sourcecode 3.1.0__py3-none-any.whl → 3.2.0__py3-none-any.whl

sourcecode/semantic_integration_engine.py

@@ -288,9 +288,23 @@ class SemanticIntegrationEngine:
             "runtime/DI-wired clients remain out of static scope."
         )
 
-    def as_report(self, n_files: Optional[int] = None) -> dict:
+    def as_report(
+        self,
+        n_files: Optional[int] = None,
+        *,
+        declared: "Optional[list]" = None,
+    ) -> dict:
         """Same output contract as integration_detector.detect_integrations, so the
-        `export --integrations` / C4 external_systems consumer is unchanged."""
+        `export --integrations` / C4 external_systems consumer is unchanged.
+
+        ``declared`` — the build's declared client libraries from the coordinate
+        authority (:mod:`sourcecode.integration_coordinates`). They are reported in
+        their own block and never counted as integrations: a coordinate says the build
+        declares a client, not that the code uses one. Passing them is what stops this
+        report from answering `count: 0` in a document whose stack block lists a client
+        library for the same external system (ADR-0008 R12/R14) — a contradiction that
+        survived two releases on the LDAP surface.
+        """
         recs = self.detect()
         by_kind: dict[str, int] = {}
         for r in recs:
@@ -306,11 +320,49 @@ class SemanticIntegrationEngine:
             if r.confidence is not None:
                 rec["confidence"] = r.confidence
             integrations.append(rec)
+
+        declared_list = list(declared or [])
+        observed_kinds = set(by_kind)
+        declared_block = [
+            {**d.to_dict(), "observed_in_source": d.kind in observed_kinds}
+            for d in declared_list
+        ]
+        declared_not_observed = sorted(
+            {d.kind for d in declared_list} - observed_kinds
+        )
+        if declared_not_observed:
+            _cites = "; ".join(
+                f"{d.kind} ({d.coordinate} at {d.evidence})"
+                for d in declared_list if d.kind in set(declared_not_observed)
+            )
+            coverage_reason = (
+                f"{coverage_reason} The build DECLARES a client library for "
+                f"{len(declared_not_observed)} kind(s) with no client construct in "
+                f"source — {_cites}. A configuration-wired client (properties, YAML, "
+                "XML, or a starter's auto-configuration) is not statically visible as a "
+                "construct, so read these as declared-not-observed, neither as an "
+                "integration record nor as their absence."
+            )
+
         return {
             "integrations": integrations,
             "by_kind": {k: by_kind[k] for k in sorted(by_kind)},
             "count": len(recs),
             "confidence": "observed" if recs else "not_analyzed",
+            # Declared ≠ observed. Two facts about the same external system, each under
+            # its own name and its own evidence, so no reader has to reconcile a count of
+            # 0 here against a client library named in the stack block.
+            "declared_clients": declared_block,
+            "declared_clients_count": len(declared_block),
+            "kinds_declared_not_observed": declared_not_observed,
+            "declared_clients_note": (
+                "Client libraries the BUILD declares (Maven/Gradle coordinates, "
+                "test/provided scope excluded). Evidence of a declared client, never of "
+                "an observed integration: a coordinate does not prove the code uses it, "
+                "and its absence from `integrations` does not prove the system does not "
+                "talk to that party — a properties/YAML/XML-wired client has no construct "
+                "to find."
+            ),
             "coverage_confidence": coverage_confidence,
             "coverage_confidence_reason": coverage_reason,
             "coverage_note": (

sourcecode/spring_impact.py

@@ -96,7 +96,13 @@ class AffectedEndpoint:
     controller_class: str
     handler_symbol: str
     source_file: str
-    security_policy: str  # e.g. "spring_pre_authorize", "none_detected", "unknown"
+    # Guard vocabulary DECLARED on the handler ("spring_pre_authorize",
+    # "none_detected", "unknown"). Evidence about an annotation — never a statement
+    # about whether the route is covered. The coverage answer is `security_verdict`,
+    # bound from the one authority (security_posture.endpoint_security_surface).
+    security_policy: str
+    security_verdict: str = "coverage_unknown"
+    security_confidence: str = "Unknown"
 
     def to_dict(self) -> dict:
         return {
@@ -106,6 +112,9 @@ class AffectedEndpoint:
             "controller_class": self.controller_class,
             "handler_symbol": self.handler_symbol,
             "source_file": self.source_file,
+            "security_verdict": self.security_verdict,
+            "security_confidence": self.security_confidence,
+            # kept for consumers reading the declared annotation; see the field note
             "security_policy": self.security_policy,
         }
 
@@ -863,11 +872,43 @@ def _build_chain_explanation(
 # Security surface aggregation
 # ---------------------------------------------------------------------------
 
+def _bind_security_surface(
+    endpoints_affected: list[AffectedEndpoint],
+    surface: dict[str, dict],
+    *,
+    unavailable_reason: str = "",
+) -> None:
+    """Bind each affected endpoint to the one security authority, in place.
+
+    An endpoint the authority does not speak about (or an authority that could not
+    be built) is `coverage_unknown` with its reason — never the declared policy
+    reused as a coverage claim (ADR-0008 R9).
+    """
+    from sourcecode.security_posture import unknown_endpoint_surface
+
+    for ep in endpoints_affected:
+        answer = surface.get(ep.endpoint_id)
+        if answer is None:
+            answer = unknown_endpoint_surface(
+                unavailable_reason
+                or "endpoint is not present in the security-posture projection",
+                declared_policy=ep.security_policy,
+            )
+        ep.security_verdict = answer.get("verdict", "coverage_unknown")
+        ep.security_confidence = answer.get("confidence", "Unknown")
+
+
 def _build_security_surfaces(
     endpoints_affected: list[AffectedEndpoint],
     impact_findings: list[SpringFinding],
 ) -> list[dict]:
-    """Per-endpoint security surface with associated finding IDs."""
+    """Per-endpoint security surface with associated finding IDs.
+
+    The surface reports the authority's verdict (`security_posture`); the declared
+    annotation policy travels with it as evidence. Emitting the declared policy
+    alone is what made this command answer "none_detected" for 324 Keycloak
+    endpoints the same run classified `protected_custom`.
+    """
     finding_by_ep: dict[str, list[str]] = {}
     for f in impact_findings:
         if f.category == "security":
@@ -881,6 +922,11 @@ def _build_security_surfaces(
             "endpoint_id": ep.endpoint_id,
             "method": ep.method,
             "path": ep.path,
+            "verdict": ep.security_verdict,
+            "confidence": ep.security_confidence,
+            "declared_policy": ep.security_policy,
+            # deprecated alias of `declared_policy` (two-minor window): it always
+            # carried the declared annotation, never a coverage verdict.
             "security_policy": ep.security_policy,
             "security_findings": finding_by_ep.get(ep.endpoint_id, []),
         })
@@ -1102,10 +1148,13 @@ class ImpactOrchestrator:
             pass
 
         # ── 5. TX + SEC audit findings, filtered to call chain ────────────
+        # The security audit already derives the posture projection; take it from
+        # there rather than deriving the same answer a second time (ADR-0008 R1).
+        posture_dict: dict = {}
         if prebuilt_findings is not None:
             all_findings = prebuilt_findings
         else:
-            all_findings = _run_audit_for_chain(cir, model, root)
+            all_findings, posture_dict = _run_audit_for_chain(cir, model, root)
 
         impact_findings_raw = _filter_findings(
             all_findings, seed_fqns, direct_callers_raw, indirect_callers_raw,
@@ -1118,6 +1167,18 @@ class ImpactOrchestrator:
         impact_findings = [f.to_dict() for f in impact_findings_raw]
 
         # ── 6. Security surfaces ──────────────────────────────────────────
+        security_surface_index, surface_gap = _endpoint_security_authority(
+            cir, root, posture_dict,
+        )
+        # The gap is only worth a warning when it actually withheld an answer:
+        # a repo with no affected endpoints is not missing a security surface.
+        surface_gap_warned = False
+        if surface_gap and endpoints_affected:
+            warnings.append(surface_gap)
+            surface_gap_warned = True
+        _bind_security_surface(
+            endpoints_affected, security_surface_index, unavailable_reason=surface_gap,
+        )
         security_surfaces = _build_security_surfaces(endpoints_affected, impact_findings_raw)
 
         # ── 7. Risk ───────────────────────────────────────────────────────
@@ -1176,6 +1237,13 @@ class ImpactOrchestrator:
                 key=lambda f: (SEVERITY_ORDER.get(f.severity, 9), f.symbol)
             )
             impact_findings = [f.to_dict() for f in impact_findings_raw]
+            _bind_security_surface(
+                endpoints_affected, security_surface_index,
+                unavailable_reason=surface_gap,
+            )
+            if surface_gap and endpoints_affected and not surface_gap_warned:
+                warnings.append(surface_gap)
+                surface_gap_warned = True
             security_surfaces = _build_security_surfaces(endpoints_affected, impact_findings_raw)
             risk_level, risk_score, risk_score_raw = _compute_risk(
                 len(direct_callers), len(indirect_callers),
@@ -1456,16 +1524,21 @@ def _run_audit_for_chain(
     cir: CanonicalRepositoryIR,
     model: SpringSemanticModel,
     root: Optional[Path],
-) -> list[SpringFinding]:
-    """Run TX + SEC audit and return combined findings list.
+) -> tuple[list[SpringFinding], dict]:
+    """Run TX + SEC audit; return (combined findings, security-posture projection).
+
+    The posture travels out with the findings because the security audit already
+    derives it — the impact chain binds to that derivation instead of computing a
+    second answer to the same question (ADR-0008 R1).
 
     Uses the pre-built model — no duplicate CIR traversal.
-    Never raises; returns [] on any error.
+    Never raises; returns ([], {}) on any error.
     """
     from sourcecode.spring_security_audit import run_security_audit
     from sourcecode.spring_tx_analyzer import run_tx_audit
 
     findings: list[SpringFinding] = []
+    posture: dict = {}
     try:
         tx_result = run_tx_audit(cir, root=root, model=model)
         findings.extend(tx_result.findings)
@@ -1474,9 +1547,53 @@ def _run_audit_for_chain(
     try:
         sec_result = run_security_audit(cir, root=root, model=model)
         findings.extend(sec_result.findings)
+        posture = getattr(sec_result, "security_posture", None) or {}
+    except Exception:
+        pass
+    return findings, posture
+
+
+# Per-CIR memo of the endpoint security authority's answer (one derivation per repo).
+_SURFACE_CACHE_ATTR = "_impact_endpoint_security_surface"
+
+
+def _endpoint_security_authority(
+    cir: CanonicalRepositoryIR,
+    root: Optional[Path],
+    posture: dict,
+) -> tuple[dict[str, dict], str]:
+    """(endpoint_id → security answer, reason it is unavailable).
+
+    Reuses ``posture`` when the audit already produced it; otherwise asks the
+    authority directly (the `prebuilt_findings` path, where no audit ran here).
+    Memoized on the CIR because `pr-impact` issues one query per changed class
+    against the same repository — reuse is what keeps "one authority" from meaning
+    "one full projection per query".
+    """
+    from sourcecode.security_posture import endpoint_security_surface
+
+    cached = getattr(cir, _SURFACE_CACHE_ATTR, None)
+    if cached is not None:
+        return cached
+
+    try:
+        surface = endpoint_security_surface(
+            cir, root=root, posture=posture or None,
+        )
+    except Exception:
+        surface = {}
+    if not surface:
+        answer = ({}, (
+            "security-posture projection unavailable for this repository; every "
+            "endpoint security answer is coverage_unknown (absence of evidence)"
+        ))
+    else:
+        answer = (surface, "")
+    try:
+        setattr(cir, _SURFACE_CACHE_ATTR, answer)
     except Exception:
         pass
-    return findings
+    return answer
 
 
 # ---------------------------------------------------------------------------

sourcecode/spring_semantic.py

@@ -16,7 +16,7 @@ from __future__ import annotations
 import re
 import time
 from dataclasses import dataclass, field
-from typing import TYPE_CHECKING, Optional
+from typing import TYPE_CHECKING, Iterable, Optional
 
 if TYPE_CHECKING:
     from sourcecode.canonical_ir import CanonicalRepositoryIR
@@ -295,12 +295,24 @@ def build_tx_index(cir: "CanonicalRepositoryIR") -> TransactionBoundaryIndex:
       3. Method-level boundaries override class-level for the same method.
       4. Class-level boundaries are inherited by methods that lack their own.
     """
+    return build_tx_index_from_ir(
+        getattr(cir, "_raw_ir", {}) or {}, repo_id=getattr(cir, "cir_hash", "")[:16]
+    )
+
+
+def build_tx_index_from_ir(raw_ir: dict, repo_id: str = "") -> TransactionBoundaryIndex:
+    """Same index, built straight from a repo IR dict.
+
+    THE authority for "where are the @Transactional boundaries" (ADR-0008 R1).
+    `build_tx_index` is the CanonicalRepositoryIR-shaped entry point; consumers that
+    hold the raw IR dict (blast radius) call this one instead of re-deriving
+    boundaries from graph node roles. Both produce the same index from the same nodes.
+    """
     t0 = time.monotonic()
-    index = TransactionBoundaryIndex(repo_id=getattr(cir, "cir_hash", "")[:16])
+    index = TransactionBoundaryIndex(repo_id=repo_id)
 
     try:
-        raw_ir = getattr(cir, "_raw_ir", {}) or {}
-        graph = raw_ir.get("graph") or {}
+        graph = (raw_ir or {}).get("graph") or {}
         nodes = graph.get("nodes") or []
 
         # Pass 1: build meta-@Transactional map from annotation-type nodes.
@@ -378,3 +390,43 @@ def build_tx_index(cir: "CanonicalRepositoryIR") -> TransactionBoundaryIndex:
 
     index.build_time_ms = round((time.monotonic() - t0) * 1000, 2)
     return index
+
+
+def boundaries_declared_within(
+    index: TransactionBoundaryIndex, symbols: "Iterable[str]"
+) -> list[TransactionBoundary]:
+    """The @Transactional declaration sites carried by *symbols*, ordered by symbol.
+
+    THE authority for "which transaction boundaries belong to this set of symbols"
+    (ADR-0008 R1). Every consumer that reports transaction boundaries over a set of
+    symbols — a blast radius, a caller closure, a module — calls this. A consumer that
+    re-derives the answer from graph node roles, annotation strings or naming is in
+    violation of the ADR, and is how `impact` came to report 0 boundaries where
+    `retrieve transactions-reaching` reported 47 on the same symbol.
+
+    Membership follows Spring's own inheritance, in both directions and no further:
+
+    - the declaration site itself is in the set;
+    - a **class**-level boundary when a method of that class is in the set (the method
+      runs inside it);
+    - a **method**-level boundary when its class is in the set (asking about a class asks
+      about the methods it declares).
+
+    Asking about one method does *not* pull in a sibling method's own boundary — that
+    sibling is a different code path, and reporting it would be the kind of quietly
+    inflated count this authority exists to prevent.
+    """
+    wanted = {s for s in symbols if s}
+    if not wanted:
+        return []
+    declaring_classes = {s.split("#", 1)[0] for s in wanted if "#" in s}
+
+    def _belongs(b: TransactionBoundary) -> bool:
+        if b.symbol in wanted:
+            return True
+        if b.scope == "class":
+            return b.symbol in declaring_classes
+        return _enclosing_class(b.symbol) in wanted
+
+    found = [b for b in index.all_declared if _belongs(b)]
+    return sorted(found, key=lambda b: (b.symbol, b.scope, b.source_file))

{sourcecode-3.1.0.dist-info → sourcecode-3.2.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 3.1.0
+Version: 3.2.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -139,7 +139,7 @@ The system map: module graph, dependency views, REST surface, per-class summarie
 → [reference](docs/USER_GUIDE.md#core-commands)
 
 ### 4 · Migration & Modernization
-Is this codebase ready to upgrade? Per-dimension readiness (Jakarta / Spring Boot / JDK / Hibernate), located blockers, and an effort estimate.
+Is this codebase ready to upgrade? Per-dimension readiness (Jakarta / Spring Boot / JDK / Hibernate), located blockers, an effort estimate, and — with `--blast-radius` — the endpoints whose call path runs through each blocker, so the re-test plan is ordered by regression scope.
 `ask migrate-check` · `ask modernize`
 → [migrate-check reference](docs/migrate-check.md) · [MODERNIZATION.md](docs/MODERNIZATION.md)
 
@@ -233,7 +233,7 @@ Matching endpoints report `policy: "custom"` and drop out of the `no_security_si
 |-----|----------------|
 | [USER_GUIDE.md](docs/USER_GUIDE.md) | Full command reference, flags, output schema, workflows |
 | [contracts.md](docs/contracts.md) | Declare invariants in `.ask/contracts.yml`, enforce them in the edit loop and in CI |
-| [posture.md](docs/posture.md) | What a profile set actually wires, and what could not be decided (experimental) |
+| [posture.md](docs/posture.md) | What a profile set actually wires — down to which endpoints its filter chain permits — and what could not be decided (experimental) |
 | [migrate-check.md](docs/migrate-check.md) | Migration rule catalogue (MIG-001..043) + Hibernate stratification |
 | [MODERNIZATION.md](docs/MODERNIZATION.md) | The modernization product: assess → understand → plan → execute |
 | [PRODUCT_TIERS.md](docs/PRODUCT_TIERS.md) | Free vs Pro, pricing model |

{sourcecode-3.1.0.dist-info → sourcecode-3.2.0.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=RdGu3pDWTIDIExICX1CUTqllYPhYoeMc4ByyRDVrjIY,308
+sourcecode/__init__.py,sha256=4hwV87XY8dgmsv4RaWkZzBMSpB_T8EQ4A9_-xB5CzmI,308
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/archetype.py,sha256=qWMCyL2UzSGXJhCIZj38JjS7wI15EE3eILsWiaoCZXQ,35779
 sourcecode/architectural_baseline.py,sha256=7QzJri4pbL3nzAn9gNutZW6mZR8HHD6H2C2H1EEwYPE,17904
@@ -14,7 +14,7 @@ sourcecode/chain_rules.py,sha256=1kLHv1t7g5rMmycIYSpm3az8SjCr01Xw7LtyV2tNhSA,106
 sourcecode/change_plan.py,sha256=MNgNyu4zrLGvBBaXPwyCh-T2ZGaUQX3Hm4W87uuhZ3w,7750
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=zLML0Qwsxa_DQICh9QZMxKk0SIxeRu80oGmW_NV6ulM,395225
+sourcecode/cli.py,sha256=F7HXBOhTrzLppk81GDazz6sIvowkZomei1MCRXaTutc,400663
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=jdePg0dNCxFpysiTGMsROL5XABLjy_zVUgVeySvdb0o,7514
 sourcecode/confidence_analyzer.py,sha256=vnbPI-20FnHdjO6STxHW8fbaxmB4A7y58io63ibFZjc,21586
@@ -48,11 +48,13 @@ sourcecode/git_analyzer.py,sha256=irvEwddbd5_tbA_eYUZebf4mH7_nFhpjwaWAV1f7jUY,15
 sourcecode/graph_analyzer.py,sha256=lp0eB1PWC20BYF-GpPhAyegRpKrUKgOmXZIcZSIX_Ks,65777
 sourcecode/graph_evidence.py,sha256=rENNsYRZeNstX_ExNCLlbHJAruFQwxo5d00x6wO3xwI,15030
 sourcecode/hibernate_strat.py,sha256=5GmHiB865HxKdvaxeFV07ojglUgxyOP41AY2xiHfV30,61700
+sourcecode/integration_coordinates.py,sha256=7vGFxN4tCn_KTisYFJuixa8XkyHBoasEFB3fqM62OBI,7407
 sourcecode/jdk_exports.py,sha256=fCrlwNAXUT9gge_joq6kMnY3zJxYB2pxqy-0w3o3MJI,874
 sourcecode/license.py,sha256=keFuwNxdAtvK2Ds91Wl79GMYxuxWYnN5Wbw1qBpaoUI,24896
 sourcecode/mcp_nudge.py,sha256=lKemOqK_wny2u7Ymcr2Idi5Kx8pXY02jCi-_nJYLGMg,2992
 sourcecode/metrics_analyzer.py,sha256=m0ENgtqKeBL17kUIK3fmGkgo7UfXBNHxCMj0H_Y5K7c,22750
-sourcecode/migrate_check.py,sha256=07jZp8CY6GYybK67092ma_EomBsYbYt-O4jarW5HmKQ,109340
+sourcecode/migrate_check.py,sha256=TJvaShbglENOr8ikvCodnlXQy54TtT05N2ZVe02b3lc,110421
+sourcecode/migration_blast.py,sha256=5qUsUi4n0cwBKltdJYyvyfhBkGENAYjB-d_7LZtnVks,9282
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
 sourcecode/output_budget.py,sha256=Js9yUlfQtPhqBl9R6wn_9UHVjjJc3GtLcqyfjf5t50Q,9869
 sourcecode/parse_cache.py,sha256=IIsWhtMYpBLNyRCDVoiVpUZa62QIk1Q1sZBDNG4G4V0,6668
@@ -70,26 +72,26 @@ sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg,12965
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=ynno-4M3iBWetuKCiZ2rfbe_fd6MibGxf1X3bXF1-18,343766
+sourcecode/repository_ir.py,sha256=2S14aUMY5vpZePObd3F87kz71KUsVXQllurXjufa6A0,344648
 sourcecode/ris.py,sha256=Hw8TakTQ6hku-Abf2k8954NwkrH_sP73_8wVH8x5khc,22079
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=z3CV0rcGunu0Y8mpNgp07wI7nxT0pxw1BkXRRtI0Rpo,9609
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
 sourcecode/security_config.py,sha256=KblMEoRiEjrIE68YsPaUAFebxFp8UM7MS7lAk5CGD8U,3531
-sourcecode/security_posture.py,sha256=OqVNAnBAQ3ehRDi5_3wcMO3Mwn2MSppLWjGS3GdsyVg,32152
+sourcecode/security_posture.py,sha256=0tKL_RafS0dYY5W__JTeJIfopd8f-DyKEerHrvA3-Mg,40243
 sourcecode/semantic_analyzer.py,sha256=bpgdC6m0_ftVtRf3rSdwhbhWjnZnGxRXaZVcfe4BbcQ,95414
 sourcecode/semantic_impact_engine.py,sha256=t09IirGC3JjQDy33JZd1_WKzQVKXkoNl3-XEUr5kjis,20563
-sourcecode/semantic_integration_engine.py,sha256=TDq8XrFBAjnAXRSZLjHSRLK67U-WLeA_SEECCaLwPEg,16196
+sourcecode/semantic_integration_engine.py,sha256=7a0WqAInOv39f0Yr_94TYo_JP_8QpeI9KGaknpzAyQU,18899
 sourcecode/semantic_services.py,sha256=nbUuPv-F01USTt_9CHT8iy_ucCIw3fz4W3Aquea_pd4,10782
 sourcecode/serializer.py,sha256=BAGL2J3G3bHvJS60OcxekPvTJg8x6b1LzeLKFbGaots,131497
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=ICcR2qEZgYzWypZzsoaEmVeMYZ0YkuZ8AvTwA-rcVOs,7604
-sourcecode/spring_impact.py,sha256=Y2oUZDCeMZ6-fNYLUviC5DgiJfllE-l0yAZR7IabmxM,75083
+sourcecode/spring_impact.py,sha256=Cm2KZplpQHjdjUC8jPX1SNnLHxOdM3HsUBNFGwgTP18,80145
 sourcecode/spring_model.py,sha256=zOAgFmrRbG4a6KLm1TJl55aWMyPNsz3OS3FSczqPG6A,16594
 sourcecode/spring_profiles.py,sha256=YPgBH3RuML-mtid7YwUMfA9sfSXPZwknYL7UvRMoYbE,7946
 sourcecode/spring_properties.py,sha256=bQSOVrtj7YENsCjMQTTlVh-Gm_K0n0DdWzjPRUP38C4,8394
 sourcecode/spring_security_audit.py,sha256=FteXv5GH-iE07GLEqPpoX7sVXf_dxRns8zxh9_m6By0,23015
-sourcecode/spring_semantic.py,sha256=jteQ1PkY9ArFJv0embg_jBIdbOxqrk9mQ2Xz8OF_FKA,14214
+sourcecode/spring_semantic.py,sha256=UrmLg_4gmBVmMqvSnUMgSReVEERVGv3X7LYDBEs6k_o,16598
 sourcecode/spring_tx_analyzer.py,sha256=lp0h5Pzzd3fPxHAAagMmG8PqR1-v2uVpFIG1o7tCWQs,41148
 sourcecode/summarizer.py,sha256=sr0-tfecFKCr-fSkPPWbl-t9HC7SY2ZxkjnnXX8DB2A,26621
 sourcecode/token_estimate.py,sha256=ZP3C54aQLExuf32Yvrjok2TAS2oSSyNVRA_HjhsD6Eg,7165
@@ -111,7 +113,7 @@ sourcecode/detectors/elixir.py,sha256=jCpvt5Yi6jvplc80ovRtWh17q-11ZGo9qX7o8b57TJ
 sourcecode/detectors/go.py,sha256=2r66uRQfeTWsqxr4HDhT6vExZErby0t46QXLHVBRv9w,2782
 sourcecode/detectors/heuristic.py,sha256=7cRxrip4yIaggYzZJB6ef8yHKh-gHgiH_pXMFcjlyFU,3723
 sourcecode/detectors/hybrid.py,sha256=IGFRUVsAZ1ooRlFdznCeJAV6vy1yVDx-VyghvLtddXc,9101
-sourcecode/detectors/java.py,sha256=M8RZZkryXSDTWDZnmmnuPlZpKX9hnZ7eQy0Rh-eG3_I,44746
+sourcecode/detectors/java.py,sha256=v47yvL4mftcK35cVBpO7gru6O5AcEaKml-OoNyVU0Bg,45246
 sourcecode/detectors/jvm_ext.py,sha256=EgHJ5W8EE-ZTN9V607mVzohyKgZE8Mc2jCi-DF8RAZU,2616
 sourcecode/detectors/nodejs.py,sha256=Hg3Gmr7yIMJFiLoDwOTk2wtu00wxIs6kZf-oQujTFUA,13187
 sourcecode/detectors/parsers.py,sha256=ug9K31tyHqinmv0HkIVQVjdTZpBv67FYKAEf52YXOSM,3178
@@ -125,9 +127,9 @@ sourcecode/detectors/terraform.py,sha256=cxORPR_zVLOJpHlh4e9JnFpkQsn_UnqMMom5yG6
 sourcecode/detectors/tooling.py,sha256=8CKbtxwQoABP-WyBRNmdAmHDOvAH57AR1cF4UKuWEdQ,2074
 sourcecode/mcp/__init__.py,sha256=XU4HfRGbdid8wdUA0x_4f7uKZD1z3mv_XUY_WU_T9Mw,179
 sourcecode/mcp/orchestrator.py,sha256=diVoQgn24QmgPL3Ev8Sp6hsvh02OqY3MktHXOzrlodo,36525
-sourcecode/mcp/registry.py,sha256=OCUCRLPRM176FCw850rF7dNh74f5Zj0h3a9lpxrf8mI,68171
+sourcecode/mcp/registry.py,sha256=1qIcwtl01AGjEM3yMOwYgr_Ck3y-LZeRvh8i70Nhl_w,68258
 sourcecode/mcp/runner.py,sha256=RGimCwhLyHxjCvH7q72y12HWEnATXZLC-NBWhkzlu0I,2852
-sourcecode/mcp/server.py,sha256=P6JqQrlat2jP8OK0ysxSWNwqfUYF-bTc3X05FszR1_4,65180
+sourcecode/mcp/server.py,sha256=GH7bgJRVVkBJf-orj_Zmn_mEqMENG76-KNREJS7E5FY,65354
 sourcecode/mcp/onboarding/__init__.py,sha256=sj2PWqEBmMc4zBNkomg89WtL0M6S7A9yb7_wAuSWNP4,66
 sourcecode/mcp/onboarding/applier.py,sha256=Sx9vHTaXr_M1Bs4uMjO7qa_a2_p4J9oz93oJsKQ7ds4,3298
 sourcecode/mcp/onboarding/backup.py,sha256=ihqGOR8QTX8HASRSEDyfFyXr5bkXrygPHamv4p9KTmk,1452
@@ -146,9 +148,9 @@ sourcecode/retrieval/retriever.py,sha256=YdnbaXaWhFKyShuuE6fj36GfgpuGetqOFzx7_D2
 sourcecode/retrieval/runtime.py,sha256=ODQlPqyS4OfMtCb1oEA_0t7vK0uKPBLhB4K2CnytPUU,10822
 sourcecode/retrieval/steps.py,sha256=wyOiO84fuDgdd-HdugzGSEriN-lN891PTc3gU7lgcmI,9959
 sourcecode/retrieval/steps_endpoint.py,sha256=H_o4YsqgM198ZHtJg-UzhcmnFzbBeaYXrPNIDoc2IjI,13526
-sourcecode/retrieval/steps_graph.py,sha256=epr3V8qGtmFrhDnlk0ZC8eyr5-TDIhY-eiWNB5UJ0Uw,10447
+sourcecode/retrieval/steps_graph.py,sha256=E45vN9pA1lpKQ4pO2JP9-1cwIXoy1hWW6jsBDryeHGM,10684
 sourcecode/retrieval/steps_impact.py,sha256=M0AwU5Ue7nkj-A7DYgQI2BP0BV1b0TFZRrYIydF-Ajw,11605
-sourcecode/retrieval/steps_intf.py,sha256=BAh2oODyzaHpIfLwpAzE_mbG-QGXDSy60dgTROFFbzE,10549
+sourcecode/retrieval/steps_intf.py,sha256=BIopGUhxwutV51r8-1bTCC_VTYENJiHbREF13pB5mSo,11697
 sourcecode/retrieval/steps_struct.py,sha256=jO9L49hziTlS_xhuhCGUavgyAL3ZAnJSOZB-UA4GaRM,13893
 sourcecode/retrieval/steps_txsec.py,sha256=LKRzALzRw_0aQ3_tpbd34mt8u7o690g5tCnp871j7P4,17804
 sourcecode/schemas/envelope-v1.schema.json,sha256=lABkyKqXND039JUY2R6KK47OCDco5mq5PLgkcCXFhOQ,3477
@@ -158,8 +160,8 @@ sourcecode/telemetry/consent.py,sha256=GuhCiA_x2n3LwGBkZnvyIwtFcf5Zwa8O0DdLqkATI
 sourcecode/telemetry/events.py,sha256=4_yeO58U-Cwc1Qb27VB0_EjhmroY0k91n3_VGxeALB8,2776
 sourcecode/telemetry/filters.py,sha256=RzxauTz8HliO4BllQnXEXc7zTeqdCZi5MgqGEDuW7OQ,6570
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-3.1.0.dist-info/METADATA,sha256=B4R07QBUVN2LdW8xLyj6ABp3wCpWDhJqCtXcv45F34s,11091
-sourcecode-3.1.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-3.1.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-3.1.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-3.1.0.dist-info/RECORD,,
+sourcecode-3.2.0.dist-info/METADATA,sha256=O9_rjaiou-XB3P9QZsqnkmS1OAKcBCiEsxJOjjN2D9A,11286
+sourcecode-3.2.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-3.2.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-3.2.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-3.2.0.dist-info/RECORD,,