sourcecode 4.9.0__tar.gz → 4.9.1__tar.gz

{sourcecode-4.9.0 → sourcecode-4.9.1}/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+## [4.9.1] — 2026-08-04
+
+### Added
+
+- **Java LTS/licensing inventory in `migrate-check`.** Reports Java 8/11/17/21/25
+  evidence from Maven/Gradle, local runtime hints and container files, target-LTS
+  blockers via `--target-jdk`, and explicit Oracle JDK licensing-review signals
+  without changing migration readiness scoring.
+- **Claim provenance ledger.** `risk`, `enrich`, `migrate-check`, `audit-report`
+  and `prepare-context` now emit `evidence_manifest` with stable claim IDs,
+  source paths/lines, command inputs, ASK version, git HEAD and freshness metadata.
+
 ## [4.9.0] — 2026-08-04
 
 ### Added

{sourcecode-4.9.0 → sourcecode-4.9.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.9.0
+Version: 4.9.1
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.9.0-blue)
+![Version](https://img.shields.io/badge/version-4.9.1-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -97,7 +97,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.9.0 — and, on a build that has aged,
+ask version                    # ask 4.9.1 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -137,8 +137,9 @@ ask endpoints /path/to/repo
 # CGLIB no-op), security surface, request-body validation.
 ask spring-audit /path/to/repo
 
-# Spring Boot 2→3 readiness: located blockers, per-dimension score, effort estimate.
+# Spring Boot 2→3 readiness plus Java LTS/licensing inventory.
 ask migrate-check /path/to/repo --compact
+# Add --target-jdk 25 to make the LTS route explicit.
 ```
 
 **Then the three that finish the sentence the four above start.** A profile-set answer stays
@@ -308,12 +309,12 @@ from it.
 | `posture` | experimental | which beans a profile set wires, and how effective endpoint access differs between two sets | the most differentiated capability here |
 | `risk` | experimental | what each defect actually costs, once reach, access, write effect and the shape of the input path are in it | `defect_severity × reachability × auth_verdict × write_effect × query_construction × input_constraints`; every factor names its authority; `--table --rule SEC-008 --band high --top-n 20` gives audit triage without `jq` |
 | `enrich` | experimental | another scanner's SARIF findings, ranked by what this repository does with them | `--sarif <log>`; same composition as `risk`, with `--table --rule <id> --band high --top-n 20` for triage |
-| `audit-report` | experimental | human audit bundle over existing `risk` + `posture` evidence, optionally signed | `--format markdown`; `--sign-key <file>` signs canonical JSON with HMAC-SHA256 |
+| `audit-report` | experimental | human audit bundle over existing `risk` + `posture` evidence, optionally signed | includes `evidence_manifest` claim provenance; `--format markdown`; `--sign-key <file>` signs canonical JSON with HMAC-SHA256 |
 | `migrate-recipe` | experimental | the migration report as the OpenRewrite recipe that applies it | only recipes a finding named; the manual remainder published beside them; writes nothing without `--write`, and never a runnable command for an empty recipe list |
 | `data-exposure` | experimental | which routes can carry the data you labelled, and who reaches them | labels declared in `sourcecode.config.json` — never inferred from a name; `signature` and `call_reach` evidence published apart, field-level flow out of scope (NC-008). With nothing declared, `ask data-exposure /path/to/repo` answers `answered: false` and hands back the file, the key and an example to declare — it never reports zero exposed routes |
 | `endpoints` | core | every REST endpoint, effective path, security policy, confidence | Spring MVC + JAX-RS (~65 % recall on JAX-RS sub-resource locators). `--compact` answers the exposure census without the rows; `--servlets` lists the servlet-mounted surface as its own population; `--client-usage` says which routes the TS/JS client in this repository actually calls |
 | `spring-audit` | core | transactional anomalies + security surface + validation gaps | `--ci`, `-f github-comment`; `--table --rule SEC-008 --top-n 20` for human-scale review |
-| `migrate-check` | core | Boot 2→3 readiness: located blockers, per-dimension score, effort | `--blast-radius` orders the re-test plan; `--table --rule MIG-001 --band critical --top-n 20` for blocker triage |
+| `migrate-check` | core | Boot 2→3 readiness + Java LTS/licensing inventory: located blockers, per-dimension score, effort, detected Java 8/11/17/21/25 evidence and explicit licensing-review signals | `--target-jdk 25` sets the target LTS route; `--blast-radius` orders the re-test plan; `--table --rule MIG-001 --band critical --top-n 20` for blocker triage |
 | `impact` / `impact-chain` | core | blast radius of a change, to the endpoints it reaches | target the **interface**, not the `Impl` |
 | `pr-impact` | core | the same, scoped to a PR diff | gating command: `--fail-on`, exit codes |
 | `verify` | core | does the repo satisfy its declared contracts, **relative to a baseline** | `.ask/contracts.yml`; exit 0/1/2 |
@@ -401,6 +402,16 @@ and that gap is the honest description, not a defect to argue with. `migrate-che
 the OpenRewrite recipe each finding carries so the executor that does apply changes has its
 input.
 
+**Java LTS/licensing inventory.** `migrate-check` emits `java_lts_inventory` beside the migration
+scores. It reads Maven/Gradle, local runtime hints and container files for Java 8/11/17/21/25
+evidence, reports target-LTS blockers with `--target-jdk`, and marks explicit Oracle JDK evidence
+as `licensing_review_needed`. This is inventory evidence, not legal advice.
+
+**Claim provenance ledger.** JSON outputs from `risk`, `enrich`, `migrate-check`,
+`audit-report` and `prepare-context` include `evidence_manifest`: stable claim IDs mapped to
+source paths/lines, command inputs, ASK version, git HEAD and freshness metadata. The manifest
+indexes claims already in the payload; it does not add analysis or certify compliance.
+
 
 ---
 

{sourcecode-4.9.0 → sourcecode-4.9.1}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.9.0-blue)
+![Version](https://img.shields.io/badge/version-4.9.1-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -59,7 +59,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.9.0 — and, on a build that has aged,
+ask version                    # ask 4.9.1 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -99,8 +99,9 @@ ask endpoints /path/to/repo
 # CGLIB no-op), security surface, request-body validation.
 ask spring-audit /path/to/repo
 
-# Spring Boot 2→3 readiness: located blockers, per-dimension score, effort estimate.
+# Spring Boot 2→3 readiness plus Java LTS/licensing inventory.
 ask migrate-check /path/to/repo --compact
+# Add --target-jdk 25 to make the LTS route explicit.
 ```
 
 **Then the three that finish the sentence the four above start.** A profile-set answer stays
@@ -270,12 +271,12 @@ from it.
 | `posture` | experimental | which beans a profile set wires, and how effective endpoint access differs between two sets | the most differentiated capability here |
 | `risk` | experimental | what each defect actually costs, once reach, access, write effect and the shape of the input path are in it | `defect_severity × reachability × auth_verdict × write_effect × query_construction × input_constraints`; every factor names its authority; `--table --rule SEC-008 --band high --top-n 20` gives audit triage without `jq` |
 | `enrich` | experimental | another scanner's SARIF findings, ranked by what this repository does with them | `--sarif <log>`; same composition as `risk`, with `--table --rule <id> --band high --top-n 20` for triage |
-| `audit-report` | experimental | human audit bundle over existing `risk` + `posture` evidence, optionally signed | `--format markdown`; `--sign-key <file>` signs canonical JSON with HMAC-SHA256 |
+| `audit-report` | experimental | human audit bundle over existing `risk` + `posture` evidence, optionally signed | includes `evidence_manifest` claim provenance; `--format markdown`; `--sign-key <file>` signs canonical JSON with HMAC-SHA256 |
 | `migrate-recipe` | experimental | the migration report as the OpenRewrite recipe that applies it | only recipes a finding named; the manual remainder published beside them; writes nothing without `--write`, and never a runnable command for an empty recipe list |
 | `data-exposure` | experimental | which routes can carry the data you labelled, and who reaches them | labels declared in `sourcecode.config.json` — never inferred from a name; `signature` and `call_reach` evidence published apart, field-level flow out of scope (NC-008). With nothing declared, `ask data-exposure /path/to/repo` answers `answered: false` and hands back the file, the key and an example to declare — it never reports zero exposed routes |
 | `endpoints` | core | every REST endpoint, effective path, security policy, confidence | Spring MVC + JAX-RS (~65 % recall on JAX-RS sub-resource locators). `--compact` answers the exposure census without the rows; `--servlets` lists the servlet-mounted surface as its own population; `--client-usage` says which routes the TS/JS client in this repository actually calls |
 | `spring-audit` | core | transactional anomalies + security surface + validation gaps | `--ci`, `-f github-comment`; `--table --rule SEC-008 --top-n 20` for human-scale review |
-| `migrate-check` | core | Boot 2→3 readiness: located blockers, per-dimension score, effort | `--blast-radius` orders the re-test plan; `--table --rule MIG-001 --band critical --top-n 20` for blocker triage |
+| `migrate-check` | core | Boot 2→3 readiness + Java LTS/licensing inventory: located blockers, per-dimension score, effort, detected Java 8/11/17/21/25 evidence and explicit licensing-review signals | `--target-jdk 25` sets the target LTS route; `--blast-radius` orders the re-test plan; `--table --rule MIG-001 --band critical --top-n 20` for blocker triage |
 | `impact` / `impact-chain` | core | blast radius of a change, to the endpoints it reaches | target the **interface**, not the `Impl` |
 | `pr-impact` | core | the same, scoped to a PR diff | gating command: `--fail-on`, exit codes |
 | `verify` | core | does the repo satisfy its declared contracts, **relative to a baseline** | `.ask/contracts.yml`; exit 0/1/2 |
@@ -363,6 +364,16 @@ and that gap is the honest description, not a defect to argue with. `migrate-che
 the OpenRewrite recipe each finding carries so the executor that does apply changes has its
 input.
 
+**Java LTS/licensing inventory.** `migrate-check` emits `java_lts_inventory` beside the migration
+scores. It reads Maven/Gradle, local runtime hints and container files for Java 8/11/17/21/25
+evidence, reports target-LTS blockers with `--target-jdk`, and marks explicit Oracle JDK evidence
+as `licensing_review_needed`. This is inventory evidence, not legal advice.
+
+**Claim provenance ledger.** JSON outputs from `risk`, `enrich`, `migrate-check`,
+`audit-report` and `prepare-context` include `evidence_manifest`: stable claim IDs mapped to
+source paths/lines, command inputs, ASK version, git HEAD and freshness metadata. The manifest
+indexes claims already in the payload; it does not add analysis or certify compliance.
+
 
 ---
 

{sourcecode-4.9.0 → sourcecode-4.9.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "4.9.0"
+version = "4.9.1"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-4.9.0 → sourcecode-4.9.1}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.9.0"
+__version__ = "4.9.1"

{sourcecode-4.9.0 → sourcecode-4.9.1}/src/sourcecode/audit_report.py

@@ -78,6 +78,17 @@ def build_audit_report(
             "non_coverage": (risk.get("non_coverage") or {}).get("items", []),
         },
     }
+    from sourcecode.provenance import build_evidence_manifest
+    unsigned["evidence_manifest"] = build_evidence_manifest(
+        unsigned,
+        command="audit-report",
+        root=root,
+        inputs={
+            "profiles": sorted(profiles) if profiles else None,
+            "risk_limit": risk_limit,
+            "signed": bool(sign_key),
+        },
+    )
     # Sign and publish the same JSON-normalized material. Some embedded evidence
     # may contain tuples or other JSON-coercible values; normalizing before signing
     # avoids a signature over an in-memory shape the user never receives.

{sourcecode-4.9.0 → sourcecode-4.9.1}/src/sourcecode/cli.py

@@ -345,7 +345,7 @@ of files) in minutes. Semantic analysis itself is sub-second; repo indexing domi
   posture . --diff dev:prod    [dim]# effective access, two profile sets (exp.)[/dim]
   endpoints .                  [dim]# endpoints + effective path + policy[/dim]
   spring-audit .               [dim]# TX anomalies + security surface[/dim]
-  migrate-check . --compact    [dim]# Boot 2→3: located blockers + effort[/dim]
+  migrate-check . --compact    [dim]# Boot 2→3 + Java LTS/licensing inventory[/dim]
   risk .                       [dim]# defects ranked by reach × access (exp.)[/dim]
 
 {_remedy_help_block()}
@@ -3875,6 +3875,11 @@ def prepare_context_cmd(
       ask prepare-context review-pr . --since main --output review.json
       ask prepare-context onboard --llm-prompt
       ask prepare-context --task-help
+
+    \b
+    Provenance:
+      JSON output includes evidence_manifest: claim IDs for context files and
+      source-backed rows, plus command inputs, ASK version, git HEAD and freshness.
     """
     from sourcecode.prepare_context import TASKS, TaskContextBuilder
 
@@ -4419,6 +4424,20 @@ def prepare_context_cmd(
             _skipped.append("test_gap_discovery")
         out["skipped_analyzers"] = _skipped
 
+    from sourcecode.provenance import build_evidence_manifest as _build_evidence_manifest
+    out["evidence_manifest"] = _build_evidence_manifest(
+        out,
+        command="prepare-context",
+        root=target,
+        inputs={
+            "task": task,
+            "since": since,
+            "format": format or "json",
+            "fast": fast,
+            "llm_prompt": llm_prompt,
+        },
+    )
+
     # P0-1: Apply output budget per task — safety net for large repos.
     _pc_budget = _prepare_context_budget(task)
 
@@ -8015,7 +8034,8 @@ def audit_report_cmd(
     This packages the same evidence `risk` and `posture` already publish into a
     report a buyer can read: top risks, effective runtime posture, source-linked
     evidence and non-coverage. It does not certify compliance, choose fixes or
-    assign ROI.
+    assign ROI. JSON includes evidence_manifest: claim IDs mapped to source spans,
+    command inputs, ASK version and freshness.
 
     \b
     `--sign-key` adds an HMAC-SHA256 signature over the canonical JSON payload.
@@ -8724,9 +8744,9 @@ def migrate_check_cmd(
         None,
         "--target-jdk",
         help=(
-            "The JDK you are actually moving to (e.g. 11, 17, 21). Rules for a "
-            "later JDK are not your blockers and are not reported. Without it, "
-            "every JDK axis is reported at once."
+            "The JDK you are actually moving to (e.g. 11, 17, 21, 25). Rules "
+            "for a later JDK are not your blockers and are not reported. Also "
+            "sets java_lts_inventory.target_lts."
         ),
     ),
     keep_boot: bool = typer.Option(
@@ -8786,7 +8806,7 @@ def migrate_check_cmd(
         help="Caller BFS depth for --blast-radius (1-8, default: 4).",
     ),
 ) -> None:
-    """Spring Boot 2→3 migration readiness: detect javax→jakarta namespace blockers.
+    """Spring Boot 2→3 migration readiness + Java LTS/licensing inventory.
 
     \b
     Detects:
@@ -8815,6 +8835,7 @@ def migrate_check_cmd(
       ask migrate-check . --compact          bounded decision summary
       ask migrate-check /path/to/repo --format text
       ask migrate-check . --min-severity high
+      ask migrate-check . --target-jdk 25       Java LTS target inventory
       ask migrate-check . --table --rule MIG-001 --band critical --top-n 20
       ask migrate-check . --output migration.json
       ask migrate-check . --snapshot --ref sprint-12   persist a readiness point
@@ -8837,6 +8858,13 @@ def migrate_check_cmd(
       <repo>/.ask/readiness-history). --trend reads that series and reports
       first→last movement — no improving/degrading label, and readiness_score is
       flagged not-comparable when the applicable dimension set changed.
+
+    \b
+    Java LTS/licensing inventory:
+      The JSON report includes java_lts_inventory: Java 8/11/17/21/25 evidence
+      from Maven/Gradle, local runtime hints and container files; target-LTS
+      blockers; and explicit Oracle JDK/licensing-review signals. This is
+      inventory evidence, not legal advice, and it never changes readiness_score.
     """
     from sourcecode.repository_ir import find_java_files
     from sourcecode.migrate_check import run_migrate_check

{sourcecode-4.9.0 → sourcecode-4.9.1}/src/sourcecode/migrate_check.py

@@ -860,6 +860,282 @@ def _parse_major(version: "Optional[str]") -> "Optional[int]":
         return None
     m = re.match(r"\s*(\d+)", version)
     return int(m.group(1)) if m else None
+
+
+_MAVEN_JAVA_VERSION_RE: re.Pattern = re.compile(
+    r"<(java\.version|maven\.compiler\.(?:source|target|release))>\s*([^<${}]+)\s*</\1>",
+    re.IGNORECASE,
+)
+_MAVEN_COMPILER_TAG_RE: re.Pattern = re.compile(
+    r"<(?:source|target|release)>\s*([^<${}]+)\s*</(?:source|target|release)>",
+    re.IGNORECASE,
+)
+_GRADLE_JAVA_ENUM_RE: re.Pattern = re.compile(
+    r"JavaVersion\.VERSION_(?:1_)?(\d+)", re.IGNORECASE
+)
+_GRADLE_JAVA_ASSIGN_RE: re.Pattern = re.compile(
+    r"(?:sourceCompatibility|targetCompatibility|javaVersion|languageVersion)\s*=?\s*['\"]?(\d+(?:\.\d+)?)",
+    re.IGNORECASE,
+)
+_GRADLE_TOOLCHAIN_RE: re.Pattern = re.compile(
+    r"JavaLanguageVersion\.of\s*\(\s*(\d+)\s*\)", re.IGNORECASE
+)
+_JAVA_VERSION_LINE_RE: re.Pattern = re.compile(
+    r"(?:JAVA_VERSION|JDK_VERSION|java\.version)\s*[=:]\s*['\"]?(\d+(?:\.\d+)?)",
+    re.IGNORECASE,
+)
+_DOCKER_FROM_RE: re.Pattern = re.compile(
+    r"^\s*FROM\s+(?:--platform=\S+\s+)?(\S+)", re.IGNORECASE | re.MULTILINE
+)
+_DOCKER_JAVA_TAG_RE: re.Pattern = re.compile(
+    r"(?:^|[:\-_])(?:jdk|jre|java)?(?:-)?(1\.8|8|11|17|21|25)(?:[.\-_a-z0-9]*|$)",
+    re.IGNORECASE,
+)
+_JAVA_LTS_RELEASES: frozenset[int] = frozenset({8, 11, 17, 21, 25})
+_JAVA_LTS_SUPPORT_FILE_NAMES: frozenset[str] = frozenset({
+    "gradle.properties", ".java-version", ".sdkmanrc", "Dockerfile",
+    "dockerfile", "compose.yaml", "compose.yml", "docker-compose.yaml",
+    "docker-compose.yml", "jvm.config",
+})
+
+
+def _normalize_java_major(value: str) -> Optional[int]:
+    """Normalize Java version spellings (`1.8`, `VERSION_17`, `21.0.2`) to major."""
+    value = value.strip().strip("'\"")
+    if value.startswith("1."):
+        parts = value.split(".")
+        if len(parts) > 1 and parts[1].isdigit():
+            return int(parts[1])
+    m = re.match(r"(\d+)", value)
+    if not m:
+        return None
+    return int(m.group(1))
+
+
+def _java_lts_name(major: Optional[int]) -> str:
+    if major is None:
+        return "unknown"
+    return f"Java {major}" + (" LTS" if major in _JAVA_LTS_RELEASES else "")
+
+
+def _java_distribution_from_text(text: str) -> Optional[str]:
+    low = text.lower()
+    for marker, name in (
+        ("eclipse-temurin", "Eclipse Temurin"),
+        ("adoptium", "Eclipse Temurin"),
+        ("amazoncorretto", "Amazon Corretto"),
+        ("corretto", "Amazon Corretto"),
+        ("liberica", "BellSoft Liberica"),
+        ("azul", "Azul Zulu"),
+        ("zulu", "Azul Zulu"),
+        ("graalvm", "GraalVM"),
+        ("oracle", "Oracle JDK"),
+        ("openjdk", "OpenJDK"),
+    ):
+        if marker in low:
+            return name
+    return None
+
+
+def _java_evidence(
+    *,
+    source: str,
+    path: str,
+    value: str,
+    version: Optional[int],
+    distribution: Optional[str] = None,
+) -> dict:
+    out = {
+        "source": source,
+        "path": path,
+        "value": value,
+        "version": version,
+        "version_label": _java_lts_name(version),
+    }
+    if distribution:
+        out["distribution"] = distribution
+    return out
+
+
+def _find_java_lts_support_files(root: Path) -> list[tuple[Path, str]]:
+    """Files that may declare build/runtime Java without executing the project."""
+    found: list[tuple[Path, str]] = []
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in _SKIP_DIRS or d == ".mvn"]
+        dp = Path(dirpath)
+        try:
+            rel_dir = dp.relative_to(root)
+        except ValueError:
+            continue
+        for fname in filenames:
+            if fname not in _JAVA_LTS_SUPPORT_FILE_NAMES:
+                continue
+            abs_path = dp / fname
+            rel = str(rel_dir / fname) if str(rel_dir) != "." else fname
+            found.append((abs_path, rel))
+    return found
+
+
+def _java_lts_inventory(
+    root: Path,
+    build_texts: "Iterable[tuple[str, str]]",
+    *,
+    spring_boot_version: Optional[str],
+    target_jdk: Optional[int],
+) -> dict:
+    """Java LTS/licensing inventory for migration planning.
+
+    Bounded evidence only: build descriptors and local deployment hints. No build
+    execution, no legal verdict, and no inference from absent runtime metadata.
+    """
+    target_lts = target_jdk or 25
+    evidence: list[dict] = []
+    limitations: list[str] = []
+
+    for rel_path, raw_text in build_texts:
+        text = _resolve_maven_properties(raw_text) if rel_path.endswith("pom.xml") else raw_text
+        if rel_path.endswith("pom.xml"):
+            for m in _MAVEN_JAVA_VERSION_RE.finditer(text):
+                major = _normalize_java_major(m.group(2))
+                evidence.append(_java_evidence(
+                    source=f"maven_property:{m.group(1)}",
+                    path=rel_path,
+                    value=m.group(2).strip(),
+                    version=major,
+                ))
+            for m in _MAVEN_COMPILER_TAG_RE.finditer(text):
+                major = _normalize_java_major(m.group(1))
+                evidence.append(_java_evidence(
+                    source="maven_compiler_plugin",
+                    path=rel_path,
+                    value=m.group(1).strip(),
+                    version=major,
+                ))
+        elif rel_path.endswith((".gradle", ".gradle.kts", "gradle.properties")):
+            for pat, source in (
+                (_GRADLE_JAVA_ENUM_RE, "gradle_java_version_enum"),
+                (_GRADLE_JAVA_ASSIGN_RE, "gradle_java_assignment"),
+                (_GRADLE_TOOLCHAIN_RE, "gradle_toolchain"),
+                (_JAVA_VERSION_LINE_RE, "gradle_property"),
+            ):
+                for m in pat.finditer(text):
+                    major = _normalize_java_major(m.group(1))
+                    evidence.append(_java_evidence(
+                        source=source,
+                        path=rel_path,
+                        value=m.group(1).strip(),
+                        version=major,
+                    ))
+
+    for abs_path, rel_path in _find_java_lts_support_files(root):
+        if rel_path.endswith(("pom.xml", "build.gradle", "build.gradle.kts")):
+            continue
+        try:
+            text = abs_path.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            limitations.append(f"{rel_path}: could not be read")
+            continue
+        if rel_path.endswith((".java-version", ".sdkmanrc", "jvm.config", "gradle.properties")):
+            for m in _JAVA_VERSION_LINE_RE.finditer(text):
+                major = _normalize_java_major(m.group(1))
+                evidence.append(_java_evidence(
+                    source="java_version_file",
+                    path=rel_path,
+                    value=m.group(1).strip(),
+                    version=major,
+                ))
+            if rel_path.endswith(".java-version"):
+                major = _normalize_java_major(text.strip())
+                evidence.append(_java_evidence(
+                    source="java_version_file",
+                    path=rel_path,
+                    value=text.strip(),
+                    version=major,
+                ))
+        if "docker" in rel_path.lower() or rel_path.lower().endswith(("compose.yml", "compose.yaml")):
+            for m in _DOCKER_FROM_RE.finditer(text):
+                image = m.group(1).strip()
+                tag_major: Optional[int] = None
+                tag_match = _DOCKER_JAVA_TAG_RE.search(image)
+                if tag_match:
+                    tag_major = _normalize_java_major(tag_match.group(1))
+                evidence.append(_java_evidence(
+                    source="container_base_image",
+                    path=rel_path,
+                    value=image,
+                    version=tag_major,
+                    distribution=_java_distribution_from_text(image),
+                ))
+            for m in _JAVA_VERSION_LINE_RE.finditer(text):
+                major = _normalize_java_major(m.group(1))
+                evidence.append(_java_evidence(
+                    source="container_java_env",
+                    path=rel_path,
+                    value=m.group(1).strip(),
+                    version=major,
+                    distribution=_java_distribution_from_text(text),
+                ))
+
+    versions = sorted({e["version"] for e in evidence if isinstance(e.get("version"), int)})
+    distributions = sorted({e["distribution"] for e in evidence if e.get("distribution")})
+    target_blockers: list[dict] = []
+    for version in versions:
+        if version < target_lts:
+            target_blockers.append({
+                "kind": "version_below_target_lts",
+                "version": version,
+                "target_lts": target_lts,
+                "reason": f"{_java_lts_name(version)} evidence is below target {_java_lts_name(target_lts)}",
+            })
+    if not versions:
+        target_blockers.append({
+            "kind": "java_version_unknown",
+            "version": None,
+            "target_lts": target_lts,
+            "reason": "No Java source/target/runtime version evidence found in build or deployment hints.",
+        })
+
+    licensing_reasons: list[str] = []
+    oracle_evidence = [
+        e for e in evidence
+        if str(e.get("distribution", "")).lower() == "oracle jdk"
+        or ("oracle" in str(e.get("value", "")).lower() and "jdk" in str(e.get("value", "")).lower())
+    ]
+    for e in oracle_evidence:
+        licensing_reasons.append(
+            f"{e['path']} declares {e.get('distribution', 'Oracle JDK')} "
+            f"{e.get('version_label', 'unknown version')} ({e['source']}); review support/licensing terms."
+        )
+
+    return {
+        "schema_version": "java-lts-inventory-v1",
+        "target_lts": target_lts,
+        "target_lts_basis": (
+            "--target-jdk supplied by caller" if target_jdk else
+            "default planning target for the 2026 Java LTS/licensing inventory"
+        ),
+        "versions": {
+            "detected": versions,
+            "lowest": versions[0] if versions else None,
+            "highest": versions[-1] if versions else None,
+            "labels": [_java_lts_name(v) for v in versions],
+        },
+        "distributions": distributions,
+        "evidence": evidence,
+        "spring_boot_version_detected": spring_boot_version,
+        "target_lts_blockers": target_blockers,
+        "licensing_review_needed": bool(licensing_reasons),
+        "licensing_review_reasons": licensing_reasons,
+        "legal_disclaimer": (
+            "Inventory signal only, not legal advice. ASK marks explicit Oracle JDK "
+            "or unknown-version evidence for review; license entitlement must be "
+            "confirmed from contracts and deployed binaries."
+        ),
+        "limitations": limitations + [
+            "No build was executed; Maven/Gradle toolchains and transitive runtime images may be incomplete.",
+            "Distribution detection is based on local build/container text only.",
+        ],
+    }
 # Cap on total readiness deduction from JDK-modernization findings (medium/low),
 # so reflection/date cleanups cannot collapse a jakarta-ready repo's headline.
 _JDK_ADVISORY_DEDUCTION_CAP: int = 15
@@ -1527,6 +1803,10 @@ class MigrationReport:
     # Opt-in — attached by the CLI under --blast-radius; None when not computed,
     # and then absent from the payload so the default report stays byte-identical.
     blast_radius: Optional[dict] = None
+    # F-P: Java LTS/licensing inventory, derived from build/runtime hints. Additive
+    # field: it informs migration planning but does not participate in readiness_score.
+    java_lts_inventory: dict = field(default_factory=dict)
+    evidence_manifest: dict = field(default_factory=dict)
 
     def finalize(self) -> "MigrationReport":
         if not self.generated_at:
@@ -2052,6 +2332,8 @@ class MigrationReport:
             "spring_test_only": self.spring_test_only,
             "spring_boot_2_detected": self.spring_boot_2_detected,
             "spring_boot_version_detected": self.spring_boot_version_detected,
+            "java_lts_inventory": self.java_lts_inventory,
+            **({"evidence_manifest": self.evidence_manifest} if self.evidence_manifest else {}),
             "summary": self.summary,
             "findings": [f.to_dict() for f in _listed],
             "hibernate": self.hibernate.to_dict() if self.hibernate is not None else None,
@@ -2155,6 +2437,9 @@ class MigrationReport:
                f"(readiness_score reflects jakarta/Boot3 only — Hibernate is a separate rewrite axis)"]
               if self.headline_blocker else []),
             f"Spring present: {self.spring_present}    Spring Boot 2 detected: {_boot}",
+            f"Java LTS inventory: target {self.java_lts_inventory.get('target_lts', 'unknown')}  "
+            f"detected {self.java_lts_inventory.get('versions', {}).get('labels', [])}  "
+            f"licensing_review_needed={self.java_lts_inventory.get('licensing_review_needed', False)}",
             f"Migration blockers (readiness dimensions): {self.migration_blocking_count}",
             f"Blocking issues (product code): {self.blocking_count}  "
             f"(critical: {main_crit}, high: {main_high})"
@@ -2534,6 +2819,7 @@ def run_migrate_check(
     dep_read_errors = 0
     raw_dep_findings: list[MigrationFinding] = []
     _build_texts: list[str] = []
+    _build_sources: list[tuple[str, str]] = []
     for abs_path, rel_path in build_files:
         try:
             text = abs_path.read_text(encoding="utf-8", errors="replace")
@@ -2541,6 +2827,7 @@ def run_migrate_check(
             dep_read_errors += 1
             continue
         _build_texts.append(text)
+        _build_sources.append((rel_path, text))
         dep_findings = _scan_dep_file(text, rel_path)
         filtered = [f for f in dep_findings if SEVERITY_ORDER.get(f.severity, 3) <= min_order]
         raw_dep_findings.extend(filtered)
@@ -2595,6 +2882,12 @@ def run_migrate_check(
         root, spring_runtime_import_seen, spring_test_import_seen
     )
     spring_boot_present = _detect_spring_boot_present(root)
+    java_lts_inventory = _java_lts_inventory(
+        root,
+        _build_sources,
+        spring_boot_version=spring_boot_version,
+        target_jdk=target_jdk,
+    )
 
     # BUG #8: classify each finding's code context (main / test / generated) so the
     # report can keep test fixtures and autogenerated sources out of blocking_count.
@@ -2645,6 +2938,7 @@ def run_migrate_check(
         jakarta_namespace_adopted=jakarta_import_count > 0,
         findings=all_findings,
         hibernate=hibernate_strat,
+        java_lts_inventory=java_lts_inventory,
         limitations=limitations,
         metadata={
             "java_files_scanned": len(file_paths),
@@ -2703,7 +2997,19 @@ def run_migrate_check(
     except Exception:
         pass
 
-    return report.finalize()
+    report = report.finalize()
+    from sourcecode.provenance import build_evidence_manifest
+    report.evidence_manifest = build_evidence_manifest(
+        report.to_dict(),
+        command="migrate-check",
+        root=root,
+        inputs={
+            "min_severity": min_severity,
+            "target_jdk": target_jdk,
+            "keep_boot": keep_boot,
+        },
+    )
+    return report
 
 
 # Remaining static limitations — things that truly require runtime analysis