "--c4",
-        help="Unified C4 architecture export (context/containers/components/code) "
+        help="Unified C4 architecture export (context/containers/components) "
              "+ per-directory incremental manifest. Vendor-neutral.",
     ),
+    c4_code: bool = typer.Option(
+        False, "--c4-code",
+        help="Include C4 level 4 (code): every symbol per directory. Omitted by "
+             "default because it dominates the export size (18 MB on a large repo).",
+    ),
 ) -> None:
     """Export structured, tool-agnostic codebase views for downstream tooling.
 
@@ -4641,6 +4661,7 @@ def export_cmd(
             endpoints,
             _integrations,
             endpoint_meta=_ep_data,
+            include_code_level=c4_code,
         )
         _prog.finish()
         output = _serialize_dict(data, format)
@@ -4767,7 +4788,7 @@ def validation_cmd(
     try:
         from sourcecode.validation_inference import infer_validation_pattern
 
-        _vres = infer_validation_pattern(_graph.cir)
+        _vres = infer_validation_pattern(_graph.cir, target)
         data["validation_pattern"] = _vres.to_dict()
         # Proposal 1 (Explainability): a compact confidence block projecting the
         # verdict's own confidence tier + rollup + declared precision limits, plus
@@ -5702,24 +5723,7 @@ def spring_audit_cmd(
     if scope in ("all", "security"):
         results.append(run_security_audit(cir, root=target, min_severity=min_severity, model=_model))
 
-    if len(results) == 1:
-        combined = results[0]
-    else:
-        all_findings: list[SpringFinding] = []
-        all_limitations: list[str] = []
-        merged_meta: dict = {}
-        for r in results:
-            all_findings.extend(r.findings)
-            all_limitations.extend(r.limitations)
-            merged_meta.update(r.metadata)
-        combined = SpringAuditResult(
-            repo_id=results[0].repo_id,
-            spring_detected=any(r.spring_detected for r in results),
-            scope="all",
-            findings=all_findings,
-            limitations=all_limitations,
-            metadata=merged_meta,
-        ).finalize()
+    combined = SpringAuditResult.merge(results, scope=scope)
 
     if _file_limitations:
         combined.limitations.extend(_file_limitations)
@@ -6034,6 +6038,40 @@ def migrate_check_cmd(
 # ── Spring Impact Chain ───────────────────────────────────────────────────────
 
 
+_IMPACT_CAPPED_LISTS = (
+    "direct_callers", "indirect_callers", "endpoints_affected",
+    "security_surfaces", "transactional_boundaries", "impact_findings",
+)
+
+
+def _cap_impact_lists(data: dict, limit: int) -> dict:
+    """Cap impact-chain leaf arrays, keeping every total exact.
+
+    One hub class produced 324 KB of JSON (511 callers, 262 endpoints, 262
+    security surfaces) from a tool sold on context economy. The COUNTS are the
+    decision signal and stay exact — in `metadata` (callers_total,
+    endpoints_total) and in `truncated_lists` per capped list — while the
+    enumerations, which are what blows the budget, are capped.
+    """
+    if limit <= 0:
+        return data
+    truncated: dict[str, dict] = {}
+    for key in _IMPACT_CAPPED_LISTS:
+        values = data.get(key)
+        if isinstance(values, list) and len(values) > limit:
+            truncated[key] = {"total": len(values), "shown": limit,
+                              "omitted": len(values) - limit}
+            data[key] = values[:limit]
+    if truncated:
+        data["truncated_lists"] = truncated
+        data.setdefault("analysis_warnings", []).append(
+            f"Output capped to {limit} items per list; every total stays exact "
+            "(truncated_lists per list, metadata.callers_total / "
+            "metadata.endpoints_total). Use --limit 0 for the full enumeration."
+        )
+    return data
+
+
 @app.command("impact-chain")
 def impact_chain_cmd(
     symbol: str = typer.Argument(
@@ -6076,6 +6114,12 @@ def impact_chain_cmd(
         False, "--no-cache",
         help="Accepted for compatibility; this command always reads fresh source (no snapshot cache). No-op.",
     ),
+    limit: int = typer.Option(
+        100, "--limit",
+        help="Maximum items per list section (callers, endpoints, security "
+             "surfaces). Totals stay exact in metadata/truncated_lists. "
+             "0 disables the cap.",
+    ),
 ) -> None:
     """Spring impact-chain: systemic blast radius of a symbol with TX/SEC enrichment.
 
@@ -6198,6 +6242,7 @@ def impact_chain_cmd(
     result = run_impact_chain(cir, symbol, depth=depth, root=target, model=_model)
 
     data = result.to_dict()
+    data = _cap_impact_lists(data, limit)
     _prog.finish()
     output = _serialize_dict(data, format)
     _emit_command_output(
@@ -6222,10 +6267,14 @@ def pr_impact_cmd(
         Path("."),
         help="Repository root (default: current directory)",
     ),
-    files: Path = typer.Option(
+    files: str = typer.Option(
         ...,
         "--files",
-        help="File containing the list of changed Java files, one path per line.",
+        help=(
+            "Changed files to analyze: a text file with one path per line "
+            "(e.g. from `git diff --name-only`), a comma-separated list of paths, "
+            "or '-' to read the list from stdin."
+        ),
     ),
     output_path: Optional[Path] = typer.Option(
         None, "--output", "-o",
@@ -6236,6 +6285,14 @@ def pr_impact_cmd(
         help="Output format: text (default) or json.",
         show_default=True,
     ),
+    fail_on: Optional[str] = typer.Option(
+        None, "--fail-on",
+        help=(
+            "Exit non-zero when the risk level reaches this threshold: "
+            "critical | high | medium | low | unknown. UNKNOWN (partial evidence) "
+            "always fails when a threshold is set."
+        ),
+    ),
     copy: bool = typer.Option(
         False, "--copy", "-c",
         help="Copy output to clipboard after a successful run.",
@@ -6251,6 +6308,11 @@ def pr_impact_cmd(
       - Event publishers and consumers triggered by the change
       - @Transactional methods in the changed classes
       - Consolidated risk level (CRITICAL / HIGH / MEDIUM / LOW)
+      - Changed files that could NOT be analyzed (unresolved / non-Java)
+
+    \b
+    A changed Java file that maps to no class caps the verdict at UNKNOWN:
+    a partial blast radius is never reported as a low one.
 
     \b
     Reuses existing graph and impact analysis — no new parsers.
@@ -6260,7 +6322,8 @@ def pr_impact_cmd(
     Examples:
       ask pr-impact --files changed_files.txt
       ask pr-impact /path/to/repo --files diff.txt --format json
-      ask pr-impact --files changes.txt --output pr_report.txt
+      ask pr-impact --files A.java,B.java --fail-on high
+      git diff --name-only origin/main | ask pr-impact --files -
     """
     import json as _json
 
@@ -6280,33 +6343,53 @@ def pr_impact_cmd(
         )
         raise typer.Exit(code=1)
 
-    if not files.exists() or files.is_dir():
-        _emit_error_json(
-            INVALID_INPUT_CODE,
-            f"--files '{files}' does not exist or is a directory. Expected a text file listing changed file paths (one per line).",
-            path=str(files),
-            hint=(
-                "Create a file with one changed Java file path per line, then pass it with --files. "
-                "Example: git diff --name-only HEAD~1 > changed.txt && ask pr-impact . --files changed.txt"
-            ),
-            expected="A text file containing one Java file path per line.",
-        )
-        raise typer.Exit(code=1)
-
     _enforce_format("pr-impact", format)
 
-    # Read changed-files list
-    changed_files = [
-        line.strip()
-        for line in files.read_text(encoding="utf-8").splitlines()
-        if line.strip()
-    ]
+    # --files accepts three shapes: a list file, '-' for stdin, or an inline
+    # comma-separated list. The list-file shape was the only documented one and
+    # the only one the error hint mentioned.
+    _files_raw = str(files).strip()
+    if _files_raw == "-":
+        changed_files = [ln.strip() for ln in sys.stdin.read().splitlines() if ln.strip()]
+        _files_desc = "stdin"
+    else:
+        _files_path = Path(_files_raw)
+        if _files_path.is_file():
+            changed_files = [
+                line.strip()
+                for line in _files_path.read_text(encoding="utf-8").splitlines()
+                if line.strip()
+            ]
+            _files_desc = str(_files_path)
+        elif all(
+            p.strip().lower().endswith(".java")
+            for p in _files_raw.split(",") if p.strip()
+        ):
+            # Inline path list. Restricted to .java entries so that a mistyped
+            # list-file path ("changd.txt") still errors loudly instead of being
+            # read as a one-element list of changed files.
+            changed_files = [p.strip() for p in _files_raw.split(",") if p.strip()]
+            _files_desc = "inline list"
+        else:
+            _emit_error_json(
+                INVALID_INPUT_CODE,
+                f"--files '{_files_raw}' is not a readable file, a comma-separated list, or '-'.",
+                path=_files_raw,
+                hint=(
+                    "Pass a file with one changed path per line "
+                    "(git diff --name-only HEAD~1 > changed.txt && ask pr-impact . --files changed.txt), "
+                    "a comma-separated list (--files A.java,B.java), or '-' to read from stdin."
+                ),
+                expected="A list file, a comma-separated list of paths, or '-'.",
+            )
+            raise typer.Exit(code=1)
+
     if not changed_files:
         _emit_error_json(
             INVALID_INPUT_CODE,
-            f"--files '{files}' is empty.",
-            hint="File must contain at least one Java file path.",
-            expected="One Java file path per line.",
+            f"--files '{_files_desc}' is empty.",
+            hint="Provide at least one changed file path.",
+            expected="One file path per line, or a comma-separated list.",
         )
         raise typer.Exit(code=1)
 
@@ -6347,6 +6430,23 @@ def pr_impact_cmd(
         ),
     )
 
+    if fail_on:
+        _levels = {"critical": 4, "high": 3, "medium": 2, "low": 1, "unknown": 0}
+        _threshold = _levels.get(fail_on.strip().lower())
+        if _threshold is None:
+            _emit_error_json(
+                INVALID_INPUT_CODE,
+                f"--fail-on '{fail_on}' is not a risk level.",
+                hint="Use one of: critical, high, medium, low, unknown.",
+                expected="critical | high | medium | low | unknown",
+            )
+            raise typer.Exit(code=1)
+        _actual = _levels.get(report.risk_level.lower(), 0)
+        # UNKNOWN means the analysis could not see everything it was asked about.
+        # A gate must not read that as "below threshold".
+        if report.risk_level == "UNKNOWN" or _actual >= _threshold:
+            raise typer.Exit(code=1)
+
 
 # ── Explain Command ───────────────────────────────────────────────────────────
 
@@ -6371,6 +6471,11 @@ def explain_cmd(
              "human-readable text/Markdown, NOT JSON — pass --format json (or use a "
              ".json output path) for machine-readable output.",
     ),
+    limit: int = typer.Option(
+        50, "--limit",
+        help="Maximum items per list section (callers, methods, deps). "
+             "0 disables the cap. Truncation is always reported in warnings.",
+    ),
     copy: bool = typer.Option(
         False, "--copy", "-c",
         help="Copy output to clipboard after a successful run.",
@@ -6468,7 +6573,7 @@ def explain_cmd(
         except Exception:
             cir = ContextGraph.build(file_list, target).cir  # fallback: never break explain
         model = SpringSemanticModel.build(cir)
-        explanation = explain_class(class_name, cir, model)
+        explanation = explain_class(class_name, cir, model).capped(limit)
     finally:
         _prog.finish()
     if _cc_look is not None:
@@ -7166,7 +7271,8 @@ def modernize_cmd(
                 "that blocks independent module extraction; coupling_type="
                 "directional (reverse_edge_count=0) is a normal one-way layered "
                 "dependency, listed for coupling strength, NOT a tangle. Empty "
-                "means no cross-subsystem structural coupling was detected."
+                "means no cross-subsystem structural coupling was detected. "
+                + CYCLE_METRIC_RECONCILIATION
             ),
             # BUG-05 fix: don't recommend "Start with hotspot_candidates" when the list is empty.
             "recommendation": (
@@ -7441,13 +7547,33 @@ def auth_status_cmd() -> None:
     """Show current authentication and plan status."""
     import json as _json
     try:
-        from sourcecode.license import _license_data as _ld, is_pro as _ip
+        from sourcecode.license import (
+            _PRO_UNLOCK_ALL as _unlock,
+            _license_data as _ld,
+            is_pro as _ip,
+        )
     except Exception:
         _ld = None
         _ip = False
+        _unlock = False
+
+    # While the early-adoption unlock is on, every Pro command runs. Reporting
+    # `pro: false` here contradicted the --help header and the commands' own
+    # behaviour: the status has to describe the gating that is actually in force,
+    # not the credential that happens to be absent.
+    _gating = {
+        "pro_gating": "disabled" if _unlock else "enabled",
+        "pro_effective": bool(_ip or _unlock),
+    }
+    if _unlock:
+        _gating["pro_reason"] = "early-adoption unlock: Pro commands run without a license"
 
     if not _ld:
-        out: dict = {"status": "unauthenticated", "pro": False}
+        out: dict = {
+            "status": "unauthenticated",
+            "pro": bool(_unlock),
+            **_gating,
+        }
         sys.stdout.write(_json.dumps(out, ensure_ascii=False) + "\n")
         sys.stdout.flush()
         return
@@ -7460,6 +7586,7 @@ def auth_status_cmd() -> None:
         "plan_status": _ld.get("status", "unknown"),
         "pro": _ip,
         "validated_at": _ld.get("validated_at") or _ld.get("activated_at") or "",
+        **_gating,
     }
     sys.stdout.write(_json.dumps(out, indent=2, ensure_ascii=False) + "\n")
     sys.stdout.flush()
@@ -8625,8 +8752,19 @@ def cache_warm_cmd(
     """
     import shutil as _shutil
     import subprocess as _sub
-    target = _resolve_repo_root(Path(path))
+    # Warm exactly the path given. Resolving up to the enclosing git root warmed
+    # (and reported on) the whole monorepo when asked for one module — every other
+    # command scopes to the argument, so `cache warm ./service-a` populated a cache
+    # for a different target than `ask ./service-a` reads.
+    target = Path(path).resolve()
+    _git_root = _resolve_repo_root(Path(path))
     typer.echo(f"Warming cache for {target} …", err=True)
+    if _git_root != target:
+        typer.echo(
+            f"(scoped to {target}; the enclosing git repository is {_git_root} — "
+            "git-derived signals are computed within the scope above)",
+            err=True,
+        )
     _sc_bin = _shutil.which("sourcecode") or sys.argv[0]
     cmd = [_sc_bin, str(target)]
     if compact: