sourcecode 5.0.0__tar.gz → 5.0.1__tar.gz

{sourcecode-5.0.0 → sourcecode-5.0.1}/CHANGELOG.md

@@ -2,6 +2,50 @@
 
 ## [Unreleased]
 
+## [5.0.1] — 2026-08-11
+
+**A patch on the release that made the product's own cost figures honest, for the
+four cells that refresh did not reach.** No analysis changes: `onboard` payloads
+on spring-petclinic and jobrunr are byte-identical against 5.0.0. What moves is
+the operational advice on two commands — `repo-ir` and `baseline capture` are
+foreground work at field scale, where 5.0.0 still sent them to a nightly job on a
+4.10.4 outcome.
+
+### Fixed
+
+- **Four cost cells the 5.0.0 refresh did not reach, and two of them said the
+  field could not run a command it has since run twice (C3-100).** C3-97 gave
+  every field figure the build it was taken on and re-measured what evaluation
+  #22 had run; what #22 had not run kept its 4.10.4 cell. `ask` (root) published
+  115 s, `baseline` 11 s, and — worse, because the claim is categorical rather
+  than numeric — `repo-ir` and `verify-edit` published `field_blocked`, which the
+  model renders as *"did not finish in an interactive session"*. Evaluation #23
+  ran all four from a purged cache on the same repository: root **72,3 s**,
+  `repo-ir` **9,8 s**, `baseline capture` **2,2 s**, `verify-edit` **76,6 s**.
+  `repo-ir` and `baseline` are foreground work at field scale where the product
+  was sending them to a nightly job.
+- **An outcome is a measurement, so it expires like one.** `field_blocked` was the
+  strongest claim in the table and the only one that could be written without a
+  build behind it. It is dated now wherever it is published (*"did not finish in
+  an interactive session on 4.10.4 … and nothing has re-measured it since"*), and
+  the battery rejects an undated one.
+- **A figure now states the cache state it was taken in.** The root analysis is
+  72,3 s from a purged cache and 0,3 s from a warm one; publishing one number
+  without saying which invites a reader to compare two different facts. Every
+  field figure carries `warm`/`cold`/`mixed`, in the `here:` line, the `cache
+  model` rows and the JSON.
+- **The headline anchor is read off the table instead of copied beside it.**
+  `FIELD_ANCHOR`, `FIELD_ANCHOR_SECONDS` and `FIELD_ANCHOR_MEASURED_VERSION` are
+  derived from the `spring-audit` row — the missed copy is what C3-100 was — and
+  `field_currency()` now also names every row measured before the newest figure in
+  the same table (`rows_behind_the_newest_field_measurement`), which is the
+  staleness that hid for three releases: not *"older than the build you are
+  running"* but *"older than the refresh that reached the row next to it"*.
+- **The root row was invisible to the surface its measurement exists for.**
+  `cost_row("ask (root)")` resolved to no row, so `cache model`'s `here:` line for
+  the root analysis was published from the command's *class*, with no figure in
+  it, on every repository. Found while checking the refresh on a real one.
+
 ## [5.0.0] — 2026-08-11
 
 **The engine got 280× faster in 4.18.0 and every number the product quoted about

{sourcecode-5.0.0 → sourcecode-5.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.0.0
+Version: 5.0.1
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.0.0-blue)
+![Version](https://img.shields.io/badge/version-5.0.1-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -126,7 +126,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.0.0 — and, on a build that has aged,
+ask version                    # ask 5.0.1 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.0.0 → sourcecode-5.0.1}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.0.0-blue)
+![Version](https://img.shields.io/badge/version-5.0.1-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -88,7 +88,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.0.0 — and, on a build that has aged,
+ask version                    # ask 5.0.1 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.0.0 → sourcecode-5.0.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.0.0"
+version = "5.0.1"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.0.0 → sourcecode-5.0.1}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.0.0"
+__version__ = "5.0.1"

{sourcecode-5.0.0 → sourcecode-5.0.1}/src/sourcecode/cache_model.py

@@ -87,7 +87,28 @@ class CommandCache:
     #: releases (spring-audit, 408 s in #13 against 2 351 s in #16) is itself the
     #: measurement C3-76 exists for.
     field_seconds: "Optional[float]" = None
+    #: **C3-100.** `field_blocked` is a *measurement outcome*, not a property of the
+    #: command: it says "this run did not finish on that build, at that size", and
+    #: like every other measurement here it belongs to the build named in
+    #: `field_measured_version` and expires with it. It was read as a property for
+    #: three releases — `repo-ir` and `verify-edit` carried a 4.10.4 outcome while
+    #: eval #23 ran them in 9,8 s and 76,6 s — which is worse than a stale number,
+    #: because a stale number is a measurement and *"the field could not run this"*
+    #: is an incapacity the product does not have. A blocked row without a build is
+    #: rejected by the battery for the same reason a figure without one is.
     field_blocked: bool = False
+    #: The cache state the field figure was taken in. Eval #22 measured a warm
+    #: machine; eval #23 purged every cache first (`cache clear --all`,
+    #: `context-clear`, `rm -rf parse-cache-v1`) and then ran the whole catalogue
+    #: in one round, so its first figures are cold and its later ones are neither —
+    #: the shared layers filled as the round went on. Published because *72,3 s
+    #: cold* and *72,3 s warm* are two different facts about the same command, and
+    #: the row that says which is the only thing standing between the two:
+    #:   ``warm``  — the caches were warmed before the run
+    #:   ``cold``  — every cache was purged before the run
+    #:   ``mixed`` — inside a round that began purged: earlier commands had already
+    #:               filled some of the shared layers this one reads
+    field_cache_state: str = "warm"
     #: **C3-97.** The build the field figure was taken on. An anchor without one is
     #: a measurement that can outlive its build and keep deciding: 4.18.0 deleted
     #: two catastrophic-backtracking patterns (C3-95, C3-96) and every figure taken
@@ -137,21 +158,20 @@ REFERENCE_MEASURED_VERSION = "3.2.2"
 #: What can be said honestly is the class, the two measured anchors, **the build
 #: each was measured on**, and how to run it.
 #:
-#: History of this constant, kept because it is the measurement C3-76 exists for:
+#: History of the anchor, kept because it is the measurement C3-76 exists for:
 #: 408 s (#13) → 2 351 s (#16, C3-72) → 8,4 s (#22, C3-97). The middle figure was
 #: quoted as an operational anchor for four releases after the build that produced
 #: it, and told operators to detach commands that finish in seconds.
-FIELD_ANCHOR = (
-    "field evaluation #22: spring-audit on 3 342 Java files took 8.4 s "
-    "(Windows, pipx, warm cache) against 8.8 s on the 2 000-file reference"
-)
+#:
+#: ⚠ `FIELD_ANCHOR`, `FIELD_ANCHOR_SECONDS` and `FIELD_ANCHOR_MEASURED_VERSION`
+#: are **derived from the `spring-audit` row**, below `COMMANDS`. They used to be
+#: written out here as well, which made the anchor two facts kept in step by hand:
+#: C3-97 refreshed both, and C3-100 is what it costs when the next refresh reaches
+#: only one of the copies. One authority per fact — the table — and the headline
+#: reads itself off it.
+#:
+#: The size of the field repository every `field_seconds` below was taken on.
 FIELD_ANCHOR_JAVA_FILES = 3342
-FIELD_ANCHOR_SECONDS = 8.4
-
-#: The build the field anchors above were taken on. Rows carrying a different
-#: `field_measured_version` are published with that build's name attached rather
-#: than as figures for this one (C3-97).
-FIELD_ANCHOR_MEASURED_VERSION = "4.18.0"
 
 
 #: Every layer keys on `cache.worktree_signature` — the exact tree state (C1-9).
@@ -217,9 +237,12 @@ COMMANDS: tuple[CommandCache, ...] = (
     CommandCache("ask (root)", ("snapshot", "ris", "parse"), "answer", True,
                  "`--compact` is what a warm stores by default; `--agent` needs `cache warm --agent`. "
                  "`--env-map`, `--depth N` and `--exclude` change the *analysis*, so they miss the "
-                 "warmed core and rescan — this is the 171 s the field measured after a 103 s warm.",
+                 "warmed core and rescan — the 171 s the field measured after a 103 s warm on 4.10.4. "
+                 "Eval #23 timed the same invocation at 72,3 s from a purged cache, and then paid "
+                 "71,7 s again for `--agent` on the state it had just analysed (C3-103).",
                  "--compact 13.3 s cold → 0.3 s warm (cold re-measured on 3.7.0: was 19.3 s, C3-6); "
-                 "--agent --full --env-map --depth 20 34.7 s → 33.9 s (no gain)", analysis_class="repo-wide", cold_seconds=13.3, warm_seconds=0.3, field_seconds=115.0, field_measured_version="4.10.4"),
+                 "--agent --full --env-map --depth 20 34.7 s → 33.9 s (no gain)", analysis_class="repo-wide", cold_seconds=13.3, warm_seconds=0.3,
+                 field_seconds=72.3, field_cache_state="cold", field_measured_version="5.0.0"),
     CommandCache("posture", ("cir", "parse"), "shared", False,
                  "Resolves the conditional bean graph on every run, over the shared CIR a warm "
                  "builds — the parse it used to repeat for itself. `--diff` compares two profile "
@@ -284,9 +307,11 @@ COMMANDS: tuple[CommandCache, ...] = (
     CommandCache("verify", (), "none", False, "Runs the contracts against a fresh reading.", analysis_class="core"),
     CommandCache("verify-edit", ("parse",), "shared", True,
                  "Built for the edit loop: the parse cache is what keeps an unchanged file out of the "
-                 "next run. Its own second run is faster again.",
+                 "next run. Its own second run is faster again. At field size that loop is not short "
+                 "yet: eval #23 measured 76,6 s on a tree with no edits, because the HEAD side is "
+                 "still built in a throwaway worktree instead of reusing the shared CIR (C3-102).",
                  "14.6 s → 9.6 s → 5.6 s on repeat", analysis_class="repo-wide", cold_seconds=14.6, warm_seconds=9.6,
-                 field_blocked=True, field_measured_version="4.10.4"),
+                 field_seconds=76.6, field_cache_state="mixed", field_measured_version="5.0.0"),
     CommandCache("review-pr", ("cir",), "none", False,
                  "Diff-dependent, and it reuses the CIR only if one exists. On a small diff, loading "
                  "the warmed CIR costs more than the work it saves.",
@@ -318,8 +343,12 @@ COMMANDS: tuple[CommandCache, ...] = (
                  "9.8 s → 1.6 s", analysis_class="core", cold_seconds=9.8, warm_seconds=1.6,
                  field_seconds=4.4, field_measured_version="4.18.0"),
     CommandCache("export", ("parse",), "shared", False, "", "8.8 s → 3.7 s", analysis_class="repo-wide", cold_seconds=8.8, warm_seconds=3.7),
-    CommandCache("repo-ir", ("parse",), "shared", False, "", "5.1 s → 2.9 s", analysis_class="repo-wide", cold_seconds=5.1, warm_seconds=2.9,
-                 field_blocked=True, field_measured_version="4.10.4"),
+    CommandCache("repo-ir", ("parse",), "shared", False,
+                 "Carried as *did not finish* from 4.10.4 until eval #23 ran it at field size in "
+                 "9,8 s — a run that did not finish once is not a command that cannot finish "
+                 "(C3-100, and the same correction `modernize` needed).",
+                 "5.1 s → 2.9 s", analysis_class="repo-wide", cold_seconds=5.1, warm_seconds=2.9,
+                 field_seconds=9.8, field_cache_state="mixed", field_measured_version="5.0.0"),
     CommandCache("validation", ("parse",), "shared", False, "", "11.6 s → 6.4 s", analysis_class="repo-wide", cold_seconds=11.6, warm_seconds=6.4,
                  field_seconds=17.4, field_measured_version="4.18.0"),
     CommandCache("modernize", ("parse",), "shared", False,
@@ -333,8 +362,11 @@ COMMANDS: tuple[CommandCache, ...] = (
                  "`no_ris` instead of a snapshot.",
                  "0.2 s either way", analysis_class="core", cold_seconds=0.2, warm_seconds=0.2),
     CommandCache("trend", (), "none", False, "Reads stored baseline artifacts from disk; analyses no source, so no cache layer applies. Same command as `baseline trend`.", analysis_class="none"),
-    CommandCache("baseline", ("parse",), "shared", False, "`capture`/`diff`/`trend` over architectural metrics.",
-                 "capture 8.7 s → 3.6 s", analysis_class="repo-wide", cold_seconds=8.7, warm_seconds=3.6, field_seconds=11.0, field_measured_version="4.10.4"),
+    CommandCache("baseline", ("parse",), "shared", False,
+                 "`capture`/`diff`/`trend` over architectural metrics. The field figure is `capture`, "
+                 "the subcommand that analyses; `trend` reads stored artifacts and has its own row.",
+                 "capture 8.7 s → 3.6 s", analysis_class="repo-wide", cold_seconds=8.7, warm_seconds=3.6,
+                 field_seconds=2.2, field_cache_state="mixed", field_measured_version="5.0.0"),
     CommandCache("retrieve", ("cir", "parse"), "shared", False,
                  "Every query builds or reuses the shared CIR a warm builds.", analysis_class="core"),
     CommandCache("archetype", ("parse",), "shared", False, "", "9.3 s → 5.6 s", analysis_class="repo-wide", cold_seconds=9.3, warm_seconds=5.6),
@@ -355,6 +387,73 @@ _WARM_LABEL = {
     "none": "nothing",
 }
 
+#: The cache states a field figure may declare. A row outside this set is a
+#: measurement whose conditions nobody can read (C3-100).
+FIELD_CACHE_STATES = ("warm", "cold", "mixed")
+
+
+def _thousands(n: int) -> str:
+    return f"{n:,}".replace(",", " ")
+
+
+def _row(command: str) -> "CommandCache":
+    for entry in COMMANDS:
+        if entry.command == command:
+            return entry
+    raise KeyError(command)
+
+
+#: The headline anchor, read off the table rather than written twice (C3-100).
+#: `spring-audit` is the command the whole series measured — 408 s (#13), 2 351 s
+#: (#16), 8,4 s (#22) — so it is the row the front page quotes, and quoting it
+#: means reading it, not copying it.
+_FIELD_ANCHOR_ROW = _row("spring-audit")
+FIELD_ANCHOR_SECONDS = _FIELD_ANCHOR_ROW.field_seconds
+FIELD_ANCHOR_MEASURED_VERSION = _FIELD_ANCHOR_ROW.field_measured_version
+FIELD_ANCHOR = (
+    f"field evaluation #22: spring-audit on {_thousands(FIELD_ANCHOR_JAVA_FILES)} "
+    f"Java files took {FIELD_ANCHOR_SECONDS:g} s (Windows, pipx, "
+    f"{_FIELD_ANCHOR_ROW.field_cache_state} cache) against "
+    f"{_FIELD_ANCHOR_ROW.cold_seconds:g} s on the "
+    f"{_thousands(REFERENCE_JAVA_FILES)}-file reference"
+)
+
+
+def _version_key(version: "Optional[str]") -> tuple:
+    """A comparable key for a release name, for ordering measurements only.
+
+    Not a distance — `reference_currency` refuses to invent one and this does not
+    either. It answers exactly one question: is this row's build older than the
+    newest build anything in the table was measured on (C3-100)? Anything
+    unparseable sorts oldest, which is the safe direction: it gets labelled.
+    """
+    if not version:
+        return ()
+    parts: list[int] = []
+    for chunk in version.split("."):
+        digits = "".join(c for c in chunk if c.isdigit())
+        if not digits:
+            break
+        parts.append(int(digits))
+    return tuple(parts)
+
+
+def newest_field_measurement_version() -> "Optional[str]":
+    """The most recent build any field figure in the table was taken on.
+
+    The reference point for *"this row is older than the table it sits in"* — the
+    state C3-100 lived in for three releases, where a refresh reached five rows
+    and left four behind on a build four releases older, with nothing anywhere
+    saying so.
+    """
+    versions = [
+        row.field_measured_version
+        for row in COMMANDS
+        if (row.field_seconds is not None or row.field_blocked)
+        and row.field_measured_version
+    ]
+    return max(versions, key=_version_key) if versions else None
+
 
 def layer(layer_id: str) -> Layer:
     for entry in LAYERS:
@@ -459,10 +558,6 @@ def cost_sentence() -> str:
     )
 
 
-def _thousands(n: int) -> str:
-    return f"{n:,}".replace(",", " ")
-
-
 def field_currency() -> dict:
     """The same statement as `reference_currency`, for the field anchors (C3-97).
 
@@ -473,11 +568,32 @@ def field_currency() -> dict:
     from sourcecode import __version__
 
     current = __version__
+    measured = [
+        row for row in COMMANDS
+        if row.field_seconds is not None or row.field_blocked
+    ]
     stale = sorted(
         row.command
-        for row in COMMANDS
-        if (row.field_seconds is not None or row.field_blocked)
-        and row.field_measured_version not in (None, current)
+        for row in measured
+        if row.field_measured_version not in (None, current)
+    )
+    # C3-100: the other staleness, and the one that hid for three releases — not
+    # "older than the build you are running" (every row is, the day after a
+    # release) but "older than the newest measurement in this same table", which
+    # is a refresh that reached some rows and not others. Named here so the gap is
+    # readable without diffing the rows by hand.
+    newest = newest_field_measurement_version()
+    behind = sorted(
+        row.command
+        for row in measured
+        if _version_key(row.field_measured_version) < _version_key(newest)
+    )
+    lagging = (
+        f" {len(behind)} of the {len(measured)} field figures were taken before "
+        f"the newest one in this table ({newest}): "
+        f"{', '.join(behind)}."
+        if behind
+        else ""
     )
     return {
         "anchor": FIELD_ANCHOR,
@@ -485,12 +601,17 @@ def field_currency() -> dict:
         "running_version": current,
         "current": FIELD_ANCHOR_MEASURED_VERSION == current,
         "rows_measured_on_an_earlier_build": stale,
+        "newest_field_measurement_version": newest,
+        "rows_behind_the_newest_field_measurement": behind,
         "statement": (
-            f"The field anchors were taken on {FIELD_ANCHOR_MEASURED_VERSION}; you "
-            f"are running {current}. Each row states the build its field figure "
-            f"belongs to, and no figure is projected onto this one."
-            if FIELD_ANCHOR_MEASURED_VERSION != current
-            else f"The field anchors were taken on {current}, the build you are running."
+            (
+                f"The field anchors were taken on {FIELD_ANCHOR_MEASURED_VERSION}; you "
+                f"are running {current}. Each row states the build its field figure "
+                f"belongs to, and no figure is projected onto this one."
+                if FIELD_ANCHOR_MEASURED_VERSION != current
+                else f"The field anchors were taken on {current}, the build you are running."
+            )
+            + lagging
         ),
     }
 
@@ -590,6 +711,7 @@ def as_dict(here: "Optional[Conditioning]" = None) -> dict:
                         "seconds": cmd.field_seconds,
                         "did_not_finish": cmd.field_blocked,
                         "java_files": FIELD_ANCHOR_JAVA_FILES,
+                        "cache_state": cmd.field_cache_state,
                         "measured_on_version": cmd.field_measured_version,
                         "note": field_anchor_note(cmd),
                     }
@@ -713,13 +835,15 @@ def render_text(here: "Optional[Conditioning]" = None) -> str:
             lines.append(f"  {' ' * width}    measured: {cmd.measured}")
         if cmd.field_seconds is not None or cmd.field_blocked:
             # C3-97: never the seconds without the build they were taken on.
+            # C3-100: nor without the cache state they were taken in.
             note = field_anchor_note(cmd)
             shown = (
                 "did not finish in an interactive session"
                 if cmd.field_seconds is None
                 else f"{cmd.field_seconds:g} s"
             )
-            suffix = f" ({note})" if note else ""
+            qualifiers = [f"{cmd.field_cache_state} cache"] + ([note] if note else [])
+            suffix = f" ({', '.join(qualifiers)})"
             lines.append(
                 f"  {' ' * width}    field:    {shown} at "
                 f"{_thousands(FIELD_ANCHOR_JAVA_FILES)} Java files{suffix}"

{sourcecode-5.0.0 → sourcecode-5.0.1}/src/sourcecode/execution_plan.py

@@ -204,7 +204,16 @@ def cost_row(command: str):
     `retrieve blast-radius <sym> .` — because that is what the front page and the
     remedies hold. Flags and arguments are dropped; what is left is the command.
     """
-    tokens = [t for t in (command or "").split() if not t.startswith("-")]
+    named = (command or "").strip()
+    if named in _BY_COMMAND:
+        # A caller may also ask by the name the table itself gives a row, which is
+        # how `cache model` builds its `here:` lines. The root analysis is filed as
+        # "ask (root)" — a name the tokenizer below strips to `(root)` and then
+        # fails to find, so the root row's `here:` line was the only one published
+        # from its class instead of from its measurement (C3-100: a cell nothing
+        # reads is the cell that goes stale).
+        return _BY_COMMAND[named]
+    tokens = [t for t in named.split() if not t.startswith("-")]
     if tokens and tokens[0] in ("ask", "sourcecode"):
         tokens = tokens[1:]
     if not tokens:
@@ -259,16 +268,22 @@ def _reference(row) -> Optional[str]:
             f"{row.cold_seconds:g} s cold{warm} at {REFERENCE_JAVA_FILES} files"
         )
     note = field_anchor_note(row)
-    dated = f", {note}" if note else ""
+    # C3-100: the cache state travels with the figure for the same reason the
+    # build does — a root analysis is 72,3 s from a purged cache and 0,3 s from a
+    # warm one, so a figure that does not say which is not a measurement anybody
+    # can act on.
+    qualified = ", ".join(
+        ["field", f"{row.field_cache_state} cache"] + ([note] if note else [])
+    )
     if row.field_seconds is not None:
         parts.append(
             f"{row.field_seconds:g} s at {_files(FIELD_ANCHOR_JAVA_FILES)} files "
-            f"(field{dated})"
+            f"({qualified})"
         )
     elif row.field_blocked:
         parts.append(
             f"did not finish in an interactive session at "
-            f"{_files(FIELD_ANCHOR_JAVA_FILES)} files (field{dated})"
+            f"{_files(FIELD_ANCHOR_JAVA_FILES)} files ({qualified})"
         )
     return " · ".join(parts) or None
 
@@ -310,11 +325,27 @@ def verdict(command: str, scope: Scope) -> Verdict:
         # critical finding — under "too big for this session" because its class
         # is repo-wide would repeat C4-19 in the other direction.
         if row is not None and row.field_blocked:
+            # C3-100: an outcome is a measurement, so it is dated like one. "It did
+            # not finish" is the strongest claim this table makes about a command,
+            # and it was published undated while the field was running two of those
+            # commands in 9,8 s and 76,6 s. It still decides — an outcome at this
+            # size outranks a class, as C3-97 established for seconds — but it says
+            # which build it happened on and that nothing has re-measured it since.
+            note = field_anchor_note(row)
+            dated = ""
+            if note:
+                dated = (
+                    f" on {row.field_measured_version}"
+                    if row.field_measured_version
+                    else " on a build the row does not record"
+                )
+            since = ", and nothing has re-measured it since" if note else ""
             return Verdict(
                 command, DETACH,
                 (
                     f"measured at this size and it did not finish in an interactive "
-                    f"session ({_files(FIELD_ANCHOR_JAVA_FILES)} Java files, cold) — "
+                    f"session{dated} ({_files(FIELD_ANCHOR_JAVA_FILES)} Java files, "
+                    f"{row.field_cache_state} cache){since} — "
                     f"run it with `--output` and `--detach`, or nightly"
                 ),
                 cls, reference,
@@ -325,7 +356,14 @@ def verdict(command: str, scope: Scope) -> Verdict:
             # a measurement at this size and the class is not — but it is never
             # printed as though it described the build in hand.
             note = field_anchor_note(row)
-            dated = f" ({note})" if note else ""
+            # C3-100: and the cache state it was taken in. `ask --compact` is the
+            # row this matters most on — 72,3 s from a purged cache against 0,3 s
+            # warm on the reference — and the honest thing to publish is the
+            # measurement's conditions, not a warm figure nobody took at this size.
+            qualifiers = ", ".join(
+                [f"{row.field_cache_state} cache"] + ([note] if note else [])
+            )
+            dated = f" ({qualifiers})"
             if row.field_seconds <= FOREGROUND_SECONDS:
                 return Verdict(
                     command, RUNS_NOW,

{sourcecode-5.0.0 → sourcecode-5.0.1}/src/sourcecode/posture.py

@@ -33,6 +33,9 @@ from pathlib import Path
 from typing import TYPE_CHECKING, Any, Optional
 
 from sourcecode.remedies import remedy
+from sourcecode.security_chain import CHAIN_PARTICIPANT_TYPES as _CHAIN_PARTICIPANT_TYPES
+from sourcecode.security_chain import simple_name as _chain_simple_name
+from sourcecode.security_chain import types_from_edges as _chain_types_from_edges
 
 if TYPE_CHECKING:
     from sourcecode.canonical_ir import CanonicalRepositoryIR
@@ -478,20 +481,17 @@ _SECURITY_CONFIG_ANNOTATIONS = frozenset({
     "@EnableWebSecurity", "@EnableMethodSecurity", "@EnableGlobalMethodSecurity",
     "@EnableReactiveMethodSecurity", "@EnableWebFluxSecurity",
 })
-_SECURITY_CONFIG_SUPERTYPES = frozenset({
-    "WebSecurityConfigurerAdapter", "SecurityFilterChain",
-    "AbstractSecurityInterceptor", "OncePerRequestFilter",
-})
-
-
-#: Edge types that say "this type IS one of those" — the inheritance half of the
-#: request-chain SPI test.
-_SUPERTYPE_EDGES = frozenset({"extends", "implements"})
+#: C1-43: the request-chain SPI vocabulary is `security_chain`'s, not a second
+#: copy here. This command asks the *participant* question — a filter takes part
+#: in configuring the chain without declaring one — while the endpoint surface
+#: asks the narrower declaration question. Same vocabulary, same member rule, two
+#: named subsets.
+_SECURITY_CONFIG_SUPERTYPES = _CHAIN_PARTICIPANT_TYPES
 
 
 def _simple_name(type_ref: str) -> str:
     """`a.b.Chain<T>` → `Chain`. Generic arguments are not part of the type's name."""
-    return str(type_ref).partition("<")[0].rsplit(".", 1)[-1].strip()
+    return _chain_simple_name(type_ref)
 
 
 def _security_config_types(cir: "CanonicalRepositoryIR") -> "frozenset[str]":
@@ -520,25 +520,12 @@ def _security_config_types(cir: "CanonicalRepositoryIR") -> "frozenset[str]":
     cached = getattr(cir, "_posture_security_types", None)
     if cached is not None:
         return cached
-    relevant: set[str] = set()
     raw = getattr(cir, "_raw_ir", None) or {}
     graph = raw.get("graph") if isinstance(raw, dict) else None
     edges = (graph or {}).get("edges") if isinstance(graph, dict) else None
-    for edge in edges or []:
-        if not isinstance(edge, dict):
-            continue
-        kind = edge.get("type")
-        if kind not in _SUPERTYPE_EDGES and kind != "returns":
-            continue
-        if _simple_name(edge.get("to") or "") not in _SECURITY_CONFIG_SUPERTYPES:
-            continue
-        source = str(edge.get("from") or "")
-        if not source:
-            continue
-        # A member returning the SPI type makes its *declaring class* the
-        # configuration; a type extending it is the configuration itself.
-        relevant.add(source.partition("#")[0] if kind == "returns" else source)
-    result = frozenset(relevant)
+    # C1-43: the scan itself lives in `security_chain`, so the endpoint surface's
+    # narrower reading of the same edges cannot drift from this one.
+    result = _chain_types_from_edges(edges or [], targets=_SECURITY_CONFIG_SUPERTYPES)
     try:
         object.__setattr__(cir, "_posture_security_types", result)
     except Exception:

{sourcecode-5.0.0 → sourcecode-5.0.1}/src/sourcecode/repository_ir.py

@@ -348,15 +348,19 @@ _SECURITY_MARKER_ANNOTATIONS: frozenset[str] = frozenset({
     "@PermitAll", "@DenyAll", "@Authenticated",
 })
 
-# Annotations on config classes that indicate a centralized security filter chain
-# (Spring Security / Spring Boot).  When present, per-endpoint no_security_signal
-# is expected and does NOT mean endpoints are unprotected.
-_FILTER_SECURITY_ANNOTATIONS: frozenset[str] = frozenset({
-    "@EnableWebSecurity",
-    # @EnableMethodSecurity / @EnableGlobalMethodSecurity enable per-method annotation
-    # security (@PreAuthorize/@Secured), NOT a filter chain — must NOT be treated as
-    # filter_based or SEC-001 is suppressed for every unannotated endpoint.
-})
+# A centralized security filter chain: when the repository declares one,
+# per-endpoint no_security_signal is expected and does NOT mean endpoints are
+# unprotected.
+#: C1-43: "does this repository declare a request filter chain?" is one fact with
+#: one reading, and it lives in `security_chain` — which is also where the reason
+#: `@EnableMethodSecurity` is *not* in it is written down. This module used to
+#: answer it from annotations and `extends WebSecurityConfigurerAdapter` alone,
+#: i.e. Spring Security 5 vocabulary, while `posture` had already learned that a
+#: chain can be a `@Bean SecurityFilterChain` and nothing else. The consequence
+#: was not a missing signal: it was SEC-001 telling the reader that a Security 6
+#: repository has no centralized filter, and naming a route the chain admits on
+#: purpose as reachable without authentication.
+from sourcecode.security_chain import declares_request_chain as _declares_request_chain
 
 # Programmatic security: method-call patterns that indicate runtime auth enforcement.
 # Requires method-call or field-access context — bare class name mentions (imports,
@@ -4586,16 +4590,10 @@ def _assemble(
     # Stored here so CIR projections (project_endpoint_surface) can read it without
     # re-parsing symbols.
     _class_syms_asm = [s for s in sorted_syms if s.type in ("class", "interface")]
-    _filter_based_asm = (
-        any(
-            ann in _FILTER_SECURITY_ANNOTATIONS
-            for sym in _class_syms_asm
-            for ann in sym.annotations
-        )
-        or any(
-            _extends_map.get(sym.symbol, "") == "WebSecurityConfigurerAdapter"
-            for sym in _class_syms_asm
-        )
+    _filter_based_asm = _declares_request_chain(
+        annotations=(a for sym in _class_syms_asm for a in sym.annotations),
+        supertypes=(_extends_map.get(sym.symbol, "") for sym in _class_syms_asm),
+        return_types=(s.return_type for s in sorted_syms if s.type == "method"),
     )
     # A repo whose authorization runs through its OWN annotation is not an
     # unsecured repo. The `endpoints` command applied this predicate to its own
@@ -6487,18 +6485,10 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     # When present, high no_security_signal is expected — security is enforced by
     # the filter chain, not per-endpoint annotations.
     _class_syms = [s for s in all_symbols if s.type in ("class", "interface")]
-    _filter_based = (
-        # Config class annotated with EnableWebSecurity / EnableMethodSecurity
-        any(
-            ann in _FILTER_SECURITY_ANNOTATIONS
-            for sym in _class_syms
-            for ann in sym.annotations
-        )
-        # Class extends WebSecurityConfigurerAdapter (pre-Spring 5.7 style)
-        or any(
-            extends_map.get(sym.symbol, "") == "WebSecurityConfigurerAdapter"
-            for sym in _class_syms
-        )
+    _filter_based = _declares_request_chain(
+        annotations=(a for sym in _class_syms for a in sym.annotations),
+        supertypes=(extends_map.get(sym.symbol, "") for sym in _class_syms),
+        return_types=(s.return_type for s in all_symbols if s.type == "method"),
     )
     # A repo whose authorization runs through its OWN annotation is not an
     # unsecured repo. The structural gate predicate (coverage + specificity over