sourcecode 4.2.0__tar.gz → 4.3.0__tar.gz

{sourcecode-4.2.0 → sourcecode-4.3.0}/CHANGELOG.md

@@ -2,6 +2,188 @@
 
 ## [Unreleased]
 
+### Added
+
+- **`ask migrate-recipe` — the migration report in the form the executor takes**
+  (roadmap M10.5 item 5 / M8.5, experimental). `migrate-check` already names the
+  OpenRewrite recipe each finding carries (296 of 309 on openmrs-core) and a reader
+  still had to copy them out of a JSON payload by hand — field evaluation #4's verdict
+  on that gap was *"el informe muere en un cajón; el codemod se convierte en PRs"*. The
+  command emits the declarative composite recipe naming exactly those recipes, the
+  artifact coordinates derived from their packages, and the invocation for the build the
+  repository declares (Maven or Gradle). It writes nothing without `--write`, so an audit
+  of somebody else's repository can run it; `--write` refuses to replace an existing
+  `rewrite.yml` without `--force`. **Nothing here edits source** — that is NC-005's
+  position, not a gap: OpenRewrite is the executor and this is its input.
+  - The recipe list comes from the findings, never from a catalogue of what OpenRewrite
+    can do: a recipe nobody's finding asked for would rewrite code nobody measured.
+  - Every finding with no recipe is published under `manual_remainder`. Measured on
+    BroadleafCommerce: **25 blocking findings in product code and not one automatable**,
+    which is an answer, not an empty result — and the reason an empty recipe list prints
+    *no* runnable command, because `mvn … rewrite:run` over nothing is a green executor
+    run that reads as "the migration is automated".
+  - Advisory hygiene is excluded by default (`--include-hygiene` opts in): on openmrs-core
+    it takes the population from 125 findings to 309 and adds `JavaTimeAPIs`, and a
+    migration diff that also modernises date handling cannot be reviewed as one change.
+  - The coverage block names **both** populations — its own and `migrate-check`'s narrower
+    `blocking_count` (125 against 114 on openmrs-core) — because two populations under one
+    name is the defect this project keeps finding in its own output.
+
+## [4.3.0] — 2026-08-03
+
+Minor, not a patch: two commands are new (`ask enrich`, `ask data-exposure`), the
+composed risk model gains two factors, and `ask verify` writes a file where it
+wrote none — every one of them additive, none of them removing a published field
+or moving an exit code. A pipeline that reads this release the way it read 4.2.0
+gets the same answers, plus blocks it can ignore.
+
+### Added
+
+- **`ask baseline capture --auto` — an architectural history that does not depend on
+  somebody remembering** (roadmap M10.5, head of the milestone). The snapshot has
+  shipped since D5; the *series* is the asset a competitor cannot backfill, and in
+  every repository measured so far its length is zero, because capture is a command a
+  human has to type. `--auto` is the form a pipeline can keep: it captures one baseline
+  per commit, keeps an already-captured commit instead of relabelling it, refuses to
+  file a tree with uncommitted changes under the commit it would be stored as, and
+  **exits 0 whatever happens** — a build never goes red because a snapshot could not be
+  taken. Every outcome names itself (`captured` / `skipped` with the reason and a
+  sentence of effect), so a pipeline log says which happened rather than going quiet.
+  A skip costs no analysis: the decision is taken before the IR is built, so the common
+  case in a per-push job is ~0.2 s against 1.8 s for a capture. New authority
+  `sourcecode/baseline_autocapture.py`; `docs/baseline-ci.yml` now captures per merge
+  as well as per tag.
+- **`ask data-exposure` — which routes can carry the data you labelled, and who
+  reaches them** (roadmap M10.5 item 3, experimental). Nothing here detects sensitive
+  data: a label is a judgement about a domain, a field named `dni` is a national
+  identifier in one repository and a column name in another, and the engine never
+  branches on a name (VAI). It is declared once under `dataLabels` in
+  `sourcecode.config.json`; everything after that is measured over authorities that
+  already exist — the call reach `impact-chain` walks, the endpoint security surface
+  `risk` weighs, the profile resolution `posture` publishes (`--profile`). Two evidence
+  classes, published apart and never added together: `signature` (the handler names the
+  labelled type in its own signature) and `call_reach` (the chain reaches it — a
+  supremum, not a proof, because the mapping in between is not modelled: NC-008).
+  Measured: petclinic labelling `Owner#telephone` → **7 routes by signature**;
+  BroadleafCommerce labelling `Customer` → **6 by call reach and none by signature**,
+  because those controllers return view names. A repository that declared nothing is
+  `answered: false`, never zero exposed routes, and a declared type the graph never
+  resolved is named with the note that this is not evidence it is unexposed.
+- **A request handler declares types too.** `_extract_class_type_refs` enumerated
+  `symbol_kind == "method"`, and a handler is classified `endpoint` at emission (a
+  factory method `bean`), so the class-scope type surface contained **no controller
+  signature anywhere in a repository**: `structural_references_to_type("Owner")` on
+  petclinic returned 3 atoms, none of them a route that takes an `Owner` as its request
+  body, and "which routes accept or return this type" answered nothing while looking
+  like an answer. Now 10 atoms, 7 of them handler signatures. Same shape as the F.4-1
+  body-surface seam, one scope up; `member_kind` still publishes the kind the symbol was
+  classified with.
+- **The history answers from the repository path.** `ask trend .` and
+  `ask baseline trend .` now take either a repository or a directory of baselines, and
+  `ask baseline diff .` defaults to the newest point in that repository's own history
+  instead of requiring `--baseline <file>`. Capture writes to `<repo>/.ask/baselines`,
+  so making the reader name the storage directory was the same friction that kept the
+  series empty. An explicit directory (the `--dir` case) is unchanged, and a repository
+  with no history gets an error that names how to start one. New
+  `architectural_baseline.latest_baseline_path`, ordered exactly as the trend series is
+  ordered so "the last point" and "the base of a default diff" cannot disagree.
+- **`ask verify` carries the history for free.** The gate is the run that already happens
+  on every push and already builds the IR a baseline is extracted from, so where a
+  repository keeps `.ask/baselines` the gate adds the current commit to it and publishes
+  what it did under `architectural_history` — on every run, including the ones that
+  captured nothing, because a series that silently stopped growing is invisible until the
+  day somebody needs it (I-8). Measured on BroadleafCommerce: 3.9 s with the capture
+  against 4.0 s without, i.e. inside the noise; eureka 1.8 s against 0.8 s (its IR is
+  smaller, the extraction is not). The passenger cannot move the gate: the verdict, the
+  exit code and every other field are identical with and without it, and an exception
+  inside it is swallowed. `ASK_BASELINE_AUTOCAPTURE=0/1` overrides in both directions.
+  - ⚠One measured cost stated rather than hidden: a baseline is ~730 KB on a 3 300-file
+    monolith, because it stores the full endpoint surface and fan-in map so a later
+    `baseline diff` is faithful. A point per merge is a megabyte-scale history; a point
+    per release is not. `--dir` sends them outside the repository.
+  - ⚠Found by the battery, not by the field: the first capture writes an untracked file
+    **inside the repository**, so a plain `git status --porcelain` check would have
+    reported a dirty tree from then on and every later run would have skipped — a
+    history of exactly one. The dirtiness question excludes this tool's own footprint
+    (`.ask/`) and nothing else, because everything else is what the baseline measures —
+    and the second half of that came from eureka, where `verify --init` writes
+    `.ask/contracts.yml` and, counted as a modification, would stop the history from
+    ever starting.
+- **`ask enrich --sarif <log>` — somebody else's detection, ranked by what this
+  repository does with it** (roadmap M10, first deliverable). This product does not
+  detect injection, CVEs or secrets and says so in every security payload (NC-001,
+  NC-002); the scanners that do have no bean graph, no profile model and no endpoint
+  id they share with anything, so their output is a list nobody can order. `enrich`
+  reads a SARIF 2.1.0 log from Semgrep, CodeQL or Trivy and runs the **same
+  composition** `ask risk` runs over each finding — same axes, same weights, same
+  `RiskComposer` — with one difference: `defect_severity` is the scanner's own
+  verdict (`security-severity` when the tool published one, `level` otherwise),
+  carried through with the scanner named as its authority. Nothing re-rates,
+  confirms or contradicts a finding. Results sharing (tool, rule, symbol) are one
+  defect with several witnesses; a result the join could not place — a file outside
+  the population this build read, a line with no declaration above it — is published
+  under `unresolved` with the reason, never dropped.
+- **The CVE half of the same command: a dependency finding is joined through the
+  coordinate, not through a line.** A result located on `pom.xml` or
+  `build.gradle` is about a library, so the coordinate is read back out of the
+  manifest the scanner named and the reach is the worst of the types that import
+  it — *of forty vulnerable dependencies, which ones does an unauthenticated route
+  actually reach?* Importers are found from the IR's existing `imports` edges, by
+  the coordinate's group id or by its artifact id as a package segment, and each
+  row publishes which basis found them. A library nothing imports is `unresolved`
+  and never "unreachable": reflection, a service loader and use through another
+  dependency all leave no import edge. Both kinds rank in one list, because a CVE
+  in a reachable library and an injection finding in a handler are the same
+  question to whoever decides what to fix first.
+- **`--profile <set>` on `ask risk` and `ask enrich` — profile context per finding**
+  (M10 exit criterion). The access axis stops answering for *the repository as
+  configured* and answers for *that deployment*: `posture` resolves the conditional
+  bean graph and the request chain under the named set, through a new published
+  seam (`posture.endpoint_access_under`, `posture.access_verdict`), so a composed
+  row and a `posture` run can never disagree about the same profile set. A decision
+  resolves an endpoint the repository-wide surface left at `coverage_unknown`, in
+  either direction — measured on a fixture, one defect scores 11.52/`open` under
+  `dev`, 8.06/`unknown` with no set named, and 5.76/`protected` under `prod`. When
+  both authorities decided, the worse of them wins, per endpoint.
+- **`ask risk` gains a fifth factor: `query_construction`** (roadmap F.4-1). The
+  field asked the question this answers the structural half of — *"con 618 HQL
+  concatenados, ¿alguno concatena entrada de request?"* Following request input to
+  a query is dataflow, is declared out of scope in NC-001, and stays there. What
+  is publishable without it is the adjacency: this defect's own code assembles a
+  query string by concatenation, and the four factors beside it already say whether
+  that code is reachable, unauthenticated and writing. Read from the α
+  argument-shape atoms the IR already carries (`dynamic_argument_surface`) — no new
+  analysis, one pass, joined per defect. `not_observed` means the shape was absent
+  from the body facts; it is never a claim that a query is safely parameterised.
+- **…and a sixth: `input_constraints`** — the other half of the same field question
+  (*"1 201 bodies sin validación"*). Joined by route against `validation`'s gap
+  list: `absent` means one of the endpoints reaching this defect accepts a request
+  body with no declared constraint, taking the worst of the reached routes for the
+  reason the auth axis does. `ask risk` now publishes the `non_coverage` block too,
+  because two axes describing the input path, composed with an open access verdict,
+  read as *injection* unless the payload states that no dataflow was followed.
+
+### Fixed
+
+- **`validation` counted handlers that take no argument as body endpoints.** The
+  body surface was the verb alone (POST/PUT/PATCH) and the declared limitation said
+  the parameter list was not captured. It is now captured (`_handler_params`) and
+  read in the negative direction only: an empty parameter list proves no body can
+  bind. A handler whose parameters are all path or query values still counts, and
+  the limitation says so.
+
+- **The α argument-shape surface was blind to every controller body.**
+  `dynamic_argument_surface` walked `kind="method"` and `kind="constructor"` symbol
+  nodes; a request handler is a `kind="endpoint"` node. The owner population is now
+  the body-fact layer's own (`ContextGraph.body_owners()`).
+
+### Changed
+
+- `severity_effective` in `ask risk` can now be larger for a row whose code
+  concatenates a query. Every factor's neutral value is 1.0, so a new axis only
+  ever moves a row **up**: no band a reader has already acted on is demoted by
+  this release.
+
 ## [4.2.0] — 2026-08-03
 
 Minor, not a patch, by this project's own criterion: two published figures move

{sourcecode-4.2.0 → sourcecode-4.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.2.0
+Version: 4.3.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -160,8 +160,8 @@ ask verify /path/to/repo --init
 # writes nothing — the form an audit of somebody else's repository can run.
 ask verify /path/to/repo --init --dry-run
 
-# What each defect actually costs once reach, access and write effect are in it:
-# severity × reachability × auth_verdict × write_effect, ordered, every factor traceable.
+# What each defect actually costs once reach, access, write effect and the shape of
+# the input path are in it — ordered, every factor traceable to the command that owns it.
 ask risk /path/to/repo
 ```
 
@@ -254,12 +254,16 @@ guesses is a confident security falsehood — the worst failure mode this tool h
 ### 5c · Composed Risk *(experimental)*
 Every command above answers one axis, and a reader composes them by hand. `ask risk` does the
 join over the endpoint and symbol ids these commands already share with each other:
-`severity_effective = defect_severity × reachability × auth_verdict × write_effect`. The
-product of the published factors **is** the published score — decomposable to the four
+`severity_effective = defect_severity × reachability × auth_verdict × write_effect × query_construction × input_constraints`. The
+product of the published factors **is** the published score — decomposable to the six
 figures and the authority behind each — and an axis this build cannot measure is `unknown`,
 weighted 1.0 and named in `blind_axes` rather than silently treated as safe. Measured on a
 field case: a defect both `spring-audit` and `impact-chain` called *medium* composes to
 **high (8.06)** once *reachable unauthenticated* and *writes to the database* are in it.
+The last two factors describe the input path — a query assembled by concatenation, a route
+accepting a body with no declared constraint. They are **adjacencies, not dataflow**: no
+value is followed from a request to a sink, which is `NC-001` and is published in the
+payload's own `non_coverage` block.
 `ask risk .` · `ask risk . --min-band high` · `ask risk . --limit 10`
 → [reference](docs/USER_GUIDE.md)
 
@@ -285,7 +289,7 @@ experimental: both are true, and they are two different facts.
 |---|---|---|
 | **core** | contract stable within a major — safe to gate CI on | `endpoints` · `spring-audit` · `migrate-check` · `impact` · `impact-chain` · `pr-impact` · `verify` |
 | **supported** | maintained; fields are added, never removed without a major | every command not named in another row |
-| **experimental** | shape may change in a minor — do not gate CI on it | `risk` · `posture` · `archetype` |
+| **experimental** | shape may change in a minor — do not gate CI on it | `risk` · `enrich` · `data-exposure` · `migrate-recipe` · `posture` · `archetype` |
 | **parked** | kept working, no longer developed | `retrieve` |
 
 The same table is printed by `ask --help`, and both are generated from one authority
@@ -302,7 +306,10 @@ from it.
 | Command | Tier | Answers | Note |
 |---|---|---|---|
 | `posture` | experimental | which beans a profile set wires, and how effective endpoint access differs between two sets | the most differentiated capability here |
-| `risk` | experimental | what each defect actually costs, once reach, access and write effect are in it | `defect_severity × reachability × auth_verdict × write_effect`; every factor names its authority |
+| `risk` | experimental | what each defect actually costs, once reach, access, write effect and the shape of the input path are in it | `defect_severity × reachability × auth_verdict × write_effect × query_construction × input_constraints`; every factor names its authority |
+| `enrich` | experimental | another scanner's SARIF findings, ranked by what this repository does with them | `--sarif <log>`; the same composition as `risk`, with the scanner as the severity authority |
+| `migrate-recipe` | experimental | the migration report as the OpenRewrite recipe that applies it | only recipes a finding named; the manual remainder published beside them; writes nothing without `--write`, and never a runnable command for an empty recipe list |
+| `data-exposure` | experimental | which routes can carry the data you labelled, and who reaches them | labels declared in `sourcecode.config.json` — never inferred from a name; `signature` and `call_reach` evidence published apart, field-level flow out of scope (NC-008) |
 | `endpoints` | core | every REST endpoint, effective path, security policy, confidence | Spring MVC + JAX-RS (~65 % recall on JAX-RS sub-resource locators) |
 | `spring-audit` | core | transactional anomalies + security surface + validation gaps | `--ci`, `-f github-comment` |
 | `migrate-check` | core | Boot 2→3 readiness: located blockers, per-dimension score, effort | `--blast-radius` orders the re-test plan |
@@ -317,7 +324,7 @@ from it.
 | `review-pr` / `fix-bug` / `prepare-context` | supported | diff review, symptom triage, task-shaped context | |
 | `plan` / `compare` / `delta` / `contract-diff` | supported | what to review for a change; candidates by measured cost; outcome of a change; public-contract break | no verdicts, measured cost only |
 | `validation` | supported | request-body validation coverage and gaps | |
-| `baseline capture\|diff` · `trend` | supported | versioned architectural metrics over time; `ask trend <dir>` reads the series | trend reporting, not gating. Baselines land in `.ask/baselines` **inside the repository** — the history travels with the code, not with a vendor; an audit that must not write passes `--dir`. Automate it: [baseline-ci.yml](docs/baseline-ci.yml) |
+| `baseline capture\|diff` · `trend` | supported | versioned architectural metrics over time; `ask trend .` reads the series (a repository path or a baselines directory), `ask baseline diff .` compares the tree against its newest point | trend reporting, not gating. Baselines land in `.ask/baselines` **inside the repository** — the history travels with the code, not with a vendor; an audit that must not write passes `--dir`. `capture --auto` is the unattended form (one baseline per commit, never rewrites one, never fails the build) — automate it: [baseline-ci.yml](docs/baseline-ci.yml) |
 | `retrieve` | parked | typed knowledge queries over the model | |
 | `archetype` | experimental | evidence-based architectural archetype | |
 | `rename-class` / `chunk-file` | supported | word-boundary Java rename; split a large file for an agent | |
@@ -368,6 +375,18 @@ And one about the endpoint surface itself:
 |---|---|---|
 | **HTTP surface that is not a Spring handler mapping — a servlet declared in `web.xml` or registered as a `ServletRegistrationBean`, a container-level mapping, a static console mounted by a library.** | The endpoint population is projected from the Spring route model: one entry per handler mapping. A servlet is reachable over HTTP and is not in that model, so it is absent from `endpoints`, from the access verdicts derived from it, and from every ratio keyed on the total. Merging a second population into that count would move a published figure and every ratio with it, so the population is declared before it is widened. | Read the deployment descriptors for `<servlet-mapping>` entries and the Spring configuration for `ServletRegistrationBean` beans. Field evaluation #9 found a monitoring console mounted this way, behind a credential `ask spring-audit` did report (SEC-007) at a path nothing here listed. |
 
+And one about labelled data:
+
+| Not covered | Why | What answers it |
+|---|---|---|
+| **Whether a labelled member actually leaves the process on a given route — field-level dataflow through mappers, DTOs, serializers and projections.** | Exposure here is measured at TYPE granularity over the same call reach every other command walks: a route reaches the labelled type, or its signature names it. Whether the mapping in between keeps the labelled member is a dataflow question, and answering it by approximation would put a confident `no` on a route that does leak. So `call_reach` is published as a supremum and says so. | Read the mapping on the routes this answer ranks first — they are the ones worth a human — and label the DTO too if it carries the member, which makes the route `signature` instead of `call_reach`. |
+
+And one about who calls a route:
+
+| Not covered | Why | What answers it |
+|---|---|---|
+| **Whether a route is called from outside this repository — another service, a mobile app, a partner, a cron job, or a client whose URL is assembled at run time.** | The join reads the TypeScript/JavaScript checked in beside the server and only the call shapes whose verb and path are written at the call site. That is a floor on who calls a route and can never be a ceiling: the repository cannot observe consumers it does not contain. So a route with no call site here is published as a candidate for deletion, never as dead API. | Access logs or an API gateway answer who really calls a route. The opposite direction is decisive without them: a client call matching no route is a request this repository's own front end makes and its server does not serve. |
+
 **Positioning.** Until an executor ships, this is the **diagnosis layer**: it measures what
 must change, what each change reaches, and what a gate should block — and it removes none of
 it. Field evaluation scored it 7/10 as a report generator and 5.5/10 as a development tool,

{sourcecode-4.2.0 → sourcecode-4.3.0}/README.md

@@ -122,8 +122,8 @@ ask verify /path/to/repo --init
 # writes nothing — the form an audit of somebody else's repository can run.
 ask verify /path/to/repo --init --dry-run
 
-# What each defect actually costs once reach, access and write effect are in it:
-# severity × reachability × auth_verdict × write_effect, ordered, every factor traceable.
+# What each defect actually costs once reach, access, write effect and the shape of
+# the input path are in it — ordered, every factor traceable to the command that owns it.
 ask risk /path/to/repo
 ```
 
@@ -216,12 +216,16 @@ guesses is a confident security falsehood — the worst failure mode this tool h
 ### 5c · Composed Risk *(experimental)*
 Every command above answers one axis, and a reader composes them by hand. `ask risk` does the
 join over the endpoint and symbol ids these commands already share with each other:
-`severity_effective = defect_severity × reachability × auth_verdict × write_effect`. The
-product of the published factors **is** the published score — decomposable to the four
+`severity_effective = defect_severity × reachability × auth_verdict × write_effect × query_construction × input_constraints`. The
+product of the published factors **is** the published score — decomposable to the six
 figures and the authority behind each — and an axis this build cannot measure is `unknown`,
 weighted 1.0 and named in `blind_axes` rather than silently treated as safe. Measured on a
 field case: a defect both `spring-audit` and `impact-chain` called *medium* composes to
 **high (8.06)** once *reachable unauthenticated* and *writes to the database* are in it.
+The last two factors describe the input path — a query assembled by concatenation, a route
+accepting a body with no declared constraint. They are **adjacencies, not dataflow**: no
+value is followed from a request to a sink, which is `NC-001` and is published in the
+payload's own `non_coverage` block.
 `ask risk .` · `ask risk . --min-band high` · `ask risk . --limit 10`
 → [reference](docs/USER_GUIDE.md)
 
@@ -247,7 +251,7 @@ experimental: both are true, and they are two different facts.
 |---|---|---|
 | **core** | contract stable within a major — safe to gate CI on | `endpoints` · `spring-audit` · `migrate-check` · `impact` · `impact-chain` · `pr-impact` · `verify` |
 | **supported** | maintained; fields are added, never removed without a major | every command not named in another row |
-| **experimental** | shape may change in a minor — do not gate CI on it | `risk` · `posture` · `archetype` |
+| **experimental** | shape may change in a minor — do not gate CI on it | `risk` · `enrich` · `data-exposure` · `migrate-recipe` · `posture` · `archetype` |
 | **parked** | kept working, no longer developed | `retrieve` |
 
 The same table is printed by `ask --help`, and both are generated from one authority
@@ -264,7 +268,10 @@ from it.
 | Command | Tier | Answers | Note |
 |---|---|---|---|
 | `posture` | experimental | which beans a profile set wires, and how effective endpoint access differs between two sets | the most differentiated capability here |
-| `risk` | experimental | what each defect actually costs, once reach, access and write effect are in it | `defect_severity × reachability × auth_verdict × write_effect`; every factor names its authority |
+| `risk` | experimental | what each defect actually costs, once reach, access, write effect and the shape of the input path are in it | `defect_severity × reachability × auth_verdict × write_effect × query_construction × input_constraints`; every factor names its authority |
+| `enrich` | experimental | another scanner's SARIF findings, ranked by what this repository does with them | `--sarif <log>`; the same composition as `risk`, with the scanner as the severity authority |
+| `migrate-recipe` | experimental | the migration report as the OpenRewrite recipe that applies it | only recipes a finding named; the manual remainder published beside them; writes nothing without `--write`, and never a runnable command for an empty recipe list |
+| `data-exposure` | experimental | which routes can carry the data you labelled, and who reaches them | labels declared in `sourcecode.config.json` — never inferred from a name; `signature` and `call_reach` evidence published apart, field-level flow out of scope (NC-008) |
 | `endpoints` | core | every REST endpoint, effective path, security policy, confidence | Spring MVC + JAX-RS (~65 % recall on JAX-RS sub-resource locators) |
 | `spring-audit` | core | transactional anomalies + security surface + validation gaps | `--ci`, `-f github-comment` |
 | `migrate-check` | core | Boot 2→3 readiness: located blockers, per-dimension score, effort | `--blast-radius` orders the re-test plan |
@@ -279,7 +286,7 @@ from it.
 | `review-pr` / `fix-bug` / `prepare-context` | supported | diff review, symptom triage, task-shaped context | |
 | `plan` / `compare` / `delta` / `contract-diff` | supported | what to review for a change; candidates by measured cost; outcome of a change; public-contract break | no verdicts, measured cost only |
 | `validation` | supported | request-body validation coverage and gaps | |
-| `baseline capture\|diff` · `trend` | supported | versioned architectural metrics over time; `ask trend <dir>` reads the series | trend reporting, not gating. Baselines land in `.ask/baselines` **inside the repository** — the history travels with the code, not with a vendor; an audit that must not write passes `--dir`. Automate it: [baseline-ci.yml](docs/baseline-ci.yml) |
+| `baseline capture\|diff` · `trend` | supported | versioned architectural metrics over time; `ask trend .` reads the series (a repository path or a baselines directory), `ask baseline diff .` compares the tree against its newest point | trend reporting, not gating. Baselines land in `.ask/baselines` **inside the repository** — the history travels with the code, not with a vendor; an audit that must not write passes `--dir`. `capture --auto` is the unattended form (one baseline per commit, never rewrites one, never fails the build) — automate it: [baseline-ci.yml](docs/baseline-ci.yml) |
 | `retrieve` | parked | typed knowledge queries over the model | |
 | `archetype` | experimental | evidence-based architectural archetype | |
 | `rename-class` / `chunk-file` | supported | word-boundary Java rename; split a large file for an agent | |
@@ -330,6 +337,18 @@ And one about the endpoint surface itself:
 |---|---|---|
 | **HTTP surface that is not a Spring handler mapping — a servlet declared in `web.xml` or registered as a `ServletRegistrationBean`, a container-level mapping, a static console mounted by a library.** | The endpoint population is projected from the Spring route model: one entry per handler mapping. A servlet is reachable over HTTP and is not in that model, so it is absent from `endpoints`, from the access verdicts derived from it, and from every ratio keyed on the total. Merging a second population into that count would move a published figure and every ratio with it, so the population is declared before it is widened. | Read the deployment descriptors for `<servlet-mapping>` entries and the Spring configuration for `ServletRegistrationBean` beans. Field evaluation #9 found a monitoring console mounted this way, behind a credential `ask spring-audit` did report (SEC-007) at a path nothing here listed. |
 
+And one about labelled data:
+
+| Not covered | Why | What answers it |
+|---|---|---|
+| **Whether a labelled member actually leaves the process on a given route — field-level dataflow through mappers, DTOs, serializers and projections.** | Exposure here is measured at TYPE granularity over the same call reach every other command walks: a route reaches the labelled type, or its signature names it. Whether the mapping in between keeps the labelled member is a dataflow question, and answering it by approximation would put a confident `no` on a route that does leak. So `call_reach` is published as a supremum and says so. | Read the mapping on the routes this answer ranks first — they are the ones worth a human — and label the DTO too if it carries the member, which makes the route `signature` instead of `call_reach`. |
+
+And one about who calls a route:
+
+| Not covered | Why | What answers it |
+|---|---|---|
+| **Whether a route is called from outside this repository — another service, a mobile app, a partner, a cron job, or a client whose URL is assembled at run time.** | The join reads the TypeScript/JavaScript checked in beside the server and only the call shapes whose verb and path are written at the call site. That is a floor on who calls a route and can never be a ceiling: the repository cannot observe consumers it does not contain. So a route with no call site here is published as a candidate for deletion, never as dead API. | Access logs or an API gateway answer who really calls a route. The opposite direction is decisive without them: a client call matching no route is a request this repository's own front end makes and its server does not serve. |
+
 **Positioning.** Until an executor ships, this is the **diagnosis layer**: it measures what
 must change, what each change reaches, and what a gate should block — and it removes none of
 it. Field evaluation scored it 7/10 as a report generator and 5.5/10 as a development tool,

{sourcecode-4.2.0 → sourcecode-4.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "4.2.0"
+version = "4.3.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-4.2.0 → sourcecode-4.3.0}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.2.0"
+__version__ = "4.3.0"

{sourcecode-4.2.0 → sourcecode-4.3.0}/src/sourcecode/architectural_baseline.py

@@ -312,6 +312,25 @@ def load_baseline(path: Path) -> dict:
     return data
 
 
+def latest_baseline_path(directory: Path) -> "Path | None":
+    """The most recently captured baseline in `directory`, or None if there is none.
+
+    Ordered exactly as `load_baselines_dir` orders its series (capture time, commit
+    as the tie-break), so "the last point in the trend" and "the base a diff uses by
+    default" can never disagree about which artifact that is.
+    """
+    dated: list[tuple[str, str, Path]] = []
+    for p in sorted(Path(directory).glob("*.json")):
+        try:
+            b = load_baseline(p)
+        except (OSError, ValueError, json.JSONDecodeError):
+            continue
+        dated.append((str(b.get("captured_at", "")), str(b.get("commit", "")), p))
+    if not dated:
+        return None
+    return max(dated, key=lambda t: (t[0], t[1]))[2]
+
+
 def load_baselines_dir(directory: Path) -> list[dict]:
     """Load every architectural baseline in `directory`, sorted by capture time."""
     out: list[dict] = []