sourcecode 3.2.2__tar.gz → 3.4.0__tar.gz

{sourcecode-3.2.2 → sourcecode-3.4.0}/CHANGELOG.md

@@ -2,6 +2,109 @@
 
 ## [Unreleased]
 
+## [3.4.0] — 2026-07-29
+
+**Two of the five reconciliation gates, and one commercial surface that answered five ways.**
+The theme of field evaluation #4 was not missing analysis: it was analysis the product had
+already done and did not consult — a migration estimate that ignored its own
+`auto_fix_available`, and a gate that reported `pass` for a file it never looked at.
+
+**A minor, not a patch, and for one reason: `verify-edit` can now exit 2 where it exited 0.**
+No API changed, but a build-configuration-only edit stops being a green light, so an installed
+hook or a pipeline that gates on the exit code will start blocking on it. A patch release must
+never be able to turn a green pipeline red.
+
+**Upgrade notes.**
+
+- `verify-edit`: a change to `pom.xml`, `build.gradle`, `application*.yml`, `web.xml` or a
+  container descriptor now yields `unverified` (exit 2). `git commit --no-verify` and
+  `ask verify-edit --no-ci` are the escape hatches.
+- `migrate-check`: published effort numbers **move down** — the same work, split by what it
+  actually is. Measured: openmrs-core 122.1 → 76.4 d, BroadleafCommerce 163.3 → 157.7,
+  alfresco 22.8 → 5.2. `blocking_count` and `readiness_score` are unchanged.
+- `auth status`: new authoritative fields; `pro`, `pro_effective`, `pro_gating` and `pro_reason`
+  still ship, now derived from the authority and listed in `deprecated_fields`.
+
+### Fixed
+
+- **`verify-edit` sees the files that decide what the code compiles to** (C3-14, the second
+  reconciliation gate). Editing a `pom.xml` produced `changed_files: []`, `verdict: pass`,
+  `exit_code: 0` — and `blast_radius: {"confidence": "high", "note": "no changed files"}`.
+  git reported the file; the gate did not look at it, then said everything was fine about a
+  change that moves every source file in the repository at once.
+  - New blocking axis **`build_config_changed`**, and a new `changed_build_files` list beside
+    `changed_files`. It names what moved: `effective_compiler_release` (from → to) and
+    `dependency_delta` per coordinate.
+  - **The verdict is `unverified`, not `break`.** A build edit is neither a proven regression
+    nor computed-clean, which is exactly what `changed: null` has always meant here — so it
+    flows through the existing "could not compute" path and exits 2. No special case.
+  - Admission is by file name and deliberately narrow — `pom.xml`, `build.gradle`,
+    `settings.gradle`, `gradle.properties`, `application*.yml|properties`, `bootstrap*`,
+    `web.xml`, `weblogic*.xml`, `jboss-*.xml`, `*-context.xml`, `persistence.xml`, `beans.xml`.
+    `messages.properties` and `logback.xml` are out: every admitted file degrades a verdict, and
+    a loose rule turns the gate into noise people learn to ignore.
+  - `blast_radius` stops reporting `confidence: "high"` over a change whose reach it has not
+    measured.
+  - **Upgrade note (behaviour change):** a build-configuration-only edit now exits **2**
+    (unverified) where it exited 0 (pass). An installed pre-commit/pre-push hook will block on
+    such an edit; `git commit --no-verify` remains the escape hatch, and `--no-ci` still reports
+    without gating.
+
+### Changed
+
+- **The migration estimate reads the report's own `auto_fix_available`** (C1-11, the first of
+  the five reconciliation gates from field evaluation #4). `migrate-check` shipped an
+  OpenRewrite recipe for most findings and then billed every one of them at the hand-edit rate.
+  Reproduced on the battery before fixing: **openmrs-core carries a recipe for 296 of 310
+  findings and costed all 310 as hand work**, for a headline of 122.1 person-days.
+  - `effort_breakdown` splits the same total into **`manual_days`** + **`mechanical_days`** +
+    `hibernate_rewrite_effort_days`. The partition is **by file**, because the severity weights
+    are per file: a file is mechanical only when *every* finding in it has a recipe, and one
+    unautomatable finding costs the whole file manually — a human is in that file either way.
+  - **The review factor is published, not buried.** `mechanical_review_factor` (0.2) carries
+    `mechanical_review_factor_basis: "assumption, not a measurement"`, so a team can substitute
+    their own number instead of inheriting ours silently. `recipes[]` lists what would run and
+    `mechanical_basis` states both denominators.
+  - **`validation_days` is `null` with a note, never `0`** — the re-test scope is a different
+    measurement (`migrate-check --blast-radius`), and `0` would read as "no re-testing needed"
+    (invariant I-3).
+  - **Published numbers move.** Measured: openmrs-core 122.1 → **76.4 d**, BroadleafCommerce
+    163.3 → **157.7 d**, alfresco 22.8 → **5.2 d**. `blocking_count` and `readiness_score` are
+    unchanged in all three — the split changes what the work is called, never what blocks.
+
+- **`ask auth status` answers one question instead of five** (P-2). It used to publish
+  `{"status": "unauthenticated", "pro": true, "pro_reason": "early-adoption unlock"}` — every
+  field true on its own axis, and together unreadable: a buyer could not tell what they have,
+  why they have it, or what changes when it ends.
+  - One authority, `license.entitlement()`, now answers it: **`entitlement`** (`pro`/`free` —
+    what runs today), **`source`** (why: `license_key`, `early_adoption_unlock`, `free_tier`),
+    **`authenticated`** (whether a credential exists here — a *separate* fact, since today one
+    can be entitled without one), **`paywall_active`**, **`when_it_changes`** (what you lose
+    when that source stops applying) and **`free_repo_java_file_limit`** (the number the gate
+    actually compares against).
+  - `when_it_changes` states the gate in the terms the gate uses and **never quotes a price** —
+    pricing lives in `docs/PRODUCT_TIERS.md`, and a number printed here would be stale the day
+    it moves. Asserted.
+  - **`is_pro` is derived from the same authority.** It is what every gate reads
+    (`can_use`, `require_feature`), and it used to be computed beside the status block rather
+    than from it — which is how a status page came to contradict the commands next to it.
+  - `pro`, `pro_effective`, `pro_gating` and `pro_reason` are still emitted for existing
+    consumers, are derived from the authority (so they cannot drift), and are listed in the new
+    `deprecated_fields`. They are removed in a future major.
+  - `plan_status` no longer reports `unknown` for a licence file with no explicit status while
+    the authority reads that same file as active.
+
+## [3.3.0] — 2026-07-29
+
+**A default you must remember to disable is the wrong default for someone else's code.**
+Telemetry moves from opt-out to opt-in. A minor and not a patch: no API changed, but a default
+about data leaving the machine did, and that is a change a user must be told about rather than
+discover.
+
+**Upgrade note.** If you ever ran `ask telemetry enable` or `ask telemetry disable`, nothing
+changes for you — your choice is on record and is honoured. If you never chose, telemetry is
+now off and `ask telemetry enable` is how you turn it on.
+
 ### Changed
 
 - **Telemetry is opt-in** (P-1). It was opt-out; with no explicit choice on record, nothing is

{sourcecode-3.2.2 → sourcecode-3.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 3.2.2
+Version: 3.4.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -283,10 +283,13 @@ Honest limits worth knowing before you rely on it:
 > full Pro entitlements — no size gate, no key. The tiers below describe the model the
 > paywall will return to later.
 >
-> **What that means concretely.** `ask auth status` reports `"status": "unauthenticated"`
-> together with `"pro": true`, `"pro_reason": "early-adoption unlock"` — that combination is
-> expected, not a bug: you are unauthenticated *and* unlocked. When the unlock ends, gating
-> returns **by repo size and automation, never by command**: `posture`, `endpoints`,
+> **What that means concretely.** Ask the product: `ask auth status` answers in one block —
+> `entitlement` (what runs today), `source` (*why* — a licence, the unlock, or the free tier),
+> `authenticated` (whether a credential exists, which is a separate fact) and
+> `when_it_changes` (what you lose when that source stops applying). A fresh install reads
+> `entitlement: pro`, `source: early_adoption_unlock`, `authenticated: false` — unauthenticated
+> *and* entitled, stated as two facts instead of one contradiction. When the unlock ends,
+> gating returns **by repo size and automation, never by command**: `posture`, `endpoints`,
 > `spring-audit` and `migrate-check` stay in the base tier at full output. Nothing you can run
 > today becomes a paid-only command tomorrow.
 

{sourcecode-3.2.2 → sourcecode-3.4.0}/README.md

@@ -245,10 +245,13 @@ Honest limits worth knowing before you rely on it:
 > full Pro entitlements — no size gate, no key. The tiers below describe the model the
 > paywall will return to later.
 >
-> **What that means concretely.** `ask auth status` reports `"status": "unauthenticated"`
-> together with `"pro": true`, `"pro_reason": "early-adoption unlock"` — that combination is
-> expected, not a bug: you are unauthenticated *and* unlocked. When the unlock ends, gating
-> returns **by repo size and automation, never by command**: `posture`, `endpoints`,
+> **What that means concretely.** Ask the product: `ask auth status` answers in one block —
+> `entitlement` (what runs today), `source` (*why* — a licence, the unlock, or the free tier),
+> `authenticated` (whether a credential exists, which is a separate fact) and
+> `when_it_changes` (what you lose when that source stops applying). A fresh install reads
+> `entitlement: pro`, `source: early_adoption_unlock`, `authenticated: false` — unauthenticated
+> *and* entitled, stated as two facts instead of one contradiction. When the unlock ends,
+> gating returns **by repo size and automation, never by command**: `posture`, `endpoints`,
 > `spring-audit` and `migrate-check` stay in the base tier at full output. Nothing you can run
 > today becomes a paid-only command tomorrow.
 

{sourcecode-3.2.2 → sourcecode-3.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "3.2.2"
+version = "3.4.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-3.2.2 → sourcecode-3.4.0}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "3.2.2"
+__version__ = "3.4.0"

{sourcecode-3.2.2 → sourcecode-3.4.0}/src/sourcecode/cli.py

@@ -6106,9 +6106,14 @@ def verify_edit_cmd(
 
     Deterministic, in-loop verdict over the diff of the working tree against HEAD:
     public contract, @Transactional proxy boundary, security surface, bean wiring,
-    custom domain rules, and blast radius. Built for the agent write-loop (MCP) and
-    git hooks. Only regressions the edit INTRODUCED (vs HEAD) block — pre-existing
-    debt never fails an unrelated commit.
+    custom domain rules, build/configuration changes, and blast radius. Built for the
+    agent write-loop (MCP) and git hooks. Only regressions the edit INTRODUCED (vs
+    HEAD) block — pre-existing debt never fails an unrelated commit.
+
+    Build and configuration files (pom.xml, build.gradle, application*.yml, web.xml,
+    container descriptors, Spring XML) are reported under `changed_build_files` and
+    make the verdict UNVERIFIED, never `pass`: their effect is not decidable from a
+    source diff, and a compiler-release bump moves every file in the repo at once.
 
     Custom rules: drop a `.ask/verify-rules.json` at the repo root to enforce your own
     invariants (e.g. "no @RestController injects a *DaoJpa", "every /payroll endpoint
@@ -8105,47 +8110,44 @@ def auth_status_cmd() -> None:
     """Show current authentication and plan status."""
     import json as _json
     try:
-        from sourcecode.license import (
-            _PRO_UNLOCK_ALL as _unlock,
-            _license_data as _ld,
-            is_pro as _ip,
-        )
+        from sourcecode.license import _license_data as _ld, entitlement as _entitlement
+        _ent = _entitlement()
     except Exception:
         _ld = None
-        _ip = False
-        _unlock = False
-
-    # While the early-adoption unlock is on, every Pro command runs. Reporting
-    # `pro: false` here contradicted the --help header and the commands' own
-    # behaviour: the status has to describe the gating that is actually in force,
-    # not the credential that happens to be absent.
-    _gating = {
-        "pro_gating": "disabled" if _unlock else "enabled",
-        "pro_effective": bool(_ip or _unlock),
-    }
-    if _unlock:
-        _gating["pro_reason"] = "early-adoption unlock: Pro commands run without a license"
-
-    if not _ld:
-        out: dict = {
-            "status": "unauthenticated",
-            "pro": bool(_unlock),
-            **_gating,
+        _ent = {
+            "entitlement": "free", "source": "free_tier", "authenticated": False,
+            "paywall_active": True, "when_it_changes": "", "free_repo_java_file_limit": None,
         }
-        sys.stdout.write(_json.dumps(out, ensure_ascii=False) + "\n")
-        sys.stdout.flush()
-        return
 
-    out = {
-        "status": "authenticated",
-        "auth_method": _ld.get("auth_method", "license_key"),
-        "email": _ld.get("email", ""),
-        "plan": _ld.get("plan", "unknown"),
-        "plan_status": _ld.get("status", "unknown"),
-        "pro": _ip,
-        "validated_at": _ld.get("validated_at") or _ld.get("activated_at") or "",
-        **_gating,
+    # P-2: one authority (`license.entitlement`) answers "what runs here, and why".
+    # The legacy keys below are *derived* from it rather than computed a second
+    # time — that is what stops `{"status": "unauthenticated", "pro": true}` from
+    # reappearing. They are deprecated and will be removed in a future major.
+    _pro = _ent["entitlement"] == "pro"
+    _legacy = {
+        "pro": _pro,
+        "pro_effective": _pro,
+        "pro_gating": "enabled" if _ent["paywall_active"] else "disabled",
+    }
+    if _ent["source"] == "early_adoption_unlock":
+        _legacy["pro_reason"] = "early-adoption unlock: Pro commands run without a license"
+
+    out: dict = {
+        "status": "authenticated" if _ent["authenticated"] else "unauthenticated",
+        **_ent,
+        **_legacy,
+        "deprecated_fields": ["pro", "pro_effective", "pro_gating", "pro_reason"],
     }
+    if _ld:
+        out.update({
+            "auth_method": _ld.get("auth_method", "license_key"),
+            "email": _ld.get("email", ""),
+            "plan": _ld.get("plan", "unknown"),
+            # The authority reads a missing status as active, so reporting
+            # "unknown" here would contradict the entitlement in the same object.
+            "plan_status": _ld.get("status", "active"),
+            "validated_at": _ld.get("validated_at") or _ld.get("activated_at") or "",
+        })
     sys.stdout.write(_json.dumps(out, indent=2, ensure_ascii=False) + "\n")
     sys.stdout.flush()
 

{sourcecode-3.2.2 → sourcecode-3.4.0}/src/sourcecode/license.py

@@ -376,16 +376,78 @@ def _maybe_revalidate() -> None:
         pass
 
 
-def _init() -> None:
-    global _license_data, is_pro
-    _license_data = _load_license_file()
-    is_pro = (
+def entitlement() -> dict:
+    """The one answer to "what runs here today, and why" (P-2).
+
+    `auth status` used to publish four fields about this — `status`, `pro`,
+    `pro_gating`, `pro_effective`, plus a `pro_reason` sentence — and they read as
+    a contradiction: `{"status": "unauthenticated", "pro": true}`. Each field was
+    true on its own axis; together they told a buyer nothing about what they have,
+    why they have it, or what changes when it ends. That is the ADR-0008 pattern
+    exactly, on the commercial surface instead of an analysis one.
+
+    Every published entitlement field is derived from this dict and nowhere else.
+
+    Keys:
+      entitlement        "pro" | "free" — what actually runs right now
+      source             why: "license_key" | "early_adoption_unlock" | "free_tier"
+      authenticated      whether a credential is on this machine (an independent
+                         fact: today one can be entitled to Pro without one)
+      paywall_active     whether the paywall is enforcing anything at all
+      when_it_changes    what a user loses when `source` stops applying, in the
+                         terms the gate actually uses — never a price
+      free_repo_java_file_limit
+                         the number the size gate compares against
+    """
+    authenticated = _license_data is not None
+    licensed = bool(
         _license_data is not None
         and _license_data.get("plan") == "pro"
         and _license_data.get("status", "active") != "inactive"
     )
-    if _PRO_UNLOCK_ALL:
-        is_pro = True  # TEMPORARY: early-adoption Pro unlock (see _PRO_UNLOCK_ALL)
+    if licensed:
+        source = "license_key"
+    elif _PRO_UNLOCK_ALL:
+        source = "early_adoption_unlock"
+    else:
+        source = "free_tier"
+
+    if source == "license_key":
+        when = "Your licence entitles you to Pro; nothing changes while it stays active."
+    elif source == "early_adoption_unlock":
+        when = (
+            "Pro runs without a licence during early adoption. When that ends, every command "
+            f"still runs at full output on repositories up to {_FREE_REPO_JAVA_FILE_LIMIT} Java "
+            "source files; above that, the heavy-analysis commands ask for Pro. Capability is "
+            "never what is gated — size, automation and team are."
+        )
+    else:
+        when = (
+            f"Every command runs at full output on repositories up to {_FREE_REPO_JAVA_FILE_LIMIT} "
+            "Java source files. Above that, the heavy-analysis commands require Pro."
+        )
+
+    return {
+        "entitlement": "pro" if (licensed or _PRO_UNLOCK_ALL) else "free",
+        "source": source,
+        "authenticated": authenticated,
+        "paywall_active": not _PRO_UNLOCK_ALL,
+        "when_it_changes": when,
+        "free_repo_java_file_limit": _FREE_REPO_JAVA_FILE_LIMIT,
+    }
+
+
+def _init() -> None:
+    """Load the credential and derive the entitlement from the one authority.
+
+    `is_pro` is what every gate reads (`can_use`, `require_feature`), and it is
+    computed here from `entitlement()` rather than beside it — a second copy of
+    this rule is how `auth status` came to publish a state the commands
+    contradicted (P-2).
+    """
+    global _license_data, is_pro
+    _license_data = _load_license_file()
+    is_pro = entitlement()["entitlement"] == "pro"
 
 
 _init()

{sourcecode-3.2.2 → sourcecode-3.4.0}/src/sourcecode/migrate_check.py

@@ -765,6 +765,15 @@ _BOOT3_MIGRATION_TARGETS: frozenset[str] = frozenset(
 # reported as a separate hygiene metric, excluded from JDK-modernization scoring.
 _BEST_PRACTICE_TARGETS: frozenset[str] = frozenset({"java_8_best_practice"})
 
+#: What a file costs when every finding in it has an OpenRewrite recipe, as a
+#: fraction of the hand-edit rate (C1-11). The recipe does not remove the work —
+#: it turns editing into running one recipe and reviewing the diff.
+#:
+#: This is an **assumption, not a measurement**, and it is published as a field
+#: (`effort_breakdown.mechanical_review_factor`) with that label so a reader can
+#: substitute their own team's number instead of inheriting ours silently.
+_MECHANICAL_REVIEW_FACTOR: float = 0.2
+
 # BUG #3: the migration dimensions that feed the readiness_score aggregate, in
 # order. jdk_modernization is deliberately NOT here — it is orthogonal upkeep debt
 # reported on its own axis, never folded into the migration headline.
@@ -1625,12 +1634,45 @@ class MigrationReport:
 
         # BUG #5: effort over MAIN findings only — N/A axes (Hibernate-6 phantom,
         # test fixtures) no longer pad the estimate.
-        _file_effort = (
-            len(critical_files) * 0.5
-            + len(high_files) * 0.25
-            + len(medium_files) * 0.1
-            + len(low_files) * 0.05
-        )
+        #
+        # C1-11 (field eval #4): the estimate used to bill every file at the
+        # hand-edit rate while the report itself shipped an OpenRewrite recipe for
+        # most of the findings in it — on openmrs, 296 of 310 findings carry
+        # `auto_fix_available: true` and all 310 were costed as hand work. A number
+        # that contradicts a field in the same payload is the ADR-0008 defect, so
+        # the estimate now reads that field.
+        #
+        # The unit is the file, because the weights below are per file: a file is
+        # mechanical only when EVERY main finding in it carries a recipe. One
+        # unautomatable finding puts a human in the file, and the rest of that
+        # file's work comes with them.
+        _findings_by_file: "dict[str, list[MigrationFinding]]" = {}
+        for f in main_findings:
+            _findings_by_file.setdefault(f.source_file, []).append(f)
+        _mechanical_files = {
+            path for path, items in _findings_by_file.items()
+            if items and all(bool(i.openrewrite_recipe) for i in items)
+        }
+
+        def _weighted(files: "set[str]") -> float:
+            return (
+                len(critical_files & files) * 0.5
+                + len(high_files & files) * 0.25
+                + len(medium_files & files) * 0.1
+                + len(low_files & files) * 0.05
+            )
+
+        _all_effort_files = critical_files | high_files | medium_files | low_files
+        _manual_effort = _weighted(_all_effort_files - _mechanical_files)
+        # A recipe does not remove the work, it changes what the work is: run the
+        # recipe once, then review the diff. Reviewing is charged at a fraction of
+        # editing. The fraction is an assumption, not a measurement, so it is
+        # published as a field rather than buried in this expression.
+        _mechanical_raw = _weighted(_all_effort_files & _mechanical_files)
+        _mechanical_effort = _mechanical_raw * _MECHANICAL_REVIEW_FACTOR
+        _file_effort = _manual_effort + _mechanical_effort
+        _auto_fixable = sum(1 for f in main_findings if f.openrewrite_recipe)
+        _recipes = sorted({f.openrewrite_recipe for f in main_findings if f.openrewrite_recipe})
         # BUG #1 (v1.70.0): when the Hibernate 5→6 axis APPLIES, fold its measured
         # rewrite effort (risk_matrix → total_effort_range_days) into the headline
         # estimate. Previously a Hibernate-5 project whose ${hibernateVersion} was
@@ -1646,6 +1688,33 @@ class MigrationReport:
         self.estimated_effort_days = round(_file_effort + _hib_effort, 1)
         self.effort_breakdown = {
             "findings_effort_days": round(_file_effort, 1),
+            # C1-11: the same total, split by what the work actually is.
+            "mechanical_days": round(_mechanical_effort, 1),
+            "manual_days": round(_manual_effort, 1),
+            # Not estimated rather than estimated at zero: the re-test scope is a
+            # different measurement (which endpoints the changed files reach), and
+            # `migrate-check --blast-radius` is what produces it. I-3: a fact that
+            # cannot be decided says so.
+            "validation_days": None,
+            "validation_days_note": (
+                "Not estimated here — the re-test scope is the endpoints the changed "
+                "files reach. Run `migrate-check --blast-radius` for that ordering."
+            ),
+            "mechanical_basis": (
+                f"{_auto_fixable} of {len(main_findings)} findings carry an OpenRewrite "
+                f"recipe; {len(_mechanical_files & _all_effort_files)} of "
+                f"{len(_all_effort_files)} affected files have a recipe for *every* "
+                f"finding in them and are costed at {_MECHANICAL_REVIEW_FACTOR:g}× the "
+                "hand-edit rate (run the recipe, review the diff). A file with one "
+                "unautomatable finding is costed manually in full — a human is in that "
+                "file either way."
+            ),
+            "mechanical_review_factor": _MECHANICAL_REVIEW_FACTOR,
+            "mechanical_review_factor_basis": "assumption, not a measurement",
+            "auto_fixable_findings": _auto_fixable,
+            "auto_fixable_files": len(_mechanical_files & _all_effort_files),
+            "affected_files": len(_all_effort_files),
+            "recipes": _recipes,
             "hibernate_rewrite_effort_days": round(_hib_effort, 1),
             "hibernate_rewrite_range": (
                 hib.total_effort_range_days if (_hibernate_applies and hib is not None) else None
@@ -1809,7 +1878,20 @@ class MigrationReport:
             f"(critical: {main_crit}, high: {main_high})"
             + (f"   [+{nb} in test/generated, non-blocking]" if nb else ""),
             f"Affected files: {self.summary.get('affected_files', 0)}",
-            f"Estimated effort: {self.estimated_effort_days}d",
+            f"Estimated effort: {self.estimated_effort_days}d"
+            + (
+                f"  ({self.effort_breakdown.get('manual_days', 0)}d manual + "
+                f"{self.effort_breakdown.get('mechanical_days', 0)}d mechanical"
+                + (f" + {self.effort_breakdown.get('hibernate_rewrite_effort_days')}d hibernate"
+                   if self.effort_breakdown.get("hibernate_rewrite_effort_days") else "")
+                + "; validation not estimated)"
+                if self.effort_breakdown else ""
+            ),
+            (
+                f"  {self.effort_breakdown.get('auto_fixable_findings', 0)} findings carry an "
+                f"OpenRewrite recipe — see effort_breakdown.recipes"
+                if self.effort_breakdown.get("auto_fixable_findings") else ""
+            ),
             "",
         ]