sourcecode 4.6.0__py3-none-any.whl → 4.7.0__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.6.0"
+__version__ = "4.7.0"

sourcecode/cli.py

@@ -354,7 +354,7 @@ of files) in minutes. Semantic analysis itself is sub-second; repo indexing domi
   ask --agent                  [dim]# full structured JSON for AI agents[/dim]
 
 [bold]Change and risk:[/bold]
-  impact-chain <Class> .       [dim]# blast radius w/ TX + security per hop[/dim]
+  impact-chain <Class> .       [dim]# blast radius; TX/SEC findings opt-in[/dim]
   impact <Class> .             [dim]# reverse deps → endpoints reached[/dim]
   pr-impact . --files -        [dim]# same, scoped to a diff on stdin; gating codes[/dim]
   posture . --since main       [dim]# did this branch open an endpoint? (exp.)[/dim]
@@ -8419,8 +8419,16 @@ def impact_chain_cmd(
              "surfaces). Totals stay exact in metadata/truncated_lists. "
              "0 disables the cap.",
     ),
+    with_findings: bool = typer.Option(
+        False, "--with-findings",
+        help=(
+            "Also run the repository-wide TX + security audit and filter findings "
+            "to this chain. Off by default so query cost follows the queried "
+            "subgraph rather than the whole repository."
+        ),
+    ),
 ) -> None:
-    """Spring impact-chain: systemic blast radius of a symbol with TX/SEC enrichment.
+    """Spring impact-chain: systemic blast radius of a symbol; TX/SEC findings are opt-in.
 
     \b
     Given a symbol (class or method), returns:
@@ -8431,6 +8439,7 @@ def impact_chain_cmd(
       - security_surfaces   — per-endpoint security verdict + confidence
                               (security_posture authority) + declared policy + SEC findings
       - impact_findings     — TX/SEC audit findings touching the call chain
+                              (only with --with-findings)
       - risk_level          — critical | high | medium | low
 
     \b
@@ -8537,7 +8546,10 @@ def impact_chain_cmd(
         )
         return
 
-    result = run_impact_chain(cir, symbol, depth=depth, root=target, model=_model)
+    result = run_impact_chain(
+        cir, symbol, depth=depth, root=target, model=_model,
+        include_findings=with_findings,
+    )
 
     data = result.to_dict()
     # Same rule as `impact`: a file is a request for the whole answer (C2-2). An

sourcecode/detectors/java.py

@@ -457,6 +457,10 @@ class JavaDetector(AbstractDetector):
             or "resteasy" in text       # RESTEasy — a JAX-RS implementation
         ):
             frameworks.append(FrameworkDetection(name="JAX-RS", source=source))
+        if "com.sun.jersey" in text or "org.glassfish.jersey" in text:
+            frameworks.append(FrameworkDetection(name="Jersey", source=source))
+        if "com.netflix.governator" in text:
+            frameworks.append(FrameworkDetection(name="Governator", source=source))
         if "mybatis" in text:
             frameworks.append(FrameworkDetection(name="MyBatis", source=source))
         if "thymeleaf" in text:

sourcecode/mcp/registry.py

@@ -1324,13 +1324,14 @@ min_severity: "low" (default) | "medium" | "high" | "critical"
 """
 
     _IMPACT_CHAIN_DOC = """\
-Spring impact-chain: blast radius of a symbol with TX/SEC semantic enrichment. JAVA/SPRING ONLY.
+Spring impact-chain: blast radius of a symbol. TX/SEC findings are opt-in. JAVA/SPRING ONLY.
 
 Do NOT call on non-Java repositories — returns resolution=not_found.
 
 Two query modes via query_type:
   "impact" (default) — BFS call graph: direct_callers, indirect_callers, endpoints_affected,
-    transaction_boundary, security_surfaces, impact_findings (TX/SEC patterns in call chain).
+    transaction_boundary, security_surfaces. impact_findings are populated only when
+    with_findings=true, because that runs a repository-wide TX + security audit.
   "events" — event topology: publishers, consumers, propagation graph for an event class
     or event publisher. Use when symbol is an event class (e.g. OrderPlacedEvent).
 
@@ -1344,6 +1345,7 @@ symbol: FQN, class name, or Class#method.
 repo_path: absolute path to the Java repository (default: current working directory).
 depth: BFS traversal depth 1–8 (default 4).
 query_type: "impact" (default) | "events"
+with_findings: false (default) | true to run the repository-wide TX + security audit
 """
 
     spring_audit = _alias_spec(
@@ -1374,7 +1376,7 @@ query_type: "impact" (default) | "events"
 
     impact_chain = _alias_spec(
         "impact_chain",
-        "Spring impact-chain: blast radius + TX/SEC enrichment. JAVA/SPRING ONLY.",
+        "Spring impact-chain: blast radius; TX/SEC findings opt-in. JAVA/SPRING ONLY.",
         ("impact-chain",),
         (
             ToolParamSpec("symbol", "argument", str, required=True, default=None,
@@ -1386,6 +1388,9 @@ query_type: "impact" (default) | "events"
             ToolParamSpec("query_type", "option", str, required=False, default="impact",
                           option_names=("--type",), choices=("impact", "events"),
                           help="impact (default) = call-chain blast radius; events = event topology"),
+            ToolParamSpec("with_findings", "option", bool, required=False, default=False,
+                          option_names=("--with-findings",), is_flag=True,
+                          help="Run TX + security audit and filter findings to this chain."),
         ),
         lambda inputs: [
             "impact-chain",
@@ -1393,7 +1398,7 @@ query_type: "impact" (default) | "events"
             str(inputs.get("repo_path", ".")),
             "--depth", str(inputs.get("depth", 4)),
             "--type", str(inputs.get("query_type", "impact")),
-        ],
+        ] + (["--with-findings"] if inputs.get("with_findings") else []),
         supported_targets=("repo_path", "class_name"),
         unsupported_targets=("file_path",),
         validator=validate_repo_path,

sourcecode/mcp/server.py

@@ -883,24 +883,31 @@ def get_migration_readiness(repo_path: str = ".", min_severity: str = "low") ->
 
 
 @mcp.tool()
-def get_impact_chain(repo_path: str = ".", symbol: str = "", depth: int = 4) -> dict:
-    """Spring impact-chain: systemic blast radius of a symbol with TX/SEC semantic enrichment. JAVA/SPRING ONLY.
+def get_impact_chain(
+    repo_path: str = ".",
+    symbol: str = "",
+    depth: int = 4,
+    with_findings: bool = False,
+) -> dict:
+    """Spring impact-chain: systemic blast radius of a symbol. TX/SEC findings are opt-in. JAVA/SPRING ONLY.
 
     Do NOT call this on non-Java repositories — it will return resolution=not_found.
 
-    Maps to: ask impact-chain <symbol> <repo_path> [--depth <depth>]
+    Maps to: ask impact-chain <symbol> <repo_path> [--depth <depth>] [--with-findings]
     Returns: ImpactChainResult with schema_version, symbol, resolution,
              direct_callers, indirect_callers, endpoints_affected,
              transaction_boundary (propagation/isolation/read_only),
              security_surfaces (per-endpoint verdict/confidence from the
              security_posture authority + declared policy + finding IDs),
-             impact_findings (TX-001..005 + SEC-001..003 findings in call chain),
+             impact_findings (TX/SEC/DEAD findings in call chain, only when
+             with_findings=true),
              analysis_warnings, risk_level, confidence, metadata.
 
     symbol: FQN, class name, or Class#method. Examples:
             "OrderService", "com.example.OrderService#placeOrder"
     repo_path: absolute path to the Java repository (default: current working directory).
     depth: BFS depth for indirect caller traversal (1–8, default: 4).
+    with_findings: run repository-wide TX + security audit and filter findings to this chain.
     """
     _raw = repo_path
     try:
@@ -915,6 +922,8 @@ def get_impact_chain(repo_path: str = ".", symbol: str = "", depth: int = 4) ->
         if _path_err is not None:
             return _path_err
         args = ["impact-chain", symbol.strip(), repo_path, "--depth", str(depth)]
+        if with_findings:
+            args.append("--with-findings")
         timeout_ms = int(os.environ.get("SOURCECODE_IMPACT_TIMEOUT_MS", str(_DEFAULT_IMPACT_TIMEOUT_MS)))
         timeout_s = timeout_ms / 1000.0
         _exec = concurrent.futures.ThreadPoolExecutor(max_workers=1)

sourcecode/migrate_check.py

@@ -1472,6 +1472,11 @@ class MigrationReport:
     # dimension scores it aggregates) so the headline number is fully traceable.
     readiness_aggregate: dict = field(default_factory=dict)
     blocking_count: int = 0
+    # Critical/high product findings on dimensions that participate in the
+    # migration-readiness headline. `blocking_count` remains the broad product
+    # blocker count for backward compatibility; this one excludes orthogonal JDK
+    # upkeep that never feeds readiness_score.
+    migration_blocking_count: int = 0
     # C1-12: null when the total is not a point (a range slice contributes to it).
     # The span always exists — read estimated_effort_range_days for the number.
     estimated_effort_days: Optional[float] = 0.0
@@ -1567,6 +1572,11 @@ class MigrationReport:
         self.blocking_count = sum(
             1 for f in main_findings if f.severity in ("critical", "high")
         )
+        self.migration_blocking_count = sum(
+            1 for f in main_findings
+            if f.severity in ("critical", "high")
+            and f.migration_target in _BOOT3_MIGRATION_TARGETS
+        )
 
         # Per-dimension readiness — independent severity-weighted scores (MAIN only).
         self.jakarta_readiness = _dimension_score(main_findings, _JAKARTA_TARGETS)
@@ -1941,6 +1951,7 @@ class MigrationReport:
             "by_rule": by_rule,
             "by_migration_target": by_target,
             "main_findings": len(main_findings),
+            "migration_blocking_findings": self.migration_blocking_count,
             "non_blocking_findings": self.non_blocking["count"],
             "hygiene_findings": self.hygiene_findings,
         }
@@ -1993,10 +2004,21 @@ class MigrationReport:
                 "(jakarta / boot3 / hibernate); see readiness_aggregate for the exact "
                 "inputs. N/A dimensions are excluded (never counted as 0); "
                 "jdk_modernization is orthogonal upkeep and is NOT in the aggregate. "
-                "For decisions read the per-dimension breakdown + blocking_count."
+                "For decisions read the per-dimension breakdown + "
+                "migration_blocking_count."
             ),
             "headline_blocker": self.headline_blocker,
             "blocking_count": self.blocking_count,
+            "blocking_count_basis": (
+                "critical/high findings in product code across every target, including "
+                "orthogonal JDK modernization"
+            ),
+            "migration_blocking_count": self.migration_blocking_count,
+            "migration_blocking_count_basis": (
+                "critical/high product-code findings whose targets feed the migration "
+                "readiness aggregate (jakarta / boot3 / spring_security_6). Excludes "
+                "orthogonal JDK modernization."
+            ),
             "estimated_effort_days": self.estimated_effort_days,
             "estimated_effort_range_days": self.estimated_effort_range_days,
             "estimated_effort_note": (
@@ -2116,6 +2138,7 @@ class MigrationReport:
                f"(readiness_score reflects jakarta/Boot3 only — Hibernate is a separate rewrite axis)"]
               if self.headline_blocker else []),
             f"Spring present: {self.spring_present}    Spring Boot 2 detected: {_boot}",
+            f"Migration blockers (readiness dimensions): {self.migration_blocking_count}",
             f"Blocking issues (product code): {self.blocking_count}  "
             f"(critical: {main_crit}, high: {main_high})"
             + (f"   [+{nb} in test/generated, non-blocking]" if nb else ""),

sourcecode/perf.py

@@ -37,6 +37,9 @@ SCHEMA_VERSION = "perf-baseline-v1"
 #: guesses: repo discovery, what-is-this-repo detection+enrichment, model
 #: assembly + semantic/contract extraction, and output rendering.
 PHASES: tuple[str, ...] = ("discovery", "detection", "analysis", "serialize")
+SCALE_DIMENSIONS: tuple[str, ...] = (
+    "files", "symbols", "classes", "methods", "endpoints", "findings",
+)
 
 #: Env var that arms the in-process recorder.
 ENV_ENABLE = "SOURCECODE_PERF"
@@ -248,12 +251,24 @@ def build_baseline_cell(
             phase_ms[ph] = None
         phase_ms["instrumentation"] = "absent"
 
+    repo_dict = dict(repo)
+    scale_dimensions = {
+        key: repo_dict[key]
+        for key in SCALE_DIMENSIONS
+        if key in repo_dict
+    }
+
     return {
         "schema_version": SCHEMA_VERSION,
         "tool_version": tool_version,
         "captured_at": captured_at or datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
         "command": command,
-        "repo": dict(repo),
+        "repo": repo_dict,
+        "scale_dimensions": scale_dimensions,
+        "scale_dimensions_basis": (
+            "The repository axes this timing is expected to scale over. A performance "
+            "claim without these dimensions is not comparable across repositories."
+        ),
         "mode": mode,
         "runs": len(wall_ms_runs),
         "wall_ms": {
@@ -266,3 +281,99 @@ def build_baseline_cell(
         "rss_peak_bytes": _stat_block(rss_bytes_runs) if rss_bytes_runs else None,
         "env": dict(env) if env is not None else collect_env(),
     }
+
+
+def regression_gate(
+    baseline: Mapping[str, object],
+    current: Mapping[str, object],
+    *,
+    max_regression: float = 0.25,
+    allow_incomparable: bool = False,
+) -> dict[str, object]:
+    """Compare two perf cells and decide whether the current run regressed.
+
+    Same-host comparability is mandatory by default. Timing deltas compare p50
+    and p95 wall time; either one breaching the threshold fails the gate.
+    """
+    comparable, reasons = _perf_comparability(baseline, current)
+    if not comparable and not allow_incomparable:
+        return {
+            "status": "incomparable",
+            "passed": False,
+            "reasons": reasons,
+            "threshold": max_regression,
+            "basis": (
+                "Perf regressions are gated only between comparable cells: same "
+                "schema, command, repo, mode and hostname_hash."
+            ),
+        }
+
+    def _wall(cell: Mapping[str, object], key: str) -> float | None:
+        wall = cell.get("wall_ms")
+        if not isinstance(wall, Mapping):
+            return None
+        val = wall.get(key)
+        return float(val) if isinstance(val, (int, float)) else None
+
+    deltas: dict[str, object] = {}
+    failures: list[str] = []
+    for key in ("p50", "p95"):
+        base = _wall(baseline, key)
+        head = _wall(current, key)
+        if base is None or head is None or base <= 0:
+            deltas[key] = {"status": "unmeasured", "baseline": base, "current": head}
+            continue
+        ratio = (head - base) / base
+        deltas[key] = {
+            "baseline": base,
+            "current": head,
+            "delta": round(head - base, 3),
+            "regression_ratio": round(ratio, 4),
+            "regression_percent": round(ratio * 100.0, 2),
+        }
+        if ratio > max_regression:
+            failures.append(key)
+
+    return {
+        "status": "fail" if failures else "pass",
+        "passed": not failures,
+        "threshold": max_regression,
+        "failed_metrics": failures,
+        "deltas": deltas,
+        "scale_dimensions": {
+            "baseline": baseline.get("scale_dimensions")
+            or (
+                baseline.get("repo")
+                if isinstance(baseline.get("repo"), Mapping) else {}
+            ),
+            "current": current.get("scale_dimensions")
+            or (
+                current.get("repo")
+                if isinstance(current.get("repo"), Mapping) else {}
+            ),
+        },
+        "basis": (
+            "Fails when current wall_ms.p50 or wall_ms.p95 exceeds the comparable "
+            f"baseline by more than {max_regression:.0%}. Unexplained regressions "
+            "must be attributed or accepted by updating the baseline deliberately."
+        ),
+    }
+
+
+def _perf_comparability(
+    baseline: Mapping[str, object],
+    current: Mapping[str, object],
+) -> tuple[bool, list[str]]:
+    reasons: list[str] = []
+    for key in ("schema_version", "command", "mode"):
+        if baseline.get(key) != current.get(key):
+            reasons.append(f"{key} differs")
+    base_repo = baseline.get("repo") if isinstance(baseline.get("repo"), Mapping) else {}
+    cur_repo = current.get("repo") if isinstance(current.get("repo"), Mapping) else {}
+    if base_repo.get("name") != cur_repo.get("name"):
+        reasons.append("repo.name differs")
+    base_env = baseline.get("env") if isinstance(baseline.get("env"), Mapping) else {}
+    cur_env = current.get("env") if isinstance(current.get("env"), Mapping) else {}
+    if base_env.get("hostname_hash") != cur_env.get("hostname_hash"):
+        reasons.append("env.hostname_hash differs")
+    return not reasons, reasons

sourcecode/rule_catalog.py

@@ -34,7 +34,7 @@ class Rule:
     """One audit rule, as a reader meets it."""
 
     id: str
-    family: str        # "TX" or "SEC" — the scope flag that selects it
+    family: str        # "TX", "SEC", "DEAD" — the help grouping
     summary: str       # one line, no wrapping games
 
     def to_dict(self) -> dict:
@@ -55,9 +55,16 @@ RULES: tuple[Rule, ...] = (
     Rule("SEC-005", "SEC", "CSRF disabled under session-bearing authentication"),
     Rule("SEC-006", "SEC", "Cookie created without the Secure attribute"),
     Rule("SEC-007", "SEC", "Credential stored in a deployment descriptor"),
+    Rule("SEC-008", "SEC", "SQL built by MyBatis string interpolation"),
+    Rule("DEAD-001", "DEAD", "Security control present but disabled"),
 )
 
-FAMILY_ORDER: tuple[str, ...] = ("TX", "SEC")
+FAMILY_ORDER: tuple[str, ...] = ("TX", "SEC", "DEAD")
+_FAMILY_LABELS = {
+    "TX": "TX anomalies",
+    "SEC": "security surface",
+    "DEAD": "disabled controls",
+}
 
 
 def ids() -> tuple[str, ...]:
@@ -84,7 +91,7 @@ def range_label(family: str) -> str:
 def summary_line() -> str:
     """The command's one-liner: the families and how far each one reaches."""
     return " + ".join(
-        f"{'TX anomalies' if fam == 'TX' else 'security surface'} "
+        f"{_FAMILY_LABELS.get(fam, fam)} "
         f"({range_label(fam)})"
         for fam in FAMILY_ORDER
         if for_family(fam)

sourcecode/security_config_scan.py

@@ -121,6 +121,71 @@ _DESCRIPTOR_VALUE = re.compile(
 _DESCRIPTOR_NAMES = ("web.xml",)
 _DESCRIPTOR_SUFFIXES = ("-context.xml",)
 
+# ── SEC-008: MyBatis string interpolation in mapper SQL ──────────────────────
+# F-B. In MyBatis, `#{param}` binds a parameter and `${param}` splices text into
+# the SQL. That distinction is local, syntactic and mapper-specific: a `${}` in
+# another XML dialect is not this rule's evidence.
+_MYBATIS_MAPPER = re.compile(r"<mapper\b", re.IGNORECASE)
+_MYBATIS_SQL_TAG = re.compile(
+    r"<(?P<tag>select|insert|update|delete)\b[^>]*>(?P<body>.*?)</(?P=tag)>",
+    re.IGNORECASE | re.DOTALL,
+)
+_MYBATIS_INTERPOLATION = re.compile(r"\$\{\s*(?P<param>[^}]+?)\s*\}")
+
+# ── DEAD-001: security control present but switched off in a comment ─────────
+# F-A. E-2 taught the forward half: commented-out code must not be reported as
+# live. The reverse half is product signal: a protection written and then
+# commented out is not "absent"; somebody already knew it was needed.
+_COMMENTED_JAVA_CONTROLS: tuple[tuple[re.Pattern, str, str], ...] = (
+    (
+        re.compile(r"\bsetSecure\s*\(\s*true\s*\)"),
+        "secure_cookie_attribute",
+        "A cookie Secure-attribute control is present only in a Java comment. "
+        "The running code can still create cookies without that transport guard.",
+    ),
+    (
+        re.compile(r"\bcsrfTokenRepository\s*\(|\bcsrf\s*\([^)]*\)\s*;"),
+        "csrf_control",
+        "A CSRF control is present only in a Java comment. Commented security "
+        "configuration is a disabled mitigation, not evidence the route is protected.",
+    ),
+)
+_COMMENTED_XML_CONTROLS: tuple[tuple[re.Pattern, str, str], ...] = (
+    (
+        re.compile(
+            r"<transport-guarantee>\s*CONFIDENTIAL\s*</transport-guarantee>",
+            re.IGNORECASE,
+        ),
+        "transport_guarantee_confidential",
+        "A CONFIDENTIAL transport guarantee is present only in an XML comment. "
+        "The descriptor documents a TLS-only control that the container will not enforce.",
+    ),
+    (
+        re.compile(r"<security-constraint\b", re.IGNORECASE),
+        "security_constraint",
+        "A servlet security constraint is present only in an XML comment. The "
+        "container ignores that block, so it cannot protect the declared URL patterns.",
+    ),
+    (
+        re.compile(r"<intercept-url\b[^>]*\baccess\s*=", re.IGNORECASE),
+        "spring_security_intercept_url",
+        "A Spring Security intercept-url rule is present only in an XML comment. "
+        "The filter chain will not enforce a commented authorization rule.",
+    ),
+)
+_COMMENTED_CONFIG_CONTROLS: tuple[tuple[re.Pattern, str, str], ...] = (
+    (
+        re.compile(
+            r"^[ \t]*#[ \t]*(?:server\.servlet\.session\.cookie\.secure|secure)"
+            r"\s*[:=]\s*true\s*$",
+            re.IGNORECASE,
+        ),
+        "secure_cookie_property",
+        "A cookie Secure-attribute property is present only in a comment. The "
+        "configuration records the intended control but does not apply it.",
+    ),
+)
+
 
 @dataclass(frozen=True)
 class SecurityConfigObservation:
@@ -292,6 +357,96 @@ def _scan_descriptor(text: str, rel: str) -> "list[SecurityConfigObservation]":
     return out
 
 
+def _scan_mybatis_mapper(text: str, rel: str) -> "list[SecurityConfigObservation]":
+    """SEC-008 — SQL text built with MyBatis `${}` interpolation."""
+    if not _MYBATIS_MAPPER.search(text):
+        return []
+    out: "list[SecurityConfigObservation]" = []
+    for statement in _MYBATIS_SQL_TAG.finditer(text):
+        body = statement.group("body")
+        for match in _MYBATIS_INTERPOLATION.finditer(body):
+            absolute = statement.start("body") + match.start()
+            param = " ".join(match.group("param").split())
+            out.append(SecurityConfigObservation(
+                rule="SEC-008",
+                file=rel,
+                line=_line_of(text, absolute),
+                symbol=rel,
+                evidence=f"${{{param}}}",
+                detail=(
+                    "A MyBatis mapper builds SQL with `${...}` interpolation. MyBatis "
+                    "`#{...}` binds a value as a parameter; `${...}` splices text into "
+                    "the SQL statement, so request-controlled values can change the "
+                    "query structure unless this value is strictly allowlisted."
+                ),
+            ))
+    return out
+
+
+def _comment_excerpt(text: str) -> str:
+    """Compact comment text for evidence; strips comment delimiters, not meaning."""
+    cleaned = re.sub(r"^\s*(?://|/\*+|<!--|#)", "", text.strip())
+    cleaned = re.sub(r"(?:\*/|-->)\s*$", "", cleaned.strip())
+    cleaned = " ".join(cleaned.split())
+    return cleaned[:120] + ("..." if len(cleaned) > 120 else "")
+
+
+def _scan_commented_controls(
+    source: str,
+    rel: str,
+    *,
+    xml: bool = False,
+) -> "list[SecurityConfigObservation]":
+    """DEAD-001 — security controls visible only inside comments."""
+    from sourcecode.source_text import commented_spans
+
+    rules = _COMMENTED_XML_CONTROLS if xml else _COMMENTED_JAVA_CONTROLS
+    out: "list[SecurityConfigObservation]" = []
+    seen: set[tuple[str, int]] = set()
+    for start, end in commented_spans(source, xml=xml):
+        text = source[start:end]
+        for pattern, symbol, detail in rules:
+            if not pattern.search(text):
+                continue
+            line = _line_of(source, start)
+            key = (symbol, line)
+            if key in seen:
+                continue
+            seen.add(key)
+            out.append(SecurityConfigObservation(
+                rule="DEAD-001",
+                file=rel,
+                line=line,
+                symbol=symbol,
+                evidence=_comment_excerpt(text),
+                detail=detail,
+            ))
+            break
+    return out
+
+
+def _scan_commented_config_controls(
+    source: str,
+    rel: str,
+) -> "list[SecurityConfigObservation]":
+    """DEAD-001 for whole-line commented properties/YAML controls."""
+    out: "list[SecurityConfigObservation]" = []
+    for number, line in enumerate(source.splitlines(), start=1):
+        for pattern, symbol, detail in _COMMENTED_CONFIG_CONTROLS:
+            if not pattern.match(line):
+                continue
+            out.append(SecurityConfigObservation(
+                rule="DEAD-001",
+                file=rel,
+                line=number,
+                symbol=symbol,
+                evidence=_comment_excerpt(line),
+                detail=detail,
+            ))
+            break
+    return out
+
+
 def _shared_across_environments(
     observations: "list[SecurityConfigObservation]",
 ) -> "list[SecurityConfigObservation]":
@@ -368,6 +523,7 @@ def scan_security_configuration(
             source = (root / rel).read_text(encoding="utf-8", errors="replace")
         except OSError:
             continue
+        out.extend(_scan_commented_controls(source, rel, xml=False))
         out.extend(_scan_java(blank_java_comments(source), rel))
 
     if config_files is None:
@@ -382,6 +538,7 @@ def scan_security_configuration(
             text = (root / rel).read_text(encoding="utf-8", errors="replace")
         except OSError:
             continue
+        out.extend(_scan_commented_config_controls(text, rel))
         out.extend(_scan_config(blank_hash_comments(text), rel))
 
     # CL-10 — the descriptors. Discovered the same way `environment_resolution`
@@ -401,8 +558,23 @@ def scan_security_configuration(
             text = (root / rel).read_text(encoding="utf-8", errors="replace")
         except OSError:
             continue
+        out.extend(_scan_commented_controls(text, rel, xml=True))
         out.extend(_scan_descriptor(blank_xml_comments(text), rel))
 
+    mappers: "list[str]" = []
+    try:
+        for path in root.rglob("*.xml"):
+            if path.name.endswith("Mapper.xml"):
+                mappers.append(path.relative_to(root).as_posix())
+    except OSError:
+        pass
+    for rel in sorted(set(mappers) - set(descriptors)):
+        try:
+            text = (root / rel).read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        out.extend(_scan_mybatis_mapper(blank_xml_comments(text), rel))
+
     return sorted(
         _shared_across_environments(out), key=lambda o: (o.rule, o.file, o.line)
     )

sourcecode/source_text.py

@@ -91,9 +91,8 @@ def commented_spans(source: str, *, xml: bool) -> "list[tuple[int, int]]":
     delete. A control that is present but commented out is not noise: somebody
     decided it was needed and then turned it off, which is the most actionable
     thing a reader can be told about a security surface. E-2's fix removes those
-    matches from the findings; this is what a future rule reports them *as*
-    (DEAD-001, queued as F-A). Nothing consumes it yet — it exists so the two
-    halves cannot drift apart when it does.
+    matches from the live findings; `security_config_scan` consumes this inverse
+    view as DEAD-001, so the two halves cannot drift apart.
     """
     pattern = _XML_COMMENT if xml else _JAVA_TOKENS
     spans: "list[tuple[int, int]]" = []

sourcecode/spring_impact.py

@@ -841,6 +841,7 @@ class ImpactOrchestrator:
         depth: int = _BFS_DEFAULT_DEPTH,
         root: Optional[Path] = None,
         prebuilt_findings: Optional[list[SpringFinding]] = None,
+        include_findings: bool = False,
     ) -> ImpactChainResult:
         """Execute impact-chain query for symbol.
 
@@ -851,7 +852,10 @@ class ImpactOrchestrator:
             depth:             BFS depth for indirect caller traversal.
             root:              Repo root path (for TX-005 source reading).
             prebuilt_findings: Pre-run audit findings (avoids double audit).
-                               If None, runs TX + SEC audit internally.
+                               When supplied, impact findings are computed from it.
+            include_findings: Run the repository-wide TX + SEC audit when no
+                              prebuilt findings are supplied. Defaults false so a
+                              chain query cost follows the chain, not the full repo.
         """
         t0 = time.monotonic()
         depth = max(1, min(depth, _BFS_HARD_LIMIT))
@@ -1067,20 +1071,28 @@ class ImpactOrchestrator:
             pass
 
         # ── 5. TX + SEC audit findings, filtered to call chain ────────────
-        # The security audit already derives the posture projection; take it from
-        # there rather than deriving the same answer a second time (ADR-0008 R1).
+        # C3-42-b: findings are now an explicit enrichment. A chain query whose
+        # caller only asked "what reaches this symbol?" must not pay for a full
+        # repository TX + security audit and then filter almost all of it away.
+        # If a caller needs findings, it either supplies a prebuilt audit or opts in.
         posture_dict: dict = {}
-        # C3-42. This is a **repository-wide** audit, run inside what the payload
-        # then publishes as `query_time_ms` — so a reader comparing that figure
-        # against `model_build_time_ms` is comparing a model build against a model
-        # build plus a full audit of every file. The share is measured and named
-        # rather than hidden: the cost is real, and which part of it is the walk is
-        # the first thing anyone reporting a slow query needs to know.
+        findings_status = "not_computed"
         _audit_t0 = time.monotonic()
         if prebuilt_findings is not None:
             all_findings = prebuilt_findings
-        else:
+            findings_status = "prebuilt"
+        elif include_findings:
+            # The security audit already derives the posture projection; take it
+            # from there rather than deriving the same answer a second time
+            # (ADR-0008 R1).
+            #
+            # C3-42. This is a **repository-wide** audit, run inside what the
+            # payload then publishes as `query_time_ms`. It is now opt-in and its
+            # share remains measured so a slow enriched query names the paid term.
             all_findings, posture_dict = _run_audit_for_chain(cir, model, root)
+            findings_status = "computed"
+        else:
+            all_findings = []
         audit_ms = round((time.monotonic() - _audit_t0) * 1000, 2)
 
         impact_findings_raw = _filter_findings(
@@ -1448,22 +1460,28 @@ class ImpactOrchestrator:
                 "caller_metric_note": CALLER_METRIC_RECONCILIATION,
                 "endpoints_total": len(endpoints_affected),
                 "findings_in_chain": len(impact_findings),
+                "findings_status": findings_status,
+                "findings_status_note": (
+                    "impact_findings were not computed; by default impact-chain skips "
+                    "the repository-wide TX + security audit so query cost correlates "
+                    "with the queried chain. Pass --with-findings or prebuilt findings "
+                    "to compute this enrichment."
+                    if findings_status == "not_computed" else
+                    "impact_findings were filtered from prebuilt audit findings."
+                    if findings_status == "prebuilt" else
+                    "impact_findings were computed by running the repository-wide TX + "
+                    "security audit and filtering it to this chain."
+                ),
                 "risk_score": risk_score,
                 "model_build_time_ms": model.build_time_ms,
                 "query_time_ms": elapsed_ms,
-                # What that number is made of. A field report of
-                # `query_time_ms: 1 187 063` beside `model_build_time_ms: 516`
-                # reads as a 2 300× graph walk; the walk is the difference between
-                # these two figures, and on every repository measured here the
-                # repository-wide audit is the larger part (C3-42).
                 "audit_time_ms": audit_ms,
                 "query_time_basis": (
-                    "wall time of the whole call, which includes a repository-wide "
-                    "TX + security audit (`audit_time_ms`) whose findings are then "
-                    "filtered to this chain. The graph walk itself is "
+                    "wall time of the whole call. The repository-wide TX + security "
+                    "audit is skipped by default; when findings_status is `computed`, "
+                    "`audit_time_ms` is the opt-in audit share and the graph walk is "
                     "`query_time_ms - audit_time_ms`. `model_build_time_ms` covers "
-                    "the semantic model only, so the two are not comparable as they "
-                    "stand"
+                    "the semantic model only."
                 ),
                 "blind_spots": blind_spots,
                 "reconciliation": reconciliation_findings,
@@ -1491,6 +1509,11 @@ def _run_audit_for_chain(
     from sourcecode.spring_security_audit import run_security_audit
     from sourcecode.spring_tx_analyzer import run_tx_audit
 
+    root_key = str(Path(root).resolve()) if root is not None else ""
+    cache = getattr(cir, _AUDIT_CACHE_ATTR, None)
+    if isinstance(cache, dict) and root_key in cache:
+        return cache[root_key]
+
     findings: list[SpringFinding] = []
     posture: dict = {}
     try:
@@ -1504,11 +1527,20 @@ def _run_audit_for_chain(
         posture = getattr(sec_result, "security_posture", None) or {}
     except Exception:
         pass
-    return findings, posture
+    answer = (findings, posture)
+    try:
+        if not isinstance(cache, dict):
+            cache = {}
+            setattr(cir, _AUDIT_CACHE_ATTR, cache)
+        cache[root_key] = answer
+    except Exception:
+        pass
+    return answer
 
 
 # Per-CIR memo of the endpoint security authority's answer (one derivation per repo).
 _SURFACE_CACHE_ATTR = "_impact_endpoint_security_surface"
+_AUDIT_CACHE_ATTR = "_impact_chain_audit_findings"
 
 
 def _endpoint_security_authority(
@@ -1562,6 +1594,7 @@ def run_impact_chain(
     root: Optional[Path] = None,
     model: Optional[SpringSemanticModel] = None,
     prebuilt_findings: Optional[list[SpringFinding]] = None,
+    include_findings: bool = False,
 ) -> ImpactChainResult:
     """Run impact-chain query from a CIR.
 
@@ -1573,6 +1606,8 @@ def run_impact_chain(
         model:             Pre-built SpringSemanticModel. Built internally if None.
         prebuilt_findings: Pre-run SpringFinding list. Avoids double audit if
                            impact-chain runs after spring-audit in the same session.
+        include_findings: Run TX + security audit internally when no prebuilt
+                          findings are supplied. Defaults false for query cost.
 
     Returns ImpactChainResult — always JSON-serializable, never raises.
     """
@@ -1584,6 +1619,7 @@ def run_impact_chain(
             cir, model, symbol,
             depth=depth, root=root,
             prebuilt_findings=prebuilt_findings,
+            include_findings=include_findings,
         )
     except Exception as exc:
         return ImpactChainResult(

sourcecode/spring_security_audit.py

@@ -8,6 +8,8 @@ Patterns implemented (Phase 3):
   SEC-005  CSRF disabled under session-bearing authentication (CL-9)
   SEC-006  Cookie created without the Secure attribute (CL-9)
   SEC-007  Credential stored in a deployment descriptor (CL-10)
+  SEC-008  SQL built by MyBatis string interpolation (F-B)
+  DEAD-001 Security control present but disabled (F-A)
 
 All patterns are deterministic and never raise.
 """
@@ -387,8 +389,10 @@ def _controller_source_file(cir: "CanonicalRepositoryIR", controller_fqn: str) -
 
 class _SEC00XConfigurationWeaknesses:
     """The textbook rules (CL-9): SEC-004 password storage, SEC-005 CSRF under
-    session authentication, SEC-006 a cookie without the Secure attribute — and
-    SEC-007 (CL-10), a credential stored in a deployment descriptor.
+    session authentication, SEC-006 a cookie without the Secure attribute,
+    SEC-007 (CL-10), a credential stored in a deployment descriptor,
+    SEC-008 (F-B), SQL built by mapper interpolation, and DEAD-001 (F-A), a
+    security control present but disabled in a comment.
 
     One pattern for three rules because they share a scan of the same files, and
     because the alternative — three passes over the source per audit — is how a
@@ -406,12 +410,16 @@ class _SEC00XConfigurationWeaknesses:
         "SEC-004": "high", "SEC-005": "medium", "SEC-006": "medium",
         # A credential every reader of the repository already holds.
         "SEC-007": "high",
+        "SEC-008": "high",
+        "DEAD-001": "high",
     }
     _TITLE = {
         "SEC-004": "Password stored under a fast unsalted digest",
         "SEC-005": "CSRF protection disabled under session-bearing authentication",
         "SEC-006": "Cookie created without the Secure attribute",
         "SEC-007": "Credential stored in a deployment descriptor",
+        "SEC-008": "SQL built by MyBatis string interpolation",
+        "DEAD-001": "Security control present but disabled",
     }
     #: A pattern that emits more than one rule id declares them all, so a catalogue
     #: reader is never left with the group's identity standing for the group.
@@ -439,6 +447,16 @@ class _SEC00XConfigurationWeaknesses:
             "retire it — and give each environment its own, so the least protected "
             "deployment stops deciding the strength of the others."
         ),
+        "SEC-008": (
+            "Replace `${...}` with `#{...}` for values. If the interpolated token is "
+            "an identifier such as an ORDER BY column, map it through a closed "
+            "allowlist before it reaches the mapper."
+        ),
+        "DEAD-001": (
+            "Decide explicitly: either restore the commented control and verify it in "
+            "the active profile, or delete the dead block with a note explaining the "
+            "replacement control. Do not leave security posture encoded as comments."
+        ),
     }
 
     def analyze(

sourcecode/verify_rules.py

@@ -232,7 +232,7 @@ def _audit_findings(cir: Any, root: "Optional[Path]" = None) -> list[Any]:
     ten contracts over the same repository run the audit once.
 
     **`root` is not optional in practice, and C1-24 is why.** Half of the shipped
-    security rules — SEC-004…SEC-007 — are produced by `security_config_scan`,
+    security rules — SEC-004…SEC-008 and DEAD-001 — are produced by `security_config_scan`,
     which reads source and descriptor *text*; `SecurityScanner.analyze` returns
     an empty list when it has no root to read from. This function used to call
     `run_security_audit(cir, model=model)` with no root, so it saw the CIR

{sourcecode-4.6.0.dist-info → sourcecode-4.7.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.6.0
+Version: 4.7.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.6.0-blue)
+![Version](https://img.shields.io/badge/version-4.7.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -97,7 +97,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.6.0 — and, on a build that has aged,
+ask version                    # ask 4.7.0 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -211,7 +211,7 @@ Bounded, noise-free repo context designed to drop straight into an agent's conte
 
 ### 2 · Impact Analysis
 Blast radius from a class or interface — reverse dependencies, through Spring DI, to the HTTP endpoints a change reaches.
-`ask impact` · `ask impact-chain` (TX/SEC-enriched) · `ask pr-impact`
+`ask impact` · `ask impact-chain` (blast radius; `--with-findings` for TX/SEC audit findings) · `ask pr-impact`
 → [reference](docs/USER_GUIDE.md#core-commands)
 
 ### 3 · Architecture Intelligence

{sourcecode-4.6.0.dist-info → sourcecode-4.7.0.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=4dXthmwMtG3-Py64d-gE1ZDK9uCes0_GCsrNgSGBt3I,308
+sourcecode/__init__.py,sha256=gF1pcXBiZrYfXSksXAH0CHm4BhYKU2-GNCDgZSMnIPM,308
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/archetype.py,sha256=CZvRLpkHot_D8D3JFQVorr-EHDJyh0BbS7RnSTqBigM,40499
 sourcecode/architectural_baseline.py,sha256=agDSwGEakdkgLLh5xnd3hiD_TC6pRujWt4klnuYF1wo,18689
@@ -17,7 +17,7 @@ sourcecode/chain_rules.py,sha256=Bi6UHfgd-GxWswmnHRcPz5jdbAuqka3Zkz_P-MTvqhw,127
 sourcecode/change_plan.py,sha256=kFjjp16XYbupgkv1CPkfqo39_SiZPMRQ8OOfC-Vy9eg,7929
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=iTTJJyP4yugJ37xOA-G7W0WslC31d7fL4If-Gx4mIpM,492713
+sourcecode/cli.py,sha256=BY4rr4FXnTwsNOygW59U1GipD_NyNy5icdfcn24ewKQ,493157
 sourcecode/client_calls.py,sha256=daRTgbXNUOfkzGXJpVb6A737R_Thhka8vw1_YgxCaLg,13548
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=xq3zsqAOAw4AWkoD9khb9xDP_O3KvwqO9k-pf8sbi3g,10951
@@ -65,7 +65,7 @@ sourcecode/jdk_exports.py,sha256=fCrlwNAXUT9gge_joq6kMnY3zJxYB2pxqy-0w3o3MJI,874
 sourcecode/license.py,sha256=vvgE1vBUWh8ozWI7USYuteh6noxntnjuzDQIPF-l4rA,27795
 sourcecode/mcp_nudge.py,sha256=lKemOqK_wny2u7Ymcr2Idi5Kx8pXY02jCi-_nJYLGMg,2992
 sourcecode/metrics_analyzer.py,sha256=gLoRWKygF18jLgwsqmGXSWopw-f5iO1VbM7Jjdif6ag,22809
-sourcecode/migrate_check.py,sha256=jMv1GMhMthpHCnoEtkKWHiIC2Not2kdbU4UaA9sWX7I,134643
+sourcecode/migrate_check.py,sha256=ktNAI24Og-8IJo5lzveuTxmjasK2CJpUyv5LLEUVxK8,135908
 sourcecode/migration_blast.py,sha256=OPryWkM6-PbvcG3eJFdcWUnlpXBje41nu2BkrZnE2hg,9359
 sourcecode/non_coverage.py,sha256=lQZCdvHz4c_Gr0PIugkybOvSVwiaWvpCesq2p_9HtNk,11823
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
@@ -74,7 +74,7 @@ sourcecode/output_budget.py,sha256=__DQrIg7MGsYrd0_S3lyd3AG0a0jWNGr55v5Gg9kK0U,1
 sourcecode/parse_cache.py,sha256=SnHOhNTvAqHm_PXImPVBuj7NEoOQRn8dfIZHEqOFENs,7565
 sourcecode/path_admission.py,sha256=OGNSoluhVh8YYOBZBnACUrkmH4Tp_yxjGLifkcsxQpo,5838
 sourcecode/path_filters.py,sha256=LmTYq735orssKTIuxTX1mE1FHAXF7dVEJEse35xE1RA,12371
-sourcecode/perf.py,sha256=GAcEoouPIlPMCQIcHNToxK6K3WdIR-lj9aFg4prOYJI,9743
+sourcecode/perf.py,sha256=2YlJTXjyur1S7hecOMz_joUHAXE5bkcZ85a_LXBEcHQ,13931
 sourcecode/pipe_contract.py,sha256=PML0Er5d8uDyec4OrdUXuyqHbGPUYndjeaKUjkFz2u4,8369
 sourcecode/posture.py,sha256=nmvlJOBwnwV5aAOmO7GMfU35hNgArCQFSuESsYzcS8s,76101
 sourcecode/pr_comment_renderer.py,sha256=239PmJdf95av_ZW236C7_tvq_ahECeuF9AZxrheJ4OQ,15573
@@ -94,13 +94,13 @@ sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ
 sourcecode/repository_ir.py,sha256=yrQd8yB9NO0M2SLkI0bQ5ty1RjTldQOhVbr3IoNkXJk,357437
 sourcecode/ris.py,sha256=SjjDNMcc9Zr9us9G8ikBVkoPXKK3BpM-dBodSGMh_g4,24783
 sourcecode/risk.py,sha256=xYzXMINAkA1lGdlTiBpK9ODhor3c_UrNtL33P88mGJs,39850
-sourcecode/rule_catalog.py,sha256=buU6qZI1j1EjqAWOIzeDhZ9kO_6Tp_Ma-dmexNWkMe0,4324
+sourcecode/rule_catalog.py,sha256=SEFLMOdngn2Oo4giWb9wX-k_5ZrH5fFdEbhjEAlotYs,4555
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/sarif.py,sha256=_3ggbtV0O2iK5zeUiJSS36KxpPRVAtGy0hzXAFBmww8,25590
 sourcecode/scanner.py,sha256=z3CV0rcGunu0Y8mpNgp07wI7nxT0pxw1BkXRRtI0Rpo,9609
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
 sourcecode/security_config.py,sha256=KblMEoRiEjrIE68YsPaUAFebxFp8UM7MS7lAk5CGD8U,3531
-sourcecode/security_config_scan.py,sha256=9MC3N9G3627jOsP9SI2et_TQEUbdlmxuHq1Ycm-msBg,16920
+sourcecode/security_config_scan.py,sha256=FFI16W982cDokc5nf2zwuB8DcilEUR_rQa6eIu7gg4A,23949
 sourcecode/security_posture.py,sha256=CjJ2Qm87HhKXepnaWx1ncJLW-SxI18udCmUDIkCyAsY,50270
 sourcecode/semantic_analyzer.py,sha256=bpgdC6m0_ftVtRf3rSdwhbhWjnZnGxRXaZVcfe4BbcQ,95414
 sourcecode/semantic_impact_engine.py,sha256=t09IirGC3JjQDy33JZd1_WKzQVKXkoNl3-XEUr5kjis,20563
@@ -108,14 +108,14 @@ sourcecode/semantic_integration_engine.py,sha256=7a0WqAInOv39f0Yr_94TYo_JP_8QpeI
 sourcecode/semantic_services.py,sha256=nbUuPv-F01USTt_9CHT8iy_ucCIw3fz4W3Aquea_pd4,10782
 sourcecode/serializer.py,sha256=T1-Ybi6aPczxiz11N_nfuZ_jUMQVBMExeWuYHCUjKPc,139222
 sourcecode/servlet_surface.py,sha256=kwIBS6aT-DJHu8mqzvhlYrhaqAq_005SDAeVZ7yx8Y0,8165
-sourcecode/source_text.py,sha256=Q5v5kAq2QFZ-HcaK5UXp_xZTbiLiFW5p09v7r_hQHnU,4878
+sourcecode/source_text.py,sha256=5ZOqD04Vpdc6Jl6tUlkpeXtM3wXYC297hczZ71iksVk,4819
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=qgWz4LLL5TFe3eG-mTttlrDTx-6ps3EOuLA-S2HvQCM,16945
-sourcecode/spring_impact.py,sha256=SW7gyjnzf1f9dLH296s1-EmxgZvitl1MjHAnTQlUfmQ,78145
+sourcecode/spring_impact.py,sha256=MFx0I6ElRTpjWPGgX5C8XY1gZmR3-bk6Ky9FJHpKbAk,79822
 sourcecode/spring_model.py,sha256=zOAgFmrRbG4a6KLm1TJl55aWMyPNsz3OS3FSczqPG6A,16594
 sourcecode/spring_profiles.py,sha256=-kwrCK0O-MRjrCp6SA1d31t--o4Tg87iqPVrTwxoIUs,19605
 sourcecode/spring_properties.py,sha256=kPTk5qAJxdbHc1hclhHAP0O-hCIzBn8PTh3lzl-I4a4,8400
-sourcecode/spring_security_audit.py,sha256=KIjshNuS-cQSUBstqCuvDnp5i1J4_qAwXYKJArL2QpI,28720
+sourcecode/spring_security_audit.py,sha256=BHKgEQCKlAgwzY3xnRm1HYYfVpwY6sAVGp1tRnkFQUg,29687
 sourcecode/spring_semantic.py,sha256=UrmLg_4gmBVmMqvSnUMgSReVEERVGv3X7LYDBEs6k_o,16598
 sourcecode/spring_tx_analyzer.py,sha256=_wqjRktqdPS6PiXXxtTkCD1t6BaE2uhqx6ioYY-ULAw,44153
 sourcecode/summarizer.py,sha256=0aD4x3vgPngqBCEBKGuES1J2Vk5f7mqCm_ZWErwm3js,27025
@@ -129,7 +129,7 @@ sourcecode/validation_inference.py,sha256=-oWJqE6PqkqcZbCFDJeWCQHgI9Dbuv5ggJWD3L
 sourcecode/validation_surface.py,sha256=jYL-hkDjaaRKkAt7ZUcbxm3Dydl8o6KVRhTkuPXKPVc,31460
 sourcecode/verify_edit.py,sha256=Toqx4z47gLUmcj5F673eTFq1dE_6e4T3mXVesjkPx6g,35955
 sourcecode/verify_repo.py,sha256=ltSP1nFc726k2aTHCu5dfhxQgxQwz3nrUNDMDN-aDa8,12158
-sourcecode/verify_rules.py,sha256=kqo-tuqOfxSti3jIVS-bJtbSV5b1KxdigOR0j5Wr_XM,19388
+sourcecode/verify_rules.py,sha256=YxG5JkDXBVpwbU1_tIKVtU8_eaF3zjpsq05tjpN4Z7Y,19401
 sourcecode/version_check.py,sha256=CHp6ZxTIfo8kyHPCBgJA1uFC0xQCoXMuuOfrW8QTL8o,4942
 sourcecode/workspace.py,sha256=X_6NmNnitvT3_38V-JDChydo_sR68s249hLFlrQskU0,8271
 sourcecode/detectors/__init__.py,sha256=A0AACJFF6HWf_RgatNtWu3PUzstcKtIGM9f1PoFcJug,1987
@@ -141,7 +141,7 @@ sourcecode/detectors/elixir.py,sha256=jCpvt5Yi6jvplc80ovRtWh17q-11ZGo9qX7o8b57TJ
 sourcecode/detectors/go.py,sha256=2r66uRQfeTWsqxr4HDhT6vExZErby0t46QXLHVBRv9w,2782
 sourcecode/detectors/heuristic.py,sha256=7cRxrip4yIaggYzZJB6ef8yHKh-gHgiH_pXMFcjlyFU,3723
 sourcecode/detectors/hybrid.py,sha256=IGFRUVsAZ1ooRlFdznCeJAV6vy1yVDx-VyghvLtddXc,9101
-sourcecode/detectors/java.py,sha256=PmCbiUDDnnJ7jjv6BuQQBDnyzeEBXrA_YPXrdnZW7vU,44471
+sourcecode/detectors/java.py,sha256=Xr9n9GXBAtFB9EE9SMWG7Ix1qi6sweTGpDfLbLgAr4k,44751
 sourcecode/detectors/jvm_ext.py,sha256=EgHJ5W8EE-ZTN9V607mVzohyKgZE8Mc2jCi-DF8RAZU,2616
 sourcecode/detectors/nodejs.py,sha256=Hg3Gmr7yIMJFiLoDwOTk2wtu00wxIs6kZf-oQujTFUA,13187
 sourcecode/detectors/parsers.py,sha256=ug9K31tyHqinmv0HkIVQVjdTZpBv67FYKAEf52YXOSM,3178
@@ -157,9 +157,9 @@ sourcecode/facts/__init__.py,sha256=JpMjDb7BSaM1a9UQU91YYKr2HJ5tOOuNRCIeQwN8_2o,
 sourcecode/facts/registry.json,sha256=_N3iy2pfYfljtWtcwjKFZwYPNuOPJE8Evxy5WpUDG1c,14084
 sourcecode/mcp/__init__.py,sha256=XU4HfRGbdid8wdUA0x_4f7uKZD1z3mv_XUY_WU_T9Mw,179
 sourcecode/mcp/orchestrator.py,sha256=wTZ47WgFYpbDGlKMofVSdCJU5TAatD6YVGlut2FlT34,36737
-sourcecode/mcp/registry.py,sha256=Cf_ftaby5XfGZU4zq0oqBzyvSher65vDAKIRXz5bIWQ,68582
+sourcecode/mcp/registry.py,sha256=p9GJtQLeiPaUWlSnlL0o7wo4A0Jjw9-LXVRWqTkJXj4,69061
 sourcecode/mcp/runner.py,sha256=RGimCwhLyHxjCvH7q72y12HWEnATXZLC-NBWhkzlu0I,2852
-sourcecode/mcp/server.py,sha256=l1-eU9C0Sljz38llzgPmPaF1Q-A1CAFF_WN1M6DsL2g,65705
+sourcecode/mcp/server.py,sha256=0lN5G4MkyRm57pGjmmiU1zKVHUFK-OLnbTNxDf1HrkA,65958
 sourcecode/mcp/onboarding/__init__.py,sha256=sj2PWqEBmMc4zBNkomg89WtL0M6S7A9yb7_wAuSWNP4,66
 sourcecode/mcp/onboarding/applier.py,sha256=Sx9vHTaXr_M1Bs4uMjO7qa_a2_p4J9oz93oJsKQ7ds4,3298
 sourcecode/mcp/onboarding/backup.py,sha256=ihqGOR8QTX8HASRSEDyfFyXr5bkXrygPHamv4p9KTmk,1452
@@ -190,8 +190,8 @@ sourcecode/telemetry/consent.py,sha256=pQdl-QeLl6Gcibn0eWHSKZrm-HYSsjpVqOnjrgFp8
 sourcecode/telemetry/events.py,sha256=4_yeO58U-Cwc1Qb27VB0_EjhmroY0k91n3_VGxeALB8,2776
 sourcecode/telemetry/filters.py,sha256=RzxauTz8HliO4BllQnXEXc7zTeqdCZi5MgqGEDuW7OQ,6570
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-4.6.0.dist-info/METADATA,sha256=6XkofNasppQ6luCtFPesmVOf4wVVd-JWSACEyVw85r4,34161
-sourcecode-4.6.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-4.6.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-4.6.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-4.6.0.dist-info/RECORD,,
+sourcecode-4.7.0.dist-info/METADATA,sha256=LuAnOSnbticxEPgM0-gzikRwKa5oeorlKWtzsTJk26U,34203
+sourcecode-4.7.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-4.7.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-4.7.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-4.7.0.dist-info/RECORD,,