sourcecode 3.1.0__tar.gz → 3.2.0__tar.gz

{sourcecode-3.1.0 → sourcecode-3.2.0}/CHANGELOG.md

@@ -1,5 +1,189 @@
 # Changelog
 
+## [3.2.0] — 2026-07-28
+
+**Answer coherence (M7, first four seams).** One fact, one authority (ADR-0008). Four
+questions this tool answered twice — transaction boundaries, endpoint denominators, endpoint
+security coverage, outbound integrations — now have a single authority each, and every
+consumer binds to it instead of re-deriving.
+
+**Upgrade note.** Two behaviours change for anyone gating on the output:
+
+- `impact` / `impact-chain` / `plan` / `compare` now count transaction boundaries that were
+  structurally reported as `0` on every repository. Risk scores move **up**: on a
+  200-class BroadleafCommerce sample, 42 classes go from 0 to ≥1 boundary and 11 change
+  `risk_level`, always upward. A pinned `--fail-on` threshold can now trip where it did not.
+- `impact-chain.security_surfaces[]` and `endpoints_affected[]` gain `verdict` +
+  `confidence` and no longer let the declared annotation policy stand as a coverage answer.
+  `security_policy` is kept as a deprecated alias of `declared_policy` (two minor versions),
+  with its value unchanged.
+
+New payload keys (`population`, `declared_clients`, three-part endpoint partitions) are
+additive; the deprecated aliases listed below keep their previous values.
+
+### Fixed
+
+- **`export --integrations` answered "0 LDAP" in documents whose stack block named Spring
+  LDAP.** Reported in two field evaluations two majors apart. Reproduced on a Boot app that
+  declares `spring-boot-starter-data-ldap` and configures `spring.ldap.urls` in YAML: the
+  directory is wired entirely by properties, so no LDAP client type is ever imported and the
+  construct scan is *right* to find nothing — but the report never mentioned the declaration
+  it could see, and the document as a whole said the system has no outbound integrations
+  while naming a directory client library elsewhere.
+  - New authority `integration_coordinates.declared_integration_coordinates(root)` answers
+    one question — which client libraries the build declares — from Maven/Gradle
+    coordinates with `file:line` evidence, excluding test/provided scope.
+  - `export --integrations` (and `export --c4`) now carry `declared_clients`
+    (`kind`, `coordinate`, `evidence`, `observed_in_source`), `declared_clients_count` and
+    `kinds_declared_not_observed`, and the coverage reason names the declared kind and its
+    coordinate. A declared coordinate is never counted as an integration: `count` and
+    `by_kind` are unchanged and still report observed constructs only.
+  - `retrieve integration-inventory` states the same declared-not-observed kinds as
+    observations.
+  - `detectors/java.py` reads its directory coordinates from that one list, so the stack
+    block and the integration report can never recognize different libraries for the same
+    external system (ADR-0008 R12).
+  - Measured: alfresco declares `cxf-rt-frontend-jaxws` with no SOAP construct in source —
+    previously invisible, now stated. Broadleaf's declared JMS/LDAP coordinates are all
+    marked `observed_in_source: true`; repositories that declare no client library keep an
+    empty block. The `export --integrations` and `export --c4` baseline cells drift by
+    these added keys, by design.
+
+- **`impact-chain` called endpoints "none_detected" that the same run classified as guarded
+  by a custom authorization mechanism.** Measured on keycloak: `security_posture` reports
+  406 endpoints `protected_custom` (Likely) — 324 of them carrying the declared policy
+  `none_detected`, because their gate is a bespoke annotation outside every published
+  vocabulary — while `impact-chain` printed `security_policy: none_detected` for those same
+  `endpoint_id`s. One document answered both "guarded by a custom mechanism" and "no
+  security detected" about `DELETE /admin/realms/{realm}`. The declared policy is a fact
+  about an annotation; it was never an answer about coverage.
+  - New authority `security_posture.endpoint_security_surface(cir)` returns the per-endpoint
+    answer keyed by `endpoint_id` (ADR-0008 R1). `impact-chain` binds to it and reuses the
+    projection the security audit already derived — no second derivation, memoized per CIR
+    so `pr-impact`'s per-class queries pay for it once.
+  - `security_surfaces[]` and `endpoints_affected[]` now carry `verdict` + `confidence`
+    (`security_verdict` / `security_confidence` on affected endpoints) from the four-way
+    posture vocabulary, plus `declared_policy` for the annotation actually found. On the
+    28 endpoints reachable from `RealmAdminResource`, all 28 move `none_detected` →
+    `protected_custom` (Likely), matching `spring-audit` exactly.
+  - An endpoint the authority cannot speak about — or a repository with no posture
+    projection — is `coverage_unknown` with the reason stated, never a manufactured "none"
+    (ADR-0008 R9). On spring-petclinic all 17 endpoints read `coverage_unknown` in both
+    commands instead of `none_detected` in one and `coverage_unknown` in the other.
+  - `security_policy` is kept as a deprecated alias of `declared_policy` for two minor
+    versions; its value is unchanged.
+
+- **The security posture reported three counts under names that all read as "handlers", and
+  they did not reconcile.** The field report put `custom_authorization_mechanisms` at
+  713/936, `gate_coverage` at 698 and 2635, and a rollup of 939 + 2635 = 3574 — the only
+  figure matching `endpoints.total`. None was arithmetically wrong: they counted three
+  different populations, and no key said which. Reproduced exactly on keycloak, where the
+  old payload showed `gate_bearing: 337` beside `not_carrying_gate: 270` against a stated
+  total of 676 — a partition that visibly loses 69 endpoints, because the first number
+  counts handler *methods* and the second counts *endpoints*.
+  - One authority, `security_posture.endpoint_population`, now supplies every denominator,
+    and the posture payload carries a `population` block stating both units once
+    (ADR-0008 R1).
+  - `gate_coverage` gains an explicit three-part endpoint partition —
+    `endpoints_carrying_gate` + `endpoints_standard_guarded` +
+    `endpoints_not_carrying_gate` = `endpoints_total` — counted in the single loop that
+    visits each endpoint once, so the parts sum by construction. On keycloak:
+    406 + 0 + 270 = 676. Handler-method figures keep their own names
+    (`handler_methods_total`, `handler_methods_carrying_gate`) and are never part of that
+    sum.
+  - Custom-gate detection states the unit its percentage used: the denominator is handler
+    method *declarations* (overloads share an FQN, so keycloak has 551 distinct handler
+    methods across 601 declarations), and `endpoints_total` / `handler_methods_total` are
+    printed beside it so no reader has to infer which one a coverage figure meant.
+  - `total_controller_handlers`, `gate_bearing`, `not_carrying_gate` and `handler_total`
+    are kept as deprecated aliases with their existing values for two minor versions. No
+    consumer breaks; the numbers they held did not change.
+
+- **`impact` counted zero transaction boundaries on every repository — corrected, and the
+  two commands that answer this question now answer it once.** The field report was that
+  `impact` reported `transactional_boundaries_count: 0` for a symbol while `retrieve
+  transactions-reaching` reported 47 for the same one. The cause was worse than a
+  disagreement: the blast radius derived boundaries from a call-graph node
+  `role == "transaction_boundary"` that no producer ever assigns — 0 of 28 662 nodes carry
+  it on BroadleafCommerce — so the figure was **structurally always zero**, and the
+  `n_txn` term never contributed to `risk_score` or to the `n_txn >= 2` escalation rule
+  behind `risk_level`.
+  - Both consumers now ask one authority, `spring_semantic.boundaries_declared_within`
+    over the transaction-boundary index (ADR-0008 R1), which follows Spring's own
+    inheritance in both directions: a method carries its class's boundary, a class carries
+    the boundaries of the methods it declares, and asking about one method never sweeps in
+    a sibling's.
+  - Two named facts, one authority (ADR-0008 R3): `transactional_boundaries_touched` is
+    the target plus everything that calls it; the new `transactional_boundaries_reaching`
+    is the callers-only subset — what would run this change inside a transaction — and is
+    the number `retrieve transactions-reaching` reports, now by construction rather than
+    by coincidence.
+  - **Figures move, upward, because a real cost was being counted as nothing.** Measured
+    on BroadleafCommerce (161 declared boundaries): `CatalogServiceImpl` 0 → 10 boundaries
+    and `risk_score` 76.73 → 77.54; `OrderServiceImpl` 0 → 32 and 73.83 → 76.86;
+    `CustomerServiceImpl` 0 → 32 and 66.10 → 71.01. Across a 200-class sample, 42 classes
+    now report at least one boundary and 11 change `risk_level` — every one of them
+    upward. A pinned `--fail-on` threshold may therefore trip where it did not before;
+    that is the correction, not a regression.
+
+### Added
+
+- **ADR-0008 "Answer Coherence" — one fact, one authority (normative, no behaviour change
+  yet).** Two independent field evaluations, on releases two majors apart, scored the
+  product identically and named the same ceiling: not a missing capability, but the same
+  question answered twice with different numbers (`impact` reporting 0 transactional
+  boundaries where `retrieve` reports 47; `compare` ranking on caller arrays truncated at
+  30 while the exact magnitudes sit in `stats`; `has_tests` contradicting `analysis_gaps`
+  inside one document). The ADR fixes the rule the codebase had never stated: a fact has
+  exactly one authority, consumers transport it, quantities never come from the length of a
+  rendered collection, and a surface that cannot resolve emits `unknown` — never `0`. It
+  also changes the unit of remediation from *defect* to *fact*: a coherence fix is complete
+  only when the authority is corrected, every consumer is rebound, and a cross-command
+  parity assertion is added to the release battery.
+  - `docs/architecture/adr/0008-answer-coherence.md` — the rule, with the code-verified seam
+    inventory in Appendix A.
+  - `docs/DEFECT-LEDGER.md` — every field defect, its class, and the release that closed it,
+    published rather than tracked privately.
+  - `.planning/FIELD-EVAL-SYNTHESIS-2026-07-28.md` and
+    `.planning/ROADMAP-STRATEGIC-2026-07-28.md` — the evidence and the resulting direction
+    (M7 Coherence → M8 Payload economy → M9 Core & surface → M10 Enrichment interop →
+    M11 Compliance substrate).
+
+- **`migrate-check --blast-radius` states the regression scope behind each blocker.** The
+  finding list says what must change; a migration plan is built around what has to be
+  re-tested when that change lands. Each affected product file now resolves to the types
+  it declares and runs through the same caller traversal `impact-chain` uses, so the
+  block reports the HTTP endpoints whose call path passes through it, ranked. Measured on
+  BroadleafCommerce: 62.3% of the request surface (137 of 220 endpoints) runs through a
+  file with a finding, and 52 of the 166 affected files carry all of it. Implemented as a
+  rule over the existing IR — no new detector, ~3 ms per affected file on top of an IR
+  build shared with `impact-chain` / `explain` through the context cache.
+  - Reach is regression scope, never build breakage: a `javax→jakarta` finding fails
+    compilation whether or not any endpoint reaches it, and the payload says so.
+  - Unresolved is not zero — a file whose declared types the IR never resolved is listed
+    in `files_unresolved` with reach *unknown*.
+  - A repository the IR resolves no endpoints in (alfresco's webscript framework,
+    openmrs-core) gets `request_surface_share: null` and a note that ranking fell back to
+    caller counts, never a manufactured `0.0`.
+  - Opt-in and additive: without the flag the report is byte-identical to before, and the
+    key is absent rather than `null`.
+
+## [3.1.1] — 2026-07-28
+
+Documentation only; no behaviour changed.
+
+- **`contracts.md` gains an enforcement-maturity section**: which contract kinds have been
+  run against real code and with what result, the one false block found and fixed (a
+  fully-qualified security annotation reading as no guard, 3.1.0), and what is still
+  unproven — the GitHub Actions workflow has never run in a hosted runner. Plus a
+  three-week rollout that starts advisory (`--fail-on never`), because a contract whose
+  first act is blocking a merge gets deleted.
+- **`migrate-check.md` documents the output-size guard** added in 3.1.0: the measured
+  sizes that motivated it, the emitted `OUTPUT_TOO_LARGE` payload, and the four ways past
+  it in the order worth trying.
+- Doc-accuracy tests cover the new claims: the rollout flags exist, every documented
+  contract kind is implemented, and the quoted guard hint is the one the code emits.
+
 ## [3.1.0] — 2026-07-28
 
 **Posture answers about requests, not only about beans.** Milestone M4 of the strategic

{sourcecode-3.1.0 → sourcecode-3.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 3.1.0
+Version: 3.2.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -139,7 +139,7 @@ The system map: module graph, dependency views, REST surface, per-class summarie
 → [reference](docs/USER_GUIDE.md#core-commands)
 
 ### 4 · Migration & Modernization
-Is this codebase ready to upgrade? Per-dimension readiness (Jakarta / Spring Boot / JDK / Hibernate), located blockers, and an effort estimate.
+Is this codebase ready to upgrade? Per-dimension readiness (Jakarta / Spring Boot / JDK / Hibernate), located blockers, an effort estimate, and — with `--blast-radius` — the endpoints whose call path runs through each blocker, so the re-test plan is ordered by regression scope.
 `ask migrate-check` · `ask modernize`
 → [migrate-check reference](docs/migrate-check.md) · [MODERNIZATION.md](docs/MODERNIZATION.md)
 
@@ -233,7 +233,7 @@ Matching endpoints report `policy: "custom"` and drop out of the `no_security_si
 |-----|----------------|
 | [USER_GUIDE.md](docs/USER_GUIDE.md) | Full command reference, flags, output schema, workflows |
 | [contracts.md](docs/contracts.md) | Declare invariants in `.ask/contracts.yml`, enforce them in the edit loop and in CI |
-| [posture.md](docs/posture.md) | What a profile set actually wires, and what could not be decided (experimental) |
+| [posture.md](docs/posture.md) | What a profile set actually wires — down to which endpoints its filter chain permits — and what could not be decided (experimental) |
 | [migrate-check.md](docs/migrate-check.md) | Migration rule catalogue (MIG-001..043) + Hibernate stratification |
 | [MODERNIZATION.md](docs/MODERNIZATION.md) | The modernization product: assess → understand → plan → execute |
 | [PRODUCT_TIERS.md](docs/PRODUCT_TIERS.md) | Free vs Pro, pricing model |

{sourcecode-3.1.0 → sourcecode-3.2.0}/README.md

@@ -101,7 +101,7 @@ The system map: module graph, dependency views, REST surface, per-class summarie
 → [reference](docs/USER_GUIDE.md#core-commands)
 
 ### 4 · Migration & Modernization
-Is this codebase ready to upgrade? Per-dimension readiness (Jakarta / Spring Boot / JDK / Hibernate), located blockers, and an effort estimate.
+Is this codebase ready to upgrade? Per-dimension readiness (Jakarta / Spring Boot / JDK / Hibernate), located blockers, an effort estimate, and — with `--blast-radius` — the endpoints whose call path runs through each blocker, so the re-test plan is ordered by regression scope.
 `ask migrate-check` · `ask modernize`
 → [migrate-check reference](docs/migrate-check.md) · [MODERNIZATION.md](docs/MODERNIZATION.md)
 
@@ -195,7 +195,7 @@ Matching endpoints report `policy: "custom"` and drop out of the `no_security_si
 |-----|----------------|
 | [USER_GUIDE.md](docs/USER_GUIDE.md) | Full command reference, flags, output schema, workflows |
 | [contracts.md](docs/contracts.md) | Declare invariants in `.ask/contracts.yml`, enforce them in the edit loop and in CI |
-| [posture.md](docs/posture.md) | What a profile set actually wires, and what could not be decided (experimental) |
+| [posture.md](docs/posture.md) | What a profile set actually wires — down to which endpoints its filter chain permits — and what could not be decided (experimental) |
 | [migrate-check.md](docs/migrate-check.md) | Migration rule catalogue (MIG-001..043) + Hibernate stratification |
 | [MODERNIZATION.md](docs/MODERNIZATION.md) | The modernization product: assess → understand → plan → execute |
 | [PRODUCT_TIERS.md](docs/PRODUCT_TIERS.md) | Free vs Pro, pricing model |

{sourcecode-3.1.0 → sourcecode-3.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "3.1.0"
+version = "3.2.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-3.1.0 → sourcecode-3.2.0}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "3.1.0"
+__version__ = "3.2.0"

{sourcecode-3.1.0 → sourcecode-3.2.0}/src/sourcecode/cli.py

@@ -4084,7 +4084,11 @@ def impact_cmd(
       - direct_callers     — classes that directly call or depend on the target
       - indirect_callers   — transitive callers (BFS, bounded by --depth)
       - endpoints_affected — HTTP endpoints that transitively depend on the target
-      - transactional_boundaries_touched — @Transactional classes in the call chain
+      - transactional_boundaries_touched — @Transactional declarations on the target
+                             and on everything that calls it
+      - transactional_boundaries_reaching — the callers-only subset: what would run
+                             this change inside a transaction (the figure
+                             `ask retrieve transactions-reaching` reports)
       - risk_score / risk_level — quantified change risk
 
     \b
@@ -4714,7 +4718,10 @@ def export_cmd(
     ),
     integrations: bool = typer.Option(
         False, "--integrations",
-        help="Detect outbound integrations (HTTP/LDAP/JMS clients) with file:line evidence.",
+        help=(
+            "Detect outbound integrations (HTTP/LDAP/JMS clients) with file:line "
+            "evidence, plus the client libraries the build declares."
+        ),
     ),
     c4: bool = typer.Option(
         False, "--c4",
@@ -4742,6 +4749,11 @@ def export_cmd(
                      rolled up from class-level relation edges.
     --integrations   Outbound integrations (RestTemplate/WebClient/Feign/LDAP/JMS)
                      with file:line evidence — external-system dependency arrows.
+                     Also lists the client libraries the BUILD declares
+                     (declared_clients) and which of those no source construct
+                     uses — a config-wired client has no construct to find, so a
+                     count of 0 is never left standing alone against a client
+                     library named in the stack block.
     --c4             Unified architecture document mapped onto the open C4 model
                      (context/containers/components/code) + an API surface and a
                      per-directory content-hash manifest for incremental consumers.
@@ -4792,9 +4804,12 @@ def export_cmd(
         graph = ir.get("graph", {})
         _ep_data = extract_java_endpoints(root)
         endpoints = _ep_data.get("endpoints", [])
+        from sourcecode.integration_coordinates import declared_integration_coordinates
         _integrations = SemanticIntegrationEngine(
             ContextGraph.build(file_list, root)
-        ).as_report(len(file_list))
+        ).as_report(
+            len(file_list), declared=declared_integration_coordinates(root),
+        )
         data = _build_c4_export(
             root,
             file_list,
@@ -4831,9 +4846,12 @@ def export_cmd(
     if integrations:
         from sourcecode.context_graph import ContextGraph
         from sourcecode.semantic_integration_engine import SemanticIntegrationEngine
+        from sourcecode.integration_coordinates import declared_integration_coordinates
         data["integrations"] = SemanticIntegrationEngine(
             ContextGraph.build(file_list, root)
-        ).as_report(len(file_list))
+        ).as_report(
+            len(file_list), declared=declared_integration_coordinates(root),
+        )
 
     _prog.finish()
     output = _serialize_dict(data, format)
@@ -5684,19 +5702,35 @@ def _render_gate_coverage_section(result: "SpringAuditResult") -> list[str]:  #
     gc = (result.security_posture or {}).get("gate_coverage")
     if not gc:
         return []
-    not_covered = gc.get("not_carrying_gate", 0)
+    not_covered = gc.get("endpoints_not_carrying_gate", gc.get("not_carrying_gate", 0))
     gates = ", ".join(f"`{g}`" for g in gc.get("gate_annotations", [])) or "the detected gate"
-    total = gc.get("total_controller_handlers", 0)
+    # One unit, named: these are endpoints, not handler methods. The two counts differ
+    # (one method can serve several mappings) and must never be summed together.
+    total = gc.get("endpoints_total", gc.get("total_controller_handlers", 0))
     lines: list[str] = ["", "---", ""]
     if not_covered == 0:
-        lines.append(f"✅ **Gate coverage** — all {total} controller handlers carry {gates}.")
+        _gated = gc.get("endpoints_carrying_gate", total)
+        _std = gc.get("endpoints_standard_guarded", 0)
+        if _std:
+            lines.append(
+                f"✅ **Gate coverage** — all {total} endpoints are guarded: {_gated} carry "
+                f"{gates}, {_std} rely on a standard guard."
+            )
+        else:
+            lines.append(f"✅ **Gate coverage** — all {total} endpoints carry {gates}.")
         return lines
 
     covered = gc.get("possibly_filter_covered", 0)
+    _standard = gc.get("endpoints_standard_guarded", 0)
     lines.append(
-        f"🔓 **Gate coverage** — {not_covered} of {total} controller handlers do not carry "
+        f"🔓 **Gate coverage** — {not_covered} of {total} endpoints do not carry "
         f"{gates}."
     )
+    if _standard:
+        lines.append(
+            f"_{gc.get('endpoints_carrying_gate', 0)} carry the gate, {_standard} rely on a "
+            f"standard guard, {not_covered} on neither — the three sum to {total}._"
+        )
     if gc.get("reconstructed_filter_patterns"):
         lines.append(
             f"_{covered} of those match a reconstructed servlet filter pattern "
@@ -6201,6 +6235,65 @@ def posture_cmd(
 # ── Spring Boot Migration Check ───────────────────────────────────────────────
 
 
+def _migration_blast_radius(
+    target: Path,
+    file_list: list[str],
+    report: "object",
+    depth: int,
+) -> dict:
+    """Resolve the regression scope behind the migration findings (--blast-radius).
+
+    Reuses the shared context-cache CIR — the same one `impact-chain`, `explain` and
+    `cache warm` use — so a warmed repository skips the Java parse. Every failure mode
+    degrades to a block that says what could not be computed; it never fabricates reach
+    and never breaks the scan that already succeeded.
+    """
+    from sourcecode.migration_blast import compute_migration_blast, SCHEMA_VERSION
+
+    _depth = max(1, min(int(depth), 8))
+    findings = list(getattr(report, "findings", []) or [])
+
+    def _degraded(reason: str) -> dict:
+        return {
+            "schema_version": SCHEMA_VERSION,
+            "depth": _depth,
+            "status": "unavailable",
+            "endpoints_in_repo": 0,
+            "endpoints_reached": 0,
+            "request_surface_share": None,
+            "files_analyzed": 0,
+            "files_on_request_path": 0,
+            "files_off_request_path": 0,
+            "files_unresolved": [],
+            "files": [],
+            "files_omitted": 0,
+            "notes": [reason],
+        }
+
+    if not file_list:
+        return _degraded(
+            "No Java sources in this repository — there is no call graph to traverse, "
+            "so no regression scope can be attributed."
+        )
+
+    try:
+        from sourcecode import context_cache as _ctxcache
+        from sourcecode.context_graph import ContextGraph
+        from sourcecode.spring_model import SpringSemanticModel
+
+        try:
+            cir, _ = _ctxcache.get_or_build_cir(_resolve_repo_root(target), target, file_list)
+        except Exception:
+            cir = ContextGraph.build(file_list, target).cir
+        model = SpringSemanticModel.build(cir)
+        return compute_migration_blast(cir, model, findings, depth=_depth)
+    except Exception as exc:  # pragma: no cover - defensive
+        return _degraded(
+            f"Blast radius unavailable: {type(exc).__name__} while building the "
+            "repository IR. The migration findings above are unaffected."
+        )
+
+
 @app.command("migrate-check")
 def migrate_check_cmd(
     path: Path = typer.Argument(
@@ -6265,6 +6358,18 @@ def migrate_check_cmd(
         False, "--force",
         help="Emit to stdout even when the report exceeds the output-size guard.",
     ),
+    blast_radius: bool = typer.Option(
+        False, "--blast-radius",
+        help=(
+            "Rank affected product files by the HTTP endpoints whose call path runs "
+            "through them (regression scope), using the same caller traversal as "
+            "impact-chain. Builds the repository IR — slower than a plain scan."
+        ),
+    ),
+    depth: int = typer.Option(
+        4, "--depth",
+        help="Caller BFS depth for --blast-radius (1-8, default: 4).",
+    ),
 ) -> None:
     """Spring Boot 2→3 migration readiness: detect javax→jakarta namespace blockers.
 
@@ -6298,6 +6403,16 @@ def migrate_check_cmd(
       ask migrate-check . --output migration.json
       ask migrate-check . --snapshot --ref sprint-12   persist a readiness point
       ask migrate-check . --trend                      days-remaining over time
+      ask migrate-check . --blast-radius               endpoints behind each blocker
+
+    \b
+    Blast radius (--blast-radius):
+      Ranks the affected product files by the HTTP endpoints whose call path runs
+      through them — the re-test plan, ordered by regression scope. Reach is never
+      build breakage: a javax→jakarta finding fails compilation whether or not an
+      endpoint reaches it. A file whose types the IR could not resolve is reported
+      unresolved (reach unknown, never zero), and a repository with no endpoints in
+      the IR gets a null share with the reason stated instead of a 0.0.
 
     \b
     Readiness time series:
@@ -6366,6 +6481,9 @@ def migrate_check_cmd(
     if _file_limitations:
         report.limitations.extend(_file_limitations)
 
+    if blast_radius:
+        report.blast_radius = _migration_blast_radius(target, file_list, report, depth)
+
     if format == "text":
         output = report.to_text(min_severity=min_severity)
     else:
@@ -6513,7 +6631,8 @@ def impact_chain_cmd(
       - indirect_callers    — transitive callers (BFS up to --depth hops)
       - endpoints_affected  — HTTP endpoints reachable through the call chain
       - transaction_boundary — @Transactional semantics on the target (if any)
-      - security_surfaces   — per-endpoint security policy + SEC findings
+      - security_surfaces   — per-endpoint security verdict + confidence
+                              (security_posture authority) + declared policy + SEC findings
       - impact_findings     — TX/SEC audit findings touching the call chain
       - risk_level          — critical | high | medium | low
 

{sourcecode-3.1.0 → sourcecode-3.2.0}/src/sourcecode/detectors/java.py

@@ -15,6 +15,7 @@ from sourcecode.detectors.parsers import (
     substitute_maven_properties as _resolve_maven_property,
     unique_strings,
 )
+from sourcecode.integration_coordinates import coordinates_for_kind
 from sourcecode.schema import FrameworkDetection
 from sourcecode.tree_utils import flatten_file_tree
 
@@ -488,11 +489,15 @@ class JavaDetector(AbstractDetector):
         if "spring-boot-starter-data-jpa" in text or "spring-data-jpa" in text:
             frameworks.append(FrameworkDetection(name="Spring Data JPA", source=source))
         # The Boot starter names neither of the module coordinates, so a Boot app
-        # wiring LDAP the standard way declared no LDAP framework at all.
-        if (
-            "spring-ldap-core" in text
-            or "spring-security-ldap" in text
-            or "spring-boot-starter-data-ldap" in text
+        # wiring LDAP the standard way declared no LDAP framework at all. The coordinate
+        # list lives in `integration_coordinates` — the same set `export --integrations`
+        # reads, so this stack block and that report can never recognize different
+        # libraries for the same external system (ADR-0008 R12).
+        # Only the Spring-family coordinates may carry the "Spring LDAP" label — the
+        # authority also knows non-Spring directory clients, and naming the wrong library
+        # would trade one incoherence for another.
+        if any(
+            c in text for c in coordinates_for_kind("ldap") if c.startswith("spring-")
         ):
             frameworks.append(FrameworkDetection(name="Spring LDAP", source=source))
         if "spring-aspects" in text or "spring-aop" in text: