sourcecode 5.0.0__py3-none-any.whl → 5.0.1__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.0.0"
+__version__ = "5.0.1"

sourcecode/cache_model.py

@@ -87,7 +87,28 @@ class CommandCache:
     #: releases (spring-audit, 408 s in #13 against 2 351 s in #16) is itself the
     #: measurement C3-76 exists for.
     field_seconds: "Optional[float]" = None
+    #: **C3-100.** `field_blocked` is a *measurement outcome*, not a property of the
+    #: command: it says "this run did not finish on that build, at that size", and
+    #: like every other measurement here it belongs to the build named in
+    #: `field_measured_version` and expires with it. It was read as a property for
+    #: three releases — `repo-ir` and `verify-edit` carried a 4.10.4 outcome while
+    #: eval #23 ran them in 9,8 s and 76,6 s — which is worse than a stale number,
+    #: because a stale number is a measurement and *"the field could not run this"*
+    #: is an incapacity the product does not have. A blocked row without a build is
+    #: rejected by the battery for the same reason a figure without one is.
     field_blocked: bool = False
+    #: The cache state the field figure was taken in. Eval #22 measured a warm
+    #: machine; eval #23 purged every cache first (`cache clear --all`,
+    #: `context-clear`, `rm -rf parse-cache-v1`) and then ran the whole catalogue
+    #: in one round, so its first figures are cold and its later ones are neither —
+    #: the shared layers filled as the round went on. Published because *72,3 s
+    #: cold* and *72,3 s warm* are two different facts about the same command, and
+    #: the row that says which is the only thing standing between the two:
+    #:   ``warm``  — the caches were warmed before the run
+    #:   ``cold``  — every cache was purged before the run
+    #:   ``mixed`` — inside a round that began purged: earlier commands had already
+    #:               filled some of the shared layers this one reads
+    field_cache_state: str = "warm"
     #: **C3-97.** The build the field figure was taken on. An anchor without one is
     #: a measurement that can outlive its build and keep deciding: 4.18.0 deleted
     #: two catastrophic-backtracking patterns (C3-95, C3-96) and every figure taken
@@ -137,21 +158,20 @@ REFERENCE_MEASURED_VERSION = "3.2.2"
 #: What can be said honestly is the class, the two measured anchors, **the build
 #: each was measured on**, and how to run it.
 #:
-#: History of this constant, kept because it is the measurement C3-76 exists for:
+#: History of the anchor, kept because it is the measurement C3-76 exists for:
 #: 408 s (#13) → 2 351 s (#16, C3-72) → 8,4 s (#22, C3-97). The middle figure was
 #: quoted as an operational anchor for four releases after the build that produced
 #: it, and told operators to detach commands that finish in seconds.
-FIELD_ANCHOR = (
-    "field evaluation #22: spring-audit on 3 342 Java files took 8.4 s "
-    "(Windows, pipx, warm cache) against 8.8 s on the 2 000-file reference"
-)
+#:
+#: ⚠ `FIELD_ANCHOR`, `FIELD_ANCHOR_SECONDS` and `FIELD_ANCHOR_MEASURED_VERSION`
+#: are **derived from the `spring-audit` row**, below `COMMANDS`. They used to be
+#: written out here as well, which made the anchor two facts kept in step by hand:
+#: C3-97 refreshed both, and C3-100 is what it costs when the next refresh reaches
+#: only one of the copies. One authority per fact — the table — and the headline
+#: reads itself off it.
+#:
+#: The size of the field repository every `field_seconds` below was taken on.
 FIELD_ANCHOR_JAVA_FILES = 3342
-FIELD_ANCHOR_SECONDS = 8.4
-
-#: The build the field anchors above were taken on. Rows carrying a different
-#: `field_measured_version` are published with that build's name attached rather
-#: than as figures for this one (C3-97).
-FIELD_ANCHOR_MEASURED_VERSION = "4.18.0"
 
 
 #: Every layer keys on `cache.worktree_signature` — the exact tree state (C1-9).
@@ -217,9 +237,12 @@ COMMANDS: tuple[CommandCache, ...] = (
     CommandCache("ask (root)", ("snapshot", "ris", "parse"), "answer", True,
                  "`--compact` is what a warm stores by default; `--agent` needs `cache warm --agent`. "
                  "`--env-map`, `--depth N` and `--exclude` change the *analysis*, so they miss the "
-                 "warmed core and rescan — this is the 171 s the field measured after a 103 s warm.",
+                 "warmed core and rescan — the 171 s the field measured after a 103 s warm on 4.10.4. "
+                 "Eval #23 timed the same invocation at 72,3 s from a purged cache, and then paid "
+                 "71,7 s again for `--agent` on the state it had just analysed (C3-103).",
                  "--compact 13.3 s cold → 0.3 s warm (cold re-measured on 3.7.0: was 19.3 s, C3-6); "
-                 "--agent --full --env-map --depth 20 34.7 s → 33.9 s (no gain)", analysis_class="repo-wide", cold_seconds=13.3, warm_seconds=0.3, field_seconds=115.0, field_measured_version="4.10.4"),
+                 "--agent --full --env-map --depth 20 34.7 s → 33.9 s (no gain)", analysis_class="repo-wide", cold_seconds=13.3, warm_seconds=0.3,
+                 field_seconds=72.3, field_cache_state="cold", field_measured_version="5.0.0"),
     CommandCache("posture", ("cir", "parse"), "shared", False,
                  "Resolves the conditional bean graph on every run, over the shared CIR a warm "
                  "builds — the parse it used to repeat for itself. `--diff` compares two profile "
@@ -284,9 +307,11 @@ COMMANDS: tuple[CommandCache, ...] = (
     CommandCache("verify", (), "none", False, "Runs the contracts against a fresh reading.", analysis_class="core"),
     CommandCache("verify-edit", ("parse",), "shared", True,
                  "Built for the edit loop: the parse cache is what keeps an unchanged file out of the "
-                 "next run. Its own second run is faster again.",
+                 "next run. Its own second run is faster again. At field size that loop is not short "
+                 "yet: eval #23 measured 76,6 s on a tree with no edits, because the HEAD side is "
+                 "still built in a throwaway worktree instead of reusing the shared CIR (C3-102).",
                  "14.6 s → 9.6 s → 5.6 s on repeat", analysis_class="repo-wide", cold_seconds=14.6, warm_seconds=9.6,
-                 field_blocked=True, field_measured_version="4.10.4"),
+                 field_seconds=76.6, field_cache_state="mixed", field_measured_version="5.0.0"),
     CommandCache("review-pr", ("cir",), "none", False,
                  "Diff-dependent, and it reuses the CIR only if one exists. On a small diff, loading "
                  "the warmed CIR costs more than the work it saves.",
@@ -318,8 +343,12 @@ COMMANDS: tuple[CommandCache, ...] = (
                  "9.8 s → 1.6 s", analysis_class="core", cold_seconds=9.8, warm_seconds=1.6,
                  field_seconds=4.4, field_measured_version="4.18.0"),
     CommandCache("export", ("parse",), "shared", False, "", "8.8 s → 3.7 s", analysis_class="repo-wide", cold_seconds=8.8, warm_seconds=3.7),
-    CommandCache("repo-ir", ("parse",), "shared", False, "", "5.1 s → 2.9 s", analysis_class="repo-wide", cold_seconds=5.1, warm_seconds=2.9,
-                 field_blocked=True, field_measured_version="4.10.4"),
+    CommandCache("repo-ir", ("parse",), "shared", False,
+                 "Carried as *did not finish* from 4.10.4 until eval #23 ran it at field size in "
+                 "9,8 s — a run that did not finish once is not a command that cannot finish "
+                 "(C3-100, and the same correction `modernize` needed).",
+                 "5.1 s → 2.9 s", analysis_class="repo-wide", cold_seconds=5.1, warm_seconds=2.9,
+                 field_seconds=9.8, field_cache_state="mixed", field_measured_version="5.0.0"),
     CommandCache("validation", ("parse",), "shared", False, "", "11.6 s → 6.4 s", analysis_class="repo-wide", cold_seconds=11.6, warm_seconds=6.4,
                  field_seconds=17.4, field_measured_version="4.18.0"),
     CommandCache("modernize", ("parse",), "shared", False,
@@ -333,8 +362,11 @@ COMMANDS: tuple[CommandCache, ...] = (
                  "`no_ris` instead of a snapshot.",
                  "0.2 s either way", analysis_class="core", cold_seconds=0.2, warm_seconds=0.2),
     CommandCache("trend", (), "none", False, "Reads stored baseline artifacts from disk; analyses no source, so no cache layer applies. Same command as `baseline trend`.", analysis_class="none"),
-    CommandCache("baseline", ("parse",), "shared", False, "`capture`/`diff`/`trend` over architectural metrics.",
-                 "capture 8.7 s → 3.6 s", analysis_class="repo-wide", cold_seconds=8.7, warm_seconds=3.6, field_seconds=11.0, field_measured_version="4.10.4"),
+    CommandCache("baseline", ("parse",), "shared", False,
+                 "`capture`/`diff`/`trend` over architectural metrics. The field figure is `capture`, "
+                 "the subcommand that analyses; `trend` reads stored artifacts and has its own row.",
+                 "capture 8.7 s → 3.6 s", analysis_class="repo-wide", cold_seconds=8.7, warm_seconds=3.6,
+                 field_seconds=2.2, field_cache_state="mixed", field_measured_version="5.0.0"),
     CommandCache("retrieve", ("cir", "parse"), "shared", False,
                  "Every query builds or reuses the shared CIR a warm builds.", analysis_class="core"),
     CommandCache("archetype", ("parse",), "shared", False, "", "9.3 s → 5.6 s", analysis_class="repo-wide", cold_seconds=9.3, warm_seconds=5.6),
@@ -355,6 +387,73 @@ _WARM_LABEL = {
     "none": "nothing",
 }
 
+#: The cache states a field figure may declare. A row outside this set is a
+#: measurement whose conditions nobody can read (C3-100).
+FIELD_CACHE_STATES = ("warm", "cold", "mixed")
+
+
+def _thousands(n: int) -> str:
+    return f"{n:,}".replace(",", " ")
+
+
+def _row(command: str) -> "CommandCache":
+    for entry in COMMANDS:
+        if entry.command == command:
+            return entry
+    raise KeyError(command)
+
+
+#: The headline anchor, read off the table rather than written twice (C3-100).
+#: `spring-audit` is the command the whole series measured — 408 s (#13), 2 351 s
+#: (#16), 8,4 s (#22) — so it is the row the front page quotes, and quoting it
+#: means reading it, not copying it.
+_FIELD_ANCHOR_ROW = _row("spring-audit")
+FIELD_ANCHOR_SECONDS = _FIELD_ANCHOR_ROW.field_seconds
+FIELD_ANCHOR_MEASURED_VERSION = _FIELD_ANCHOR_ROW.field_measured_version
+FIELD_ANCHOR = (
+    f"field evaluation #22: spring-audit on {_thousands(FIELD_ANCHOR_JAVA_FILES)} "
+    f"Java files took {FIELD_ANCHOR_SECONDS:g} s (Windows, pipx, "
+    f"{_FIELD_ANCHOR_ROW.field_cache_state} cache) against "
+    f"{_FIELD_ANCHOR_ROW.cold_seconds:g} s on the "
+    f"{_thousands(REFERENCE_JAVA_FILES)}-file reference"
+)
+
+
+def _version_key(version: "Optional[str]") -> tuple:
+    """A comparable key for a release name, for ordering measurements only.
+
+    Not a distance — `reference_currency` refuses to invent one and this does not
+    either. It answers exactly one question: is this row's build older than the
+    newest build anything in the table was measured on (C3-100)? Anything
+    unparseable sorts oldest, which is the safe direction: it gets labelled.
+    """
+    if not version:
+        return ()
+    parts: list[int] = []
+    for chunk in version.split("."):
+        digits = "".join(c for c in chunk if c.isdigit())
+        if not digits:
+            break
+        parts.append(int(digits))
+    return tuple(parts)
+
+
+def newest_field_measurement_version() -> "Optional[str]":
+    """The most recent build any field figure in the table was taken on.
+
+    The reference point for *"this row is older than the table it sits in"* — the
+    state C3-100 lived in for three releases, where a refresh reached five rows
+    and left four behind on a build four releases older, with nothing anywhere
+    saying so.
+    """
+    versions = [
+        row.field_measured_version
+        for row in COMMANDS
+        if (row.field_seconds is not None or row.field_blocked)
+        and row.field_measured_version
+    ]
+    return max(versions, key=_version_key) if versions else None
+
 
 def layer(layer_id: str) -> Layer:
     for entry in LAYERS:
@@ -459,10 +558,6 @@ def cost_sentence() -> str:
     )
 
 
-def _thousands(n: int) -> str:
-    return f"{n:,}".replace(",", " ")
-
-
 def field_currency() -> dict:
     """The same statement as `reference_currency`, for the field anchors (C3-97).
 
@@ -473,11 +568,32 @@ def field_currency() -> dict:
     from sourcecode import __version__
 
     current = __version__
+    measured = [
+        row for row in COMMANDS
+        if row.field_seconds is not None or row.field_blocked
+    ]
     stale = sorted(
         row.command
-        for row in COMMANDS
-        if (row.field_seconds is not None or row.field_blocked)
-        and row.field_measured_version not in (None, current)
+        for row in measured
+        if row.field_measured_version not in (None, current)
+    )
+    # C3-100: the other staleness, and the one that hid for three releases — not
+    # "older than the build you are running" (every row is, the day after a
+    # release) but "older than the newest measurement in this same table", which
+    # is a refresh that reached some rows and not others. Named here so the gap is
+    # readable without diffing the rows by hand.
+    newest = newest_field_measurement_version()
+    behind = sorted(
+        row.command
+        for row in measured
+        if _version_key(row.field_measured_version) < _version_key(newest)
+    )
+    lagging = (
+        f" {len(behind)} of the {len(measured)} field figures were taken before "
+        f"the newest one in this table ({newest}): "
+        f"{', '.join(behind)}."
+        if behind
+        else ""
     )
     return {
         "anchor": FIELD_ANCHOR,
@@ -485,12 +601,17 @@ def field_currency() -> dict:
         "running_version": current,
         "current": FIELD_ANCHOR_MEASURED_VERSION == current,
         "rows_measured_on_an_earlier_build": stale,
+        "newest_field_measurement_version": newest,
+        "rows_behind_the_newest_field_measurement": behind,
         "statement": (
-            f"The field anchors were taken on {FIELD_ANCHOR_MEASURED_VERSION}; you "
-            f"are running {current}. Each row states the build its field figure "
-            f"belongs to, and no figure is projected onto this one."
-            if FIELD_ANCHOR_MEASURED_VERSION != current
-            else f"The field anchors were taken on {current}, the build you are running."
+            (
+                f"The field anchors were taken on {FIELD_ANCHOR_MEASURED_VERSION}; you "
+                f"are running {current}. Each row states the build its field figure "
+                f"belongs to, and no figure is projected onto this one."
+                if FIELD_ANCHOR_MEASURED_VERSION != current
+                else f"The field anchors were taken on {current}, the build you are running."
+            )
+            + lagging
         ),
     }
 
@@ -590,6 +711,7 @@ def as_dict(here: "Optional[Conditioning]" = None) -> dict:
                         "seconds": cmd.field_seconds,
                         "did_not_finish": cmd.field_blocked,
                         "java_files": FIELD_ANCHOR_JAVA_FILES,
+                        "cache_state": cmd.field_cache_state,
                         "measured_on_version": cmd.field_measured_version,
                         "note": field_anchor_note(cmd),
                     }
@@ -713,13 +835,15 @@ def render_text(here: "Optional[Conditioning]" = None) -> str:
             lines.append(f"  {' ' * width}    measured: {cmd.measured}")
         if cmd.field_seconds is not None or cmd.field_blocked:
             # C3-97: never the seconds without the build they were taken on.
+            # C3-100: nor without the cache state they were taken in.
             note = field_anchor_note(cmd)
             shown = (
                 "did not finish in an interactive session"
                 if cmd.field_seconds is None
                 else f"{cmd.field_seconds:g} s"
             )
-            suffix = f" ({note})" if note else ""
+            qualifiers = [f"{cmd.field_cache_state} cache"] + ([note] if note else [])
+            suffix = f" ({', '.join(qualifiers)})"
             lines.append(
                 f"  {' ' * width}    field:    {shown} at "
                 f"{_thousands(FIELD_ANCHOR_JAVA_FILES)} Java files{suffix}"

sourcecode/execution_plan.py

@@ -204,7 +204,16 @@ def cost_row(command: str):
     `retrieve blast-radius <sym> .` — because that is what the front page and the
     remedies hold. Flags and arguments are dropped; what is left is the command.
     """
-    tokens = [t for t in (command or "").split() if not t.startswith("-")]
+    named = (command or "").strip()
+    if named in _BY_COMMAND:
+        # A caller may also ask by the name the table itself gives a row, which is
+        # how `cache model` builds its `here:` lines. The root analysis is filed as
+        # "ask (root)" — a name the tokenizer below strips to `(root)` and then
+        # fails to find, so the root row's `here:` line was the only one published
+        # from its class instead of from its measurement (C3-100: a cell nothing
+        # reads is the cell that goes stale).
+        return _BY_COMMAND[named]
+    tokens = [t for t in named.split() if not t.startswith("-")]
     if tokens and tokens[0] in ("ask", "sourcecode"):
         tokens = tokens[1:]
     if not tokens:
@@ -259,16 +268,22 @@ def _reference(row) -> Optional[str]:
             f"{row.cold_seconds:g} s cold{warm} at {REFERENCE_JAVA_FILES} files"
         )
     note = field_anchor_note(row)
-    dated = f", {note}" if note else ""
+    # C3-100: the cache state travels with the figure for the same reason the
+    # build does — a root analysis is 72,3 s from a purged cache and 0,3 s from a
+    # warm one, so a figure that does not say which is not a measurement anybody
+    # can act on.
+    qualified = ", ".join(
+        ["field", f"{row.field_cache_state} cache"] + ([note] if note else [])
+    )
     if row.field_seconds is not None:
         parts.append(
             f"{row.field_seconds:g} s at {_files(FIELD_ANCHOR_JAVA_FILES)} files "
-            f"(field{dated})"
+            f"({qualified})"
         )
     elif row.field_blocked:
         parts.append(
             f"did not finish in an interactive session at "
-            f"{_files(FIELD_ANCHOR_JAVA_FILES)} files (field{dated})"
+            f"{_files(FIELD_ANCHOR_JAVA_FILES)} files ({qualified})"
         )
     return " · ".join(parts) or None
 
@@ -310,11 +325,27 @@ def verdict(command: str, scope: Scope) -> Verdict:
         # critical finding — under "too big for this session" because its class
         # is repo-wide would repeat C4-19 in the other direction.
         if row is not None and row.field_blocked:
+            # C3-100: an outcome is a measurement, so it is dated like one. "It did
+            # not finish" is the strongest claim this table makes about a command,
+            # and it was published undated while the field was running two of those
+            # commands in 9,8 s and 76,6 s. It still decides — an outcome at this
+            # size outranks a class, as C3-97 established for seconds — but it says
+            # which build it happened on and that nothing has re-measured it since.
+            note = field_anchor_note(row)
+            dated = ""
+            if note:
+                dated = (
+                    f" on {row.field_measured_version}"
+                    if row.field_measured_version
+                    else " on a build the row does not record"
+                )
+            since = ", and nothing has re-measured it since" if note else ""
             return Verdict(
                 command, DETACH,
                 (
                     f"measured at this size and it did not finish in an interactive "
-                    f"session ({_files(FIELD_ANCHOR_JAVA_FILES)} Java files, cold) — "
+                    f"session{dated} ({_files(FIELD_ANCHOR_JAVA_FILES)} Java files, "
+                    f"{row.field_cache_state} cache){since} — "
                     f"run it with `--output` and `--detach`, or nightly"
                 ),
                 cls, reference,
@@ -325,7 +356,14 @@ def verdict(command: str, scope: Scope) -> Verdict:
             # a measurement at this size and the class is not — but it is never
             # printed as though it described the build in hand.
             note = field_anchor_note(row)
-            dated = f" ({note})" if note else ""
+            # C3-100: and the cache state it was taken in. `ask --compact` is the
+            # row this matters most on — 72,3 s from a purged cache against 0,3 s
+            # warm on the reference — and the honest thing to publish is the
+            # measurement's conditions, not a warm figure nobody took at this size.
+            qualifiers = ", ".join(
+                [f"{row.field_cache_state} cache"] + ([note] if note else [])
+            )
+            dated = f" ({qualifiers})"
             if row.field_seconds <= FOREGROUND_SECONDS:
                 return Verdict(
                     command, RUNS_NOW,

sourcecode/posture.py

@@ -33,6 +33,9 @@ from pathlib import Path
 from typing import TYPE_CHECKING, Any, Optional
 
 from sourcecode.remedies import remedy
+from sourcecode.security_chain import CHAIN_PARTICIPANT_TYPES as _CHAIN_PARTICIPANT_TYPES
+from sourcecode.security_chain import simple_name as _chain_simple_name
+from sourcecode.security_chain import types_from_edges as _chain_types_from_edges
 
 if TYPE_CHECKING:
     from sourcecode.canonical_ir import CanonicalRepositoryIR
@@ -478,20 +481,17 @@ _SECURITY_CONFIG_ANNOTATIONS = frozenset({
     "@EnableWebSecurity", "@EnableMethodSecurity", "@EnableGlobalMethodSecurity",
     "@EnableReactiveMethodSecurity", "@EnableWebFluxSecurity",
 })
-_SECURITY_CONFIG_SUPERTYPES = frozenset({
-    "WebSecurityConfigurerAdapter", "SecurityFilterChain",
-    "AbstractSecurityInterceptor", "OncePerRequestFilter",
-})
-
-
-#: Edge types that say "this type IS one of those" — the inheritance half of the
-#: request-chain SPI test.
-_SUPERTYPE_EDGES = frozenset({"extends", "implements"})
+#: C1-43: the request-chain SPI vocabulary is `security_chain`'s, not a second
+#: copy here. This command asks the *participant* question — a filter takes part
+#: in configuring the chain without declaring one — while the endpoint surface
+#: asks the narrower declaration question. Same vocabulary, same member rule, two
+#: named subsets.
+_SECURITY_CONFIG_SUPERTYPES = _CHAIN_PARTICIPANT_TYPES
 
 
 def _simple_name(type_ref: str) -> str:
     """`a.b.Chain<T>` → `Chain`. Generic arguments are not part of the type's name."""
-    return str(type_ref).partition("<")[0].rsplit(".", 1)[-1].strip()
+    return _chain_simple_name(type_ref)
 
 
 def _security_config_types(cir: "CanonicalRepositoryIR") -> "frozenset[str]":
@@ -520,25 +520,12 @@ def _security_config_types(cir: "CanonicalRepositoryIR") -> "frozenset[str]":
     cached = getattr(cir, "_posture_security_types", None)
     if cached is not None:
         return cached
-    relevant: set[str] = set()
     raw = getattr(cir, "_raw_ir", None) or {}
     graph = raw.get("graph") if isinstance(raw, dict) else None
     edges = (graph or {}).get("edges") if isinstance(graph, dict) else None
-    for edge in edges or []:
-        if not isinstance(edge, dict):
-            continue
-        kind = edge.get("type")
-        if kind not in _SUPERTYPE_EDGES and kind != "returns":
-            continue
-        if _simple_name(edge.get("to") or "") not in _SECURITY_CONFIG_SUPERTYPES:
-            continue
-        source = str(edge.get("from") or "")
-        if not source:
-            continue
-        # A member returning the SPI type makes its *declaring class* the
-        # configuration; a type extending it is the configuration itself.
-        relevant.add(source.partition("#")[0] if kind == "returns" else source)
-    result = frozenset(relevant)
+    # C1-43: the scan itself lives in `security_chain`, so the endpoint surface's
+    # narrower reading of the same edges cannot drift from this one.
+    result = _chain_types_from_edges(edges or [], targets=_SECURITY_CONFIG_SUPERTYPES)
     try:
         object.__setattr__(cir, "_posture_security_types", result)
     except Exception:

sourcecode/repository_ir.py

@@ -348,15 +348,19 @@ _SECURITY_MARKER_ANNOTATIONS: frozenset[str] = frozenset({
     "@PermitAll", "@DenyAll", "@Authenticated",
 })
 
-# Annotations on config classes that indicate a centralized security filter chain
-# (Spring Security / Spring Boot).  When present, per-endpoint no_security_signal
-# is expected and does NOT mean endpoints are unprotected.
-_FILTER_SECURITY_ANNOTATIONS: frozenset[str] = frozenset({
-    "@EnableWebSecurity",
-    # @EnableMethodSecurity / @EnableGlobalMethodSecurity enable per-method annotation
-    # security (@PreAuthorize/@Secured), NOT a filter chain — must NOT be treated as
-    # filter_based or SEC-001 is suppressed for every unannotated endpoint.
-})
+# A centralized security filter chain: when the repository declares one,
+# per-endpoint no_security_signal is expected and does NOT mean endpoints are
+# unprotected.
+#: C1-43: "does this repository declare a request filter chain?" is one fact with
+#: one reading, and it lives in `security_chain` — which is also where the reason
+#: `@EnableMethodSecurity` is *not* in it is written down. This module used to
+#: answer it from annotations and `extends WebSecurityConfigurerAdapter` alone,
+#: i.e. Spring Security 5 vocabulary, while `posture` had already learned that a
+#: chain can be a `@Bean SecurityFilterChain` and nothing else. The consequence
+#: was not a missing signal: it was SEC-001 telling the reader that a Security 6
+#: repository has no centralized filter, and naming a route the chain admits on
+#: purpose as reachable without authentication.
+from sourcecode.security_chain import declares_request_chain as _declares_request_chain
 
 # Programmatic security: method-call patterns that indicate runtime auth enforcement.
 # Requires method-call or field-access context — bare class name mentions (imports,
@@ -4586,16 +4590,10 @@ def _assemble(
     # Stored here so CIR projections (project_endpoint_surface) can read it without
     # re-parsing symbols.
     _class_syms_asm = [s for s in sorted_syms if s.type in ("class", "interface")]
-    _filter_based_asm = (
-        any(
-            ann in _FILTER_SECURITY_ANNOTATIONS
-            for sym in _class_syms_asm
-            for ann in sym.annotations
-        )
-        or any(
-            _extends_map.get(sym.symbol, "") == "WebSecurityConfigurerAdapter"
-            for sym in _class_syms_asm
-        )
+    _filter_based_asm = _declares_request_chain(
+        annotations=(a for sym in _class_syms_asm for a in sym.annotations),
+        supertypes=(_extends_map.get(sym.symbol, "") for sym in _class_syms_asm),
+        return_types=(s.return_type for s in sorted_syms if s.type == "method"),
     )
     # A repo whose authorization runs through its OWN annotation is not an
     # unsecured repo. The `endpoints` command applied this predicate to its own
@@ -6487,18 +6485,10 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     # When present, high no_security_signal is expected — security is enforced by
     # the filter chain, not per-endpoint annotations.
     _class_syms = [s for s in all_symbols if s.type in ("class", "interface")]
-    _filter_based = (
-        # Config class annotated with EnableWebSecurity / EnableMethodSecurity
-        any(
-            ann in _FILTER_SECURITY_ANNOTATIONS
-            for sym in _class_syms
-            for ann in sym.annotations
-        )
-        # Class extends WebSecurityConfigurerAdapter (pre-Spring 5.7 style)
-        or any(
-            extends_map.get(sym.symbol, "") == "WebSecurityConfigurerAdapter"
-            for sym in _class_syms
-        )
+    _filter_based = _declares_request_chain(
+        annotations=(a for sym in _class_syms for a in sym.annotations),
+        supertypes=(extends_map.get(sym.symbol, "") for sym in _class_syms),
+        return_types=(s.return_type for s in all_symbols if s.type == "method"),
     )
     # A repo whose authorization runs through its OWN annotation is not an
     # unsecured repo. The structural gate predicate (coverage + specificity over

sourcecode/security_chain.py

@@ -0,0 +1,148 @@
+"""security_chain.py — the Spring Security request filter chain, read once.
+
+C1-43. *"Does this repository declare a request filter chain?"* had two readings
+that disagreed, and the weaker one decided whether a `high`-severity finding
+family ran at all.
+
+`posture` learned the modern shape and recorded why in its own docstring: the
+chain used to be read off annotations only, so **a repository that wires its
+chain with a `@Bean SecurityFilterChain` and no `@EnableWebSecurity` reported
+`security.active: 0`** — a false zero on the axis that command exists for. The
+endpoint surface never learned it. It still tested `@EnableWebSecurity` and
+`extends WebSecurityConfigurerAdapter`, which is Spring Security 5 vocabulary,
+so a Spring Security 6 application — where the chain is a bean and the
+annotation is optional — came out `annotation_based`, and SEC-001 then told the
+reader, per unannotated handler, that *"there is no centralized filter — any
+caller can reach this endpoint without authentication"*.
+
+Field evaluation #24 measured what that costs: on a greenfield Boot 3 service,
+the one SEC-001 finding was `POST /api/v1/auth/login`, a route the chain admits
+on purpose (`PUBLIC_ENDPOINTS` … `permitAll()`), sitting under an
+`anyRequest().authenticated()` that guards the other 24. The detection was
+right; the binding was missing.
+
+**Two questions, deliberately named apart, because they have different answers
+and only one of them may silence a finding.**
+
+``declares_request_chain`` — *does the repository declare a chain at all?* A
+declaration is the chain itself: the enabling annotation, the pre-5.7 adapter,
+or a member that produces a ``SecurityFilterChain``. This is the premise
+SEC-001 rests on, so it is deliberately narrow: a filter is **not** a
+declaration. Widening it here would silence the rule on repositories that have
+no centralized authorization, which is the failure mode P1-A already records.
+
+``chain_participant_types`` — *which types take part in configuring the chain?*
+Broader: a ``OncePerRequestFilter`` participates without declaring anything.
+`posture` asks this one, to show which beans a profile switch moves.
+
+Both read the same vocabulary and the same member rule from this file, so the
+two answers can differ in scope but never in mechanism.
+"""
+from __future__ import annotations
+
+from typing import Iterable
+
+#: The annotation that turns on the request filter chain. **One entry, on
+#: purpose.** `@EnableMethodSecurity` / `@EnableGlobalMethodSecurity` enable
+#: per-method annotation security (`@PreAuthorize`, `@Secured`) and configure no
+#: chain; counting them here would suppress SEC-001 for every unannotated
+#: endpoint in exactly the repositories the rule exists for.
+CHAIN_DECLARATION_ANNOTATIONS: "frozenset[str]" = frozenset({
+    "@EnableWebSecurity",
+})
+
+#: Types whose presence *is* the chain. `WebSecurityConfigurerAdapter` is the
+#: pre-5.7 form (extended); `SecurityFilterChain` is the current one (returned
+#: from a `@Bean` method). Either one means the request path has a centralized
+#: authorization configuration.
+CHAIN_DECLARATION_TYPES: "frozenset[str]" = frozenset({
+    "WebSecurityConfigurerAdapter",
+    "SecurityFilterChain",
+})
+
+#: Everything that participates in configuring the chain, which includes
+#: declaring it. A filter or an interceptor changes what the chain does without
+#: declaring that there is one — true for `posture`'s question, false for
+#: SEC-001's premise.
+CHAIN_PARTICIPANT_TYPES: "frozenset[str]" = CHAIN_DECLARATION_TYPES | frozenset({
+    "AbstractSecurityInterceptor",
+    "OncePerRequestFilter",
+})
+
+#: Edge kinds that say "this type IS one of those" — the inheritance half of the
+#: test. The other half is `returns`, handled separately because it attributes to
+#: the declaring class rather than to the member.
+SUPERTYPE_EDGES: "frozenset[str]" = frozenset({"extends", "implements"})
+
+
+def simple_name(type_ref: str) -> str:
+    """``a.b.Chain<T>`` → ``Chain``. Generic arguments are not part of a name.
+
+    Array and whitespace noise is stripped too, because the same vocabulary is
+    matched against a declared return type (`SecurityFilterChain`, written by
+    hand) and against a resolved edge target (`org.springframework…`, produced
+    by the resolver), and a rule that only worked on one of them would be the
+    drift this module exists to prevent.
+    """
+    return str(type_ref).partition("<")[0].replace("[]", "").strip().rsplit(".", 1)[-1].strip()
+
+
+def _matches(type_ref: str, targets: "frozenset[str]") -> bool:
+    return simple_name(type_ref) in targets
+
+
+def declares_request_chain(
+    *,
+    annotations: "Iterable[str]" = (),
+    supertypes: "Iterable[str]" = (),
+    return_types: "Iterable[str]" = (),
+) -> bool:
+    """True when this repository declares a Spring Security request filter chain.
+
+    Three evidence shapes, because the two callers hold the evidence in different
+    forms and neither should have to reshape it into the other's: annotations
+    anywhere in the repository, supertypes of its classes, and the declared
+    return types of its members. The rule is one rule; only the input differs.
+
+    A member returning the chain type is a declaration of the chain — that is the
+    `@Bean SecurityFilterChain` shape, and the reason this function exists.
+    """
+    for annotation in annotations:
+        if str(annotation).split("(", 1)[0].strip() in CHAIN_DECLARATION_ANNOTATIONS:
+            return True
+    for supertype in supertypes:
+        if supertype and _matches(supertype, CHAIN_DECLARATION_TYPES):
+            return True
+    for return_type in return_types:
+        if return_type and _matches(return_type, CHAIN_DECLARATION_TYPES):
+            return True
+    return False
+
+
+def types_from_edges(
+    edges: "Iterable[dict]",
+    *,
+    targets: "frozenset[str]",
+) -> "frozenset[str]":
+    """Types related to *targets* by inheritance or by a member that returns one.
+
+    Reads the IR's own edge list — the vocabulary of a node is fqn/annotations/
+    signature/role, so inheritance and return types are `extends`, `implements`
+    and `returns` **edges** and nothing else. A member returning the SPI type
+    makes its *declaring class* the configuration; a type extending it is the
+    configuration itself.
+    """
+    relevant: "set[str]" = set()
+    for edge in edges or ():
+        if not isinstance(edge, dict):
+            continue
+        kind = edge.get("type")
+        if kind not in SUPERTYPE_EDGES and kind != "returns":
+            continue
+        if not _matches(edge.get("to") or "", targets):
+            continue
+        source = str(edge.get("from") or "")
+        if not source:
+            continue
+        relevant.add(source.partition("#")[0] if kind == "returns" else source)
+    return frozenset(relevant)

sourcecode/security_config_scan.py

@@ -467,26 +467,73 @@ def _comment_excerpt(text: str) -> str:
     return cleaned[:120] + ("..." if len(cleaned) > 120 else "")
 
 
+#: How far past a comment the declaration it heads is looked for. A declaration
+#: head is annotations + modifiers + signature; 600 characters covers a generously
+#: annotated method and stops well short of the next member.
+_DECLARATION_HEAD_WINDOW = 600
+
+
+def _control_is_live_below(live_source: str, end: int, pattern: "re.Pattern") -> bool:
+    """True when the same control is live in the declaration this comment heads.
+
+    C3-101, the second discriminator. A comment that *names* a control which the
+    very next declaration *carries* is documenting it, not disabling it — the
+    shape is `// authorization is @PreAuthorize below` followed by the live
+    annotation. The window ends at the first `{` or `;` (the end of a declaration
+    head), so a control commented out on one member is never excused by a live
+    one on the next.
+
+    Read on comment-blanked source, so a second comment inside the window cannot
+    be mistaken for live code.
+    """
+    window = live_source[end:end + _DECLARATION_HEAD_WINDOW]
+    stop = min(
+        (pos for pos in (window.find("{"), window.find(";")) if pos != -1),
+        default=len(window),
+    )
+    return bool(pattern.search(window[:stop]))
+
+
 def _scan_commented_controls(
     source: str,
     rel: str,
     *,
     xml: bool = False,
+    live_source: "Optional[str]" = None,
 ) -> "list[SecurityConfigObservation]":
-    """DEAD-001 — security controls visible only inside comments."""
-    from sourcecode.source_text import commented_spans
+    """DEAD-001 — security controls visible only inside comments.
+
+    C3-101: *only inside comments* is the claim, and it is not what a comment span
+    alone establishes. Two discriminators separate a switched-off control from a
+    documented one, both lexical and both decidable from the source already read:
+    a Javadoc block is documentation by construction (`source_text.is_javadoc`),
+    and a control the adjacent declaration carries live is being described rather
+    than disabled. Neither was applied, and on a well-documented repository the
+    result was 8 `high` findings and 0 true positives — the rule fired *because*
+    the repository documents its authorization decisions.
+    """
+    from sourcecode.source_text import commented_spans, is_javadoc
 
     rules = _COMMENTED_XML_CONTROLS if xml else _COMMENTED_JAVA_CONTROLS
     hints = _COMMENTED_XML_HINTS if xml else _COMMENTED_JAVA_HINTS
     if not any(hint in source for hint in hints):
         return []
+    if live_source is None and not xml:
+        from sourcecode.source_text import blank_java_comments
+
+        live_source = blank_java_comments(source)
     out: "list[SecurityConfigObservation]" = []
     seen: set[tuple[str, int]] = set()
     for start, end in commented_spans(source, xml=xml):
+        # Javadoc is addressed to a reader; a disabled control is not written in it.
+        if not xml and is_javadoc(source, start):
+            continue
         text = source[start:end]
         for pattern, symbol, detail in rules:
             if not pattern.search(text):
                 continue
+            if not xml and _control_is_live_below(live_source or "", end, pattern):
+                continue
             line = _line_of(source, start)
             key = (symbol, line)
             if key in seen:
@@ -623,8 +670,11 @@ def scan_security_configuration(
             source = (root / rel).read_text(encoding="utf-8", errors="replace")
         except OSError:
             continue
-        out.extend(_scan_commented_controls(source, rel, xml=False))
-        out.extend(_scan_java(blank_java_comments(source), rel))
+        # One blanking per file: the live view is what `_scan_java` reads and what
+        # C3-101's second discriminator tests the declaration head against.
+        _live = blank_java_comments(source)
+        out.extend(_scan_commented_controls(source, rel, xml=False, live_source=_live))
+        out.extend(_scan_java(_live, rel))
 
     # C3-64 — one pruned walk for all three populations. This used to be five
     # `rglob` calls (one per config suffix, one for descriptors, one for

sourcecode/source_text.py

@@ -165,3 +165,21 @@ def commented_spans(source: str, *, xml: bool) -> "list[tuple[int, int]]":
         if xml or match.lastgroup in ("line", "block"):
             spans.append((match.start(), match.end()))
     return spans
+
+
+def is_javadoc(source: str, start: int) -> bool:
+    """True when the comment beginning at *start* is a Javadoc block.
+
+    C3-101: a comment span says *what is not compiled*, and DEAD-001 reads it as
+    *what was switched off* — two different things, and the difference is
+    lexical. Code is disabled with `//` or `/* */`; `/** */` is the documentation
+    form, addressed to a reader and processed by a doc tool. Nobody disables an
+    annotation by moving it into a Javadoc block, and a repository that documents
+    the authorization decision it makes writes the annotation's name there on
+    purpose — which is how eight `high` findings were produced by good
+    documentation, with the live annotations sixty lines below in the same file.
+
+    `/**/` is an empty block comment, not a Javadoc opener, and is excluded the
+    way `javadoc` itself excludes it.
+    """
+    return source.startswith("/**", start) and not source.startswith("/**/", start)

{sourcecode-5.0.0.dist-info → sourcecode-5.0.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.0.0
+Version: 5.0.1
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.0.0-blue)
+![Version](https://img.shields.io/badge/version-5.0.1-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -126,7 +126,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.0.0 — and, on a build that has aged,
+ask version                    # ask 5.0.1 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.0.0.dist-info → sourcecode-5.0.1.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=Y22bv5DzCS9Djs9Ql4VI3jyeczhm8uAgC4Nl9LjiXm0,308
+sourcecode/__init__.py,sha256=Vi4TJSP5-Nuef7bTyGWp6icmexh3SfDW_L2-OJMHyWk,308
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/archetype.py,sha256=CZvRLpkHot_D8D3JFQVorr-EHDJyh0BbS7RnSTqBigM,40499
 sourcecode/architectural_baseline.py,sha256=4GiMVBLJVHvRKSWQGf2ZVurI1-R0qk5pmaevgvGSgVA,26325
@@ -9,7 +9,7 @@ sourcecode/ast_extractor.py,sha256=aXJjZ7XjAdxa99hWNm4SyzPqx4gNWiTbUYjNWGNl-Vc,5
 sourcecode/audit_report.py,sha256=CLvvlQH2oA6Qj4UADUWhNwSsp1OcyzwXXey5DN_IiWI,8660
 sourcecode/baseline_autocapture.py,sha256=tmMLexQSeaQRRbqxAd7walvGQqnF0mdpxQmkL40rlhI,15623
 sourcecode/cache.py,sha256=CK_J8NqyaTNZ57KQT-R4puqI8yYlzG5WL7uLFRbzods,41727
-sourcecode/cache_model.py,sha256=jQcXAIpfBl2rXrf8xitNKXy8M0RSIn4F4hQYV-tKGm8,41285
+sourcecode/cache_model.py,sha256=8xaRd_9zS6XMGPWZ7E6FHSimAG-pZQKNGQBi1jBFLhY,47724
 sourcecode/call_surface.py,sha256=fiqYfHooxN1fX9oQoysq1LS3LoZcobhyUNjAGEZKpwk,4148
 sourcecode/caller_metrics.py,sha256=--sFGDnIog_YGu9xZHMcB91F5xZakfaAKvy15xU54hg,7904
 sourcecode/caller_reach.py,sha256=RRF49tv4-QswraJ2vsZ89VAMOj7BmYXlAdXr-tLP_CA,9483
@@ -52,7 +52,7 @@ sourcecode/envelope.py,sha256=fpF_8znvPqGXKZb0UPYcCYjm27yO7Pr-WsdXNE-tEoY,8911
 sourcecode/environment_resolution.py,sha256=bfhkM0RGSyLwzFvfi-YhHjU1cy2ufA_WIkXBVeHs9y8,22130
 sourcecode/error_schema.py,sha256=uwosfNaSujtYm11_732Hu92z5ITV040fQDaIyefSvR4,1683
 sourcecode/evidence_provider.py,sha256=GSSL44JEaouO5AHks2sB3d1YvC9xIKIld1yBYxZpXxo,4277
-sourcecode/execution_plan.py,sha256=KRI_bFiBbmxOu0aF4bGwgVK9RdH8eB6g9Xhj1fkS2Zk,18120
+sourcecode/execution_plan.py,sha256=c_pYnk-JFY7QNuk_Wc1F0z6tBJswUeu_j5i3QQtakGg,20390
 sourcecode/explain.py,sha256=yqxvKiLF0XMMg11PdgqMFrsim5SXuEKM1U2cLvCLspM,29935
 sourcecode/file_chunker.py,sha256=3vkM3mDQ5eE_yTPvUgjyjpGFBIjkW6_mrBmIbrylnA8,16444
 sourcecode/file_classifier.py,sha256=pJCeN9KqWpAwKMCgGP4KDsBjuWMeo4zlbj5fv3hk9dA,15587
@@ -85,7 +85,7 @@ sourcecode/path_filters.py,sha256=LmTYq735orssKTIuxTX1mE1FHAXF7dVEJEse35xE1RA,12
 sourcecode/perf.py,sha256=ZCPxDIg6ww6PXfLwcqNTH99lc1UgkYUZI3MywFgRO90,25991
 sourcecode/phased_run.py,sha256=cFd0Lxfc8XL-XkCVCCzcjd9bZbtgkJkGZAHfmJ6dBJ4,16542
 sourcecode/pipe_contract.py,sha256=PML0Er5d8uDyec4OrdUXuyqHbGPUYndjeaKUjkFz2u4,8369
-sourcecode/posture.py,sha256=TGzSwa413NJyVvBgGWyCyaFqJXX-fnctq7vdxVs9z9A,76744
+sourcecode/posture.py,sha256=7d3zM4ExrSXVKrWNTlXQ0fUQNqDdl1LOuKwRVaXdRss,76574
 sourcecode/pr_comment_renderer.py,sha256=239PmJdf95av_ZW236C7_tvq_ahECeuF9AZxrheJ4OQ,15573
 sourcecode/pr_impact.py,sha256=KyVBvHCCbgByKA_wqTbO1dSkfi05GEudIAuH4CyDPK4,27395
 sourcecode/prepare_context.py,sha256=ntB2MSScHtYRKRm9SansA0FrklMnXZmE9_yRXqXk0qc,239264
@@ -102,7 +102,7 @@ sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcr
 sourcecode/remedies.py,sha256=9eAuP9ndw78YvuUtOi2VvoeNnVCMh1q0uxfnPIkvx7c,7838
 sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg,12965
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=x0u0m-Dlgtcfr7VsggnKRw_mCobe6B7lZMw3U2H1rd8,368709
+sourcecode/repository_ir.py,sha256=R2LjUHUxdOQdx4lGCCgKLY-9K7ldc7JAuW7MpEFJ124,368882
 sourcecode/ris.py,sha256=nc0d6boOiREFqXO4eLHHaYcnqZj4pT_AG43-Xz9ejkc,24862
 sourcecode/risk.py,sha256=QSm_F-3tGncQNMcdKGgr5bVONM8614J8n8qmP9x4FDU,73200
 sourcecode/rule_catalog.py,sha256=pTkgkQZ1u7atB3fkQJ9BPWo8lNiamvEuRN7MtRgle0c,5263
@@ -112,8 +112,9 @@ sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_X
 sourcecode/sarif.py,sha256=3hQEegUxIZbojFdY59oB-yKsK-rnafHdTNmYsEP2--A,25984
 sourcecode/scanner.py,sha256=z3CV0rcGunu0Y8mpNgp07wI7nxT0pxw1BkXRRtI0Rpo,9609
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
+sourcecode/security_chain.py,sha256=1YZVeFLwy65kntMBhMNvz1cUpOoKCmvEqYICgxs66Gw,6823
 sourcecode/security_config.py,sha256=_tdyI939NeOlgwQWNCXPfsqaB1fTyNROizYqTOdvWGQ,3718
-sourcecode/security_config_scan.py,sha256=7DD0ou6xsOPhdUbBbEKLDM07PREeEHNISQltboHPnRU,29976
+sourcecode/security_config_scan.py,sha256=CttiIYVhBlPCuLNYMWTEtgbZmwXGYm2GYiFo9ehD1Go,32487
 sourcecode/security_posture.py,sha256=FiEGood01y5gKhuYyL6NK4VT-WtCUMJwHOSR5xTfnPI,54063
 sourcecode/semantic_analyzer.py,sha256=bpgdC6m0_ftVtRf3rSdwhbhWjnZnGxRXaZVcfe4BbcQ,95414
 sourcecode/semantic_impact_engine.py,sha256=t09IirGC3JjQDy33JZd1_WKzQVKXkoNl3-XEUr5kjis,20563
@@ -121,7 +122,7 @@ sourcecode/semantic_integration_engine.py,sha256=7a0WqAInOv39f0Yr_94TYo_JP_8QpeI
 sourcecode/semantic_services.py,sha256=nbUuPv-F01USTt_9CHT8iy_ucCIw3fz4W3Aquea_pd4,10782
 sourcecode/serializer.py,sha256=KiUUHMQNWOOJye95bZQKsRKFkVeVK0Vb2Y7IocQjVbk,140262
 sourcecode/servlet_surface.py,sha256=aOeRne07man8DwHsbog4FTOyF3sYV-oP_N1e4gt3Uvk,9115
-sourcecode/source_text.py,sha256=uir8uBoOnxuH2R-eDJp7mqkDSQRgipxpFdjddLycj-E,8081
+sourcecode/source_text.py,sha256=R52gmSljz7L6YVPbixv5W-LOZ5eKUVvSUP3S-QH_IWc,9047
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=-0EZMFpZxPRmK2FiR4d7Mk4O73c4wkga-Dqs1-fBSUA,22895
 sourcecode/spring_impact.py,sha256=GW77k7KMn13QmzP5520BbVcXSCYlTFeD1bFibhbmzJM,83907
@@ -205,8 +206,8 @@ sourcecode/telemetry/consent.py,sha256=pQdl-QeLl6Gcibn0eWHSKZrm-HYSsjpVqOnjrgFp8
 sourcecode/telemetry/events.py,sha256=4_yeO58U-Cwc1Qb27VB0_EjhmroY0k91n3_VGxeALB8,2776
 sourcecode/telemetry/filters.py,sha256=RzxauTz8HliO4BllQnXEXc7zTeqdCZi5MgqGEDuW7OQ,6570
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-5.0.0.dist-info/METADATA,sha256=mW6-jtrJZ6KxEAqRhncgpItWR93mFkL5sHDq0NjTd1Y,42410
-sourcecode-5.0.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-5.0.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-5.0.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-5.0.0.dist-info/RECORD,,
+sourcecode-5.0.1.dist-info/METADATA,sha256=wKxYzyIT5zVAkDjb12M3Wzj2yyLMr-uklRY8AmRlHGI,42410
+sourcecode-5.0.1.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-5.0.1.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-5.0.1.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-5.0.1.dist-info/RECORD,,