sourcecode 4.5.2__py3-none-any.whl → 4.5.3__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.5.2"
+__version__ = "4.5.3"

sourcecode/ast_extractor.py

@@ -1252,7 +1252,7 @@ class AstExtractor:
             stat = path.stat()
             if stat.st_size > self.max_file_size:
                 return FileContract(
-                    path=str(path.relative_to(root)) if root else path.name,
+                    path=rel_path,
                     language=language,
                     extraction_method="heuristic",
                     limitations=[f"file_too_large: {stat.st_size} bytes > {self.max_file_size}"],

sourcecode/cli.py

@@ -2533,9 +2533,17 @@ def main(
                                 [l for l in _uc_r.stdout.splitlines() if l.strip()]
                             )
                             _patched["git_context"]["uncommitted_files"] = _uc_count
-                            _patched["git_context"]["_stale_fields_refreshed"] = [
-                                "uncommitted_files"
-                            ]
+                            # Provenance goes in `_meta`, never inside the payload
+                            # block. Written into `git_context` it changed that
+                            # block's *shape* depending on whether the answer came
+                            # from cache, so one request answered two ways compared
+                            # unequal on a key that describes the run rather than
+                            # the repository (surfaced by C3-40, which made an
+                            # untracked file dirty again and put this path back in
+                            # reach).
+                            _meta_gc = _patched.setdefault("_meta", {})
+                            if isinstance(_meta_gc, dict):
+                                _meta_gc["stale_fields_refreshed"] = ["git_context.uncommitted_files"]
                             _cache_hit_content = _json_gc.dumps(
                                 _patched, indent=2, ensure_ascii=False
                             )

sourcecode/client_calls.py

@@ -185,9 +185,12 @@ def extract_client_calls(
         except OSError:
             continue
         try:
-            relative = str(file_path.relative_to(base))
+            # POSIX like every other published path (C2-24). A client-usage row
+            # exists to be joined against a route's declaring file, and a join
+            # on path fails silently when the two sides spell it differently.
+            relative = file_path.relative_to(base).as_posix()
         except ValueError:
-            relative = str(file_path)
+            relative = Path(file_path).as_posix()
         for match in _VERB_CALL.finditer(text):
             receiver = match.group("receiver") or ""
             if not _HTTP_RECEIVER.search(receiver):

sourcecode/contract_init.py

@@ -125,24 +125,52 @@ def _security_rules(cir: Any) -> tuple[list[dict], list[dict]]:
     return proposed, rejected
 
 
-def _finding_rules(cir: Any) -> tuple[list[dict], list[dict]]:
-    """`forbid_finding` for audit patterns that fire nowhere today."""
-    from sourcecode.spring_security_audit import _DEFAULT_SECURITY_PATTERNS
+def _rule_catalogue() -> "list[tuple[str, str]]":
+    """Every rule this build ships, as `(pattern_id, severity)`.
+
+    Read from `rule_catalog.RULES` — the one authority `--help`, the README and
+    the rule reference already render from, and the one a test binds to the
+    pattern registries so a new rule cannot exist without a row.
+
+    C1-24's second half: this list used to be built from the two *pattern
+    registries* alone, which stop at SEC-004. SEC-005, SEC-006 and SEC-007 are
+    produced by `security_config_scan` and appeared in **neither** the proposed
+    nor the rejected list — a rule could be silently outside contract derivation
+    with nothing saying so, which is the failure mode a "not proposed, and why"
+    list exists to prevent.
+    """
+    from sourcecode.rule_catalog import RULES
+    from sourcecode.spring_security_audit import (
+        _DEFAULT_SECURITY_PATTERNS,
+        SecurityScanner,
+    )
     from sourcecode.spring_tx_analyzer import _DEFAULT_TX_PATTERNS
+
+    severities: "dict[str, str]" = {}
+    for pattern in (*_DEFAULT_TX_PATTERNS, *_DEFAULT_SECURITY_PATTERNS):
+        pattern_id = getattr(pattern, "pattern_id", "")
+        if pattern_id:
+            severities[pattern_id] = getattr(pattern, "severity", "low")
+    # The configuration rules carry their severity on the scanner that emits
+    # them, not on a pattern object; same authority, different shape.
+    severities.update(getattr(SecurityScanner, "_SEVERITY", {}) or {})
+    return sorted(
+        (rule.id, severities.get(rule.id, "low")) for rule in RULES if rule.id
+    )
+
+
+def _finding_rules(cir: Any, root: "Optional[Path]" = None) -> tuple[list[dict], list[dict]]:
+    """`forbid_finding` for audit patterns that fire nowhere today."""
     from sourcecode.verify_rules import _audit_findings
 
-    findings = _audit_findings(cir)
+    # Same `root` the gate evaluates with: without it the configuration rules
+    # cannot fire, and every one of them would be proposed as "fires nowhere".
+    findings = _audit_findings(cir, root)
     firing = Counter(f.pattern_id for f in findings)
 
     proposed: list[dict] = []
     rejected: list[dict] = []
-    catalogue = [
-        (getattr(p, "pattern_id", ""), getattr(p, "severity", "low"))
-        for p in (*_DEFAULT_TX_PATTERNS, *_DEFAULT_SECURITY_PATTERNS)
-    ]
-    for pattern_id, severity in sorted(set(catalogue)):
-        if not pattern_id:
-            continue
+    for pattern_id, severity in _rule_catalogue():
         count = firing.get(pattern_id, 0)
         if count:
             rejected.append({
@@ -283,7 +311,9 @@ def _slug(annotation: str) -> str:
     return annotation.lstrip("@").replace(".", "-").lower()
 
 
-def execute_candidates(candidates: list[dict], cir: Any) -> tuple[list[dict], list[dict]]:
+def execute_candidates(
+    candidates: list[dict], cir: Any, root: "Optional[Path]" = None
+) -> tuple[list[dict], list[dict]]:
     """``(kept, dropped)`` — run every candidate before publishing it.
 
     The check that makes this a baseline rather than a wish list, and the one
@@ -292,6 +322,12 @@ def execute_candidates(candidates: list[dict], cir: Any) -> tuple[list[dict], li
     the engine `verify` runs and drops anything that disagrees, so a derivation
     that grows a blind spot cannot ship a red gate on the commit it was
     generated from.
+
+    C1-24: this net had the hole it was meant to catch. It evaluated without a
+    `root`, so the security *configuration* rules could not fire here either, and
+    `no-sec-004` passed the check that exists to stop exactly that rule from
+    being published. A safety net blind in the same way as the thing it guards
+    is not a second opinion.
     """
     from sourcecode.verify_rules import evaluate_all, parse_rules
 
@@ -300,7 +336,7 @@ def execute_candidates(candidates: list[dict], cir: Any) -> tuple[list[dict], li
     for rule in candidates:
         payload = {k: v for k, v in rule.items() if not k.startswith("_")}
         try:
-            violations = evaluate_all(parse_rules({"contracts": [payload]}), cir)
+            violations = evaluate_all(parse_rules({"contracts": [payload]}), cir, root)
         except Exception as exc:  # a rule this module built must never break the run
             dropped.append({"id": rule.get("id", "?"), "reason": f"did not parse: {exc}"})
             continue
@@ -333,12 +369,17 @@ def derive_contracts(root: Path, cir: Optional[Any] = None) -> dict:
 
     proposed: list[dict] = []
     rejected: list[dict] = []
+    # `_finding_rules` needs the root; the graph-only derivations do not. Passed
+    # by name rather than positionally so adding a third file-reading derivation
+    # is a one-word change instead of a silent blind spot (C1-24).
     for derive in (_security_rules, _finding_rules, _edge_rules):
-        rules, skipped = derive(cir)
+        rules, skipped = (
+            derive(cir, root) if derive is _finding_rules else derive(cir)
+        )
         proposed.extend(rules)
         rejected.extend(skipped)
 
-    kept, dropped = execute_candidates(proposed, cir)
+    kept, dropped = execute_candidates(proposed, cir, root)
 
     return {
         "schema_version": SCHEMA_VERSION,

sourcecode/data_exposure.py

@@ -146,15 +146,44 @@ def build_data_exposure(
     if not decl.labels:
         # No declaration is not "nothing is exposed" — it is a question nobody asked
         # yet, and the counts stay null rather than reading as a clean bill (I-3/R9).
+        #
+        # C4-14: the statement said what to do and the payload gave the reader no
+        # way to do it — "cero valor out-of-the-box, cero guía de onboarding en la
+        # propia salida", on the payload aimed at a regulated buyer. The file name,
+        # the key and the shape are read from `data_labels`, the module that parses
+        # them, so an example that stops being valid fails the build instead of
+        # teaching a buyer the wrong schema.
+        from sourcecode.data_labels import CONFIG_FILENAME, CONFIG_KEY
+        from sourcecode.remedies import remedy as _remedy
+
         payload.update(
             {
                 "answered": False,
                 "statement": (
                     "No data labels are declared, so this run measured nothing. A "
                     "label is a judgement about a domain and is never inferred from a "
-                    "field name: declare one under `dataLabels` in "
-                    "sourcecode.config.json and re-run."
+                    f"field name: declare one under `{CONFIG_KEY}` in "
+                    f"{CONFIG_FILENAME} and re-run."
                 ),
+                "remedy": _remedy("no_data_labels_declared").to_dict(),
+                "declare": {
+                    "file": CONFIG_FILENAME,
+                    "key": CONFIG_KEY,
+                    "example": {
+                        CONFIG_KEY: [
+                            {
+                                "label": "pii",
+                                "types": ["com.example.Person"],
+                                "fields": ["com.example.Account#iban"],
+                            }
+                        ]
+                    },
+                    "note": (
+                        "`types` labels every route whose signature names the type; "
+                        "`fields` labels the declaring type through the member. Both "
+                        "are fully-qualified, and neither is matched by name shape."
+                    ),
+                },
                 "summary": {
                     "labels": 0,
                     "seeds": 0,

sourcecode/remedies.py

@@ -75,6 +75,23 @@ REMEDIES: "dict[str, Remedy]" = {
             ),
             headline="which profile set actually runs",
         ),
+        Remedy(
+            key="no_data_labels_declared",
+            command="data-exposure",
+            # The next move is a declaration, not a flag: nothing this command
+            # could be told on the command line would make it *infer* that a
+            # field is sensitive, because that is a judgement about a domain.
+            # The invocation is the re-run, and `declare` beside it in the
+            # payload carries the file, the key and a copy-pasteable example.
+            option="",
+            answers=(
+                "no data labels are declared, so nothing was measured — declare which "
+                "types and fields are sensitive under `dataLabels` in "
+                "sourcecode.config.json (a label is a judgement about a domain and is "
+                "never inferred from a field name), then re-run"
+            ),
+            headline="declare the labels, then re-run",
+        ),
         Remedy(
             key="no_contracts_declared",
             command="verify",

sourcecode/ris.py

@@ -451,24 +451,34 @@ def _tree_signature(repo_root: Path) -> str:
 
 
 def _has_uncommitted_changes(repo_root: Path) -> bool:
-    """Return True if working tree has staged or unstaged changes to tracked files.
-
-    Uses ``git status --porcelain --untracked-files=no`` so that untracked
-    files (e.g. legacy .sourcecode-cache/ directories) do not produce false
-    positives.  Returns False on any error (non-git dirs, etc.).
+    """True when the working tree differs from HEAD in a way the analysis sees.
+
+    C3-40: this used to pass ``--untracked-files=no``, to keep legacy
+    `.sourcecode-cache/` directories from reading as modifications. That excused
+    far more than the noise it was aimed at — **an untracked `.java` file is in
+    the IR**, so a repository with a new source file reported
+    `has_uncommitted_changes: False` and, through it, `fresh: true` for a snapshot
+    that did not contain that file. A false *fresh* is the confident-falsehood
+    direction. It also contradicted the root scan's own `--changed-only`, whose
+    help promises "staged, unstaged, **untracked**" in the same CLI.
+
+    One authority now answers it: `baseline_autocapture.worktree_dirty`, which
+    already had to get this exactly right for the architectural history. It
+    honours `.gitignore` (so build output and any gitignored cache directory are
+    not modifications — the original concern, handled properly) and excuses only
+    this tool's own footprint under `.ask/`, for the reason recorded there: the
+    first capture leaves an untracked file behind, and counting it would leave
+    every history one entry long.
+
+    Returns False when the state cannot be determined (non-git directories), which
+    is the pre-existing contract of this helper — `worktree_dirty` answers `None`
+    there, and the RIS freshness fields have no way to carry it.
     """
-    try:
-        result = subprocess.run(
-            ["git", "-C", str(repo_root), "status", "--porcelain", "--untracked-files=no"],
-            capture_output=True,
-            text=True,
-            timeout=2,
-        )
-        if result.returncode == 0:
-            return bool(result.stdout.strip())
-    except Exception:
-        pass
-    return False
+    from sourcecode.baseline_autocapture import HISTORY_DIRNAME, worktree_dirty
+
+    root = Path(repo_root)
+    own = (root / HISTORY_DIRNAME, root / HISTORY_DIRNAME.parts[0])
+    return bool(worktree_dirty(root, ignore=own))
 
 
 def get_cold_start_context(repo_root: Path) -> dict:

sourcecode/security_config_scan.py

@@ -338,7 +338,22 @@ def scan_security_configuration(
     java_files: "Optional[list[str]]" = None,
     config_files: "Optional[list[str]]" = None,
 ) -> "list[SecurityConfigObservation]":
-    """Every textbook weakness under ``root``. Best-effort per file, never fatal."""
+    """Every textbook weakness under ``root``. Best-effort per file, never fatal.
+
+    E-2: every rule here matches on raw text, and until 4.5.3 none of them could
+    tell code from a comment — `SEC-004` and `SEC-007` fired identically on a live
+    statement and on a commented-out block, which cost 31 % of the `high` findings
+    in a field evaluation. Comments are blanked **here**, at the three points a
+    file is read, rather than inside each rule: a rule added later is covered by
+    construction instead of by whoever remembers. `source_text` preserves offsets,
+    so the line each observation reports is still the line in the real file.
+    """
+    from sourcecode.source_text import (
+        blank_hash_comments,
+        blank_java_comments,
+        blank_xml_comments,
+    )
+
     root = Path(root)
     if java_files is None:
         try:
@@ -353,7 +368,7 @@ def scan_security_configuration(
             source = (root / rel).read_text(encoding="utf-8", errors="replace")
         except OSError:
             continue
-        out.extend(_scan_java(source, rel))
+        out.extend(_scan_java(blank_java_comments(source), rel))
 
     if config_files is None:
         config_files = []
@@ -367,7 +382,7 @@ def scan_security_configuration(
             text = (root / rel).read_text(encoding="utf-8", errors="replace")
         except OSError:
             continue
-        out.extend(_scan_config(text, rel))
+        out.extend(_scan_config(blank_hash_comments(text), rel))
 
     # CL-10 — the descriptors. Discovered the same way `environment_resolution`
     # classifies them, so the two surfaces cannot disagree about which files are
@@ -386,7 +401,7 @@ def scan_security_configuration(
             text = (root / rel).read_text(encoding="utf-8", errors="replace")
         except OSError:
             continue
-        out.extend(_scan_descriptor(text, rel))
+        out.extend(_scan_descriptor(blank_xml_comments(text), rel))
 
     return sorted(
         _shared_across_environments(out), key=lambda o: (o.rule, o.file, o.line)

sourcecode/servlet_surface.py

@@ -144,9 +144,15 @@ def build_servlet_surface(root: Path, *, limit: Optional[int] = None) -> dict:
         if any(part in _SKIP_DIRS for part in path.parts) or not path.is_file():
             continue
         try:
-            relative = str(path.relative_to(root))
+            # POSIX, like every other path this CLI publishes. C2-18 fixed this
+            # for `spring_profiles.conditional_beans[].source_file`; this module
+            # shipped two releases later without the convention, so one response
+            # could carry `src/main/java/...` beside `src\main\options\...`
+            # and defeat a consumer joining on path — which is what a servlet
+            # population is for (C2-24).
+            relative = path.relative_to(root).as_posix()
         except ValueError:
-            relative = str(path)
+            relative = Path(path).as_posix()
         if path.name == "web.xml":
             mappings.extend(_from_web_xml(path, relative))
         elif path.suffix == ".java":

sourcecode/source_text.py

@@ -0,0 +1,103 @@
+"""source_text.py — the one authority for "this text, with comments neutralised".
+
+A static analyzer that matches raw text cannot tell code from a note about code.
+This project has now paid for that three times:
+
+* **E-1 (3.7.0)** — a comment containing `class` before an annotated declaration
+  swallowed the real declaration, and the file left the graph entirely.
+* **E-2 (4.5.3)** — the security configuration scan reported `SEC-004` and
+  `SEC-007` on commented-out code, which cost **31 % of the `high` findings** in a
+  field evaluation. Worse than the count: the correlation engine wrote a
+  persuasive paragraph about credentials in a block that was switched off.
+  Confident prose about dead code is worse than a terse warning, because it
+  invites trust.
+
+**Offsets are preserved exactly.** Comment bodies are overwritten with spaces and
+every newline is kept, so the result has the same length and the same line
+structure as the input. A match found in the blanked text has the same
+`start()`, and therefore the same reported line, as it would in the original —
+which is what lets a scanner keep quoting the source file it read.
+
+**String literals are deliberately kept.** This is the difference between these
+functions and `hibernate_strat._strip_comments_strings`, which blanks literal
+*content* on purpose so that a pattern cannot match a substring living inside a
+string. The security rules need the opposite: `new MessageDigestPasswordEncoder(
+"SHA-1")` and `<param-value>admin:{SHA-256}…</param-value>` carry their evidence
+*in* the literal. Two different questions, two functions, neither a copy of the
+other.
+"""
+
+from __future__ import annotations
+
+import re
+
+#: Java/C-family lexical tokens, in precedence order. String and character
+#: literals are matched **first** so that a `//` or `/*` living inside one — as in
+#: `String url = "http://example.com";` — is never mistaken for a comment.
+_JAVA_TOKENS = re.compile(
+    r'"""(?:\\.|[^\\])*?"""'      # text block (Java 15+), before the plain string
+    r'|"(?:\\.|[^"\\\n])*"'       # string literal
+    r"|'(?:\\.|[^'\\\n])*'"       # char literal
+    r"|(?P<line>//[^\n]*)"        # line comment
+    r"|(?P<block>/\*.*?\*/)",     # block comment
+    re.DOTALL,
+)
+
+#: XML/HTML comments. Unterminated ones run to end of input on purpose: an
+#: unclosed `<!--` comments out the rest of the document for a parser too.
+_XML_COMMENT = re.compile(r"<!--.*?(?:-->|\Z)", re.DOTALL)
+
+
+def _blank(text: str) -> str:
+    """Same length, same newlines, no content."""
+    return "".join("\n" if ch == "\n" else " " for ch in text)
+
+
+def blank_java_comments(source: str) -> str:
+    """Java source with comment bodies replaced by spaces, offsets preserved.
+
+    String and character literals are left intact — see the module docstring.
+    """
+    def _replace(match: "re.Match[str]") -> str:
+        if match.lastgroup in ("line", "block"):
+            return _blank(match.group(0))
+        return match.group(0)  # a literal: untouched
+
+    return _JAVA_TOKENS.sub(_replace, source)
+
+
+def blank_xml_comments(source: str) -> str:
+    """XML/HTML with comment bodies replaced by spaces, offsets preserved."""
+    return _XML_COMMENT.sub(lambda m: _blank(m.group(0)), source)
+
+
+#: A `#` comment in `.properties`/YAML, but only where it opens the line. A `#`
+#: further along may be a comment in YAML and is part of the value in
+#: `.properties` (`password=abc#123`), and blanking that would corrupt evidence to
+#: avoid a false positive — the wrong trade for a scan that quotes what it found.
+#: The fully-commented-out block E-2 is about is covered by the line-start form.
+_HASH_COMMENT_LINE = re.compile(r"^[ \t]*#[^\n]*", re.MULTILINE)
+
+
+def blank_hash_comments(source: str) -> str:
+    """`.properties`/YAML with whole-line `#` comments blanked, offsets preserved."""
+    return _HASH_COMMENT_LINE.sub(lambda m: _blank(m.group(0)), source)
+
+
+def commented_spans(source: str, *, xml: bool) -> "list[tuple[int, int]]":
+    """`(start, end)` offsets of every comment — what was switched off, not what runs.
+
+    The inverse of the functions above, and the reason they blank rather than
+    delete. A control that is present but commented out is not noise: somebody
+    decided it was needed and then turned it off, which is the most actionable
+    thing a reader can be told about a security surface. E-2's fix removes those
+    matches from the findings; this is what a future rule reports them *as*
+    (DEAD-001, queued as F-A). Nothing consumes it yet — it exists so the two
+    halves cannot drift apart when it does.
+    """
+    pattern = _XML_COMMENT if xml else _JAVA_TOKENS
+    spans: "list[tuple[int, int]]" = []
+    for match in pattern.finditer(source):
+        if xml or match.lastgroup in ("line", "block"):
+            spans.append((match.start(), match.end()))
+    return spans

sourcecode/token_estimate.py

@@ -134,7 +134,7 @@ def collect_anchor_files(root: Path) -> list[str]:
     out: set[str] = set()
     for p in paths:
         try:
-            out.add(str(Path(p).resolve().relative_to(root)))
+            out.add(Path(p).resolve().relative_to(root).as_posix())
         except (OSError, ValueError):
             continue
     return sorted(out)

sourcecode/verify_edit.py

@@ -519,8 +519,8 @@ def _custom_rules_axis(cir_head: Any, cir_working: Any, root: Path) -> AxisResul
         return AxisResult(False, "no custom rules")
 
     try:
-        head_ids = {v.id for v in vr.evaluate_all(rules, cir_head)}
-        work = vr.evaluate_all(rules, cir_working)
+        head_ids = {v.id for v in vr.evaluate_all(rules, cir_head, root)}
+        work = vr.evaluate_all(rules, cir_working, root)
     except Exception as exc:  # evaluator fault → honest degrade, never false-clean
         return AxisResult(None, f"rule evaluation error: {exc}")
 

sourcecode/verify_repo.py

@@ -179,7 +179,8 @@ def evaluate_repo(
             on_cir(cir)
         except Exception:  # noqa: BLE001 — a passenger never crashes the gate
             pass
-    return evaluate_all(rules, cir), path, len(rules)
+    # `root` is what lets the security *configuration* rules fire at all (C1-24).
+    return evaluate_all(rules, cir, root), path, len(rules)
 
 
 def verify_repo(

sourcecode/verify_rules.py

@@ -157,7 +157,7 @@ class ForbiddenEdgeRule:
     from_sel: Selector
     to_sel: Selector
 
-    def evaluate(self, cir: Any) -> list[Violation]:
+    def evaluate(self, cir: Any, root: "Optional[Path]" = None) -> list[Violation]:
         nodes = {n.get("fqn"): n for n in _nodes(cir) if n.get("fqn")}
         owner = _owner_type_map(cir)  # member fqn → declaring type fqn
         out: list[Violation] = []
@@ -201,7 +201,7 @@ class RequireEndpointSecurityRule:
     require_policy: Optional[str]
     require_role: Optional[str]
 
-    def evaluate(self, cir: Any) -> list[Violation]:
+    def evaluate(self, cir: Any, root: "Optional[Path]" = None) -> list[Violation]:
         out: list[Violation] = []
         for ep in cir.endpoints:
             if not self.path_re.search(ep.path or ""):
@@ -224,32 +224,48 @@ class RequireEndpointSecurityRule:
 _SEVERITY_ORDER = ("low", "medium", "high", "critical")
 
 
-def _audit_findings(cir: Any) -> list[Any]:
+def _audit_findings(cir: Any, root: "Optional[Path]" = None) -> list[Any]:
     """Findings of the Spring audit for this CIR, computed once per CIR.
 
     A contract that forbids a finding class does not need a second detector —
     the transaction and security patterns already ship. Memoised on the CIR so
     ten contracts over the same repository run the audit once.
+
+    **`root` is not optional in practice, and C1-24 is why.** Half of the shipped
+    security rules — SEC-004…SEC-007 — are produced by `security_config_scan`,
+    which reads source and descriptor *text*; `SecurityScanner.analyze` returns
+    an empty list when it has no root to read from. This function used to call
+    `run_security_audit(cir, model=model)` with no root, so it saw the CIR
+    pattern rules and none of the configuration rules — and `verify --init`, its
+    only derivation consumer, concluded that SEC-004 "fires nowhere in this
+    repository" on a tree where `spring-audit` reported it `high`. One question
+    ("what does the audit find?") answered by two authorities, which is the C1
+    class; the first time it produced a *fabricable contract*.
+
+    The memo key carries the root for the same reason: a cached answer computed
+    without one must not be served to a caller that supplied one.
     """
-    cached = getattr(cir, "_verify_audit_findings", None)
+    key = f"_verify_audit_findings::{root}"
+    cached = getattr(cir, key, None)
     if cached is not None:
         return cached
     from sourcecode.spring_model import SpringSemanticModel
     from sourcecode.spring_security_audit import run_security_audit
     from sourcecode.spring_tx_analyzer import run_tx_audit
 
-    # Same two audits `spring-audit` runs, over one shared semantic model.
+    # Same two audits `spring-audit` runs, over one shared semantic model, and
+    # with the same `root` — the argument is what makes them the same audit.
     model = SpringSemanticModel.build(cir)
     findings = [
         f
         for result in (
-            run_tx_audit(cir, model=model),
-            run_security_audit(cir, model=model),
+            run_tx_audit(cir, root=root, model=model),
+            run_security_audit(cir, root=root, model=model),
         )
         for f in result.findings
     ]
     try:
-        object.__setattr__(cir, "_verify_audit_findings", findings)
+        object.__setattr__(cir, key, findings)
     except Exception:
         pass  # frozen or slotted CIR — recompute rather than fail
     return findings
@@ -270,10 +286,10 @@ class ForbidFindingRule:
     category: Optional[str]
     min_severity: str
 
-    def evaluate(self, cir: Any) -> list[Violation]:
+    def evaluate(self, cir: Any, root: "Optional[Path]" = None) -> list[Violation]:
         floor = _SEVERITY_ORDER.index(self.min_severity)
         out: list[Violation] = []
-        for f in _audit_findings(cir):
+        for f in _audit_findings(cir, root):
             if self.pattern_id is not None and f.pattern_id != self.pattern_id:
                 continue
             if self.category is not None and f.category != self.category:
@@ -420,8 +436,12 @@ def load_rules(root: Path) -> list[Rule]:
     return parse_rules(raw)
 
 
-def evaluate_all(rules: list[Rule], cir: Any) -> list[Violation]:
+def evaluate_all(
+    rules: list[Rule], cir: Any, root: "Optional[Path]" = None
+) -> list[Violation]:
+    """Evaluate every rule. `root` reaches the rules that read files rather than
+    the graph — without it the security configuration rules cannot fire (C1-24)."""
     out: list[Violation] = []
     for r in rules:
-        out.extend(r.evaluate(cir))
+        out.extend(r.evaluate(cir, root))
     return out

{sourcecode-4.5.2.dist-info → sourcecode-4.5.3.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.5.2
+Version: 4.5.3
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.5.2-blue)
+![Version](https://img.shields.io/badge/version-4.5.3-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -97,7 +97,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.5.2 — and, on a build that has aged,
+ask version                    # ask 4.5.3 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -309,7 +309,7 @@ from it.
 | `risk` | experimental | what each defect actually costs, once reach, access, write effect and the shape of the input path are in it | `defect_severity × reachability × auth_verdict × write_effect × query_construction × input_constraints`; every factor names its authority |
 | `enrich` | experimental | another scanner's SARIF findings, ranked by what this repository does with them | `--sarif <log>`; the same composition as `risk`, with the scanner as the severity authority |
 | `migrate-recipe` | experimental | the migration report as the OpenRewrite recipe that applies it | only recipes a finding named; the manual remainder published beside them; writes nothing without `--write`, and never a runnable command for an empty recipe list |
-| `data-exposure` | experimental | which routes can carry the data you labelled, and who reaches them | labels declared in `sourcecode.config.json` — never inferred from a name; `signature` and `call_reach` evidence published apart, field-level flow out of scope (NC-008) |
+| `data-exposure` | experimental | which routes can carry the data you labelled, and who reaches them | labels declared in `sourcecode.config.json` — never inferred from a name; `signature` and `call_reach` evidence published apart, field-level flow out of scope (NC-008). With nothing declared, `ask data-exposure /path/to/repo` answers `answered: false` and hands back the file, the key and an example to declare — it never reports zero exposed routes |
 | `endpoints` | core | every REST endpoint, effective path, security policy, confidence | Spring MVC + JAX-RS (~65 % recall on JAX-RS sub-resource locators). `--compact` answers the exposure census without the rows; `--servlets` lists the servlet-mounted surface as its own population; `--client-usage` says which routes the TS/JS client in this repository actually calls |
 | `spring-audit` | core | transactional anomalies + security surface + validation gaps | `--ci`, `-f github-comment` |
 | `migrate-check` | core | Boot 2→3 readiness: located blockers, per-dimension score, effort | `--blast-radius` orders the re-test plan |

{sourcecode-4.5.2.dist-info → sourcecode-4.5.3.dist-info}/RECORD

@@ -1,11 +1,11 @@
-sourcecode/__init__.py,sha256=PjbysF4qIQqtt4mDuRtvBeNW9k_9zDCDbXO6ctobaLc,308
+sourcecode/__init__.py,sha256=TB3NC3ZIhSq8CPZFlNi9Y6qRAqfWAwRIj4a5XRpDjx0,308
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/archetype.py,sha256=HBGTTaS-bVHS6pdacPUMKcMxklkDEKnZMgz48Kc3yec,37630
 sourcecode/architectural_baseline.py,sha256=agDSwGEakdkgLLh5xnd3hiD_TC6pRujWt4klnuYF1wo,18689
 sourcecode/architectural_delta.py,sha256=E6MkyjWl-1ZgR4KSKnI785gUAfc8nq-lK-jd_rupQBU,12496
 sourcecode/architecture_analyzer.py,sha256=GFc4ek-s1IHWM7pl-0L32WahZ93AmDgrAMcOuBKA5Dk,61463
 sourcecode/architecture_summary.py,sha256=BVVRHd952cjRhjHnR6CPrvKgaa-tdM16l-pBi1yDCPs,32395
-sourcecode/ast_extractor.py,sha256=ZwHN3Y0iRp2gpv3t5Nm5uvX7Xw1KtULCJPZqKpZQRAE,51255
+sourcecode/ast_extractor.py,sha256=aXJjZ7XjAdxa99hWNm4SyzPqx4gNWiTbUYjNWGNl-Vc,51213
 sourcecode/baseline_autocapture.py,sha256=xxfXT9Nu4uiDbWMZRawcCXsA4fjgEjZW2qI173dq3GE,14962
 sourcecode/cache.py,sha256=Es9ZLqGRoheMv2bOD1azaFKqU2zJKJVudHhjQKcIxy8,40128
 sourcecode/cache_model.py,sha256=hUGWNKBKLV76mGveFffOzr9fqFD1ZydJVakseRsg14s,17401
@@ -17,8 +17,8 @@ sourcecode/chain_rules.py,sha256=Bi6UHfgd-GxWswmnHRcPz5jdbAuqka3Zkz_P-MTvqhw,127
 sourcecode/change_plan.py,sha256=kFjjp16XYbupgkv1CPkfqo39_SiZPMRQ8OOfC-Vy9eg,7929
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=x6JoPbcJy8VYHrYR7X2GVTtr1qn0w1uXmt7ft5rpUdI,491853
-sourcecode/client_calls.py,sha256=fb5fvmryrBQlly2ETyLcjoQcyzQTPxZ38jYx47V_yqs,13293
+sourcecode/cli.py,sha256=J9pEXkcMWFHg0FXW6CxWa69zvP2DHHOXlgliKXNc4Dc,492534
+sourcecode/client_calls.py,sha256=daRTgbXNUOfkzGXJpVb6A737R_Thhka8vw1_YgxCaLg,13548
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=xq3zsqAOAw4AWkoD9khb9xDP_O3KvwqO9k-pf8sbi3g,10951
 sourcecode/confidence_analyzer.py,sha256=5li0NyOdS3Ie-f2ZY1gBmnjtkuRvI50l4OnGaKkXAOU,22358
@@ -28,11 +28,11 @@ sourcecode/context_graph.py,sha256=UBUW97DnJe5hGgCI-JohgKWDfKTszBuL3DIxQylVZQE,4
 sourcecode/context_scorer.py,sha256=QpChSpsmaAYz91rXA4Ue5xzQmNz_ZboZN09YOHScq1U,14679
 sourcecode/context_summarizer.py,sha256=cI2TZMvEhl0BEma12VtPaX6z03ZVBAetVzuK5GaCOvg,6852
 sourcecode/contract_diff.py,sha256=ivgHL1qRKFhriwQ52KWj4oJselqd5icSJW7Z2Ke04po,9429
-sourcecode/contract_init.py,sha256=MBzhrgCVfJRXsMYNe8k5cwxdDGcz4pZpIaJhieQTvmk,17457
+sourcecode/contract_init.py,sha256=bXRCqWM9tvrDLeT8j7ea6IWf87jB4VJxnlSzGBsRRXo,19582
 sourcecode/contract_model.py,sha256=nRxJKPMs1VHwFTa8AVXhGmaLjti3Lr2sjHDpWgv1bfE,3917
 sourcecode/contract_pipeline.py,sha256=4XE-xhab7ysdExXyUOBl2hAH4MABo7moKnT9V4XcEwQ,30243
 sourcecode/coverage_parser.py,sha256=X9scuUWxacahYTrTBGea2Ku-sf-WCVcnc9OEB35_3IU,19340
-sourcecode/data_exposure.py,sha256=NWavzz8tvsI_3QF9IulJdFQYNV_Z07QLWcBJSGduuN4,13768
+sourcecode/data_exposure.py,sha256=pp2WVTjWZGHuXh-1m3mfCEb5awzKQbUjs61t3Sy2En4,15248
 sourcecode/data_labels.py,sha256=IF8xedY0uPFefpDpOSYrb1ita_XoyjPctlXTXAMe4pc,7230
 sourcecode/defect_identity.py,sha256=XS2VFDImg9NLaRImybKTeyk-CoDSsXmchldg0dwvM7c,7028
 sourcecode/degradation.py,sha256=BtuGUKFgkzI3Z6fwmUdxEUEaLFAcPQ_bHhU2w9ItDxw,18376
@@ -88,11 +88,11 @@ sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/reference_facts.py,sha256=Ns495c6eTmq2SrqPkcUrJUJru4_wj_yRWm4YDeJwves,13440
 sourcecode/release_info.py,sha256=yxvjQM2HNzt84tGEOeTwwU8ZBcuupzjGLiwLFziMJL4,5378
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
-sourcecode/remedies.py,sha256=TIYeWD8gFsG_69CF2Qjxgbcx6mivf9TVTm1GqevASWM,5591
+sourcecode/remedies.py,sha256=8lgvKkW1WuBG-QfTnA0uBhEKnwWGSvgSMWCfTjzYhEY,6516
 sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg,12965
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
 sourcecode/repository_ir.py,sha256=uuJsPmtgSEi4MKVKJEiZl8bpvU1QFU2Oslxn96p5xi8,356849
-sourcecode/ris.py,sha256=Xin3d3U43-VthgRA6ttJnyIow8iyUEsQCBENvZc4eEc,23782
+sourcecode/ris.py,sha256=SjjDNMcc9Zr9us9G8ikBVkoPXKK3BpM-dBodSGMh_g4,24783
 sourcecode/risk.py,sha256=cgkHu4fjAyLs9xSytegdv4b8ua8RqRJEQ5rHbQKgzfo,34851
 sourcecode/rule_catalog.py,sha256=buU6qZI1j1EjqAWOIzeDhZ9kO_6Tp_Ma-dmexNWkMe0,4324
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
@@ -100,14 +100,15 @@ sourcecode/sarif.py,sha256=_3ggbtV0O2iK5zeUiJSS36KxpPRVAtGy0hzXAFBmww8,25590
 sourcecode/scanner.py,sha256=z3CV0rcGunu0Y8mpNgp07wI7nxT0pxw1BkXRRtI0Rpo,9609
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
 sourcecode/security_config.py,sha256=KblMEoRiEjrIE68YsPaUAFebxFp8UM7MS7lAk5CGD8U,3531
-sourcecode/security_config_scan.py,sha256=TZj8qkg8XAMPPPDSSrJvWrvJn9hmgR-V-Sl9SRF4G2w,16148
+sourcecode/security_config_scan.py,sha256=9MC3N9G3627jOsP9SI2et_TQEUbdlmxuHq1Ycm-msBg,16920
 sourcecode/security_posture.py,sha256=CjJ2Qm87HhKXepnaWx1ncJLW-SxI18udCmUDIkCyAsY,50270
 sourcecode/semantic_analyzer.py,sha256=bpgdC6m0_ftVtRf3rSdwhbhWjnZnGxRXaZVcfe4BbcQ,95414
 sourcecode/semantic_impact_engine.py,sha256=t09IirGC3JjQDy33JZd1_WKzQVKXkoNl3-XEUr5kjis,20563
 sourcecode/semantic_integration_engine.py,sha256=7a0WqAInOv39f0Yr_94TYo_JP_8QpeI9KGaknpzAyQU,18899
 sourcecode/semantic_services.py,sha256=nbUuPv-F01USTt_9CHT8iy_ucCIw3fz4W3Aquea_pd4,10782
 sourcecode/serializer.py,sha256=T1-Ybi6aPczxiz11N_nfuZ_jUMQVBMExeWuYHCUjKPc,139222
-sourcecode/servlet_surface.py,sha256=XokdtUFeqCpFfD1nZHJSnJsDgrQMuVOYzM72eoaAHpM,7708
+sourcecode/servlet_surface.py,sha256=kwIBS6aT-DJHu8mqzvhlYrhaqAq_005SDAeVZ7yx8Y0,8165
+sourcecode/source_text.py,sha256=Q5v5kAq2QFZ-HcaK5UXp_xZTbiLiFW5p09v7r_hQHnU,4878
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=qgWz4LLL5TFe3eG-mTttlrDTx-6ps3EOuLA-S2HvQCM,16945
 sourcecode/spring_impact.py,sha256=KkThpPmBbBJk_1H8f0cVWOuz6vBN-yX5qcTQ3Sjmjnk,74797
@@ -121,14 +122,14 @@ sourcecode/summarizer.py,sha256=0aD4x3vgPngqBCEBKGuES1J2Vk5f7mqCm_ZWErwm3js,2702
 sourcecode/target_admission.py,sha256=wFZ4pzlxhiF6Q6s2lEAZEzcCfj1Y6xNvujjt8MdO0Qo,7154
 sourcecode/test_gap_ranking.py,sha256=hl-tTyQUXZGJycG1b6npbLeE_DaVHaOsvPwG9qqC5y8,15711
 sourcecode/test_sources.py,sha256=cMGVNLbYZZ2yt2PVcySK4scbjKpCLDAKhIViyWN_pRM,6986
-sourcecode/token_estimate.py,sha256=RBXCGnF20jMzAeU0rUuf22Ol6y2wdf9q6nfs2sXIn4k,9262
+sourcecode/token_estimate.py,sha256=G-ivzIJfVq5TLQN04dC0WK4LZJjWVYL54Ebcxe4fJ7M,9268
 sourcecode/tree_utils.py,sha256=8GAkIfQAsvtEudIeW1l4ooH_oRtrWR8cpJQJsEa_Pfw,2093
 sourcecode/type_usage_surface.py,sha256=51IrKRQoIoRnlsiDjHnqpJBn2rc6E59aRhgS0HTzAF0,4428
 sourcecode/validation_inference.py,sha256=-oWJqE6PqkqcZbCFDJeWCQHgI9Dbuv5ggJWD3LE_2IU,20817
 sourcecode/validation_surface.py,sha256=jYL-hkDjaaRKkAt7ZUcbxm3Dydl8o6KVRhTkuPXKPVc,31460
-sourcecode/verify_edit.py,sha256=FPvHmHQd0cUBAZE9smy9HGpNeH9BwAITPUKBBxyUXdk,35943
-sourcecode/verify_repo.py,sha256=GRdw3vHHcuDD7JTW_dmLRmp93oyv8FH1yNa-ukBRjdc,12070
-sourcecode/verify_rules.py,sha256=vX0YADEI78J8-tjRTtRhe2pZP0x7K_qvS1EypuqD3KQ,18011
+sourcecode/verify_edit.py,sha256=Toqx4z47gLUmcj5F673eTFq1dE_6e4T3mXVesjkPx6g,35955
+sourcecode/verify_repo.py,sha256=ltSP1nFc726k2aTHCu5dfhxQgxQwz3nrUNDMDN-aDa8,12158
+sourcecode/verify_rules.py,sha256=kqo-tuqOfxSti3jIVS-bJtbSV5b1KxdigOR0j5Wr_XM,19388
 sourcecode/version_check.py,sha256=CHp6ZxTIfo8kyHPCBgJA1uFC0xQCoXMuuOfrW8QTL8o,4942
 sourcecode/workspace.py,sha256=X_6NmNnitvT3_38V-JDChydo_sR68s249hLFlrQskU0,8271
 sourcecode/detectors/__init__.py,sha256=A0AACJFF6HWf_RgatNtWu3PUzstcKtIGM9f1PoFcJug,1987
@@ -189,8 +190,8 @@ sourcecode/telemetry/consent.py,sha256=pQdl-QeLl6Gcibn0eWHSKZrm-HYSsjpVqOnjrgFp8
 sourcecode/telemetry/events.py,sha256=4_yeO58U-Cwc1Qb27VB0_EjhmroY0k91n3_VGxeALB8,2776
 sourcecode/telemetry/filters.py,sha256=RzxauTz8HliO4BllQnXEXc7zTeqdCZi5MgqGEDuW7OQ,6570
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-4.5.2.dist-info/METADATA,sha256=GOP9JMY6LBPWhXjHmwsympd1g0jua3RF3hvj6IuzPtI,33977
-sourcecode-4.5.2.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-4.5.2.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-4.5.2.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-4.5.2.dist-info/RECORD,,
+sourcecode-4.5.3.dist-info/METADATA,sha256=md2ShdxOBK6RppqSdpqL8YjqIDoo3PRAHMZxb96YT64,34161
+sourcecode-4.5.3.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-4.5.3.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-4.5.3.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-4.5.3.dist-info/RECORD,,