sourcecode 4.10.4__tar.gz → 4.10.6__tar.gz

{sourcecode-4.10.4 → sourcecode-4.10.6}/CHANGELOG.md

@@ -2,6 +2,235 @@
 
 ## [Unreleased]
 
+## [4.10.6] — 2026-08-07
+
+The M13 sanitation queue, tiers A through C plus the claims tier: **eighteen ledger
+rows close** (C1-36 · C1-37 · C1-38 · C1-39 · C1-40 · C2-27 · C2-28 · C2-29 ·
+C3-53 · C3-54 part 3 · C3-55 · C3-61 · C3-65 · C3-66 · C3-67 · C3-68 · C3-69 ·
+CL-16), against the two independent field evaluations of 4.10.4 and 4.10.5 that
+agreed on the diagnosis and disagreed on nothing material. No feature ships here:
+the owner directive for this milestone is that every bug is sanitated before the
+first feature starts.
+
+⚠ **Five behaviour changes to read before upgrading a pipeline.** All five are the
+fix working, and three of them can move a gate:
+
+- **`pr-impact`, `impact`, `impact-chain`, `plan` and `compare` now floor the
+  verdict at `HIGH` when the change touches a component the container invokes** —
+  a `@Configuration`, an `@Aspect`, a `Filter`, a `@ControllerAdvice`, a bean
+  resolved through an interface something injects, `web.xml`,
+  `application*.y*ml`. A gate that was passing green over a security-config diff
+  will start failing, with the verdict that diff always deserved (C1-36).
+- **`ASK_MAX_ANALYSIS_SECONDS` is honoured instead of vetoed.** A value below the
+  class floor no longer refuses to run: it warns and runs, and a run that spends
+  its budget publishes what it measured with `partial: true`. `--ci` fails on a
+  partial answer (C3-55, C3-54 part 3).
+- **`ask endpoints --servlets` answers with the servlet population only**, plus
+  the endpoint total as one number. A consumer that read `endpoints[]` out of that
+  document has to call `ask endpoints` for it (C3-65).
+- **`ask plan` publishes `null`, not `0`, for anything it did not measure** — an
+  unresolved target, or `covering_tests` in a repository with no test source root.
+  A consumer coercing those to `int` needs to handle `null` (C1-39).
+- **`baseline capture` no longer records the machine by default** (`cpu`, `cores`,
+  `hostname_hash`); `--record-env` restores it. A comparison keyed on those fields
+  needs the flag (C3-68).
+
+`posture` moves from `experimental` to `supported` (CL-16).
+
+### Fixed
+
+- **A component the container calls is not a component nothing calls** (C1-36).
+  *The one blind spot this product did not declare, reproduced on two builds by
+  two evaluations.* Blast radius is projected over the call graph, so a class the
+  framework invokes has fan-in ~0 and every figure derived from it reads as no
+  impact: a diff over the filter chain, the aspect gating 935 routes and the
+  production password encoder published `LOW / "No high-risk signals detected" /
+  affected_endpoints: []`, while a plain POJO in the same repository published
+  `CRITICAL` with 3 382 endpoints. The fan-in figure was never wrong; using it as
+  a risk proxy on that population was. `container_wiring.py` answers the one
+  question that separates them, from facts the CIR already carries — the role it
+  assigns, the interception annotations and supertypes fixed by published
+  specifications, and one route that consults no name at all: *the class
+  implements an interface something injects and has zero incoming call edges*,
+  which catches a password encoder without anyone naming one. Wired at the single
+  blast-radius authority so the four commands that disagreed now answer from one
+  place. The verdict is floored, never lowered; the population is published with
+  its evidence; and **NC-010** states the limit in the payload, the README and the
+  help.
+- **A killed analysis keeps what it measured** (C3-54 part 3). `phased_run.py`
+  gives a long command a declared phase list and a durable checkpoint after each
+  phase, written through the same fsynced, atomic seam as the final answer and
+  removed only once the complete answer is on disk — so a teardown leaves the
+  better of the two files and never neither. A checkpoint can never pass for a
+  finished answer: `partial: true`, `phases_completed`, `phases_pending`,
+  `why_stopped`. The field lost 6,8 minutes of CPU and every recoverable byte
+  four times.
+- **A budget that is set is honoured** (C3-55). Below the class floor was refused
+  and above it admitted a run that outlived the session, so no value was both
+  accepted and survivable on the variable the help presents as the CI control.
+  The floor is advice printed before the work; the budget stops the run between
+  phases; counts in a partial answer are a floor over the phases that completed
+  and say so.
+- **A repository-wide run can outlive its shell** (C3-53, survivable half).
+  `--detach` (with `--output`) starts the analysis in a process that leads its own
+  session and, on Windows, carries `CREATE_BREAKAWAY_FROM_JOB` — the documented
+  way out of the parent shell's job object, which is what killed even
+  `Start-Process -NoNewWindow` and all six of its children at the same second the
+  session died. When a platform refuses the breakaway the envelope says so rather
+  than implying a guarantee it does not have. **Not closed:** the field case is
+  Windows under an agent harness, and only a Windows re-run proves the tree
+  survives there.
+- **`--servlets` answers with the population it names** (C3-65). The flag read as
+  a filter and behaved as an aggregator: 1,8 MB to stdout, the useful signal at
+  0,08 % of the bytes, at line 49 622 of 49 730 — and the agent session that asked
+  for it died. Every servlet row also carries `population: "servlet"`, so a
+  consumer iterating rows finally sees a servlet after passing the flag built to
+  show them.
+- **`compare` no longer ranks the repository first** (C3-67). A candidate that
+  resolves to an existing directory is published as `resolved: false` /
+  `not_a_candidate` and ranks last. `ask compare A B .` used to rank the `.`
+  first, with 3 574 endpoints and 3 342 rollback files as its cost.
+- **`secured_endpoints` published a display cap as a measurement** (C1-38). The
+  `15` that reconciled with nothing was `min(real, 15)`: the count was `len()` of
+  a truncated 15-row sample. The population is counted before the cut, the list is
+  still sampled, and the omission is published with its `cap_effect`. All four
+  figures that share the name now carry their unit and name the other three.
+- **Four figures called "endpoints" each say what they counted** (C1-37), and the
+  baseline stopped disagreeing with itself: `totals.endpoints` counts handler
+  mappings, `totals.endpoint_contract_pairs` counts the distinct (METHOD, path)
+  pairs `endpoint_surface` lists, and the battery holds the invariant between the
+  second and the list — an invariant that is only checkable because the two
+  figures finally describe two things.
+- **What was not measured is `null`, never `0`** (C1-39), in `plan` and in
+  `covering_tests` on a repository with no test source root. The shape
+  `data-exposure` already had, one level up.
+- **`cache model` promised a hit the command does not store** (C1-40). Measured on
+  keycloak: **with** a warm, `onboard` costs 0,7 s; **without** one, a second
+  identical run costs 9,4 s against 10,2 s cold. `repeat` is now false for
+  `onboard`, with the figures published at two scales.
+- **A local artefact is not committable by accident** (C3-68). `.ask/` gets its own
+  `.gitignore` the moment it is created — self-confined, never touching the user's
+  own, never overwriting one they edited — and `env` records only the two fields
+  that decide comparability.
+- **A heartbeat does not make a successful run look failed** (C3-66).
+  `ASK_PROGRESS` takes `1`/`stderr`, `off` and `file:<path>`; the file form leaves
+  stderr empty, so a PowerShell job can watch a six-minute run and still trust
+  `$?`. No setting writes to stdout.
+- **Fix the decoder, not the bytes** (C3-69). `SetConsoleOutputCP(65001)` at entry
+  tells the Windows console to read the UTF-8 we were always writing; only when
+  that fails does the emit seam escape the payload to ASCII. One decision, made
+  once, read by every emit seam.
+- **A budget note that contradicts the summary beside it** (C2-27). The unit is
+  bytes, so `29KB → 29KB` beside `total_omitted_items: 10` cannot recur, and both
+  the note and `_truncation_summary.applies_to` state that trimming describes the
+  stdout rendering — `--output` writes the answer untrimmed.
+- **Git churn is not evidence about semantics** (C2-29). When the symptom names
+  something this repository contains, activity signals contribute nothing to the
+  `fix-bug` rank and are reported as context; when nothing resolves they still
+  rank, published as correlational rather than as triage.
+- **A limit is stated once and referenced** (C2-28). `NC-007` was emitted twice,
+  byte for byte, in the heaviest payload the tool produces.
+
+### Performance
+
+- **The rule pass was never mostly rules** (C3-61, second measurement).
+  Re-profiled after the pre-filter shipped: `infer_security_posture` ran **twice**
+  per audit — once to learn the custom-gate tokens the rules match on, once to
+  publish the posture block — at ~2,1 s each, each rebuilding the filter surface
+  and re-walking the tree underneath it; and `_proxy_bypass` scanned every
+  admissible source for methods twice. Both are identities and both are fixed as
+  identities. **keycloak 6,17 s → 4,07 s, 90 findings before and after, payload
+  identical except `generated_at` and `analysis_time_ms`.** No threads and no
+  processes: parallelising would have bought ~15 % of a wall clock now dominated
+  by the CIR build (12,6 s warm against 4,1 s for the whole rule pass), which is
+  F-AA's problem and not this row's.
+- **Deciding whether a cached context is still valid no longer deserialises it**
+  (C1-40, second half). The validity keys live in an uncompressed sidecar beside
+  the blob; the field measured 1 029 ms average / 1 955 ms p95 to read three short
+  strings out of a 10 MB envelope, and an entry invalidated by a changed signature
+  paid all of it before discarding the result.
+
+### Changed
+
+- `posture` is `supported`, not `experimental` (CL-16). It is the one command
+  neither field evaluation found a competitor for, and it produced 2 of
+  evaluation #15's 3 CRITICAL findings.
+- `pr-impact` keeps its `core` tier because C1-36's silent half is closed: it can
+  now keep the promise that tier makes.
+
+### Still open from this queue
+
+`C4-17` (`--output` accepted postfix on some subcommands, absent on others),
+`C4-19` (a scope-aware `--help` ordered by what can actually run), `C4-20`
+(suggested next commands checked against the cost model before printing), `C4-21`
+(`ask config` listing the label source it resolved) and `C4-18` (`cache status`
+printing `Cores:` for a cache count). All five are discoverability; none of them
+publishes a false claim.
+
+## [4.10.5] — 2026-08-07
+
+Second release of the field-evaluation #13 queue. Three rows close and one closes
+in part; the suite is 6 691 tests green.
+
+⚠ **Two behaviour changes to read before upgrading a pipeline.** Both are the fix
+working, and both can move a gate:
+
+- On Windows, `pr-impact --files -` now resolves paths it previously mangled, so a
+  pipeline that was passing because its diff decoded to nothing can start failing —
+  with the verdict the diff always deserved (C3-58).
+- A security finding that existed only in build output (`target/classes`) is no
+  longer reported, so a repository audited mid-build can report fewer findings
+  (C3-64).
+
+### Performance
+
+- **The security configuration scan discovers its files 8.7× faster** (C3-64):
+  0.61 s → 0.07 s on keycloak, 0.45 s → 0.05 s on alfresco. Five `rglob` calls
+  became one pruned walk. `rglob` cannot skip a subtree, so the old cost was set by
+  the build output and the VCS metadata rather than by the source: 48.4 % of
+  openmrs-core's tree entries and 53.3 % of this repository's live under directories
+  that hold no source at all. On a clean checkout the end-to-end scan moves 1.73 s →
+  1.43 s (the rest is reading Java sources); the win grows with how built the tree
+  is, which is the state a developer's repository is normally in.
+
+### Fixed
+
+- **A path list is decoded by its bytes, never by the platform locale** (C3-58).
+  `ask pr-impact --files -` read stdin through Python's locale decoding, which on
+  Windows is the ANSI codepage: `git diff --name-only | ask pr-impact --files -`
+  returned `risk: UNKNOWN` and 0 endpoints where the same list without the shell's
+  default byte-order mark returned `CRITICAL` and 1 144 — a green pipeline on the
+  gating command. The BOM was the visible half; `AñoService.java` arriving as
+  `AñoService.java` was the cause. The new authority `sourcecode/text_input.py`
+  reads `sys.stdin.buffer` and lets the bytes name the encoding, and the list-file
+  shape goes through it too: PowerShell 5.1 writes UTF-16-LE by default, which the
+  previous UTF-8 read raised on. Undecodable bytes now yield an unusable path with
+  encoding named as a cause, never a traceback.
+- **No command claims `done` before its answer exists** (C3-54, part 2). The
+  completion line moved out of `Progress.finish()` entirely: `finish()` claims the
+  work is done, and the line is printed when the answer has actually been handed
+  over. A run killed in between prints nothing, and a run that raised prints
+  nothing — previously ~20 commands emitted `done (Xs)` while their `--output` file
+  did not exist yet, which in the field meant 6.8 minutes of analysis reported as
+  success over an absent file. Output files are also durable now: the shared writer
+  fsyncs data and directory entry before anything reports a write, and `repo-ir` —
+  the one `-o` path that bypassed that writer — goes through it.
+- **A rejected progress write no longer silences progress for the rest of the run**
+  (C3-56, part). The heartbeat treated any write failure as terminal; it now retries
+  and gives up only after five consecutive failures. The reported 393 s of silence
+  did not reproduce: the cadence is timer-driven and measured exact on a cold
+  29.9 s run (5.0 / 10.0 / 15.0 / 20.0 / 25.1 s). The progress denominator and ETA
+  the row also asks for are still open.
+- **A build copy is no longer a second security finding** (C3-64). The configuration
+  scan walked the whole tree five times and could not skip a subtree, so a compiled
+  copy of `application.properties` under `target/classes` was reported beside the
+  source file it came from. It now walks once, pruning build output and VCS metadata
+  with the same ignore set Java discovery uses.
+- **An unresolved changed file names the right thing to check** (C3-58). One message
+  covered both causes and pointed at the wrong one: a path that is *not on disk* is a
+  path problem (form and encoding), while a path that *is* there but maps to no class
+  is a fact about the file. They now say so separately.
+
 ## [4.10.4] — 2026-08-07
 
 First release of the queue opened by field evaluation #13. Four of its rows close,

{sourcecode-4.10.4 → sourcecode-4.10.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.10.4
+Version: 4.10.6
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.10.4-blue)
+![Version](https://img.shields.io/badge/version-4.10.6-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -106,7 +106,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.10.4 — and, on a build that has aged,
+ask version                    # ask 4.10.6 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -299,7 +299,7 @@ experimental: both are true, and they are two different facts.
 |---|---|---|
 | **core** | contract stable within a major — safe to gate CI on | `endpoints` · `spring-audit` · `migrate-check` · `impact` · `impact-chain` · `pr-impact` · `verify` |
 | **supported** | maintained; fields are added, never removed without a major | every command not named in another row |
-| **experimental** | shape may change in a minor — do not gate CI on it | `risk` · `enrich` · `audit-report` · `data-exposure` · `migrate-recipe` · `posture` · `archetype` |
+| **experimental** | shape may change in a minor — do not gate CI on it | `risk` · `enrich` · `audit-report` · `data-exposure` · `migrate-recipe` · `archetype` |
 | **parked** | kept working, no longer developed | `retrieve` |
 
 The same table is printed by `ask --help`, and both are generated from one authority
@@ -315,7 +315,7 @@ from it.
 
 | Command | Tier | Answers | Note |
 |---|---|---|---|
-| `posture` | experimental | which beans a profile set wires, and how effective endpoint access differs between two sets | the most differentiated capability here |
+| `posture` | supported | which beans a profile set wires, and how effective endpoint access differs between two sets | the most differentiated capability here |
 | `risk` | experimental | what each defect actually costs, once reach, access, write effect and the shape of the input path are in it | `defect_severity × reachability × auth_verdict × write_effect × query_construction × input_constraints`; every factor names its authority; `--table --rule SEC-008 --band high --top-n 20` gives audit triage without `jq` |
 | `enrich` | experimental | another scanner's SARIF findings, ranked by what this repository does with them | `--sarif <log>`; same composition as `risk`, with `--table --rule <id> --band high --top-n 20` for triage |
 | `audit-report` | experimental | human audit bundle over existing `risk` + `posture` evidence, optionally signed | includes `evidence_manifest` claim provenance; `--format markdown`; `--sign-key <file>` signs canonical JSON with HMAC-SHA256 |
@@ -398,6 +398,12 @@ And one about who calls a route:
 |---|---|---|
 | **Whether a route is called from outside this repository — another service, a mobile app, a partner, a cron job, or a client whose URL is assembled at run time.** | The join reads the TypeScript/JavaScript checked in beside the server and only the call shapes whose verb and path are written at the call site. That is a floor on who calls a route and can never be a ceiling: the repository cannot observe consumers it does not contain. So a route with no call site here is published as a candidate for deletion, never as dead API. | Access logs or an API gateway answer who really calls a route. The opposite direction is decisive without them: a client call matching no route is a request this repository's own front end makes and its server does not serve. |
 
+And one about blast radius:
+
+| Not covered | Why | What answers it |
+|---|---|---|
+| **The reach of a component the container invokes rather than the code — a security filter chain, an around-advice aspect, a `@ControllerAdvice`, a bean resolved through the interface it implements.** | Blast radius here is projected over the call graph: who calls the changed symbol, and which routes reach those callers. Nothing in the repository calls a container-wired component, so its measured call-graph fan-in is ~0 and every figure derived from it — affected endpoints, direct callers, rollback surface — reads as no impact. The fan-in figure is correct; using it as a risk proxy on this population is not. Publishing that as a low verdict would be a confident zero, which is the one thing this product does not do. | Such a change is flagged in `analysis_warnings` and its verdict is floored, never rated on fan-in. The reach itself is measured elsewhere and was there all along: `ask endpoints` resolves a gate annotation to the routes carrying it, `ask explain <class>` prints the request chain a configuration declares with its source line, and `ask posture --profile <set>` states what each profile leaves open. Projecting those into the blast radius (pointcut → routes, matcher → routes) is a measurement this command does not yet make. |
+
 The one row above with a remedy in this build: `ask endpoints /path/to/repo --servlets`
 lists the servlet-mounted HTTP surface as a population of its own — `web.xml` mappings and
 `ServletRegistrationBean` registrations, with the file that declares each — and never merges
@@ -497,7 +503,7 @@ Matching endpoints report `policy: "custom"` and drop out of the `no_security_si
 | [USER_GUIDE.md](docs/USER_GUIDE.md) | Full command reference, flags, output schema, workflows |
 | [contracts.md](docs/contracts.md) | Declare invariants in `.ask/contracts.yml` (or derive them with `ask verify --init`), enforce them in the edit loop and in CI |
 | [baseline-ci.yml](docs/baseline-ci.yml) | Capture an architectural baseline per release, so the series exists when you want to read it |
-| [posture.md](docs/posture.md) | What a profile set actually wires — down to which endpoints its filter chain permits — and what could not be decided (experimental) |
+| [posture.md](docs/posture.md) | What a profile set actually wires — down to which endpoints its filter chain permits — and what could not be decided |
 | [migrate-check.md](docs/migrate-check.md) | Migration rule catalogue (MIG-001..043) + Hibernate stratification |
 | [MODERNIZATION.md](docs/MODERNIZATION.md) | The modernization product: assess → understand → plan → execute |
 | [PRODUCT_TIERS.md](docs/PRODUCT_TIERS.md) | Free vs Pro, pricing model |

{sourcecode-4.10.4 → sourcecode-4.10.6}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.10.4-blue)
+![Version](https://img.shields.io/badge/version-4.10.6-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -68,7 +68,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.10.4 — and, on a build that has aged,
+ask version                    # ask 4.10.6 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -261,7 +261,7 @@ experimental: both are true, and they are two different facts.
 |---|---|---|
 | **core** | contract stable within a major — safe to gate CI on | `endpoints` · `spring-audit` · `migrate-check` · `impact` · `impact-chain` · `pr-impact` · `verify` |
 | **supported** | maintained; fields are added, never removed without a major | every command not named in another row |
-| **experimental** | shape may change in a minor — do not gate CI on it | `risk` · `enrich` · `audit-report` · `data-exposure` · `migrate-recipe` · `posture` · `archetype` |
+| **experimental** | shape may change in a minor — do not gate CI on it | `risk` · `enrich` · `audit-report` · `data-exposure` · `migrate-recipe` · `archetype` |
 | **parked** | kept working, no longer developed | `retrieve` |
 
 The same table is printed by `ask --help`, and both are generated from one authority
@@ -277,7 +277,7 @@ from it.
 
 | Command | Tier | Answers | Note |
 |---|---|---|---|
-| `posture` | experimental | which beans a profile set wires, and how effective endpoint access differs between two sets | the most differentiated capability here |
+| `posture` | supported | which beans a profile set wires, and how effective endpoint access differs between two sets | the most differentiated capability here |
 | `risk` | experimental | what each defect actually costs, once reach, access, write effect and the shape of the input path are in it | `defect_severity × reachability × auth_verdict × write_effect × query_construction × input_constraints`; every factor names its authority; `--table --rule SEC-008 --band high --top-n 20` gives audit triage without `jq` |
 | `enrich` | experimental | another scanner's SARIF findings, ranked by what this repository does with them | `--sarif <log>`; same composition as `risk`, with `--table --rule <id> --band high --top-n 20` for triage |
 | `audit-report` | experimental | human audit bundle over existing `risk` + `posture` evidence, optionally signed | includes `evidence_manifest` claim provenance; `--format markdown`; `--sign-key <file>` signs canonical JSON with HMAC-SHA256 |
@@ -360,6 +360,12 @@ And one about who calls a route:
 |---|---|---|
 | **Whether a route is called from outside this repository — another service, a mobile app, a partner, a cron job, or a client whose URL is assembled at run time.** | The join reads the TypeScript/JavaScript checked in beside the server and only the call shapes whose verb and path are written at the call site. That is a floor on who calls a route and can never be a ceiling: the repository cannot observe consumers it does not contain. So a route with no call site here is published as a candidate for deletion, never as dead API. | Access logs or an API gateway answer who really calls a route. The opposite direction is decisive without them: a client call matching no route is a request this repository's own front end makes and its server does not serve. |
 
+And one about blast radius:
+
+| Not covered | Why | What answers it |
+|---|---|---|
+| **The reach of a component the container invokes rather than the code — a security filter chain, an around-advice aspect, a `@ControllerAdvice`, a bean resolved through the interface it implements.** | Blast radius here is projected over the call graph: who calls the changed symbol, and which routes reach those callers. Nothing in the repository calls a container-wired component, so its measured call-graph fan-in is ~0 and every figure derived from it — affected endpoints, direct callers, rollback surface — reads as no impact. The fan-in figure is correct; using it as a risk proxy on this population is not. Publishing that as a low verdict would be a confident zero, which is the one thing this product does not do. | Such a change is flagged in `analysis_warnings` and its verdict is floored, never rated on fan-in. The reach itself is measured elsewhere and was there all along: `ask endpoints` resolves a gate annotation to the routes carrying it, `ask explain <class>` prints the request chain a configuration declares with its source line, and `ask posture --profile <set>` states what each profile leaves open. Projecting those into the blast radius (pointcut → routes, matcher → routes) is a measurement this command does not yet make. |
+
 The one row above with a remedy in this build: `ask endpoints /path/to/repo --servlets`
 lists the servlet-mounted HTTP surface as a population of its own — `web.xml` mappings and
 `ServletRegistrationBean` registrations, with the file that declares each — and never merges
@@ -459,7 +465,7 @@ Matching endpoints report `policy: "custom"` and drop out of the `no_security_si
 | [USER_GUIDE.md](docs/USER_GUIDE.md) | Full command reference, flags, output schema, workflows |
 | [contracts.md](docs/contracts.md) | Declare invariants in `.ask/contracts.yml` (or derive them with `ask verify --init`), enforce them in the edit loop and in CI |
 | [baseline-ci.yml](docs/baseline-ci.yml) | Capture an architectural baseline per release, so the series exists when you want to read it |
-| [posture.md](docs/posture.md) | What a profile set actually wires — down to which endpoints its filter chain permits — and what could not be decided (experimental) |
+| [posture.md](docs/posture.md) | What a profile set actually wires — down to which endpoints its filter chain permits — and what could not be decided |
 | [migrate-check.md](docs/migrate-check.md) | Migration rule catalogue (MIG-001..043) + Hibernate stratification |
 | [MODERNIZATION.md](docs/MODERNIZATION.md) | The modernization product: assess → understand → plan → execute |
 | [PRODUCT_TIERS.md](docs/PRODUCT_TIERS.md) | Free vs Pro, pricing model |

{sourcecode-4.10.4 → sourcecode-4.10.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "4.10.4"
+version = "4.10.6"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-4.10.4 → sourcecode-4.10.6}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.10.4"
+__version__ = "4.10.6"

{sourcecode-4.10.4 → sourcecode-4.10.6}/src/sourcecode/architectural_baseline.py

@@ -136,6 +136,19 @@ def _fan_in_from_stored(value: Any) -> dict[str, int]:
     return {}
 
 
+def _comparability_env() -> dict:
+    """The environment fields a delta actually depends on (C3-68).
+
+    A baseline is comparable to another when the platform and the tool agree;
+    the CPU model, the core count and a hash of the hostname change none of
+    that. `--record-env` restores the full set for someone benchmarking runs
+    against each other on one machine.
+    """
+    import sys as _sys
+
+    return {"os": _sys.platform, "tool_version": TOOL_VERSION, "recorded": "comparability_only"}
+
+
 def build_baseline(
     cir: "CanonicalRepositoryIR",
     *,
@@ -145,6 +158,7 @@ def build_baseline(
     captured_at: str | None = None,
     env: dict | None = None,
     tool_version: str | None = None,
+    record_env: bool = False,
 ) -> dict:
     """Freeze a CIR's measured architectural metrics into a baseline artifact.
 
@@ -168,6 +182,21 @@ def build_baseline(
             "files": m.file_count,
             "symbols": m.symbol_count,
             "endpoints": m.endpoint_count,
+            # C1-37: this artefact's declared purpose is to be a replayable
+            # fingerprint, and it disagreed with itself — `totals.endpoints`
+            # 3 574 against `len(endpoint_surface)` 3 538 on the field
+            # repository. Neither figure was wrong: `endpoints` counts handler
+            # mappings and `endpoint_surface` is the set of distinct
+            # (METHOD, path) contract pairs, so 36 routes are declared by more
+            # than one handler. Two facts, two names, and the invariant the
+            # battery can actually hold.
+            "endpoint_contract_pairs": len(m.endpoints),
+            "endpoints_unit": (
+                "handler mappings declared in the repository; "
+                "`endpoint_contract_pairs` counts the distinct (METHOD, path) "
+                "pairs those mappings expose, which is what `endpoint_surface` "
+                "lists and what a diff compares"
+            ),
             "dependency_edges": m.dependency_edge_count,
             "import_cycles": len(m.cycles),
         },
@@ -175,7 +204,16 @@ def build_baseline(
         "endpoint_surface": endpoints,
         "fan_in": _fan_in_to_list(m.fan_in),
         "import_cycles": cycles,
-        "env": env if env is not None else collect_env(),
+        # C3-68: this artefact is written inside the work tree, so what it
+        # records is what a `git add -A` publishes. `hostname_hash`, `cpu` and
+        # `cores` describe the developer's machine and affect nothing a delta
+        # compares — from a tool whose own `ask config` says telemetry is off.
+        # The default is now the two fields that DO decide comparability; the
+        # rest is opt-in per capture.
+        "env": (
+            env if env is not None
+            else (collect_env() if record_env else _comparability_env())
+        ),
         "provenance": (
             "architectural_baseline (D5): a measured structural fingerprint of one "
             "CIR, persisted per ref. Metric content is a pure function of the repo "
@@ -319,9 +357,50 @@ def _baseline_filename(baseline: dict) -> str:
     return f"{safe}.json"
 
 
+#: What `.ask/` gets the moment it is created, and why.
+#:
+#: C3-68: `baseline capture` writes into the work tree and nothing protected it.
+#: The field verified `grep -nE "^\.ask|sourcecode" .gitignore` → no matches, so
+#: a `git add -A` commits the artefact — which carries a machine fingerprint and
+#: a 14 587-entry structural inventory of the code. A self-confined
+#: `.ask/.gitignore` is the honest form: it never touches the user's own
+#: `.gitignore`, and it stops applying the moment they delete the directory.
+_ASK_DIR_GITIGNORE = (
+    "# Written by `ask` the first time it created this directory.\n"
+    "# These are local analysis artefacts: a structural inventory of your code\n"
+    "# and, if you asked for it, the machine that measured it. Nothing here\n"
+    "# belongs in a commit. Delete this file to version them deliberately.\n"
+    "*\n"
+)
+
+
+def protect_ask_dir(out_dir: Path) -> None:
+    """Give a freshly created `.ask/` its own `.gitignore` (C3-68).
+
+    Best-effort and never overwriting: a user who edited it decided something,
+    and a tool that re-imposes its default on every run is worse than one that
+    never wrote it.
+    """
+    try:
+        ask_dir = Path(out_dir)
+        while ask_dir.name and ask_dir.name != ".ask":
+            if ask_dir.parent == ask_dir:
+                return
+            ask_dir = ask_dir.parent
+        if ask_dir.name != ".ask":
+            return
+        marker = ask_dir / ".gitignore"
+        if not marker.exists():
+            ask_dir.mkdir(parents=True, exist_ok=True)
+            marker.write_text(_ASK_DIR_GITIGNORE, encoding="utf-8")
+    except OSError:
+        return
+
+
 def write_baseline(baseline: dict, out_dir: Path) -> Path:
     """Write `baseline` as deterministic JSON under `out_dir`; return the file path."""
     out_dir.mkdir(parents=True, exist_ok=True)
+    protect_ask_dir(out_dir)
     path = out_dir / _baseline_filename(baseline)
     path.write_text(
         json.dumps(baseline, sort_keys=True, indent=2) + "\n", encoding="utf-8"

{sourcecode-4.10.4 → sourcecode-4.10.6}/src/sourcecode/cache_model.py

@@ -202,10 +202,17 @@ COMMANDS: tuple[CommandCache, ...] = (
                  "`refactor`, `fix-bug` and `generate-tests` cache their own answer, but a warm does "
                  "not run them, so their first call pays full price; `delta` and `review-pr` are "
                  "diff-dependent and never cached.",
-                 "onboard 6.5 s → 0.3 s · refactor 7.7 s → 7.7 s (0.3 s on repeat) · "
-                 "generate-tests 12.4 s → 11.0 s (0.3 s on repeat)"),
-    CommandCache("onboard", ("task", "ris"), "answer", True, "Shorthand for `prepare-context onboard`.",
-                 "6.5 s → 0.3 s"),
+                 "onboard 6.5 s → 0.3 s with a warm — but a second run with NO warm recomputes "
+                 "(10.2 s → 9.4 s at 5 486 files; C1-40) · refactor 7.7 s → 7.7 s (0.3 s on "
+                 "repeat) · generate-tests 12.4 s → 11.0 s (0.3 s on repeat)"),
+    CommandCache("onboard", ("task", "ris"), "answer", False,
+                 "Shorthand for `prepare-context onboard`. A warm stores its answer; the command "
+                 "does NOT store its own, so a second run without a warm pays full price. C1-40: "
+                 "the field read `repeat cached` here, ran it twice with no warm, and measured "
+                 "56 s then 23,5 s — this row said it would be a hit.",
+                 "with a warm: 6.5 s → 0.3 s (2 000 files) · 10.2 s → 0.7 s (5 486 files). "
+                 "WITHOUT a warm, a second identical run: 10.2 s → 9.4 s (5 486 files) — "
+                 "no answer hit"),
     CommandCache("explain", ("cir",), "shared", False, "Serves from the shared CIR a warm builds.",
                  "9.8 s → 1.6 s"),
     CommandCache("export", ("parse",), "shared", False, "", "8.8 s → 3.7 s"),

{sourcecode-4.10.4 → sourcecode-4.10.6}/src/sourcecode/change_plan.py

@@ -93,17 +93,31 @@ def build_change_plan(
     from sourcecode.target_admission import is_unresolved
 
     if is_unresolved(resolution) or not blast.get("matched_fqns"):
+        # C1-39: this is a well-formed `change-plan-v1`, not an error envelope,
+        # so an agent reads its fields — and every cost used to be `0`. Nothing
+        # was measured, and `0` is the answer to a different question. The
+        # product already gets this right elsewhere (`data-exposure` answers
+        # `answered: false` rather than measuring nothing and publishing a
+        # confident zero); this is the same rule, one level up.
+        _not_measured = {
+            "answered": False,
+            "reason": f"target {target!r} did not resolve — nothing was measured",
+        }
         return {
             "schema": CHANGE_PLAN_SCHEMA,
             "target": target,
             "resolution": resolution,
             "message": blast.get("message", f"Target {target!r} not found."),
             "candidates": blast.get("candidates", []),
-            "affected_components": {"count": 0, "components": []},
-            "covering_tests": {"count": 0, "tests": []},
-            "affected_endpoints": {"count": 0, "endpoints": []},
-            "rollback_surface": {"file_count": 0, "files": []},
+            "affected_components": {"count": None, "components": [], **_not_measured},
+            "covering_tests": {"count": None, "tests": [], **_not_measured},
+            "affected_endpoints": {"count": None, "endpoints": [], **_not_measured},
+            "rollback_surface": {"file_count": None, "files": [], **_not_measured},
             "review_checklist": [],
+            "how_to_read": (
+                "Every cost here is `null`, not `0`: the target did not resolve, so "
+                "nothing was measured. A zero would say the change is free."
+            ),
         }
 
     seeds = list(blast["matched_fqns"])
@@ -148,10 +162,21 @@ def build_change_plan(
         checklist.append(
             f"Re-verify the contract of {len(ep_strings)} endpoint(s) in the blast radius."
         )
+    # C1-39, second half: on a repository with no test source root at all — the
+    # field one had 0 test files for 3 337 non-test Java sources — "0 covering
+    # tests" reads as *the change is safe* when it means *there are no tests*.
+    _has_test_root = any(
+        is_test_path(str(m.get("file") or "")) for m in meta.values()
+    )
     if tests:
         checklist.append(
             f"Run {len(tests)} covering test symbol(s) that reach the change."
         )
+    elif not _has_test_root:
+        checklist.append(
+            "Covering tests were not measured: this repository has no test source "
+            "root, so `covering_tests.count` is null rather than 0."
+        )
     else:
         checklist.append(
             "No covering tests reach the change — no existing test exercises this blast radius."
@@ -178,10 +203,20 @@ def build_change_plan(
             "count": len(prod),
             "components": prod[:_LIST_CAP],
         },
-        "covering_tests": {
-            "count": len(tests),
-            "tests": tests[:_LIST_CAP],
-        },
+        "covering_tests": (
+            {
+                "count": len(tests),
+                "tests": tests[:_LIST_CAP],
+                "answered": True,
+            }
+            if _has_test_root else
+            {
+                "count": None,
+                "tests": [],
+                "answered": False,
+                "reason": "no test source root in this repository — nothing to measure",
+            }
+        ),
         "affected_endpoints": {
             "count": len(ep_strings),
             "endpoints": ep_strings[:_LIST_CAP],