sourcecode 4.0.1__tar.gz → 4.1.0__tar.gz

{sourcecode-4.0.1 → sourcecode-4.1.0}/CHANGELOG.md

@@ -2,6 +2,70 @@
 
 ## [Unreleased]
 
+## [4.1.0] — 2026-08-03
+
+Minor, not a patch, and the criterion is this project's own: a new rule can trip
+a gate that was green yesterday. `spring-audit --ci` and `verify --fail-on any`
+will fail on a repository that stores a credential in a deployment descriptor —
+correctly, and for the first time. Nothing is removed, no default moves, and no
+exit code changes meaning.
+
+Field audit #8 (deep read-only audit of the eval #6/#7 repository, by a new
+evaluator, 100 % catalogue coverage) ran a build self-reporting **3.5.0** while
+4.0.1 was shipping, and re-derived twelve of its fourteen product complaints from
+rows already closed — one of them the answer to its own critical finding. The
+first entry below is that defect; the rest are the three findings that survived
+verification against 4.0.1.
+
+### Added
+
+- **SEC-007 — a credential stored in a deployment descriptor** (CL-10). The audit
+  found `monitor:{SHA-256}dc20b820…` in
+  `src/main/options/{DPA,M3,M3DEV}/WEB-INF/web.xml`: unsalted, the same hash in all
+  three per-environment overlays, and found by hand because *"los overlays
+  `src/main/options/**` son punto ciego"*. The gap was admission surface, not
+  detection — those descriptors are files `environment_resolution`,
+  `filter_surface` and `path_filters` already open, and SEC-004 already names a
+  fast unsalted digest. The rule fires on the **shape of the value**
+  (`{ALGO}<hex>`), never on the parameter's name (VAI), with `${placeholder}` as
+  the negative control; the digest is truncated in the finding, because a report
+  about a credential must not be a place to read one from; and identical digests
+  across descriptors are composed into the statement the audit actually made —
+  three environments share one credential, so the least protected decides the
+  strength of all three. NC-002 is **narrowed, not deleted**: Helm values, CI
+  variable files and shell scripts stay declared out of scope. Zero findings across
+  six field repositories.
+- **`ask version` says how old the build is** (C4-12). Age in days alone would not
+  have caught the audit's case — that build was three days old. On this project's
+  cadence three days is six releases (eight, in fact). So the block publishes the
+  release date, the measured release rate (2.07/day over the last 30 releases), an
+  **estimate** of releases since with its basis, and an advisory naming the upgrade
+  command and the defect ledger. It never claims a newer release exists: offline,
+  that would be the confident-wrong answer the ledger exists to prevent. `_meta`
+  carries `tool_release_date` only — the date is a constant of the build, the age
+  changes daily, and the envelope is byte-identical by contract.
+
+### Fixed
+
+- **`posture` now says when the container would not contradict its own resolution**
+  (CL-11). `allow-bean-definition-overriding: true` and
+  `allow-circular-references: true`, in the repository whose entire security verdict
+  turns on which `SecurityConfig` bean wins: with overriding enabled a second
+  definition replaces the first silently, so the startup failure that would have
+  caught a filter-chain override never happens. The block only ever **lowers**
+  confidence, so it sits beside the verdict and is repeated inside
+  `security.resolution_is_a_default` — the C1-20 lesson runs the other way here, and
+  a caveat a reader has to go and find does not reach the conclusion it was written
+  for. An undecidable setting is not read as off.
+- **The platform claim matches what the battery can check** (C3-38). Third field
+  report of console mojibake on Windows/PowerShell; C3-3 and C3-12 are both recorded
+  *does not reproduce*, both scoped macOS-only. Patching a codec that was never
+  reproduced is what C3-27's rule forbids, so the README states instead that
+  Windows is a target the battery cannot verify, names what the CLI does do for it,
+  and cites the three rows. A documented limit is not a fix: C3-38 stays open until
+  a Windows runner exists.
+
+
 ## [4.0.1] — 2026-08-02
 
 Patch, and the criterion is the one this project has used since 3.2.0: nothing here

{sourcecode-4.0.1 → sourcecode-4.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.0.1
+Version: 4.1.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -97,13 +97,25 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 2.5.1
+ask version                    # ask 4.1.0 — and, on a build that has aged,
+                               # how many releases have probably shipped since
 ```
 
 > **Package vs. command.** The install package is named `sourcecode` this release
 > (renaming the distribution is a separate, breaking change). Installing it gives you the
 > canonical **`ask`** command plus the deprecated **`sourcecode`** alias.
 
+> **Platforms.** Developed and tested on macOS and Linux; every release runs its full
+> battery there. **Windows/PowerShell is a target we cannot verify:** the CLI is written
+> for it — UTF-8 streams are forced at both console entry points, a successful run writes
+> nothing to stderr (PowerShell 5.1 raises `NativeCommandError` on any stderr write), and
+> the MCP server strips the BOM PowerShell puts on stdin — but no Windows runner exists in
+> the battery. Three separate field reports of console mojibake (`—` rendering as `â€"`)
+> have never reproduced under measurement, and the only variable those reports share is the
+> platform we cannot exercise (C3-3, C3-12, C3-38 in the
+> [defect ledger](docs/DEFECT-LEDGER.md)). On Windows, prefer `--output <file>` over shell
+> redirection, and report a rendering problem rather than assuming it is known.
+
 ---
 
 ## Quickstart
@@ -331,7 +343,7 @@ reading JSON sees the same boundary a buyer reads here.
 | Not covered | Why | What answers it |
 |---|---|---|
 | **Whether request input reaches a sink — no dataflow or taint analysis.** | This engine resolves structure and wiring without compiling. Taint needs value flow through a program, which is a different analysis with a different failure mode: an unsound one produces confident findings that are wrong, and every claim here is meant to be checkable against the line that produced it. | A dataflow scanner (Semgrep, CodeQL). What this product adds on top is reachability: which of that tool's findings sit behind an endpoint that is reachable unauthenticated. |
-| **Secrets outside Java and Spring configuration — a credential in a deployment descriptor, a Helm value, a CI variable file.** | The file population this analyzer reads is the Java source and the Spring configuration convention. A secret elsewhere is not missed by a weak rule; it is outside the set of files anything here opens. | A dedicated secret scanner over the whole tree (gitleaks, trufflehog). |
+| **Secrets outside Java, Spring configuration and the deployment descriptors — a Helm value, a CI variable file, a shell script.** | The file population this analyzer reads is the Java source, the Spring configuration convention and the descriptors it already parses to resolve an environment. A secret elsewhere is not missed by a weak rule; it is outside the set of files anything here opens. Narrowed by CL-10: a credential stored in `web.xml` or a Spring XML context IS reported (SEC-007), because those files were already being read. | A dedicated secret scanner over the whole tree (gitleaks, trufflehog). |
 | **Filter-chain order and per-filter URL patterns — the presence of a custom filter is structural only.** | Which filter runs first is decided by bean ordering this analyzer does not resolve. Where two active configurations both match a request, the answer published is `undecided` rather than a guess. | `ask posture --profile <set>` states per endpoint what the readable rules decide and what they leave undecided. |
 | **Known vulnerabilities in dependencies — no CVE database, no version advisory matching.** | Enriching a vulnerability feed is a different product with a different update cadence; a stale embedded database is worse than no database, because it reads as a clean bill of health. | A dependency scanner (Trivy, OWASP Dependency-Check). `impact-chain` then answers which of its findings anything actually reaches. |
 

{sourcecode-4.0.1 → sourcecode-4.1.0}/README.md

@@ -59,13 +59,25 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 2.5.1
+ask version                    # ask 4.1.0 — and, on a build that has aged,
+                               # how many releases have probably shipped since
 ```
 
 > **Package vs. command.** The install package is named `sourcecode` this release
 > (renaming the distribution is a separate, breaking change). Installing it gives you the
 > canonical **`ask`** command plus the deprecated **`sourcecode`** alias.
 
+> **Platforms.** Developed and tested on macOS and Linux; every release runs its full
+> battery there. **Windows/PowerShell is a target we cannot verify:** the CLI is written
+> for it — UTF-8 streams are forced at both console entry points, a successful run writes
+> nothing to stderr (PowerShell 5.1 raises `NativeCommandError` on any stderr write), and
+> the MCP server strips the BOM PowerShell puts on stdin — but no Windows runner exists in
+> the battery. Three separate field reports of console mojibake (`—` rendering as `â€"`)
+> have never reproduced under measurement, and the only variable those reports share is the
+> platform we cannot exercise (C3-3, C3-12, C3-38 in the
+> [defect ledger](docs/DEFECT-LEDGER.md)). On Windows, prefer `--output <file>` over shell
+> redirection, and report a rendering problem rather than assuming it is known.
+
 ---
 
 ## Quickstart
@@ -293,7 +305,7 @@ reading JSON sees the same boundary a buyer reads here.
 | Not covered | Why | What answers it |
 |---|---|---|
 | **Whether request input reaches a sink — no dataflow or taint analysis.** | This engine resolves structure and wiring without compiling. Taint needs value flow through a program, which is a different analysis with a different failure mode: an unsound one produces confident findings that are wrong, and every claim here is meant to be checkable against the line that produced it. | A dataflow scanner (Semgrep, CodeQL). What this product adds on top is reachability: which of that tool's findings sit behind an endpoint that is reachable unauthenticated. |
-| **Secrets outside Java and Spring configuration — a credential in a deployment descriptor, a Helm value, a CI variable file.** | The file population this analyzer reads is the Java source and the Spring configuration convention. A secret elsewhere is not missed by a weak rule; it is outside the set of files anything here opens. | A dedicated secret scanner over the whole tree (gitleaks, trufflehog). |
+| **Secrets outside Java, Spring configuration and the deployment descriptors — a Helm value, a CI variable file, a shell script.** | The file population this analyzer reads is the Java source, the Spring configuration convention and the descriptors it already parses to resolve an environment. A secret elsewhere is not missed by a weak rule; it is outside the set of files anything here opens. Narrowed by CL-10: a credential stored in `web.xml` or a Spring XML context IS reported (SEC-007), because those files were already being read. | A dedicated secret scanner over the whole tree (gitleaks, trufflehog). |
 | **Filter-chain order and per-filter URL patterns — the presence of a custom filter is structural only.** | Which filter runs first is decided by bean ordering this analyzer does not resolve. Where two active configurations both match a request, the answer published is `undecided` rather than a guess. | `ask posture --profile <set>` states per endpoint what the readable rules decide and what they leave undecided. |
 | **Known vulnerabilities in dependencies — no CVE database, no version advisory matching.** | Enriching a vulnerability feed is a different product with a different update cadence; a stale embedded database is worse than no database, because it reads as a clean bill of health. | A dependency scanner (Trivy, OWASP Dependency-Check). `impact-chain` then answers which of its findings anything actually reaches. |
 

{sourcecode-4.0.1 → sourcecode-4.1.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "4.0.1"
+version = "4.1.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-4.0.1 → sourcecode-4.1.0}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.0.1"
+__version__ = "4.1.0"

{sourcecode-4.0.1 → sourcecode-4.1.0}/src/sourcecode/cli.py

@@ -8934,8 +8934,16 @@ def version_cmd() -> None:
       {"cli_version": "1.33.11", "mcp_schema_version": "1.33.11",
        "compatibility_schema_version": "1.0"}
     """
+    from sourcecode.release_info import advisory_line, build_status
+
     if getattr(sys.stdout, "isatty", lambda: False)():
         typer.echo(f"ask {__version__}")
+        # C4-12: the field audits builds that are days old and many releases
+        # behind, and nothing said so. Printed only when it applies — an advisory
+        # on every run is one nobody reads.
+        _advisory = advisory_line()
+        if _advisory:
+            typer.echo(_advisory)
     else:
         import json as _json_ver
         from sourcecode.envelope import ENVELOPE_VERSION, available_schemas
@@ -8943,6 +8951,10 @@ def version_cmd() -> None:
             "cli_version": __version__,
             "mcp_schema_version": __version__,
             "compatibility_schema_version": "1.0",
+            # Which release this is, when it shipped, and how far behind it
+            # probably is. The estimate carries its basis and never claims a
+            # newer release exists (C4-12).
+            "build": build_status(),
             # What a consumer should actually pin against: the release string
             # changes every release, the envelope version only when the output
             # contract does.

{sourcecode-4.0.1 → sourcecode-4.1.0}/src/sourcecode/envelope.py

@@ -123,6 +123,16 @@ def build_meta(
         "tool_version": __version__,
         "command": command,
     }
+    # C4-12: a consumer holding a payload could not tell how old the build that
+    # produced it was. The DATE is a constant of the build, so it goes here; the
+    # AGE changes daily and would break the byte-identical property above, so it
+    # is derived where it is asked for (`ask version`), never in the envelope.
+    try:
+        from sourcecode.release_info import RELEASE_DATE
+
+        meta["tool_release_date"] = RELEASE_DATE
+    except Exception:
+        pass
     if schema_version:
         meta["schema_version"] = schema_version
 

{sourcecode-4.0.1 → sourcecode-4.1.0}/src/sourcecode/non_coverage.py

@@ -74,13 +74,16 @@ NON_COVERAGE: tuple[NonCoverage, ...] = (
         id="NC-002",
         surface="security_surface",
         not_covered=(
-            "Secrets outside Java and Spring configuration — a credential in a "
-            "deployment descriptor, a Helm value, a CI variable file."
+            "Secrets outside Java, Spring configuration and the deployment "
+            "descriptors — a Helm value, a CI variable file, a shell script."
         ),
         why=(
-            "The file population this analyzer reads is the Java source and the "
-            "Spring configuration convention. A secret elsewhere is not missed by "
-            "a weak rule; it is outside the set of files anything here opens."
+            "The file population this analyzer reads is the Java source, the Spring "
+            "configuration convention and the descriptors it already parses to "
+            "resolve an environment. A secret elsewhere is not missed by a weak "
+            "rule; it is outside the set of files anything here opens. Narrowed by "
+            "CL-10: a credential stored in `web.xml` or a Spring XML context IS "
+            "reported (SEC-007), because those files were already being read."
         ),
         instead="A dedicated secret scanner over the whole tree (gitleaks, trufflehog).",
     ),

{sourcecode-4.0.1 → sourcecode-4.1.0}/src/sourcecode/posture.py

@@ -381,6 +381,87 @@ def resolve_beans(
     )
 
 
+#: CL-11 — container settings that make the resolution below a DEFAULT rather
+#: than a description of what runs. Each says what the container will no longer
+#: report, in the terms of the verdict it qualifies. Published Spring property
+#: names, so this is framework vocabulary, never a client's own configuration.
+_OBSERVABILITY_AMPLIFIERS: "tuple[tuple[str, str], ...]" = (
+    (
+        "spring.main.allow-bean-definition-overriding",
+        "a second bean definition for a name resolved here REPLACES it instead of "
+        "failing at startup, so a security configuration can be overridden by one "
+        "this resolution never saw and nothing in the deployment reports the "
+        "disagreement",
+    ),
+    (
+        "spring.main.allow-circular-references",
+        "a wiring cycle through the beans resolved here is repaired at runtime by "
+        "injecting a proxy rather than refused, so the instance that ends up in the "
+        "chain need not be the one this resolution describes",
+    ),
+)
+
+#: Values Spring reads as "on". Compared case-insensitively, as Spring does.
+_TRUTHY = frozenset({"true", "yes", "on", "1"})
+
+
+def container_observability(properties: "EffectiveProperties") -> dict:
+    """Whether the container would report a disagreement with this resolution (CL-11).
+
+    Audit #8 found `allow-bean-definition-overriding: true` and
+    `allow-circular-references: true` in the repository whose entire security
+    verdict turns on which `SecurityConfig` bean wins. On its own each is a
+    preference; beside a conditional security verdict each is the reason that
+    verdict is a **default and not a guarantee** — with overriding enabled, a
+    silent override of the filter chain does not fail at startup, so the one
+    check that would have caught it never runs.
+
+    This block only ever LOWERS confidence. It is emitted beside the verdict it
+    qualifies rather than as a finding underneath it, because the C1-20 lesson
+    runs the other way here: a caveat a reader has to go and find is a caveat
+    that does not reach the conclusion it was written for.
+    """
+    amplifiers: "list[dict]" = []
+    for key, effect in _OBSERVABILITY_AMPLIFIERS:
+        blocked = properties.blocked(key)
+        if blocked:
+            # The property exists and nothing decides it. That is not "off": an
+            # undecidable safety setting is exactly the case where claiming the
+            # safe default would be the confident falsehood.
+            amplifiers.append({
+                "property": key, "value": None, "state": "undecidable",
+                "reason": blocked, "source": None, "profile": None, "effect": effect,
+            })
+            continue
+        found = properties.lookup(key)
+        if found is None or found.value.strip().lower() not in _TRUTHY:
+            continue
+        amplifiers.append({
+            "property": key, "value": found.value, "state": "enabled",
+            "reason": None, "source": found.source, "profile": found.profile,
+            "effect": effect,
+        })
+
+    block: dict = {
+        "weakens_this_resolution": bool(amplifiers),
+        "amplifiers": amplifiers,
+    }
+    if amplifiers:
+        block["reading"] = (
+            "The bean resolution in this payload describes the configuration this "
+            "repository declares. " + str(len(amplifiers)) + " container setting(s) "
+            "mean the deployment would not report a disagreement with it, so read "
+            "every verdict below as a default rather than as what runs."
+        )
+    else:
+        block["reading"] = (
+            "No container setting was found that suppresses a startup failure over "
+            "the beans resolved here; a disagreement with this resolution would "
+            "surface as a failure to start."
+        )
+    return block
+
+
 #: Published Spring Security vocabulary that makes a bean part of the request
 #: chain's authorization configuration. Recorded as evidence; never branched on
 #: a client's own class name.
@@ -1017,11 +1098,20 @@ def _posture(
             "supplied": sorted(properties or {}),
         },
         **resolution.to_dict(),
+        # CL-11. Whether the container would even report a disagreement with the
+        # resolution above. Beside it, not underneath it: this block only lowers
+        # confidence in the verdicts that follow, and a caveat a reader has to go
+        # looking for does not reach the conclusion it was written for.
+        "container": container_observability(resolved_properties),
         # Called out separately because a profile that switches the security
         # configuration is not one bean among many — it is the difference
         # between an authenticated surface and an open one.
         "security": security_projection(cir, resolution),
     }
+    # The verdict a reader acts on is the security slice, so the qualifier
+    # travels with it rather than only at the top of the document.
+    if payload["container"]["weakens_this_resolution"]:
+        payload["security"]["resolution_is_a_default"] = payload["container"]["reading"]
     payload["endpoints"] = endpoint_projection(cir, payload["security"])
     # Which chain is wired is a fact about a bean; what that chain permits is the
     # fact about the request, and it is the one a reviewer asked for.

sourcecode-4.1.0/src/sourcecode/release_info.py

@@ -0,0 +1,123 @@
+"""What this build is, and how far behind it is likely to be (C4-12).
+
+Field audit #8 ran a build self-reporting 3.5.0 while 4.0.1 was shipping and
+re-derived, by hand, twelve product complaints from rows already closed — one of
+them the answer to its own critical finding. Nothing in the output told the
+operator their build was eight releases behind, so remediation speed, the
+property `docs/DEFECT-LEDGER.md` exists to make visible, was invisible to the
+person it was for.
+
+Age in days is the wrong unit on its own, and measuring it is what shows why:
+that build was **three days old**. On this project's cadence three days is six
+releases. So the fact published here is the release date (a constant, in the
+build), and the derived figure is an **estimate** of how many releases have
+shipped since — labelled as an estimate, because a CLI cannot see an index it
+has no network to read. It never claims a newer release exists.
+
+`_meta.tool_release_date` carries the constant half; the envelope is
+byte-identical across runs by contract, so the age — which changes every day —
+is computed only where it is asked for, in `ask version`.
+"""
+
+from __future__ import annotations
+
+import datetime
+from typing import Any, Optional
+
+#: The date `__version__` was released, from that version's CHANGELOG entry.
+#: `tests/test_release_info.py` fails the build if the two disagree, so this is
+#: a copy of a fact rather than a second authority for it.
+RELEASE_DATE = "2026-08-03"
+
+#: Releases per day, measured over the 30 releases before this one (the same
+#: computation the test re-runs against the CHANGELOG). Stable across window
+#: sizes when it was taken — 2.25 over 10, 2.11 over 20, 2.07 over 30 — which is
+#: why a single figure is publishable at all.
+RELEASE_RATE_PER_DAY = 2.07
+
+#: How many releases behind is worth telling the operator about. Four, which on
+#: the measured cadence is about two days: one release is half a day and warning
+#: about it would put a line on almost every run, which is how an advisory stops
+#: being read. The field case — three days, an estimated six releases, eight in
+#: fact — is well past it. An assumption, not a measurement.
+STALE_AFTER_RELEASES = 4
+
+#: What the estimate is, in the words the payload uses. The rate is a
+#: measurement of the past, not a promise about the future, and the distinction
+#: is the whole reason this string is published beside the number.
+ESTIMATE_BASIS = (
+    f"{RELEASE_RATE_PER_DAY} releases/day, measured over the 30 releases before "
+    f"this one. An estimate of what has shipped since, not an observation: this "
+    f"build has no index to read and never claims a newer release exists."
+)
+
+#: Where this version's known-wrong answers are written down.
+DEFECT_LEDGER = "docs/DEFECT-LEDGER.md"
+
+#: How to move off this build. Named here so the advisory cannot drift from the
+#: distribution name in `pyproject.toml`.
+UPGRADE_COMMAND = "pip install -U sourcecode"
+
+
+def _today() -> datetime.date:
+    return datetime.date.today()
+
+
+def release_age_days(today: "Optional[datetime.date]" = None) -> int:
+    """Days between this build's release and *today*, never negative.
+
+    A build produced from a working tree ahead of the last CHANGELOG entry, or a
+    machine whose clock is behind, reads as age 0 rather than as a negative
+    number that would flow into the estimate as a negative release count.
+    """
+    try:
+        released = datetime.date.fromisoformat(RELEASE_DATE)
+    except ValueError:
+        return 0
+    return max(0, ((today or _today()) - released).days)
+
+
+def estimated_releases_since(today: "Optional[datetime.date]" = None) -> int:
+    """Releases likely shipped since this build. Rounded down: a floor, not a guess up."""
+    return int(release_age_days(today) * RELEASE_RATE_PER_DAY)
+
+
+def build_status(today: "Optional[datetime.date]" = None) -> "dict[str, Any]":
+    """What this build is and how far behind it probably is.
+
+    `advisory` is `None` on a fresh build — a line that appears on every run is a
+    line nobody reads, and this one exists to be read once.
+    """
+    from sourcecode import __version__
+
+    age = release_age_days(today)
+    behind = estimated_releases_since(today)
+    stale = behind >= STALE_AFTER_RELEASES
+
+    status: dict[str, Any] = {
+        "version": __version__,
+        "released": RELEASE_DATE,
+        "age_days": age,
+        "estimated_releases_since": behind,
+        "estimate_basis": ESTIMATE_BASIS,
+        "stale": stale,
+        "known_defects": (
+            f"{DEFECT_LEDGER} records what this version is known to get wrong. "
+            f"Rows closed after it shipped are not in this copy."
+        ),
+        "advisory": None,
+    }
+    if stale:
+        status["advisory"] = (
+            f"This build is {age} day{'s' if age != 1 else ''} old and this project "
+            f"released {RELEASE_RATE_PER_DAY} times a day over its last 30 releases "
+            f"(~{behind} since). Upgrade before reading an absent finding as a "
+            f"clean result: `{UPGRADE_COMMAND}`. What this version is known to get "
+            f"wrong is in {DEFECT_LEDGER}."
+        )
+    return status
+
+
+def advisory_line(today: "Optional[datetime.date]" = None) -> "Optional[str]":
+    """The one-line human form of `build_status()['advisory']`, or None when fresh."""
+    return build_status(today)["advisory"]

{sourcecode-4.0.1 → sourcecode-4.1.0}/src/sourcecode/rule_catalog.py

@@ -54,6 +54,7 @@ RULES: tuple[Rule, ...] = (
     Rule("SEC-004", "SEC", "Password stored under a fast unsalted digest (SHA-1, MD5)"),
     Rule("SEC-005", "SEC", "CSRF disabled under session-bearing authentication"),
     Rule("SEC-006", "SEC", "Cookie created without the Secure attribute"),
+    Rule("SEC-007", "SEC", "Credential stored in a deployment descriptor"),
 )
 
 FAMILY_ORDER: tuple[str, ...] = ("TX", "SEC")

{sourcecode-4.0.1 → sourcecode-4.1.0}/src/sourcecode/schemas/envelope-v1.schema.json

@@ -19,6 +19,11 @@
       "description": "Release that produced the payload.",
       "type": "string"
     },
+    "tool_release_date": {
+      "description": "Date the release that produced this payload shipped (ISO 8601). A constant of the build, so the envelope stays byte-identical across runs; the AGE is derived by the consumer, or printed by `ask version`, which also estimates how many releases have shipped since.",
+      "type": "string",
+      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}$"
+    },
     "command": {
       "description": "Full path through the command tree, e.g. \"retrieve endpoint-inventory\".",
       "type": "string",
@@ -27,7 +32,9 @@
     "scope": {
       "description": "What was analysed. Absent when the command addresses no path.",
       "type": "object",
-      "required": ["path"],
+      "required": [
+        "path"
+      ],
       "properties": {
         "path": {
           "description": "Absolute path the command was pointed at.",