sourcecode 3.2.2__py3-none-any.whl → 3.4.0__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "3.2.2"
+__version__ = "3.4.0"

sourcecode/cli.py

@@ -6106,9 +6106,14 @@ def verify_edit_cmd(
 
     Deterministic, in-loop verdict over the diff of the working tree against HEAD:
     public contract, @Transactional proxy boundary, security surface, bean wiring,
-    custom domain rules, and blast radius. Built for the agent write-loop (MCP) and
-    git hooks. Only regressions the edit INTRODUCED (vs HEAD) block — pre-existing
-    debt never fails an unrelated commit.
+    custom domain rules, build/configuration changes, and blast radius. Built for the
+    agent write-loop (MCP) and git hooks. Only regressions the edit INTRODUCED (vs
+    HEAD) block — pre-existing debt never fails an unrelated commit.
+
+    Build and configuration files (pom.xml, build.gradle, application*.yml, web.xml,
+    container descriptors, Spring XML) are reported under `changed_build_files` and
+    make the verdict UNVERIFIED, never `pass`: their effect is not decidable from a
+    source diff, and a compiler-release bump moves every file in the repo at once.
 
     Custom rules: drop a `.ask/verify-rules.json` at the repo root to enforce your own
     invariants (e.g. "no @RestController injects a *DaoJpa", "every /payroll endpoint
@@ -8105,47 +8110,44 @@ def auth_status_cmd() -> None:
     """Show current authentication and plan status."""
     import json as _json
     try:
-        from sourcecode.license import (
-            _PRO_UNLOCK_ALL as _unlock,
-            _license_data as _ld,
-            is_pro as _ip,
-        )
+        from sourcecode.license import _license_data as _ld, entitlement as _entitlement
+        _ent = _entitlement()
     except Exception:
         _ld = None
-        _ip = False
-        _unlock = False
-
-    # While the early-adoption unlock is on, every Pro command runs. Reporting
-    # `pro: false` here contradicted the --help header and the commands' own
-    # behaviour: the status has to describe the gating that is actually in force,
-    # not the credential that happens to be absent.
-    _gating = {
-        "pro_gating": "disabled" if _unlock else "enabled",
-        "pro_effective": bool(_ip or _unlock),
-    }
-    if _unlock:
-        _gating["pro_reason"] = "early-adoption unlock: Pro commands run without a license"
-
-    if not _ld:
-        out: dict = {
-            "status": "unauthenticated",
-            "pro": bool(_unlock),
-            **_gating,
+        _ent = {
+            "entitlement": "free", "source": "free_tier", "authenticated": False,
+            "paywall_active": True, "when_it_changes": "", "free_repo_java_file_limit": None,
         }
-        sys.stdout.write(_json.dumps(out, ensure_ascii=False) + "\n")
-        sys.stdout.flush()
-        return
 
-    out = {
-        "status": "authenticated",
-        "auth_method": _ld.get("auth_method", "license_key"),
-        "email": _ld.get("email", ""),
-        "plan": _ld.get("plan", "unknown"),
-        "plan_status": _ld.get("status", "unknown"),
-        "pro": _ip,
-        "validated_at": _ld.get("validated_at") or _ld.get("activated_at") or "",
-        **_gating,
+    # P-2: one authority (`license.entitlement`) answers "what runs here, and why".
+    # The legacy keys below are *derived* from it rather than computed a second
+    # time — that is what stops `{"status": "unauthenticated", "pro": true}` from
+    # reappearing. They are deprecated and will be removed in a future major.
+    _pro = _ent["entitlement"] == "pro"
+    _legacy = {
+        "pro": _pro,
+        "pro_effective": _pro,
+        "pro_gating": "enabled" if _ent["paywall_active"] else "disabled",
+    }
+    if _ent["source"] == "early_adoption_unlock":
+        _legacy["pro_reason"] = "early-adoption unlock: Pro commands run without a license"
+
+    out: dict = {
+        "status": "authenticated" if _ent["authenticated"] else "unauthenticated",
+        **_ent,
+        **_legacy,
+        "deprecated_fields": ["pro", "pro_effective", "pro_gating", "pro_reason"],
     }
+    if _ld:
+        out.update({
+            "auth_method": _ld.get("auth_method", "license_key"),
+            "email": _ld.get("email", ""),
+            "plan": _ld.get("plan", "unknown"),
+            # The authority reads a missing status as active, so reporting
+            # "unknown" here would contradict the entitlement in the same object.
+            "plan_status": _ld.get("status", "active"),
+            "validated_at": _ld.get("validated_at") or _ld.get("activated_at") or "",
+        })
     sys.stdout.write(_json.dumps(out, indent=2, ensure_ascii=False) + "\n")
     sys.stdout.flush()
 

sourcecode/license.py

@@ -376,16 +376,78 @@ def _maybe_revalidate() -> None:
         pass
 
 
-def _init() -> None:
-    global _license_data, is_pro
-    _license_data = _load_license_file()
-    is_pro = (
+def entitlement() -> dict:
+    """The one answer to "what runs here today, and why" (P-2).
+
+    `auth status` used to publish four fields about this — `status`, `pro`,
+    `pro_gating`, `pro_effective`, plus a `pro_reason` sentence — and they read as
+    a contradiction: `{"status": "unauthenticated", "pro": true}`. Each field was
+    true on its own axis; together they told a buyer nothing about what they have,
+    why they have it, or what changes when it ends. That is the ADR-0008 pattern
+    exactly, on the commercial surface instead of an analysis one.
+
+    Every published entitlement field is derived from this dict and nowhere else.
+
+    Keys:
+      entitlement        "pro" | "free" — what actually runs right now
+      source             why: "license_key" | "early_adoption_unlock" | "free_tier"
+      authenticated      whether a credential is on this machine (an independent
+                         fact: today one can be entitled to Pro without one)
+      paywall_active     whether the paywall is enforcing anything at all
+      when_it_changes    what a user loses when `source` stops applying, in the
+                         terms the gate actually uses — never a price
+      free_repo_java_file_limit
+                         the number the size gate compares against
+    """
+    authenticated = _license_data is not None
+    licensed = bool(
         _license_data is not None
         and _license_data.get("plan") == "pro"
         and _license_data.get("status", "active") != "inactive"
     )
-    if _PRO_UNLOCK_ALL:
-        is_pro = True  # TEMPORARY: early-adoption Pro unlock (see _PRO_UNLOCK_ALL)
+    if licensed:
+        source = "license_key"
+    elif _PRO_UNLOCK_ALL:
+        source = "early_adoption_unlock"
+    else:
+        source = "free_tier"
+
+    if source == "license_key":
+        when = "Your licence entitles you to Pro; nothing changes while it stays active."
+    elif source == "early_adoption_unlock":
+        when = (
+            "Pro runs without a licence during early adoption. When that ends, every command "
+            f"still runs at full output on repositories up to {_FREE_REPO_JAVA_FILE_LIMIT} Java "
+            "source files; above that, the heavy-analysis commands ask for Pro. Capability is "
+            "never what is gated — size, automation and team are."
+        )
+    else:
+        when = (
+            f"Every command runs at full output on repositories up to {_FREE_REPO_JAVA_FILE_LIMIT} "
+            "Java source files. Above that, the heavy-analysis commands require Pro."
+        )
+
+    return {
+        "entitlement": "pro" if (licensed or _PRO_UNLOCK_ALL) else "free",
+        "source": source,
+        "authenticated": authenticated,
+        "paywall_active": not _PRO_UNLOCK_ALL,
+        "when_it_changes": when,
+        "free_repo_java_file_limit": _FREE_REPO_JAVA_FILE_LIMIT,
+    }
+
+
+def _init() -> None:
+    """Load the credential and derive the entitlement from the one authority.
+
+    `is_pro` is what every gate reads (`can_use`, `require_feature`), and it is
+    computed here from `entitlement()` rather than beside it — a second copy of
+    this rule is how `auth status` came to publish a state the commands
+    contradicted (P-2).
+    """
+    global _license_data, is_pro
+    _license_data = _load_license_file()
+    is_pro = entitlement()["entitlement"] == "pro"
 
 
 _init()

sourcecode/migrate_check.py

@@ -765,6 +765,15 @@ _BOOT3_MIGRATION_TARGETS: frozenset[str] = frozenset(
 # reported as a separate hygiene metric, excluded from JDK-modernization scoring.
 _BEST_PRACTICE_TARGETS: frozenset[str] = frozenset({"java_8_best_practice"})
 
+#: What a file costs when every finding in it has an OpenRewrite recipe, as a
+#: fraction of the hand-edit rate (C1-11). The recipe does not remove the work —
+#: it turns editing into running one recipe and reviewing the diff.
+#:
+#: This is an **assumption, not a measurement**, and it is published as a field
+#: (`effort_breakdown.mechanical_review_factor`) with that label so a reader can
+#: substitute their own team's number instead of inheriting ours silently.
+_MECHANICAL_REVIEW_FACTOR: float = 0.2
+
 # BUG #3: the migration dimensions that feed the readiness_score aggregate, in
 # order. jdk_modernization is deliberately NOT here — it is orthogonal upkeep debt
 # reported on its own axis, never folded into the migration headline.
@@ -1625,12 +1634,45 @@ class MigrationReport:
 
         # BUG #5: effort over MAIN findings only — N/A axes (Hibernate-6 phantom,
         # test fixtures) no longer pad the estimate.
-        _file_effort = (
-            len(critical_files) * 0.5
-            + len(high_files) * 0.25
-            + len(medium_files) * 0.1
-            + len(low_files) * 0.05
-        )
+        #
+        # C1-11 (field eval #4): the estimate used to bill every file at the
+        # hand-edit rate while the report itself shipped an OpenRewrite recipe for
+        # most of the findings in it — on openmrs, 296 of 310 findings carry
+        # `auto_fix_available: true` and all 310 were costed as hand work. A number
+        # that contradicts a field in the same payload is the ADR-0008 defect, so
+        # the estimate now reads that field.
+        #
+        # The unit is the file, because the weights below are per file: a file is
+        # mechanical only when EVERY main finding in it carries a recipe. One
+        # unautomatable finding puts a human in the file, and the rest of that
+        # file's work comes with them.
+        _findings_by_file: "dict[str, list[MigrationFinding]]" = {}
+        for f in main_findings:
+            _findings_by_file.setdefault(f.source_file, []).append(f)
+        _mechanical_files = {
+            path for path, items in _findings_by_file.items()
+            if items and all(bool(i.openrewrite_recipe) for i in items)
+        }
+
+        def _weighted(files: "set[str]") -> float:
+            return (
+                len(critical_files & files) * 0.5
+                + len(high_files & files) * 0.25
+                + len(medium_files & files) * 0.1
+                + len(low_files & files) * 0.05
+            )
+
+        _all_effort_files = critical_files | high_files | medium_files | low_files
+        _manual_effort = _weighted(_all_effort_files - _mechanical_files)
+        # A recipe does not remove the work, it changes what the work is: run the
+        # recipe once, then review the diff. Reviewing is charged at a fraction of
+        # editing. The fraction is an assumption, not a measurement, so it is
+        # published as a field rather than buried in this expression.
+        _mechanical_raw = _weighted(_all_effort_files & _mechanical_files)
+        _mechanical_effort = _mechanical_raw * _MECHANICAL_REVIEW_FACTOR
+        _file_effort = _manual_effort + _mechanical_effort
+        _auto_fixable = sum(1 for f in main_findings if f.openrewrite_recipe)
+        _recipes = sorted({f.openrewrite_recipe for f in main_findings if f.openrewrite_recipe})
         # BUG #1 (v1.70.0): when the Hibernate 5→6 axis APPLIES, fold its measured
         # rewrite effort (risk_matrix → total_effort_range_days) into the headline
         # estimate. Previously a Hibernate-5 project whose ${hibernateVersion} was
@@ -1646,6 +1688,33 @@ class MigrationReport:
         self.estimated_effort_days = round(_file_effort + _hib_effort, 1)
         self.effort_breakdown = {
             "findings_effort_days": round(_file_effort, 1),
+            # C1-11: the same total, split by what the work actually is.
+            "mechanical_days": round(_mechanical_effort, 1),
+            "manual_days": round(_manual_effort, 1),
+            # Not estimated rather than estimated at zero: the re-test scope is a
+            # different measurement (which endpoints the changed files reach), and
+            # `migrate-check --blast-radius` is what produces it. I-3: a fact that
+            # cannot be decided says so.
+            "validation_days": None,
+            "validation_days_note": (
+                "Not estimated here — the re-test scope is the endpoints the changed "
+                "files reach. Run `migrate-check --blast-radius` for that ordering."
+            ),
+            "mechanical_basis": (
+                f"{_auto_fixable} of {len(main_findings)} findings carry an OpenRewrite "
+                f"recipe; {len(_mechanical_files & _all_effort_files)} of "
+                f"{len(_all_effort_files)} affected files have a recipe for *every* "
+                f"finding in them and are costed at {_MECHANICAL_REVIEW_FACTOR:g}× the "
+                "hand-edit rate (run the recipe, review the diff). A file with one "
+                "unautomatable finding is costed manually in full — a human is in that "
+                "file either way."
+            ),
+            "mechanical_review_factor": _MECHANICAL_REVIEW_FACTOR,
+            "mechanical_review_factor_basis": "assumption, not a measurement",
+            "auto_fixable_findings": _auto_fixable,
+            "auto_fixable_files": len(_mechanical_files & _all_effort_files),
+            "affected_files": len(_all_effort_files),
+            "recipes": _recipes,
             "hibernate_rewrite_effort_days": round(_hib_effort, 1),
             "hibernate_rewrite_range": (
                 hib.total_effort_range_days if (_hibernate_applies and hib is not None) else None
@@ -1809,7 +1878,20 @@ class MigrationReport:
             f"(critical: {main_crit}, high: {main_high})"
             + (f"   [+{nb} in test/generated, non-blocking]" if nb else ""),
             f"Affected files: {self.summary.get('affected_files', 0)}",
-            f"Estimated effort: {self.estimated_effort_days}d",
+            f"Estimated effort: {self.estimated_effort_days}d"
+            + (
+                f"  ({self.effort_breakdown.get('manual_days', 0)}d manual + "
+                f"{self.effort_breakdown.get('mechanical_days', 0)}d mechanical"
+                + (f" + {self.effort_breakdown.get('hibernate_rewrite_effort_days')}d hibernate"
+                   if self.effort_breakdown.get("hibernate_rewrite_effort_days") else "")
+                + "; validation not estimated)"
+                if self.effort_breakdown else ""
+            ),
+            (
+                f"  {self.effort_breakdown.get('auto_fixable_findings', 0)} findings carry an "
+                f"OpenRewrite recipe — see effort_breakdown.recipes"
+                if self.effort_breakdown.get("auto_fixable_findings") else ""
+            ),
             "",
         ]
 

sourcecode/verify_edit.py

@@ -19,6 +19,7 @@ No public command and no verdict layer yet (those are Fase V1). What it must pro
 """
 from __future__ import annotations
 
+import re
 import shutil
 import subprocess
 import tempfile
@@ -48,6 +49,10 @@ class HeadVsWorking:
     head_sha: str
     head_cache_hit: bool
     timings_ms: dict[str, float] = field(default_factory=dict)
+    #: Changed files that are not code but decide what the code compiles to and how
+    #: it is wired (C3-14). Kept apart from ``changed_files`` because the CIR diff
+    #: cannot reason about them — they make the verdict *unverified*, not *broken*.
+    changed_build_files: tuple[str, ...] = ()
 
 
 # Git env vars that REDIRECT git at where it operates. When verify-edit runs INSIDE a
@@ -98,8 +103,8 @@ def _head_sha(root: Path) -> str:
         return ""
 
 
-def _changed_java_files(root: Path) -> tuple[str, ...]:
-    """`.java` paths that differ from HEAD: tracked diff ∪ untracked adds.
+def _changed_paths(root: Path) -> tuple[str, ...]:
+    """Every path that differs from HEAD: tracked diff ∪ untracked adds.
 
     Deletions are kept (the path is gone but the contract change is real). Pure
     git; never reads file contents.
@@ -114,7 +119,53 @@ def _changed_java_files(root: Path) -> tuple[str, ...]:
             files.update(line.strip() for line in ru.stdout.splitlines() if line.strip())
     except Exception:
         pass
-    return tuple(sorted(f for f in files if f.endswith(".java")))
+    return tuple(sorted(files))
+
+
+def _changed_java_files(root: Path) -> tuple[str, ...]:
+    """The `.java` subset of `_changed_paths` — what the CIR diff can reason about."""
+    return tuple(f for f in _changed_paths(root) if f.endswith(".java"))
+
+
+#: Files that change what the code *means* without being code: the build, the
+#: container contract, the Spring wiring, the configuration a profile resolves.
+#:
+#: C3-14 (field eval #4): an edit to any of these was invisible to `verify-edit`,
+#: which answered `changed_files: []` and `verdict: pass` — a confident green over
+#: a change that can move every source file in the repository at once. Matched on
+#: the file name, never on content, so the check costs nothing.
+_BUILD_FILE_NAMES: frozenset[str] = frozenset({
+    "pom.xml", "build.gradle", "build.gradle.kts",
+    "settings.gradle", "settings.gradle.kts", "gradle.properties",
+    "web.xml", "context.xml", "jboss-web.xml", "beans.xml", "persistence.xml",
+})
+#: Descriptor families matched by prefix + `.xml`: the container contract and the
+#: classic Spring XML wiring.
+_XML_DESCRIPTOR_PREFIXES: tuple[str, ...] = ("weblogic", "jboss-", "applicationcontext")
+#: Config file families that a profile resolves against. Deliberately narrow —
+#: `messages.properties` is text for humans, not wiring.
+_CONFIG_PREFIXES: tuple[str, ...] = ("application", "bootstrap")
+_CONFIG_SUFFIXES: tuple[str, ...] = (".properties", ".yml", ".yaml")
+
+
+def _is_build_config_path(rel_path: str) -> bool:
+    """Admission rule, kept narrow on purpose: every admitted file degrades a verdict
+    to unverified, and a loose rule turns the gate into noise people learn to ignore."""
+    name = rel_path.rsplit("/", 1)[-1].lower()
+    if name in _BUILD_FILE_NAMES:
+        return True
+    if name.endswith(".xml") and (
+        name.endswith("-context.xml") or name.startswith(_XML_DESCRIPTOR_PREFIXES)
+    ):
+        return True
+    if name.endswith(_CONFIG_SUFFIXES) and name.startswith(_CONFIG_PREFIXES):
+        return True
+    return False
+
+
+def _changed_build_files(root: Path) -> tuple[str, ...]:
+    """Changed non-Java files that can alter compilation or runtime wiring."""
+    return tuple(f for f in _changed_paths(root) if _is_build_config_path(f))
 
 
 # ── CIR construction ───────────────────────────────────────────────────────────
@@ -213,7 +264,9 @@ def head_vs_working(path: Path) -> HeadVsWorking:
     timings: dict[str, float] = {}
 
     t0 = time.perf_counter()
-    changed = _changed_java_files(root)
+    all_changed = _changed_paths(root)
+    changed = tuple(f for f in all_changed if f.endswith(".java"))
+    changed_build = tuple(f for f in all_changed if _is_build_config_path(f))
     timings["changed_files_ms"] = (time.perf_counter() - t0) * 1000.0
 
     t1 = time.perf_counter()
@@ -231,6 +284,7 @@ def head_vs_working(path: Path) -> HeadVsWorking:
         head_sha=head_sha,
         head_cache_hit=hit,
         timings_ms=timings,
+        changed_build_files=changed_build,
     )
 
 
@@ -252,7 +306,7 @@ VERDICT_SCHEMA = "verify-edit-v1"
 # no-op (clean) when no rules file exists, so adding it never blocks a repo that has none.
 _BLOCKING_AXES = (
     "contract_broken", "tx_boundary_changed", "security_delta", "new_orphan_bean",
-    "custom_rule_violated",
+    "custom_rule_violated", "build_config_changed",
 )
 
 
@@ -264,6 +318,7 @@ class AxisResult:
     changed: Optional[bool]
     detail: str = ""
     items: tuple[dict, ...] = ()
+    data: dict = field(default_factory=dict)
 
     def to_dict(self) -> dict:
         d: dict = {"changed": self.changed}
@@ -271,6 +326,7 @@ class AxisResult:
             d["detail"] = self.detail
         if self.items:
             d["items"] = list(self.items)
+        d.update(self.data)
         return d
 
 
@@ -279,6 +335,7 @@ class VerifyVerdict:
     verdict: str  # "pass" | "break" | "unverified"
     axes: dict[str, AxisResult]
     changed_files: tuple[str, ...]
+    changed_build_files: tuple[str, ...]
     blast_radius: dict
     reasons: tuple[str, ...]
     exit_code: int
@@ -290,6 +347,7 @@ class VerifyVerdict:
             "verdict": self.verdict,
             "head_sha": self.head_sha,
             "changed_files": list(self.changed_files),
+            "changed_build_files": list(self.changed_build_files),
             "axes": {name: ax.to_dict() for name, ax in self.axes.items()},
             "blast_radius": self.blast_radius,
             "reasons": list(self.reasons),
@@ -451,9 +509,132 @@ def _custom_rules_axis(cir_head: Any, cir_working: Any, root: Path) -> AxisResul
     return AxisResult(False)
 
 
+# ── build configuration (C3-14) ────────────────────────────────────────────────
+_COMPILER_PROPS: tuple[str, ...] = (
+    "java.version", "maven.compiler.release", "maven.compiler.source",
+    "maven.compiler.target",
+)
+_MAVEN_DEP_RE: "re.Pattern[str]" = re.compile(
+    r"<dependency>(.*?)</dependency>", re.DOTALL | re.IGNORECASE
+)
+_MAVEN_FIELD_RE: "re.Pattern[str]" = re.compile(
+    r"<(groupId|artifactId|version)>\s*([^<]+?)\s*</\1>", re.IGNORECASE
+)
+
+
+def _file_at_head(root: Path, rel_path: str) -> Optional[str]:
+    """The HEAD content of a path, or None when it did not exist there."""
+    try:
+        r = _run_git(root, "show", f"HEAD:{rel_path}")
+        return r.stdout if r.returncode == 0 else None
+    except Exception:
+        return None
+
+
+def _maven_property(text: str, name: str) -> Optional[str]:
+    m = re.search(rf"<{re.escape(name)}>\s*([^<]+?)\s*</{re.escape(name)}>", text, re.IGNORECASE)
+    return m.group(1) if m else None
+
+
+def _maven_dependencies(text: str) -> "dict[str, str]":
+    """`groupId:artifactId` → version (or "" when managed elsewhere). A diff input,
+    not an inventory: this answers *what changed in this file*, which is why it does
+    not go through the declared-coordinates authority (that one answers a different
+    question — which client libraries the build declares, allowlisted by kind)."""
+    out: dict[str, str] = {}
+    for block in _MAVEN_DEP_RE.findall(text or ""):
+        fields = {k.lower(): v for k, v in _MAVEN_FIELD_RE.findall(block)}
+        gid, aid = fields.get("groupid"), fields.get("artifactid")
+        if gid and aid:
+            out[f"{gid}:{aid}"] = fields.get("version", "")
+    return out
+
+
+def _build_config_axis(root: Path, changed_build_files: tuple[str, ...]) -> AxisResult:
+    """C3-14: a changed build/config file is a change `verify-edit` cannot decide.
+
+    `changed: None` on purpose. The CIR diff proves nothing about a `pom.xml` edit —
+    it is neither a proven regression (`True`) nor computed-clean (`False`) — so the
+    axis degrades to *unverified* and the verdict follows the machinery that already
+    exists for "could not compute". Answering `pass` was the defect: a compiler-release
+    bump moves every source file in the repository at once, and the gate said nothing
+    changed.
+    """
+    if not changed_build_files:
+        return AxisResult(False, "no build or configuration file changed")
+
+    compiler: dict = {}
+    dependency_delta: list[dict] = []
+    for rel in changed_build_files:
+        if not rel.endswith("pom.xml"):
+            continue
+        before = _file_at_head(root, rel)
+        try:
+            after = (root / rel).read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            after = None
+        if before is None or after is None:
+            continue
+        for prop in _COMPILER_PROPS:
+            was, now = _maven_property(before, prop), _maven_property(after, prop)
+            if was != now:
+                compiler[prop] = {"from": was, "to": now, "file": rel}
+        deps_before, deps_after = _maven_dependencies(before), _maven_dependencies(after)
+        for key in sorted(set(deps_before) | set(deps_after)):
+            if deps_before.get(key) == deps_after.get(key):
+                continue
+            dependency_delta.append({
+                "coordinate": key,
+                "from": deps_before.get(key),
+                "to": deps_after.get(key),
+                "file": rel,
+            })
+
+    detail = f"{len(changed_build_files)} build/configuration file(s) changed; "
+    if compiler:
+        first = next(iter(compiler.values()))
+        detail += f"compiler release {first['from']} → {first['to']}; "
+    if dependency_delta:
+        detail += f"{len(dependency_delta)} dependency change(s); "
+    detail += "effect on runtime behaviour is not decidable from the source diff"
+
+    return AxisResult(
+        None,
+        detail,
+        items=tuple({"file": f} for f in changed_build_files[:20]),
+        data={
+            "files": list(changed_build_files),
+            "effective_compiler_release": compiler or None,
+            "dependency_delta": dependency_delta or None,
+            "blast_note": (
+                "A build or configuration change applies to the whole compilation "
+                "unit, not to a file: its reach is every source file in scope, and "
+                "`verify-edit` does not model it. Verdict degrades to unverified "
+                "(exit 2) rather than passing."
+            ),
+        },
+    )
+
+
 # ── blast radius (reach over the changed files; informational, not a diff) ──────
-def _blast_radius(cir_working: Any, changed_files: tuple[str, ...]) -> dict:
+def _blast_radius(
+    cir_working: Any,
+    changed_files: tuple[str, ...],
+    changed_build_files: tuple[str, ...] = (),
+) -> dict:
     if not changed_files:
+        # C3-14: "no changed files" with high confidence was a lie when the build
+        # changed — the reach of that edit is the whole tree, and it is unmeasured.
+        if changed_build_files:
+            return {
+                "affected_entry_points": None,
+                "confidence": "unknown",
+                "note": (
+                    f"no changed .java files, but {len(changed_build_files)} build/"
+                    "configuration file(s) changed — reach is the whole compilation "
+                    "unit and is not modelled here"
+                ),
+            }
         return {"affected_entry_points": 0, "confidence": "high", "note": "no changed files"}
     try:
         from sourcecode.context_graph import ContextGraph
@@ -487,8 +668,9 @@ def verdict(hvw: HeadVsWorking, root: Path) -> VerifyVerdict:
         "security_delta": _security_axis(hvw.cir_head, hvw.cir_working, root),
         "new_orphan_bean": _orphan_bean_axis(hvw.cir_head, hvw.cir_working),
         "custom_rule_violated": _custom_rules_axis(hvw.cir_head, hvw.cir_working, root),
+        "build_config_changed": _build_config_axis(root, hvw.changed_build_files),
     }
-    blast = _blast_radius(hvw.cir_working, hvw.changed_files)
+    blast = _blast_radius(hvw.cir_working, hvw.changed_files, hvw.changed_build_files)
 
     reasons: list[str] = []
     broke = False
@@ -513,6 +695,7 @@ def verdict(hvw: HeadVsWorking, root: Path) -> VerifyVerdict:
         verdict=verdict_str,
         axes=axes,
         changed_files=hvw.changed_files,
+        changed_build_files=hvw.changed_build_files,
         blast_radius=blast,
         reasons=tuple(reasons),
         exit_code=code,

{sourcecode-3.2.2.dist-info → sourcecode-3.4.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 3.2.2
+Version: 3.4.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -283,10 +283,13 @@ Honest limits worth knowing before you rely on it:
 > full Pro entitlements — no size gate, no key. The tiers below describe the model the
 > paywall will return to later.
 >
-> **What that means concretely.** `ask auth status` reports `"status": "unauthenticated"`
-> together with `"pro": true`, `"pro_reason": "early-adoption unlock"` — that combination is
-> expected, not a bug: you are unauthenticated *and* unlocked. When the unlock ends, gating
-> returns **by repo size and automation, never by command**: `posture`, `endpoints`,
+> **What that means concretely.** Ask the product: `ask auth status` answers in one block —
+> `entitlement` (what runs today), `source` (*why* — a licence, the unlock, or the free tier),
+> `authenticated` (whether a credential exists, which is a separate fact) and
+> `when_it_changes` (what you lose when that source stops applying). A fresh install reads
+> `entitlement: pro`, `source: early_adoption_unlock`, `authenticated: false` — unauthenticated
+> *and* entitled, stated as two facts instead of one contradiction. When the unlock ends,
+> gating returns **by repo size and automation, never by command**: `posture`, `endpoints`,
 > `spring-audit` and `migrate-check` stay in the base tier at full output. Nothing you can run
 > today becomes a paid-only command tomorrow.
 

{sourcecode-3.2.2.dist-info → sourcecode-3.4.0.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=U82Z_Ox36oAqoNY_hG72f5nWmFp6G5hZFIJetg0zXsI,308
+sourcecode/__init__.py,sha256=BJYzzs2-t47FGMhqR8simvGdbEj3lwxxqRiN1D-DvaM,308
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/archetype.py,sha256=qWMCyL2UzSGXJhCIZj38JjS7wI15EE3eILsWiaoCZXQ,35779
 sourcecode/architectural_baseline.py,sha256=7QzJri4pbL3nzAn9gNutZW6mZR8HHD6H2C2H1EEwYPE,17904
@@ -15,7 +15,7 @@ sourcecode/chain_rules.py,sha256=Bi6UHfgd-GxWswmnHRcPz5jdbAuqka3Zkz_P-MTvqhw,127
 sourcecode/change_plan.py,sha256=MNgNyu4zrLGvBBaXPwyCh-T2ZGaUQX3Hm4W87uuhZ3w,7750
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=kXMCuDtQtL5Px8cHHsSPwgfB9S31mxoGJk84nOQ3vHA,411359
+sourcecode/cli.py,sha256=roM8n8UVzNYbDEhDHYB8DqzKXmGr8U1yWuwrTUhex-U,412075
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=jdePg0dNCxFpysiTGMsROL5XABLjy_zVUgVeySvdb0o,7514
 sourcecode/confidence_analyzer.py,sha256=_nvtwO6RM3k0JMuH5m7DsBxOD0PdxGFS4Bb1fTQ536E,21946
@@ -51,10 +51,10 @@ sourcecode/graph_evidence.py,sha256=rENNsYRZeNstX_ExNCLlbHJAruFQwxo5d00x6wO3xwI,
 sourcecode/hibernate_strat.py,sha256=5GmHiB865HxKdvaxeFV07ojglUgxyOP41AY2xiHfV30,61700
 sourcecode/integration_coordinates.py,sha256=7vGFxN4tCn_KTisYFJuixa8XkyHBoasEFB3fqM62OBI,7407
 sourcecode/jdk_exports.py,sha256=fCrlwNAXUT9gge_joq6kMnY3zJxYB2pxqy-0w3o3MJI,874
-sourcecode/license.py,sha256=OwLh4x1gU_iGL69zFKAgsnwHO2yx9jBsCOK_WK7CUUw,24907
+sourcecode/license.py,sha256=vvgE1vBUWh8ozWI7USYuteh6noxntnjuzDQIPF-l4rA,27795
 sourcecode/mcp_nudge.py,sha256=lKemOqK_wny2u7Ymcr2Idi5Kx8pXY02jCi-_nJYLGMg,2992
 sourcecode/metrics_analyzer.py,sha256=gLoRWKygF18jLgwsqmGXSWopw-f5iO1VbM7Jjdif6ag,22809
-sourcecode/migrate_check.py,sha256=TJvaShbglENOr8ikvCodnlXQy54TtT05N2ZVe02b3lc,110421
+sourcecode/migrate_check.py,sha256=bI2ZseCM5xlrXMvZTKtpPcfkK5EbUGHHhYNUo5l2voc,115427
 sourcecode/migration_blast.py,sha256=5qUsUi4n0cwBKltdJYyvyfhBkGENAYjB-d_7LZtnVks,9282
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
 sourcecode/output_budget.py,sha256=Js9yUlfQtPhqBl9R6wn_9UHVjjJc3GtLcqyfjf5t50Q,9869
@@ -102,7 +102,7 @@ sourcecode/tree_utils.py,sha256=8GAkIfQAsvtEudIeW1l4ooH_oRtrWR8cpJQJsEa_Pfw,2093
 sourcecode/type_usage_surface.py,sha256=51IrKRQoIoRnlsiDjHnqpJBn2rc6E59aRhgS0HTzAF0,4428
 sourcecode/validation_inference.py,sha256=yd2TSuh-hhdF0vdBB63ffkbPn1vEUp896K2tAKkNogM,19508
 sourcecode/validation_surface.py,sha256=jYL-hkDjaaRKkAt7ZUcbxm3Dydl8o6KVRhTkuPXKPVc,31460
-sourcecode/verify_edit.py,sha256=LFk5CRste11GwNUTUrTGxoQpmQhy4Qoqd7NdhGq1weA,26190
+sourcecode/verify_edit.py,sha256=ZakJc7Bnh7e6dX3XtS3uDWaButLMCQ22MTkPP4wYyeg,34523
 sourcecode/verify_repo.py,sha256=XpyofGahvs9y7uJEy_axqEQdXpmR41WsWw7GJqs8vQ4,9440
 sourcecode/verify_rules.py,sha256=vX0YADEI78J8-tjRTtRhe2pZP0x7K_qvS1EypuqD3KQ,18011
 sourcecode/version_check.py,sha256=CHp6ZxTIfo8kyHPCBgJA1uFC0xQCoXMuuOfrW8QTL8o,4942
@@ -165,8 +165,8 @@ sourcecode/telemetry/consent.py,sha256=pQdl-QeLl6Gcibn0eWHSKZrm-HYSsjpVqOnjrgFp8
 sourcecode/telemetry/events.py,sha256=4_yeO58U-Cwc1Qb27VB0_EjhmroY0k91n3_VGxeALB8,2776
 sourcecode/telemetry/filters.py,sha256=RzxauTz8HliO4BllQnXEXc7zTeqdCZi5MgqGEDuW7OQ,6570
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-3.2.2.dist-info/METADATA,sha256=jVS3W1ZhWUoj34fE8GVEeg4w8CmEPhtAxCpuJ-qIEV4,19406
-sourcecode-3.2.2.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-3.2.2.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-3.2.2.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-3.2.2.dist-info/RECORD,,
+sourcecode-3.4.0.dist-info/METADATA,sha256=Jya4xGSyUpcnOk7Oqip8LL0NO-6LzNxaJXTWKq8Hq4A,19684
+sourcecode-3.4.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-3.4.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-3.4.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-3.4.0.dist-info/RECORD,,