sourcecode 4.1.0__py3-none-any.whl → 4.2.0__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.1.0"
+__version__ = "4.2.0"

sourcecode/caller_reach.py

@@ -127,13 +127,21 @@ def bfs_callers(
     max_depth: int,
     impl_graph: object | None = None,
     method_scoped: bool = False,
-) -> tuple[list[str], list[str], bool, int]:
+) -> tuple[list[str], list[str], bool, int, int]:
     """Walk the reverse graph from *seed_fqns*.
 
-    Returns ``(direct, indirect, was_truncated, self_excluded)``. ``direct`` is
-    depth 1 — the callers of the seeds themselves; ``indirect`` is depth 2 and
-    beyond, up to *max_depth*. ``was_truncated`` says the hub-class guard capped
-    the walk, which makes the result a floor.
+    Returns ``(direct, indirect, was_truncated, self_excluded, guard_population)``.
+    ``direct`` is depth 1 — the callers of the seeds themselves; ``indirect`` is
+    depth 2 and beyond, up to *max_depth*. ``was_truncated`` says the hub-class
+    guard capped the walk, which makes the result a floor.
+
+    ``guard_population`` is the number the guard actually read: unique caller
+    **reference sites**, method-level keys included, before anything is
+    normalised to a class. It is returned rather than left implicit because the
+    figure the payload publishes is the class count, and a message that names
+    the cap without naming its own population contradicts the payload beside it —
+    measured on openmrs-core, *"symbol has > 500 direct callers"* printed next to
+    `direct_caller_count: 215` (C2-21).
 
     A class's own members are members, not external callers, so they are dropped
     and counted (BUG #2 — leaving them in inflated a blast radius ~12×). For a
@@ -170,7 +178,8 @@ def bfs_callers(
             if etype not in SKIP_EDGE_TYPES:
                 unique_direct.update(c for c in fqn_list if not _is_self_reference(c))
 
-    effective_depth = 1 if len(unique_direct) > CALLER_CAP else max_depth
+    guard_population = len(unique_direct)
+    effective_depth = 1 if guard_population > CALLER_CAP else max_depth
     if effective_depth < max_depth:
         was_truncated = True
 
@@ -202,4 +211,4 @@ def bfs_callers(
                 else:
                     _add_caller(caller, depth)
 
-    return direct, indirect, was_truncated, self_excluded
+    return direct, indirect, was_truncated, self_excluded, guard_population

sourcecode/canonical_ir.py

@@ -115,6 +115,30 @@ class CanonicalSecurity:
 # CanonicalEndpoint
 # ---------------------------------------------------------------------------
 
+def request_identity(method: str, path: str) -> str:
+    """The identity of the **request**, not of the handler that serves it.
+
+    An endpoint `id` identifies a handler: it carries the controller FQN and the
+    handler symbol, so moving a mapping to another class produces a different
+    `id` for the same URL. That is the right identity inside one tree and the
+    wrong one across two — a comparison keyed on it reports every refactored
+    handler as one endpoint removed and another added, and the reader asking
+    "did this change what a caller can reach" has to subtract the noise by hand.
+
+    Two states of one repository — `contract-diff` between refs, `posture
+    --diff-ref` — compare what a client can call, which is METHOD + path. One
+    authority for it, because two spellings of one identity is how two commands
+    come to disagree about the same endpoint (ADR-0008 R11).
+
+    Note what this deliberately does *not* do: it does not normalise path
+    variable names or inline regexes. `/{id:.*}` and `/{id:[^0-9].*}` are
+    different URLs to a client, and equating them would hide a real change in
+    the surface — measured on a fleet repository where exactly that edit moved
+    93 requests.
+    """
+    return f"{str(method).upper()} {path}"
+
+
 @dataclass
 class CanonicalEndpoint:
     """Canonical endpoint entity — single source of truth for REST endpoint data.
@@ -159,6 +183,11 @@ class CanonicalEndpoint:
         """Deterministic endpoint ID — stable across formatting/body changes."""
         return f"{method}:{path}:{controller_class}:{handler_symbol}"
 
+    @property
+    def request_key(self) -> str:
+        """This endpoint's request identity — see `request_identity`."""
+        return request_identity(self.method, self.path)
+
 
 # ---------------------------------------------------------------------------
 # CanonicalRepositoryIR

sourcecode/cli.py

@@ -357,6 +357,7 @@ of files) in minutes. Semantic analysis itself is sub-second; repo indexing domi
   impact-chain <Class> .       [dim]# blast radius w/ TX + security per hop[/dim]
   impact <Class> .             [dim]# reverse deps → endpoints reached[/dim]
   pr-impact . --files -        [dim]# same, scoped to a diff on stdin; gating codes[/dim]
+  posture . --since main       [dim]# did this branch open an endpoint? (exp.)[/dim]
   verify .                     [dim]# contract gate, baseline-relative[/dim]
   verify-edit .                [dim]# did working-tree edits change behaviour?[/dim]
   [dim]modernize · explain <Class> · validation · export · repo-ir[/dim]
@@ -4726,6 +4727,71 @@ def impact_cmd(
 # canonical single-source-of-truth endpoint extractor.
 
 
+#: How many rows each `endpoints --compact` rollup lists. The counts beside them are
+#: measured over the whole population, never over what survives this cut (R5-R8).
+_ENDPOINT_ROLLUP_CAP = 25
+
+
+def _endpoint_exposure_summary(endpoints: "list[dict]") -> dict:
+    """How exposed this repository is, without listing every endpoint (C2-22).
+
+    Field evaluation #9 wanted the answer and got 1.9 MB of JSON for 3 574
+    endpoints, then aggregated it by hand in PowerShell. The list is the evidence;
+    it is not the answer, and a command whose product is a census should be able
+    to publish the census.
+
+    Every figure here is counted over the **full** population that reached this
+    function. The rollups are ranked and cut, and each states its own total, so
+    nobody derives a count from the rows they were handed — the mechanism by which
+    a truncated list becomes a wrong number (C2-1, C2-20).
+    """
+    from collections import Counter
+
+    from sourcecode.degradation import cap_effect
+
+    by_method = Counter(str(e.get("method") or "UNKNOWN").upper() for e in endpoints)
+    by_policy = Counter(
+        str((e.get("security") or {}).get("policy") or "none_detected") for e in endpoints
+    )
+    by_controller = Counter(
+        str(e.get("controller_class") or e.get("controller") or "unknown") for e in endpoints
+    )
+    # The first path segment: the coarsest grouping a reader can act on, and the
+    # one that answers "which area of the API is open" without 3 574 rows.
+    by_area = Counter(
+        ("/" + str(e.get("path") or "").lstrip("/").split("/")[0]) if e.get("path") else "/"
+        for e in endpoints
+    )
+
+    def _rollup(counter: "Counter[str]", name: str) -> dict:
+        ranked = counter.most_common()
+        block: dict = {
+            "distinct": len(ranked),
+            "listed": [{name: key, "endpoints": count} for key, count in ranked[:_ENDPOINT_ROLLUP_CAP]],
+        }
+        if len(ranked) > _ENDPOINT_ROLLUP_CAP:
+            block["cap"] = {
+                "total": len(ranked),
+                "shown": _ENDPOINT_ROLLUP_CAP,
+                "omitted": len(ranked) - _ENDPOINT_ROLLUP_CAP,
+                **cap_effect("display_list", limit=_ENDPOINT_ROLLUP_CAP, total=len(ranked)),
+            }
+        return block
+
+    return {
+        "endpoints": len(endpoints),
+        "by_method": dict(sorted(by_method.items())),
+        "by_security_policy": dict(sorted(by_policy.items())),
+        "by_controller": _rollup(by_controller, "controller"),
+        "by_path_area": _rollup(by_area, "area"),
+        "basis": (
+            "every count is measured over all "
+            f"{len(endpoints)} endpoints in this answer; the rollups below are "
+            "ranked and cut, and each states its own total"
+        ),
+    }
+
+
 def _group_endpoints_by_controller(endpoints: "list[dict]") -> "dict":
     """Group endpoints by their controller FQN into a structured API surface.
 
@@ -4791,6 +4857,12 @@ def endpoints_cmd(
         None, "--limit", "-n",
         help="Maximum number of endpoints to return.",
     ),
+    compact: bool = typer.Option(
+        False, "--compact",
+        help="Answer how exposed the repository is without listing every endpoint: "
+             "counts by method, by security policy and by controller. Every count is "
+             "measured over the full population.",
+    ),
     no_cache: bool = typer.Option(
         False, "--no-cache",
         help=_NO_CACHE_SUBCOMMAND_HELP,
@@ -4828,6 +4900,7 @@ def endpoints_cmd(
       ask endpoints . --path-prefix /v1/liquidacion
       ask endpoints . --controller LiquidacionJornada
       ask endpoints . --limit 10
+      ask endpoints . --compact
     """
     _enforce_format("endpoints", format)
 
@@ -4894,6 +4967,41 @@ def endpoints_cmd(
         data["by_controller"] = _grouped["by_controller"]
         data["controller_count"] = _grouped["controller_count"]
 
+    # C2-22. The census, and — when asked for — the census *instead of* the list:
+    # the product of this command for a reader asking "how exposed is this
+    # repository" is the aggregate, and 1.9 MB of rows is the evidence for it.
+    # `_selected` is the population the filters chose, before `--limit` cut the
+    # rendering: counting the rendered list here would be the defect this block
+    # exists to remove, one line into its own implementation (R5-R8).
+    data["exposure"] = _endpoint_exposure_summary(_selected)
+    if compact:
+        from sourcecode.degradation import cap_effect
+
+        _listed = len(data.get("endpoints", []))
+        data["endpoints"] = []
+        data["endpoints_omitted"] = {
+            "total": _listed,
+            "shown": 0,
+            "omitted": _listed,
+            **cap_effect("display_list", limit=0, total=_listed),
+            "note": (
+                "--compact answers with the census; every count in this document "
+                "was measured before the list was dropped. Re-run without --compact, "
+                "or narrow with --path-prefix / --controller / --limit, for the rows."
+            ),
+        }
+
+    # CL-12 / NC-007. The population here is Spring handler mappings, and six
+    # published non-coverage rows are exactly what lets a reader treat this list
+    # as the whole HTTP surface. A servlet mounted in `web.xml` is reachable and
+    # is not in this model — field evaluation #9 lost a monitoring console that
+    # way, at a path behind a credential the same run reported.
+    from sourcecode import non_coverage as _non_coverage
+
+    _endpoint_limits = _non_coverage.block("endpoints")
+    if _endpoint_limits:
+        data["non_coverage"] = _endpoint_limits
+
     output = _serialize_dict(data, format)
 
     _emit_command_output(output, output_path, copy,
@@ -6935,6 +7043,12 @@ def risk_cmd(
     from, so a reader can disagree with one and keep the rest. An axis that could
     not be measured is `unknown`, multiplies by 1.0, and is named in `blind_axes`.
 
+    \b
+    One row is one **defect** — the same identity `spring-audit` groups by, so the
+    two commands report the same count. The observations behind it travel with it
+    as `witness_count` and `witness_sites`, and `total_findings` publishes the
+    observation census under its own name.
+
     \b
     Examples:
       ask risk .
@@ -6981,6 +7095,24 @@ def posture_cmd(
         "--diff",
         help="Compare two profile sets: --diff dev:prod (each side comma-separated).",
     ),
+    diff_ref: Optional[str] = typer.Option(
+        None,
+        "--diff-ref",
+        help="Compare two git refs under ONE profile set: --diff-ref origin/main:HEAD "
+             "(read with git archive; the repository is not written to).",
+    ),
+    since: Optional[str] = typer.Option(
+        None,
+        "--since",
+        help="Compare a git ref against the working tree, uncommitted edits included: "
+             "--since origin/main.",
+    ),
+    fail_on: str = typer.Option(
+        "never",
+        "--fail-on",
+        help="Exit 1 when a ref comparison finds: opened (requests newly reachable "
+             "unauthenticated) | any (any access change) | never (default).",
+    ),
     resolve_environments_flag: bool = typer.Option(
         False,
         "--resolve-environments",
@@ -7021,15 +7153,29 @@ def posture_cmd(
     property value or a condition class is never assumed active and never
     assumed absent — a posture answer that guesses is a confident falsehood.
 
+    \b
+    Two axes, and they are different questions. `--diff` holds the tree fixed
+    and moves the profile set. `--diff-ref` (and `--since`) hold the profile set
+    fixed and move the tree: *does this change what a client can reach without
+    authenticating?* That one takes `--fail-on` and is the per-PR gate.
+
     \b
     Examples:
       ask posture . --profile prod
       ask posture . --profile prod,metrics
       ask posture . --diff dev:prod
+      ask posture . --profile prod --diff-ref origin/main:HEAD
+      ask posture . --since origin/main --fail-on opened
       ask posture . --profile prod --property app.security.enabled=true
       ask posture . --resolve-environments
     """
-    from sourcecode.posture import build_posture, diff_posture, resolve_environments
+    from sourcecode.posture import (
+        FAIL_ON_CHOICES,
+        build_posture,
+        diff_posture,
+        diff_posture_refs,
+        resolve_environments,
+    )
 
     # A repository that could not be read has an unknown posture, not a posture
     # of zero beans (R9/I-3: never `0` where the honest answer is `unknown`).
@@ -7059,16 +7205,96 @@ def posture_cmd(
             raise typer.Exit(code=1)
         overrides[key.strip()] = value.strip()
 
+    if fail_on not in FAIL_ON_CHOICES:
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            f"--fail-on expects {' | '.join(FAIL_ON_CHOICES)} (got {fail_on!r}).",
+            hint="Example: --since origin/main --fail-on opened",
+            expected="|".join(FAIL_ON_CHOICES),
+        )
+        raise typer.Exit(code=1)
+    if diff_ref and since:
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            "--diff-ref names both states; --since names one and compares it with the "
+            "working tree. Pass one of them.",
+            hint="ask posture . --diff-ref origin/main:HEAD  |  ask posture . --since origin/main",
+        )
+        raise typer.Exit(code=1)
+    ref_comparison = bool(diff_ref or since)
+    if fail_on != "never" and not ref_comparison:
+        # A gate needs two states to compare. Failing on a single posture run would
+        # have to gate on pre-existing debt, which is the absolute-gate confusion
+        # `spring-audit --ci` already documents.
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            "--fail-on gates a comparison between two trees; a single posture run has "
+            "nothing to compare against.",
+            hint="ask posture . --since origin/main --fail-on opened",
+        )
+        raise typer.Exit(code=1)
+    if ref_comparison and diff:
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            "--diff moves the profile set and --diff-ref/--since move the tree. Asking "
+            "for both at once names four states and answers about none of them: pass "
+            "--profile with --diff-ref, or --diff on its own.",
+            hint="ask posture . --profile prod --diff-ref origin/main:HEAD",
+        )
+        raise typer.Exit(code=1)
+
     if resolve_environments_flag:
-        if diff or profile:
+        if diff or profile or ref_comparison:
             _emit_error_json(
                 INVALID_INPUT_CODE,
                 "--resolve-environments answers which profile set runs; it cannot be "
-                "combined with --profile or --diff, which state one.",
+                "combined with --profile, --diff or --diff-ref/--since, which state one.",
                 hint="Run `ask posture . --resolve-environments` on its own.",
             )
             raise typer.Exit(code=1)
         data = resolve_environments(path, overrides)
+    elif ref_comparison:
+        from sourcecode.git_checkout import RefError
+
+        base_ref, head_ref = (since, None)
+        if diff_ref:
+            if ":" not in diff_ref:
+                _emit_error_json(
+                    INVALID_INPUT_CODE,
+                    f"--diff-ref needs two refs separated by ':' (got {diff_ref!r}).",
+                    hint="Example: --diff-ref origin/main:HEAD",
+                    expected="base:head",
+                )
+                raise typer.Exit(code=1)
+            base_ref, head_ref = diff_ref.split(":", 1)
+        if not (base_ref or "").strip() or (head_ref is not None and not head_ref.strip()):
+            _emit_error_json(
+                INVALID_INPUT_CODE,
+                "A ref cannot be empty: both sides of --diff-ref name a commit.",
+                hint="Example: --diff-ref origin/main:HEAD",
+                expected="base:head",
+            )
+            raise typer.Exit(code=1)
+        try:
+            data = diff_posture_refs(
+                path,
+                _parse_set(profile) if profile else set(),
+                base_ref.strip(),
+                head_ref.strip() if head_ref is not None else None,
+                overrides,
+                fail_on=fail_on,
+            )
+        except RefError as exc:
+            # Never borrowed from a parent or a remote: the answer names the ref
+            # that failed, and nothing was fetched (C3-27).
+            _emit_error_json(
+                exc.code, exc.message, ref=exc.ref,
+                hint=(
+                    "ask posture <repo> --since <ref>" if since
+                    else "ask posture <repo> --diff-ref <base>:<head>"
+                ),
+            )
+            raise typer.Exit(code=1)
     elif diff:
         if ":" not in diff:
             _emit_error_json(
@@ -7089,6 +7315,12 @@ def posture_cmd(
         False,
         success_msg=f"posture written to {output_path}",
     )
+    # The payload is emitted first and the exit code follows it: a gate that
+    # exits before answering leaves the reviewer with a red pipeline and no
+    # statement of what opened.
+    gate = data.get("gate") if isinstance(data, dict) else None
+    if isinstance(gate, dict) and gate.get("triggered"):
+        raise typer.Exit(code=int(gate.get("exit_code") or 1))
 
 
 # ── Spring Boot Migration Check ───────────────────────────────────────────────

sourcecode/contract_diff.py

@@ -140,16 +140,17 @@ def diff_contract(
         else:
             breaking.append(f)
 
-    # --- endpoints (keyed by METHOD path) ---
+    # --- endpoints (keyed by the request identity, see `request_identity`) ---
+    from sourcecode.canonical_ir import request_identity as ident
     b_eps, h_eps = base.endpoints, head.endpoints
     for key in b_eps.keys() - h_eps.keys():
-        breaking.append(_finding("endpoint", f"{key[0]} {key[1]}", "removed", "", "", "breaking"))
+        breaking.append(_finding("endpoint", ident(*key), "removed", "", "", "breaking"))
     for key in h_eps.keys() - b_eps.keys():
-        additive.append(_finding("endpoint", f"{key[0]} {key[1]}", "added", "", "", "additive"))
+        additive.append(_finding("endpoint", ident(*key), "added", "", "", "additive"))
     for key in b_eps.keys() & h_eps.keys():
         if b_eps[key] != h_eps[key]:
             breaking.append(_finding(
-                "endpoint", f"{key[0]} {key[1]}", "signature_changed",
+                "endpoint", ident(*key), "signature_changed",
                 b_eps[key], h_eps[key], "breaking",
             ))
 

sourcecode/environment_resolution.py

@@ -50,6 +50,19 @@ _PROPERTY_KEY = "spring.profiles.active"
 _ENV_KEY = "SPRING_PROFILES_ACTIVE"
 _PLACEHOLDER = re.compile(r"\$\{[^}]*\}|@[\w.]+@")
 
+#: What a *consumer* of the build property looks like (C1-22). A Maven
+#: `<properties>` entry is a build-time value and nothing else: it reaches a
+#: running application only if a resource the build filters carries a token that
+#: substitutes it. `@key@` is the Spring Boot parent's filtering delimiter and
+#: means nothing else, so it counts on its own; `${key}` is ambiguous — in a
+#: config file it is usually Spring's own placeholder syntax resolved at run time
+#: — so it counts only where the build declares the resources filtered.
+_MAVEN_FILTER_TOKEN = f"@{_PROPERTY_KEY}@"
+_SPRING_REFERENCE = "${" + _PROPERTY_KEY + "}"
+_FILTERING_DECLARED = re.compile(
+    r"<filtering>\s*true\s*</filtering>|filesMatching|expand\s*\(", re.IGNORECASE
+)
+
 _MAX_FILES = 20_000
 _MAX_BYTES = 2_000_000
 
@@ -69,9 +82,16 @@ class Signal:
     raw: str
     value: Optional[str]  # None when the artefact defers to something else
     note: str
+    #: Whether this artefact's value reaches a *running* application. False for a
+    #: build property no filtered resource consumes: it states a value, and the
+    #: value stops at the build (C1-22). The value is kept rather than nulled —
+    #: it is still the set a build of that profile would produce, which is what
+    #: makes it a candidate worth ranking.
+    activates: bool = True
+    why_not: str = ""
 
     def to_dict(self) -> dict:
-        return {
+        out = {
             "kind": self.kind,
             "file": self.file,
             "line": self.line,
@@ -79,6 +99,10 @@ class Signal:
             "value": self.value,
             "note": self.note,
         }
+        if not self.activates:
+            out["activates_at_runtime"] = False
+            out["why_not"] = self.why_not
+        return out
 
 
 @dataclass
@@ -99,6 +123,12 @@ class EnvironmentResolution:
             "profile_set_if_decided": list(self.values) if self.verdict == DECIDED else None,
             "signals": [s.to_dict() for s in self.signals],
             "deferred": [s.to_dict() for s in self.deferred],
+            # C1-22, published as a count a gate can read: a build value that
+            # reaches nothing is the difference between "two deployments, pick
+            # one" and "nobody decided, so the permissive default runs".
+            "build_properties_not_consumed": sum(
+                1 for s in self.deferred if s.value and not s.activates
+            ),
             "note": (
                 "A value found here is the default this repository ships, not a "
                 "guarantee: SPRING_PROFILES_ACTIVE in the process environment "
@@ -193,9 +223,15 @@ def _clean(raw: str) -> str:
 
 
 def collect_signals(root: Path) -> list[Signal]:
-    """Every artefact in *root* that names the active profile set, with evidence."""
+    """Every artefact in *root* that names the active profile set, with evidence.
+
+    A build property that no filtered resource consumes is collected, kept, and
+    marked as not activating (C1-22): it states a value the build has, not one
+    the application starts with.
+    """
     root = Path(root).resolve()
     signals: list[Signal] = []
+    filtering_declared = False
     for path in _iter_files(root):
         kind = _classify(path)
         if kind is None:
@@ -206,6 +242,8 @@ def collect_signals(root: Path) -> list[Signal]:
             text = path.read_text(encoding="utf-8", errors="ignore")
         except OSError:
             continue
+        if kind == "build_property" and _FILTERING_DECLARED.search(text):
+            filtering_declared = True
         if _PROPERTY_KEY not in text and _ENV_KEY not in text:
             continue
         try:
@@ -234,7 +272,49 @@ def collect_signals(root: Path) -> list[Signal]:
                     signals.append(_signal(
                         kind, rel, index, line, _next_param_value(lines, index),
                     ))
-    return signals
+    return _mark_unconsumed_build_properties(signals, filtering_declared)
+
+
+def _consumes_build_property(signal: Signal, filtering_declared: bool) -> bool:
+    """Whether this artefact hands the *build* property to the running application.
+
+    The evidence is already collected: a resource carrying `@key@` reads here as
+    a placeholder signal, which is exactly what a consumer looks like.
+    """
+    if signal.kind == "build_property":
+        return False  # a build file cannot be its own consumer
+    if _MAVEN_FILTER_TOKEN in signal.raw:
+        return True
+    return filtering_declared and _SPRING_REFERENCE in signal.raw
+
+
+def _mark_unconsumed_build_properties(
+    signals: list[Signal], filtering_declared: bool
+) -> list[Signal]:
+    """C1-22. A `<properties>` entry is a build value; without a filtered resource
+    referencing it, no profile is active at run time and the honest verdict is that
+    nothing here decides — which is a *fail-open*, not a choice between deployments.
+
+    Field evaluation #9 measured the cost of not doing this: two Maven profiles
+    setting the property produced `artefacts_disagree` (*"different deployments,
+    pick one"*) on a repository where nothing activated a profile at all, so the
+    permissive default ran and the report read as an ambiguity to resolve rather
+    than as the exposure it was.
+    """
+    if any(_consumes_build_property(s, filtering_declared) for s in signals):
+        return signals
+    return [
+        s if not (s.kind == "build_property" and s.value) else Signal(
+            s.kind, s.file, s.line, s.raw, s.value, s.note,
+            activates=False,
+            why_not=(
+                f"sets {_PROPERTY_KEY!r} as a build property; no resource in this "
+                f"repository references it ('{_MAVEN_FILTER_TOKEN}'), so the value "
+                "stops at the build and no profile is active because of it"
+            ),
+        )
+        for s in signals
+    ]
 
 
 def _next_k8s_value(lines: list[str], after: int) -> Optional[str]:
@@ -274,8 +354,9 @@ def _signal(kind: str, rel: str, line: int, raw: str, value: Optional[str]) -> S
 def resolve_environment(root: Path) -> EnvironmentResolution:
     """What decides the active profile set in *root* — or the fact that nothing does."""
     signals = collect_signals(root)
-    deciding = [s for s in signals if s.value]
-    deferred = [s for s in signals if not s.value]
+    deciding = [s for s in signals if s.value and s.activates]
+    deferred = [s for s in signals if not (s.value and s.activates)]
+    inert = [s for s in signals if s.value and not s.activates]
 
     if not deciding:
         return EnvironmentResolution(
@@ -284,6 +365,16 @@ def resolve_environment(root: Path) -> EnvironmentResolution:
             statement=(
                 "Your security configuration is not decided by this repository. "
                 + (
+                    # The sentence a field evaluator wrote by hand after ASK
+                    # published `artefacts_disagree` over exactly this shape.
+                    f"{len(inert)} build propert{'y' if len(inert) == 1 else 'ies'} "
+                    f"set `{_PROPERTY_KEY}` "
+                    f"({', '.join(sorted({repr(s.value) for s in inert}))}), and no "
+                    "resource here consumes them, so they set nothing at run time. "
+                    "The profile set is whatever the runtime is given — and with "
+                    "none given, Spring activates `default` alone, which is the "
+                    "permissive case, not a neutral one."
+                    if inert else
                     f"{len(deferred)} artefact(s) name the setting and none of them "
                     "supplies a value: it comes from the process environment at "
                     "start-up."
@@ -345,7 +436,10 @@ def candidate_profile_sets(
     if resolution.verdict == DECIDED:
         ordered.append(resolution.values)
     ordered.append(())  # `default` alone — the no-variable case
-    for signal in resolution.signals:
+    # Both lists: a build property that activates nothing is still the profile set
+    # *a build of it* would produce, so it stays a candidate worth ranking. C1-22
+    # corrects the verdict; it must not narrow the worst case.
+    for signal in list(resolution.signals) + list(resolution.deferred):
         if signal.value:
             candidate = _split_profiles(signal.value)
             if candidate not in ordered:

sourcecode/facts/registry.json

@@ -185,6 +185,21 @@
       "was": "Two traversals. `impact` looked up the exact reverse-graph key, so the walk died at every class-level node — which is what a DI injects edge normalises to — and it admitted implements/extends as caller edges under a comment claiming its edge set was consistent with the other's. On BroadleafCommerce's Money it reached 241 classes and no controller at all, publishing endpoints_affected_count: 0 beside 21 endpoints from impact-chain for the same symbol at the same depth.",
       "unresolved_answer": null,
       "unresolved_note": "Reach over the analysed graph is decidable: an edge is present or it is not. What the graph could not resolve (reflective dispatch, configuration-driven wiring) is stated as analysis scope and as a hub-guard truncation flag, which makes the answer a floor rather than an unknown."
+    },
+    {
+      "fact": "endpoint_request_identity",
+      "authority": "sourcecode.canonical_ir:request_identity",
+      "definition": "The identity of an HTTP request across two states of one repository: METHOD plus the mapping path, with no normalisation of path-variable names or inline regexes. It is deliberately not the endpoint id, which carries the controller FQN and the handler symbol and therefore changes when a handler moves without the URL changing.",
+      "stats_key": "base_requests",
+      "consumers": [
+        "sourcecode.contract_diff",
+        "sourcecode.posture"
+      ],
+      "parity_test": "tests/test_posture_diff_ref.py",
+      "seam": "M10.5 item 1 (posture --diff-ref)",
+      "was": "Each command comparing two trees spelled the identity itself: `contract_diff` built a (METHOD, path) tuple and rendered it, and a second consumer keyed on the endpoint id, which reports a handler moved between controllers as one request removed and another added. Two spellings of one identity is how two commands come to disagree about the same endpoint.",
+      "unresolved_answer": null,
+      "unresolved_note": "A mapping always has a method and a path, so the identity itself is never undecided. What can be undecided is the access decision attached to it, and where two mappings share one request identity and disagree, the request is reported `undecided` rather than resolved by picking one."
     }
   ]
 }

sourcecode/git_checkout.py

@@ -68,10 +68,13 @@ def repo_root(path: Path) -> Path:
     """
     result = _git(path, "rev-parse", "--show-toplevel")
     if result.returncode != 0 or not result.stdout.strip():
+        # The fact only. What to do instead differs per command — `delta` takes
+        # two checkouts, `posture --since` takes none — so the remedy is added by
+        # the caller through its own `hint`, and this message stopped naming one
+        # that half its callers do not offer.
         raise RefError(
             NOT_A_REPOSITORY,
-            f"{path} is not inside a git repository, so a ref cannot be resolved "
-            "there. Pass two checkouts positionally instead.",
+            f"{path} is not inside a git repository, so a ref cannot be resolved there.",
         )
     return Path(result.stdout.strip())