sourcecode 4.9.0__py3-none-any.whl → 4.9.1__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.9.0"
+__version__ = "4.9.1"

sourcecode/audit_report.py

@@ -78,6 +78,17 @@ def build_audit_report(
             "non_coverage": (risk.get("non_coverage") or {}).get("items", []),
         },
     }
+    from sourcecode.provenance import build_evidence_manifest
+    unsigned["evidence_manifest"] = build_evidence_manifest(
+        unsigned,
+        command="audit-report",
+        root=root,
+        inputs={
+            "profiles": sorted(profiles) if profiles else None,
+            "risk_limit": risk_limit,
+            "signed": bool(sign_key),
+        },
+    )
     # Sign and publish the same JSON-normalized material. Some embedded evidence
     # may contain tuples or other JSON-coercible values; normalizing before signing
     # avoids a signature over an in-memory shape the user never receives.

sourcecode/cli.py

@@ -345,7 +345,7 @@ of files) in minutes. Semantic analysis itself is sub-second; repo indexing domi
   posture . --diff dev:prod    [dim]# effective access, two profile sets (exp.)[/dim]
   endpoints .                  [dim]# endpoints + effective path + policy[/dim]
   spring-audit .               [dim]# TX anomalies + security surface[/dim]
-  migrate-check . --compact    [dim]# Boot 2→3: located blockers + effort[/dim]
+  migrate-check . --compact    [dim]# Boot 2→3 + Java LTS/licensing inventory[/dim]
   risk .                       [dim]# defects ranked by reach × access (exp.)[/dim]
 
 {_remedy_help_block()}
@@ -3875,6 +3875,11 @@ def prepare_context_cmd(
       ask prepare-context review-pr . --since main --output review.json
       ask prepare-context onboard --llm-prompt
       ask prepare-context --task-help
+
+    \b
+    Provenance:
+      JSON output includes evidence_manifest: claim IDs for context files and
+      source-backed rows, plus command inputs, ASK version, git HEAD and freshness.
     """
     from sourcecode.prepare_context import TASKS, TaskContextBuilder
 
@@ -4419,6 +4424,20 @@ def prepare_context_cmd(
             _skipped.append("test_gap_discovery")
         out["skipped_analyzers"] = _skipped
 
+    from sourcecode.provenance import build_evidence_manifest as _build_evidence_manifest
+    out["evidence_manifest"] = _build_evidence_manifest(
+        out,
+        command="prepare-context",
+        root=target,
+        inputs={
+            "task": task,
+            "since": since,
+            "format": format or "json",
+            "fast": fast,
+            "llm_prompt": llm_prompt,
+        },
+    )
+
     # P0-1: Apply output budget per task — safety net for large repos.
     _pc_budget = _prepare_context_budget(task)
 
@@ -8015,7 +8034,8 @@ def audit_report_cmd(
     This packages the same evidence `risk` and `posture` already publish into a
     report a buyer can read: top risks, effective runtime posture, source-linked
     evidence and non-coverage. It does not certify compliance, choose fixes or
-    assign ROI.
+    assign ROI. JSON includes evidence_manifest: claim IDs mapped to source spans,
+    command inputs, ASK version and freshness.
 
     \b
     `--sign-key` adds an HMAC-SHA256 signature over the canonical JSON payload.
@@ -8724,9 +8744,9 @@ def migrate_check_cmd(
         None,
         "--target-jdk",
         help=(
-            "The JDK you are actually moving to (e.g. 11, 17, 21). Rules for a "
-            "later JDK are not your blockers and are not reported. Without it, "
-            "every JDK axis is reported at once."
+            "The JDK you are actually moving to (e.g. 11, 17, 21, 25). Rules "
+            "for a later JDK are not your blockers and are not reported. Also "
+            "sets java_lts_inventory.target_lts."
         ),
     ),
     keep_boot: bool = typer.Option(
@@ -8786,7 +8806,7 @@ def migrate_check_cmd(
         help="Caller BFS depth for --blast-radius (1-8, default: 4).",
     ),
 ) -> None:
-    """Spring Boot 2→3 migration readiness: detect javax→jakarta namespace blockers.
+    """Spring Boot 2→3 migration readiness + Java LTS/licensing inventory.
 
     \b
     Detects:
@@ -8815,6 +8835,7 @@ def migrate_check_cmd(
       ask migrate-check . --compact          bounded decision summary
       ask migrate-check /path/to/repo --format text
       ask migrate-check . --min-severity high
+      ask migrate-check . --target-jdk 25       Java LTS target inventory
       ask migrate-check . --table --rule MIG-001 --band critical --top-n 20
       ask migrate-check . --output migration.json
       ask migrate-check . --snapshot --ref sprint-12   persist a readiness point
@@ -8837,6 +8858,13 @@ def migrate_check_cmd(
       <repo>/.ask/readiness-history). --trend reads that series and reports
       first→last movement — no improving/degrading label, and readiness_score is
       flagged not-comparable when the applicable dimension set changed.
+
+    \b
+    Java LTS/licensing inventory:
+      The JSON report includes java_lts_inventory: Java 8/11/17/21/25 evidence
+      from Maven/Gradle, local runtime hints and container files; target-LTS
+      blockers; and explicit Oracle JDK/licensing-review signals. This is
+      inventory evidence, not legal advice, and it never changes readiness_score.
     """
     from sourcecode.repository_ir import find_java_files
     from sourcecode.migrate_check import run_migrate_check

sourcecode/migrate_check.py

@@ -860,6 +860,282 @@ def _parse_major(version: "Optional[str]") -> "Optional[int]":
         return None
     m = re.match(r"\s*(\d+)", version)
     return int(m.group(1)) if m else None
+
+
+_MAVEN_JAVA_VERSION_RE: re.Pattern = re.compile(
+    r"<(java\.version|maven\.compiler\.(?:source|target|release))>\s*([^<${}]+)\s*</\1>",
+    re.IGNORECASE,
+)
+_MAVEN_COMPILER_TAG_RE: re.Pattern = re.compile(
+    r"<(?:source|target|release)>\s*([^<${}]+)\s*</(?:source|target|release)>",
+    re.IGNORECASE,
+)
+_GRADLE_JAVA_ENUM_RE: re.Pattern = re.compile(
+    r"JavaVersion\.VERSION_(?:1_)?(\d+)", re.IGNORECASE
+)
+_GRADLE_JAVA_ASSIGN_RE: re.Pattern = re.compile(
+    r"(?:sourceCompatibility|targetCompatibility|javaVersion|languageVersion)\s*=?\s*['\"]?(\d+(?:\.\d+)?)",
+    re.IGNORECASE,
+)
+_GRADLE_TOOLCHAIN_RE: re.Pattern = re.compile(
+    r"JavaLanguageVersion\.of\s*\(\s*(\d+)\s*\)", re.IGNORECASE
+)
+_JAVA_VERSION_LINE_RE: re.Pattern = re.compile(
+    r"(?:JAVA_VERSION|JDK_VERSION|java\.version)\s*[=:]\s*['\"]?(\d+(?:\.\d+)?)",
+    re.IGNORECASE,
+)
+_DOCKER_FROM_RE: re.Pattern = re.compile(
+    r"^\s*FROM\s+(?:--platform=\S+\s+)?(\S+)", re.IGNORECASE | re.MULTILINE
+)
+_DOCKER_JAVA_TAG_RE: re.Pattern = re.compile(
+    r"(?:^|[:\-_])(?:jdk|jre|java)?(?:-)?(1\.8|8|11|17|21|25)(?:[.\-_a-z0-9]*|$)",
+    re.IGNORECASE,
+)
+_JAVA_LTS_RELEASES: frozenset[int] = frozenset({8, 11, 17, 21, 25})
+_JAVA_LTS_SUPPORT_FILE_NAMES: frozenset[str] = frozenset({
+    "gradle.properties", ".java-version", ".sdkmanrc", "Dockerfile",
+    "dockerfile", "compose.yaml", "compose.yml", "docker-compose.yaml",
+    "docker-compose.yml", "jvm.config",
+})
+
+
+def _normalize_java_major(value: str) -> Optional[int]:
+    """Normalize Java version spellings (`1.8`, `VERSION_17`, `21.0.2`) to major."""
+    value = value.strip().strip("'\"")
+    if value.startswith("1."):
+        parts = value.split(".")
+        if len(parts) > 1 and parts[1].isdigit():
+            return int(parts[1])
+    m = re.match(r"(\d+)", value)
+    if not m:
+        return None
+    return int(m.group(1))
+
+
+def _java_lts_name(major: Optional[int]) -> str:
+    if major is None:
+        return "unknown"
+    return f"Java {major}" + (" LTS" if major in _JAVA_LTS_RELEASES else "")
+
+
+def _java_distribution_from_text(text: str) -> Optional[str]:
+    low = text.lower()
+    for marker, name in (
+        ("eclipse-temurin", "Eclipse Temurin"),
+        ("adoptium", "Eclipse Temurin"),
+        ("amazoncorretto", "Amazon Corretto"),
+        ("corretto", "Amazon Corretto"),
+        ("liberica", "BellSoft Liberica"),
+        ("azul", "Azul Zulu"),
+        ("zulu", "Azul Zulu"),
+        ("graalvm", "GraalVM"),
+        ("oracle", "Oracle JDK"),
+        ("openjdk", "OpenJDK"),
+    ):
+        if marker in low:
+            return name
+    return None
+
+
+def _java_evidence(
+    *,
+    source: str,
+    path: str,
+    value: str,
+    version: Optional[int],
+    distribution: Optional[str] = None,
+) -> dict:
+    out = {
+        "source": source,
+        "path": path,
+        "value": value,
+        "version": version,
+        "version_label": _java_lts_name(version),
+    }
+    if distribution:
+        out["distribution"] = distribution
+    return out
+
+
+def _find_java_lts_support_files(root: Path) -> list[tuple[Path, str]]:
+    """Files that may declare build/runtime Java without executing the project."""
+    found: list[tuple[Path, str]] = []
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in _SKIP_DIRS or d == ".mvn"]
+        dp = Path(dirpath)
+        try:
+            rel_dir = dp.relative_to(root)
+        except ValueError:
+            continue
+        for fname in filenames:
+            if fname not in _JAVA_LTS_SUPPORT_FILE_NAMES:
+                continue
+            abs_path = dp / fname
+            rel = str(rel_dir / fname) if str(rel_dir) != "." else fname
+            found.append((abs_path, rel))
+    return found
+
+
+def _java_lts_inventory(
+    root: Path,
+    build_texts: "Iterable[tuple[str, str]]",
+    *,
+    spring_boot_version: Optional[str],
+    target_jdk: Optional[int],
+) -> dict:
+    """Java LTS/licensing inventory for migration planning.
+
+    Bounded evidence only: build descriptors and local deployment hints. No build
+    execution, no legal verdict, and no inference from absent runtime metadata.
+    """
+    target_lts = target_jdk or 25
+    evidence: list[dict] = []
+    limitations: list[str] = []
+
+    for rel_path, raw_text in build_texts:
+        text = _resolve_maven_properties(raw_text) if rel_path.endswith("pom.xml") else raw_text
+        if rel_path.endswith("pom.xml"):
+            for m in _MAVEN_JAVA_VERSION_RE.finditer(text):
+                major = _normalize_java_major(m.group(2))
+                evidence.append(_java_evidence(
+                    source=f"maven_property:{m.group(1)}",
+                    path=rel_path,
+                    value=m.group(2).strip(),
+                    version=major,
+                ))
+            for m in _MAVEN_COMPILER_TAG_RE.finditer(text):
+                major = _normalize_java_major(m.group(1))
+                evidence.append(_java_evidence(
+                    source="maven_compiler_plugin",
+                    path=rel_path,
+                    value=m.group(1).strip(),
+                    version=major,
+                ))
+        elif rel_path.endswith((".gradle", ".gradle.kts", "gradle.properties")):
+            for pat, source in (
+                (_GRADLE_JAVA_ENUM_RE, "gradle_java_version_enum"),
+                (_GRADLE_JAVA_ASSIGN_RE, "gradle_java_assignment"),
+                (_GRADLE_TOOLCHAIN_RE, "gradle_toolchain"),
+                (_JAVA_VERSION_LINE_RE, "gradle_property"),
+            ):
+                for m in pat.finditer(text):
+                    major = _normalize_java_major(m.group(1))
+                    evidence.append(_java_evidence(
+                        source=source,
+                        path=rel_path,
+                        value=m.group(1).strip(),
+                        version=major,
+                    ))
+
+    for abs_path, rel_path in _find_java_lts_support_files(root):
+        if rel_path.endswith(("pom.xml", "build.gradle", "build.gradle.kts")):
+            continue
+        try:
+            text = abs_path.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            limitations.append(f"{rel_path}: could not be read")
+            continue
+        if rel_path.endswith((".java-version", ".sdkmanrc", "jvm.config", "gradle.properties")):
+            for m in _JAVA_VERSION_LINE_RE.finditer(text):
+                major = _normalize_java_major(m.group(1))
+                evidence.append(_java_evidence(
+                    source="java_version_file",
+                    path=rel_path,
+                    value=m.group(1).strip(),
+                    version=major,
+                ))
+            if rel_path.endswith(".java-version"):
+                major = _normalize_java_major(text.strip())
+                evidence.append(_java_evidence(
+                    source="java_version_file",
+                    path=rel_path,
+                    value=text.strip(),
+                    version=major,
+                ))
+        if "docker" in rel_path.lower() or rel_path.lower().endswith(("compose.yml", "compose.yaml")):
+            for m in _DOCKER_FROM_RE.finditer(text):
+                image = m.group(1).strip()
+                tag_major: Optional[int] = None
+                tag_match = _DOCKER_JAVA_TAG_RE.search(image)
+                if tag_match:
+                    tag_major = _normalize_java_major(tag_match.group(1))
+                evidence.append(_java_evidence(
+                    source="container_base_image",
+                    path=rel_path,
+                    value=image,
+                    version=tag_major,
+                    distribution=_java_distribution_from_text(image),
+                ))
+            for m in _JAVA_VERSION_LINE_RE.finditer(text):
+                major = _normalize_java_major(m.group(1))
+                evidence.append(_java_evidence(
+                    source="container_java_env",
+                    path=rel_path,
+                    value=m.group(1).strip(),
+                    version=major,
+                    distribution=_java_distribution_from_text(text),
+                ))
+
+    versions = sorted({e["version"] for e in evidence if isinstance(e.get("version"), int)})
+    distributions = sorted({e["distribution"] for e in evidence if e.get("distribution")})
+    target_blockers: list[dict] = []
+    for version in versions:
+        if version < target_lts:
+            target_blockers.append({
+                "kind": "version_below_target_lts",
+                "version": version,
+                "target_lts": target_lts,
+                "reason": f"{_java_lts_name(version)} evidence is below target {_java_lts_name(target_lts)}",
+            })
+    if not versions:
+        target_blockers.append({
+            "kind": "java_version_unknown",
+            "version": None,
+            "target_lts": target_lts,
+            "reason": "No Java source/target/runtime version evidence found in build or deployment hints.",
+        })
+
+    licensing_reasons: list[str] = []
+    oracle_evidence = [
+        e for e in evidence
+        if str(e.get("distribution", "")).lower() == "oracle jdk"
+        or ("oracle" in str(e.get("value", "")).lower() and "jdk" in str(e.get("value", "")).lower())
+    ]
+    for e in oracle_evidence:
+        licensing_reasons.append(
+            f"{e['path']} declares {e.get('distribution', 'Oracle JDK')} "
+            f"{e.get('version_label', 'unknown version')} ({e['source']}); review support/licensing terms."
+        )
+
+    return {
+        "schema_version": "java-lts-inventory-v1",
+        "target_lts": target_lts,
+        "target_lts_basis": (
+            "--target-jdk supplied by caller" if target_jdk else
+            "default planning target for the 2026 Java LTS/licensing inventory"
+        ),
+        "versions": {
+            "detected": versions,
+            "lowest": versions[0] if versions else None,
+            "highest": versions[-1] if versions else None,
+            "labels": [_java_lts_name(v) for v in versions],
+        },
+        "distributions": distributions,
+        "evidence": evidence,
+        "spring_boot_version_detected": spring_boot_version,
+        "target_lts_blockers": target_blockers,
+        "licensing_review_needed": bool(licensing_reasons),
+        "licensing_review_reasons": licensing_reasons,
+        "legal_disclaimer": (
+            "Inventory signal only, not legal advice. ASK marks explicit Oracle JDK "
+            "or unknown-version evidence for review; license entitlement must be "
+            "confirmed from contracts and deployed binaries."
+        ),
+        "limitations": limitations + [
+            "No build was executed; Maven/Gradle toolchains and transitive runtime images may be incomplete.",
+            "Distribution detection is based on local build/container text only.",
+        ],
+    }
 # Cap on total readiness deduction from JDK-modernization findings (medium/low),
 # so reflection/date cleanups cannot collapse a jakarta-ready repo's headline.
 _JDK_ADVISORY_DEDUCTION_CAP: int = 15
@@ -1527,6 +1803,10 @@ class MigrationReport:
     # Opt-in — attached by the CLI under --blast-radius; None when not computed,
     # and then absent from the payload so the default report stays byte-identical.
     blast_radius: Optional[dict] = None
+    # F-P: Java LTS/licensing inventory, derived from build/runtime hints. Additive
+    # field: it informs migration planning but does not participate in readiness_score.
+    java_lts_inventory: dict = field(default_factory=dict)
+    evidence_manifest: dict = field(default_factory=dict)
 
     def finalize(self) -> "MigrationReport":
         if not self.generated_at:
@@ -2052,6 +2332,8 @@ class MigrationReport:
             "spring_test_only": self.spring_test_only,
             "spring_boot_2_detected": self.spring_boot_2_detected,
             "spring_boot_version_detected": self.spring_boot_version_detected,
+            "java_lts_inventory": self.java_lts_inventory,
+            **({"evidence_manifest": self.evidence_manifest} if self.evidence_manifest else {}),
             "summary": self.summary,
             "findings": [f.to_dict() for f in _listed],
             "hibernate": self.hibernate.to_dict() if self.hibernate is not None else None,
@@ -2155,6 +2437,9 @@ class MigrationReport:
                f"(readiness_score reflects jakarta/Boot3 only — Hibernate is a separate rewrite axis)"]
               if self.headline_blocker else []),
             f"Spring present: {self.spring_present}    Spring Boot 2 detected: {_boot}",
+            f"Java LTS inventory: target {self.java_lts_inventory.get('target_lts', 'unknown')}  "
+            f"detected {self.java_lts_inventory.get('versions', {}).get('labels', [])}  "
+            f"licensing_review_needed={self.java_lts_inventory.get('licensing_review_needed', False)}",
             f"Migration blockers (readiness dimensions): {self.migration_blocking_count}",
             f"Blocking issues (product code): {self.blocking_count}  "
             f"(critical: {main_crit}, high: {main_high})"
@@ -2534,6 +2819,7 @@ def run_migrate_check(
     dep_read_errors = 0
     raw_dep_findings: list[MigrationFinding] = []
     _build_texts: list[str] = []
+    _build_sources: list[tuple[str, str]] = []
     for abs_path, rel_path in build_files:
         try:
             text = abs_path.read_text(encoding="utf-8", errors="replace")
@@ -2541,6 +2827,7 @@ def run_migrate_check(
             dep_read_errors += 1
             continue
         _build_texts.append(text)
+        _build_sources.append((rel_path, text))
         dep_findings = _scan_dep_file(text, rel_path)
         filtered = [f for f in dep_findings if SEVERITY_ORDER.get(f.severity, 3) <= min_order]
         raw_dep_findings.extend(filtered)
@@ -2595,6 +2882,12 @@ def run_migrate_check(
         root, spring_runtime_import_seen, spring_test_import_seen
     )
     spring_boot_present = _detect_spring_boot_present(root)
+    java_lts_inventory = _java_lts_inventory(
+        root,
+        _build_sources,
+        spring_boot_version=spring_boot_version,
+        target_jdk=target_jdk,
+    )
 
     # BUG #8: classify each finding's code context (main / test / generated) so the
     # report can keep test fixtures and autogenerated sources out of blocking_count.
@@ -2645,6 +2938,7 @@ def run_migrate_check(
         jakarta_namespace_adopted=jakarta_import_count > 0,
         findings=all_findings,
         hibernate=hibernate_strat,
+        java_lts_inventory=java_lts_inventory,
         limitations=limitations,
         metadata={
             "java_files_scanned": len(file_paths),
@@ -2703,7 +2997,19 @@ def run_migrate_check(
     except Exception:
         pass
 
-    return report.finalize()
+    report = report.finalize()
+    from sourcecode.provenance import build_evidence_manifest
+    report.evidence_manifest = build_evidence_manifest(
+        report.to_dict(),
+        command="migrate-check",
+        root=root,
+        inputs={
+            "min_severity": min_severity,
+            "target_jdk": target_jdk,
+            "keep_boot": keep_boot,
+        },
+    )
+    return report
 
 
 # Remaining static limitations — things that truly require runtime analysis

sourcecode/provenance.py

@@ -0,0 +1,202 @@
+"""Claim provenance manifest for ASK outputs.
+
+The manifest is an index over claims already present in a command payload. It
+does not re-run analysis and does not certify a claim; it makes the published
+claim traceable to source spans, command inputs, tool version and freshness.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import subprocess
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Optional
+
+from sourcecode import __version__
+
+PROVENANCE_SCHEMA = "evidence-manifest-v1"
+_MAX_CLAIMS = 200
+
+
+def _stable_id(*parts: object) -> str:
+    raw = "|".join(str(p) for p in parts)
+    return "ev-" + hashlib.sha256(raw.encode("utf-8")).hexdigest()[:16]
+
+
+def _git_head(root: Path) -> Optional[str]:
+    try:
+        result = subprocess.run(
+            ["git", "-C", str(root), "rev-parse", "--short", "HEAD"],
+            capture_output=True,
+            text=True,
+            timeout=3,
+        )
+    except Exception:
+        return None
+    if result.returncode != 0:
+        return None
+    return result.stdout.strip() or None
+
+
+def _line(row: dict[str, Any]) -> Optional[int]:
+    value = row.get("first_line", row.get("line"))
+    return value if isinstance(value, int) else None
+
+
+def _source_path(row: dict[str, Any]) -> str:
+    return str(row.get("source_file") or row.get("file") or row.get("path") or "")
+
+
+def _claim(
+    *,
+    command: str,
+    claim_type: str,
+    row: dict[str, Any],
+    text: str,
+    confidence: Optional[str] = None,
+) -> Optional[dict[str, Any]]:
+    path = _source_path(row)
+    line = _line(row)
+    if not path:
+        return None
+    claim_id = _stable_id(command, claim_type, path, line or "", text)
+    out: dict[str, Any] = {
+        "id": claim_id,
+        "type": claim_type,
+        "text": text,
+        "source": {"path": path, **({"line": line} if line is not None else {})},
+    }
+    if confidence:
+        out["confidence"] = confidence
+    return out
+
+
+def _claims_from_rows(command: str, payload: dict[str, Any]) -> list[dict[str, Any]]:
+    claims: list[dict[str, Any]] = []
+    for field, claim_type in (
+        ("findings", "finding"),
+        ("risks", "risk"),
+        ("top_risks", "risk"),
+        ("relevant_files", "context_file"),
+        ("runtime_changes", "context_file"),
+        ("build_changes", "context_file"),
+    ):
+        rows = payload.get(field)
+        if not isinstance(rows, list):
+            continue
+        for row in rows:
+            if not isinstance(row, dict):
+                continue
+            title = str(row.get("title") or row.get("statement") or row.get("explanation") or field)
+            confidence = row.get("confidence")
+            if not isinstance(confidence, str):
+                confidence = None
+            claim = _claim(
+                command=command,
+                claim_type=claim_type,
+                row=row,
+                text=title,
+                confidence=confidence,
+            )
+            if claim is not None:
+                if row.get("rule_id"):
+                    claim["rule_id"] = row["rule_id"]
+                if row.get("rule_ids"):
+                    claim["rule_ids"] = row["rule_ids"]
+                claims.append(claim)
+            if len(claims) >= _MAX_CLAIMS:
+                return claims
+    return claims
+
+
+def _claims_from_java_lts(command: str, payload: dict[str, Any]) -> list[dict[str, Any]]:
+    inv = payload.get("java_lts_inventory")
+    if not isinstance(inv, dict):
+        return []
+    claims: list[dict[str, Any]] = []
+    for row in inv.get("evidence") or []:
+        if not isinstance(row, dict):
+            continue
+        text = (
+            f"Java runtime/build evidence {row.get('value')} "
+            f"({row.get('source')})"
+        )
+        claim = _claim(
+            command=command,
+            claim_type="java_lts_evidence",
+            row=row,
+            text=text,
+            confidence="medium",
+        )
+        if claim is not None:
+            claim["version"] = row.get("version")
+            if row.get("distribution"):
+                claim["distribution"] = row["distribution"]
+            claims.append(claim)
+    return claims
+
+
+def _embedded_manifests(payload: dict[str, Any]) -> list[dict[str, Any]]:
+    manifests: list[dict[str, Any]] = []
+    for value in payload.values():
+        if isinstance(value, dict):
+            manifest = value.get("evidence_manifest")
+            if isinstance(manifest, dict):
+                manifests.append({
+                    "schema_version": manifest.get("schema_version"),
+                    "command": (manifest.get("run") or {}).get("command"),
+                    "claim_count": len(manifest.get("claims") or []),
+                })
+            manifests.extend(_embedded_manifests(value))
+        elif isinstance(value, list):
+            for item in value:
+                if isinstance(item, dict):
+                    manifests.extend(_embedded_manifests(item))
+    return manifests
+
+
+def build_evidence_manifest(
+    payload: dict[str, Any],
+    *,
+    command: str,
+    root: Path,
+    inputs: Optional[dict[str, Any]] = None,
+) -> dict[str, Any]:
+    """Build a machine-readable provenance index for an existing payload."""
+    root = Path(root).resolve()
+    claims = _claims_from_rows(command, payload)
+    claims.extend(_claims_from_java_lts(command, payload))
+    claims = claims[:_MAX_CLAIMS]
+    sources = sorted({
+        str((claim.get("source") or {}).get("path"))
+        for claim in claims
+        if (claim.get("source") or {}).get("path")
+    })
+    return {
+        "schema_version": PROVENANCE_SCHEMA,
+        "run": {
+            "command": command,
+            "tool": "ask",
+            "tool_version": __version__,
+            "repository": str(root),
+            "git_head": _git_head(root),
+            "generated_at": datetime.now(timezone.utc).isoformat(),
+            "inputs": inputs or {},
+        },
+        "claims": claims,
+        "sources": [{"path": path} for path in sources],
+        "claims_cap": (
+            {"total_indexed": _MAX_CLAIMS, "capped": True}
+            if len(claims) >= _MAX_CLAIMS else
+            {"total_indexed": len(claims), "capped": False}
+        ),
+        "embedded_manifests": _embedded_manifests(payload),
+        "limits": {
+            "statement": (
+                "This manifest indexes claims already present in the payload. It "
+                "does not add analysis, certify correctness, or replace the source "
+                "evidence carried by each command."
+            )
+        },
+    }

sourcecode/risk.py

@@ -1209,4 +1209,15 @@ def build_risk(
             "omitted": len(kept) - limit,
             **cap_effect("display_list", limit=limit, total=len(kept)),
         }
+    from sourcecode.provenance import build_evidence_manifest
+    payload["evidence_manifest"] = build_evidence_manifest(
+        payload,
+        command="risk",
+        root=root,
+        inputs={
+            "limit": limit,
+            "min_band": min_band,
+            "profiles": sorted(profiles) if profiles is not None else None,
+        },
+    )
     return payload

sourcecode/sarif.py

@@ -615,4 +615,16 @@ def enrich_sarif(
             "omitted": len(kept) - limit,
             **cap_effect("display_list", limit=limit, total=len(kept)),
         }
+    from sourcecode.provenance import build_evidence_manifest
+    payload["evidence_manifest"] = build_evidence_manifest(
+        payload,
+        command="enrich",
+        root=root,
+        inputs={
+            "sarif": str(sarif_path),
+            "limit": limit,
+            "min_band": min_band,
+            "profiles": sorted(profiles) if profiles is not None else None,
+        },
+    )
     return payload

{sourcecode-4.9.0.dist-info → sourcecode-4.9.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.9.0
+Version: 4.9.1
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.9.0-blue)
+![Version](https://img.shields.io/badge/version-4.9.1-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -97,7 +97,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.9.0 — and, on a build that has aged,
+ask version                    # ask 4.9.1 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -137,8 +137,9 @@ ask endpoints /path/to/repo
 # CGLIB no-op), security surface, request-body validation.
 ask spring-audit /path/to/repo
 
-# Spring Boot 2→3 readiness: located blockers, per-dimension score, effort estimate.
+# Spring Boot 2→3 readiness plus Java LTS/licensing inventory.
 ask migrate-check /path/to/repo --compact
+# Add --target-jdk 25 to make the LTS route explicit.
 ```
 
 **Then the three that finish the sentence the four above start.** A profile-set answer stays
@@ -308,12 +309,12 @@ from it.
 | `posture` | experimental | which beans a profile set wires, and how effective endpoint access differs between two sets | the most differentiated capability here |
 | `risk` | experimental | what each defect actually costs, once reach, access, write effect and the shape of the input path are in it | `defect_severity × reachability × auth_verdict × write_effect × query_construction × input_constraints`; every factor names its authority; `--table --rule SEC-008 --band high --top-n 20` gives audit triage without `jq` |
 | `enrich` | experimental | another scanner's SARIF findings, ranked by what this repository does with them | `--sarif <log>`; same composition as `risk`, with `--table --rule <id> --band high --top-n 20` for triage |
-| `audit-report` | experimental | human audit bundle over existing `risk` + `posture` evidence, optionally signed | `--format markdown`; `--sign-key <file>` signs canonical JSON with HMAC-SHA256 |
+| `audit-report` | experimental | human audit bundle over existing `risk` + `posture` evidence, optionally signed | includes `evidence_manifest` claim provenance; `--format markdown`; `--sign-key <file>` signs canonical JSON with HMAC-SHA256 |
 | `migrate-recipe` | experimental | the migration report as the OpenRewrite recipe that applies it | only recipes a finding named; the manual remainder published beside them; writes nothing without `--write`, and never a runnable command for an empty recipe list |
 | `data-exposure` | experimental | which routes can carry the data you labelled, and who reaches them | labels declared in `sourcecode.config.json` — never inferred from a name; `signature` and `call_reach` evidence published apart, field-level flow out of scope (NC-008). With nothing declared, `ask data-exposure /path/to/repo` answers `answered: false` and hands back the file, the key and an example to declare — it never reports zero exposed routes |
 | `endpoints` | core | every REST endpoint, effective path, security policy, confidence | Spring MVC + JAX-RS (~65 % recall on JAX-RS sub-resource locators). `--compact` answers the exposure census without the rows; `--servlets` lists the servlet-mounted surface as its own population; `--client-usage` says which routes the TS/JS client in this repository actually calls |
 | `spring-audit` | core | transactional anomalies + security surface + validation gaps | `--ci`, `-f github-comment`; `--table --rule SEC-008 --top-n 20` for human-scale review |
-| `migrate-check` | core | Boot 2→3 readiness: located blockers, per-dimension score, effort | `--blast-radius` orders the re-test plan; `--table --rule MIG-001 --band critical --top-n 20` for blocker triage |
+| `migrate-check` | core | Boot 2→3 readiness + Java LTS/licensing inventory: located blockers, per-dimension score, effort, detected Java 8/11/17/21/25 evidence and explicit licensing-review signals | `--target-jdk 25` sets the target LTS route; `--blast-radius` orders the re-test plan; `--table --rule MIG-001 --band critical --top-n 20` for blocker triage |
 | `impact` / `impact-chain` | core | blast radius of a change, to the endpoints it reaches | target the **interface**, not the `Impl` |
 | `pr-impact` | core | the same, scoped to a PR diff | gating command: `--fail-on`, exit codes |
 | `verify` | core | does the repo satisfy its declared contracts, **relative to a baseline** | `.ask/contracts.yml`; exit 0/1/2 |
@@ -401,6 +402,16 @@ and that gap is the honest description, not a defect to argue with. `migrate-che
 the OpenRewrite recipe each finding carries so the executor that does apply changes has its
 input.
 
+**Java LTS/licensing inventory.** `migrate-check` emits `java_lts_inventory` beside the migration
+scores. It reads Maven/Gradle, local runtime hints and container files for Java 8/11/17/21/25
+evidence, reports target-LTS blockers with `--target-jdk`, and marks explicit Oracle JDK evidence
+as `licensing_review_needed`. This is inventory evidence, not legal advice.
+
+**Claim provenance ledger.** JSON outputs from `risk`, `enrich`, `migrate-check`,
+`audit-report` and `prepare-context` include `evidence_manifest`: stable claim IDs mapped to
+source paths/lines, command inputs, ASK version, git HEAD and freshness metadata. The manifest
+indexes claims already in the payload; it does not add analysis or certify compliance.
+
 
 ---
 

{sourcecode-4.9.0.dist-info → sourcecode-4.9.1.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=qmMU4XyVYaQ8oZUh7exFVgj9YNWXVEdccvidG3GXWdg,308
+sourcecode/__init__.py,sha256=-xlrcRnU01z5SLmkXJMeg2C79FevkV3-PlmwssyEWIg,308
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/archetype.py,sha256=CZvRLpkHot_D8D3JFQVorr-EHDJyh0BbS7RnSTqBigM,40499
 sourcecode/architectural_baseline.py,sha256=agDSwGEakdkgLLh5xnd3hiD_TC6pRujWt4klnuYF1wo,18689
@@ -6,7 +6,7 @@ sourcecode/architectural_delta.py,sha256=E6MkyjWl-1ZgR4KSKnI785gUAfc8nq-lK-jd_ru
 sourcecode/architecture_analyzer.py,sha256=GFc4ek-s1IHWM7pl-0L32WahZ93AmDgrAMcOuBKA5Dk,61463
 sourcecode/architecture_summary.py,sha256=BVVRHd952cjRhjHnR6CPrvKgaa-tdM16l-pBi1yDCPs,32395
 sourcecode/ast_extractor.py,sha256=aXJjZ7XjAdxa99hWNm4SyzPqx4gNWiTbUYjNWGNl-Vc,51213
-sourcecode/audit_report.py,sha256=l6xPRSLms4SCVbL-Tu3aCvDtTTHciyPenuih32ngod0,5392
+sourcecode/audit_report.py,sha256=6YCvXR9C9jRTpngjUYJbhE35KxionHK0gM2eBY8ORi4,5758
 sourcecode/baseline_autocapture.py,sha256=tmMLexQSeaQRRbqxAd7walvGQqnF0mdpxQmkL40rlhI,15623
 sourcecode/cache.py,sha256=9XJUNSGzqM6DNWy4erUO-OcZY9qkrTCCcOJ-OANVrw8,41409
 sourcecode/cache_model.py,sha256=hUGWNKBKLV76mGveFffOzr9fqFD1ZydJVakseRsg14s,17401
@@ -18,7 +18,7 @@ sourcecode/chain_rules.py,sha256=Bi6UHfgd-GxWswmnHRcPz5jdbAuqka3Zkz_P-MTvqhw,127
 sourcecode/change_plan.py,sha256=kFjjp16XYbupgkv1CPkfqo39_SiZPMRQ8OOfC-Vy9eg,7929
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=JFmUut4Ux2ziJAwWjfJb0imSvrZACSvvdjR5I1RqI_0,519004
+sourcecode/cli.py,sha256=YUaIQLqKahnKqv9-2QWOTL5qnlMAuDHPZj4kjqqK-7g,520130
 sourcecode/client_calls.py,sha256=daRTgbXNUOfkzGXJpVb6A737R_Thhka8vw1_YgxCaLg,13548
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=xq3zsqAOAw4AWkoD9khb9xDP_O3KvwqO9k-pf8sbi3g,10951
@@ -66,7 +66,7 @@ sourcecode/jdk_exports.py,sha256=fCrlwNAXUT9gge_joq6kMnY3zJxYB2pxqy-0w3o3MJI,874
 sourcecode/license.py,sha256=vvgE1vBUWh8ozWI7USYuteh6noxntnjuzDQIPF-l4rA,27795
 sourcecode/mcp_nudge.py,sha256=lKemOqK_wny2u7Ymcr2Idi5Kx8pXY02jCi-_nJYLGMg,2992
 sourcecode/metrics_analyzer.py,sha256=gLoRWKygF18jLgwsqmGXSWopw-f5iO1VbM7Jjdif6ag,22809
-sourcecode/migrate_check.py,sha256=M6Q1kaIK7w9SSjwta34fXOVkeF-bJtpv9Fqnle4VYyw,136690
+sourcecode/migrate_check.py,sha256=1X3iMVhy4PRAryrrYoX1-8sUOpDyZWQkLRdGZRO2_Qk,148992
 sourcecode/migration_blast.py,sha256=OPryWkM6-PbvcG3eJFdcWUnlpXBje41nu2BkrZnE2hg,9359
 sourcecode/non_coverage.py,sha256=N4pLd0zKOEdkObzMz3TSMTCDRmV0dwqZtXWFFPR9gSo,12001
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
@@ -82,6 +82,7 @@ sourcecode/pr_comment_renderer.py,sha256=239PmJdf95av_ZW236C7_tvq_ahECeuF9AZxrhe
 sourcecode/pr_impact.py,sha256=eaFgcPMDsjaF8VZvcitFWCPCabMTi-khtGdxpK0wXTQ,22461
 sourcecode/prepare_context.py,sha256=B8TiBQbazxUOz6D37Dt9zqbOtD5b2S_fR3MB15P9DrI,237206
 sourcecode/progress.py,sha256=qn30sWaHOkjTgXsSBmiPkz7Rsbwc5oSlIe6JNEMYp_k,3149
+sourcecode/provenance.py,sha256=nAkzUQ6OzvHanhA4PCTRuBgyhrlaJXdN71YjQdcguDE,6590
 sourcecode/ranking_engine.py,sha256=ZAucq_YX2KkWUuAZf4P0lhtQ_38vEFnUhuGtSZd1S0E,12970
 sourcecode/readiness_timeline.py,sha256=qqc14vL9nj9E4qw4bVZpGhfMLaVaYr9s6Pak_VUIwt0,8008
 sourcecode/reconciliation.py,sha256=GU-1PTcVr8zcbtC7BASfpHcZndP9AdboXPNQiBc0fzo,34251
@@ -94,10 +95,10 @@ sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
 sourcecode/repository_ir.py,sha256=yrQd8yB9NO0M2SLkI0bQ5ty1RjTldQOhVbr3IoNkXJk,357437
 sourcecode/ris.py,sha256=SjjDNMcc9Zr9us9G8ikBVkoPXKK3BpM-dBodSGMh_g4,24783
-sourcecode/risk.py,sha256=OiHibjaPTlXhmjZNlfcOG88CJj2x1VKjsSf7Kr_CbVs,54137
+sourcecode/risk.py,sha256=UgTVdMc8XBArO6D9e2Xx9I-kKqx-PW4W0hSe1Jy9qjU,54491
 sourcecode/rule_catalog.py,sha256=xmphuULUCtg_GWTbriwY25D-N2IaeMXXvB5CNU1xSuA,4925
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
-sourcecode/sarif.py,sha256=_3ggbtV0O2iK5zeUiJSS36KxpPRVAtGy0hzXAFBmww8,25590
+sourcecode/sarif.py,sha256=3hQEegUxIZbojFdY59oB-yKsK-rnafHdTNmYsEP2--A,25984
 sourcecode/scanner.py,sha256=z3CV0rcGunu0Y8mpNgp07wI7nxT0pxw1BkXRRtI0Rpo,9609
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
 sourcecode/security_config.py,sha256=KblMEoRiEjrIE68YsPaUAFebxFp8UM7MS7lAk5CGD8U,3531
@@ -191,8 +192,8 @@ sourcecode/telemetry/consent.py,sha256=pQdl-QeLl6Gcibn0eWHSKZrm-HYSsjpVqOnjrgFp8
 sourcecode/telemetry/events.py,sha256=4_yeO58U-Cwc1Qb27VB0_EjhmroY0k91n3_VGxeALB8,2776
 sourcecode/telemetry/filters.py,sha256=RzxauTz8HliO4BllQnXEXc7zTeqdCZi5MgqGEDuW7OQ,6570
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-4.9.0.dist-info/METADATA,sha256=zYlJaXbhple_TmmCRkcHt2x_REhzgXnQRR3oNeL-s10,34785
-sourcecode-4.9.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-4.9.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-4.9.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-4.9.0.dist-info/RECORD,,
+sourcecode-4.9.1.dist-info/METADATA,sha256=4S6TZgY8kS5yoXj8TpekgXe80PBoZmSoilVukkDWg-s,35741
+sourcecode-4.9.1.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-4.9.1.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-4.9.1.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-4.9.1.dist-info/RECORD,,