sourcecode 4.15.0__tar.gz → 4.17.0__tar.gz

{sourcecode-4.15.0 → sourcecode-4.17.0}/CHANGELOG.md

@@ -2,6 +2,179 @@
 
 ## [Unreleased]
 
+## [4.17.0] — 2026-08-10
+
+**The Part 1 queues of field evaluations #20 and #21, and the first three
+capabilities behind them.** Eval #20 is the first audit of a repository this
+product does not model — Keycloak, 8 204 Java files, Quarkus + JAX-RS,
+`spring_detected: false` in all six audited modules, 47 invocations under
+`ASK_READONLY=1` — and it split the product cleanly in two: every structural axis
+worked alone, and the axes that guess produced 86 `high` findings with zero true
+positives. Eval #21 is the seventh measurement of `saint-server`, and its
+contribution is a partition rather than a defect.
+
+**Fixed in this release:**
+
+- **`audit-report` had no deadline at all (C3-89).** It composes the whole of
+  `risk` and did so with no `PhasedRun`, no `stop_when` and no checkpoint: the
+  field measured 2 265 s under `ASK_MAX_ANALYSIS_SECONDS=300`, killed by hand
+  with nothing to show. Bound to the same authority `risk` is bound to, and a cut
+  bundle declares it **before the signature covers it** — including when the cut
+  arrived through `--from-risk`.
+- **`risk` was still not bounded, and now the walks ask (C3-88).** C3-85's naming
+  answered which one held the time on the first run: `reading HTTP-input query
+  sinks`, still on screen at 1,4 min under a 5 s budget. Every walk of the
+  composition now asks the deadline, a skipped walk degrades its axis to
+  `unknown` rather than shrinking a count, and the walk itself runs only when it
+  can change an answer. Measured: jobrunr 15,7 → **4,1 s** with an identical
+  payload; `keycloak/services` over ten minutes → **10,2 s under a 5 s budget**,
+  PARTIAL published.
+- **A gate is one the repository declares (C3-90).** `@NoCache` and
+  `@APIResponses` were being read as Keycloak's authorization gates by coverage
+  and specificity alone. `spring-audit keycloak/services`: **86 findings, all
+  `high`, all false → 0**, with the hedged posture verdict untouched.
+- **And a route is protected by one too (C3-93).** The same wide list decided the
+  per-endpoint verdict, which is the reassurance side and the worse one: **366 of
+  593 endpoints `protected_custom`** on a caching hint. Now **0**.
+- **A bypass claim needs something to bypass (C3-91).** Self-invocation and
+  private/final non-interception are properties of a proxy; where nothing
+  proxies, the two rules are silent, and where something does, the finding names
+  the enforcement model it assumed instead of asserting a framework.
+- **A family says which of its walks the count belongs to (C3-92).** The name was
+  computed, used for `_partial`, and dropped on the way to the screen.
+- **The answer says whether its axes model this repository (CL-19).** Six axes
+  returned the shape of an answer and none added them up; `stack_fit` does, from
+  the flag the payload already carries.
+- **`ask schema <unknown>` lists everything the argument accepts (C4-22).**
+
+**New in this release:**
+
+- **`--config <path>` / `ASK_CONFIG` (F-AX).** The repository's declaration may
+  live outside the repository, so an auditor under `--no-write` can declare data
+  labels and custom security annotations without touching somebody else's tree —
+  the case eval #20 executed, and the one where four commands were unreachable by
+  construction.
+- **The fit statement reaches `posture` and `risk` (F-AY)**, over one
+  `spring_detected` authority that replaced two independent computations.
+- **A truncated answer breaks the consumer that did not ask (F-AV).** On a cut
+  run `total_defects` becomes `total_defects_floor`, and `--ci` exits **75** —
+  neither the pass, nor "found something", nor "refused". Asked for in three
+  consecutive rounds and deliberately kept out of three correction queues,
+  because it changes a published contract.
+
+**Measured and not fixed:** eval #21 reports ten performance regressions on
+4.16.0. The 4.15.0 → 4.16.0 diff is 282 lines and contains **no analysis change**
+— emission, budget binding and payload keys — and an A/B on BroadleafCommerce is
+flat on the four worst-reported commands (`validation` 8,52 → 8,28 s, `endpoints`
+2,09 → 2,24 s, `migrate-check` 7,79 → 7,51 s, `posture --diff` 4,00 → 4,08 s).
+Third consecutive in-house A/B to come back flat; the row (C3-76e) stays open on
+the Windows runner, which is now the highest-value item on the capability list.
+
+
+## [4.16.0] — 2026-08-10
+
+**The Part 1 queue of field evaluation #19 — three rows, one commit each — and
+the round where reading the field's *numbers* against our source found more than
+reading its *conclusions* did.** The sixth measurement of the same repository at
+the same commit scored **8,2/10**, the highest of the series: *"4.15.0 es la
+mejor versión medida."* It verified both of the previous release's rows from the
+outside (C3-81's `stage_stopped_in`, C3-83's budget provenance), determinism held
+a **sixth** consecutive build across five version jumps, and five commands got
+much faster (`validation` −57 %, `posture --diff` −54 %).
+
+Two of the three complaints it left open turned out not to be what was filed.
+
+**Fixed in this release:**
+
+- **`risk` declares a budget and never asks whether it is spent (C3-87).** The
+  field filed `risk` at 2 842 s under a 420 s budget as a +41 % performance
+  regression. It is a consumer left unbound. C3-71 and C3-79 made the deadline
+  reach inside the rule pass and bound exactly one: `spring-audit` passes
+  `stop_when=_run.exhausted` at both of its call sites, while `risk` built the
+  same `PhasedRun`, with the same `budget_seconds` and the same `budget_source`,
+  and then constructed its observers with **no `stop_when` at all** — so
+  `should_stop()` answered `False` for the life of the run and the budget could
+  only be observed on the boundary between two phases. Their own two numbers
+  prove it on one machine under one budget: `spring-audit` **1,94×** over, `risk`
+  **6,8×** over. Reproduced here on keycloak (5 486 files) with a 5 s budget —
+  `spring-audit` stops at 9,9 s with `_partial` published; `risk` was still
+  running at **10 minutes, 120×**, and had to be killed. Both rule passes and the
+  composition join now ask, each on the unit it iterates. A cut run publishes the
+  floor marks **where the numbers are** (`partial`, `counts_are_floor`,
+  `counts_basis` — C2-31's rule applied to the second consumer), names the join's
+  own cut (`composition_stopped_after`), and says PARTIAL on the terminal. A
+  complete run gains no field. The three rule-pass keys of `_partial` move into
+  `PhasedRun.status`: for four releases there was one caller, so "the caller" and
+  "the authority" were the same object by accident, and a second consumer would
+  otherwise have duplicated thirty lines of composition or invented a second
+  vocabulary for one fact. **The battery asserts an absence**, because the defect
+  was one — a missing argument at a call site is invisible in the payload of the
+  command that omits it, so it reads `cli.py` and fails on any
+  `_rule_pass_progress(...)` built without `stop_when`. A third consumer cannot
+  be added unbound.
+
+- **A stage of an audit either counts its population or names itself (C3-85).**
+  Six rounds of field reports read the 14,5-minute silence as a dead emitter,
+  proposing that the timer be re-armed. Measured through the real seam, the
+  emitter is alive and correct: a per-unit tick loop produced **5 evenly spaced
+  lines over 5,4 s at a 1 s interval**. What is silent is the work no counter
+  covers — instrumented on keycloak, **8,2 s of a 24 s warm run, 34 %**, between
+  the last `linking` tick and the first rule tick, with `linking 5486/5486`
+  frozen on screen throughout; 2,7 s more inside `GATE-001`; 24,7 s on a cold run
+  after `parsing 50/5486`. Named, not counted: the IR build's tail (`assembling
+  the IR`, `recovering spec-declared routes`, `scanning XML security
+  configuration`), the semantic-model build, the whole-tree walk *inside* the
+  configuration family (through `FamilyBudget.stage`, so the line says which
+  family it belongs to), the rule pass's dedup-and-order tail, and each of the
+  five repository-wide walks `risk` makes before it composes. A single walk has
+  no population, and inventing a denominator for it is the fabrication C3-56
+  refused. The assertion is the invariant rather than the symptom: a build may
+  not end on a completed counter, because everything after it runs under a line
+  that reads as still running.
+
+- **A count that has stopped moving says so, and stops estimating (C3-86).** The
+  field's line — `3340/3342 java files eta=0.5s` — was written **fourteen
+  minutes** after the counter last advanced, and both of its halves are claims
+  the run cannot support: it asserts the stage is 99,9 % done *now*, and the ETA
+  divides the remaining units by a rate measured over a window in which nothing
+  happened, so the longer the stall lasted the more imminent the finish looked. A
+  line whose counted state has not advanced for a whole interval now publishes
+  `unchanged_for=<duration>` and withholds the estimate — the rule
+  `_eta_seconds` already applies to a stage too young to extrapolate from. The
+  count itself is still printed: it is true, and it is what a reader wants; what
+  is withheld is the assertion that it is current. The staleness clock is
+  deliberately not the stage clock — a long, healthy, advancing stage must not be
+  marked frozen, and both directions are asserted. An uncounted stage is never
+  called stale: it never claimed a denominator.
+
+**Measured and not reproduced:** the report's third proposed fix — *"corregir la
+documentación del flag `--jobs`"* — is already shipped. `JOBS_OPTION_HELP` in
+this build reads *"It does NOT parallelise the rule pass, which is where a
+repository-wide audit spends most of its time, and on a warm cache there is
+nothing left to parse, so raising it buys nothing there."* The report quotes a
+truncated earlier string. Recorded on CL-18 so it is not re-opened, which is the
+CL-17 precedent.
+
+**Deliberately not in this release**, and each for a stated reason: **F-AT**
+(parallel rule evaluation — the field's single priority, *"lo único que separa
+este producto de un 9"*: a capability, and it does not start before this queue
+finishes), **F-AV** (a distinct exit code for a partial answer, or renaming
+`total_defects` to `total_defects_floor` when `partial` is true — a published
+contract change, never a side effect of a correction), **F-AU** (reusing the
+cached audit in the compositions), and **C3-76/F-AW** (the cross-version `risk`
+variance: macOS measures both sides flat for the second consecutive A/B, and a
+regression that reproduces on one platform cannot be bisected from the platform
+where it does not).
+
+**What C3-87 does not close, stated plainly: the wall time.** After the fix,
+`risk` on BroadleafCommerce (2 985 files) still runs past ten minutes under a 3 s
+budget, because the cost is not in the passes that now ask. That is **C3-88**,
+and it is open with a measurement rather than a hypothesis — the stage-by-stage
+profile was started and cancelled before it attributed the time, so the row says
+so instead of guessing.
+
+Suite **7 833** (7 813 before), 20 new assertions, zero failures.
+
 ## [4.15.0] — 2026-08-10
 
 **The Part 1 queue of Amendment O — the four rows field evaluation #18 opened,

{sourcecode-4.15.0 → sourcecode-4.17.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.15.0
+Version: 4.17.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.15.0-blue)
+![Version](https://img.shields.io/badge/version-4.17.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -126,7 +126,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.15.0 — and, on a build that has aged,
+ask version                    # ask 4.17.0 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-4.15.0 → sourcecode-4.17.0}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.15.0-blue)
+![Version](https://img.shields.io/badge/version-4.17.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -88,7 +88,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.15.0 — and, on a build that has aged,
+ask version                    # ask 4.17.0 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-4.15.0 → sourcecode-4.17.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "4.15.0"
+version = "4.17.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-4.15.0 → sourcecode-4.17.0}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.15.0"
+__version__ = "4.17.0"

{sourcecode-4.15.0 → sourcecode-4.17.0}/src/sourcecode/audit_report.py

@@ -12,9 +12,10 @@ import hmac
 import json
 from datetime import datetime, timezone
 from pathlib import Path
-from typing import Any, Optional
+from typing import Any, Callable, Optional
 
 from sourcecode import __version__
+from sourcecode.partial_contract import floor_counts, read_count
 
 AUDIT_REPORT_SCHEMA = "audit-report-v1"
 
@@ -40,14 +41,30 @@ def build_audit_report(
     sign_key: Optional[bytes] = None,
     risk_limit: int = 10,
     risk_payload: Optional[dict[str, Any]] = None,
+    progress: "Optional[Callable[..., Any]]" = None,
+    checkpoint: "Optional[Callable[[str, dict], None]]" = None,
+    partial_status: "Optional[Callable[..., dict]]" = None,
 ) -> dict[str, Any]:
-    """Build the buyer-readable audit bundle from existing command payloads."""
+    """Build the buyer-readable audit bundle from existing command payloads.
+
+    C3-89. This command composes the whole of `risk`, and for four releases it did
+    so with none of the three arguments above — no observer carrying the deadline,
+    no checkpoint, no `partial_status` — while `cli` built no `PhasedRun` for it
+    either. The operator's budget therefore did not exist here at all: the field
+    measured **2 265 s under `ASK_MAX_ANALYSIS_SECONDS=300`** (7,55×), CPU-bound in
+    one worker, with no `partial` and no answer. C3-87 bound the second consumer of
+    that fact and moved the composition of the `_partial` keys into
+    `PhasedRun.status` so the third would get it by construction; this is the third.
+    """
     from sourcecode.posture import build_posture
 
     root = Path(root).resolve()
     if risk_payload is None:
         from sourcecode.risk import build_risk
-        risk = build_risk(root, limit=risk_limit, min_band="low", profiles=profiles)
+        risk = build_risk(
+            root, limit=risk_limit, min_band="low", profiles=profiles,
+            progress=progress, checkpoint=checkpoint, partial_status=partial_status,
+        )
         risk_source = "computed"
     else:
         risk = risk_payload
@@ -65,8 +82,10 @@ def build_audit_report(
         "summary": {
             "risk_model": risk.get("model"),
             "risk_source": risk_source,
-            "total_defects": risk.get("total_defects"),
-            "total_findings": risk.get("total_findings"),
+            # F-AV: read under either spelling, and republished under the one
+            # the bundle's own `summary.partial` already qualifies.
+            "total_defects": read_count(risk, "total_defects"),
+            "total_findings": read_count(risk, "total_findings"),
             "risk_bands": risk.get("by_band", {}),
             "top_risks_shown": len(top_risks),
             "endpoint_access": access.get("summary", {}),
@@ -85,6 +104,28 @@ def build_audit_report(
             "non_coverage": (risk.get("non_coverage") or {}).get("items", []),
         },
     }
+    # C3-89. A bundle whose evidence was cut says so **before** it is signed, and
+    # says it where a reader of the summary sees it — a signature over a truncated
+    # payload that does not declare the truncation is the worst artifact this
+    # product can produce. The keys come from `risk` itself, whichever way it
+    # arrived: a `--from-risk` file that was cut carries its own `_partial`, and
+    # packaging it silently would launder a floor into a verdict (C2-31's rule).
+    if risk.get("partial"):
+        unsigned["summary"]["partial"] = True
+        floor_counts(unsigned["summary"], True)  # F-AV, on the bundle too
+        unsigned["summary"]["counts_are_floor"] = True
+        unsigned["summary"]["counts_basis"] = (
+            "The risk evidence in this bundle was stopped by the analysis budget. "
+            "`total_defects` and `risk_bands` count what the families that ran "
+            "measured, and are a floor over the repository."
+        )
+        _risk_partial = risk.get("_partial")
+        if isinstance(_risk_partial, dict):
+            unsigned["_partial"] = dict(_risk_partial)
+            unsigned["_partial"]["command"] = "audit-report"
+            unsigned["_partial"]["cut_in"] = "risk"
+            if risk_source == "from-risk":
+                unsigned["_partial"]["cut_in"] = "the `--from-risk` payload"
     from sourcecode.provenance import build_evidence_manifest
     unsigned["evidence_manifest"] = build_evidence_manifest(
         unsigned,
@@ -117,7 +158,8 @@ def render_markdown(report: dict[str, Any]) -> str:
         f"- Repository: `{repo}`",
         f"- ASK version: `{(report.get('tool') or {}).get('version', '')}`",
         f"- Profile set: `{profile}`",
-        f"- Total defects: `{summary.get('total_defects')}`",
+        f"- Total defects: `{read_count(summary, 'total_defects')}`"
+        + ("  **(floor — this run was cut short)**" if summary.get("partial") else ""),
         f"- Risk bands: `{summary.get('risk_bands')}`",
         f"- Endpoint access: `{summary.get('endpoint_access')}`",
         "",