sourcecode 4.2.0__py3-none-any.whl → 4.3.0__py3-none-any.whl

sourcecode/cli.py

@@ -183,7 +183,7 @@ COMMAND_TIERS: "tuple[tuple[str, str, tuple[str, ...]], ...]" = (
         "cache", "auth", "mcp", "telemetry",
     )),
     ("experimental", "shape may change in a minor — do not gate CI on it", (
-        "risk", "posture", "archetype",
+        "risk", "enrich", "data-exposure", "migrate-recipe", "posture", "archetype",
     )),
     # `retrieve` publishes 15+ intents whose answers the other commands already
     # give better: measured on the battery, `security-surface` merely re-states
@@ -814,6 +814,20 @@ def _admit_path(
     raise typer.Exit(code=exit_code)
 
 
+def _profile_set(raw: "Optional[str]") -> "Optional[set[str]]":
+    """`--profile prod,metrics` → `{"prod", "metrics"}`; nothing given → None.
+
+    None and the empty set are different answers: no profile set was named, versus
+    a named set that is empty. The first leaves the access axis on the repository's
+    own security surface; the second would resolve the bean graph with nothing
+    active. One parser, so `posture`, `risk` and `enrich` cannot disagree about
+    what a profile string means.
+    """
+    if raw is None:
+        return None
+    return {part.strip() for part in raw.split(",") if part.strip()}
+
+
 def _exit_on_unresolved_target(resolution: "Optional[str]") -> None:
     """Close the run on a target the analysis never resolved — one exit code.
 
@@ -4871,6 +4885,18 @@ def endpoints_cmd(
         False, "--by-controller",
         help="Group endpoints by controller class (structured API surface for C4/Container synthesis).",
     ),
+    client_usage: bool = typer.Option(
+        False, "--client-usage",
+        help="Join the routes against the HTTP calls written in the TypeScript/"
+             "JavaScript client checked into this repository: which routes anybody "
+             "here calls, which nothing here calls, and which client calls hit no "
+             "route at all.",
+    ),
+    client_dir: Optional[Path] = typer.Option(
+        None, "--client-dir",
+        help="Where the client lives, when it is not the whole repository "
+             "(implies --client-usage).",
+    ),
 ) -> None:
     """Extract REST API endpoint surface from Java source files.
 
@@ -4974,6 +5000,18 @@ def endpoints_cmd(
     # rendering: counting the rendered list here would be the defect this block
     # exists to remove, one line into its own implementation (R5-R8).
     data["exposure"] = _endpoint_exposure_summary(_selected)
+
+    # M10.5 item 4. On a large surface the cheapest reduction of exposure is
+    # deleting API nobody calls, and in a monorepo the caller is checked in next
+    # to the callee. Joined over the population the filters chose, for the same
+    # reason the census is.
+    if client_usage or client_dir is not None:
+        from sourcecode.client_calls import build_client_usage
+
+        data["client_usage"] = build_client_usage(
+            target, _selected,
+            client_dirs=[client_dir] if client_dir is not None else None,
+        )
     if compact:
         from sourcecode.degradation import cap_effect
 
@@ -6100,6 +6138,30 @@ def _require_dir(target_dir: Path, cmd: str) -> None:
     _admit_path(target_dir, usage=f"ask baseline {cmd} <path> ...")
 
 
+def _resolve_history_dir(target_dir: Path) -> Path:
+    """A repository path and its history directory are both valid ways to say it.
+
+    Capture writes to `<repo>/.ask/baselines`, so once a history exists the reader
+    commands have to accept the thing the writer was pointed at: `ask trend .` is what
+    someone types after `ask baseline capture .`, and making them name the storage
+    directory is the same avoidable friction that kept the series empty.
+    Directories holding baselines are used as they are, so an explicit `--dir`
+    location keeps working unchanged.
+    """
+    from sourcecode.architectural_baseline import latest_baseline_path
+
+    if latest_baseline_path(target_dir) is not None:
+        return target_dir
+    nested = target_dir / _bac_history_dirname()
+    return nested if nested.is_dir() else target_dir
+
+
+def _bac_history_dirname() -> Path:
+    from sourcecode.baseline_autocapture import HISTORY_DIRNAME
+
+    return HISTORY_DIRNAME
+
+
 @baseline_app.command("capture")
 def baseline_capture_cmd(
     path: Path = typer.Argument(
@@ -6119,6 +6181,12 @@ def baseline_capture_cmd(
              "with a vendor — so an audit that must leave the tree untouched "
              "writes elsewhere with this flag.",
     ),
+    auto: bool = typer.Option(
+        False, "--auto",
+        help="Pipeline mode: capture this commit once, skip when there is nothing new "
+             "to record (dirty tree, commit already captured), and never fail the run. "
+             "Safe to leave in a CI job that runs on every push.",
+    ),
 ) -> None:
     """Capture a versioned architectural baseline of the current repo state.
 
@@ -6129,10 +6197,18 @@ def baseline_capture_cmd(
     replays it; `baseline trend` series several. Metric content is a pure function of
     the repo state; no verdict, no ROI.
 
+    \b
+    `--auto` is the form for a pipeline: the series is the asset nobody can
+    reconstruct afterwards, and a history that depends on someone remembering to
+    run this command will not exist. It captures one baseline per commit, refuses
+    to attribute a dirty tree to the commit it would be filed under, and exits 0
+    whatever happens — a build must not go red because a snapshot could not be
+    written.
     \b
     Examples:
       ask baseline capture ./repo --ref v2.5.20
       ask baseline capture ./repo --dir ./repo/.ask/baselines
+      ask baseline capture . --auto            # in CI, on every push
     """
     target_dir = path.resolve()
     _require_dir(target_dir, "capture")
@@ -6140,6 +6216,30 @@ def baseline_capture_cmd(
     from sourcecode.context_graph import ContextGraph
     from sourcecode.architectural_baseline import build_baseline, git_commit, write_baseline
 
+    if auto:
+        from sourcecode import baseline_autocapture as _auto
+
+        # Decide BEFORE building the IR: a skip is the common case in a pipeline
+        # that runs on every push, and it must cost nothing.
+        plan = _auto.plan(target_dir, out_dir=out_dir, explicit=True)
+        if plan.action != _auto.CAPTURED:
+            typer.echo(f"Baseline not captured ({plan.reason}): {plan.statement}")
+            return
+        _prog = Progress()
+        _prog.start("building IR")
+        _cir = ContextGraph.build_from_root(target_dir).cir
+        _prog.update("capturing baseline")
+        done = _auto.run(target_dir, _cir, out_dir=out_dir, ref=ref, decision=plan)
+        _prog.finish()
+        if done.action == _auto.CAPTURED:
+            typer.echo(
+                f"Baseline written to {done.baseline_file} "
+                f"(commit={done.commit}; history holds {done.history_size})"
+            )
+        else:
+            typer.echo(f"Baseline not captured ({done.reason}): {done.statement}")
+        return
+
     _prog = Progress()
     _prog.start("building IR")
     _cir = ContextGraph.build_from_root(target_dir).cir
@@ -6164,9 +6264,11 @@ def baseline_diff_cmd(
         Path("."),
         help="Repository root to diff against the stored baseline (default: cwd).",
     ),
-    baseline_file: Path = typer.Option(
-        ..., "--baseline", "-b",
-        help="Path to a stored architectural-baseline-v1 JSON artifact.",
+    baseline_file: Optional[Path] = typer.Option(
+        None, "--baseline", "-b",
+        help="Path to a stored architectural-baseline-v1 JSON artifact. Omit it to "
+             "diff against the most recent baseline in the repository's own history "
+             "(<path>/.ask/baselines) — the question a captured series exists for.",
     ),
     output_path: Optional[Path] = typer.Option(
         None, "--output", "-o",
@@ -6202,12 +6304,32 @@ def baseline_diff_cmd(
     or pass --allow-incomparable to override.
 
     \b
-    Example:
+    Examples:
+      ask baseline diff ./repo
       ask baseline diff ./repo --baseline ./repo/.ask/baselines/abc1234.json
     """
     _enforce_format("baseline-diff", format)
     target_dir = path.resolve()
     _require_dir(target_dir, "diff")
+
+    if baseline_file is None:
+        from sourcecode.architectural_baseline import latest_baseline_path
+
+        history = _resolve_history_dir(target_dir)
+        latest = latest_baseline_path(history)
+        if latest is None:
+            _emit_error_json(
+                INVALID_INPUT_CODE,
+                f"No captured baseline found for '{target_dir}'.",
+                path=str(history),
+                hint="Capture one first: ask baseline capture <path> "
+                     "(or --auto in the pipeline that already runs).",
+                expected="A stored architectural-baseline-v1 JSON file, or a "
+                         "repository whose .ask/baselines holds one.",
+            )
+            raise typer.Exit(code=1)
+        baseline_file = latest
+
     if not baseline_file.exists():
         _emit_error_json(
             INVALID_INPUT_CODE,
@@ -6262,8 +6384,9 @@ def baseline_diff_cmd(
 @baseline_app.command("trend")
 def baseline_trend_cmd(
     directory: Path = typer.Argument(
-        ...,
-        help="Directory of stored architectural-baseline-v1 artifacts.",
+        Path("."),
+        help="A repository whose history to read, or a directory of stored "
+             "architectural-baseline-v1 artifacts (default: current directory).",
     ),
     output_path: Optional[Path] = typer.Option(
         None, "--output", "-o",
@@ -6286,11 +6409,12 @@ def baseline_trend_cmd(
     fan-in tracks. Reports movement only — no improving/degrading label.
 
     \b
-    Example:
+    Examples:
+      ask baseline trend ./repo
       ask baseline trend ./repo/.ask/baselines
     """
     _enforce_format("baseline-trend", format)
-    trend_dir = directory.resolve()
+    trend_dir = _resolve_history_dir(directory.resolve())
     _require_dir(trend_dir, "trend")
 
     from sourcecode.architectural_baseline import build_trend, load_baselines_dir
@@ -6301,8 +6425,10 @@ def baseline_trend_cmd(
             INVALID_INPUT_CODE,
             f"No architectural baselines found in '{trend_dir}'.",
             path=str(trend_dir),
-            hint="Capture some first: ask baseline capture <path> --dir <this dir>.",
-            expected="A directory containing architectural-baseline-v1 JSON files.",
+            hint="Capture some first: ask baseline capture <path> "
+                 "(or --auto in the pipeline that already runs).",
+            expected="A repository with a captured history, or a directory "
+                     "containing architectural-baseline-v1 JSON files.",
         )
         raise typer.Exit(code=1)
 
@@ -6321,8 +6447,9 @@ def baseline_trend_cmd(
 @app.command("trend")
 def trend_cmd(
     directory: Path = typer.Argument(
-        ...,
-        help="Directory of stored architectural-baseline-v1 artifacts.",
+        Path("."),
+        help="A repository whose history to read, or a directory of stored "
+             "architectural-baseline-v1 artifacts (default: current directory).",
     ),
     output_path: Optional[Path] = typer.Option(
         None, "--output", "-o",
@@ -6351,7 +6478,8 @@ def trend_cmd(
     fan-in tracks. Reports movement only — no improving/degrading label.
 
     \b
-    Example:
+    Examples:
+      ask trend ./repo
       ask trend ./repo/.ask/baselines
     """
     baseline_trend_cmd(
@@ -6897,6 +7025,15 @@ def verify_cmd(
     repository could not be analysed — never a silent pass). Same codes as
     `verify-edit`.
 
+    \b
+    Where the repository already keeps an architectural history (`.ask/baselines`),
+    this run adds the current commit to it and reports what it did under
+    `architectural_history` — the gate already built the IR a baseline is extracted
+    from, and a series that depends on somebody remembering will not exist. It never
+    starts a history on its own, never captures from a dirty tree, and never changes
+    this command's verdict. `--capture-baseline` above is a different artifact: the
+    accepted *contract debt*, not the architectural series.
+
     \b
     Examples:
       ask verify --init                     # derive contracts this repo satisfies
@@ -6985,8 +7122,24 @@ def verify_cmd(
         )
         return
 
+    # The architectural history rides along with the gate (M10.5). This is the run
+    # that already happens on every push and already builds the IR a baseline is
+    # extracted from, so the series costs a file write instead of an analysis — and
+    # a series nobody has to remember to capture is the one that exists. It writes
+    # only where a history is already kept (or where the operator opted in), never
+    # from a dirty tree, never twice for a commit, and never changes this command's
+    # verdict or exit code.
+    from sourcecode import baseline_autocapture as _bac
+
+    _history: dict = {}
+
+    def _capture(cir) -> None:
+        _history["decision"] = _bac.run(path, cir)
+
     try:
-        report = _vr.verify_repo(path, fail_on=fail_on, baseline_path=baseline)
+        report = _vr.verify_repo(
+            path, fail_on=fail_on, baseline_path=baseline, on_cir=_capture
+        )
     except _vr.VerifyError as exc:
         _emit_error_json(
             INVALID_INPUT_CODE,
@@ -6995,8 +7148,17 @@ def verify_cmd(
         )
         raise typer.Exit(code=2 if ci else 0)
 
+    payload = report.to_dict()
+    # Published on every run, including the ones that captured nothing: a history
+    # that silently stopped growing is invisible until the day somebody needs the
+    # series (I-8 — a run declares the effect of what it did not do).
+    payload["architectural_history"] = (
+        _history.get("decision")
+        or _bac.CaptureDecision(_bac.SKIPPED, _bac.NO_ANALYSIS)
+    ).to_dict()
+
     _emit_command_output(
-        _serialize_dict(report.to_dict(), format),
+        _serialize_dict(payload, format),
         output_path,
         False,
         success_msg=f"verify report written to {output_path}",
@@ -7019,6 +7181,12 @@ def risk_cmd(
         "--min-band",
         help="Floor on the composed band: critical | high | medium | low.",
     ),
+    profile: Optional[str] = typer.Option(
+        None,
+        "--profile",
+        help="Active profile set, comma-separated (e.g. prod or prod,metrics). "
+             "Binds the access axis to what THAT deployment leaves reachable.",
+    ),
     output_path: Optional[Path] = typer.Option(
         None, "--output", "-o", help="Write the report to a file instead of stdout."
     ),
@@ -7035,13 +7203,16 @@ def risk_cmd(
     commands saying "medium".
 
     \b
-      severity_effective = defect_severity × reachability × auth_verdict × write_effect
+      {{RISK_MODEL}}
 
     \b
     No new analysis: every factor is read from the command that already publishes
-    it, and every row publishes its four factors with the authority each came
-    from, so a reader can disagree with one and keep the rest. An axis that could
-    not be measured is `unknown`, multiplies by 1.0, and is named in `blind_axes`.
+    it, and every row publishes every factor with the authority each came from, so
+    a reader can disagree with one and keep the rest. An axis that could not be
+    measured is `unknown`, multiplies by 1.0, and is named in `blind_axes`. The
+    two input-path axes — a query built by concatenation, a route accepting an
+    unconstrained body — are adjacencies: no dataflow is followed (NC-001, in the
+    payload's `non_coverage`).
 
     \b
     One row is one **defect** — the same identity `spring-audit` groups by, so the
@@ -7049,10 +7220,18 @@ def risk_cmd(
     as `witness_count` and `witness_sites`, and `total_findings` publishes the
     observation census under its own name.
 
+    \b
+    `--profile prod` binds the access axis to what THAT deployment leaves
+    reachable: `posture` resolves the conditional bean graph and the request
+    chain, and its decision resolves an endpoint the repository-wide surface left
+    at `coverage_unknown` — in either direction. Without it the axis answers for
+    the repository as configured.
+
     \b
     Examples:
       ask risk .
       ask risk . --min-band high
+      ask risk . --profile prod
       ask risk . --limit 10 -o risk.json
     """
     from sourcecode.risk import build_risk
@@ -7067,7 +7246,7 @@ def risk_cmd(
         )
         raise typer.Exit(code=1)
 
-    data = build_risk(path, limit=limit, min_band=min_band)
+    data = build_risk(path, limit=limit, min_band=min_band, profiles=_profile_set(profile))
     _emit_command_output(
         _serialize_dict(data, format),
         output_path,
@@ -7079,6 +7258,356 @@ def risk_cmd(
     )
 
 
+@app.command("enrich")
+def enrich_cmd(
+    path: Path = typer.Argument(
+        Path("."),
+        help="Repository path (default: current directory).",
+    ),
+    sarif: Optional[Path] = typer.Option(
+        None,
+        "--sarif",
+        help="SARIF 2.1.0 log from another scanner (Semgrep, CodeQL, Trivy…).",
+    ),
+    limit: int = typer.Option(
+        50, "--limit", help="How many enriched findings to publish (highest first)."
+    ),
+    min_band: str = typer.Option(
+        "low",
+        "--min-band",
+        help="Floor on the composed band: critical | high | medium | low.",
+    ),
+    profile: Optional[str] = typer.Option(
+        None,
+        "--profile",
+        help="Active profile set, comma-separated (e.g. prod or prod,metrics). "
+             "Binds the access axis to what THAT deployment leaves reachable.",
+    ),
+    output_path: Optional[Path] = typer.Option(
+        None, "--output", "-o", help="Write the report to a file instead of stdout."
+    ),
+    format: str = typer.Option("json", "--format", "-f", help="Output format: json or yaml."),
+) -> None:
+    """[EXPERIMENTAL] Somebody else's findings, ranked by what this repository does with them.
+
+    \b
+    This product does not detect injection, CVEs or secrets, and says so in every
+    security payload (NC-001, NC-002). A scanner that does has no bean graph, no
+    profile model and no endpoint id it shares with anything, so its output is a
+    list nobody can order. `enrich` reads that list and answers the question the
+    scanner cannot: which of these findings sits in code an unauthenticated
+    request reaches.
+
+    \b
+      {{RISK_MODEL}}
+
+    \b
+    The same composition `ask risk` runs, with one difference: `defect_severity`
+    is the scanner's own verdict, carried through with the scanner named as its
+    authority. Nothing here re-rates, confirms or contradicts a finding.
+
+    \b
+    A result located on a build manifest is a statement about a **library**, not
+    about a line of this repository's code, so it is joined differently: the
+    coordinate is read back out of the manifest the scanner named, and the reach is
+    the worst of the types that import it. That is the CVE question crossed with
+    exposure — of forty vulnerable dependencies, which ones does an unauthenticated
+    route actually reach. A library nothing imports is `unresolved`, never
+    "unreachable": reflection and service loaders leave no import edge.
+
+    \b
+    A result this build cannot place — a file outside the population it read, a
+    line with no declaration above it — is published under `unresolved` with the
+    reason. It is never dropped, because a count of enriched findings that quietly
+    omitted them is exactly the confident falsehood this product is built against.
+
+    \b
+    Examples:
+      ask enrich . --sarif semgrep.sarif
+      ask enrich . --sarif codeql.sarif --min-band high
+      ask enrich . --sarif trivy.sarif --profile prod
+      ask enrich /path/to/repo --sarif trivy.sarif -o enriched.json
+    """
+    from sourcecode.sarif import enrich_sarif
+
+    path = _admit_path(path)
+    if sarif is None:
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            "--sarif is required: this command enriches another tool's findings, "
+            "it does not detect any of its own.",
+            hint="Example: ask enrich . --sarif semgrep.sarif",
+            expected="a path to a SARIF 2.1.0 log",
+        )
+        raise typer.Exit(code=1)
+    if min_band not in ("critical", "high", "medium", "low"):
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            f"--min-band expects critical | high | medium | low (got {min_band!r}).",
+            hint="Example: --min-band high",
+            expected="critical|high|medium|low",
+        )
+        raise typer.Exit(code=1)
+    if not Path(sarif).is_file():
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            f"SARIF log not found: {sarif}",
+            hint="Point --sarif at the file the scanner wrote.",
+            expected="an existing SARIF 2.1.0 log",
+        )
+        raise typer.Exit(code=1)
+
+    try:
+        data = enrich_sarif(
+            Path(sarif), path, limit=limit, min_band=min_band,
+            profiles=_profile_set(profile),
+        )
+    except (ValueError, json.JSONDecodeError) as exc:
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            f"{sarif} is not a readable SARIF 2.1.0 log: {exc}",
+            hint="Check that the file is the scanner's SARIF output, not its native format.",
+            expected="a SARIF 2.1.0 JSON document with a `runs` array",
+        )
+        raise typer.Exit(code=1)
+
+    _emit_command_output(
+        _serialize_dict(data, format),
+        output_path,
+        False,
+        success_msg=(
+            f"enriched findings written to {output_path} ({data['shown']} of "
+            f"{data['defects']} defects composed, {len(data['unresolved'])} unplaced)"
+        ),
+    )
+
+
+@app.command("migrate-recipe")
+def migrate_recipe_cmd(
+    path: Path = typer.Argument(
+        Path("."),
+        help="Repository path to scan (default: current directory).",
+    ),
+    write: bool = typer.Option(
+        False, "--write",
+        help="Write the recipe to <path>/rewrite.yml instead of only publishing it. "
+             "Read-only by default: an audit of somebody else's repository must be "
+             "able to run this.",
+    ),
+    force: bool = typer.Option(
+        False, "--force",
+        help="Overwrite an existing rewrite.yml (only with --write).",
+    ),
+    recipe_name: str = typer.Option(
+        None, "--name",
+        help="Name of the generated composite recipe (default: ask.MigrationFromMeasuredFindings).",
+    ),
+    min_severity: str = typer.Option(
+        "low", "--min-severity",
+        help="Minimum severity to include: critical | high | medium | low.",
+    ),
+    include_hygiene: bool = typer.Option(
+        False, "--include-hygiene",
+        help="Add the advisory hygiene recipes (java.util.Date → java.time and the "
+             "rest of the best-practice bucket). Excluded by default: a migration "
+             "diff that also modernises date handling cannot be reviewed as one "
+             "change.",
+    ),
+    target_jdk: Optional[int] = typer.Option(
+        None, "--target-jdk",
+        help="JDK the migration targets (passed through to migrate-check).",
+    ),
+    output_path: Optional[Path] = typer.Option(
+        None, "--output", "-o", help="Write the report to a file instead of stdout."
+    ),
+    format: str = typer.Option("json", "--format", "-f", help="Output format: json or yaml."),
+) -> None:
+    """[EXPERIMENTAL] The migration report, in the form the executor takes.
+
+    \b
+    `migrate-check` already names the OpenRewrite recipe each finding carries —
+    296 of 309 on openmrs-core, 144 of 170 on BroadleafCommerce — and a reader
+    still had to copy them out of a JSON payload by hand. This emits the
+    declarative recipe that runs exactly those, plus the invocation for the build
+    this repository actually declares.
+
+    \b
+    It does not rewrite anything, and that is a position rather than a gap
+    (NC-005): OpenRewrite is the executor, this is its input. The recipe list is
+    derived from findings — never from a catalogue of what OpenRewrite can do,
+    because a recipe nobody's finding asked for would rewrite code nobody
+    measured — and every blocking finding with no recipe is published under
+    `manual_remainder`, because "run this and you are done" is the failure mode a
+    585-blocker report cannot afford twice.
+
+    \b
+    Examples:
+      ask migrate-recipe .                  # publish the recipe, write nothing
+      ask migrate-recipe . --write          # write <path>/rewrite.yml
+      ask migrate-recipe . --min-severity high
+    """
+    from sourcecode.migrate_check import run_migrate_check
+    from sourcecode.openrewrite_recipe import DEFAULT_FILENAME, DEFAULT_RECIPE_NAME, build_plan
+    from sourcecode.repository_ir import find_java_files
+
+    target = _admit_path(path)
+    _enforce_format("migrate-recipe", format)
+    if min_severity not in ("critical", "high", "medium", "low"):
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            f"Invalid min-severity '{min_severity}'.",
+            hint="min-severity must be one of: critical, high, medium, low.",
+            expected="critical | high | medium | low",
+        )
+        raise typer.Exit(code=1)
+
+    _prog = Progress()
+    _prog.start("scanning for migration findings")
+    try:
+        report = run_migrate_check(
+            find_java_files(target), target,
+            min_severity=min_severity, target_jdk=target_jdk,
+        )
+    finally:
+        _prog.finish()
+
+    plan = build_plan(
+        report, target,
+        recipe_name=recipe_name or DEFAULT_RECIPE_NAME,
+        include_hygiene=include_hygiene,
+    )
+    data = plan.to_dict()
+
+    destination = target / DEFAULT_FILENAME
+    if write:
+        if destination.exists() and not force:
+            _emit_error_json(
+                INVALID_INPUT_CODE,
+                f"{destination} already exists; --write would replace it.",
+                path=str(destination),
+                hint="Review that file, or re-run with --force to overwrite it.",
+                expected="No rewrite.yml at the repository root, or --force.",
+            )
+            raise typer.Exit(code=1)
+        if not plan.recipes:
+            # Writing an empty recipe list produces a file the executor accepts and
+            # that changes nothing — a green run that proves nothing was migrated.
+            _emit_error_json(
+                INVALID_INPUT_CODE,
+                "No finding in this repository names an OpenRewrite recipe, so there "
+                "is nothing to write.",
+                path=str(target),
+                hint="Run `ask migrate-check` to see what was found; the remainder is "
+                     "manual work, listed under `manual_remainder`.",
+                expected="At least one finding carrying a recipe.",
+            )
+            raise typer.Exit(code=1)
+        destination.write_text(plan.document, encoding="utf-8")
+        data["written_to"] = str(destination)
+    else:
+        data["written_to"] = None
+
+    _emit_command_output(
+        _serialize_dict(data, format),
+        output_path,
+        False,
+        success_msg=(
+            f"migration recipe written to {output_path} "
+            f"({plan.covered_findings} of {plan.total_findings} findings covered by "
+            f"{len(plan.recipes)} recipe(s))"
+        ),
+    )
+
+
+@app.command("data-exposure")
+def data_exposure_cmd(
+    path: Path = typer.Argument(
+        Path("."),
+        help="Repository path (default: current directory).",
+    ),
+    profile: Optional[str] = typer.Option(
+        None,
+        "--profile",
+        help="Active profile set, comma-separated (e.g. prod). Says what THAT "
+             "deployment leaves reachable on the routes that carry labelled data.",
+    ),
+    output_path: Optional[Path] = typer.Option(
+        None, "--output", "-o", help="Write the report to a file instead of stdout."
+    ),
+    format: str = typer.Option("json", "--format", "-f", help="Output format: json or yaml."),
+) -> None:
+    """[EXPERIMENTAL] Which routes can carry the data you labelled, and who reaches them.
+
+    \b
+    Nothing here decides what is sensitive: that is a judgement about a domain, and
+    a field called `dni` is a national identifier in one repository and a column
+    name in another. Declare it once in `sourcecode.config.json`:
+
+    \b
+      {"dataLabels": [{"label": "pii", "types": ["com.example.Person"],
+                       "fields": ["com.example.Account#iban"]}]}
+
+    \b
+    Everything after the declaration is measured, over authorities that already
+    exist — the same call reach `impact-chain` walks, the same endpoint security
+    surface `risk` weighs, the same profile resolution `posture` publishes. Two
+    evidence classes, published apart and never added together:
+      signature   — the handler names the labelled type in its own signature
+      call_reach  — the handler's chain reaches it: a supremum, not a proof
+
+    \b
+    A route absent from the answer is not evidence that it carries nothing:
+    reflection, a runtime serializer, an untyped payload and a native query name no
+    type (NC-008). No labels declared is reported as `answered: false` — never as
+    zero exposed routes.
+
+    \b
+    Examples:
+      ask data-exposure .
+      ask data-exposure . --profile prod
+      ask data-exposure /path/to/repo -o exposure.json
+    """
+    from sourcecode.data_exposure import build_data_exposure
+
+    path = _admit_path(path)
+    _prog = Progress()
+    _prog.start("measuring labelled data exposure")
+    data = build_data_exposure(path, profiles=_profile_set(profile))
+    _prog.finish()
+
+    summary = data["summary"]
+    exposed = summary["endpoints_exposed"]
+    _emit_command_output(
+        _serialize_dict(data, format),
+        output_path,
+        False,
+        success_msg=(
+            f"data exposure written to {output_path} "
+            + (
+                f"({exposed} route(s) carry {summary['labels']} label(s))"
+                if data["answered"] else "(no labels declared — nothing measured)"
+            )
+        ),
+    )
+
+
+def _render_risk_help(doc: str) -> str:
+    """Fill the model line from the module that computes it.
+
+    The help screen carried its own copy of the composition and went on
+    advertising four factors after a fifth and a sixth shipped — the same C4
+    shape as `spring-audit`'s rule list, which is why this is rendered and not
+    written twice.
+    """
+    from sourcecode.risk import RISK_MODEL
+
+    return doc.replace("{{RISK_MODEL}}", RISK_MODEL)
+
+
+risk_cmd.__doc__ = _render_risk_help(risk_cmd.__doc__ or "")
+enrich_cmd.__doc__ = _render_risk_help(enrich_cmd.__doc__ or "")
+
+
 @app.command("posture")
 def posture_cmd(
     path: Path = typer.Argument(
@@ -7182,7 +7711,7 @@ def posture_cmd(
     path = _admit_path(path)
 
     def _parse_set(raw: str) -> set:
-        return {p.strip() for p in raw.split(",") if p.strip()}
+        return _profile_set(raw) or set()
 
     overrides: dict = {}
     for item in property_overrides or []:
@@ -10709,7 +11238,7 @@ HELP_PANELS: "tuple[tuple[str, tuple[str, ...]], ...]" = (
         "cache", "auth", "mcp", "telemetry", "baseline",
     )),
     ("Experimental — shape may change", (
-        "risk", "archetype", "retrieve",
+        "risk", "enrich", "data-exposure", "migrate-recipe", "archetype", "retrieve",
     )),
 )