sourcecode 4.0.0__py3-none-any.whl → 4.1.0__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.0.0"
+__version__ = "4.1.0"

sourcecode/cli.py

@@ -297,6 +297,27 @@ def _group_help_block() -> str:
     return "\n".join(lines)
 
 
+def _remedy_help_block() -> str:
+    """The front page names the answers the field asked for as missing features.
+
+    C4-8 was closed in the payload: a limitation now carries the invocation that
+    resolves it. But the evaluator who wrote `ask posture --provenance` and `ask
+    contracts init` by hand was reading `--help` first, and neither shipped flag
+    was on it. The block is rendered from `remedies.REMEDIES`, so the pointer and
+    the capability cannot drift — `tests/test_remedies.py` already refuses a
+    remedy whose option the CLI does not accept.
+    """
+    from sourcecode.remedies import headlines
+
+    lines = ["[bold]Questions the repository alone does not answer:[/bold]"]
+    for invocation, headline in headlines():
+        # Bare invocation, like every other block on this page: the header panels
+        # print without the `ask ` prefix (C3-16).
+        bare = invocation.removeprefix("ask ")
+        lines.append(f"  {bare:<33}[dim]# {headline}[/dim]")
+    return "\n".join(lines)
+
+
 def _build_help_text() -> str:
     """Build --help text dynamically based on current license state."""
     try:
@@ -323,6 +344,9 @@ of files) in minutes. Semantic analysis itself is sub-second; repo indexing domi
   endpoints .                  [dim]# endpoints + effective path + policy[/dim]
   spring-audit .               [dim]# TX anomalies + security surface[/dim]
   migrate-check . --compact    [dim]# Boot 2→3: located blockers + effort[/dim]
+  risk .                       [dim]# defects ranked by reach × access (exp.)[/dim]
+
+{_remedy_help_block()}
 
 [bold]Agent context:[/bold]
   ask --compact                [dim]# high-signal summary (~2,500–4,000 tokens)[/dim]
@@ -6438,19 +6462,11 @@ def spring_audit_cmd(
         help=_NO_CACHE_SUBCOMMAND_HELP,
     ),
 ) -> None:
-    """Spring semantic audit: TX anomalies (TX-001..006) + security surface (SEC-001..003).
+    """Spring semantic audit: {{RULE_SUMMARY}}.
 
     \b
     Detects:
-      TX-001  @Transactional on private/final method (CGLIB proxy bypass)
-      TX-002  REQUIRES_NEW nested in REQUIRED call chain
-      TX-003  readOnly=true boundary propagating to write operation
-      TX-004  NOT_SUPPORTED/NEVER within active TX chain
-      TX-005  Exception swallowing inside @Transactional
-      TX-006  Self-invocation of @Transactional sibling (proxy bypass)
-      SEC-001 Unsecured endpoint in annotation_based security model
-      SEC-002 CVE-2025-41248: @PreAuthorize on inherited method from generic supertype
-      SEC-003 @Transactional on @Controller/@RestController (TX in wrong layer)
+{{RULE_LIST}}
 
     \b
     Findings and defects are two counts, both published. A rule fires per
@@ -6482,10 +6498,7 @@ def spring_audit_cmd(
     \b
     What it does not look at (the whole list is in the payload's `non_coverage`,
     and in the README):
-      NC-001  whether request input reaches a sink — no dataflow or taint
-      NC-002  secrets outside Java and Spring configuration
-      NC-003  filter-chain ORDER — a custom filter's presence is structural only
-      NC-004  known vulnerabilities in dependencies — no CVE matching
+{{NON_COVERAGE}}
     Silence about those is not evidence that there is nothing to find.
 """
     import json as _json
@@ -6587,6 +6600,30 @@ def spring_audit_cmd(
         raise typer.Exit(code=1)
 
 
+def _render_audit_help(doc: str) -> str:
+    """Fill the rule and non-coverage blocks from the tables that own them.
+
+    The rules this command detects were written out by hand in its own help, and
+    stayed at `SEC-001..003` for two releases after CL-9 shipped three more — the
+    C4-1 shape, where a curated list beside a generated one drifts and the
+    curated one is what the reader gets. Both blocks are rendered now, so adding
+    a rule updates the help by construction.
+    """
+    from sourcecode import non_coverage, rule_catalog
+
+    nc_lines = [
+        f"      {line}" for line in non_coverage.render_help_lines("security_surface", width=68)
+    ]
+    return (
+        doc.replace("{{RULE_SUMMARY}}", rule_catalog.summary_line())
+        .replace("{{RULE_LIST}}", rule_catalog.render_help_block())
+        .replace("{{NON_COVERAGE}}", "\n".join(nc_lines))
+    )
+
+
+spring_audit_cmd.__doc__ = _render_audit_help(spring_audit_cmd.__doc__ or "")
+
+
 # ── verify-edit: in-loop semantic diff gate ───────────────────────────────────
 
 
@@ -8897,8 +8934,16 @@ def version_cmd() -> None:
       {"cli_version": "1.33.11", "mcp_schema_version": "1.33.11",
        "compatibility_schema_version": "1.0"}
     """
+    from sourcecode.release_info import advisory_line, build_status
+
     if getattr(sys.stdout, "isatty", lambda: False)():
         typer.echo(f"ask {__version__}")
+        # C4-12: the field audits builds that are days old and many releases
+        # behind, and nothing said so. Printed only when it applies — an advisory
+        # on every run is one nobody reads.
+        _advisory = advisory_line()
+        if _advisory:
+            typer.echo(_advisory)
     else:
         import json as _json_ver
         from sourcecode.envelope import ENVELOPE_VERSION, available_schemas
@@ -8906,6 +8951,10 @@ def version_cmd() -> None:
             "cli_version": __version__,
             "mcp_schema_version": __version__,
             "compatibility_schema_version": "1.0",
+            # Which release this is, when it shipped, and how far behind it
+            # probably is. The estimate carries its basis and never claims a
+            # newer release exists (C4-12).
+            "build": build_status(),
             # What a consumer should actually pin against: the release string
             # changes every release, the envelope version only when the output
             # contract does.

sourcecode/envelope.py

@@ -123,6 +123,16 @@ def build_meta(
         "tool_version": __version__,
         "command": command,
     }
+    # C4-12: a consumer holding a payload could not tell how old the build that
+    # produced it was. The DATE is a constant of the build, so it goes here; the
+    # AGE changes daily and would break the byte-identical property above, so it
+    # is derived where it is asked for (`ask version`), never in the envelope.
+    try:
+        from sourcecode.release_info import RELEASE_DATE
+
+        meta["tool_release_date"] = RELEASE_DATE
+    except Exception:
+        pass
     if schema_version:
         meta["schema_version"] = schema_version
 

sourcecode/non_coverage.py

@@ -74,13 +74,16 @@ NON_COVERAGE: tuple[NonCoverage, ...] = (
         id="NC-002",
         surface="security_surface",
         not_covered=(
-            "Secrets outside Java and Spring configuration — a credential in a "
-            "deployment descriptor, a Helm value, a CI variable file."
+            "Secrets outside Java, Spring configuration and the deployment "
+            "descriptors — a Helm value, a CI variable file, a shell script."
         ),
         why=(
-            "The file population this analyzer reads is the Java source and the "
-            "Spring configuration convention. A secret elsewhere is not missed by "
-            "a weak rule; it is outside the set of files anything here opens."
+            "The file population this analyzer reads is the Java source, the Spring "
+            "configuration convention and the descriptors it already parses to "
+            "resolve an environment. A secret elsewhere is not missed by a weak "
+            "rule; it is outside the set of files anything here opens. Narrowed by "
+            "CL-10: a credential stored in `web.xml` or a Spring XML context IS "
+            "reported (SEC-007), because those files were already being read."
         ),
         instead="A dedicated secret scanner over the whole tree (gitleaks, trufflehog).",
     ),

sourcecode/posture.py

@@ -381,6 +381,87 @@ def resolve_beans(
     )
 
 
+#: CL-11 — container settings that make the resolution below a DEFAULT rather
+#: than a description of what runs. Each says what the container will no longer
+#: report, in the terms of the verdict it qualifies. Published Spring property
+#: names, so this is framework vocabulary, never a client's own configuration.
+_OBSERVABILITY_AMPLIFIERS: "tuple[tuple[str, str], ...]" = (
+    (
+        "spring.main.allow-bean-definition-overriding",
+        "a second bean definition for a name resolved here REPLACES it instead of "
+        "failing at startup, so a security configuration can be overridden by one "
+        "this resolution never saw and nothing in the deployment reports the "
+        "disagreement",
+    ),
+    (
+        "spring.main.allow-circular-references",
+        "a wiring cycle through the beans resolved here is repaired at runtime by "
+        "injecting a proxy rather than refused, so the instance that ends up in the "
+        "chain need not be the one this resolution describes",
+    ),
+)
+
+#: Values Spring reads as "on". Compared case-insensitively, as Spring does.
+_TRUTHY = frozenset({"true", "yes", "on", "1"})
+
+
+def container_observability(properties: "EffectiveProperties") -> dict:
+    """Whether the container would report a disagreement with this resolution (CL-11).
+
+    Audit #8 found `allow-bean-definition-overriding: true` and
+    `allow-circular-references: true` in the repository whose entire security
+    verdict turns on which `SecurityConfig` bean wins. On its own each is a
+    preference; beside a conditional security verdict each is the reason that
+    verdict is a **default and not a guarantee** — with overriding enabled, a
+    silent override of the filter chain does not fail at startup, so the one
+    check that would have caught it never runs.
+
+    This block only ever LOWERS confidence. It is emitted beside the verdict it
+    qualifies rather than as a finding underneath it, because the C1-20 lesson
+    runs the other way here: a caveat a reader has to go and find is a caveat
+    that does not reach the conclusion it was written for.
+    """
+    amplifiers: "list[dict]" = []
+    for key, effect in _OBSERVABILITY_AMPLIFIERS:
+        blocked = properties.blocked(key)
+        if blocked:
+            # The property exists and nothing decides it. That is not "off": an
+            # undecidable safety setting is exactly the case where claiming the
+            # safe default would be the confident falsehood.
+            amplifiers.append({
+                "property": key, "value": None, "state": "undecidable",
+                "reason": blocked, "source": None, "profile": None, "effect": effect,
+            })
+            continue
+        found = properties.lookup(key)
+        if found is None or found.value.strip().lower() not in _TRUTHY:
+            continue
+        amplifiers.append({
+            "property": key, "value": found.value, "state": "enabled",
+            "reason": None, "source": found.source, "profile": found.profile,
+            "effect": effect,
+        })
+
+    block: dict = {
+        "weakens_this_resolution": bool(amplifiers),
+        "amplifiers": amplifiers,
+    }
+    if amplifiers:
+        block["reading"] = (
+            "The bean resolution in this payload describes the configuration this "
+            "repository declares. " + str(len(amplifiers)) + " container setting(s) "
+            "mean the deployment would not report a disagreement with it, so read "
+            "every verdict below as a default rather than as what runs."
+        )
+    else:
+        block["reading"] = (
+            "No container setting was found that suppresses a startup failure over "
+            "the beans resolved here; a disagreement with this resolution would "
+            "surface as a failure to start."
+        )
+    return block
+
+
 #: Published Spring Security vocabulary that makes a bean part of the request
 #: chain's authorization configuration. Recorded as evidence; never branched on
 #: a client's own class name.
@@ -1017,11 +1098,20 @@ def _posture(
             "supplied": sorted(properties or {}),
         },
         **resolution.to_dict(),
+        # CL-11. Whether the container would even report a disagreement with the
+        # resolution above. Beside it, not underneath it: this block only lowers
+        # confidence in the verdicts that follow, and a caveat a reader has to go
+        # looking for does not reach the conclusion it was written for.
+        "container": container_observability(resolved_properties),
         # Called out separately because a profile that switches the security
         # configuration is not one bean among many — it is the difference
         # between an authenticated surface and an open one.
         "security": security_projection(cir, resolution),
     }
+    # The verdict a reader acts on is the security slice, so the qualifier
+    # travels with it rather than only at the top of the document.
+    if payload["container"]["weakens_this_resolution"]:
+        payload["security"]["resolution_is_a_default"] = payload["container"]["reading"]
     payload["endpoints"] = endpoint_projection(cir, payload["security"])
     # Which chain is wired is a fact about a bean; what that chain permits is the
     # fact about the request, and it is the one a reviewer asked for.

sourcecode/release_info.py

@@ -0,0 +1,123 @@
+"""What this build is, and how far behind it is likely to be (C4-12).
+
+Field audit #8 ran a build self-reporting 3.5.0 while 4.0.1 was shipping and
+re-derived, by hand, twelve product complaints from rows already closed — one of
+them the answer to its own critical finding. Nothing in the output told the
+operator their build was eight releases behind, so remediation speed, the
+property `docs/DEFECT-LEDGER.md` exists to make visible, was invisible to the
+person it was for.
+
+Age in days is the wrong unit on its own, and measuring it is what shows why:
+that build was **three days old**. On this project's cadence three days is six
+releases. So the fact published here is the release date (a constant, in the
+build), and the derived figure is an **estimate** of how many releases have
+shipped since — labelled as an estimate, because a CLI cannot see an index it
+has no network to read. It never claims a newer release exists.
+
+`_meta.tool_release_date` carries the constant half; the envelope is
+byte-identical across runs by contract, so the age — which changes every day —
+is computed only where it is asked for, in `ask version`.
+"""
+
+from __future__ import annotations
+
+import datetime
+from typing import Any, Optional
+
+#: The date `__version__` was released, from that version's CHANGELOG entry.
+#: `tests/test_release_info.py` fails the build if the two disagree, so this is
+#: a copy of a fact rather than a second authority for it.
+RELEASE_DATE = "2026-08-03"
+
+#: Releases per day, measured over the 30 releases before this one (the same
+#: computation the test re-runs against the CHANGELOG). Stable across window
+#: sizes when it was taken — 2.25 over 10, 2.11 over 20, 2.07 over 30 — which is
+#: why a single figure is publishable at all.
+RELEASE_RATE_PER_DAY = 2.07
+
+#: How many releases behind is worth telling the operator about. Four, which on
+#: the measured cadence is about two days: one release is half a day and warning
+#: about it would put a line on almost every run, which is how an advisory stops
+#: being read. The field case — three days, an estimated six releases, eight in
+#: fact — is well past it. An assumption, not a measurement.
+STALE_AFTER_RELEASES = 4
+
+#: What the estimate is, in the words the payload uses. The rate is a
+#: measurement of the past, not a promise about the future, and the distinction
+#: is the whole reason this string is published beside the number.
+ESTIMATE_BASIS = (
+    f"{RELEASE_RATE_PER_DAY} releases/day, measured over the 30 releases before "
+    f"this one. An estimate of what has shipped since, not an observation: this "
+    f"build has no index to read and never claims a newer release exists."
+)
+
+#: Where this version's known-wrong answers are written down.
+DEFECT_LEDGER = "docs/DEFECT-LEDGER.md"
+
+#: How to move off this build. Named here so the advisory cannot drift from the
+#: distribution name in `pyproject.toml`.
+UPGRADE_COMMAND = "pip install -U sourcecode"
+
+
+def _today() -> datetime.date:
+    return datetime.date.today()
+
+
+def release_age_days(today: "Optional[datetime.date]" = None) -> int:
+    """Days between this build's release and *today*, never negative.
+
+    A build produced from a working tree ahead of the last CHANGELOG entry, or a
+    machine whose clock is behind, reads as age 0 rather than as a negative
+    number that would flow into the estimate as a negative release count.
+    """
+    try:
+        released = datetime.date.fromisoformat(RELEASE_DATE)
+    except ValueError:
+        return 0
+    return max(0, ((today or _today()) - released).days)
+
+
+def estimated_releases_since(today: "Optional[datetime.date]" = None) -> int:
+    """Releases likely shipped since this build. Rounded down: a floor, not a guess up."""
+    return int(release_age_days(today) * RELEASE_RATE_PER_DAY)
+
+
+def build_status(today: "Optional[datetime.date]" = None) -> "dict[str, Any]":
+    """What this build is and how far behind it probably is.
+
+    `advisory` is `None` on a fresh build — a line that appears on every run is a
+    line nobody reads, and this one exists to be read once.
+    """
+    from sourcecode import __version__
+
+    age = release_age_days(today)
+    behind = estimated_releases_since(today)
+    stale = behind >= STALE_AFTER_RELEASES
+
+    status: dict[str, Any] = {
+        "version": __version__,
+        "released": RELEASE_DATE,
+        "age_days": age,
+        "estimated_releases_since": behind,
+        "estimate_basis": ESTIMATE_BASIS,
+        "stale": stale,
+        "known_defects": (
+            f"{DEFECT_LEDGER} records what this version is known to get wrong. "
+            f"Rows closed after it shipped are not in this copy."
+        ),
+        "advisory": None,
+    }
+    if stale:
+        status["advisory"] = (
+            f"This build is {age} day{'s' if age != 1 else ''} old and this project "
+            f"released {RELEASE_RATE_PER_DAY} times a day over its last 30 releases "
+            f"(~{behind} since). Upgrade before reading an absent finding as a "
+            f"clean result: `{UPGRADE_COMMAND}`. What this version is known to get "
+            f"wrong is in {DEFECT_LEDGER}."
+        )
+    return status
+
+
+def advisory_line(today: "Optional[datetime.date]" = None) -> "Optional[str]":
+    """The one-line human form of `build_status()['advisory']`, or None when fresh."""
+    return build_status(today)["advisory"]

sourcecode/remedies.py

@@ -38,6 +38,10 @@ class Remedy:
     #: feature name — the evaluator's request was written in their own words, so
     #: the pointer has to be recognisable from the question they were asking.
     answers: str
+    #: The same thing in a help-screen column. A payload can afford the sentence;
+    #: a front page cannot, and rewriting it there by hand is how the pointer and
+    #: the capability drift apart.
+    headline: str = ""
 
     @property
     def invocation(self) -> str:
@@ -63,6 +67,7 @@ REMEDIES: "dict[str, Remedy]" = {
                 "this repository; to read every artefact that can set it with file:line "
                 "and rank the admissible sets by what they leave reachable"
             ),
+            headline="which profile set actually runs",
         ),
         Remedy(
             key="no_contracts_declared",
@@ -73,11 +78,23 @@ REMEDIES: "dict[str, Remedy]" = {
                 "and write `.ask/contracts.yml` from the current measurement instead of "
                 "by hand"
             ),
+            headline="derive contracts from measurement",
         ),
     )
 }
 
 
+def headlines() -> "tuple[tuple[str, str], ...]":
+    """`(invocation, headline)` for every remedy, for a help screen or a README.
+
+    Rendered rather than restated: the front page is where the evaluator looked
+    first and found neither of these commands.
+    """
+    return tuple(
+        (r.invocation, r.headline or r.answers) for r in REMEDIES.values()
+    )
+
+
 def remedy(key: str) -> Remedy:
     """The remedy for `key`. Raises rather than returning a silent blank, because a
     missing pointer is exactly the defect this module exists to prevent."""

sourcecode/rule_catalog.py

@@ -0,0 +1,108 @@
+"""The rules `spring-audit` ships, in the one place every reader is rendered from.
+
+The help screen used to name its own rules. It said `SEC-001..003` for two
+releases after CL-9 shipped SEC-004, SEC-005 and SEC-006, so the product
+advertised three security rules while holding six — the same shape as C4-1
+(`endpoints` missing from every help list) and C4-8 (a shipped capability the
+field asked for as a feature): a curated list beside a generated one drifts, and
+the curated one is what a buyer reads.
+
+Two seams keep this honest, and neither is a promise:
+
+* The **summaries** live here, keyed by rule id, and `--help` renders from them
+  rather than restating them.
+* The **id set** is not authored here at all. It belongs to the pattern
+  registries in `spring_tx_analyzer` and `spring_security_audit`, and
+  `tests/test_rule_catalog.py` derives it from them: a seventh SEC rule fails
+  the build until it has a line in this table. That import is deliberately not
+  done at module level — the analyzers are heavy and this module is imported to
+  render a help screen.
+
+A pattern class that emits several ids declares them in `pattern_ids`; one that
+emits its own declares nothing and is read through `pattern_id`.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+SCHEMA_VERSION = "rule-catalog-v1"
+
+
+@dataclass(frozen=True)
+class Rule:
+    """One audit rule, as a reader meets it."""
+
+    id: str
+    family: str        # "TX" or "SEC" — the scope flag that selects it
+    summary: str       # one line, no wrapping games
+
+    def to_dict(self) -> dict:
+        return {"id": self.id, "family": self.family, "summary": self.summary}
+
+
+RULES: tuple[Rule, ...] = (
+    Rule("TX-001", "TX", "@Transactional on private/final method (CGLIB proxy bypass)"),
+    Rule("TX-002", "TX", "REQUIRES_NEW nested in REQUIRED call chain"),
+    Rule("TX-003", "TX", "readOnly=true boundary propagating to write operation"),
+    Rule("TX-004", "TX", "NOT_SUPPORTED/NEVER within active TX chain"),
+    Rule("TX-005", "TX", "Exception swallowing inside @Transactional"),
+    Rule("TX-006", "TX", "Self-invocation of @Transactional sibling (proxy bypass)"),
+    Rule("SEC-001", "SEC", "Unsecured endpoint in annotation_based security model"),
+    Rule("SEC-002", "SEC", "CVE-2025-41248: @PreAuthorize inherited from a generic supertype"),
+    Rule("SEC-003", "SEC", "@Transactional on @Controller/@RestController (TX in wrong layer)"),
+    Rule("SEC-004", "SEC", "Password stored under a fast unsalted digest (SHA-1, MD5)"),
+    Rule("SEC-005", "SEC", "CSRF disabled under session-bearing authentication"),
+    Rule("SEC-006", "SEC", "Cookie created without the Secure attribute"),
+    Rule("SEC-007", "SEC", "Credential stored in a deployment descriptor"),
+)
+
+FAMILY_ORDER: tuple[str, ...] = ("TX", "SEC")
+
+
+def ids() -> tuple[str, ...]:
+    """Every rule id this build can emit, in help order."""
+    return tuple(rule.id for rule in RULES)
+
+
+def for_family(family: str) -> tuple[Rule, ...]:
+    return tuple(rule for rule in RULES if rule.family == family)
+
+
+def range_label(family: str) -> str:
+    """`TX-001..006` — the span a one-line summary can carry without lying."""
+    rules = for_family(family)
+    if not rules:
+        return ""
+    if len(rules) == 1:
+        return rules[0].id
+    first, last = rules[0].id, rules[-1].id
+    _, _, tail = last.partition("-")
+    return f"{first}..{tail}"
+
+
+def summary_line() -> str:
+    """The command's one-liner: the families and how far each one reaches."""
+    return " + ".join(
+        f"{'TX anomalies' if fam == 'TX' else 'security surface'} "
+        f"({range_label(fam)})"
+        for fam in FAMILY_ORDER
+        if for_family(fam)
+    )
+
+
+def help_lines(*, indent: str = "      ") -> list[str]:
+    """One line per rule, id column aligned, for a `--help` screen."""
+    width = max(len(rule.id) for rule in RULES)
+    return [f"{indent}{rule.id.ljust(width)}  {rule.summary}" for rule in RULES]
+
+
+def render_help_block(*, indent: str = "      ") -> str:
+    return "\n".join(help_lines(indent=indent))
+
+
+def render_markdown() -> str:
+    """The docs table, generated from the same tuple."""
+    lines = ["| Rule | Detects |", "|---|---|"]
+    lines.extend(f"| `{rule.id}` | {rule.summary} |" for rule in RULES)
+    return "\n".join(lines)

sourcecode/schemas/envelope-v1.schema.json

@@ -19,6 +19,11 @@
       "description": "Release that produced the payload.",
       "type": "string"
     },
+    "tool_release_date": {
+      "description": "Date the release that produced this payload shipped (ISO 8601). A constant of the build, so the envelope stays byte-identical across runs; the AGE is derived by the consumer, or printed by `ask version`, which also estimates how many releases have shipped since.",
+      "type": "string",
+      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}$"
+    },
     "command": {
       "description": "Full path through the command tree, e.g. \"retrieve endpoint-inventory\".",
       "type": "string",
@@ -27,7 +32,9 @@
     "scope": {
       "description": "What was analysed. Absent when the command addresses no path.",
       "type": "object",
-      "required": ["path"],
+      "required": [
+        "path"
+      ],
       "properties": {
         "path": {
           "description": "Absolute path the command was pointed at.",

sourcecode/security_config_scan.py

@@ -83,6 +83,44 @@ _INSECURE_COOKIE_PROPERTY = re.compile(
     re.IGNORECASE,
 )
 
+# ── SEC-007: a stored credential in a deployment descriptor ───────────────────
+# CL-10. NC-002 declares "no secrets outside Java/YAML", which is honest and
+# wider than it needs to be: audit #8's credential sits in the `web.xml` files
+# `environment_resolution`, `filter_surface` and `path_filters` already read —
+# `monitor:{SHA-256}dc20b820…`, unsalted, the SAME hash in all three
+# per-environment overlays. The gap was admission surface, not detection.
+#
+# The rule fires on the SHAPE of the value, not on the name of the parameter
+# carrying it (VAI): a digest tag followed by a hex literal is a stored
+# credential wherever it appears, and needs no vendor vocabulary to recognise.
+
+#: `{SHA-256}dc20…` — the platform-neutral form for a digested credential written
+#: into a configuration value. The tag is spec vocabulary (RFC 2307 / LDAP, and
+#: every container that copied it); the hex run is what makes it a stored value
+#: rather than a reference to one.
+_DIGEST_LITERAL = re.compile(
+    r"\{(?P<algo>SHA-?(?:1|256|384|512)|SSHA|MD5|CRYPT)\}(?P<digest>[A-Za-z0-9+/=]{16,})",
+    re.IGNORECASE,
+)
+
+#: A descriptor value that is a reference, not a credential: resolved at deploy
+#: time from somewhere this repository does not contain.
+_PLACEHOLDER = re.compile(r"^\s*[$@%]?[{(]?[^{}()]*[}\)]?\s*$")
+_IS_REFERENCE = re.compile(r"[$@]\{[^}]+\}|^\s*$|^\s*ENC\(|^\s*\*+\s*$")
+
+#: XML elements whose text is a configured VALUE. Servlet/JEE spec vocabulary.
+_DESCRIPTOR_VALUE = re.compile(
+    r"<(?P<tag>param-value|env-entry-value|value|property|password)\b[^>]*>"
+    r"(?P<value>[^<]*)</(?P=tag)>",
+    re.IGNORECASE,
+)
+
+#: Files a deployment descriptor scan admits. `web.xml` and the Spring XML
+#: contexts are the two `environment_resolution` already classifies, so this adds
+#: no new reader — it narrows what NC-002 excludes to what we genuinely cannot see.
+_DESCRIPTOR_NAMES = ("web.xml",)
+_DESCRIPTOR_SUFFIXES = ("-context.xml",)
+
 
 @dataclass(frozen=True)
 class SecurityConfigObservation:
@@ -219,6 +257,78 @@ def _scan_config(text: str, rel: str) -> "list[SecurityConfigObservation]":
     return out
 
 
+def _scan_descriptor(text: str, rel: str) -> "list[SecurityConfigObservation]":
+    """SEC-007 — a credential written into a deployment descriptor (CL-10).
+
+    Matched on the value's shape. A descriptor that carries `${admin.password}`
+    holds a reference and is not reported; one that carries a digest literal
+    holds the credential itself, in a file under version control.
+    """
+    out: "list[SecurityConfigObservation]" = []
+    for match in _DESCRIPTOR_VALUE.finditer(text):
+        value = match.group("value").strip()
+        if not value or _IS_REFERENCE.search(value):
+            continue
+        digest = _DIGEST_LITERAL.search(value)
+        if digest is None:
+            continue
+        out.append(SecurityConfigObservation(
+            rule="SEC-007",
+            file=rel,
+            line=_line_of(text, match.start()),
+            symbol=rel,
+            # The digest is truncated on purpose: enough to correlate two files,
+            # never enough to make this payload a place to read a credential from.
+            evidence=f"<{match.group('tag')}>…{{{digest.group('algo')}}}"
+                     f"{digest.group('digest')[:8]}…",
+            detail=(
+                f"A credential is stored in this deployment descriptor as a "
+                f"{digest.group('algo').upper()} digest. It is under version control, so "
+                f"every reader of the repository holds it, and the digest is a fast "
+                f"unsalted hash rather than a password hash — recovering the input is "
+                f"a dictionary run, not an attack."
+            ),
+        ))
+    return out
+
+
+def _shared_across_environments(
+    observations: "list[SecurityConfigObservation]",
+) -> "list[SecurityConfigObservation]":
+    """Say when the same stored credential appears in more than one descriptor.
+
+    Audit #8's finding was not one credential in one file: it was the SAME hash
+    in the DPA, M3 and M3DEV overlays, which is a fact about the deployment —
+    three environments share one credential, so compromising the least protected
+    one is compromising all three. Composed here because both halves are already
+    in this list and neither file knows about the other.
+    """
+    by_digest: "dict[str, list[SecurityConfigObservation]]" = {}
+    for obs in observations:
+        if obs.rule != "SEC-007":
+            continue
+        by_digest.setdefault(obs.evidence, []).append(obs)
+
+    out: "list[SecurityConfigObservation]" = []
+    for obs in observations:
+        siblings = by_digest.get(obs.evidence, []) if obs.rule == "SEC-007" else []
+        if len(siblings) > 1:
+            others = sorted({s.file for s in siblings if s.file != obs.file})
+            if others:
+                obs = SecurityConfigObservation(
+                    rule=obs.rule, file=obs.file, line=obs.line, symbol=obs.symbol,
+                    evidence=obs.evidence,
+                    detail=(
+                        obs.detail + " The same digest is declared in "
+                        + ", ".join(others)
+                        + ": these deployments share one credential, so the least "
+                        "protected of them decides the strength of all of them."
+                    ),
+                )
+        out.append(obs)
+    return out
+
+
 #: Configuration extensions worth reading for the property form of these decisions.
 _CONFIG_SUFFIXES = (".properties", ".yml", ".yaml")
 
@@ -259,4 +369,25 @@ def scan_security_configuration(
             continue
         out.extend(_scan_config(text, rel))
 
-    return sorted(out, key=lambda o: (o.rule, o.file, o.line))
+    # CL-10 — the descriptors. Discovered the same way `environment_resolution`
+    # classifies them, so the two surfaces cannot disagree about which files are
+    # deployment descriptors, and a per-environment overlay tree is covered
+    # because the walk finds the file wherever the build put it.
+    descriptors: "list[str]" = []
+    try:
+        for path in root.rglob("*.xml"):
+            name = path.name.lower()
+            if name in _DESCRIPTOR_NAMES or name.endswith(_DESCRIPTOR_SUFFIXES):
+                descriptors.append(path.relative_to(root).as_posix())
+    except OSError:
+        pass
+    for rel in sorted(set(descriptors)):
+        try:
+            text = (root / rel).read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        out.extend(_scan_descriptor(text, rel))
+
+    return sorted(
+        _shared_across_environments(out), key=lambda o: (o.rule, o.file, o.line)
+    )

sourcecode/spring_security_audit.py

@@ -7,6 +7,7 @@ Patterns implemented (Phase 3):
   SEC-004  Password stored under a fast unsalted digest (CL-9)
   SEC-005  CSRF disabled under session-bearing authentication (CL-9)
   SEC-006  Cookie created without the Secure attribute (CL-9)
+  SEC-007  Credential stored in a deployment descriptor (CL-10)
 
 All patterns are deterministic and never raise.
 """
@@ -386,7 +387,8 @@ def _controller_source_file(cir: "CanonicalRepositoryIR", controller_fqn: str) -
 
 class _SEC00XConfigurationWeaknesses:
     """The textbook rules (CL-9): SEC-004 password storage, SEC-005 CSRF under
-    session authentication, SEC-006 a cookie without the Secure attribute.
+    session authentication, SEC-006 a cookie without the Secure attribute — and
+    SEC-007 (CL-10), a credential stored in a deployment descriptor.
 
     One pattern for three rules because they share a scan of the same files, and
     because the alternative — three passes over the source per audit — is how a
@@ -400,12 +402,20 @@ class _SEC00XConfigurationWeaknesses:
 
     pattern_id = "SEC-004"  # the group's identity for the Protocol; each finding carries its own
 
-    _SEVERITY = {"SEC-004": "high", "SEC-005": "medium", "SEC-006": "medium"}
+    _SEVERITY = {
+        "SEC-004": "high", "SEC-005": "medium", "SEC-006": "medium",
+        # A credential every reader of the repository already holds.
+        "SEC-007": "high",
+    }
     _TITLE = {
         "SEC-004": "Password stored under a fast unsalted digest",
         "SEC-005": "CSRF protection disabled under session-bearing authentication",
         "SEC-006": "Cookie created without the Secure attribute",
+        "SEC-007": "Credential stored in a deployment descriptor",
     }
+    #: A pattern that emits more than one rule id declares them all, so a catalogue
+    #: reader is never left with the group's identity standing for the group.
+    pattern_ids = tuple(_TITLE)
     _FIX = {
         "SEC-004": (
             "Store passwords with an adaptive, salted function — BCryptPasswordEncoder, "
@@ -422,6 +432,13 @@ class _SEC00XConfigurationWeaknesses:
             "Set the Secure attribute (and HttpOnly, and SameSite) on session cookies, "
             "and configure it per environment rather than in code."
         ),
+        "SEC-007": (
+            "Move the credential out of the descriptor: read it from an environment "
+            "variable or a secret store and leave a ${placeholder} in the file. Rotate "
+            "it — it is in the history of every clone, so removing the line does not "
+            "retire it — and give each environment its own, so the least protected "
+            "deployment stops deciding the strength of the others."
+        ),
     }
 
     def analyze(

{sourcecode-4.0.0.dist-info → sourcecode-4.1.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.0.0
+Version: 4.1.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -97,13 +97,25 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 2.5.1
+ask version                    # ask 4.1.0 — and, on a build that has aged,
+                               # how many releases have probably shipped since
 ```
 
 > **Package vs. command.** The install package is named `sourcecode` this release
 > (renaming the distribution is a separate, breaking change). Installing it gives you the
 > canonical **`ask`** command plus the deprecated **`sourcecode`** alias.
 
+> **Platforms.** Developed and tested on macOS and Linux; every release runs its full
+> battery there. **Windows/PowerShell is a target we cannot verify:** the CLI is written
+> for it — UTF-8 streams are forced at both console entry points, a successful run writes
+> nothing to stderr (PowerShell 5.1 raises `NativeCommandError` on any stderr write), and
+> the MCP server strips the BOM PowerShell puts on stdin — but no Windows runner exists in
+> the battery. Three separate field reports of console mojibake (`—` rendering as `â€"`)
+> have never reproduced under measurement, and the only variable those reports share is the
+> platform we cannot exercise (C3-3, C3-12, C3-38 in the
+> [defect ledger](docs/DEFECT-LEDGER.md)). On Windows, prefer `--output <file>` over shell
+> redirection, and report a rendering problem rather than assuming it is known.
+
 ---
 
 ## Quickstart
@@ -129,6 +141,26 @@ ask spring-audit /path/to/repo
 ask migrate-check /path/to/repo --compact
 ```
 
+**Then the three that finish the sentence the four above start.** A profile-set answer stays
+conditional until you know which set the deployment starts with, a gate nobody can populate is
+a gate nobody runs, and a defect ranked without its reach is a linter note:
+
+```bash
+# Which profile set ACTUALLY runs? Reads every artefact that can set it — build,
+# descriptors, Dockerfile, Compose, Kubernetes, launch scripts — with file:line, and
+# says NOT DECIDED IN THIS REPOSITORY when nothing in the tree decides it. Then ranks
+# every admissible set by what it leaves reachable without authentication.
+ask posture /path/to/repo --resolve-environments
+
+# Derive the contracts this repository already satisfies, execute each one before
+# writing it, and populate .ask/contracts.yml from the measurement instead of by hand.
+ask verify /path/to/repo --init
+
+# What each defect actually costs once reach, access and write effect are in it:
+# severity × reachability × auth_verdict × write_effect, ordered, every factor traceable.
+ask risk /path/to/repo
+```
+
 Then the everyday loop:
 
 ```bash
@@ -145,13 +177,17 @@ ask onboard /path/to/repo
 ask review-pr /path/to/repo --since main
 
 # CI gate on NEW violations only, instead of on pre-existing debt
+ask verify /path/to/repo --init               # derive the contracts, don't hand-write them
 ask verify /path/to/repo --capture-baseline   # accept today's debt, once
 ask verify /path/to/repo                      # then: only new violations block
 ```
 
-> **Adopting a gate on a real codebase.** A repository that starts declaring contracts already
-> violates them somewhere; `ask verify` is **baseline-relative by default** (`--fail-on new`)
-> so the gate survives contact with reality instead of being switched off on day one.
+> **Adopting a gate on a real codebase.** Nobody hand-writes contracts for a 3 000-file
+> monolith, so `ask verify --init` derives the ones the repository satisfies **today** and
+> executes each before writing it — init followed by verify passes by construction.
+> A repository that starts declaring contracts already violates them somewhere; `ask verify`
+> is **baseline-relative by default** (`--fail-on new`) so the gate survives contact with
+> reality instead of being switched off on day one.
 > `ask baseline capture|diff|trend` is a different thing: versioned architectural metrics over
 > time, for trend reporting rather than blocking.
 
@@ -194,10 +230,32 @@ What a profile set **actually wires**: which conditional beans register, which d
 `ask posture` · `ask posture --diff dev:prod` · `ask posture --property k=v`
 → [posture.md](docs/posture.md)
 
+**`--resolve-environments` carries it past the edge of the repository.** Every answer above
+is conditional on a profile set, and which set runs is decided by the deployment. This flag
+reads every artefact in the tree that can set `spring.profiles.active` — Maven/Gradle,
+`web.xml`, `Dockerfile`, Compose, Kubernetes, launch scripts — with `file:line`, and returns
+`decided_in_repository`, `artefacts_disagree` (two deployments, never resolved by picking
+one) or **`NOT DECIDED IN THIS REPOSITORY`**. Then it resolves every admissible set over one
+parse and publishes the worst. A field audit closed those five hops by hand with grep before
+the flag existed.
+`ask posture . --resolve-environments`
+
 Unresolved is a first-class outcome: a condition the resolver cannot decide is reported as a
 hole with the condition named, never folded into active or inactive. **A posture answer that
 guesses is a confident security falsehood — the worst failure mode this tool has.**
 
+### 5c · Composed Risk *(experimental)*
+Every command above answers one axis, and a reader composes them by hand. `ask risk` does the
+join over the endpoint and symbol ids these commands already share with each other:
+`severity_effective = defect_severity × reachability × auth_verdict × write_effect`. The
+product of the published factors **is** the published score — decomposable to the four
+figures and the authority behind each — and an axis this build cannot measure is `unknown`,
+weighted 1.0 and named in `blind_axes` rather than silently treated as safe. Measured on a
+field case: a defect both `spring-audit` and `impact-chain` called *medium* composes to
+**high (8.06)** once *reachable unauthenticated* and *writes to the database* are in it.
+`ask risk .` · `ask risk . --min-band high` · `ask risk . --limit 10`
+→ [reference](docs/USER_GUIDE.md)
+
 ### 6 · Developer Workflows
 The everyday loop: diff-based PR review, symptom-driven bug triage, and delta context for continuous agent runs.
 `ask review-pr` · `ask fix-bug` · `ask prepare-context`
@@ -285,7 +343,7 @@ reading JSON sees the same boundary a buyer reads here.
 | Not covered | Why | What answers it |
 |---|---|---|
 | **Whether request input reaches a sink — no dataflow or taint analysis.** | This engine resolves structure and wiring without compiling. Taint needs value flow through a program, which is a different analysis with a different failure mode: an unsound one produces confident findings that are wrong, and every claim here is meant to be checkable against the line that produced it. | A dataflow scanner (Semgrep, CodeQL). What this product adds on top is reachability: which of that tool's findings sit behind an endpoint that is reachable unauthenticated. |
-| **Secrets outside Java and Spring configuration — a credential in a deployment descriptor, a Helm value, a CI variable file.** | The file population this analyzer reads is the Java source and the Spring configuration convention. A secret elsewhere is not missed by a weak rule; it is outside the set of files anything here opens. | A dedicated secret scanner over the whole tree (gitleaks, trufflehog). |
+| **Secrets outside Java, Spring configuration and the deployment descriptors — a Helm value, a CI variable file, a shell script.** | The file population this analyzer reads is the Java source, the Spring configuration convention and the descriptors it already parses to resolve an environment. A secret elsewhere is not missed by a weak rule; it is outside the set of files anything here opens. Narrowed by CL-10: a credential stored in `web.xml` or a Spring XML context IS reported (SEC-007), because those files were already being read. | A dedicated secret scanner over the whole tree (gitleaks, trufflehog). |
 | **Filter-chain order and per-filter URL patterns — the presence of a custom filter is structural only.** | Which filter runs first is decided by bean ordering this analyzer does not resolve. Where two active configurations both match a request, the answer published is `undecided` rather than a guess. | `ask posture --profile <set>` states per endpoint what the readable rules decide and what they leave undecided. |
 | **Known vulnerabilities in dependencies — no CVE database, no version advisory matching.** | Enriching a vulnerability feed is a different product with a different update cadence; a stale embedded database is worse than no database, because it reads as a clean bill of health. | A dependency scanner (Trivy, OWASP Dependency-Check). `impact-chain` then answers which of its findings anything actually reaches. |
 

{sourcecode-4.0.0.dist-info → sourcecode-4.1.0.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=eDauw_R82BOI1zuajxATrPedKVSZuW09pYQhvMq5lro,308
+sourcecode/__init__.py,sha256=apfUI_GpozMGQBqfAZGbrSQGmV6iibhGJAm1wFVTQvc,308
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/archetype.py,sha256=HBGTTaS-bVHS6pdacPUMKcMxklkDEKnZMgz48Kc3yec,37630
 sourcecode/architectural_baseline.py,sha256=7QzJri4pbL3nzAn9gNutZW6mZR8HHD6H2C2H1EEwYPE,17904
@@ -16,7 +16,7 @@ sourcecode/chain_rules.py,sha256=Bi6UHfgd-GxWswmnHRcPz5jdbAuqka3Zkz_P-MTvqhw,127
 sourcecode/change_plan.py,sha256=kFjjp16XYbupgkv1CPkfqo39_SiZPMRQ8OOfC-Vy9eg,7929
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=C8aSVlSeBZtU5vmNSF4cZl7Gu-iQ_OtcaJ5UMl3xIBU,448225
+sourcecode/cli.py,sha256=bPG84FLZTsYZits8DFjyl6tYLBAlWhAeS8-pCU2CvhQ,449990
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=xq3zsqAOAw4AWkoD9khb9xDP_O3KvwqO9k-pf8sbi3g,10951
 sourcecode/confidence_analyzer.py,sha256=5li0NyOdS3Ie-f2ZY1gBmnjtkuRvI50l4OnGaKkXAOU,22358
@@ -40,7 +40,7 @@ sourcecode/endpoint_literals.py,sha256=Qf4gTZzvNSFDGDuOvF0YRL9NvaYKKj24klhR5LIOa
 sourcecode/endpoint_metrics.py,sha256=sLSLUIgiIyvNdOynaxVgHd9SjRF_DbN3QxevaquykaU,2840
 sourcecode/entrypoint_classifier.py,sha256=jhTYlyqDJH2AtdEcLVaRU3lYRTJuF8DkxVzl4-W3zWE,5322
 sourcecode/env_analyzer.py,sha256=oLz4gDUE3BHlRRn6Qj4rnbjwyYjIZ0nlqO_SBQwL_H8,21999
-sourcecode/envelope.py,sha256=OBYOfhcwXf6W9sq7iO3oQU0-f_EFstquupVAMJtfdUY,6900
+sourcecode/envelope.py,sha256=IIUY6q_VPGsDfmlZri1GORXcYiAKvQepGoI-B0N0orE,7372
 sourcecode/environment_resolution.py,sha256=FajZhyLFJblYMb4VORm1fdP4RsQ8TJKySG9uh5IE7bU,13838
 sourcecode/error_schema.py,sha256=uwosfNaSujtYm11_732Hu92z5ITV040fQDaIyefSvR4,1683
 sourcecode/evidence_provider.py,sha256=GSSL44JEaouO5AHks2sB3d1YvC9xIKIld1yBYxZpXxo,4277
@@ -63,7 +63,7 @@ sourcecode/mcp_nudge.py,sha256=lKemOqK_wny2u7Ymcr2Idi5Kx8pXY02jCi-_nJYLGMg,2992
 sourcecode/metrics_analyzer.py,sha256=gLoRWKygF18jLgwsqmGXSWopw-f5iO1VbM7Jjdif6ag,22809
 sourcecode/migrate_check.py,sha256=jMv1GMhMthpHCnoEtkKWHiIC2Not2kdbU4UaA9sWX7I,134643
 sourcecode/migration_blast.py,sha256=OPryWkM6-PbvcG3eJFdcWUnlpXBje41nu2BkrZnE2hg,9359
-sourcecode/non_coverage.py,sha256=YoCIOlLYoBDv94rxQ5r7L755WeEz05OKo2zU_jt9_a8,7985
+sourcecode/non_coverage.py,sha256=u6-09dt21B2IltIWPC53KAo1ok7PU-u1rM38N16RhRY,8238
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
 sourcecode/output_budget.py,sha256=__DQrIg7MGsYrd0_S3lyd3AG0a0jWNGr55v5Gg9kK0U,12347
 sourcecode/parse_cache.py,sha256=SnHOhNTvAqHm_PXImPVBuj7NEoOQRn8dfIZHEqOFENs,7565
@@ -71,7 +71,7 @@ sourcecode/path_admission.py,sha256=OGNSoluhVh8YYOBZBnACUrkmH4Tp_yxjGLifkcsxQpo,
 sourcecode/path_filters.py,sha256=qPKO7kRmVp2y9zjLNSuAVCbcpZrIInHE4QulLUlzPFI,10412
 sourcecode/perf.py,sha256=GAcEoouPIlPMCQIcHNToxK6K3WdIR-lj9aFg4prOYJI,9743
 sourcecode/pipe_contract.py,sha256=PML0Er5d8uDyec4OrdUXuyqHbGPUYndjeaKUjkFz2u4,8369
-sourcecode/posture.py,sha256=-r4LxE1-GISz8hvKmVMQRipEWlAPbmtVbi6Z6D0DFTI,49479
+sourcecode/posture.py,sha256=obE9lB3dxan5MDOm3eFQ-aQX3DrJQxAU_D2OyYZrYwk,53981
 sourcecode/pr_comment_renderer.py,sha256=239PmJdf95av_ZW236C7_tvq_ahECeuF9AZxrheJ4OQ,15573
 sourcecode/pr_impact.py,sha256=eaFgcPMDsjaF8VZvcitFWCPCabMTi-khtGdxpK0wXTQ,22461
 sourcecode/prepare_context.py,sha256=B8TiBQbazxUOz6D37Dt9zqbOtD5b2S_fR3MB15P9DrI,237206
@@ -81,18 +81,20 @@ sourcecode/readiness_timeline.py,sha256=qqc14vL9nj9E4qw4bVZpGhfMLaVaYr9s6Pak_VUI
 sourcecode/reconciliation.py,sha256=GU-1PTcVr8zcbtC7BASfpHcZndP9AdboXPNQiBc0fzo,34251
 sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/reference_facts.py,sha256=Ns495c6eTmq2SrqPkcUrJUJru4_wj_yRWm4YDeJwves,13440
+sourcecode/release_info.py,sha256=r8GlRnraTQH_olGkdpbCAzBb0B_Js1cRBPaRe7IUoyU,5378
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
-sourcecode/remedies.py,sha256=iOWms6MiD_PQEk1yq-puO6iMihtclSt3PowRFz_2cGs,3575
+sourcecode/remedies.py,sha256=oMLpxrup88yCOalrsHWM1-kc0penm68q4HV0H7kxia0,4279
 sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg,12965
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
 sourcecode/repository_ir.py,sha256=t4RSLn00mkru5p54KXsT3tmG78FjXKNFDMl2YR-jLiM,355314
 sourcecode/ris.py,sha256=Xin3d3U43-VthgRA6ttJnyIow8iyUEsQCBENvZc4eEc,23782
 sourcecode/risk.py,sha256=SRTJfFHCD8enHXVJapEff6lgwdicfeHOHkEcHp2o6iw,14262
+sourcecode/rule_catalog.py,sha256=buU6qZI1j1EjqAWOIzeDhZ9kO_6Tp_Ma-dmexNWkMe0,4324
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=z3CV0rcGunu0Y8mpNgp07wI7nxT0pxw1BkXRRtI0Rpo,9609
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
 sourcecode/security_config.py,sha256=KblMEoRiEjrIE68YsPaUAFebxFp8UM7MS7lAk5CGD8U,3531
-sourcecode/security_config_scan.py,sha256=tG9KgmOdVOPz8PGJ6FPz3IvbR2irfkXxvTImlA7qrOM,9979
+sourcecode/security_config_scan.py,sha256=TZj8qkg8XAMPPPDSSrJvWrvJn9hmgR-V-Sl9SRF4G2w,16148
 sourcecode/security_posture.py,sha256=CjJ2Qm87HhKXepnaWx1ncJLW-SxI18udCmUDIkCyAsY,50270
 sourcecode/semantic_analyzer.py,sha256=bpgdC6m0_ftVtRf3rSdwhbhWjnZnGxRXaZVcfe4BbcQ,95414
 sourcecode/semantic_impact_engine.py,sha256=t09IirGC3JjQDy33JZd1_WKzQVKXkoNl3-XEUr5kjis,20563
@@ -105,7 +107,7 @@ sourcecode/spring_impact.py,sha256=ie1j6N8qIEvsJjFw3hVsG2BWRFIAXWAG0MZ7rzfJhfQ,7
 sourcecode/spring_model.py,sha256=zOAgFmrRbG4a6KLm1TJl55aWMyPNsz3OS3FSczqPG6A,16594
 sourcecode/spring_profiles.py,sha256=-kwrCK0O-MRjrCp6SA1d31t--o4Tg87iqPVrTwxoIUs,19605
 sourcecode/spring_properties.py,sha256=kPTk5qAJxdbHc1hclhHAP0O-hCIzBn8PTh3lzl-I4a4,8400
-sourcecode/spring_security_audit.py,sha256=-KamVr0DGkGAabmx21jiCOjh-1BaOAXveL5B3xOrt70,27757
+sourcecode/spring_security_audit.py,sha256=KIjshNuS-cQSUBstqCuvDnp5i1J4_qAwXYKJArL2QpI,28720
 sourcecode/spring_semantic.py,sha256=UrmLg_4gmBVmMqvSnUMgSReVEERVGv3X7LYDBEs6k_o,16598
 sourcecode/spring_tx_analyzer.py,sha256=_wqjRktqdPS6PiXXxtTkCD1t6BaE2uhqx6ioYY-ULAw,44153
 sourcecode/summarizer.py,sha256=0aD4x3vgPngqBCEBKGuES1J2Vk5f7mqCm_ZWErwm3js,27025
@@ -173,15 +175,15 @@ sourcecode/retrieval/steps_impact.py,sha256=vvU4MSEECkrEMTyKqivDuw-R_b32nghk-Na1
 sourcecode/retrieval/steps_intf.py,sha256=vWyAn17O7G8-CdD9Qx0X-t60X7IpZxBZnmIlBkQUEDo,11657
 sourcecode/retrieval/steps_struct.py,sha256=Y9043laxxPS9zeV509WRI4vPSHfnjci6WKxZX1Ryqhw,13843
 sourcecode/retrieval/steps_txsec.py,sha256=5yB4uUrY7_tb4WP2Dh7SEaQwn9m1kS_z6HP0sryKuiM,17753
-sourcecode/schemas/envelope-v1.schema.json,sha256=lABkyKqXND039JUY2R6KK47OCDco5mq5PLgkcCXFhOQ,3477
+sourcecode/schemas/envelope-v1.schema.json,sha256=Zu5D2cspa_biP5-JMWY0H6oYGyAyA4sII3x1X7rdAVs,3886
 sourcecode/telemetry/__init__.py,sha256=ZxV5AJAK5_pk0RnW0B1ntpGPRapOX_XKFJdT_6RuYhE,3502
 sourcecode/telemetry/config.py,sha256=HD5ccO_k91WxDsnMo1lmxaF906bK3nrLv8qzUR3HbTo,4212
 sourcecode/telemetry/consent.py,sha256=pQdl-QeLl6Gcibn0eWHSKZrm-HYSsjpVqOnjrgFp8co,2472
 sourcecode/telemetry/events.py,sha256=4_yeO58U-Cwc1Qb27VB0_EjhmroY0k91n3_VGxeALB8,2776
 sourcecode/telemetry/filters.py,sha256=RzxauTz8HliO4BllQnXEXc7zTeqdCZi5MgqGEDuW7OQ,6570
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-4.0.0.dist-info/METADATA,sha256=n1G9QYjGcq7ZxoRbpszTorb53pbwaPngQa5NazRDAuM,23967
-sourcecode-4.0.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-4.0.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-4.0.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-4.0.0.dist-info/RECORD,,
+sourcecode-4.1.0.dist-info/METADATA,sha256=O0Dj7DN2b55Cvv2qxRRbSQJbEbEB9c-jL4ySO1Xd98s,28102
+sourcecode-4.1.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-4.1.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-4.1.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-4.1.0.dist-info/RECORD,,