sourcecode 3.3.0__tar.gz → 3.4.0__tar.gz

{sourcecode-3.3.0 → sourcecode-3.4.0}/CHANGELOG.md

@@ -2,6 +2,98 @@
 
 ## [Unreleased]
 
+## [3.4.0] — 2026-07-29
+
+**Two of the five reconciliation gates, and one commercial surface that answered five ways.**
+The theme of field evaluation #4 was not missing analysis: it was analysis the product had
+already done and did not consult — a migration estimate that ignored its own
+`auto_fix_available`, and a gate that reported `pass` for a file it never looked at.
+
+**A minor, not a patch, and for one reason: `verify-edit` can now exit 2 where it exited 0.**
+No API changed, but a build-configuration-only edit stops being a green light, so an installed
+hook or a pipeline that gates on the exit code will start blocking on it. A patch release must
+never be able to turn a green pipeline red.
+
+**Upgrade notes.**
+
+- `verify-edit`: a change to `pom.xml`, `build.gradle`, `application*.yml`, `web.xml` or a
+  container descriptor now yields `unverified` (exit 2). `git commit --no-verify` and
+  `ask verify-edit --no-ci` are the escape hatches.
+- `migrate-check`: published effort numbers **move down** — the same work, split by what it
+  actually is. Measured: openmrs-core 122.1 → 76.4 d, BroadleafCommerce 163.3 → 157.7,
+  alfresco 22.8 → 5.2. `blocking_count` and `readiness_score` are unchanged.
+- `auth status`: new authoritative fields; `pro`, `pro_effective`, `pro_gating` and `pro_reason`
+  still ship, now derived from the authority and listed in `deprecated_fields`.
+
+### Fixed
+
+- **`verify-edit` sees the files that decide what the code compiles to** (C3-14, the second
+  reconciliation gate). Editing a `pom.xml` produced `changed_files: []`, `verdict: pass`,
+  `exit_code: 0` — and `blast_radius: {"confidence": "high", "note": "no changed files"}`.
+  git reported the file; the gate did not look at it, then said everything was fine about a
+  change that moves every source file in the repository at once.
+  - New blocking axis **`build_config_changed`**, and a new `changed_build_files` list beside
+    `changed_files`. It names what moved: `effective_compiler_release` (from → to) and
+    `dependency_delta` per coordinate.
+  - **The verdict is `unverified`, not `break`.** A build edit is neither a proven regression
+    nor computed-clean, which is exactly what `changed: null` has always meant here — so it
+    flows through the existing "could not compute" path and exits 2. No special case.
+  - Admission is by file name and deliberately narrow — `pom.xml`, `build.gradle`,
+    `settings.gradle`, `gradle.properties`, `application*.yml|properties`, `bootstrap*`,
+    `web.xml`, `weblogic*.xml`, `jboss-*.xml`, `*-context.xml`, `persistence.xml`, `beans.xml`.
+    `messages.properties` and `logback.xml` are out: every admitted file degrades a verdict, and
+    a loose rule turns the gate into noise people learn to ignore.
+  - `blast_radius` stops reporting `confidence: "high"` over a change whose reach it has not
+    measured.
+  - **Upgrade note (behaviour change):** a build-configuration-only edit now exits **2**
+    (unverified) where it exited 0 (pass). An installed pre-commit/pre-push hook will block on
+    such an edit; `git commit --no-verify` remains the escape hatch, and `--no-ci` still reports
+    without gating.
+
+### Changed
+
+- **The migration estimate reads the report's own `auto_fix_available`** (C1-11, the first of
+  the five reconciliation gates from field evaluation #4). `migrate-check` shipped an
+  OpenRewrite recipe for most findings and then billed every one of them at the hand-edit rate.
+  Reproduced on the battery before fixing: **openmrs-core carries a recipe for 296 of 310
+  findings and costed all 310 as hand work**, for a headline of 122.1 person-days.
+  - `effort_breakdown` splits the same total into **`manual_days`** + **`mechanical_days`** +
+    `hibernate_rewrite_effort_days`. The partition is **by file**, because the severity weights
+    are per file: a file is mechanical only when *every* finding in it has a recipe, and one
+    unautomatable finding costs the whole file manually — a human is in that file either way.
+  - **The review factor is published, not buried.** `mechanical_review_factor` (0.2) carries
+    `mechanical_review_factor_basis: "assumption, not a measurement"`, so a team can substitute
+    their own number instead of inheriting ours silently. `recipes[]` lists what would run and
+    `mechanical_basis` states both denominators.
+  - **`validation_days` is `null` with a note, never `0`** — the re-test scope is a different
+    measurement (`migrate-check --blast-radius`), and `0` would read as "no re-testing needed"
+    (invariant I-3).
+  - **Published numbers move.** Measured: openmrs-core 122.1 → **76.4 d**, BroadleafCommerce
+    163.3 → **157.7 d**, alfresco 22.8 → **5.2 d**. `blocking_count` and `readiness_score` are
+    unchanged in all three — the split changes what the work is called, never what blocks.
+
+- **`ask auth status` answers one question instead of five** (P-2). It used to publish
+  `{"status": "unauthenticated", "pro": true, "pro_reason": "early-adoption unlock"}` — every
+  field true on its own axis, and together unreadable: a buyer could not tell what they have,
+  why they have it, or what changes when it ends.
+  - One authority, `license.entitlement()`, now answers it: **`entitlement`** (`pro`/`free` —
+    what runs today), **`source`** (why: `license_key`, `early_adoption_unlock`, `free_tier`),
+    **`authenticated`** (whether a credential exists here — a *separate* fact, since today one
+    can be entitled without one), **`paywall_active`**, **`when_it_changes`** (what you lose
+    when that source stops applying) and **`free_repo_java_file_limit`** (the number the gate
+    actually compares against).
+  - `when_it_changes` states the gate in the terms the gate uses and **never quotes a price** —
+    pricing lives in `docs/PRODUCT_TIERS.md`, and a number printed here would be stale the day
+    it moves. Asserted.
+  - **`is_pro` is derived from the same authority.** It is what every gate reads
+    (`can_use`, `require_feature`), and it used to be computed beside the status block rather
+    than from it — which is how a status page came to contradict the commands next to it.
+  - `pro`, `pro_effective`, `pro_gating` and `pro_reason` are still emitted for existing
+    consumers, are derived from the authority (so they cannot drift), and are listed in the new
+    `deprecated_fields`. They are removed in a future major.
+  - `plan_status` no longer reports `unknown` for a licence file with no explicit status while
+    the authority reads that same file as active.
+
 ## [3.3.0] — 2026-07-29
 
 **A default you must remember to disable is the wrong default for someone else's code.**

{sourcecode-3.3.0 → sourcecode-3.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 3.3.0
+Version: 3.4.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -283,10 +283,13 @@ Honest limits worth knowing before you rely on it:
 > full Pro entitlements — no size gate, no key. The tiers below describe the model the
 > paywall will return to later.
 >
-> **What that means concretely.** `ask auth status` reports `"status": "unauthenticated"`
-> together with `"pro": true`, `"pro_reason": "early-adoption unlock"` — that combination is
-> expected, not a bug: you are unauthenticated *and* unlocked. When the unlock ends, gating
-> returns **by repo size and automation, never by command**: `posture`, `endpoints`,
+> **What that means concretely.** Ask the product: `ask auth status` answers in one block —
+> `entitlement` (what runs today), `source` (*why* — a licence, the unlock, or the free tier),
+> `authenticated` (whether a credential exists, which is a separate fact) and
+> `when_it_changes` (what you lose when that source stops applying). A fresh install reads
+> `entitlement: pro`, `source: early_adoption_unlock`, `authenticated: false` — unauthenticated
+> *and* entitled, stated as two facts instead of one contradiction. When the unlock ends,
+> gating returns **by repo size and automation, never by command**: `posture`, `endpoints`,
 > `spring-audit` and `migrate-check` stay in the base tier at full output. Nothing you can run
 > today becomes a paid-only command tomorrow.
 

{sourcecode-3.3.0 → sourcecode-3.4.0}/README.md

@@ -245,10 +245,13 @@ Honest limits worth knowing before you rely on it:
 > full Pro entitlements — no size gate, no key. The tiers below describe the model the
 > paywall will return to later.
 >
-> **What that means concretely.** `ask auth status` reports `"status": "unauthenticated"`
-> together with `"pro": true`, `"pro_reason": "early-adoption unlock"` — that combination is
-> expected, not a bug: you are unauthenticated *and* unlocked. When the unlock ends, gating
-> returns **by repo size and automation, never by command**: `posture`, `endpoints`,
+> **What that means concretely.** Ask the product: `ask auth status` answers in one block —
+> `entitlement` (what runs today), `source` (*why* — a licence, the unlock, or the free tier),
+> `authenticated` (whether a credential exists, which is a separate fact) and
+> `when_it_changes` (what you lose when that source stops applying). A fresh install reads
+> `entitlement: pro`, `source: early_adoption_unlock`, `authenticated: false` — unauthenticated
+> *and* entitled, stated as two facts instead of one contradiction. When the unlock ends,
+> gating returns **by repo size and automation, never by command**: `posture`, `endpoints`,
 > `spring-audit` and `migrate-check` stay in the base tier at full output. Nothing you can run
 > today becomes a paid-only command tomorrow.
 

{sourcecode-3.3.0 → sourcecode-3.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "3.3.0"
+version = "3.4.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-3.3.0 → sourcecode-3.4.0}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "3.3.0"
+__version__ = "3.4.0"

{sourcecode-3.3.0 → sourcecode-3.4.0}/src/sourcecode/cli.py

@@ -6106,9 +6106,14 @@ def verify_edit_cmd(
 
     Deterministic, in-loop verdict over the diff of the working tree against HEAD:
     public contract, @Transactional proxy boundary, security surface, bean wiring,
-    custom domain rules, and blast radius. Built for the agent write-loop (MCP) and
-    git hooks. Only regressions the edit INTRODUCED (vs HEAD) block — pre-existing
-    debt never fails an unrelated commit.
+    custom domain rules, build/configuration changes, and blast radius. Built for the
+    agent write-loop (MCP) and git hooks. Only regressions the edit INTRODUCED (vs
+    HEAD) block — pre-existing debt never fails an unrelated commit.
+
+    Build and configuration files (pom.xml, build.gradle, application*.yml, web.xml,
+    container descriptors, Spring XML) are reported under `changed_build_files` and
+    make the verdict UNVERIFIED, never `pass`: their effect is not decidable from a
+    source diff, and a compiler-release bump moves every file in the repo at once.
 
     Custom rules: drop a `.ask/verify-rules.json` at the repo root to enforce your own
     invariants (e.g. "no @RestController injects a *DaoJpa", "every /payroll endpoint

{sourcecode-3.3.0 → sourcecode-3.4.0}/src/sourcecode/migrate_check.py

@@ -765,6 +765,15 @@ _BOOT3_MIGRATION_TARGETS: frozenset[str] = frozenset(
 # reported as a separate hygiene metric, excluded from JDK-modernization scoring.
 _BEST_PRACTICE_TARGETS: frozenset[str] = frozenset({"java_8_best_practice"})
 
+#: What a file costs when every finding in it has an OpenRewrite recipe, as a
+#: fraction of the hand-edit rate (C1-11). The recipe does not remove the work —
+#: it turns editing into running one recipe and reviewing the diff.
+#:
+#: This is an **assumption, not a measurement**, and it is published as a field
+#: (`effort_breakdown.mechanical_review_factor`) with that label so a reader can
+#: substitute their own team's number instead of inheriting ours silently.
+_MECHANICAL_REVIEW_FACTOR: float = 0.2
+
 # BUG #3: the migration dimensions that feed the readiness_score aggregate, in
 # order. jdk_modernization is deliberately NOT here — it is orthogonal upkeep debt
 # reported on its own axis, never folded into the migration headline.
@@ -1625,12 +1634,45 @@ class MigrationReport:
 
         # BUG #5: effort over MAIN findings only — N/A axes (Hibernate-6 phantom,
         # test fixtures) no longer pad the estimate.
-        _file_effort = (
-            len(critical_files) * 0.5
-            + len(high_files) * 0.25
-            + len(medium_files) * 0.1
-            + len(low_files) * 0.05
-        )
+        #
+        # C1-11 (field eval #4): the estimate used to bill every file at the
+        # hand-edit rate while the report itself shipped an OpenRewrite recipe for
+        # most of the findings in it — on openmrs, 296 of 310 findings carry
+        # `auto_fix_available: true` and all 310 were costed as hand work. A number
+        # that contradicts a field in the same payload is the ADR-0008 defect, so
+        # the estimate now reads that field.
+        #
+        # The unit is the file, because the weights below are per file: a file is
+        # mechanical only when EVERY main finding in it carries a recipe. One
+        # unautomatable finding puts a human in the file, and the rest of that
+        # file's work comes with them.
+        _findings_by_file: "dict[str, list[MigrationFinding]]" = {}
+        for f in main_findings:
+            _findings_by_file.setdefault(f.source_file, []).append(f)
+        _mechanical_files = {
+            path for path, items in _findings_by_file.items()
+            if items and all(bool(i.openrewrite_recipe) for i in items)
+        }
+
+        def _weighted(files: "set[str]") -> float:
+            return (
+                len(critical_files & files) * 0.5
+                + len(high_files & files) * 0.25
+                + len(medium_files & files) * 0.1
+                + len(low_files & files) * 0.05
+            )
+
+        _all_effort_files = critical_files | high_files | medium_files | low_files
+        _manual_effort = _weighted(_all_effort_files - _mechanical_files)
+        # A recipe does not remove the work, it changes what the work is: run the
+        # recipe once, then review the diff. Reviewing is charged at a fraction of
+        # editing. The fraction is an assumption, not a measurement, so it is
+        # published as a field rather than buried in this expression.
+        _mechanical_raw = _weighted(_all_effort_files & _mechanical_files)
+        _mechanical_effort = _mechanical_raw * _MECHANICAL_REVIEW_FACTOR
+        _file_effort = _manual_effort + _mechanical_effort
+        _auto_fixable = sum(1 for f in main_findings if f.openrewrite_recipe)
+        _recipes = sorted({f.openrewrite_recipe for f in main_findings if f.openrewrite_recipe})
         # BUG #1 (v1.70.0): when the Hibernate 5→6 axis APPLIES, fold its measured
         # rewrite effort (risk_matrix → total_effort_range_days) into the headline
         # estimate. Previously a Hibernate-5 project whose ${hibernateVersion} was
@@ -1646,6 +1688,33 @@ class MigrationReport:
         self.estimated_effort_days = round(_file_effort + _hib_effort, 1)
         self.effort_breakdown = {
             "findings_effort_days": round(_file_effort, 1),
+            # C1-11: the same total, split by what the work actually is.
+            "mechanical_days": round(_mechanical_effort, 1),
+            "manual_days": round(_manual_effort, 1),
+            # Not estimated rather than estimated at zero: the re-test scope is a
+            # different measurement (which endpoints the changed files reach), and
+            # `migrate-check --blast-radius` is what produces it. I-3: a fact that
+            # cannot be decided says so.
+            "validation_days": None,
+            "validation_days_note": (
+                "Not estimated here — the re-test scope is the endpoints the changed "
+                "files reach. Run `migrate-check --blast-radius` for that ordering."
+            ),
+            "mechanical_basis": (
+                f"{_auto_fixable} of {len(main_findings)} findings carry an OpenRewrite "
+                f"recipe; {len(_mechanical_files & _all_effort_files)} of "
+                f"{len(_all_effort_files)} affected files have a recipe for *every* "
+                f"finding in them and are costed at {_MECHANICAL_REVIEW_FACTOR:g}× the "
+                "hand-edit rate (run the recipe, review the diff). A file with one "
+                "unautomatable finding is costed manually in full — a human is in that "
+                "file either way."
+            ),
+            "mechanical_review_factor": _MECHANICAL_REVIEW_FACTOR,
+            "mechanical_review_factor_basis": "assumption, not a measurement",
+            "auto_fixable_findings": _auto_fixable,
+            "auto_fixable_files": len(_mechanical_files & _all_effort_files),
+            "affected_files": len(_all_effort_files),
+            "recipes": _recipes,
             "hibernate_rewrite_effort_days": round(_hib_effort, 1),
             "hibernate_rewrite_range": (
                 hib.total_effort_range_days if (_hibernate_applies and hib is not None) else None
@@ -1809,7 +1878,20 @@ class MigrationReport:
             f"(critical: {main_crit}, high: {main_high})"
             + (f"   [+{nb} in test/generated, non-blocking]" if nb else ""),
             f"Affected files: {self.summary.get('affected_files', 0)}",
-            f"Estimated effort: {self.estimated_effort_days}d",
+            f"Estimated effort: {self.estimated_effort_days}d"
+            + (
+                f"  ({self.effort_breakdown.get('manual_days', 0)}d manual + "
+                f"{self.effort_breakdown.get('mechanical_days', 0)}d mechanical"
+                + (f" + {self.effort_breakdown.get('hibernate_rewrite_effort_days')}d hibernate"
+                   if self.effort_breakdown.get("hibernate_rewrite_effort_days") else "")
+                + "; validation not estimated)"
+                if self.effort_breakdown else ""
+            ),
+            (
+                f"  {self.effort_breakdown.get('auto_fixable_findings', 0)} findings carry an "
+                f"OpenRewrite recipe — see effort_breakdown.recipes"
+                if self.effort_breakdown.get("auto_fixable_findings") else ""
+            ),
             "",
         ]
 

{sourcecode-3.3.0 → sourcecode-3.4.0}/src/sourcecode/verify_edit.py

@@ -19,6 +19,7 @@ No public command and no verdict layer yet (those are Fase V1). What it must pro
 """
 from __future__ import annotations
 
+import re
 import shutil
 import subprocess
 import tempfile
@@ -48,6 +49,10 @@ class HeadVsWorking:
     head_sha: str
     head_cache_hit: bool
     timings_ms: dict[str, float] = field(default_factory=dict)
+    #: Changed files that are not code but decide what the code compiles to and how
+    #: it is wired (C3-14). Kept apart from ``changed_files`` because the CIR diff
+    #: cannot reason about them — they make the verdict *unverified*, not *broken*.
+    changed_build_files: tuple[str, ...] = ()
 
 
 # Git env vars that REDIRECT git at where it operates. When verify-edit runs INSIDE a
@@ -98,8 +103,8 @@ def _head_sha(root: Path) -> str:
         return ""
 
 
-def _changed_java_files(root: Path) -> tuple[str, ...]:
-    """`.java` paths that differ from HEAD: tracked diff ∪ untracked adds.
+def _changed_paths(root: Path) -> tuple[str, ...]:
+    """Every path that differs from HEAD: tracked diff ∪ untracked adds.
 
     Deletions are kept (the path is gone but the contract change is real). Pure
     git; never reads file contents.
@@ -114,7 +119,53 @@ def _changed_java_files(root: Path) -> tuple[str, ...]:
             files.update(line.strip() for line in ru.stdout.splitlines() if line.strip())
     except Exception:
         pass
-    return tuple(sorted(f for f in files if f.endswith(".java")))
+    return tuple(sorted(files))
+
+
+def _changed_java_files(root: Path) -> tuple[str, ...]:
+    """The `.java` subset of `_changed_paths` — what the CIR diff can reason about."""
+    return tuple(f for f in _changed_paths(root) if f.endswith(".java"))
+
+
+#: Files that change what the code *means* without being code: the build, the
+#: container contract, the Spring wiring, the configuration a profile resolves.
+#:
+#: C3-14 (field eval #4): an edit to any of these was invisible to `verify-edit`,
+#: which answered `changed_files: []` and `verdict: pass` — a confident green over
+#: a change that can move every source file in the repository at once. Matched on
+#: the file name, never on content, so the check costs nothing.
+_BUILD_FILE_NAMES: frozenset[str] = frozenset({
+    "pom.xml", "build.gradle", "build.gradle.kts",
+    "settings.gradle", "settings.gradle.kts", "gradle.properties",
+    "web.xml", "context.xml", "jboss-web.xml", "beans.xml", "persistence.xml",
+})
+#: Descriptor families matched by prefix + `.xml`: the container contract and the
+#: classic Spring XML wiring.
+_XML_DESCRIPTOR_PREFIXES: tuple[str, ...] = ("weblogic", "jboss-", "applicationcontext")
+#: Config file families that a profile resolves against. Deliberately narrow —
+#: `messages.properties` is text for humans, not wiring.
+_CONFIG_PREFIXES: tuple[str, ...] = ("application", "bootstrap")
+_CONFIG_SUFFIXES: tuple[str, ...] = (".properties", ".yml", ".yaml")
+
+
+def _is_build_config_path(rel_path: str) -> bool:
+    """Admission rule, kept narrow on purpose: every admitted file degrades a verdict
+    to unverified, and a loose rule turns the gate into noise people learn to ignore."""
+    name = rel_path.rsplit("/", 1)[-1].lower()
+    if name in _BUILD_FILE_NAMES:
+        return True
+    if name.endswith(".xml") and (
+        name.endswith("-context.xml") or name.startswith(_XML_DESCRIPTOR_PREFIXES)
+    ):
+        return True
+    if name.endswith(_CONFIG_SUFFIXES) and name.startswith(_CONFIG_PREFIXES):
+        return True
+    return False
+
+
+def _changed_build_files(root: Path) -> tuple[str, ...]:
+    """Changed non-Java files that can alter compilation or runtime wiring."""
+    return tuple(f for f in _changed_paths(root) if _is_build_config_path(f))
 
 
 # ── CIR construction ───────────────────────────────────────────────────────────
@@ -213,7 +264,9 @@ def head_vs_working(path: Path) -> HeadVsWorking:
     timings: dict[str, float] = {}
 
     t0 = time.perf_counter()
-    changed = _changed_java_files(root)
+    all_changed = _changed_paths(root)
+    changed = tuple(f for f in all_changed if f.endswith(".java"))
+    changed_build = tuple(f for f in all_changed if _is_build_config_path(f))
     timings["changed_files_ms"] = (time.perf_counter() - t0) * 1000.0
 
     t1 = time.perf_counter()
@@ -231,6 +284,7 @@ def head_vs_working(path: Path) -> HeadVsWorking:
         head_sha=head_sha,
         head_cache_hit=hit,
         timings_ms=timings,
+        changed_build_files=changed_build,
     )
 
 
@@ -252,7 +306,7 @@ VERDICT_SCHEMA = "verify-edit-v1"
 # no-op (clean) when no rules file exists, so adding it never blocks a repo that has none.
 _BLOCKING_AXES = (
     "contract_broken", "tx_boundary_changed", "security_delta", "new_orphan_bean",
-    "custom_rule_violated",
+    "custom_rule_violated", "build_config_changed",
 )
 
 
@@ -264,6 +318,7 @@ class AxisResult:
     changed: Optional[bool]
     detail: str = ""
     items: tuple[dict, ...] = ()
+    data: dict = field(default_factory=dict)
 
     def to_dict(self) -> dict:
         d: dict = {"changed": self.changed}
@@ -271,6 +326,7 @@ class AxisResult:
             d["detail"] = self.detail
         if self.items:
             d["items"] = list(self.items)
+        d.update(self.data)
         return d
 
 
@@ -279,6 +335,7 @@ class VerifyVerdict:
     verdict: str  # "pass" | "break" | "unverified"
     axes: dict[str, AxisResult]
     changed_files: tuple[str, ...]
+    changed_build_files: tuple[str, ...]
     blast_radius: dict
     reasons: tuple[str, ...]
     exit_code: int
@@ -290,6 +347,7 @@ class VerifyVerdict:
             "verdict": self.verdict,
             "head_sha": self.head_sha,
             "changed_files": list(self.changed_files),
+            "changed_build_files": list(self.changed_build_files),
             "axes": {name: ax.to_dict() for name, ax in self.axes.items()},
             "blast_radius": self.blast_radius,
             "reasons": list(self.reasons),
@@ -451,9 +509,132 @@ def _custom_rules_axis(cir_head: Any, cir_working: Any, root: Path) -> AxisResul
     return AxisResult(False)
 
 
+# ── build configuration (C3-14) ────────────────────────────────────────────────
+_COMPILER_PROPS: tuple[str, ...] = (
+    "java.version", "maven.compiler.release", "maven.compiler.source",
+    "maven.compiler.target",
+)
+_MAVEN_DEP_RE: "re.Pattern[str]" = re.compile(
+    r"<dependency>(.*?)</dependency>", re.DOTALL | re.IGNORECASE
+)
+_MAVEN_FIELD_RE: "re.Pattern[str]" = re.compile(
+    r"<(groupId|artifactId|version)>\s*([^<]+?)\s*</\1>", re.IGNORECASE
+)
+
+
+def _file_at_head(root: Path, rel_path: str) -> Optional[str]:
+    """The HEAD content of a path, or None when it did not exist there."""
+    try:
+        r = _run_git(root, "show", f"HEAD:{rel_path}")
+        return r.stdout if r.returncode == 0 else None
+    except Exception:
+        return None
+
+
+def _maven_property(text: str, name: str) -> Optional[str]:
+    m = re.search(rf"<{re.escape(name)}>\s*([^<]+?)\s*</{re.escape(name)}>", text, re.IGNORECASE)
+    return m.group(1) if m else None
+
+
+def _maven_dependencies(text: str) -> "dict[str, str]":
+    """`groupId:artifactId` → version (or "" when managed elsewhere). A diff input,
+    not an inventory: this answers *what changed in this file*, which is why it does
+    not go through the declared-coordinates authority (that one answers a different
+    question — which client libraries the build declares, allowlisted by kind)."""
+    out: dict[str, str] = {}
+    for block in _MAVEN_DEP_RE.findall(text or ""):
+        fields = {k.lower(): v for k, v in _MAVEN_FIELD_RE.findall(block)}
+        gid, aid = fields.get("groupid"), fields.get("artifactid")
+        if gid and aid:
+            out[f"{gid}:{aid}"] = fields.get("version", "")
+    return out
+
+
+def _build_config_axis(root: Path, changed_build_files: tuple[str, ...]) -> AxisResult:
+    """C3-14: a changed build/config file is a change `verify-edit` cannot decide.
+
+    `changed: None` on purpose. The CIR diff proves nothing about a `pom.xml` edit —
+    it is neither a proven regression (`True`) nor computed-clean (`False`) — so the
+    axis degrades to *unverified* and the verdict follows the machinery that already
+    exists for "could not compute". Answering `pass` was the defect: a compiler-release
+    bump moves every source file in the repository at once, and the gate said nothing
+    changed.
+    """
+    if not changed_build_files:
+        return AxisResult(False, "no build or configuration file changed")
+
+    compiler: dict = {}
+    dependency_delta: list[dict] = []
+    for rel in changed_build_files:
+        if not rel.endswith("pom.xml"):
+            continue
+        before = _file_at_head(root, rel)
+        try:
+            after = (root / rel).read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            after = None
+        if before is None or after is None:
+            continue
+        for prop in _COMPILER_PROPS:
+            was, now = _maven_property(before, prop), _maven_property(after, prop)
+            if was != now:
+                compiler[prop] = {"from": was, "to": now, "file": rel}
+        deps_before, deps_after = _maven_dependencies(before), _maven_dependencies(after)
+        for key in sorted(set(deps_before) | set(deps_after)):
+            if deps_before.get(key) == deps_after.get(key):
+                continue
+            dependency_delta.append({
+                "coordinate": key,
+                "from": deps_before.get(key),
+                "to": deps_after.get(key),
+                "file": rel,
+            })
+
+    detail = f"{len(changed_build_files)} build/configuration file(s) changed; "
+    if compiler:
+        first = next(iter(compiler.values()))
+        detail += f"compiler release {first['from']} → {first['to']}; "
+    if dependency_delta:
+        detail += f"{len(dependency_delta)} dependency change(s); "
+    detail += "effect on runtime behaviour is not decidable from the source diff"
+
+    return AxisResult(
+        None,
+        detail,
+        items=tuple({"file": f} for f in changed_build_files[:20]),
+        data={
+            "files": list(changed_build_files),
+            "effective_compiler_release": compiler or None,
+            "dependency_delta": dependency_delta or None,
+            "blast_note": (
+                "A build or configuration change applies to the whole compilation "
+                "unit, not to a file: its reach is every source file in scope, and "
+                "`verify-edit` does not model it. Verdict degrades to unverified "
+                "(exit 2) rather than passing."
+            ),
+        },
+    )
+
+
 # ── blast radius (reach over the changed files; informational, not a diff) ──────
-def _blast_radius(cir_working: Any, changed_files: tuple[str, ...]) -> dict:
+def _blast_radius(
+    cir_working: Any,
+    changed_files: tuple[str, ...],
+    changed_build_files: tuple[str, ...] = (),
+) -> dict:
     if not changed_files:
+        # C3-14: "no changed files" with high confidence was a lie when the build
+        # changed — the reach of that edit is the whole tree, and it is unmeasured.
+        if changed_build_files:
+            return {
+                "affected_entry_points": None,
+                "confidence": "unknown",
+                "note": (
+                    f"no changed .java files, but {len(changed_build_files)} build/"
+                    "configuration file(s) changed — reach is the whole compilation "
+                    "unit and is not modelled here"
+                ),
+            }
         return {"affected_entry_points": 0, "confidence": "high", "note": "no changed files"}
     try:
         from sourcecode.context_graph import ContextGraph
@@ -487,8 +668,9 @@ def verdict(hvw: HeadVsWorking, root: Path) -> VerifyVerdict:
         "security_delta": _security_axis(hvw.cir_head, hvw.cir_working, root),
         "new_orphan_bean": _orphan_bean_axis(hvw.cir_head, hvw.cir_working),
         "custom_rule_violated": _custom_rules_axis(hvw.cir_head, hvw.cir_working, root),
+        "build_config_changed": _build_config_axis(root, hvw.changed_build_files),
     }
-    blast = _blast_radius(hvw.cir_working, hvw.changed_files)
+    blast = _blast_radius(hvw.cir_working, hvw.changed_files, hvw.changed_build_files)
 
     reasons: list[str] = []
     broke = False
@@ -513,6 +695,7 @@ def verdict(hvw: HeadVsWorking, root: Path) -> VerifyVerdict:
         verdict=verdict_str,
         axes=axes,
         changed_files=hvw.changed_files,
+        changed_build_files=hvw.changed_build_files,
         blast_radius=blast,
         reasons=tuple(reasons),
         exit_code=code,