sourcecode 4.0.1__py3-none-any.whl → 4.1.0__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.0.1"
+__version__ = "4.1.0"

sourcecode/cli.py

@@ -8934,8 +8934,16 @@ def version_cmd() -> None:
       {"cli_version": "1.33.11", "mcp_schema_version": "1.33.11",
        "compatibility_schema_version": "1.0"}
     """
+    from sourcecode.release_info import advisory_line, build_status
+
     if getattr(sys.stdout, "isatty", lambda: False)():
         typer.echo(f"ask {__version__}")
+        # C4-12: the field audits builds that are days old and many releases
+        # behind, and nothing said so. Printed only when it applies — an advisory
+        # on every run is one nobody reads.
+        _advisory = advisory_line()
+        if _advisory:
+            typer.echo(_advisory)
     else:
         import json as _json_ver
         from sourcecode.envelope import ENVELOPE_VERSION, available_schemas
@@ -8943,6 +8951,10 @@ def version_cmd() -> None:
             "cli_version": __version__,
             "mcp_schema_version": __version__,
             "compatibility_schema_version": "1.0",
+            # Which release this is, when it shipped, and how far behind it
+            # probably is. The estimate carries its basis and never claims a
+            # newer release exists (C4-12).
+            "build": build_status(),
             # What a consumer should actually pin against: the release string
             # changes every release, the envelope version only when the output
             # contract does.

sourcecode/envelope.py

@@ -123,6 +123,16 @@ def build_meta(
         "tool_version": __version__,
         "command": command,
     }
+    # C4-12: a consumer holding a payload could not tell how old the build that
+    # produced it was. The DATE is a constant of the build, so it goes here; the
+    # AGE changes daily and would break the byte-identical property above, so it
+    # is derived where it is asked for (`ask version`), never in the envelope.
+    try:
+        from sourcecode.release_info import RELEASE_DATE
+
+        meta["tool_release_date"] = RELEASE_DATE
+    except Exception:
+        pass
     if schema_version:
         meta["schema_version"] = schema_version
 

sourcecode/non_coverage.py

@@ -74,13 +74,16 @@ NON_COVERAGE: tuple[NonCoverage, ...] = (
         id="NC-002",
         surface="security_surface",
         not_covered=(
-            "Secrets outside Java and Spring configuration — a credential in a "
-            "deployment descriptor, a Helm value, a CI variable file."
+            "Secrets outside Java, Spring configuration and the deployment "
+            "descriptors — a Helm value, a CI variable file, a shell script."
         ),
         why=(
-            "The file population this analyzer reads is the Java source and the "
-            "Spring configuration convention. A secret elsewhere is not missed by "
-            "a weak rule; it is outside the set of files anything here opens."
+            "The file population this analyzer reads is the Java source, the Spring "
+            "configuration convention and the descriptors it already parses to "
+            "resolve an environment. A secret elsewhere is not missed by a weak "
+            "rule; it is outside the set of files anything here opens. Narrowed by "
+            "CL-10: a credential stored in `web.xml` or a Spring XML context IS "
+            "reported (SEC-007), because those files were already being read."
         ),
         instead="A dedicated secret scanner over the whole tree (gitleaks, trufflehog).",
     ),

sourcecode/posture.py

@@ -381,6 +381,87 @@ def resolve_beans(
     )
 
 
+#: CL-11 — container settings that make the resolution below a DEFAULT rather
+#: than a description of what runs. Each says what the container will no longer
+#: report, in the terms of the verdict it qualifies. Published Spring property
+#: names, so this is framework vocabulary, never a client's own configuration.
+_OBSERVABILITY_AMPLIFIERS: "tuple[tuple[str, str], ...]" = (
+    (
+        "spring.main.allow-bean-definition-overriding",
+        "a second bean definition for a name resolved here REPLACES it instead of "
+        "failing at startup, so a security configuration can be overridden by one "
+        "this resolution never saw and nothing in the deployment reports the "
+        "disagreement",
+    ),
+    (
+        "spring.main.allow-circular-references",
+        "a wiring cycle through the beans resolved here is repaired at runtime by "
+        "injecting a proxy rather than refused, so the instance that ends up in the "
+        "chain need not be the one this resolution describes",
+    ),
+)
+
+#: Values Spring reads as "on". Compared case-insensitively, as Spring does.
+_TRUTHY = frozenset({"true", "yes", "on", "1"})
+
+
+def container_observability(properties: "EffectiveProperties") -> dict:
+    """Whether the container would report a disagreement with this resolution (CL-11).
+
+    Audit #8 found `allow-bean-definition-overriding: true` and
+    `allow-circular-references: true` in the repository whose entire security
+    verdict turns on which `SecurityConfig` bean wins. On its own each is a
+    preference; beside a conditional security verdict each is the reason that
+    verdict is a **default and not a guarantee** — with overriding enabled, a
+    silent override of the filter chain does not fail at startup, so the one
+    check that would have caught it never runs.
+
+    This block only ever LOWERS confidence. It is emitted beside the verdict it
+    qualifies rather than as a finding underneath it, because the C1-20 lesson
+    runs the other way here: a caveat a reader has to go and find is a caveat
+    that does not reach the conclusion it was written for.
+    """
+    amplifiers: "list[dict]" = []
+    for key, effect in _OBSERVABILITY_AMPLIFIERS:
+        blocked = properties.blocked(key)
+        if blocked:
+            # The property exists and nothing decides it. That is not "off": an
+            # undecidable safety setting is exactly the case where claiming the
+            # safe default would be the confident falsehood.
+            amplifiers.append({
+                "property": key, "value": None, "state": "undecidable",
+                "reason": blocked, "source": None, "profile": None, "effect": effect,
+            })
+            continue
+        found = properties.lookup(key)
+        if found is None or found.value.strip().lower() not in _TRUTHY:
+            continue
+        amplifiers.append({
+            "property": key, "value": found.value, "state": "enabled",
+            "reason": None, "source": found.source, "profile": found.profile,
+            "effect": effect,
+        })
+
+    block: dict = {
+        "weakens_this_resolution": bool(amplifiers),
+        "amplifiers": amplifiers,
+    }
+    if amplifiers:
+        block["reading"] = (
+            "The bean resolution in this payload describes the configuration this "
+            "repository declares. " + str(len(amplifiers)) + " container setting(s) "
+            "mean the deployment would not report a disagreement with it, so read "
+            "every verdict below as a default rather than as what runs."
+        )
+    else:
+        block["reading"] = (
+            "No container setting was found that suppresses a startup failure over "
+            "the beans resolved here; a disagreement with this resolution would "
+            "surface as a failure to start."
+        )
+    return block
+
+
 #: Published Spring Security vocabulary that makes a bean part of the request
 #: chain's authorization configuration. Recorded as evidence; never branched on
 #: a client's own class name.
@@ -1017,11 +1098,20 @@ def _posture(
             "supplied": sorted(properties or {}),
         },
         **resolution.to_dict(),
+        # CL-11. Whether the container would even report a disagreement with the
+        # resolution above. Beside it, not underneath it: this block only lowers
+        # confidence in the verdicts that follow, and a caveat a reader has to go
+        # looking for does not reach the conclusion it was written for.
+        "container": container_observability(resolved_properties),
         # Called out separately because a profile that switches the security
         # configuration is not one bean among many — it is the difference
         # between an authenticated surface and an open one.
         "security": security_projection(cir, resolution),
     }
+    # The verdict a reader acts on is the security slice, so the qualifier
+    # travels with it rather than only at the top of the document.
+    if payload["container"]["weakens_this_resolution"]:
+        payload["security"]["resolution_is_a_default"] = payload["container"]["reading"]
     payload["endpoints"] = endpoint_projection(cir, payload["security"])
     # Which chain is wired is a fact about a bean; what that chain permits is the
     # fact about the request, and it is the one a reviewer asked for.

sourcecode/release_info.py

@@ -0,0 +1,123 @@
+"""What this build is, and how far behind it is likely to be (C4-12).
+
+Field audit #8 ran a build self-reporting 3.5.0 while 4.0.1 was shipping and
+re-derived, by hand, twelve product complaints from rows already closed — one of
+them the answer to its own critical finding. Nothing in the output told the
+operator their build was eight releases behind, so remediation speed, the
+property `docs/DEFECT-LEDGER.md` exists to make visible, was invisible to the
+person it was for.
+
+Age in days is the wrong unit on its own, and measuring it is what shows why:
+that build was **three days old**. On this project's cadence three days is six
+releases. So the fact published here is the release date (a constant, in the
+build), and the derived figure is an **estimate** of how many releases have
+shipped since — labelled as an estimate, because a CLI cannot see an index it
+has no network to read. It never claims a newer release exists.
+
+`_meta.tool_release_date` carries the constant half; the envelope is
+byte-identical across runs by contract, so the age — which changes every day —
+is computed only where it is asked for, in `ask version`.
+"""
+
+from __future__ import annotations
+
+import datetime
+from typing import Any, Optional
+
+#: The date `__version__` was released, from that version's CHANGELOG entry.
+#: `tests/test_release_info.py` fails the build if the two disagree, so this is
+#: a copy of a fact rather than a second authority for it.
+RELEASE_DATE = "2026-08-03"
+
+#: Releases per day, measured over the 30 releases before this one (the same
+#: computation the test re-runs against the CHANGELOG). Stable across window
+#: sizes when it was taken — 2.25 over 10, 2.11 over 20, 2.07 over 30 — which is
+#: why a single figure is publishable at all.
+RELEASE_RATE_PER_DAY = 2.07
+
+#: How many releases behind is worth telling the operator about. Four, which on
+#: the measured cadence is about two days: one release is half a day and warning
+#: about it would put a line on almost every run, which is how an advisory stops
+#: being read. The field case — three days, an estimated six releases, eight in
+#: fact — is well past it. An assumption, not a measurement.
+STALE_AFTER_RELEASES = 4
+
+#: What the estimate is, in the words the payload uses. The rate is a
+#: measurement of the past, not a promise about the future, and the distinction
+#: is the whole reason this string is published beside the number.
+ESTIMATE_BASIS = (
+    f"{RELEASE_RATE_PER_DAY} releases/day, measured over the 30 releases before "
+    f"this one. An estimate of what has shipped since, not an observation: this "
+    f"build has no index to read and never claims a newer release exists."
+)
+
+#: Where this version's known-wrong answers are written down.
+DEFECT_LEDGER = "docs/DEFECT-LEDGER.md"
+
+#: How to move off this build. Named here so the advisory cannot drift from the
+#: distribution name in `pyproject.toml`.
+UPGRADE_COMMAND = "pip install -U sourcecode"
+
+
+def _today() -> datetime.date:
+    return datetime.date.today()
+
+
+def release_age_days(today: "Optional[datetime.date]" = None) -> int:
+    """Days between this build's release and *today*, never negative.
+
+    A build produced from a working tree ahead of the last CHANGELOG entry, or a
+    machine whose clock is behind, reads as age 0 rather than as a negative
+    number that would flow into the estimate as a negative release count.
+    """
+    try:
+        released = datetime.date.fromisoformat(RELEASE_DATE)
+    except ValueError:
+        return 0
+    return max(0, ((today or _today()) - released).days)
+
+
+def estimated_releases_since(today: "Optional[datetime.date]" = None) -> int:
+    """Releases likely shipped since this build. Rounded down: a floor, not a guess up."""
+    return int(release_age_days(today) * RELEASE_RATE_PER_DAY)
+
+
+def build_status(today: "Optional[datetime.date]" = None) -> "dict[str, Any]":
+    """What this build is and how far behind it probably is.
+
+    `advisory` is `None` on a fresh build — a line that appears on every run is a
+    line nobody reads, and this one exists to be read once.
+    """
+    from sourcecode import __version__
+
+    age = release_age_days(today)
+    behind = estimated_releases_since(today)
+    stale = behind >= STALE_AFTER_RELEASES
+
+    status: dict[str, Any] = {
+        "version": __version__,
+        "released": RELEASE_DATE,
+        "age_days": age,
+        "estimated_releases_since": behind,
+        "estimate_basis": ESTIMATE_BASIS,
+        "stale": stale,
+        "known_defects": (
+            f"{DEFECT_LEDGER} records what this version is known to get wrong. "
+            f"Rows closed after it shipped are not in this copy."
+        ),
+        "advisory": None,
+    }
+    if stale:
+        status["advisory"] = (
+            f"This build is {age} day{'s' if age != 1 else ''} old and this project "
+            f"released {RELEASE_RATE_PER_DAY} times a day over its last 30 releases "
+            f"(~{behind} since). Upgrade before reading an absent finding as a "
+            f"clean result: `{UPGRADE_COMMAND}`. What this version is known to get "
+            f"wrong is in {DEFECT_LEDGER}."
+        )
+    return status
+
+
+def advisory_line(today: "Optional[datetime.date]" = None) -> "Optional[str]":
+    """The one-line human form of `build_status()['advisory']`, or None when fresh."""
+    return build_status(today)["advisory"]

sourcecode/rule_catalog.py

@@ -54,6 +54,7 @@ RULES: tuple[Rule, ...] = (
     Rule("SEC-004", "SEC", "Password stored under a fast unsalted digest (SHA-1, MD5)"),
     Rule("SEC-005", "SEC", "CSRF disabled under session-bearing authentication"),
     Rule("SEC-006", "SEC", "Cookie created without the Secure attribute"),
+    Rule("SEC-007", "SEC", "Credential stored in a deployment descriptor"),
 )
 
 FAMILY_ORDER: tuple[str, ...] = ("TX", "SEC")

sourcecode/schemas/envelope-v1.schema.json

@@ -19,6 +19,11 @@
       "description": "Release that produced the payload.",
       "type": "string"
     },
+    "tool_release_date": {
+      "description": "Date the release that produced this payload shipped (ISO 8601). A constant of the build, so the envelope stays byte-identical across runs; the AGE is derived by the consumer, or printed by `ask version`, which also estimates how many releases have shipped since.",
+      "type": "string",
+      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}$"
+    },
     "command": {
       "description": "Full path through the command tree, e.g. \"retrieve endpoint-inventory\".",
       "type": "string",
@@ -27,7 +32,9 @@
     "scope": {
       "description": "What was analysed. Absent when the command addresses no path.",
       "type": "object",
-      "required": ["path"],
+      "required": [
+        "path"
+      ],
       "properties": {
         "path": {
           "description": "Absolute path the command was pointed at.",

sourcecode/security_config_scan.py

@@ -83,6 +83,44 @@ _INSECURE_COOKIE_PROPERTY = re.compile(
     re.IGNORECASE,
 )
 
+# ── SEC-007: a stored credential in a deployment descriptor ───────────────────
+# CL-10. NC-002 declares "no secrets outside Java/YAML", which is honest and
+# wider than it needs to be: audit #8's credential sits in the `web.xml` files
+# `environment_resolution`, `filter_surface` and `path_filters` already read —
+# `monitor:{SHA-256}dc20b820…`, unsalted, the SAME hash in all three
+# per-environment overlays. The gap was admission surface, not detection.
+#
+# The rule fires on the SHAPE of the value, not on the name of the parameter
+# carrying it (VAI): a digest tag followed by a hex literal is a stored
+# credential wherever it appears, and needs no vendor vocabulary to recognise.
+
+#: `{SHA-256}dc20…` — the platform-neutral form for a digested credential written
+#: into a configuration value. The tag is spec vocabulary (RFC 2307 / LDAP, and
+#: every container that copied it); the hex run is what makes it a stored value
+#: rather than a reference to one.
+_DIGEST_LITERAL = re.compile(
+    r"\{(?P<algo>SHA-?(?:1|256|384|512)|SSHA|MD5|CRYPT)\}(?P<digest>[A-Za-z0-9+/=]{16,})",
+    re.IGNORECASE,
+)
+
+#: A descriptor value that is a reference, not a credential: resolved at deploy
+#: time from somewhere this repository does not contain.
+_PLACEHOLDER = re.compile(r"^\s*[$@%]?[{(]?[^{}()]*[}\)]?\s*$")
+_IS_REFERENCE = re.compile(r"[$@]\{[^}]+\}|^\s*$|^\s*ENC\(|^\s*\*+\s*$")
+
+#: XML elements whose text is a configured VALUE. Servlet/JEE spec vocabulary.
+_DESCRIPTOR_VALUE = re.compile(
+    r"<(?P<tag>param-value|env-entry-value|value|property|password)\b[^>]*>"
+    r"(?P<value>[^<]*)</(?P=tag)>",
+    re.IGNORECASE,
+)
+
+#: Files a deployment descriptor scan admits. `web.xml` and the Spring XML
+#: contexts are the two `environment_resolution` already classifies, so this adds
+#: no new reader — it narrows what NC-002 excludes to what we genuinely cannot see.
+_DESCRIPTOR_NAMES = ("web.xml",)
+_DESCRIPTOR_SUFFIXES = ("-context.xml",)
+
 
 @dataclass(frozen=True)
 class SecurityConfigObservation:
@@ -219,6 +257,78 @@ def _scan_config(text: str, rel: str) -> "list[SecurityConfigObservation]":
     return out
 
 
+def _scan_descriptor(text: str, rel: str) -> "list[SecurityConfigObservation]":
+    """SEC-007 — a credential written into a deployment descriptor (CL-10).
+
+    Matched on the value's shape. A descriptor that carries `${admin.password}`
+    holds a reference and is not reported; one that carries a digest literal
+    holds the credential itself, in a file under version control.
+    """
+    out: "list[SecurityConfigObservation]" = []
+    for match in _DESCRIPTOR_VALUE.finditer(text):
+        value = match.group("value").strip()
+        if not value or _IS_REFERENCE.search(value):
+            continue
+        digest = _DIGEST_LITERAL.search(value)
+        if digest is None:
+            continue
+        out.append(SecurityConfigObservation(
+            rule="SEC-007",
+            file=rel,
+            line=_line_of(text, match.start()),
+            symbol=rel,
+            # The digest is truncated on purpose: enough to correlate two files,
+            # never enough to make this payload a place to read a credential from.
+            evidence=f"<{match.group('tag')}>…{{{digest.group('algo')}}}"
+                     f"{digest.group('digest')[:8]}…",
+            detail=(
+                f"A credential is stored in this deployment descriptor as a "
+                f"{digest.group('algo').upper()} digest. It is under version control, so "
+                f"every reader of the repository holds it, and the digest is a fast "
+                f"unsalted hash rather than a password hash — recovering the input is "
+                f"a dictionary run, not an attack."
+            ),
+        ))
+    return out
+
+
+def _shared_across_environments(
+    observations: "list[SecurityConfigObservation]",
+) -> "list[SecurityConfigObservation]":
+    """Say when the same stored credential appears in more than one descriptor.
+
+    Audit #8's finding was not one credential in one file: it was the SAME hash
+    in the DPA, M3 and M3DEV overlays, which is a fact about the deployment —
+    three environments share one credential, so compromising the least protected
+    one is compromising all three. Composed here because both halves are already
+    in this list and neither file knows about the other.
+    """
+    by_digest: "dict[str, list[SecurityConfigObservation]]" = {}
+    for obs in observations:
+        if obs.rule != "SEC-007":
+            continue
+        by_digest.setdefault(obs.evidence, []).append(obs)
+
+    out: "list[SecurityConfigObservation]" = []
+    for obs in observations:
+        siblings = by_digest.get(obs.evidence, []) if obs.rule == "SEC-007" else []
+        if len(siblings) > 1:
+            others = sorted({s.file for s in siblings if s.file != obs.file})
+            if others:
+                obs = SecurityConfigObservation(
+                    rule=obs.rule, file=obs.file, line=obs.line, symbol=obs.symbol,
+                    evidence=obs.evidence,
+                    detail=(
+                        obs.detail + " The same digest is declared in "
+                        + ", ".join(others)
+                        + ": these deployments share one credential, so the least "
+                        "protected of them decides the strength of all of them."
+                    ),
+                )
+        out.append(obs)
+    return out
+
+
 #: Configuration extensions worth reading for the property form of these decisions.
 _CONFIG_SUFFIXES = (".properties", ".yml", ".yaml")
 
@@ -259,4 +369,25 @@ def scan_security_configuration(
             continue
         out.extend(_scan_config(text, rel))
 
-    return sorted(out, key=lambda o: (o.rule, o.file, o.line))
+    # CL-10 — the descriptors. Discovered the same way `environment_resolution`
+    # classifies them, so the two surfaces cannot disagree about which files are
+    # deployment descriptors, and a per-environment overlay tree is covered
+    # because the walk finds the file wherever the build put it.
+    descriptors: "list[str]" = []
+    try:
+        for path in root.rglob("*.xml"):
+            name = path.name.lower()
+            if name in _DESCRIPTOR_NAMES or name.endswith(_DESCRIPTOR_SUFFIXES):
+                descriptors.append(path.relative_to(root).as_posix())
+    except OSError:
+        pass
+    for rel in sorted(set(descriptors)):
+        try:
+            text = (root / rel).read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        out.extend(_scan_descriptor(text, rel))
+
+    return sorted(
+        _shared_across_environments(out), key=lambda o: (o.rule, o.file, o.line)
+    )

sourcecode/spring_security_audit.py

@@ -7,6 +7,7 @@ Patterns implemented (Phase 3):
   SEC-004  Password stored under a fast unsalted digest (CL-9)
   SEC-005  CSRF disabled under session-bearing authentication (CL-9)
   SEC-006  Cookie created without the Secure attribute (CL-9)
+  SEC-007  Credential stored in a deployment descriptor (CL-10)
 
 All patterns are deterministic and never raise.
 """
@@ -386,7 +387,8 @@ def _controller_source_file(cir: "CanonicalRepositoryIR", controller_fqn: str) -
 
 class _SEC00XConfigurationWeaknesses:
     """The textbook rules (CL-9): SEC-004 password storage, SEC-005 CSRF under
-    session authentication, SEC-006 a cookie without the Secure attribute.
+    session authentication, SEC-006 a cookie without the Secure attribute — and
+    SEC-007 (CL-10), a credential stored in a deployment descriptor.
 
     One pattern for three rules because they share a scan of the same files, and
     because the alternative — three passes over the source per audit — is how a
@@ -400,11 +402,16 @@ class _SEC00XConfigurationWeaknesses:
 
     pattern_id = "SEC-004"  # the group's identity for the Protocol; each finding carries its own
 
-    _SEVERITY = {"SEC-004": "high", "SEC-005": "medium", "SEC-006": "medium"}
+    _SEVERITY = {
+        "SEC-004": "high", "SEC-005": "medium", "SEC-006": "medium",
+        # A credential every reader of the repository already holds.
+        "SEC-007": "high",
+    }
     _TITLE = {
         "SEC-004": "Password stored under a fast unsalted digest",
         "SEC-005": "CSRF protection disabled under session-bearing authentication",
         "SEC-006": "Cookie created without the Secure attribute",
+        "SEC-007": "Credential stored in a deployment descriptor",
     }
     #: A pattern that emits more than one rule id declares them all, so a catalogue
     #: reader is never left with the group's identity standing for the group.
@@ -425,6 +432,13 @@ class _SEC00XConfigurationWeaknesses:
             "Set the Secure attribute (and HttpOnly, and SameSite) on session cookies, "
             "and configure it per environment rather than in code."
         ),
+        "SEC-007": (
+            "Move the credential out of the descriptor: read it from an environment "
+            "variable or a secret store and leave a ${placeholder} in the file. Rotate "
+            "it — it is in the history of every clone, so removing the line does not "
+            "retire it — and give each environment its own, so the least protected "
+            "deployment stops deciding the strength of the others."
+        ),
     }
 
     def analyze(

{sourcecode-4.0.1.dist-info → sourcecode-4.1.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.0.1
+Version: 4.1.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -97,13 +97,25 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 2.5.1
+ask version                    # ask 4.1.0 — and, on a build that has aged,
+                               # how many releases have probably shipped since
 ```
 
 > **Package vs. command.** The install package is named `sourcecode` this release
 > (renaming the distribution is a separate, breaking change). Installing it gives you the
 > canonical **`ask`** command plus the deprecated **`sourcecode`** alias.
 
+> **Platforms.** Developed and tested on macOS and Linux; every release runs its full
+> battery there. **Windows/PowerShell is a target we cannot verify:** the CLI is written
+> for it — UTF-8 streams are forced at both console entry points, a successful run writes
+> nothing to stderr (PowerShell 5.1 raises `NativeCommandError` on any stderr write), and
+> the MCP server strips the BOM PowerShell puts on stdin — but no Windows runner exists in
+> the battery. Three separate field reports of console mojibake (`—` rendering as `â€"`)
+> have never reproduced under measurement, and the only variable those reports share is the
+> platform we cannot exercise (C3-3, C3-12, C3-38 in the
+> [defect ledger](docs/DEFECT-LEDGER.md)). On Windows, prefer `--output <file>` over shell
+> redirection, and report a rendering problem rather than assuming it is known.
+
 ---
 
 ## Quickstart
@@ -331,7 +343,7 @@ reading JSON sees the same boundary a buyer reads here.
 | Not covered | Why | What answers it |
 |---|---|---|
 | **Whether request input reaches a sink — no dataflow or taint analysis.** | This engine resolves structure and wiring without compiling. Taint needs value flow through a program, which is a different analysis with a different failure mode: an unsound one produces confident findings that are wrong, and every claim here is meant to be checkable against the line that produced it. | A dataflow scanner (Semgrep, CodeQL). What this product adds on top is reachability: which of that tool's findings sit behind an endpoint that is reachable unauthenticated. |
-| **Secrets outside Java and Spring configuration — a credential in a deployment descriptor, a Helm value, a CI variable file.** | The file population this analyzer reads is the Java source and the Spring configuration convention. A secret elsewhere is not missed by a weak rule; it is outside the set of files anything here opens. | A dedicated secret scanner over the whole tree (gitleaks, trufflehog). |
+| **Secrets outside Java, Spring configuration and the deployment descriptors — a Helm value, a CI variable file, a shell script.** | The file population this analyzer reads is the Java source, the Spring configuration convention and the descriptors it already parses to resolve an environment. A secret elsewhere is not missed by a weak rule; it is outside the set of files anything here opens. Narrowed by CL-10: a credential stored in `web.xml` or a Spring XML context IS reported (SEC-007), because those files were already being read. | A dedicated secret scanner over the whole tree (gitleaks, trufflehog). |
 | **Filter-chain order and per-filter URL patterns — the presence of a custom filter is structural only.** | Which filter runs first is decided by bean ordering this analyzer does not resolve. Where two active configurations both match a request, the answer published is `undecided` rather than a guess. | `ask posture --profile <set>` states per endpoint what the readable rules decide and what they leave undecided. |
 | **Known vulnerabilities in dependencies — no CVE database, no version advisory matching.** | Enriching a vulnerability feed is a different product with a different update cadence; a stale embedded database is worse than no database, because it reads as a clean bill of health. | A dependency scanner (Trivy, OWASP Dependency-Check). `impact-chain` then answers which of its findings anything actually reaches. |
 

{sourcecode-4.0.1.dist-info → sourcecode-4.1.0.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=ad5-mKQ3VzgQIiOIpQZ3AKVLYX_-QJijCtIl87erKuU,308
+sourcecode/__init__.py,sha256=apfUI_GpozMGQBqfAZGbrSQGmV6iibhGJAm1wFVTQvc,308
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/archetype.py,sha256=HBGTTaS-bVHS6pdacPUMKcMxklkDEKnZMgz48Kc3yec,37630
 sourcecode/architectural_baseline.py,sha256=7QzJri4pbL3nzAn9gNutZW6mZR8HHD6H2C2H1EEwYPE,17904
@@ -16,7 +16,7 @@ sourcecode/chain_rules.py,sha256=Bi6UHfgd-GxWswmnHRcPz5jdbAuqka3Zkz_P-MTvqhw,127
 sourcecode/change_plan.py,sha256=kFjjp16XYbupgkv1CPkfqo39_SiZPMRQ8OOfC-Vy9eg,7929
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=hGyDps9KReu_vB9wDUHdvPMKfmQ6Yq_Kufh4TTfrOVM,449390
+sourcecode/cli.py,sha256=bPG84FLZTsYZits8DFjyl6tYLBAlWhAeS8-pCU2CvhQ,449990
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=xq3zsqAOAw4AWkoD9khb9xDP_O3KvwqO9k-pf8sbi3g,10951
 sourcecode/confidence_analyzer.py,sha256=5li0NyOdS3Ie-f2ZY1gBmnjtkuRvI50l4OnGaKkXAOU,22358
@@ -40,7 +40,7 @@ sourcecode/endpoint_literals.py,sha256=Qf4gTZzvNSFDGDuOvF0YRL9NvaYKKj24klhR5LIOa
 sourcecode/endpoint_metrics.py,sha256=sLSLUIgiIyvNdOynaxVgHd9SjRF_DbN3QxevaquykaU,2840
 sourcecode/entrypoint_classifier.py,sha256=jhTYlyqDJH2AtdEcLVaRU3lYRTJuF8DkxVzl4-W3zWE,5322
 sourcecode/env_analyzer.py,sha256=oLz4gDUE3BHlRRn6Qj4rnbjwyYjIZ0nlqO_SBQwL_H8,21999
-sourcecode/envelope.py,sha256=OBYOfhcwXf6W9sq7iO3oQU0-f_EFstquupVAMJtfdUY,6900
+sourcecode/envelope.py,sha256=IIUY6q_VPGsDfmlZri1GORXcYiAKvQepGoI-B0N0orE,7372
 sourcecode/environment_resolution.py,sha256=FajZhyLFJblYMb4VORm1fdP4RsQ8TJKySG9uh5IE7bU,13838
 sourcecode/error_schema.py,sha256=uwosfNaSujtYm11_732Hu92z5ITV040fQDaIyefSvR4,1683
 sourcecode/evidence_provider.py,sha256=GSSL44JEaouO5AHks2sB3d1YvC9xIKIld1yBYxZpXxo,4277
@@ -63,7 +63,7 @@ sourcecode/mcp_nudge.py,sha256=lKemOqK_wny2u7Ymcr2Idi5Kx8pXY02jCi-_nJYLGMg,2992
 sourcecode/metrics_analyzer.py,sha256=gLoRWKygF18jLgwsqmGXSWopw-f5iO1VbM7Jjdif6ag,22809
 sourcecode/migrate_check.py,sha256=jMv1GMhMthpHCnoEtkKWHiIC2Not2kdbU4UaA9sWX7I,134643
 sourcecode/migration_blast.py,sha256=OPryWkM6-PbvcG3eJFdcWUnlpXBje41nu2BkrZnE2hg,9359
-sourcecode/non_coverage.py,sha256=YoCIOlLYoBDv94rxQ5r7L755WeEz05OKo2zU_jt9_a8,7985
+sourcecode/non_coverage.py,sha256=u6-09dt21B2IltIWPC53KAo1ok7PU-u1rM38N16RhRY,8238
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
 sourcecode/output_budget.py,sha256=__DQrIg7MGsYrd0_S3lyd3AG0a0jWNGr55v5Gg9kK0U,12347
 sourcecode/parse_cache.py,sha256=SnHOhNTvAqHm_PXImPVBuj7NEoOQRn8dfIZHEqOFENs,7565
@@ -71,7 +71,7 @@ sourcecode/path_admission.py,sha256=OGNSoluhVh8YYOBZBnACUrkmH4Tp_yxjGLifkcsxQpo,
 sourcecode/path_filters.py,sha256=qPKO7kRmVp2y9zjLNSuAVCbcpZrIInHE4QulLUlzPFI,10412
 sourcecode/perf.py,sha256=GAcEoouPIlPMCQIcHNToxK6K3WdIR-lj9aFg4prOYJI,9743
 sourcecode/pipe_contract.py,sha256=PML0Er5d8uDyec4OrdUXuyqHbGPUYndjeaKUjkFz2u4,8369
-sourcecode/posture.py,sha256=-r4LxE1-GISz8hvKmVMQRipEWlAPbmtVbi6Z6D0DFTI,49479
+sourcecode/posture.py,sha256=obE9lB3dxan5MDOm3eFQ-aQX3DrJQxAU_D2OyYZrYwk,53981
 sourcecode/pr_comment_renderer.py,sha256=239PmJdf95av_ZW236C7_tvq_ahECeuF9AZxrheJ4OQ,15573
 sourcecode/pr_impact.py,sha256=eaFgcPMDsjaF8VZvcitFWCPCabMTi-khtGdxpK0wXTQ,22461
 sourcecode/prepare_context.py,sha256=B8TiBQbazxUOz6D37Dt9zqbOtD5b2S_fR3MB15P9DrI,237206
@@ -81,6 +81,7 @@ sourcecode/readiness_timeline.py,sha256=qqc14vL9nj9E4qw4bVZpGhfMLaVaYr9s6Pak_VUI
 sourcecode/reconciliation.py,sha256=GU-1PTcVr8zcbtC7BASfpHcZndP9AdboXPNQiBc0fzo,34251
 sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/reference_facts.py,sha256=Ns495c6eTmq2SrqPkcUrJUJru4_wj_yRWm4YDeJwves,13440
+sourcecode/release_info.py,sha256=r8GlRnraTQH_olGkdpbCAzBb0B_Js1cRBPaRe7IUoyU,5378
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/remedies.py,sha256=oMLpxrup88yCOalrsHWM1-kc0penm68q4HV0H7kxia0,4279
 sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg,12965
@@ -88,12 +89,12 @@ sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ
 sourcecode/repository_ir.py,sha256=t4RSLn00mkru5p54KXsT3tmG78FjXKNFDMl2YR-jLiM,355314
 sourcecode/ris.py,sha256=Xin3d3U43-VthgRA6ttJnyIow8iyUEsQCBENvZc4eEc,23782
 sourcecode/risk.py,sha256=SRTJfFHCD8enHXVJapEff6lgwdicfeHOHkEcHp2o6iw,14262
-sourcecode/rule_catalog.py,sha256=foq2hypJ3J9yD1lTCTzGAi1NN-t_X47eC-DQwy6147M,4248
+sourcecode/rule_catalog.py,sha256=buU6qZI1j1EjqAWOIzeDhZ9kO_6Tp_Ma-dmexNWkMe0,4324
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=z3CV0rcGunu0Y8mpNgp07wI7nxT0pxw1BkXRRtI0Rpo,9609
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
 sourcecode/security_config.py,sha256=KblMEoRiEjrIE68YsPaUAFebxFp8UM7MS7lAk5CGD8U,3531
-sourcecode/security_config_scan.py,sha256=tG9KgmOdVOPz8PGJ6FPz3IvbR2irfkXxvTImlA7qrOM,9979
+sourcecode/security_config_scan.py,sha256=TZj8qkg8XAMPPPDSSrJvWrvJn9hmgR-V-Sl9SRF4G2w,16148
 sourcecode/security_posture.py,sha256=CjJ2Qm87HhKXepnaWx1ncJLW-SxI18udCmUDIkCyAsY,50270
 sourcecode/semantic_analyzer.py,sha256=bpgdC6m0_ftVtRf3rSdwhbhWjnZnGxRXaZVcfe4BbcQ,95414
 sourcecode/semantic_impact_engine.py,sha256=t09IirGC3JjQDy33JZd1_WKzQVKXkoNl3-XEUr5kjis,20563
@@ -106,7 +107,7 @@ sourcecode/spring_impact.py,sha256=ie1j6N8qIEvsJjFw3hVsG2BWRFIAXWAG0MZ7rzfJhfQ,7
 sourcecode/spring_model.py,sha256=zOAgFmrRbG4a6KLm1TJl55aWMyPNsz3OS3FSczqPG6A,16594
 sourcecode/spring_profiles.py,sha256=-kwrCK0O-MRjrCp6SA1d31t--o4Tg87iqPVrTwxoIUs,19605
 sourcecode/spring_properties.py,sha256=kPTk5qAJxdbHc1hclhHAP0O-hCIzBn8PTh3lzl-I4a4,8400
-sourcecode/spring_security_audit.py,sha256=g2kiO59fFSsUv51a7_0NDY02YovaTuQpGpZ2sPJr0w8,27951
+sourcecode/spring_security_audit.py,sha256=KIjshNuS-cQSUBstqCuvDnp5i1J4_qAwXYKJArL2QpI,28720
 sourcecode/spring_semantic.py,sha256=UrmLg_4gmBVmMqvSnUMgSReVEERVGv3X7LYDBEs6k_o,16598
 sourcecode/spring_tx_analyzer.py,sha256=_wqjRktqdPS6PiXXxtTkCD1t6BaE2uhqx6ioYY-ULAw,44153
 sourcecode/summarizer.py,sha256=0aD4x3vgPngqBCEBKGuES1J2Vk5f7mqCm_ZWErwm3js,27025
@@ -174,15 +175,15 @@ sourcecode/retrieval/steps_impact.py,sha256=vvU4MSEECkrEMTyKqivDuw-R_b32nghk-Na1
 sourcecode/retrieval/steps_intf.py,sha256=vWyAn17O7G8-CdD9Qx0X-t60X7IpZxBZnmIlBkQUEDo,11657
 sourcecode/retrieval/steps_struct.py,sha256=Y9043laxxPS9zeV509WRI4vPSHfnjci6WKxZX1Ryqhw,13843
 sourcecode/retrieval/steps_txsec.py,sha256=5yB4uUrY7_tb4WP2Dh7SEaQwn9m1kS_z6HP0sryKuiM,17753
-sourcecode/schemas/envelope-v1.schema.json,sha256=lABkyKqXND039JUY2R6KK47OCDco5mq5PLgkcCXFhOQ,3477
+sourcecode/schemas/envelope-v1.schema.json,sha256=Zu5D2cspa_biP5-JMWY0H6oYGyAyA4sII3x1X7rdAVs,3886
 sourcecode/telemetry/__init__.py,sha256=ZxV5AJAK5_pk0RnW0B1ntpGPRapOX_XKFJdT_6RuYhE,3502
 sourcecode/telemetry/config.py,sha256=HD5ccO_k91WxDsnMo1lmxaF906bK3nrLv8qzUR3HbTo,4212
 sourcecode/telemetry/consent.py,sha256=pQdl-QeLl6Gcibn0eWHSKZrm-HYSsjpVqOnjrgFp8co,2472
 sourcecode/telemetry/events.py,sha256=4_yeO58U-Cwc1Qb27VB0_EjhmroY0k91n3_VGxeALB8,2776
 sourcecode/telemetry/filters.py,sha256=RzxauTz8HliO4BllQnXEXc7zTeqdCZi5MgqGEDuW7OQ,6570
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-4.0.1.dist-info/METADATA,sha256=JWZkVeDBlorjqt5DrZs3HRZUwS98YiMIK4sdxbdjL-c,26915
-sourcecode-4.0.1.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-4.0.1.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-4.0.1.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-4.0.1.dist-info/RECORD,,
+sourcecode-4.1.0.dist-info/METADATA,sha256=O0Dj7DN2b55Cvv2qxRRbSQJbEbEB9c-jL4ySO1Xd98s,28102
+sourcecode-4.1.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-4.1.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-4.1.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-4.1.0.dist-info/RECORD,,