sourcecode 4.5.3__py3-none-any.whl → 4.6.0__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.5.3"
+__version__ = "4.6.0"

sourcecode/archetype.py

@@ -86,6 +86,14 @@ _MIN_CONFIDENT_SCORE = 0.5
 # discriminating. Tuned so a clear library (no app/server/servlet entry) is not confidently
 # labeled an engine, while runnable systems (which never trigger the gate) are untouched.
 _LIBRARY_ENGINE_DISCOUNT = 0.55
+# The same shape for the opposite mistake (C3-43): a repository whose primary
+# surface is HTTP owns storage/kernel packages and hub topology *because* it
+# serves requests with them, so that evidence is not discriminating for "engine"
+# either. Scaled by the measured density, so a repository with a marginal surface
+# is barely discounted and one that is nothing but endpoints is discounted fully.
+# Below the library figure on purpose: an application CAN be built around an
+# engine, whereas a non-runnable artifact cannot be an engine product at all.
+_HTTP_ENGINE_DISCOUNT = 0.45
 # Entry kinds that make a repo a runnable system (an app/server/servlet/daemon) rather
 # than a consumable library. Used to gate the library de-bias (P0).
 _RUNNABLE_ENTRY_KINDS = frozenset({
@@ -409,6 +417,42 @@ class ArchetypeClassifier:
             add("application", "runtime_entry_plus_services",
                 f"bootstrap/server entry + service mass ≈ {cm['service']:.0%}",
                 2.0, 1.0, max(cm["service"], 0.2))
+        # C3-43. The strongest MEASURED discriminator this build has for what a
+        # repository is — its HTTP surface — was read by `_primary_interface` and
+        # ignored here, so a 3 574-endpoint CRUD REST monolith was labelled
+        # `engine` on package-name masses and a fan-in Gini, while the legacy
+        # classifier it supersedes answered `api` and was right. Same ramp as the
+        # interface dimension, from the same features: one authority for the
+        # figure, two dimensions reading it.
+        if f.endpoint_share is None:
+            # Unmeasured is not zero: contribute nothing, and say so.
+            add("application", "http_surface_density",
+                "endpoint surface not measured — this dimension is scored without it",
+                2.5, 0.0, 0.0)
+        else:
+            density = f.endpoint_share * 100
+            http_strength = (
+                max(0.0, min(1.0, (density - 0.5) / 1.5)) if f.endpoint_total else 0.0
+            )
+            add("application", "http_surface_density",
+                f"{f.endpoint_total} endpoints over {f.total_files} files "
+                f"({density:.2f}/100 files) — the repository's primary surface is HTTP",
+                2.5, http_strength, 1.0)
+            # And the same fact as NAMED negative evidence for `engine`, the way
+            # the library de-bias below does it: a codebase whose product is a
+            # request surface owns storage and kernel packages *because* it is an
+            # application, so that mass is not, alone, evidence of an engine.
+            engine_positive_http = sum(max(0.0, e.contribution) for e in cands["engine"])
+            if http_strength > 0 and engine_positive_http > 0:
+                cands["engine"].append(Evidence(
+                    "http_surface_discount",
+                    f"{f.endpoint_total} endpoints over {f.total_files} files: the "
+                    "primary surface of this repository is HTTP, and the storage/"
+                    "kernel mass and hub topology an application needs to serve it "
+                    "are not, alone, evidence of an engine product",
+                    1.0, 1.0, 1.0,
+                    -engine_positive_http * _HTTP_ENGINE_DISCOUNT * http_strength,
+                ))
         # platform: many modules + multiple concept clusters + distribution
         multi = 1.0 if f.module_count >= 8 else f.module_count / 8
         add("platform", "many_modules_multi_concern",

sourcecode/baseline_autocapture.py

@@ -210,7 +210,19 @@ def worktree_dirty(
         return None
     if out.returncode != 0:
         return None
-    lines = [ln for ln in out.stdout.splitlines() if ln.strip()]
+    # C1-27. "Dirty" means the tree *the analysis reads* differs from HEAD. A
+    # change under an editor or agent state directory is not one — no analyser
+    # opens those files — and counting it reported STALE on a snapshot that
+    # described the tree exactly, with `Delta: 0` beside it. One authority answers
+    # which paths qualify (`path_filters.analysis_reads`) and its default is
+    # inclusive: anything not named there still counts, because a missed change
+    # is a false *fresh* and a spurious one only costs a rebuild.
+    from sourcecode.path_filters import analysis_reads
+
+    lines = [
+        ln for ln in out.stdout.splitlines()
+        if ln.strip() and analysis_reads(_porcelain_path(ln))
+    ]
     if ignore is None:
         return bool(lines)
     candidates = [ignore] if isinstance(ignore, (str, Path)) else list(ignore)

sourcecode/cache.py

@@ -213,6 +213,14 @@ def _untracked_tree_fingerprint(target: Path) -> str:
     return f"ff{h.hexdigest()[:14]}"
 
 
+def _porcelain_status_path(line: str) -> str:
+    """The path a `git status --porcelain` line refers to (destination on renames)."""
+    body = line[3:] if len(line) > 3 else ""
+    if " -> " in body:
+        body = body.split(" -> ", 1)[1]
+    return body.strip().strip('"')
+
+
 def worktree_signature(repo_root: Path, scope: Optional[Path] = None) -> str:
     """Hex fingerprint of the **exact tree state an analysis would read**.
 
@@ -252,12 +260,30 @@ def worktree_signature(repo_root: Path, scope: Optional[Path] = None) -> str:
         porcelain = st.stdout if st.returncode == 0 else ""
     except Exception:
         porcelain = ""
+    # C1-27. The signature describes *the tree an analysis would read*, so a line
+    # about a file no analyser opens does not belong in it — an editor settings
+    # file was invalidating every cached answer and publishing STALE beside
+    # `Delta: 0`. One authority decides which paths qualify, and its default is
+    # inclusive: anything not named there still invalidates.
+    from sourcecode.path_filters import analysis_reads
+
+    porcelain = "\n".join(
+        ln for ln in porcelain.splitlines()
+        if ln.strip() and analysis_reads(_porcelain_status_path(ln))
+    )
     if not porcelain.strip():
         return head  # clean — HEAD fully describes the tree
 
     try:
+        from sourcecode.path_filters import _TOOL_STATE_DIRS
+
+        # The same exclusion, expressed to git for the half that is not a list of
+        # paths. A tracked editor-state file must not enter the signature through
+        # the diff after being kept out of the status.
+        _diff_spec = list(pathspec) or ["--", "."]
+        _diff_spec += [f":(exclude,glob)**/{d}/**" for d in sorted(_TOOL_STATE_DIRS)]
         df = subprocess.run(
-            ["git", "-C", str(root), "diff", "HEAD", *pathspec],
+            ["git", "-C", str(root), "diff", "HEAD", *_diff_spec],
             capture_output=True, text=True, timeout=20,
         )
         diff_txt = df.stdout if df.returncode == 0 else ""

sourcecode/cli.py

@@ -8853,7 +8853,9 @@ def explain_cmd(
         except Exception:
             cir = ContextGraph.build(file_list, target).cir  # fallback: never break explain
         model = SpringSemanticModel.build(cir)
-        explanation = explain_class(class_name, cir, model).capped(limit)
+        # `root` is what lets the security section read the request-chain rules a
+        # configuration class declares in a DSL rather than in annotations (C3-41).
+        explanation = explain_class(class_name, cir, model, root=target).capped(limit)
     finally:
         _prog.finish()
     if _cc_look is not None:

sourcecode/explain.py

@@ -15,6 +15,7 @@ are transitional and tracked for a later phase.
 from __future__ import annotations
 
 from dataclasses import dataclass, field
+from pathlib import Path
 from typing import TYPE_CHECKING, Optional
 
 from sourcecode.caller_metrics import CALLER_METRIC_RECONCILIATION
@@ -397,7 +398,15 @@ def _structural_purpose(
 
 
 def _build_public_methods(class_fqn: str, raw_nodes: list[dict]) -> list[str]:
-    """Return public method names for class_fqn from raw_ir nodes."""
+    """Return public method names for class_fqn from raw_ir nodes.
+
+    C3-41: a factory member (`symbol_kind: "bean"`) is a method, and it is the
+    *whole* API of a configuration class. Excluding the kind reported
+    `public_methods: []` for every `@Configuration` in every repository. Its
+    Java visibility is not the test either — a factory member is called by the
+    container, not by a caller in this repository, so a package-private one is
+    still the class's published surface.
+    """
     prefix = class_fqn + "#"
     methods: list[str] = []
     for node in raw_nodes:
@@ -405,6 +414,11 @@ def _build_public_methods(class_fqn: str, raw_nodes: list[dict]) -> list[str]:
         if not fqn.startswith(prefix):
             continue
         kind = node.get("symbol_kind") or node.get("type") or ""
+        if kind == "bean":
+            name = fqn[len(prefix):]
+            if name and not name.startswith("<"):
+                methods.append(name)
+            continue
         if kind not in ("method", "endpoint", "constructor", ""):
             continue
         modifiers: list[str] = node.get("modifiers") or []
@@ -465,10 +479,45 @@ def _build_callers(
     return [_simple(f) if counts[_simple(f)] == 1 else f for f in fqns]
 
 
-def _build_deps(class_fqn: str, graph: "ContextGraph") -> list[str]:
-    """DI injected dependencies, simple names — via the ContextGraph public API."""
-    deps = graph.injected_dependencies_of(class_fqn)
-    return sorted({_simple(d) for d in deps})
+def _build_deps(
+    class_fqn: str, graph: "ContextGraph", raw_nodes: "Optional[list[dict]]" = None
+) -> list[str]:
+    """What this class depends on, simple names — via the ContextGraph public API.
+
+    Injected dependencies for a class that is wired; **plus what a factory
+    declares**, for a class that does the wiring (C3-41). A configuration class
+    injects nothing: it names its collaborators in the signatures of its factory
+    members and builds them in their bodies, so reading only the injection graph
+    reported `outgoing_deps: []` for a class with eight collaborators per method.
+
+    Evidence, not naming: the extra sources are read only when the class actually
+    declares factory members, and both are atoms the IR already publishes — the
+    class-scope type surface and the instantiation facts.
+    """
+    deps = set(graph.injected_dependencies_of(class_fqn))
+    if _factory_members(class_fqn, raw_nodes or []):
+        deps.update(
+            ref.type for ref in graph.class_type_references_in(class_fqn) if ref.type
+        )
+        for member in _factory_members(class_fqn, raw_nodes or []):
+            deps.update(inst.type for inst in graph.instantiations_in(member) if inst.type)
+    return sorted({_simple(d) for d in deps if d})
+
+
+def _factory_members(class_fqn: str, raw_nodes: list[dict]) -> list[str]:
+    """Members of this class that declare a bean rather than behaviour.
+
+    The IR already classifies them (`symbol_kind: "bean"`); this is the one place
+    that reads it, so both the method list and the dependency list agree about
+    what a configuration class contains.
+    """
+    prefix = class_fqn + "#"
+    return [
+        str(node.get("fqn"))
+        for node in raw_nodes
+        if str(node.get("fqn") or "").startswith(prefix)
+        and (node.get("symbol_kind") or "") == "bean"
+    ]
 
 
 def _build_events_published(class_fqn: str, model: "SpringSemanticModel") -> list[str]:
@@ -566,6 +615,44 @@ def _build_security(
     return result
 
 
+def _build_chain_rules(class_fqn: str, cir: "CanonicalRepositoryIR", root) -> list[str]:
+    """Access rules this class declares for the request chain.
+
+    C3-41. A class that configures the chain writes its constraints in a DSL, not
+    in annotations, so the annotation reader returned `[]` for the one class whose
+    entire job is deciding access — while `posture`, in the same build, read its
+    rules from that very file. One authority answers it (`chain_rules`), so the
+    two commands cannot describe the same file differently.
+    """
+    if root is None:
+        return []
+    from sourcecode.chain_rules import rules_from_source
+
+    rel = _source_file_of(class_fqn, cir)
+    if not rel:
+        return []
+    try:
+        source = (Path(root) / rel).read_text(encoding="utf-8", errors="replace")
+    except OSError:
+        return []
+    out: list[str] = []
+    for rule in rules_from_source(source, rel):
+        patterns = ", ".join(rule.patterns) if rule.patterns else "**"
+        out.append(
+            f"request chain: {patterns} → {rule.decision} "
+            f"({rel}:{rule.line})"
+        )
+    return out
+
+
+def _source_file_of(class_fqn: str, cir: "CanonicalRepositoryIR") -> str:
+    """The repo-relative file declaring this class, from the IR's own node."""
+    for node in _get_raw_nodes(cir):
+        if node.get("fqn") == class_fqn:
+            return str(node.get("file") or node.get("source_file") or "")
+    return ""
+
+
 def _build_endpoints(class_fqn: str, model: "SpringSemanticModel") -> list[str]:
     """REST endpoints declared on this controller class."""
     endpoints = model.endpoint_index.endpoints_for(class_fqn)
@@ -585,13 +672,27 @@ def explain_class(
     class_name: str,
     cir: "CanonicalRepositoryIR",
     model: "SpringSemanticModel",
+    root: "Optional[Path]" = None,
 ) -> ClassExplanation:
     """Build a ClassExplanation for class_name from existing CIR + model.
 
-    Never raises — wraps all derivation in try/except.
+    Never raises. C3-41: a section that *failed* now says so. Every section was
+    wrapped in a bare `except: []`, which made a crash and a measured emptiness
+    the same output — and an empty section reads as *"there are none"*.
     """
     warnings: list[str] = []
 
+    def _section_of(name: str, build, default):
+        """Run one section builder; a failure becomes a warning, not a silence."""
+        try:
+            return build()
+        except Exception as exc:  # pragma: no cover — defensive by contract
+            warnings.append(
+                f"{name} could not be derived ({type(exc).__name__}): this section "
+                f"is empty because the derivation failed, not because there is none"
+            )
+            return default
+
     try:
         class_fqn, all_matches = _resolve_fqn(class_name, cir)
     except Exception:
@@ -630,40 +731,32 @@ def explain_class(
     except Exception:
         purpose = f"{stereotype} class"
 
-    try:
-        public_methods = _build_public_methods(class_fqn, raw_nodes)
-    except Exception:
-        public_methods = []
-
-    try:
-        incoming_callers = _build_callers(class_fqn, cir, graph)
-    except Exception:
-        incoming_callers = []
-
-    try:
-        outgoing_deps = _build_deps(class_fqn, graph)
-    except Exception:
-        outgoing_deps = []
-
-    try:
-        events_published = _build_events_published(class_fqn, model)
-    except Exception:
-        events_published = []
-
-    try:
-        events_consumed = _build_events_consumed(class_fqn, model)
-    except Exception:
-        events_consumed = []
-
-    try:
-        transactions = _build_transactions(class_fqn, model)
-    except Exception:
-        transactions = []
-
-    try:
-        security_constraints = _build_security(class_fqn, raw_nodes, cir)
-    except Exception:
-        security_constraints = []
+    public_methods = _section_of(
+        "public_methods", lambda: _build_public_methods(class_fqn, raw_nodes), []
+    )
+    incoming_callers = _section_of(
+        "incoming_callers", lambda: _build_callers(class_fqn, cir, graph), []
+    )
+    outgoing_deps = _section_of(
+        "outgoing_deps", lambda: _build_deps(class_fqn, graph, raw_nodes), []
+    )
+    events_published = _section_of(
+        "events_published", lambda: _build_events_published(class_fqn, model), []
+    )
+    events_consumed = _section_of(
+        "events_consumed", lambda: _build_events_consumed(class_fqn, model), []
+    )
+    transactions = _section_of(
+        "transactions", lambda: _build_transactions(class_fqn, model), []
+    )
+    security_constraints = _section_of(
+        "security_constraints", lambda: _build_security(class_fqn, raw_nodes, cir), []
+    )
+    # A class that configures the request chain declares its constraints in a
+    # DSL. Same section, one authority (`chain_rules`) — never a second parser.
+    security_constraints = security_constraints + _section_of(
+        "security_constraints", lambda: _build_chain_rules(class_fqn, cir, root), []
+    )
 
     try:
         rest_endpoints = _build_endpoints(class_fqn, model)

sourcecode/path_filters.py

@@ -62,52 +62,62 @@ _JAVA_TEST_ROOTS = (
     "\\src\\test\\",
 )
 
+#: Directories that hold **tool, editor and agent state** — nothing any analyser
+#: in this engine opens, so a change inside one cannot change an answer.
+#:
+#: C1-27. C3-40 made an untracked file count as a change, correctly: an untracked
+#: `.java` file is in the IR. It counted *any* porcelain line, though, so an
+#: editor settings file no analyser reads flipped a snapshot to STALE with
+#: `RIS HEAD == current HEAD` and `Delta: 0`. A freshness signal that fires on a
+#: file the analysis cannot see teaches its reader to ignore the one that matters.
+#:
+#: Deliberately short, and the default is **inclusive**: anything not listed here
+#: is a change. That asymmetry is the point — a missed change is a false *fresh*,
+#: which is the confident-falsehood direction, and a spurious change only costs a
+#: rebuild. `.github` is **not** here: CI descriptors are read as tooling
+#: evidence. Version-control internals are, because git's own directory is never
+#: analysis input.
+_TOOL_STATE_DIRS = frozenset({
+    ".git", ".hg", ".svn",
+    ".idea", ".vscode", ".fleet", ".eclipse", ".settings",
+    ".claude", ".cursor", ".aider", ".continue",
+    ".devcontainer", ".husky",
+})
 
-def is_test_path(path: str) -> bool:
-    """Return True when *path* is part of a test tree, not production code.
 
-    Handles:
-      - Standard Maven/Gradle layout  (src/test/java/…)
-      - Common naming conventions     (/tests/, /spec/, /it/)
-      - Java file name conventions    (FooTest.java, TestFoo.java)
-      - Python conventions            (test_foo.py, foo_test.py)
-      - JS/TS conventions             (foo.test.ts, foo.spec.ts)
+def analysis_reads(path: str) -> bool:
+    """Whether a change to *path* can change any answer this engine produces.
+
+    The one authority for that question (ADR-0008 R1). Used by cache freshness so
+    "the tree changed" means the tree *the analysis reads* changed, which is what
+    a snapshot describes.
     """
-    norm = path.replace("\\", "/").lower()
+    parts = [p for p in str(path).replace("\\", "/").split("/") if p and p != "."]
+    return not any(part in _TOOL_STATE_DIRS for part in parts)
 
-    # Maven/Gradle standard test root (fast path)
-    if "/src/test/" in norm:
-        return True
 
-    # Segment-based check – any directory component is a test segment
-    parts = norm.split("/")
-    seen: set[str] = set()
-    for part in parts[:-1]:  # skip filename itself
-        bare = part.rstrip("/")
-        if bare in _AMBIGUOUS_TEST_SEGMENTS and seen & _DOC_ROOT_SEGMENTS:
-            seen.add(bare)
-            continue  # a specification under `docs/`, not a spec suite
-        if bare in _TEST_SEGMENTS:
-            return True
-        seen.add(bare)
-
-    # File-name conventions
-    name = parts[-1]
-    if (
-        name.startswith("test_")
-        or name.endswith("_test.py")
-        or name.endswith(".test.ts")
-        or name.endswith(".test.js")
-        or name.endswith(".spec.ts")
-        or name.endswith(".spec.js")
-        or (name.endswith("test.java") and name != "test.java")
-        or name.endswith("tests.java")
-        or (name.startswith("test") and name.endswith(".java") and len(name) > 9
-            and "/src/main/" not in norm)
-    ):
-        return True
+def is_test_path(path: str) -> bool:
+    """Return True when *path* is part of a test tree, not production code.
 
-    return False
+    C1-28: **this is a passthrough**, and it exists only so the six modules that
+    import it here keep working. `test_sources.is_test_path` is the authority for
+    this fact and has been since 3.2.1 (C1-2) — but this second derivation was
+    never retired, so two rules answered one question and disagreed on five path
+    shapes, in both directions:
+
+        src/main/java/**/Test*.java     here: True   authority: False
+        src/main/java/**/*IT.java       here: False  authority: True
+        src/main/java/**/test/X.java    here: True   authority: False
+
+    The field met the first as *"`--compact` counts 1 test file that is actually
+    in `src/main`"*. Everything this module knew and the authority did not — the
+    `test-helpers`/`it`/`integrationtest` directory spellings, the JUnit-3
+    `TestFoo` prefix — moved there rather than being dropped, because retiring an
+    authority means absorbing what it knew.
+    """
+    from sourcecode.test_sources import is_test_path as _authority
+
+    return _authority(path)
 
 
 def is_test_or_fixture_path(path: str) -> bool:

sourcecode/posture.py

@@ -45,7 +45,16 @@ POSTURE_SCHEMA = "posture-v1"
 _POSTURE_LIST_CAP = 200
 
 
-def _declare_cap(parent: dict, name: str, total: int) -> None:
+#: The same, for the per-candidate lists of `--resolve-environments`. A separate
+#: number because a candidate row is one of many in a single answer, and a
+#: separate *name* because a cap that is not declared with the limit that
+#: produced it cannot be checked (C2-25).
+_ENVIRONMENT_LIST_CAP = 50
+
+
+def _declare_cap(
+    parent: dict, name: str, total: int, limit: int = _POSTURE_LIST_CAP
+) -> None:
     """Record what the cut on ``parent[name]`` omitted, or nothing when it did not
     bite (C2-20). Same shape as `migrate-check`'s `findings_cap`, because two ways
     to say "this list is not the whole list" is one more than a reader should learn.
@@ -59,7 +68,7 @@ def _declare_cap(parent: dict, name: str, total: int) -> None:
         "total": total,
         "shown": shown,
         "omitted": total - shown,
-        **cap_effect("display_list", limit=_POSTURE_LIST_CAP, total=total),
+        **cap_effect("display_list", limit=limit, total=total),
     }
 
 #: Resolved against the repository's own configuration (see `spring_properties`),
@@ -750,6 +759,7 @@ def access_projection(
 
     by_endpoint: dict[str, str] = {}
     details: dict[str, dict] = {}
+    decided_by: dict[str, list[str]] = {}
     for endpoint in getattr(cir, "endpoints", []) or []:
         policy = getattr(getattr(endpoint, "security", None), "policy", None) or ""
         if policy not in _NO_HANDLER_GUARD_POLICIES:
@@ -788,6 +798,14 @@ def access_projection(
         decision, evidence = next(iter(decisions.items()))
         by_endpoint[endpoint.id] = decision
         details[endpoint.id] = evidence
+        # C1-25. Which configuration file decided this request. Uncapped and kept
+        # beside the decision, because it is the declared scope of anything wrong
+        # in that file: a defect in a chain configuration is not "unreachable"
+        # because nothing calls the class — its blast radius is every request it
+        # decides.
+        _decider = str(evidence.get("source_file") or "") if isinstance(evidence, dict) else ""
+        if _decider:
+            decided_by.setdefault(_decider, []).append(endpoint.id)
 
     # A declared-but-undecidable servlet path means the URL the chain matches is
     # unknown. Where any pattern rule is declared, that unknown decides which rule
@@ -800,6 +818,9 @@ def access_projection(
         for rule in rules_by_file[source_file]
     )
     if not servlet.decided and path_dependent:
+        # No chain-derived verdict survives an unknown servlet path, so no file
+        # can be said to have decided a request either (C1-25).
+        decided_by.clear()
         for endpoint_id, decision in list(by_endpoint.items()):
             if decision == "guarded_by_own_annotation":
                 continue
@@ -821,6 +842,13 @@ def access_projection(
             "inactive_files": sorted(f for f in rules_by_file if states.get(f) == "inactive"),
             "unresolved_files": undecided_files,
             "rules": sum(len(rules_by_file[f]) for f in active_files),
+            # How much of the request surface each configuration file decides.
+            # Uncapped on purpose: it is a per-file figure, not a per-endpoint
+            # list, and it is the declared scope of any defect written in that
+            # file (C1-25). A count, not a sample, so nothing here needs a cap.
+            "decides_endpoints": {
+                f: len(ids) for f, ids in sorted(decided_by.items())
+            },
         },
         "summary": {k: v for k, v in summary.items() if v},
     }
@@ -900,6 +928,28 @@ def endpoint_access_under(
     return _posture(root, profiles, properties, cir=cir)[1]
 
 
+def access_resolution(
+    root: Path,
+    profiles: "Optional[set[str]]" = None,
+    *,
+    cir: "Optional[Any]" = None,
+    properties: "Optional[dict[str, str]]" = None,
+) -> "tuple[dict[str, str], dict[str, int]]":
+    """Both halves of one resolution: the per-endpoint decision, and how much of
+    the surface each chain configuration file decides.
+
+    One pass, because both consumers are the same consumer: `ask risk` weighs the
+    decision as its access axis (C1-26) **and** needs the second figure to know
+    that a defect written in a chain configuration is not unreachable merely
+    because nothing calls its class (C1-25). Running the resolution twice to
+    answer one question about one profile set is how two authorities are born.
+    """
+    payload, by_endpoint = _posture(root, profiles, properties, cir=cir)
+    access = ((payload.get("endpoints") or {}).get("effective_access") or {})
+    decides = (access.get("chains") or {}).get("decides_endpoints") or {}
+    return by_endpoint, {str(k): int(v) for k, v in decides.items()}
+
+
 def access_verdict(decision: str) -> str:
     """A profile-resolved decision, in the vocabulary the risk composition weighs.
 
@@ -956,15 +1006,25 @@ def resolve_environments(
         payload, by_endpoint = _posture(root, set(candidate), properties, cir=cir)
         open_endpoints = sorted(e for e, d in by_endpoint.items() if d in _OPEN_BY_RULE)
         undecided = sorted(e for e, d in by_endpoint.items() if d in _UNDECIDED_ACCESS)
-        evaluated.append({
+        # C2-25. The list is a sample and the count is the answer; the cut says so
+        # in the same vocabulary every other list in this module uses. Publishing
+        # 50 of 2 635 with no `total`/`omitted`/`direction` was the one place the
+        # product broke a convention it keeps everywhere else — and it was the
+        # list an auditor needs whole.
+        row = {
             "profiles": list(candidate),
             "open_by_rule": len(open_endpoints),
             "access_not_decided": len(undecided),
             "endpoints_total": len(by_endpoint),
             "access_summary": payload["endpoints"]["effective_access"].get("summary", {}),
             "unresolved_beans": len(payload.get("unresolved") or []),
-            "endpoints_open_by_rule": open_endpoints[:50],
-        })
+            "endpoints_open_by_rule": open_endpoints[:_ENVIRONMENT_LIST_CAP],
+        }
+        _declare_cap(
+            row, "endpoints_open_by_rule", len(open_endpoints),
+            limit=_ENVIRONMENT_LIST_CAP,
+        )
+        evaluated.append(row)
 
     worst = max(
         evaluated,

sourcecode/repository_ir.py

@@ -39,6 +39,7 @@ from sourcecode.path_filters import (
     is_test_path as _is_test_path,
     is_test_fixture_module_path as _is_test_fixture_module_path,
 )
+from sourcecode.test_sources import matches_test_naming as _matches_test_naming
 from sourcecode.security_config import (
     CustomSecuritySpec,
     capture_markers as _capture_markers,
@@ -6749,15 +6750,23 @@ def find_java_files(
         # Skip test dirs — use centralised is_test_path (consistent with
         # extract_java_endpoints), guarded against false positives where a Java
         # *package* is named "test" inside a production src/main/ source root.
-        if not include_tests and _is_test_path(rel):
-            _skip = True
-            # Prepend "/" so the check works whether or not rel has a leading slash.
-            _rel_sl = "/" + rel
-            if "/src/main/" in _rel_sl:
-                # is_test_path may fire on a package segment (e.g. com.example.test)
-                # rather than a true test module directory.  Only skip when the path
-                # prefix BEFORE src/main/ is itself a test path (meaning the whole
-                # module is a test module, not just a package named "test").
+        if not include_tests:
+            # Two facts, and C1-28 is why they are now written as two.
+            # `is_test_path` answers "is this file a test source"; since the
+            # authority took over it never fires inside a declared main source
+            # root, which is correct everywhere except inside a module that is
+            # itself test infrastructure — a `test-framework` module has no
+            # product for its `src/main` to belong to. There the weaker question
+            # is the right one: does this file look like a test by name or by
+            # package. Both come from the one authority, so this stays a
+            # composition of published facts rather than a third rule. A test
+            # *fixture* module (`*-test-utils`) is deliberately NOT excluded
+            # here: its endpoints are kept as raw evidence and tagged
+            # `scope: test_util` downstream.
+            _rel_sl = "/" + rel  # leading slash: the checks below are prefix-safe
+            if _is_test_path(rel):
+                continue
+            if "/src/main/" in _rel_sl and _matches_test_naming(rel):
                 _prefix = _rel_sl.split("/src/main/")[0]
                 _prefix_parts = [p for p in _prefix.split("/") if p]
                 # A module is a test module if is_test_path says so OR if any
@@ -6773,10 +6782,8 @@ def find_java_files(
                         for w in p.lower().replace("-", " ").replace("_", " ").split()
                     )
                 )
-                if not _prefix_is_test:
-                    _skip = False
-            if _skip:
-                continue
+                if _prefix_is_test:
+                    continue
         # Skip vendor/generated/build dirs
         if any(part in _VENDOR_DIRS for part in parts[:-1]):
             continue

sourcecode/risk.py

@@ -58,7 +58,14 @@ _SEVERITY_FACTOR = {"critical": 4.0, "high": 3.0, "medium": 2.0, "low": 1.0}
 #: What reaching HTTP does to a defect. *"TX-001 en un método privado es una nota de
 #: linter. TX-001 que alcanza cuatro POST de pago es un ticket."* Unreached is not
 #: zero — the defect is still real, it is simply not exposed.
-_REACH_FACTOR = {"none": 0.6, "internal": 1.0, "http": 1.6}
+#:
+#: `request_chain` is the **declared** scope, not a walked one (C1-25): a defect
+#: written in a configuration that decides access for the request surface is not
+#: unreachable because nothing calls its class. Its blast radius is every request
+#: those rules decide, which is why it weighs what an HTTP-reached defect weighs
+#: rather than what an internal one does. The count comes from `posture`, which is
+#: the authority for which file decided which request.
+_REACH_FACTOR = {"none": 0.6, "internal": 1.0, "request_chain": 1.6, "http": 1.6}
 
 #: What the access verdict on the reached endpoints does. Reading the WORST verdict
 #: among them, because one open route is what an attacker needs; and an endpoint the
@@ -153,6 +160,12 @@ class RiskRow:
     #: reaches more. Both are correct and the difference is the scope, so the scope
     #: travels with the number instead of in a note the reader has to fetch (C2-23).
     reach_scope: str = "class"
+    #: Requests this defect's own file decides access for, when it is a chain
+    #: configuration (C1-25). Zero for every other defect. Kept apart from
+    #: `endpoints_reached`, which is a *walked* figure: merging a declared scope
+    #: into a reach count would be the same unit collision C2-23 published notes
+    #: about.
+    declared_scope: int = 0
     endpoints: list = field(default_factory=list)
     statement: str = ""
     blind_axes: list = field(default_factory=list)
@@ -174,8 +187,15 @@ class RiskRow:
             # number is what makes a risk list impossible to argue with.
             "factors": self.factors,
             "endpoints_reached": self.endpoints_reached,
+            **({"decides_requests": self.declared_scope} if self.declared_scope else {}),
             "endpoints_reached_basis": (
                 f"endpoints reachable from this {self.reach_scope}"
+                + (
+                    f"; this defect is written in a chain configuration, whose "
+                    f"scope is declared rather than walked — see "
+                    f"`decides_requests` ({self.declared_scope})"
+                    if self.declared_scope else ""
+                )
                 + (
                     "; `ask impact-chain <Class>` answers the wider question — what "
                     "the whole enclosing class reaches — and returns a larger figure "
@@ -410,6 +430,15 @@ def _statement(row: "dict[str, Any]") -> str:
         )
     if reach == "http":
         return f"{row['title']} — reachable over {row['count']} endpoint(s){tail}"
+    if reach == "request_chain":
+        # C1-25. Never the "nothing reaches it" sentence for the file that decides
+        # what is reachable. The scope is declared, not walked, and the sentence
+        # says which it is.
+        return (
+            f"{row['title']} — declared in the configuration that decides access "
+            f"for {row['governs']} request(s) in this repository, so its scope is "
+            f"that surface and not a call path into this class{tail}"
+        )
     return f"{row['title']} — no HTTP endpoint in this repository reaches it{tail}"
 
 
@@ -477,20 +506,49 @@ class RiskComposer:
         )
         self._reach_cache: "dict[str, Any]" = {}
 
-        # M10's exit criterion: profile context per finding. Without a profile set
-        # the access axis is the endpoint security surface, which answers for the
-        # repository as configured. With one, `posture` resolves the conditional
-        # bean graph and says what *that deployment* leaves reachable — the axis
-        # nothing else in the market models, and the reason a finding can be
-        # `protected` under one profile set and open under another.
+        # M10's exit criterion: profile context per finding. With a profile set,
+        # `posture` resolves the conditional bean graph and says what *that
+        # deployment* leaves reachable — the axis nothing else in the market
+        # models, and the reason a finding can be `protected` under one profile
+        # set and open under another.
+        #
+        # C1-26: the resolution is read **whether or not a set is named**. It used
+        # to be the price of the flag, so the default invocation weighed an
+        # endpoint at `unknown` (×1.4) that `posture`, in the same process, over
+        # the same CIR, decided was reachable without authentication (×2.0) — the
+        # difference between `high` and `critical` on the class this product is
+        # bought for. With no set named the resolution is the one Spring itself
+        # performs with none given: `default` alone, which CL-8 records as the
+        # permissive case rather than a neutral one. It is a **default, never a
+        # guarantee** — the process environment outranks every file — and the row
+        # says which set it read.
         self.profiles = set(profiles) if profiles else None
-        self.profile_access: "dict[str, str]" = {}
-        if self.profiles is not None:
-            from sourcecode.posture import endpoint_access_under
+        from sourcecode.posture import access_resolution
+
+        # One pass answers both: the access axis (C1-26) and how much of the
+        # request surface each chain configuration file decides (C1-25).
+        self.profile_access, self.chain_reach = access_resolution(
+            self.root,
+            self.profiles if self.profiles is not None else set(),
+            cir=self.cir,
+        )
 
-            self.profile_access = endpoint_access_under(
-                self.root, self.profiles, cir=self.cir
-            )
+    def chain_scope(self, source_file: str) -> int:
+        """How many requests the chain configuration in ``source_file`` decides.
+
+        0 when this file declares no readable chain rule, which is every file
+        that is not one. Path spellings are normalised because a finding carries
+        the path its own emitter produced and `posture` keys on the repository's
+        relative POSIX path (C2-18/C2-24's convention).
+        """
+        if not source_file or not self.chain_reach:
+            return 0
+        wanted = str(source_file).replace("\\", "/").lstrip("./")
+        for candidate, count in self.chain_reach.items():
+            normalized = candidate.replace("\\", "/").lstrip("./")
+            if normalized == wanted or normalized.endswith(f"/{wanted}") or wanted.endswith(f"/{normalized}"):
+                return count
+        return 0
 
     def reach(self, symbol: str) -> "Any":
         from sourcecode.spring_impact import run_impact_chain
@@ -532,10 +590,21 @@ class RiskComposer:
                 endpoint.endpoint_id, "coverage_unknown"
             )))
 
-        reach = "http" if endpoints else ("internal" if not blind else "unknown")
+        # C1-25. A defect declared in a configuration that decides the request
+        # chain has a scope even with no call path into it, and reporting
+        # `internal` for it published a sentence that is false in effect: *"no
+        # HTTP endpoint in this repository reaches it"*, about the file that
+        # decides whether any of them are reachable at all.
+        governs = self.chain_scope(source_file)
+        if endpoints:
+            reach = "http"
+        elif governs:
+            reach = "request_chain"
+        else:
+            reach = "internal" if not blind else "unknown"
         auth = _auth_axis(verdicts)
         profile_decisions: "list[str]" = []
-        if self.profiles is not None and endpoints:
+        if endpoints:
             from sourcecode.posture import access_verdict
 
             profile_decisions = [
@@ -599,30 +668,48 @@ class RiskComposer:
                 "reachability": {
                     "value": reach,
                     "factor": _REACH_FACTOR.get(reach, 1.0),
-                    "authority": "impact-chain",
+                    "authority": (
+                        "posture.chains.decides_endpoints"
+                        if reach == "request_chain" else "impact-chain"
+                    ),
+                    **({
+                        "governs_endpoints": governs,
+                        "basis": (
+                            "declared scope, not a walked one: this file's chain "
+                            "rules decide access for that many requests, so a "
+                            "defect in it is not internal because no call path "
+                            "leads to the class"
+                        ),
+                    } if reach == "request_chain" else {}),
                 },
                 "auth_verdict": {
                     "value": auth,
                     "factor": _AUTH_FACTOR.get(auth, 1.0),
                     "authority": (
-                        "security_posture.endpoint_security_surface"
+                        "security_posture.endpoint_security_surface + "
+                        "posture.effective_access under "
                         + (
-                            f" + posture.effective_access under "
-                            f"{','.join(sorted(self.profiles))}"
-                            if self.profiles is not None else ""
+                            ",".join(sorted(self.profiles))
+                            if self.profiles is not None else "default"
                         )
                     ),
                     "worst_of": sorted(set(verdicts)),
-                    **({
-                        "profile_set": sorted(self.profiles),
-                        "profile_decisions": sorted(set(profile_decisions)),
-                        "basis": (
-                            "the worse of the two authorities: what the repository's "
-                            "own security surface says, and what this profile set "
-                            "resolves the request chain to. `no_rule_matched` is "
-                            "unknown coverage, never open access"
-                        ),
-                    } if self.profiles is not None else {}),
+                    "profile_set": sorted(self.profiles) if self.profiles is not None else [],
+                    "profile_set_basis": (
+                        "named by --profile"
+                        if self.profiles is not None else
+                        "no profile set named, so the resolution is the one Spring "
+                        "performs with none given — `default` alone, which is the "
+                        "permissive case, not a neutral one. A default, never a "
+                        "guarantee: the process environment outranks every file"
+                    ),
+                    "profile_decisions": sorted(set(profile_decisions)),
+                    "basis": (
+                        "the worse of the two authorities: what the repository's "
+                        "own security surface says, and what this profile set "
+                        "resolves the request chain to. `no_rule_matched` is "
+                        "unknown coverage, never open access"
+                    ),
                 },
                 "write_effect": {
                     "value": write,
@@ -655,11 +742,12 @@ class RiskComposer:
             },
             endpoints_reached=len(endpoints),
             reach_scope="method" if "#" in symbol else "class",
+            declared_scope=governs if reach == "request_chain" else 0,
             endpoints=[e.to_dict() for e in endpoints[:20]],
             statement=_statement({
                 "title": title, "reach": reach, "auth": auth,
                 "write": write, "count": len(endpoints), "query": query,
-                "constraints": constraints,
+                "constraints": constraints, "governs": governs,
             }),
             blind_axes=blind,
             witness_count=witness_count,

sourcecode/spring_impact.py

@@ -372,6 +372,39 @@ def _class_of(fqn: str) -> str:
     return fqn
 
 
+#: Attribute the class→symbols index is memoized under, on the CIR it describes.
+#: Not a dataclass field: it is a derived index, it must not enter `cir_hash`,
+#: equality or the serialized form. The CIR is immutable in practice once built,
+#: so one index per CIR is correct for its whole lifetime.
+_SYMBOL_INDEX_ATTR = "_impact_symbols_by_class"
+
+
+def _symbols_by_class(cir: CanonicalRepositoryIR) -> "dict[str, list[str]]":
+    """`{class FQN → [its symbols, in `cir.symbols` order]}`, built once per CIR.
+
+    C3-42. The seed expansions below need "every symbol of this class" once per
+    subtype and once per interface, and they used to answer it by scanning
+    `cir.symbols` in full for each one — `len(subtypes) × len(symbols)` string
+    splits, inside a query the field measured at **1 187 s against a 516 ms model
+    build**. It is also `risk`'s inner loop, once per defect, which is where a
+    45-minute `risk` comes from.
+
+    The order of each bucket is `cir.symbols` order, which is what the expansions
+    appended in before; the answer is identical, only the cost is not.
+    """
+    index = getattr(cir, _SYMBOL_INDEX_ATTR, None)
+    if index is not None:
+        return index
+    index = {}
+    for sym in cir.symbols:
+        index.setdefault(_class_of(sym), []).append(sym)
+    try:
+        setattr(cir, _SYMBOL_INDEX_ATTR, index)
+    except Exception:  # pragma: no cover — a CIR that cannot carry the memo still works
+        pass
+    return index
+
+
 def _resolve_symbol(
     symbol: str,
     cir_symbols: list[str],
@@ -910,8 +943,14 @@ class ImpactOrchestrator:
                 return True
             return "#" in sym and sym.rsplit("#", 1)[1] in _queried_methods
 
+        # C3-42. The class→symbols index and the seed set are both loop-invariant:
+        # `seed_fqns` is only rebound *after* the loop, so the membership test asks
+        # about the same set on every symbol. Built once here, they turn an
+        # O(subtypes × symbols × seeds) scan into O(subtypes) lookups.
+        symbols_by_class = _symbols_by_class(cir)
         if impl_graph is not None:
             seed_classes_ch001 = {_class_of(s) for s in seed_fqns}
+            seed_set = frozenset(seed_fqns)
             impl_seeds: list[str] = []
             for seed_class in sorted(seed_classes_ch001):
                 subtypes = impl_graph.all_subtypes_of(seed_class)
@@ -921,9 +960,8 @@ class ImpactOrchestrator:
                     if impl_class in subtype_classes_added:
                         continue
                     subtype_classes_added.add(impl_class)
-                    for sym in cir.symbols:
-                        if (_class_of(sym) == impl_class and sym not in set(seed_fqns)
-                                and _member_in_scope(sym)):
+                    for sym in symbols_by_class.get(impl_class, ()):
+                        if sym not in seed_set and _member_in_scope(sym):
                             impl_seeds.append(sym)
             if impl_seeds:
                 seed_fqns = list(dict.fromkeys(seed_fqns + impl_seeds))
@@ -943,6 +981,7 @@ class ImpactOrchestrator:
         # (e.g. RefByUuid) and produces false-positive callers from sibling implementors.
         if impl_graph is not None:
             current_seed_classes = {_class_of(s) for s in seed_fqns}
+            seed_set = frozenset(seed_fqns)
             iface_seeds: list[str] = []
             iface_classes_added: set[str] = set()
             for seed_class in sorted(original_seed_classes):
@@ -951,9 +990,8 @@ class ImpactOrchestrator:
                     if iface_class in iface_classes_added or iface_class in current_seed_classes:
                         continue
                     iface_classes_added.add(iface_class)
-                    for sym in cir.symbols:
-                        if (_class_of(sym) == iface_class and sym not in set(seed_fqns)
-                                and _member_in_scope(sym)):
+                    for sym in symbols_by_class.get(iface_class, ()):
+                        if sym not in seed_set and _member_in_scope(sym):
                             iface_seeds.append(sym)
             if iface_seeds:
                 seed_fqns = list(dict.fromkeys(seed_fqns + iface_seeds))
@@ -1032,10 +1070,18 @@ class ImpactOrchestrator:
         # The security audit already derives the posture projection; take it from
         # there rather than deriving the same answer a second time (ADR-0008 R1).
         posture_dict: dict = {}
+        # C3-42. This is a **repository-wide** audit, run inside what the payload
+        # then publishes as `query_time_ms` — so a reader comparing that figure
+        # against `model_build_time_ms` is comparing a model build against a model
+        # build plus a full audit of every file. The share is measured and named
+        # rather than hidden: the cost is real, and which part of it is the walk is
+        # the first thing anyone reporting a slow query needs to know.
+        _audit_t0 = time.monotonic()
         if prebuilt_findings is not None:
             all_findings = prebuilt_findings
         else:
             all_findings, posture_dict = _run_audit_for_chain(cir, model, root)
+        audit_ms = round((time.monotonic() - _audit_t0) * 1000, 2)
 
         impact_findings_raw = _filter_findings(
             all_findings, seed_fqns, direct_callers_raw, indirect_callers_raw,
@@ -1405,6 +1451,20 @@ class ImpactOrchestrator:
                 "risk_score": risk_score,
                 "model_build_time_ms": model.build_time_ms,
                 "query_time_ms": elapsed_ms,
+                # What that number is made of. A field report of
+                # `query_time_ms: 1 187 063` beside `model_build_time_ms: 516`
+                # reads as a 2 300× graph walk; the walk is the difference between
+                # these two figures, and on every repository measured here the
+                # repository-wide audit is the larger part (C3-42).
+                "audit_time_ms": audit_ms,
+                "query_time_basis": (
+                    "wall time of the whole call, which includes a repository-wide "
+                    "TX + security audit (`audit_time_ms`) whose findings are then "
+                    "filtered to this chain. The graph walk itself is "
+                    "`query_time_ms - audit_time_ms`. `model_build_time_ms` covers "
+                    "the semantic model only, so the two are not comparable as they "
+                    "stand"
+                ),
                 "blind_spots": blind_spots,
                 "reconciliation": reconciliation_findings,
                 "external_supertypes": external_supertypes,

sourcecode/test_sources.py

@@ -48,9 +48,14 @@ _TEST_ROOT_SEGMENTS: tuple[tuple[str, ...], ...] = (
 )
 
 # Repository-level test directories, for ecosystems with no src/main split.
-_TEST_DIR_NAMES: frozenset[str] = frozenset(
-    {"test", "tests", "spec", "specs", "__tests__"}
-)
+# The `test-helpers`/`it`/`integrationtest` spellings arrived with C1-28, from
+# the second module that used to answer this question: retiring an authority
+# means absorbing what it knew, not dropping it.
+_TEST_DIR_NAMES: frozenset[str] = frozenset({
+    "test", "tests", "spec", "specs", "__tests__",
+    "test-helpers", "test_helpers", "testfixtures",
+    "it", "integrationtest", "integrationtests",
+})
 
 #: `spec/` is a test suite in the RSpec/Jasmine sense — and the opposite under a
 #: documentation root, where a *specification* lives. Found by this project's own suite
@@ -73,6 +78,10 @@ _TEST_NAME_PATTERNS: tuple[re.Pattern[str], ...] = tuple(
         r"[^/]*_test\.go$",
         r"[^/]*\.(spec|test)\.(js|jsx|ts|tsx|mjs|cjs)$",
         r"[^/]*(Test|Tests|Spec|IT)\.(java|kt|scala)$",
+        # The JUnit-3 prefix spelling, absorbed from the module C1-28 retired.
+        # It is a name, so the main-root rule disarms it exactly as it disarms
+        # the suffix one.
+        r"(?:^|/)Test[A-Z][^/]*\.(java|kt|scala)$",
         r"[^/]*_test\.rb$",
         r"[^/]*_spec\.rb$",
         r"[^/]*_test\.dart$",
@@ -122,10 +131,44 @@ def is_test_path(path: str) -> bool:
 
     The single derivation of this fact. A file under a declared test source root
     is a test whatever it is named; a file named by convention is a test wherever
-    it sits; a `test` package inside a main source root is neither.
+    it sits **except inside a declared main source root**; a `test` package
+    inside a main source root is neither.
+
+    C1-28 added the exception, and it is the same rule the directory half has
+    always applied, in the same direction: a build tool that separates test
+    sources says so with a directory, and that statement outranks a name — in
+    both directions. `src/main/java/**/OrderIT.java` is production code that a
+    convention happens to match, and counting it inflates a test population in
+    the one direction a coverage figure must never be wrong about. The field met
+    it as *"`--compact` counts 1 test file that is actually in `src/main`"*, with
+    the verdict (0.0 %, critical) right and the numerator wrong.
     """
     if declared_test_root(path) is not None:
         return True
+    if _under_main_root(_parts(path)):
+        return False
+    normalized = _norm(path)
+    return any(p.search(normalized) for p in _TEST_NAME_PATTERNS)
+
+
+def matches_test_naming(path: str) -> bool:
+    """Whether ``path`` *looks* like a test by convention alone — a test-shaped
+    directory segment or file name — with no source-root reasoning at all.
+
+    Published because one caller genuinely needs the weaker question. Inside a
+    module that is itself test infrastructure (`test-framework/`, `testsuite/`),
+    a file in an `it` package or named `TestResource` is a test even though it
+    sits under `src/main`: the module has no product to belong to. Everywhere
+    else the declared root outranks the name and `is_test_path` is the question
+    to ask — this one, used alone, is the C1-2 defect.
+    """
+    parts = _parts(path)
+    for i, part in enumerate(parts[:-1]):
+        if part not in _TEST_DIR_NAMES:
+            continue
+        if part in _AMBIGUOUS_TEST_DIR_NAMES and (set(parts[:i]) & _DOC_ROOT_NAMES):
+            continue
+        return True
     normalized = _norm(path)
     return any(p.search(normalized) for p in _TEST_NAME_PATTERNS)
 

{sourcecode-4.5.3.dist-info → sourcecode-4.6.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.5.3
+Version: 4.6.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.5.3-blue)
+![Version](https://img.shields.io/badge/version-4.6.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -97,7 +97,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.5.3 — and, on a build that has aged,
+ask version                    # ask 4.6.0 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-4.5.3.dist-info → sourcecode-4.6.0.dist-info}/RECORD

@@ -1,13 +1,13 @@
-sourcecode/__init__.py,sha256=TB3NC3ZIhSq8CPZFlNi9Y6qRAqfWAwRIj4a5XRpDjx0,308
+sourcecode/__init__.py,sha256=4dXthmwMtG3-Py64d-gE1ZDK9uCes0_GCsrNgSGBt3I,308
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
-sourcecode/archetype.py,sha256=HBGTTaS-bVHS6pdacPUMKcMxklkDEKnZMgz48Kc3yec,37630
+sourcecode/archetype.py,sha256=CZvRLpkHot_D8D3JFQVorr-EHDJyh0BbS7RnSTqBigM,40499
 sourcecode/architectural_baseline.py,sha256=agDSwGEakdkgLLh5xnd3hiD_TC6pRujWt4klnuYF1wo,18689
 sourcecode/architectural_delta.py,sha256=E6MkyjWl-1ZgR4KSKnI785gUAfc8nq-lK-jd_rupQBU,12496
 sourcecode/architecture_analyzer.py,sha256=GFc4ek-s1IHWM7pl-0L32WahZ93AmDgrAMcOuBKA5Dk,61463
 sourcecode/architecture_summary.py,sha256=BVVRHd952cjRhjHnR6CPrvKgaa-tdM16l-pBi1yDCPs,32395
 sourcecode/ast_extractor.py,sha256=aXJjZ7XjAdxa99hWNm4SyzPqx4gNWiTbUYjNWGNl-Vc,51213
-sourcecode/baseline_autocapture.py,sha256=xxfXT9Nu4uiDbWMZRawcCXsA4fjgEjZW2qI173dq3GE,14962
-sourcecode/cache.py,sha256=Es9ZLqGRoheMv2bOD1azaFKqU2zJKJVudHhjQKcIxy8,40128
+sourcecode/baseline_autocapture.py,sha256=tmMLexQSeaQRRbqxAd7walvGQqnF0mdpxQmkL40rlhI,15623
+sourcecode/cache.py,sha256=9XJUNSGzqM6DNWy4erUO-OcZY9qkrTCCcOJ-OANVrw8,41409
 sourcecode/cache_model.py,sha256=hUGWNKBKLV76mGveFffOzr9fqFD1ZydJVakseRsg14s,17401
 sourcecode/call_surface.py,sha256=fiqYfHooxN1fX9oQoysq1LS3LoZcobhyUNjAGEZKpwk,4148
 sourcecode/caller_metrics.py,sha256=--sFGDnIog_YGu9xZHMcB91F5xZakfaAKvy15xU54hg,7904
@@ -17,7 +17,7 @@ sourcecode/chain_rules.py,sha256=Bi6UHfgd-GxWswmnHRcPz5jdbAuqka3Zkz_P-MTvqhw,127
 sourcecode/change_plan.py,sha256=kFjjp16XYbupgkv1CPkfqo39_SiZPMRQ8OOfC-Vy9eg,7929
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=J9pEXkcMWFHg0FXW6CxWa69zvP2DHHOXlgliKXNc4Dc,492534
+sourcecode/cli.py,sha256=iTTJJyP4yugJ37xOA-G7W0WslC31d7fL4If-Gx4mIpM,492713
 sourcecode/client_calls.py,sha256=daRTgbXNUOfkzGXJpVb6A737R_Thhka8vw1_YgxCaLg,13548
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=xq3zsqAOAw4AWkoD9khb9xDP_O3KvwqO9k-pf8sbi3g,10951
@@ -48,7 +48,7 @@ sourcecode/envelope.py,sha256=fpF_8znvPqGXKZb0UPYcCYjm27yO7Pr-WsdXNE-tEoY,8911
 sourcecode/environment_resolution.py,sha256=2cEsF741-Cb6PR9Hiv57BpOTWl4gEnHMQsiRzcNcjJM,18872
 sourcecode/error_schema.py,sha256=uwosfNaSujtYm11_732Hu92z5ITV040fQDaIyefSvR4,1683
 sourcecode/evidence_provider.py,sha256=GSSL44JEaouO5AHks2sB3d1YvC9xIKIld1yBYxZpXxo,4277
-sourcecode/explain.py,sha256=8i1gQL8qNUO6NuUmzgO4vYdGGBn5_lp-1XqI9LPyx2k,25271
+sourcecode/explain.py,sha256=yqxvKiLF0XMMg11PdgqMFrsim5SXuEKM1U2cLvCLspM,29935
 sourcecode/file_chunker.py,sha256=3vkM3mDQ5eE_yTPvUgjyjpGFBIjkW6_mrBmIbrylnA8,16444
 sourcecode/file_classifier.py,sha256=pJCeN9KqWpAwKMCgGP4KDsBjuWMeo4zlbj5fv3hk9dA,15587
 sourcecode/filter_surface.py,sha256=HeV1qU0y_UO95KNTy3Xb551zXvv7_ns2gyxCS5uC3fs,16418
@@ -73,10 +73,10 @@ sourcecode/openrewrite_recipe.py,sha256=4dyY5twRB6Xew-G9Zy5FafNZwlMU1S7DnRa2FqPk
 sourcecode/output_budget.py,sha256=__DQrIg7MGsYrd0_S3lyd3AG0a0jWNGr55v5Gg9kK0U,12347
 sourcecode/parse_cache.py,sha256=SnHOhNTvAqHm_PXImPVBuj7NEoOQRn8dfIZHEqOFENs,7565
 sourcecode/path_admission.py,sha256=OGNSoluhVh8YYOBZBnACUrkmH4Tp_yxjGLifkcsxQpo,5838
-sourcecode/path_filters.py,sha256=9yk8fA29sZSPyvI8UjF6fIOY37Hd3hs8txUiNXsQGwg,11182
+sourcecode/path_filters.py,sha256=LmTYq735orssKTIuxTX1mE1FHAXF7dVEJEse35xE1RA,12371
 sourcecode/perf.py,sha256=GAcEoouPIlPMCQIcHNToxK6K3WdIR-lj9aFg4prOYJI,9743
 sourcecode/pipe_contract.py,sha256=PML0Er5d8uDyec4OrdUXuyqHbGPUYndjeaKUjkFz2u4,8369
-sourcecode/posture.py,sha256=x1LY98XSjZzG4xThZYJYK3e5BTYDmJhyg5eqJ5KquNk,72999
+sourcecode/posture.py,sha256=nmvlJOBwnwV5aAOmO7GMfU35hNgArCQFSuESsYzcS8s,76101
 sourcecode/pr_comment_renderer.py,sha256=239PmJdf95av_ZW236C7_tvq_ahECeuF9AZxrheJ4OQ,15573
 sourcecode/pr_impact.py,sha256=eaFgcPMDsjaF8VZvcitFWCPCabMTi-khtGdxpK0wXTQ,22461
 sourcecode/prepare_context.py,sha256=B8TiBQbazxUOz6D37Dt9zqbOtD5b2S_fR3MB15P9DrI,237206
@@ -91,9 +91,9 @@ sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcr
 sourcecode/remedies.py,sha256=8lgvKkW1WuBG-QfTnA0uBhEKnwWGSvgSMWCfTjzYhEY,6516
 sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg,12965
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=uuJsPmtgSEi4MKVKJEiZl8bpvU1QFU2Oslxn96p5xi8,356849
+sourcecode/repository_ir.py,sha256=yrQd8yB9NO0M2SLkI0bQ5ty1RjTldQOhVbr3IoNkXJk,357437
 sourcecode/ris.py,sha256=SjjDNMcc9Zr9us9G8ikBVkoPXKK3BpM-dBodSGMh_g4,24783
-sourcecode/risk.py,sha256=cgkHu4fjAyLs9xSytegdv4b8ua8RqRJEQ5rHbQKgzfo,34851
+sourcecode/risk.py,sha256=xYzXMINAkA1lGdlTiBpK9ODhor3c_UrNtL33P88mGJs,39850
 sourcecode/rule_catalog.py,sha256=buU6qZI1j1EjqAWOIzeDhZ9kO_6Tp_Ma-dmexNWkMe0,4324
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/sarif.py,sha256=_3ggbtV0O2iK5zeUiJSS36KxpPRVAtGy0hzXAFBmww8,25590
@@ -111,7 +111,7 @@ sourcecode/servlet_surface.py,sha256=kwIBS6aT-DJHu8mqzvhlYrhaqAq_005SDAeVZ7yx8Y0
 sourcecode/source_text.py,sha256=Q5v5kAq2QFZ-HcaK5UXp_xZTbiLiFW5p09v7r_hQHnU,4878
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=qgWz4LLL5TFe3eG-mTttlrDTx-6ps3EOuLA-S2HvQCM,16945
-sourcecode/spring_impact.py,sha256=KkThpPmBbBJk_1H8f0cVWOuz6vBN-yX5qcTQ3Sjmjnk,74797
+sourcecode/spring_impact.py,sha256=SW7gyjnzf1f9dLH296s1-EmxgZvitl1MjHAnTQlUfmQ,78145
 sourcecode/spring_model.py,sha256=zOAgFmrRbG4a6KLm1TJl55aWMyPNsz3OS3FSczqPG6A,16594
 sourcecode/spring_profiles.py,sha256=-kwrCK0O-MRjrCp6SA1d31t--o4Tg87iqPVrTwxoIUs,19605
 sourcecode/spring_properties.py,sha256=kPTk5qAJxdbHc1hclhHAP0O-hCIzBn8PTh3lzl-I4a4,8400
@@ -121,7 +121,7 @@ sourcecode/spring_tx_analyzer.py,sha256=_wqjRktqdPS6PiXXxtTkCD1t6BaE2uhqx6ioYY-U
 sourcecode/summarizer.py,sha256=0aD4x3vgPngqBCEBKGuES1J2Vk5f7mqCm_ZWErwm3js,27025
 sourcecode/target_admission.py,sha256=wFZ4pzlxhiF6Q6s2lEAZEzcCfj1Y6xNvujjt8MdO0Qo,7154
 sourcecode/test_gap_ranking.py,sha256=hl-tTyQUXZGJycG1b6npbLeE_DaVHaOsvPwG9qqC5y8,15711
-sourcecode/test_sources.py,sha256=cMGVNLbYZZ2yt2PVcySK4scbjKpCLDAKhIViyWN_pRM,6986
+sourcecode/test_sources.py,sha256=6qXI47rVt_DFEbziFUyU-_KIUIGt8YQ5Uf4-sdiAhKU,9277
 sourcecode/token_estimate.py,sha256=G-ivzIJfVq5TLQN04dC0WK4LZJjWVYL54Ebcxe4fJ7M,9268
 sourcecode/tree_utils.py,sha256=8GAkIfQAsvtEudIeW1l4ooH_oRtrWR8cpJQJsEa_Pfw,2093
 sourcecode/type_usage_surface.py,sha256=51IrKRQoIoRnlsiDjHnqpJBn2rc6E59aRhgS0HTzAF0,4428
@@ -190,8 +190,8 @@ sourcecode/telemetry/consent.py,sha256=pQdl-QeLl6Gcibn0eWHSKZrm-HYSsjpVqOnjrgFp8
 sourcecode/telemetry/events.py,sha256=4_yeO58U-Cwc1Qb27VB0_EjhmroY0k91n3_VGxeALB8,2776
 sourcecode/telemetry/filters.py,sha256=RzxauTz8HliO4BllQnXEXc7zTeqdCZi5MgqGEDuW7OQ,6570
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-4.5.3.dist-info/METADATA,sha256=md2ShdxOBK6RppqSdpqL8YjqIDoo3PRAHMZxb96YT64,34161
-sourcecode-4.5.3.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-4.5.3.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-4.5.3.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-4.5.3.dist-info/RECORD,,
+sourcecode-4.6.0.dist-info/METADATA,sha256=6XkofNasppQ6luCtFPesmVOf4wVVd-JWSACEyVw85r4,34161
+sourcecode-4.6.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-4.6.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-4.6.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-4.6.0.dist-info/RECORD,,