sourcecode 4.6.0__tar.gz → 4.7.0__tar.gz

{sourcecode-4.6.0 → sourcecode-4.7.0}/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ## [Unreleased]
 
+## [4.7.0] — 2026-08-04
+
+### Fixed
+
+- **`impact-chain` no longer pays a repository-wide TX + security audit by default.**
+  `impact_findings` is now opt-in with `--with-findings`, so the common query cost
+  follows the queried subgraph instead of the whole repository.
+- **`migrate-check` now separates migration blockers from broad blockers.**
+  The payload publishes `migration_blocking_count` while keeping the legacy
+  `blocking_count` for compatibility.
+- **Disabled security controls are reported explicitly.** Commented-out
+  framework security annotations now emit `DEAD-001`, and security catalog/help
+  output includes disabled-control findings.
+- **MyBatis SQL interpolation is classified as SQL-injection risk.** Mapper
+  `${...}` interpolation emits `SEC-008` instead of being treated as a generic
+  raw SQL smell.
+- **Performance claims now have endpoint-scale coverage.** The battery includes
+  a high-endpoint fixture, publishes scale dimensions, and gates unexplained
+  performance regressions against prior measurements.
+- **Framework detection covers Jersey and Governator.** Migration/readiness
+  output no longer misses those stacks when scanning mixed Java repositories.
+
 ## [4.6.0] — 2026-08-04
 
 Field evaluation #11 (7,5/10), by the evaluator who measured 4.5.2 twelve hours

{sourcecode-4.6.0 → sourcecode-4.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.6.0
+Version: 4.7.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.6.0-blue)
+![Version](https://img.shields.io/badge/version-4.7.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -97,7 +97,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.6.0 — and, on a build that has aged,
+ask version                    # ask 4.7.0 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -211,7 +211,7 @@ Bounded, noise-free repo context designed to drop straight into an agent's conte
 
 ### 2 · Impact Analysis
 Blast radius from a class or interface — reverse dependencies, through Spring DI, to the HTTP endpoints a change reaches.
-`ask impact` · `ask impact-chain` (TX/SEC-enriched) · `ask pr-impact`
+`ask impact` · `ask impact-chain` (blast radius; `--with-findings` for TX/SEC audit findings) · `ask pr-impact`
 → [reference](docs/USER_GUIDE.md#core-commands)
 
 ### 3 · Architecture Intelligence

{sourcecode-4.6.0 → sourcecode-4.7.0}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.6.0-blue)
+![Version](https://img.shields.io/badge/version-4.7.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -59,7 +59,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.6.0 — and, on a build that has aged,
+ask version                    # ask 4.7.0 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -173,7 +173,7 @@ Bounded, noise-free repo context designed to drop straight into an agent's conte
 
 ### 2 · Impact Analysis
 Blast radius from a class or interface — reverse dependencies, through Spring DI, to the HTTP endpoints a change reaches.
-`ask impact` · `ask impact-chain` (TX/SEC-enriched) · `ask pr-impact`
+`ask impact` · `ask impact-chain` (blast radius; `--with-findings` for TX/SEC audit findings) · `ask pr-impact`
 → [reference](docs/USER_GUIDE.md#core-commands)
 
 ### 3 · Architecture Intelligence

{sourcecode-4.6.0 → sourcecode-4.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "4.6.0"
+version = "4.7.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-4.6.0 → sourcecode-4.7.0}/scripts/perf_harness.py

@@ -201,6 +201,12 @@ def main() -> int:
     ap.add_argument("--fleet-root", type=Path, default=DEFAULT_FLEET_ROOT)
     ap.add_argument("--out", type=Path, default=None,
                     help="Output dir (default: docs/perf/baselines/<tool_version>).")
+    ap.add_argument("--compare-dir", type=Path, default=None,
+                    help="Previous perf-baseline directory to gate against.")
+    ap.add_argument("--max-regression", type=float, default=0.25,
+                    help="Allowed wall p50/p95 regression ratio before failing (default: 0.25).")
+    ap.add_argument("--allow-incomparable", action="store_true",
+                    help="Do not fail when baseline/current cells are incomparable.")
     ap.add_argument("--quick", action="store_true", help="petclinic only, 2 runs — smoke test.")
     ap.add_argument("--dry-run", action="store_true", help="Print the plan, run nothing.")
     args = ap.parse_args()
@@ -227,6 +233,7 @@ def main() -> int:
         return 0
 
     out_dir.mkdir(parents=True, exist_ok=True)
+    failures: list[tuple[str, dict]] = []
     for cmd, name, mode in plan:
         subdir = FLEET.get(name, name)
         repo_path = args.fleet_root / subdir
@@ -242,9 +249,39 @@ def main() -> int:
         fname = f"{name}__{cmd or 'ask'}__{mode}.json"
         (out_dir / fname).write_text(json.dumps(cell, indent=2) + "\n", encoding="utf-8")
         w = cell["wall_ms"]
-        print(f" p50={w['p50']}ms p95={w['p95']}ms -> {fname}")
+        gate = None
+        if args.compare_dir:
+            base_path = args.compare_dir / fname
+            if base_path.exists():
+                try:
+                    baseline = json.loads(base_path.read_text(encoding="utf-8"))
+                    gate = perf.regression_gate(
+                        baseline,
+                        cell,
+                        max_regression=args.max_regression,
+                        allow_incomparable=args.allow_incomparable,
+                    )
+                    (out_dir / f"{fname}.gate.json").write_text(
+                        json.dumps(gate, indent=2) + "\n", encoding="utf-8"
+                    )
+                    if not gate.get("passed"):
+                        failures.append((fname, gate))
+                except (OSError, ValueError) as exc:
+                    failures.append((fname, {
+                        "status": "incomparable",
+                        "passed": False,
+                        "reasons": [f"could not read baseline: {exc}"],
+                    }))
+        _gate_text = f" gate={gate['status']}" if gate else ""
+        print(f" p50={w['p50']}ms p95={w['p95']}ms{_gate_text} -> {fname}")
 
     print(f"done. artifacts in {out_dir}")
+    if failures:
+        print("perf regression gate failed:", file=sys.stderr)
+        for fname, gate in failures:
+            detail = gate.get("failed_metrics") or gate.get("reasons")
+            print(f"  {fname}: {gate.get('status')} {detail}", file=sys.stderr)
+        return 1
     return 0
 
 

{sourcecode-4.6.0 → sourcecode-4.7.0}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.6.0"
+__version__ = "4.7.0"

{sourcecode-4.6.0 → sourcecode-4.7.0}/src/sourcecode/cli.py

@@ -354,7 +354,7 @@ of files) in minutes. Semantic analysis itself is sub-second; repo indexing domi
   ask --agent                  [dim]# full structured JSON for AI agents[/dim]
 
 [bold]Change and risk:[/bold]
-  impact-chain <Class> .       [dim]# blast radius w/ TX + security per hop[/dim]
+  impact-chain <Class> .       [dim]# blast radius; TX/SEC findings opt-in[/dim]
   impact <Class> .             [dim]# reverse deps → endpoints reached[/dim]
   pr-impact . --files -        [dim]# same, scoped to a diff on stdin; gating codes[/dim]
   posture . --since main       [dim]# did this branch open an endpoint? (exp.)[/dim]
@@ -8419,8 +8419,16 @@ def impact_chain_cmd(
              "surfaces). Totals stay exact in metadata/truncated_lists. "
              "0 disables the cap.",
     ),
+    with_findings: bool = typer.Option(
+        False, "--with-findings",
+        help=(
+            "Also run the repository-wide TX + security audit and filter findings "
+            "to this chain. Off by default so query cost follows the queried "
+            "subgraph rather than the whole repository."
+        ),
+    ),
 ) -> None:
-    """Spring impact-chain: systemic blast radius of a symbol with TX/SEC enrichment.
+    """Spring impact-chain: systemic blast radius of a symbol; TX/SEC findings are opt-in.
 
     \b
     Given a symbol (class or method), returns:
@@ -8431,6 +8439,7 @@ def impact_chain_cmd(
       - security_surfaces   — per-endpoint security verdict + confidence
                               (security_posture authority) + declared policy + SEC findings
       - impact_findings     — TX/SEC audit findings touching the call chain
+                              (only with --with-findings)
       - risk_level          — critical | high | medium | low
 
     \b
@@ -8537,7 +8546,10 @@ def impact_chain_cmd(
         )
         return
 
-    result = run_impact_chain(cir, symbol, depth=depth, root=target, model=_model)
+    result = run_impact_chain(
+        cir, symbol, depth=depth, root=target, model=_model,
+        include_findings=with_findings,
+    )
 
     data = result.to_dict()
     # Same rule as `impact`: a file is a request for the whole answer (C2-2). An

{sourcecode-4.6.0 → sourcecode-4.7.0}/src/sourcecode/detectors/java.py

@@ -457,6 +457,10 @@ class JavaDetector(AbstractDetector):
             or "resteasy" in text       # RESTEasy — a JAX-RS implementation
         ):
             frameworks.append(FrameworkDetection(name="JAX-RS", source=source))
+        if "com.sun.jersey" in text or "org.glassfish.jersey" in text:
+            frameworks.append(FrameworkDetection(name="Jersey", source=source))
+        if "com.netflix.governator" in text:
+            frameworks.append(FrameworkDetection(name="Governator", source=source))
         if "mybatis" in text:
             frameworks.append(FrameworkDetection(name="MyBatis", source=source))
         if "thymeleaf" in text:

{sourcecode-4.6.0 → sourcecode-4.7.0}/src/sourcecode/mcp/registry.py

@@ -1324,13 +1324,14 @@ min_severity: "low" (default) | "medium" | "high" | "critical"
 """
 
     _IMPACT_CHAIN_DOC = """\
-Spring impact-chain: blast radius of a symbol with TX/SEC semantic enrichment. JAVA/SPRING ONLY.
+Spring impact-chain: blast radius of a symbol. TX/SEC findings are opt-in. JAVA/SPRING ONLY.
 
 Do NOT call on non-Java repositories — returns resolution=not_found.
 
 Two query modes via query_type:
   "impact" (default) — BFS call graph: direct_callers, indirect_callers, endpoints_affected,
-    transaction_boundary, security_surfaces, impact_findings (TX/SEC patterns in call chain).
+    transaction_boundary, security_surfaces. impact_findings are populated only when
+    with_findings=true, because that runs a repository-wide TX + security audit.
   "events" — event topology: publishers, consumers, propagation graph for an event class
     or event publisher. Use when symbol is an event class (e.g. OrderPlacedEvent).
 
@@ -1344,6 +1345,7 @@ symbol: FQN, class name, or Class#method.
 repo_path: absolute path to the Java repository (default: current working directory).
 depth: BFS traversal depth 1–8 (default 4).
 query_type: "impact" (default) | "events"
+with_findings: false (default) | true to run the repository-wide TX + security audit
 """
 
     spring_audit = _alias_spec(
@@ -1374,7 +1376,7 @@ query_type: "impact" (default) | "events"
 
     impact_chain = _alias_spec(
         "impact_chain",
-        "Spring impact-chain: blast radius + TX/SEC enrichment. JAVA/SPRING ONLY.",
+        "Spring impact-chain: blast radius; TX/SEC findings opt-in. JAVA/SPRING ONLY.",
         ("impact-chain",),
         (
             ToolParamSpec("symbol", "argument", str, required=True, default=None,
@@ -1386,6 +1388,9 @@ query_type: "impact" (default) | "events"
             ToolParamSpec("query_type", "option", str, required=False, default="impact",
                           option_names=("--type",), choices=("impact", "events"),
                           help="impact (default) = call-chain blast radius; events = event topology"),
+            ToolParamSpec("with_findings", "option", bool, required=False, default=False,
+                          option_names=("--with-findings",), is_flag=True,
+                          help="Run TX + security audit and filter findings to this chain."),
         ),
         lambda inputs: [
             "impact-chain",
@@ -1393,7 +1398,7 @@ query_type: "impact" (default) | "events"
             str(inputs.get("repo_path", ".")),
             "--depth", str(inputs.get("depth", 4)),
             "--type", str(inputs.get("query_type", "impact")),
-        ],
+        ] + (["--with-findings"] if inputs.get("with_findings") else []),
         supported_targets=("repo_path", "class_name"),
         unsupported_targets=("file_path",),
         validator=validate_repo_path,

{sourcecode-4.6.0 → sourcecode-4.7.0}/src/sourcecode/mcp/server.py

@@ -883,24 +883,31 @@ def get_migration_readiness(repo_path: str = ".", min_severity: str = "low") ->
 
 
 @mcp.tool()
-def get_impact_chain(repo_path: str = ".", symbol: str = "", depth: int = 4) -> dict:
-    """Spring impact-chain: systemic blast radius of a symbol with TX/SEC semantic enrichment. JAVA/SPRING ONLY.
+def get_impact_chain(
+    repo_path: str = ".",
+    symbol: str = "",
+    depth: int = 4,
+    with_findings: bool = False,
+) -> dict:
+    """Spring impact-chain: systemic blast radius of a symbol. TX/SEC findings are opt-in. JAVA/SPRING ONLY.
 
     Do NOT call this on non-Java repositories — it will return resolution=not_found.
 
-    Maps to: ask impact-chain <symbol> <repo_path> [--depth <depth>]
+    Maps to: ask impact-chain <symbol> <repo_path> [--depth <depth>] [--with-findings]
     Returns: ImpactChainResult with schema_version, symbol, resolution,
              direct_callers, indirect_callers, endpoints_affected,
              transaction_boundary (propagation/isolation/read_only),
              security_surfaces (per-endpoint verdict/confidence from the
              security_posture authority + declared policy + finding IDs),
-             impact_findings (TX-001..005 + SEC-001..003 findings in call chain),
+             impact_findings (TX/SEC/DEAD findings in call chain, only when
+             with_findings=true),
              analysis_warnings, risk_level, confidence, metadata.
 
     symbol: FQN, class name, or Class#method. Examples:
             "OrderService", "com.example.OrderService#placeOrder"
     repo_path: absolute path to the Java repository (default: current working directory).
     depth: BFS depth for indirect caller traversal (1–8, default: 4).
+    with_findings: run repository-wide TX + security audit and filter findings to this chain.
     """
     _raw = repo_path
     try:
@@ -915,6 +922,8 @@ def get_impact_chain(repo_path: str = ".", symbol: str = "", depth: int = 4) ->
         if _path_err is not None:
             return _path_err
         args = ["impact-chain", symbol.strip(), repo_path, "--depth", str(depth)]
+        if with_findings:
+            args.append("--with-findings")
         timeout_ms = int(os.environ.get("SOURCECODE_IMPACT_TIMEOUT_MS", str(_DEFAULT_IMPACT_TIMEOUT_MS)))
         timeout_s = timeout_ms / 1000.0
         _exec = concurrent.futures.ThreadPoolExecutor(max_workers=1)

{sourcecode-4.6.0 → sourcecode-4.7.0}/src/sourcecode/migrate_check.py

@@ -1472,6 +1472,11 @@ class MigrationReport:
     # dimension scores it aggregates) so the headline number is fully traceable.
     readiness_aggregate: dict = field(default_factory=dict)
     blocking_count: int = 0
+    # Critical/high product findings on dimensions that participate in the
+    # migration-readiness headline. `blocking_count` remains the broad product
+    # blocker count for backward compatibility; this one excludes orthogonal JDK
+    # upkeep that never feeds readiness_score.
+    migration_blocking_count: int = 0
     # C1-12: null when the total is not a point (a range slice contributes to it).
     # The span always exists — read estimated_effort_range_days for the number.
     estimated_effort_days: Optional[float] = 0.0
@@ -1567,6 +1572,11 @@ class MigrationReport:
         self.blocking_count = sum(
             1 for f in main_findings if f.severity in ("critical", "high")
         )
+        self.migration_blocking_count = sum(
+            1 for f in main_findings
+            if f.severity in ("critical", "high")
+            and f.migration_target in _BOOT3_MIGRATION_TARGETS
+        )
 
         # Per-dimension readiness — independent severity-weighted scores (MAIN only).
         self.jakarta_readiness = _dimension_score(main_findings, _JAKARTA_TARGETS)
@@ -1941,6 +1951,7 @@ class MigrationReport:
             "by_rule": by_rule,
             "by_migration_target": by_target,
             "main_findings": len(main_findings),
+            "migration_blocking_findings": self.migration_blocking_count,
             "non_blocking_findings": self.non_blocking["count"],
             "hygiene_findings": self.hygiene_findings,
         }
@@ -1993,10 +2004,21 @@ class MigrationReport:
                 "(jakarta / boot3 / hibernate); see readiness_aggregate for the exact "
                 "inputs. N/A dimensions are excluded (never counted as 0); "
                 "jdk_modernization is orthogonal upkeep and is NOT in the aggregate. "
-                "For decisions read the per-dimension breakdown + blocking_count."
+                "For decisions read the per-dimension breakdown + "
+                "migration_blocking_count."
             ),
             "headline_blocker": self.headline_blocker,
             "blocking_count": self.blocking_count,
+            "blocking_count_basis": (
+                "critical/high findings in product code across every target, including "
+                "orthogonal JDK modernization"
+            ),
+            "migration_blocking_count": self.migration_blocking_count,
+            "migration_blocking_count_basis": (
+                "critical/high product-code findings whose targets feed the migration "
+                "readiness aggregate (jakarta / boot3 / spring_security_6). Excludes "
+                "orthogonal JDK modernization."
+            ),
             "estimated_effort_days": self.estimated_effort_days,
             "estimated_effort_range_days": self.estimated_effort_range_days,
             "estimated_effort_note": (
@@ -2116,6 +2138,7 @@ class MigrationReport:
                f"(readiness_score reflects jakarta/Boot3 only — Hibernate is a separate rewrite axis)"]
               if self.headline_blocker else []),
             f"Spring present: {self.spring_present}    Spring Boot 2 detected: {_boot}",
+            f"Migration blockers (readiness dimensions): {self.migration_blocking_count}",
             f"Blocking issues (product code): {self.blocking_count}  "
             f"(critical: {main_crit}, high: {main_high})"
             + (f"   [+{nb} in test/generated, non-blocking]" if nb else ""),

{sourcecode-4.6.0 → sourcecode-4.7.0}/src/sourcecode/perf.py

@@ -37,6 +37,9 @@ SCHEMA_VERSION = "perf-baseline-v1"
 #: guesses: repo discovery, what-is-this-repo detection+enrichment, model
 #: assembly + semantic/contract extraction, and output rendering.
 PHASES: tuple[str, ...] = ("discovery", "detection", "analysis", "serialize")
+SCALE_DIMENSIONS: tuple[str, ...] = (
+    "files", "symbols", "classes", "methods", "endpoints", "findings",
+)
 
 #: Env var that arms the in-process recorder.
 ENV_ENABLE = "SOURCECODE_PERF"
@@ -248,12 +251,24 @@ def build_baseline_cell(
             phase_ms[ph] = None
         phase_ms["instrumentation"] = "absent"
 
+    repo_dict = dict(repo)
+    scale_dimensions = {
+        key: repo_dict[key]
+        for key in SCALE_DIMENSIONS
+        if key in repo_dict
+    }
+
     return {
         "schema_version": SCHEMA_VERSION,
         "tool_version": tool_version,
         "captured_at": captured_at or datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
         "command": command,
-        "repo": dict(repo),
+        "repo": repo_dict,
+        "scale_dimensions": scale_dimensions,
+        "scale_dimensions_basis": (
+            "The repository axes this timing is expected to scale over. A performance "
+            "claim without these dimensions is not comparable across repositories."
+        ),
         "mode": mode,
         "runs": len(wall_ms_runs),
         "wall_ms": {
@@ -266,3 +281,99 @@ def build_baseline_cell(
         "rss_peak_bytes": _stat_block(rss_bytes_runs) if rss_bytes_runs else None,
         "env": dict(env) if env is not None else collect_env(),
     }
+
+
+def regression_gate(
+    baseline: Mapping[str, object],
+    current: Mapping[str, object],
+    *,
+    max_regression: float = 0.25,
+    allow_incomparable: bool = False,
+) -> dict[str, object]:
+    """Compare two perf cells and decide whether the current run regressed.
+
+    Same-host comparability is mandatory by default. Timing deltas compare p50
+    and p95 wall time; either one breaching the threshold fails the gate.
+    """
+    comparable, reasons = _perf_comparability(baseline, current)
+    if not comparable and not allow_incomparable:
+        return {
+            "status": "incomparable",
+            "passed": False,
+            "reasons": reasons,
+            "threshold": max_regression,
+            "basis": (
+                "Perf regressions are gated only between comparable cells: same "
+                "schema, command, repo, mode and hostname_hash."
+            ),
+        }
+
+    def _wall(cell: Mapping[str, object], key: str) -> float | None:
+        wall = cell.get("wall_ms")
+        if not isinstance(wall, Mapping):
+            return None
+        val = wall.get(key)
+        return float(val) if isinstance(val, (int, float)) else None
+
+    deltas: dict[str, object] = {}
+    failures: list[str] = []
+    for key in ("p50", "p95"):
+        base = _wall(baseline, key)
+        head = _wall(current, key)
+        if base is None or head is None or base <= 0:
+            deltas[key] = {"status": "unmeasured", "baseline": base, "current": head}
+            continue
+        ratio = (head - base) / base
+        deltas[key] = {
+            "baseline": base,
+            "current": head,
+            "delta": round(head - base, 3),
+            "regression_ratio": round(ratio, 4),
+            "regression_percent": round(ratio * 100.0, 2),
+        }
+        if ratio > max_regression:
+            failures.append(key)
+
+    return {
+        "status": "fail" if failures else "pass",
+        "passed": not failures,
+        "threshold": max_regression,
+        "failed_metrics": failures,
+        "deltas": deltas,
+        "scale_dimensions": {
+            "baseline": baseline.get("scale_dimensions")
+            or (
+                baseline.get("repo")
+                if isinstance(baseline.get("repo"), Mapping) else {}
+            ),
+            "current": current.get("scale_dimensions")
+            or (
+                current.get("repo")
+                if isinstance(current.get("repo"), Mapping) else {}
+            ),
+        },
+        "basis": (
+            "Fails when current wall_ms.p50 or wall_ms.p95 exceeds the comparable "
+            f"baseline by more than {max_regression:.0%}. Unexplained regressions "
+            "must be attributed or accepted by updating the baseline deliberately."
+        ),
+    }
+
+
+def _perf_comparability(
+    baseline: Mapping[str, object],
+    current: Mapping[str, object],
+) -> tuple[bool, list[str]]:
+    reasons: list[str] = []
+    for key in ("schema_version", "command", "mode"):
+        if baseline.get(key) != current.get(key):
+            reasons.append(f"{key} differs")
+    base_repo = baseline.get("repo") if isinstance(baseline.get("repo"), Mapping) else {}
+    cur_repo = current.get("repo") if isinstance(current.get("repo"), Mapping) else {}
+    if base_repo.get("name") != cur_repo.get("name"):
+        reasons.append("repo.name differs")
+    base_env = baseline.get("env") if isinstance(baseline.get("env"), Mapping) else {}
+    cur_env = current.get("env") if isinstance(current.get("env"), Mapping) else {}
+    if base_env.get("hostname_hash") != cur_env.get("hostname_hash"):
+        reasons.append("env.hostname_hash differs")
+    return not reasons, reasons

{sourcecode-4.6.0 → sourcecode-4.7.0}/src/sourcecode/rule_catalog.py

@@ -34,7 +34,7 @@ class Rule:
     """One audit rule, as a reader meets it."""
 
     id: str
-    family: str        # "TX" or "SEC" — the scope flag that selects it
+    family: str        # "TX", "SEC", "DEAD" — the help grouping
     summary: str       # one line, no wrapping games
 
     def to_dict(self) -> dict:
@@ -55,9 +55,16 @@ RULES: tuple[Rule, ...] = (
     Rule("SEC-005", "SEC", "CSRF disabled under session-bearing authentication"),
     Rule("SEC-006", "SEC", "Cookie created without the Secure attribute"),
     Rule("SEC-007", "SEC", "Credential stored in a deployment descriptor"),
+    Rule("SEC-008", "SEC", "SQL built by MyBatis string interpolation"),
+    Rule("DEAD-001", "DEAD", "Security control present but disabled"),
 )
 
-FAMILY_ORDER: tuple[str, ...] = ("TX", "SEC")
+FAMILY_ORDER: tuple[str, ...] = ("TX", "SEC", "DEAD")
+_FAMILY_LABELS = {
+    "TX": "TX anomalies",
+    "SEC": "security surface",
+    "DEAD": "disabled controls",
+}
 
 
 def ids() -> tuple[str, ...]:
@@ -84,7 +91,7 @@ def range_label(family: str) -> str:
 def summary_line() -> str:
     """The command's one-liner: the families and how far each one reaches."""
     return " + ".join(
-        f"{'TX anomalies' if fam == 'TX' else 'security surface'} "
+        f"{_FAMILY_LABELS.get(fam, fam)} "
         f"({range_label(fam)})"
         for fam in FAMILY_ORDER
         if for_family(fam)