sourcecode 3.8.0__tar.gz → 4.0.0__tar.gz

{sourcecode-3.8.0 → sourcecode-4.0.0}/CHANGELOG.md

@@ -2,6 +2,145 @@
 
 ## [Unreleased]
 
+## [4.0.0] — 2026-08-02
+
+Major because two published `gate_coverage` fields are removed, not because the
+engine changed shape: `total_controller_handlers` / `gate_bearing` /
+`not_carrying_gate` (C2-14, the announced end of their two-minor window) and
+`possibly_filter_covered` (C1-20, which had no window — it counted the wrong thing).
+`removed_fields` in the same block maps each retired name to its successor.
+
+This release closes fourteen of the sixteen rows opened by the seventh field
+evaluation, in the order that record argued for, and ships `ask risk` — the first
+command that composes the other answers instead of adding one.
+
+### Added
+
+- **`ask risk` — the composition layer** (M10 head; [EXPERIMENTAL]). The seventh
+  evaluation's thesis was *"ASK tiene todos los átomos y no forma moléculas"*: one
+  class was `medium` in `spring-audit`, `medium/5.0` in `impact-chain`,
+  `coverage_unknown → permit_all` in `posture`, and executed a stored procedure that
+  mutates the database. Composed, that is unauthenticated write access under the
+  release build; separately, it was two commands saying "medium" and a reader doing
+  the join by hand.
+  `severity_effective = defect_severity × reachability × auth_verdict × write_effect`,
+  emitted as an ordered list. No new analysis — every factor is read from the
+  authority that already publishes it, and every row carries its four factors with
+  their sources, so a reader can reject one and keep the rest. An axis that could
+  not be measured is `unknown`, multiplies by 1.0, and is named in `blind_axes`:
+  the composition may not invent what nobody measured. This is the item that
+  *"crea producto"* rather than correcting data, and the one nobody replicates by
+  combining three scanners, because none of them shares an endpoint id with the
+  others.
+
+- **Three textbook security rules, because silence has to mean something** (CL-9).
+  The seventh evaluation got one security finding out of 3 342 files, then found
+  three more by hand in three files ASK had pointed it at. `SEC-004` (passwords
+  stored under a fast unsalted digest), `SEC-005` (CSRF disabled under
+  session-bearing authentication) and `SEC-006` (a cookie created without the Secure
+  attribute) ship in the `spring-audit` security surface, from one scan
+  (`sourcecode/security_config_scan.py`) with `file:line`. Each requires a
+  security-configuration context, so SHA-1 over a response body stays an ETag and a
+  stateless API that disables CSRF is not reported — a rule that cannot tell those
+  apart is one teams switch off, after which it protects nothing. These are table
+  stakes rather than differentiation: closing them avoids losing the sale.
+
+- **A third verdict for a gate that authorises against an identity nobody proved**
+  (C1-21). 939 endpoints in the field were reported `protected_custom` for carrying a
+  real gate — whose aspect resolves the caller through a method that returns a
+  database user when the authentication is null. The check runs; what it decides on,
+  for a request carrying no credential, is an identity the application invented, and
+  the vocabulary had no way to say so.
+  - `sourcecode/identity_fallback.py` (extractor) reports a method that reads the
+    platform's identity and, in a branch guarded by that identity being absent,
+    returns one anyway. Throwing, denying and returning null are correct handling and
+    are never reported; nothing branches on a method or class name (VAI).
+  - `security_posture` follows the enforcement path — types carrying published AOP
+    advice vocabulary or implementing a request-chain SPI — over `calls` edges, and
+    emits `protected_custom_degraded` (confidence `RequiresManualReview`) with an
+    `identity_resolution` block naming the method, the absence test and what it
+    returns. A fallback the enforcement path does not reach is not charged to the
+    gate.
+
+- **The remedy travels with the limitation** (C4-8, C3-37). The evaluation's requests
+  #1 and #5 — written by hand with invented syntax — are `posture
+  --resolve-environments` and `verify --init`, both shipped in the build it audited.
+  Four earlier rows say the same thing: discoverability cannot live in a document,
+  because a reader looking at an output does not go and read `--help`. One registry
+  (`sourcecode/remedies.py`), keyed by the question rather than by the flag, is read
+  by `posture.activation`, `posture --diff`, the `security_posture` limitation that is
+  conditional on the profile set, and `verify`'s exit-2 reason. A test refuses any
+  remedy naming a command or option the CLI does not accept, so a renamed flag breaks
+  the build instead of sending a reader to an invocation that no longer exists.
+
+- **A filter that matches a path is not a filter that checks the caller** (C1-20).
+  `gate_coverage` published `possibly_filter_covered: 2635` over patterns `/*`,
+  `/api/*` and `/api/v1/*` — and those three filters were CORS, headers and logging,
+  while the only filter that authenticates covered two prefixes. The wording was
+  technically honest and the number was still *"falso consuelo"*: the corrected split
+  on that repository is 12 covered against 2 623 in the gap. Both halves of the join
+  were already in the same process, so the fix is an intersection **per filter**
+  rather than per pattern-set:
+  - `sourcecode/filter_surface.py` now records each declared filter (`@WebFilter`, and
+    `web.xml` mappings correlated with their `<filter-class>`) with a verdict —
+    `authenticates`, `does_not_authenticate`, `unknown` — decided structurally, never
+    by name (VAI): the filter establishes an identity, or it reads a credential *and*
+    refuses over it. A body that is not in this repository stays `unknown`, because
+    absence of evidence published as evidence of absence is the same defect mirrored.
+  - `gate_coverage` replaces the single count with four that partition the escape set:
+    `filter_covered_authenticating`, `filter_gap_non_authenticating`,
+    `filter_authentication_unknown`, `no_matching_filter_pattern`, plus a `filters`
+    list naming each filter, its patterns and the evidence behind its verdict.
+
+- **Seven presentation rows, none of them an analysis error, two of which led a
+  reader to the inverse conclusion** (C2-15…C2-20, C1-19).
+  - `validation` printed *"0 body endpoints, 1179 gaps"* over a payload carrying
+    `body_endpoints_in_code: 1201` — the declared-constraint count under the
+    code-surface name. Both axes are named in their own units (C2-15).
+  - TX-006's witnesses all carried the callee's line, because that is where the
+    remedy goes, so several rows shared one number and read as duplicates. Each
+    finding now carries its `call_site` from the IR's span index, and the defect row
+    publishes the distinct sites with their count (C2-16).
+  - `limitations` merged across scopes repeated an entry verbatim; deduplicated once
+    in `finalize`, in first-seen order (C2-17).
+  - `spring_profiles.conditional_beans[].source_file` used the platform's native path
+    separator while the rest of the document used `/`; posix everywhere, including the
+    two other extractors that did the same (C2-18).
+  - `estimated_effort_range_days` published `{low: 60.7, high: 60.7}` — not a range,
+    at a precision the model does not have. The band declares `point_estimate` and
+    `precision_days`, and rounds to it (C2-19).
+  - `posture` cut four endpoint lists and its evidence map at 200 and declared
+    nothing, in the command whose declared caps the same evaluation calls a feature.
+    Each cut publishes total/shown/omitted and the registered cap effect; a list that
+    was not cut declares nothing (C2-20).
+  - Three commands published a file count for one repository — 3 337, 3 336, 3 342 —
+    and none said what it counted. Measured rather than equalised: all code-extension
+    files in any language, the non-test denominator of a test ratio, and the `.java`
+    files handed to the migration rules. Each names its population (C1-19).
+
+- **`cache status` counts every store a warm fills** (C3-36). It printed `CAS blobs:
+  0`, `Total size: 0.1 MB` immediately after an 89-second warm of 3 342 files: true of
+  the per-repository core store, and the warm's output mostly lands in the shared
+  Canonical IR and the content-addressed parse cache, which the command never counted.
+  The status now breaks down by store, says what each holds, and labels the parse
+  cache shared across repositories so its size is not read as this repository's.
+
+### Removed
+
+- **BREAKING — `gate_coverage` no longer emits the three deprecated aliases** (C2-14).
+  `total_controller_handlers` counted *endpoints* under a name that says handlers,
+  `gate_bearing` counted *handler methods* while sitting beside an endpoint count, and
+  `not_carrying_gate` duplicated `endpoints_not_carrying_gate`. They were kept for a
+  two-minor window after C1-5 named the units; the seventh field evaluation read the
+  aliases anyway and quoted `total_controller_handlers: 3574` as handlers next to
+  `handler_methods_total: 913`. An alias that still ships is a live claim, and two of
+  these claimed the wrong unit. Read `endpoints_total`,
+  `handler_methods_carrying_gate` and `endpoints_not_carrying_gate`; the block now
+  carries `removed_fields` mapping each retired name to its successor, so a consumer
+  meets the answer rather than a `KeyError`. `possibly_filter_covered` is retired in
+  the same block and for the same reason (C1-20): it counted "a filter runs here" and
+  was read as "a filter checks here".
+
 ## [3.8.0] — 2026-08-02
 
 ### Added

{sourcecode-3.8.0 → sourcecode-4.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 3.8.0
+Version: 4.0.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -220,7 +220,7 @@ experimental: both are true, and they are two different facts.
 |---|---|---|
 | **core** | contract stable within a major — safe to gate CI on | `endpoints` · `spring-audit` · `migrate-check` · `impact` · `impact-chain` · `pr-impact` · `verify` |
 | **supported** | maintained; fields are added, never removed without a major | every command not named in another row |
-| **experimental** | shape may change in a minor — do not gate CI on it | `posture` · `archetype` |
+| **experimental** | shape may change in a minor — do not gate CI on it | `risk` · `posture` · `archetype` |
 | **parked** | kept working, no longer developed | `retrieve` |
 
 The same table is printed by `ask --help`, and both are generated from one authority
@@ -237,6 +237,7 @@ from it.
 | Command | Tier | Answers | Note |
 |---|---|---|---|
 | `posture` | experimental | which beans a profile set wires, and how effective endpoint access differs between two sets | the most differentiated capability here |
+| `risk` | experimental | what each defect actually costs, once reach, access and write effect are in it | `defect_severity × reachability × auth_verdict × write_effect`; every factor names its authority |
 | `endpoints` | core | every REST endpoint, effective path, security policy, confidence | Spring MVC + JAX-RS (~65 % recall on JAX-RS sub-resource locators) |
 | `spring-audit` | core | transactional anomalies + security surface + validation gaps | `--ci`, `-f github-comment` |
 | `migrate-check` | core | Boot 2→3 readiness: located blockers, per-dimension score, effort | `--blast-radius` orders the re-test plan |

{sourcecode-3.8.0 → sourcecode-4.0.0}/README.md

@@ -182,7 +182,7 @@ experimental: both are true, and they are two different facts.
 |---|---|---|
 | **core** | contract stable within a major — safe to gate CI on | `endpoints` · `spring-audit` · `migrate-check` · `impact` · `impact-chain` · `pr-impact` · `verify` |
 | **supported** | maintained; fields are added, never removed without a major | every command not named in another row |
-| **experimental** | shape may change in a minor — do not gate CI on it | `posture` · `archetype` |
+| **experimental** | shape may change in a minor — do not gate CI on it | `risk` · `posture` · `archetype` |
 | **parked** | kept working, no longer developed | `retrieve` |
 
 The same table is printed by `ask --help`, and both are generated from one authority
@@ -199,6 +199,7 @@ from it.
 | Command | Tier | Answers | Note |
 |---|---|---|---|
 | `posture` | experimental | which beans a profile set wires, and how effective endpoint access differs between two sets | the most differentiated capability here |
+| `risk` | experimental | what each defect actually costs, once reach, access and write effect are in it | `defect_severity × reachability × auth_verdict × write_effect`; every factor names its authority |
 | `endpoints` | core | every REST endpoint, effective path, security policy, confidence | Spring MVC + JAX-RS (~65 % recall on JAX-RS sub-resource locators) |
 | `spring-audit` | core | transactional anomalies + security surface + validation gaps | `--ci`, `-f github-comment` |
 | `migrate-check` | core | Boot 2→3 readiness: located blockers, per-dimension score, effort | `--blast-radius` orders the re-test plan |

{sourcecode-3.8.0 → sourcecode-4.0.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "3.8.0"
+version = "4.0.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-3.8.0 → sourcecode-4.0.0}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "3.8.0"
+__version__ = "4.0.0"

{sourcecode-3.8.0 → sourcecode-4.0.0}/src/sourcecode/cache.py

@@ -354,6 +354,7 @@ def status(repo_root: Path) -> dict[str, Any]:
             "cores": 0, "snapshots": 0, "views": 0, "cas_blobs": 0,
             "total_size_bytes": 0, "total_size_mb": 0.0,
             "current_git_head": current_head,
+            "stores": _store_breakdown(repo_root, 0),
             **ris_fields,
         }
     cores = list(cache_d.glob("core-*.json.gz"))
@@ -371,10 +372,57 @@ def status(repo_root: Path) -> dict[str, Any]:
         "total_size_bytes": total_bytes,
         "total_size_mb": round(total_bytes / (1024 * 1024), 2),
         "current_git_head": current_head,
+        # C3-36: `CAS blobs: 0`, `Total size: 0.1 MB` immediately after an 89-second
+        # warm of 3 342 files. Every figure above was true and described one store
+        # of three — the warm's output mostly lands in the shared CIR and the parse
+        # cache, which this command never counted. A status that reports a third of
+        # the state reads as a warm that did nothing.
+        "stores": _store_breakdown(repo_root, total_bytes),
         **ris_fields,
     }
 
 
+def _store_breakdown(repo_root: Path, core_bytes: int) -> "dict[str, Any]":
+    """What a warm actually populated, by store. Best-effort per store: a store
+    that cannot be inspected is reported as unavailable, never as empty."""
+    out: "dict[str, Any]" = {
+        "core": {
+            "cache_dir": str(cache_dir(repo_root)),
+            "bytes": core_bytes,
+            "scope": "this repository",
+            "holds": "core snapshots, rendered views and their CAS blobs",
+        },
+    }
+    try:
+        from sourcecode.context_cache import ContextCache  # noqa: PLC0415
+
+        ctx = ContextCache.for_repo(repo_root).stats()
+        out["shared_cir"] = {
+            "cache_dir": ctx["cache_dir"],
+            "entries": ctx["contexts"],
+            "bytes": ctx["bytes_stored"],
+            "scope": "this repository",
+            "holds": "the shared Canonical IR that explain/impact/posture reuse",
+        }
+    except Exception:
+        out["shared_cir"] = {"available": False}
+    try:
+        from sourcecode import parse_cache as _pc  # noqa: PLC0415
+
+        out["parse"] = {
+            **_pc.store_stats(),
+            "holds": "per-file parses, content-addressed across every repository",
+        }
+    except Exception:
+        out["parse"] = {"available": False}
+    out["note"] = (
+        "`cache warm` populates all of these; the core store alone is a third of "
+        "the answer, and reading it as the whole is how a completed warm looks like "
+        "an empty cache."
+    )
+    return out
+
+
 def clear(repo_root: Path, *, clear_ris: bool = False) -> int:
     """Delete cache files for *repo_root*.  Returns the number of files removed.
 

{sourcecode-3.8.0 → sourcecode-4.0.0}/src/sourcecode/cache_model.py

@@ -131,6 +131,13 @@ COMMANDS: tuple[CommandCache, ...] = (
                  "builds — the parse it used to repeat for itself. `--diff` compares two profile "
                  "sets over that one IR, so the second side costs the resolution only.",
                  "10.1 s → 1.6 s"),
+    CommandCache("risk", ("cir", "parse"), "shared", False,
+                 "Composes what the audit, impact-chain and the posture already answer, so it "
+                 "pays each of their costs once over the shared CIR a warm builds — one parse "
+                 "for the whole composition, and the reachability query is cached per symbol "
+                 "within the run.",
+                 "not measured on the battery yet — the composition is bounded by the "
+                 "`spring-audit` + `impact-chain` costs listed here, not by new analysis"),
     CommandCache("endpoints", ("ris", "parse"), "shared", False,
                  "Recomputes the endpoint surface on every run, over a parse a warm has already "
                  "paid for. Until 3.7.0 the extractor parsed every file itself instead of reading "

{sourcecode-3.8.0 → sourcecode-4.0.0}/src/sourcecode/cli.py

@@ -183,7 +183,7 @@ COMMAND_TIERS: "tuple[tuple[str, str, tuple[str, ...]], ...]" = (
         "cache", "auth", "mcp", "telemetry",
     )),
     ("experimental", "shape may change in a minor — do not gate CI on it", (
-        "posture", "archetype",
+        "risk", "posture", "archetype",
     )),
     # `retrieve` publishes 15+ intents whose answers the other commands already
     # give better: measured on the battery, `security-surface` merely re-states
@@ -5475,11 +5475,21 @@ def validation_cmd(
     # The payload carries the same note, so a pipeline loses nothing.
     if _note:
         _notice(f"Note: {_note}")
+    # C2-15: the console said "0 body endpoints, 1179 gaps" over a payload carrying
+    # `body_endpoints_in_code: 1201` — it printed the *declared-constraint* count
+    # under the *code-surface* name, so the one line most readers see stated the
+    # opposite of the answer. Both axes are named, in their own units.
+    _declared = _summary.get("endpoints_with_body", 0)
+    _in_code = _summary.get("body_endpoints_in_code")
+    _bodies = (
+        f"{_in_code} body endpoints in code, {_declared} with a declared constraint "
+        f"surface" if _in_code is not None
+        else f"{_declared} routes with a declared constraint surface"
+    )
     _emit_command_output(
         output, output_path, copy,
         success_msg=f"Validation surface written to {output_path} "
-        f"({_summary.get('endpoints_with_body', 0)} body endpoints, "
-        f"{_summary.get('gaps', 0)} gaps)",
+        f"({_bodies}, {_summary.get('gaps', 0)} gaps)",
     )
 
     from sourcecode.mcp_nudge import nudge_mcp_if_needed as _nudge
@@ -6308,11 +6318,13 @@ def _render_gate_coverage_section(result: "SpringAuditResult") -> list[str]:  #
     gc = (result.security_posture or {}).get("gate_coverage")
     if not gc:
         return []
-    not_covered = gc.get("endpoints_not_carrying_gate", gc.get("not_carrying_gate", 0))
+    not_covered = gc.get("endpoints_not_carrying_gate", 0)
     gates = ", ".join(f"`{g}`" for g in gc.get("gate_annotations", [])) or "the detected gate"
     # One unit, named: these are endpoints, not handler methods. The two counts differ
     # (one method can serve several mappings) and must never be summed together.
-    total = gc.get("endpoints_total", gc.get("total_controller_handlers", 0))
+    # C2-14: read only the explicit keys — falling back to the retired aliases is how
+    # a name that lies about its unit survives its own removal.
+    total = gc.get("endpoints_total", 0)
     lines: list[str] = ["", "---", ""]
     if not_covered == 0:
         _gated = gc.get("endpoints_carrying_gate", total)
@@ -6326,7 +6338,6 @@ def _render_gate_coverage_section(result: "SpringAuditResult") -> list[str]:  #
             lines.append(f"✅ **Gate coverage** — all {total} endpoints carry {gates}.")
         return lines
 
-    covered = gc.get("possibly_filter_covered", 0)
     _standard = gc.get("endpoints_standard_guarded", 0)
     lines.append(
         f"🔓 **Gate coverage** — {not_covered} of {total} endpoints do not carry "
@@ -6338,9 +6349,18 @@ def _render_gate_coverage_section(result: "SpringAuditResult") -> list[str]:  #
             f"standard guard, {not_covered} on neither — the three sum to {total}._"
         )
     if gc.get("reconstructed_filter_patterns"):
+        # C1-20: the split, not the total. "N match a filter pattern" is the sentence
+        # a reader turns into "N are covered", and in the field the filters doing the
+        # matching were CORS, headers and logging.
+        _auth = gc.get("filter_covered_authenticating", 0)
+        _gap = gc.get("filter_gap_non_authenticating", 0)
+        _unknown = gc.get("filter_authentication_unknown", 0)
         lines.append(
-            f"_{covered} of those match a reconstructed servlet filter pattern "
-            f"(possibly filter-covered); {gc.get('no_matching_filter_pattern', 0)} match none._"
+            f"_{_auth} are covered by a servlet filter that authenticates; {_gap} match "
+            f"only filters that do not check the caller (CORS, headers, logging and the "
+            f"like); {_unknown} match a filter whose implementation is not in this "
+            f"repository; {gc.get('no_matching_filter_pattern', 0)} match no pattern at "
+            f"all. Filter-chain order is not reconstructed._"
         )
     lines += ["", "<details>", "<summary>Handlers without the gate</summary>", ""]
     lines += [
@@ -6840,6 +6860,74 @@ def verify_cmd(
         raise typer.Exit(code=report.exit_code)
 
 
+@app.command("risk")
+def risk_cmd(
+    path: Path = typer.Argument(
+        Path("."),
+        help="Repository path (default: current directory).",
+    ),
+    limit: int = typer.Option(
+        50, "--limit", help="How many composed risks to publish (highest first)."
+    ),
+    min_band: str = typer.Option(
+        "low",
+        "--min-band",
+        help="Floor on the composed band: critical | high | medium | low.",
+    ),
+    output_path: Optional[Path] = typer.Option(
+        None, "--output", "-o", help="Write the report to a file instead of stdout."
+    ),
+    format: str = typer.Option("json", "--format", "-f", help="Output format: json or yaml."),
+) -> None:
+    """[EXPERIMENTAL] What each defect actually costs, once reach and access are in it.
+
+    \b
+    The other commands answer one axis each, correctly, and leave the composition
+    to the reader. In the field, one class was `medium` in `spring-audit`,
+    `medium/5.0` in `impact-chain`, `coverage_unknown → permit_all` in `posture`,
+    and executed a stored procedure that mutates the database. Composed, that is
+    unauthenticated write access under the release build; separately, it was two
+    commands saying "medium".
+
+    \b
+      severity_effective = defect_severity × reachability × auth_verdict × write_effect
+
+    \b
+    No new analysis: every factor is read from the command that already publishes
+    it, and every row publishes its four factors with the authority each came
+    from, so a reader can disagree with one and keep the rest. An axis that could
+    not be measured is `unknown`, multiplies by 1.0, and is named in `blind_axes`.
+
+    \b
+    Examples:
+      ask risk .
+      ask risk . --min-band high
+      ask risk . --limit 10 -o risk.json
+    """
+    from sourcecode.risk import build_risk
+
+    path = _admit_path(path)
+    if min_band not in ("critical", "high", "medium", "low"):
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            f"--min-band expects critical | high | medium | low (got {min_band!r}).",
+            hint="Example: --min-band high",
+            expected="critical|high|medium|low",
+        )
+        raise typer.Exit(code=1)
+
+    data = build_risk(path, limit=limit, min_band=min_band)
+    _emit_command_output(
+        _serialize_dict(data, format),
+        output_path,
+        False,
+        success_msg=(
+            f"risk written to {output_path} ({data['shown']} of "
+            f"{data['total_defects']} defects composed)"
+        ),
+    )
+
+
 @app.command("posture")
 def posture_cmd(
     path: Path = typer.Argument(
@@ -9969,6 +10057,20 @@ def cache_status_cmd(
         typer.echo(f"Views:       {stats['views']}")
         typer.echo(f"CAS blobs:   {stats['cas_blobs']}")
         typer.echo(f"Total size:  {stats['total_size_mb']} MB")
+        # C3-36: the three lines above describe ONE of the three stores a warm
+        # fills. Printed alone after an 89 s warm they read as "nothing was
+        # cached", which is the opposite of what happened.
+        _stores = stats.get("stores") or {}
+        for _label, _key in (("Shared CIR", "shared_cir"), ("Parse cache", "parse")):
+            _store = _stores.get(_key) or {}
+            if not _store or _store.get("available") is False:
+                typer.echo(f"{_label + ':':<13}unavailable")
+                continue
+            _mb = round(_store.get("bytes", 0) / (1024 * 1024), 2)
+            _scope = " (shared across repositories)" if _store.get("scope") == "shared" else ""
+            typer.echo(
+                f"{_label + ':':<13}{_store.get('entries', 0)} entries, {_mb} MB{_scope}"
+            )
         # RIS section
         if stats.get("ris_exists"):
             _stale_tag = " [STALE]" if stats.get("ris_is_stale") else ""
@@ -10326,7 +10428,7 @@ HELP_PANELS: "tuple[tuple[str, tuple[str, ...]], ...]" = (
         "cache", "auth", "mcp", "telemetry", "baseline",
     )),
     ("Experimental — shape may change", (
-        "archetype", "retrieve",
+        "risk", "archetype", "retrieve",
     )),
 )
 

{sourcecode-3.8.0 → sourcecode-4.0.0}/src/sourcecode/confidence_analyzer.py

@@ -343,9 +343,14 @@ class ConfidenceAnalyzer:
                 gaps.append(AnalysisGap(
                     area="testing",
                     reason=(
+                        # C1-19: "Java files" here has always meant the non-test ones
+                        # — the denominator of a test ratio cannot include the tests.
+                        # Unqualified, it read as a third file count contradicting
+                        # `migrate-check.java_files_scanned` (which counts them all).
                         f"Backend test coverage critical: {len(_java_tests)} test files "
-                        f"for {len(_java_prod)} Java files "
-                        f"({_ratio:.1%}) — {_java_test_facts.basis}"
+                        f"for {len(_java_prod)} non-test Java files "
+                        f"(of {len(_java_all)} Java files, {_ratio:.1%}) — "
+                        f"{_java_test_facts.basis}"
                     ),
                     impact="high",
                 ))

{sourcecode-3.8.0 → sourcecode-4.0.0}/src/sourcecode/defect_identity.py

@@ -93,6 +93,25 @@ def assign_defect_ids(findings: "Iterable[SpringFinding]") -> None:
         finding.defect_id = make_defect_id(category, kind, symbol)
 
 
+def _witness_sites(witnesses: "list[SpringFinding]") -> "dict[str, Any]":
+    """The distinct places this defect was observed, when the witnesses record one."""
+    sites: "list[dict[str, Any]]" = []
+    seen: "set[tuple[str, Any]]" = set()
+    for finding in witnesses:
+        site = (finding.evidence or {}).get("call_site")
+        if not isinstance(site, dict):
+            continue
+        key = (str(site.get("source_file") or ""), site.get("line"))
+        if key in seen:
+            continue
+        seen.add(key)
+        sites.append(site)
+    if not sites:
+        return {}
+    sites.sort(key=lambda s: (str(s.get("source_file") or ""), s.get("line") or 0))
+    return {"witness_sites": sites, "distinct_site_count": len(sites)}
+
+
 def group_by_defect(findings: "list[SpringFinding]") -> list[dict[str, Any]]:
     """One row per defect, most severe first, each naming its witnesses.
 
@@ -137,6 +156,11 @@ def group_by_defect(findings: "list[SpringFinding]") -> list[dict[str, Any]]:
             "rule_ids": sorted({f.pattern_id for f in witnesses}),
             "witness_count": len(witnesses),
             "witnesses": [f.id for f in witnesses],
+            # C2-16: witnesses of one defect are all located at the symbol that
+            # carries the remedy, so several of them print the same line and read
+            # as duplicates. Where each was actually observed is listed here, and
+            # a count of distinct sites so "N witnesses" can be checked against it.
+            **_witness_sites(witnesses),
         })
     rows.sort(key=lambda r: (SEVERITY_RANK.get(r["severity"], 9), r["symbol"]))
     return rows

{sourcecode-3.8.0 → sourcecode-4.0.0}/src/sourcecode/environment_resolution.py

@@ -209,7 +209,7 @@ def collect_signals(root: Path) -> list[Signal]:
         if _PROPERTY_KEY not in text and _ENV_KEY not in text:
             continue
         try:
-            rel = str(path.relative_to(root))
+            rel = path.relative_to(root).as_posix()
         except ValueError:
             rel = str(path)
         lines = text.splitlines()