sourcecode 4.5.2__tar.gz → 4.6.0__tar.gz

{sourcecode-4.5.2 → sourcecode-4.6.0}/CHANGELOG.md

@@ -2,6 +2,220 @@
 
 ## [Unreleased]
 
+## [4.6.0] — 2026-08-04
+
+Field evaluation #11 (7,5/10), by the evaluator who measured 4.5.2 twelve hours
+earlier, on the build that closed their previous list. **Eight complaints, eight
+reproductions, eight fixes** — the first evaluation where every complaint
+survives verification and none re-derives a closed row.
+
+The headline is not in the list below and is worth stating: the four false
+positives measured on 4.5.2 are **gone**, verified line by line in the field, and
+the run reports **0 false positives across 19 findings** — precision 9/10,
+epistemic honesty 10/10 (*"no he visto nada mejor en ninguna herramienta de
+análisis, comercial o no"*). E-2 is closed in the field, not only in the battery.
+
+Minor, not patch: `risk` publishes a sixth reachability value and three new
+fields, `posture` publishes two, `impact-chain` publishes two, and the test/
+production split moves published populations. **No field was removed and no exit
+code moved.**
+
+### Fixed
+
+- **`impact-chain` spent 2 300× longer answering than building the model it
+  answers from** (C3-42, **high**). The field published `query_time_ms: 1 187 063`
+  beside `model_build_time_ms: 516` and abandoned two more invocations past 25
+  minutes — the axis this evaluation scored **3/10**, with the verdict that
+  decides it: *"un gate de CI que tarda 45 min no es un gate"*. The seed
+  expansions (CH-001a/b) answered *"every symbol of this class"* by scanning the
+  whole symbol table once per subtype, with the seed set rebuilt for every symbol
+  tested. Both now read one class→symbols index memoized on the CIR, which
+  matters twice: `RiskComposer.reach` calls that path **once per defect**, and
+  that is where the field's ~45-minute `risk` comes from. Measured A/B on
+  keycloak (5 525 files, 59 410 symbols), identical results in all four queries:
+  `Provider` **8.15 s → 2.60 s**. Second half, and the reason the rest is flat:
+  `query_time_ms` was never the walk — it includes a repository-wide TX +
+  security audit, now published as `audit_time_ms` with a `query_time_basis`
+  stating that the walk is the difference between the two and that
+  `model_build_time_ms` is not comparable with either.
+- **`risk` did not read the other authority that answered its own access axis**
+  (C1-26, **high**). It asked `posture` only when `--profile` was given, so the
+  default invocation weighed an endpoint at `unknown` (×1.4) that `posture`, in
+  the same process and over the same CIR, decided was reachable without
+  authentication (×2.0). The resolution is now read always; with no set named it
+  is the one Spring performs with none given — `default` alone, which CL-8
+  records as the permissive case, not a neutral one — and every row publishes
+  `profile_set`, `profile_set_basis` (*"a default, never a guarantee: the process
+  environment outranks every file"*) and `profile_decisions`. It cannot
+  manufacture a verdict: `no_rule_matched` stays unknown coverage, the
+  combination is per endpoint, and on a fixture where both chains are
+  profile-gated the answer stays `unknown`. Measured on the field's shape: **8.06
+  → 11.52**, exactly the ratio of the two access weights, every other factor
+  unmoved.
+- **`risk` degraded a repository-wide control defect with a sentence that is
+  false in effect** (C1-25, configuration half; second field witness). *"No HTTP
+  endpoint in this repository reaches it"* — about the file that decides whether
+  any endpoint is reachable at all. Reach for such a defect is **declared, not
+  walked**: `posture` already knew which configuration file decided which
+  request and now publishes it as `chains.decides_endpoints`, `risk` reads it as
+  the reachability value `request_chain`, and the two units stay apart —
+  `endpoints_reached` remains the walk, `decides_requests` is the scope.
+  Evidence-bound both ways: only a file declaring readable chain rules qualifies,
+  and an unresolved servlet path clears the attribution entirely. Fixture: **low
+  2.8 → medium 4.48**.
+- **`posture --resolve-environments` truncated the open-endpoint list without
+  declaring the cap** (C2-25). 50 entries under a count of 2 635, with no
+  `total`, no `omitted`, no `direction: under_reports` — in the module that
+  defines the cap helper and applies it to four other lists. *"Rompe la garantía
+  que el resto del tool cumple escrupulosamente, y es precisamente en la lista
+  que un auditor necesita completa."* The helper grew the one parameter it was
+  missing (the limit that actually bit) and every other slice in the module was
+  checked.
+- **`explain` answered a configuration class with every section empty**,
+  `found: true` and no warning (C3-41, **high**) — on the command the same
+  evaluation calls the product's best asset, for the class an auditor opens
+  first. One model error with three faces: a factory member is a method
+  (`symbol_kind: "bean"` was excluded by kind, so **every** `@Configuration` in
+  every repository published no methods); a configuration class wires through its
+  members' signatures and bodies, not through an injection graph (both are atoms
+  already published, read only when the class really declares factory members);
+  and its constraints are in a DSL, so the section now reads `chain_rules` — the
+  authority `posture` uses on that same file — with `file:line` per rule. Fourth,
+  and the reason the report was silent: every section was wrapped in a bare
+  `except: []`, so a crash and a measured emptiness were one output. A failed
+  section now says which one failed.
+- **`cache freshness` called a snapshot STALE over a file no analyser reads**
+  (C1-27) — with `RIS HEAD == current HEAD` and `Delta: 0` beside it. C3-40
+  (4.5.3) replaced a false *fresh* with a false *stale* by counting any porcelain
+  line. One authority now decides which paths qualify
+  (`path_filters.analysis_reads`) and both consumers ask it: the freshness
+  boolean and the **tree signature**, which is what actually decides the verdict
+  and is also the cache key — so an agent writing its own settings file was
+  discarding every warm answer. The excused set is state nothing opens and is
+  **not** every dot directory: `.github` is read as tooling evidence and stays a
+  change. The default is inclusive, because a missed change is a false *fresh*.
+- **The test/production split still had two authorities** (C1-28).
+  `path_filters.is_test_path` was never retired after C1-2 made `test_sources`
+  the authority in 3.2.1, and the two disagreed on five path shapes in both
+  directions. Field symptom: *"`--compact` counts 1 test file that is actually in
+  `src/main`"* — verdict right, numerator wrong. The second module is now a
+  passthrough, after absorbing everything it knew that the authority did not; and
+  a declared **main** source root now outranks a naming convention, the same rule
+  the directory half always applied, in the other direction. Fleet effect,
+  measured cold: keycloak 5 525 → 5 486 Java files with endpoints **676 → 678**,
+  openmrs-core 866 → 861, Broadleaf / alfresco / petclinic unchanged.
+- **`archetype` never read the endpoint surface for the dimension the endpoint
+  surface decides** (C3-43). A 3 574-endpoint CRUD REST monolith was labelled
+  `engine` at medium confidence on a fan-in Gini, while the legacy classifier it
+  supersedes answered `api` and was right. The density `_primary_interface`
+  already reads is now positive evidence for `application` and **named negative
+  evidence** against `engine` — the shape the library de-bias uses — scaled by
+  the measured density, and emitted only when the surface was measured.
+  Measured: Broadleaf and keycloak `engine/high → application/low`, petclinic
+  `engine/low → application/medium`, jobrunr `engine/high → engine/low`,
+  openmrs-core unchanged (1 endpoint, no density, no discount — the negative
+  control).
+
+### Notes
+
+Two rows from this evaluation are **not** fixed here, on purpose: **P-9** is a
+pricing decision (a fifth pass, and the fourth to argue itself off the seat axis
+— the ceiling is conditioned on this battery's performance work and on a tier
+promotion, not on any missing capability), and **CL-13** is the narrow rule
+catalogue (7 SEC + 6 TX), queued as **F-F** with the *test surface in
+production* rule first, because C1-28 just gave it its admission surface for
+free. Full record in `.planning/FIELD-EVAL-11-2026-08-04.md`; every row is in
+`docs/DEFECT-LEDGER.md`.
+
+Suite: 6 468 passed, 6 skipped.
+
+## [4.5.3] — 2026-08-04
+
+Patch: the fixable half of field evaluation #10 (7,5/10, CI reliability **4/10**), in one
+battery. Five defects, one commit each, every one reproduced on a fixture before it was
+touched. No new capability, no published field removed, no exit code moved.
+
+Three of the evaluation's thirteen complaints are **not** fixed here because they did not
+survive verification against HEAD — `spring-audit --compact` has shipped since 3.7.0 (the
+second time that closed row has been re-derived as missing), the mojibake diagnosis is
+wrong (`_force_utf8_streams` already reconfigures both streams; this is the **fourth**
+field report of console mojibake and none has reproduced under measurement — the one
+variable they share is the platform with no runner, C3-39), and the "dead surface"
+capability ships as `endpoints --client-usage`. Full record and the F-A…F-E capability
+queue in `.planning/FIELD-EVAL-10-2026-08-04.md`.
+
+### Fixed
+
+- **`verify --init` derived a contract asserting an invariant the same build reported as
+  violated** (C1-24, **critical**). It proposed `no-sec-004` — *"SEC-004 fires nowhere in
+  this repository"* — on a tree where `spring-audit` reported SEC-004 `high`. Committed
+  without `--dry-run`, that gate is red on the commit it was derived from, on the
+  `core`-tier command whose promise is *"safe to gate CI on"*. Cause: the derivation
+  computed "fires nowhere" from the CIR pattern audit alone, and SEC-004…SEC-007 are
+  produced by `security_config_scan`, the second authority `spring-audit` also runs, which
+  returns nothing without a `root`. The root is now threaded through, so the derivation,
+  `verify`, `verify-edit` and the self-check all evaluate the same audit. **The safety net
+  had the same hole** — `execute_candidates` runs every candidate through the real engine
+  before publishing it, and it too evaluated without a root, so it approved the rule it
+  exists to stop. Same row, second half: SEC-005/006/007 appeared in **neither** the
+  proposed nor the rejected list, because the catalogue was built from the pattern
+  registries, which stop at SEC-004; it now comes from `rule_catalog.RULES`, the authority
+  `--help` and the README already render from.
+- **The security configuration scan could not tell code from a comment** (E-2). `SEC-004`
+  and `SEC-007` fired identically on a live statement and on a commented-out block —
+  **31 % of the `high` findings** in the field, and the count understates it, because the
+  correlation engine wrote a persuasive paragraph about shared credentials over a block
+  that was switched off. Confident prose about dead code is worse than a terse warning: it
+  invites trust. This is E-1's class in a module written after E-1 closed, so the stripper
+  is now one authority (`source_text`) wired at the **three points a file is read** rather
+  than inside each rule — a rule added later is covered by construction. Comments are
+  **blanked, not deleted**, so offsets survive and every observation still points at the
+  line a reader can open. String literals are deliberately kept: these rules carry their
+  evidence *inside* the literal. A/B with the cache cold over BroadleafCommerce,
+  openmrs-core, keycloak and spring-petclinic: **byte-identical security findings** — the
+  fix removes false positives and loses no true one.
+- **Two path conventions inside one document** (C2-24). `servlet_surface.mappings[].source_file`
+  emitted the platform separator while every other payload emits POSIX. The reported
+  emitter was one of **four**: checking for the recurrence found `client_calls` (the
+  `--client-usage` join, whose entire product is a join on path) and the file-too-large
+  branch of `ast_extractor`, which spelled the path differently from the two lines directly
+  above it; a static guard over every module then found a fourth in `token_estimate`. All
+  four fixed, and the guard now fails any `str(x.relative_to(y))` without normalisation.
+- **An untracked source file was not counted as a change** (C3-40). `cache freshness`
+  reported `has_uncommitted_changes: False` with untracked files present, contradicting the
+  root scan's `--changed-only` help in the same CLI. The measurement underneath was worse
+  than the contradiction: an untracked `.java` file **is** in the IR, so the tree reported
+  `fresh: true` for a snapshot that never contained that file — a false *fresh*. Bound to
+  `baseline_autocapture.worktree_dirty`, which already had to answer this exactly right for
+  the architectural history; gitignored build output and cache directories are still not
+  modifications.
+- **`data-exposure` measured nothing and offered no way to measure** (C4-14). It answered
+  `answered: false` and stopped, on the payload aimed at a regulated buyer — ninth
+  appearance of the C4 class. It now carries the registry remedy plus a `declare` block
+  (file, key, copy-pasteable example), all read from the module that parses them. The
+  example is **executed** in the battery — written to disk, parsed by the real loader, and
+  re-run to confirm the answer changes — because an example that has drifted from the schema
+  teaches a buyer the wrong shape.
+
+### Changed
+
+- Cache-hit provenance moved from inside the `git_context` payload block to `_meta`
+  (`stale_fields_refreshed`). Surfaced by C3-40: written into the payload it changed that
+  block's *shape* depending on whether the answer came from cache, so one request answered
+  two ways compared unequal on a key describing the run rather than the repository. The
+  previous key was undocumented, unschema'd, underscore-prefixed and reachable only on one
+  cache path — treated as internal provenance rather than a published field, which is why
+  this is a patch and not a major.
+
+### Still open from this evaluation, on purpose
+
+- **C1-25** — reachability is measured at type scope and attributed at member scope
+  (~1 700× over-attribution measured in one direction; global `@Configuration` defects
+  degraded to `internal` in the other). Feature-sized, and it **gates** the `exposure` join
+  (F-C): that table built on this model would put the over-attribution behind a
+  CISO-facing headline.
+- **P-8** — a pricing decision, and the third independent arrival at the per-repository band.
+
 ## [4.5.2] — 2026-08-04
 
 Patch: two affordances that shipped command by command, and therefore drifted, become

{sourcecode-4.5.2 → sourcecode-4.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.5.2
+Version: 4.6.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.5.2-blue)
+![Version](https://img.shields.io/badge/version-4.6.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -97,7 +97,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.5.2 — and, on a build that has aged,
+ask version                    # ask 4.6.0 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -309,7 +309,7 @@ from it.
 | `risk` | experimental | what each defect actually costs, once reach, access, write effect and the shape of the input path are in it | `defect_severity × reachability × auth_verdict × write_effect × query_construction × input_constraints`; every factor names its authority |
 | `enrich` | experimental | another scanner's SARIF findings, ranked by what this repository does with them | `--sarif <log>`; the same composition as `risk`, with the scanner as the severity authority |
 | `migrate-recipe` | experimental | the migration report as the OpenRewrite recipe that applies it | only recipes a finding named; the manual remainder published beside them; writes nothing without `--write`, and never a runnable command for an empty recipe list |
-| `data-exposure` | experimental | which routes can carry the data you labelled, and who reaches them | labels declared in `sourcecode.config.json` — never inferred from a name; `signature` and `call_reach` evidence published apart, field-level flow out of scope (NC-008) |
+| `data-exposure` | experimental | which routes can carry the data you labelled, and who reaches them | labels declared in `sourcecode.config.json` — never inferred from a name; `signature` and `call_reach` evidence published apart, field-level flow out of scope (NC-008). With nothing declared, `ask data-exposure /path/to/repo` answers `answered: false` and hands back the file, the key and an example to declare — it never reports zero exposed routes |
 | `endpoints` | core | every REST endpoint, effective path, security policy, confidence | Spring MVC + JAX-RS (~65 % recall on JAX-RS sub-resource locators). `--compact` answers the exposure census without the rows; `--servlets` lists the servlet-mounted surface as its own population; `--client-usage` says which routes the TS/JS client in this repository actually calls |
 | `spring-audit` | core | transactional anomalies + security surface + validation gaps | `--ci`, `-f github-comment` |
 | `migrate-check` | core | Boot 2→3 readiness: located blockers, per-dimension score, effort | `--blast-radius` orders the re-test plan |

{sourcecode-4.5.2 → sourcecode-4.6.0}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.5.2-blue)
+![Version](https://img.shields.io/badge/version-4.6.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -59,7 +59,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.5.2 — and, on a build that has aged,
+ask version                    # ask 4.6.0 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -271,7 +271,7 @@ from it.
 | `risk` | experimental | what each defect actually costs, once reach, access, write effect and the shape of the input path are in it | `defect_severity × reachability × auth_verdict × write_effect × query_construction × input_constraints`; every factor names its authority |
 | `enrich` | experimental | another scanner's SARIF findings, ranked by what this repository does with them | `--sarif <log>`; the same composition as `risk`, with the scanner as the severity authority |
 | `migrate-recipe` | experimental | the migration report as the OpenRewrite recipe that applies it | only recipes a finding named; the manual remainder published beside them; writes nothing without `--write`, and never a runnable command for an empty recipe list |
-| `data-exposure` | experimental | which routes can carry the data you labelled, and who reaches them | labels declared in `sourcecode.config.json` — never inferred from a name; `signature` and `call_reach` evidence published apart, field-level flow out of scope (NC-008) |
+| `data-exposure` | experimental | which routes can carry the data you labelled, and who reaches them | labels declared in `sourcecode.config.json` — never inferred from a name; `signature` and `call_reach` evidence published apart, field-level flow out of scope (NC-008). With nothing declared, `ask data-exposure /path/to/repo` answers `answered: false` and hands back the file, the key and an example to declare — it never reports zero exposed routes |
 | `endpoints` | core | every REST endpoint, effective path, security policy, confidence | Spring MVC + JAX-RS (~65 % recall on JAX-RS sub-resource locators). `--compact` answers the exposure census without the rows; `--servlets` lists the servlet-mounted surface as its own population; `--client-usage` says which routes the TS/JS client in this repository actually calls |
 | `spring-audit` | core | transactional anomalies + security surface + validation gaps | `--ci`, `-f github-comment` |
 | `migrate-check` | core | Boot 2→3 readiness: located blockers, per-dimension score, effort | `--blast-radius` orders the re-test plan |

{sourcecode-4.5.2 → sourcecode-4.6.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "4.5.2"
+version = "4.6.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-4.5.2 → sourcecode-4.6.0}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.5.2"
+__version__ = "4.6.0"

{sourcecode-4.5.2 → sourcecode-4.6.0}/src/sourcecode/archetype.py

@@ -86,6 +86,14 @@ _MIN_CONFIDENT_SCORE = 0.5
 # discriminating. Tuned so a clear library (no app/server/servlet entry) is not confidently
 # labeled an engine, while runnable systems (which never trigger the gate) are untouched.
 _LIBRARY_ENGINE_DISCOUNT = 0.55
+# The same shape for the opposite mistake (C3-43): a repository whose primary
+# surface is HTTP owns storage/kernel packages and hub topology *because* it
+# serves requests with them, so that evidence is not discriminating for "engine"
+# either. Scaled by the measured density, so a repository with a marginal surface
+# is barely discounted and one that is nothing but endpoints is discounted fully.
+# Below the library figure on purpose: an application CAN be built around an
+# engine, whereas a non-runnable artifact cannot be an engine product at all.
+_HTTP_ENGINE_DISCOUNT = 0.45
 # Entry kinds that make a repo a runnable system (an app/server/servlet/daemon) rather
 # than a consumable library. Used to gate the library de-bias (P0).
 _RUNNABLE_ENTRY_KINDS = frozenset({
@@ -409,6 +417,42 @@ class ArchetypeClassifier:
             add("application", "runtime_entry_plus_services",
                 f"bootstrap/server entry + service mass ≈ {cm['service']:.0%}",
                 2.0, 1.0, max(cm["service"], 0.2))
+        # C3-43. The strongest MEASURED discriminator this build has for what a
+        # repository is — its HTTP surface — was read by `_primary_interface` and
+        # ignored here, so a 3 574-endpoint CRUD REST monolith was labelled
+        # `engine` on package-name masses and a fan-in Gini, while the legacy
+        # classifier it supersedes answered `api` and was right. Same ramp as the
+        # interface dimension, from the same features: one authority for the
+        # figure, two dimensions reading it.
+        if f.endpoint_share is None:
+            # Unmeasured is not zero: contribute nothing, and say so.
+            add("application", "http_surface_density",
+                "endpoint surface not measured — this dimension is scored without it",
+                2.5, 0.0, 0.0)
+        else:
+            density = f.endpoint_share * 100
+            http_strength = (
+                max(0.0, min(1.0, (density - 0.5) / 1.5)) if f.endpoint_total else 0.0
+            )
+            add("application", "http_surface_density",
+                f"{f.endpoint_total} endpoints over {f.total_files} files "
+                f"({density:.2f}/100 files) — the repository's primary surface is HTTP",
+                2.5, http_strength, 1.0)
+            # And the same fact as NAMED negative evidence for `engine`, the way
+            # the library de-bias below does it: a codebase whose product is a
+            # request surface owns storage and kernel packages *because* it is an
+            # application, so that mass is not, alone, evidence of an engine.
+            engine_positive_http = sum(max(0.0, e.contribution) for e in cands["engine"])
+            if http_strength > 0 and engine_positive_http > 0:
+                cands["engine"].append(Evidence(
+                    "http_surface_discount",
+                    f"{f.endpoint_total} endpoints over {f.total_files} files: the "
+                    "primary surface of this repository is HTTP, and the storage/"
+                    "kernel mass and hub topology an application needs to serve it "
+                    "are not, alone, evidence of an engine product",
+                    1.0, 1.0, 1.0,
+                    -engine_positive_http * _HTTP_ENGINE_DISCOUNT * http_strength,
+                ))
         # platform: many modules + multiple concept clusters + distribution
         multi = 1.0 if f.module_count >= 8 else f.module_count / 8
         add("platform", "many_modules_multi_concern",

{sourcecode-4.5.2 → sourcecode-4.6.0}/src/sourcecode/ast_extractor.py

@@ -1252,7 +1252,7 @@ class AstExtractor:
             stat = path.stat()
             if stat.st_size > self.max_file_size:
                 return FileContract(
-                    path=str(path.relative_to(root)) if root else path.name,
+                    path=rel_path,
                     language=language,
                     extraction_method="heuristic",
                     limitations=[f"file_too_large: {stat.st_size} bytes > {self.max_file_size}"],

{sourcecode-4.5.2 → sourcecode-4.6.0}/src/sourcecode/baseline_autocapture.py

@@ -210,7 +210,19 @@ def worktree_dirty(
         return None
     if out.returncode != 0:
         return None
-    lines = [ln for ln in out.stdout.splitlines() if ln.strip()]
+    # C1-27. "Dirty" means the tree *the analysis reads* differs from HEAD. A
+    # change under an editor or agent state directory is not one — no analyser
+    # opens those files — and counting it reported STALE on a snapshot that
+    # described the tree exactly, with `Delta: 0` beside it. One authority answers
+    # which paths qualify (`path_filters.analysis_reads`) and its default is
+    # inclusive: anything not named there still counts, because a missed change
+    # is a false *fresh* and a spurious one only costs a rebuild.
+    from sourcecode.path_filters import analysis_reads
+
+    lines = [
+        ln for ln in out.stdout.splitlines()
+        if ln.strip() and analysis_reads(_porcelain_path(ln))
+    ]
     if ignore is None:
         return bool(lines)
     candidates = [ignore] if isinstance(ignore, (str, Path)) else list(ignore)

{sourcecode-4.5.2 → sourcecode-4.6.0}/src/sourcecode/cache.py

@@ -213,6 +213,14 @@ def _untracked_tree_fingerprint(target: Path) -> str:
     return f"ff{h.hexdigest()[:14]}"
 
 
+def _porcelain_status_path(line: str) -> str:
+    """The path a `git status --porcelain` line refers to (destination on renames)."""
+    body = line[3:] if len(line) > 3 else ""
+    if " -> " in body:
+        body = body.split(" -> ", 1)[1]
+    return body.strip().strip('"')
+
+
 def worktree_signature(repo_root: Path, scope: Optional[Path] = None) -> str:
     """Hex fingerprint of the **exact tree state an analysis would read**.
 
@@ -252,12 +260,30 @@ def worktree_signature(repo_root: Path, scope: Optional[Path] = None) -> str:
         porcelain = st.stdout if st.returncode == 0 else ""
     except Exception:
         porcelain = ""
+    # C1-27. The signature describes *the tree an analysis would read*, so a line
+    # about a file no analyser opens does not belong in it — an editor settings
+    # file was invalidating every cached answer and publishing STALE beside
+    # `Delta: 0`. One authority decides which paths qualify, and its default is
+    # inclusive: anything not named there still invalidates.
+    from sourcecode.path_filters import analysis_reads
+
+    porcelain = "\n".join(
+        ln for ln in porcelain.splitlines()
+        if ln.strip() and analysis_reads(_porcelain_status_path(ln))
+    )
     if not porcelain.strip():
         return head  # clean — HEAD fully describes the tree
 
     try:
+        from sourcecode.path_filters import _TOOL_STATE_DIRS
+
+        # The same exclusion, expressed to git for the half that is not a list of
+        # paths. A tracked editor-state file must not enter the signature through
+        # the diff after being kept out of the status.
+        _diff_spec = list(pathspec) or ["--", "."]
+        _diff_spec += [f":(exclude,glob)**/{d}/**" for d in sorted(_TOOL_STATE_DIRS)]
         df = subprocess.run(
-            ["git", "-C", str(root), "diff", "HEAD", *pathspec],
+            ["git", "-C", str(root), "diff", "HEAD", *_diff_spec],
             capture_output=True, text=True, timeout=20,
         )
         diff_txt = df.stdout if df.returncode == 0 else ""

{sourcecode-4.5.2 → sourcecode-4.6.0}/src/sourcecode/cli.py

@@ -2533,9 +2533,17 @@ def main(
                                 [l for l in _uc_r.stdout.splitlines() if l.strip()]
                             )
                             _patched["git_context"]["uncommitted_files"] = _uc_count
-                            _patched["git_context"]["_stale_fields_refreshed"] = [
-                                "uncommitted_files"
-                            ]
+                            # Provenance goes in `_meta`, never inside the payload
+                            # block. Written into `git_context` it changed that
+                            # block's *shape* depending on whether the answer came
+                            # from cache, so one request answered two ways compared
+                            # unequal on a key that describes the run rather than
+                            # the repository (surfaced by C3-40, which made an
+                            # untracked file dirty again and put this path back in
+                            # reach).
+                            _meta_gc = _patched.setdefault("_meta", {})
+                            if isinstance(_meta_gc, dict):
+                                _meta_gc["stale_fields_refreshed"] = ["git_context.uncommitted_files"]
                             _cache_hit_content = _json_gc.dumps(
                                 _patched, indent=2, ensure_ascii=False
                             )
@@ -8845,7 +8853,9 @@ def explain_cmd(
         except Exception:
             cir = ContextGraph.build(file_list, target).cir  # fallback: never break explain
         model = SpringSemanticModel.build(cir)
-        explanation = explain_class(class_name, cir, model).capped(limit)
+        # `root` is what lets the security section read the request-chain rules a
+        # configuration class declares in a DSL rather than in annotations (C3-41).
+        explanation = explain_class(class_name, cir, model, root=target).capped(limit)
     finally:
         _prog.finish()
     if _cc_look is not None:

{sourcecode-4.5.2 → sourcecode-4.6.0}/src/sourcecode/client_calls.py

@@ -185,9 +185,12 @@ def extract_client_calls(
         except OSError:
             continue
         try:
-            relative = str(file_path.relative_to(base))
+            # POSIX like every other published path (C2-24). A client-usage row
+            # exists to be joined against a route's declaring file, and a join
+            # on path fails silently when the two sides spell it differently.
+            relative = file_path.relative_to(base).as_posix()
         except ValueError:
-            relative = str(file_path)
+            relative = Path(file_path).as_posix()
         for match in _VERB_CALL.finditer(text):
             receiver = match.group("receiver") or ""
             if not _HTTP_RECEIVER.search(receiver):

{sourcecode-4.5.2 → sourcecode-4.6.0}/src/sourcecode/contract_init.py

@@ -125,24 +125,52 @@ def _security_rules(cir: Any) -> tuple[list[dict], list[dict]]:
     return proposed, rejected
 
 
-def _finding_rules(cir: Any) -> tuple[list[dict], list[dict]]:
-    """`forbid_finding` for audit patterns that fire nowhere today."""
-    from sourcecode.spring_security_audit import _DEFAULT_SECURITY_PATTERNS
+def _rule_catalogue() -> "list[tuple[str, str]]":
+    """Every rule this build ships, as `(pattern_id, severity)`.
+
+    Read from `rule_catalog.RULES` — the one authority `--help`, the README and
+    the rule reference already render from, and the one a test binds to the
+    pattern registries so a new rule cannot exist without a row.
+
+    C1-24's second half: this list used to be built from the two *pattern
+    registries* alone, which stop at SEC-004. SEC-005, SEC-006 and SEC-007 are
+    produced by `security_config_scan` and appeared in **neither** the proposed
+    nor the rejected list — a rule could be silently outside contract derivation
+    with nothing saying so, which is the failure mode a "not proposed, and why"
+    list exists to prevent.
+    """
+    from sourcecode.rule_catalog import RULES
+    from sourcecode.spring_security_audit import (
+        _DEFAULT_SECURITY_PATTERNS,
+        SecurityScanner,
+    )
     from sourcecode.spring_tx_analyzer import _DEFAULT_TX_PATTERNS
+
+    severities: "dict[str, str]" = {}
+    for pattern in (*_DEFAULT_TX_PATTERNS, *_DEFAULT_SECURITY_PATTERNS):
+        pattern_id = getattr(pattern, "pattern_id", "")
+        if pattern_id:
+            severities[pattern_id] = getattr(pattern, "severity", "low")
+    # The configuration rules carry their severity on the scanner that emits
+    # them, not on a pattern object; same authority, different shape.
+    severities.update(getattr(SecurityScanner, "_SEVERITY", {}) or {})
+    return sorted(
+        (rule.id, severities.get(rule.id, "low")) for rule in RULES if rule.id
+    )
+
+
+def _finding_rules(cir: Any, root: "Optional[Path]" = None) -> tuple[list[dict], list[dict]]:
+    """`forbid_finding` for audit patterns that fire nowhere today."""
     from sourcecode.verify_rules import _audit_findings
 
-    findings = _audit_findings(cir)
+    # Same `root` the gate evaluates with: without it the configuration rules
+    # cannot fire, and every one of them would be proposed as "fires nowhere".
+    findings = _audit_findings(cir, root)
     firing = Counter(f.pattern_id for f in findings)
 
     proposed: list[dict] = []
     rejected: list[dict] = []
-    catalogue = [
-        (getattr(p, "pattern_id", ""), getattr(p, "severity", "low"))
-        for p in (*_DEFAULT_TX_PATTERNS, *_DEFAULT_SECURITY_PATTERNS)
-    ]
-    for pattern_id, severity in sorted(set(catalogue)):
-        if not pattern_id:
-            continue
+    for pattern_id, severity in _rule_catalogue():
         count = firing.get(pattern_id, 0)
         if count:
             rejected.append({
@@ -283,7 +311,9 @@ def _slug(annotation: str) -> str:
     return annotation.lstrip("@").replace(".", "-").lower()
 
 
-def execute_candidates(candidates: list[dict], cir: Any) -> tuple[list[dict], list[dict]]:
+def execute_candidates(
+    candidates: list[dict], cir: Any, root: "Optional[Path]" = None
+) -> tuple[list[dict], list[dict]]:
     """``(kept, dropped)`` — run every candidate before publishing it.
 
     The check that makes this a baseline rather than a wish list, and the one
@@ -292,6 +322,12 @@ def execute_candidates(candidates: list[dict], cir: Any) -> tuple[list[dict], li
     the engine `verify` runs and drops anything that disagrees, so a derivation
     that grows a blind spot cannot ship a red gate on the commit it was
     generated from.
+
+    C1-24: this net had the hole it was meant to catch. It evaluated without a
+    `root`, so the security *configuration* rules could not fire here either, and
+    `no-sec-004` passed the check that exists to stop exactly that rule from
+    being published. A safety net blind in the same way as the thing it guards
+    is not a second opinion.
     """
     from sourcecode.verify_rules import evaluate_all, parse_rules
 
@@ -300,7 +336,7 @@ def execute_candidates(candidates: list[dict], cir: Any) -> tuple[list[dict], li
     for rule in candidates:
         payload = {k: v for k, v in rule.items() if not k.startswith("_")}
         try:
-            violations = evaluate_all(parse_rules({"contracts": [payload]}), cir)
+            violations = evaluate_all(parse_rules({"contracts": [payload]}), cir, root)
         except Exception as exc:  # a rule this module built must never break the run
             dropped.append({"id": rule.get("id", "?"), "reason": f"did not parse: {exc}"})
             continue
@@ -333,12 +369,17 @@ def derive_contracts(root: Path, cir: Optional[Any] = None) -> dict:
 
     proposed: list[dict] = []
     rejected: list[dict] = []
+    # `_finding_rules` needs the root; the graph-only derivations do not. Passed
+    # by name rather than positionally so adding a third file-reading derivation
+    # is a one-word change instead of a silent blind spot (C1-24).
     for derive in (_security_rules, _finding_rules, _edge_rules):
-        rules, skipped = derive(cir)
+        rules, skipped = (
+            derive(cir, root) if derive is _finding_rules else derive(cir)
+        )
         proposed.extend(rules)
         rejected.extend(skipped)
 
-    kept, dropped = execute_candidates(proposed, cir)
+    kept, dropped = execute_candidates(proposed, cir, root)
 
     return {
         "schema_version": SCHEMA_VERSION,