sourcecode 5.2.0__py3-none-any.whl → 5.3.0__py3-none-any.whl

sourcecode/consumer_join.py

@@ -0,0 +1,357 @@
+"""consumer_join.py — the consumers live in other repositories (F-BH).
+
+One repository is analysed; the system is four. `client_calls` already joins a
+client checked in *beside* the server, and the field's shape is the ordinary one:
+a server repository, and its consumers in separate repositories nobody analyses
+together. So the endpoint census answers *what is exposed* and the question that
+decides the work — *what does anybody call* — has no answer, and every reduction
+plan starts with "protect 2 635 routes".
+
+Given the consumers, the plan inverts: of 2 635 routes a readable rule leaves
+open, the ones a known consumer calls are **fix now**, and the ones nobody calls
+are **delete, do not protect** — the cheapest reduction of exposure available on
+a large surface, and one no single-repository analysis can propose.
+
+Three rules, and the first is the one that makes the output safe to act on:
+
+* **An uncalled route is a candidate, never a proven-dead one.** What was read is
+  the consumers the caller named, in the call shapes whose verb and path are
+  written at the call site. A route absent from that is absent from *what was
+  read*; the payload publishes the direction (`under_reports`) and the
+  per-consumer coverage that bounds it.
+* **A client call matching no route is the decisive direction.** It is a request
+  a consumer makes that this server does not serve — a broken integration or a
+  route that was deleted — and it needs no assumption about coverage to be true.
+* **Route-variable normalisation is confidence, not identity.** `/{bankId}` and
+  `${bank-id}` are the same position with two spellings, so the join key
+  neutralises variable segments (`client_calls.normalize_path`) and both original
+  spellings travel on the row. A match through a normalised segment is reported
+  as `normalised`, never as an exact one.
+"""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from typing import Any, Iterable, Optional
+
+from sourcecode.client_calls import (
+    ClientCall,
+    _iter_client_files,
+    _path_from_url,
+    extract_client_calls,
+    normalize_path,
+)
+
+SCHEMA_VERSION = "consumer-join-v1"
+
+#: Java client shapes whose verb and path are written at the call site — the same
+#: admission rule as the TypeScript side, in the language most server-to-server
+#: consumers are written in. A path assembled from a variable is not a call this
+#: module can see, and it is reported unresolved rather than guessed.
+_JAVA_TEMPLATE_CALL = re.compile(
+    r"""\b(?P<receiver>[\w$.]*)\.(?P<op>getFor\w+|postFor\w+|put|patch|delete|exchange)\s*\(\s*"""
+    r"""(?P<quote>")(?P<url>[^"]*)(?P=quote)""",
+)
+#: `HttpMethod.GET` inside an `exchange(...)` call, which is where the verb lives
+#: when the method name does not carry it.
+_JAVA_EXCHANGE_VERB = re.compile(r"HttpMethod\.(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)")
+#: A declarative HTTP client interface: the verb and path are annotation data.
+_JAVA_ANNOTATION_CALL = re.compile(
+    r"""@(?P<ann>GetMapping|PostMapping|PutMapping|PatchMapping|DeleteMapping|RequestMapping|RequestLine)\s*"""
+    r"""\(\s*(?P<args>[^)]*)\)""",
+)
+_ANN_VERB = {
+    "GetMapping": "GET", "PostMapping": "POST", "PutMapping": "PUT",
+    "PatchMapping": "PATCH", "DeleteMapping": "DELETE",
+}
+_STRING_ARG = re.compile(r'"([^"]*)"')
+_REQUEST_LINE = re.compile(r'"\s*(?P<verb>[A-Z]+)\s+(?P<path>/[^"\s]*)')
+_METHOD_ATTR = re.compile(r"RequestMethod\.(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)")
+#: Only a type that declares itself an HTTP client is read this way — an
+#: annotation-shaped path on a server controller is a route, not a call.
+_DECLARATIVE_CLIENT = re.compile(r"@(\w*FeignClient|HttpExchange|RegisterRestClient)\b")
+
+_JAVA_SKIP_DIRS = frozenset({
+    "target", "build", "out", ".git", "node_modules", ".gradle",
+})
+
+_VERB_FROM_OP = {
+    "getfor": "GET", "postfor": "POST", "put": "PUT", "patch": "PATCH",
+    "delete": "DELETE",
+}
+
+
+def _java_files(base: Path) -> list[Path]:
+    out: list[Path] = []
+    for path in base.rglob("*.java"):
+        if any(part in _JAVA_SKIP_DIRS for part in path.parts):
+            continue
+        if path.name.endswith("Test.java") or "/src/test/" in path.as_posix():
+            continue
+        out.append(path)
+    return sorted(out)
+
+
+def extract_java_client_calls(base: Path) -> "tuple[list[ClientCall], list[dict]]":
+    """HTTP calls written in Java client code, with the same admission rule as TS/JS."""
+    calls: list[ClientCall] = []
+    unresolved: list[dict] = []
+    base = Path(base)
+    for path in _java_files(base):
+        try:
+            text = path.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        rel = path.relative_to(base).as_posix()
+        for match in _JAVA_TEMPLATE_CALL.finditer(text):
+            op = match.group("op").lower()
+            verb = next((v for k, v in _VERB_FROM_OP.items() if op.startswith(k)), "")
+            if not verb and op == "exchange":
+                window = text[match.start(): match.start() + 400]
+                verb_match = _JAVA_EXCHANGE_VERB.search(window)
+                verb = verb_match.group(1) if verb_match else ""
+            route = _path_from_url(match.group("url"))
+            line = text.count("\n", 0, match.start()) + 1
+            if not verb or route is None:
+                unresolved.append({
+                    "source_file": rel, "line": line,
+                    "why": (
+                        "the verb is not written at the call site"
+                        if not verb else
+                        "the first argument is not a path this module can resolve"
+                    ),
+                })
+                continue
+            calls.append(ClientCall(
+                method=verb, path=route, source_file=rel, line=line,
+                receiver=match.group("receiver") or "",
+            ))
+        if not _DECLARATIVE_CLIENT.search(text):
+            continue
+        for match in _JAVA_ANNOTATION_CALL.finditer(text):
+            line = text.count("\n", 0, match.start()) + 1
+            ann, args = match.group("ann"), match.group("args")
+            if ann == "RequestLine":
+                request_line = _REQUEST_LINE.search(args)
+                if not request_line:
+                    unresolved.append({
+                        "source_file": rel, "line": line,
+                        "why": "the request line is not a literal `VERB /path`",
+                    })
+                    continue
+                calls.append(ClientCall(
+                    method=request_line.group("verb").upper(),
+                    path=request_line.group("path"),
+                    source_file=rel, line=line, receiver="declarative client",
+                ))
+                continue
+            verb = _ANN_VERB.get(ann, "")
+            if not verb:
+                method_attr = _METHOD_ATTR.search(args)
+                verb = method_attr.group(1) if method_attr else ""
+            literal = _STRING_ARG.search(args)
+            route = _path_from_url(literal.group(1)) if literal else None
+            if not verb or route is None:
+                unresolved.append({
+                    "source_file": rel, "line": line,
+                    "why": (
+                        "the verb is not written in the annotation"
+                        if not verb else
+                        "the annotation carries no literal path"
+                    ),
+                })
+                continue
+            calls.append(ClientCall(
+                method=verb, path=route, source_file=rel, line=line,
+                receiver="declarative client",
+            ))
+    return calls, unresolved
+
+
+def _consumer_calls(base: Path) -> "tuple[list[ClientCall], list[dict], dict]":
+    """Every legible call in one consumer repository, whatever it is written in."""
+    ts_calls, ts_unresolved = extract_client_calls(base, client_dirs=[base])
+    java_calls, java_unresolved = extract_java_client_calls(base)
+    read = {
+        "web_client_files": len(_iter_client_files(base, [base])),
+        "java_files": len(_java_files(base)),
+    }
+    return ts_calls + java_calls, ts_unresolved + java_unresolved, read
+
+
+def _slug(path: str) -> str:
+    """A path reduced to letters and digits, lowercased — the alias key.
+
+    `/v1/agrupadorGfh` and `/v1/agrupador-gfh` are two routes with one slug: either
+    two spellings of one live integration, or one live route plus debris. Which of
+    the two is a question about consumers, and this module has the consumers.
+    """
+    return re.sub(r"[^a-z0-9/{}]", "", normalize_path(path).lower())
+
+
+def build_consumer_join(
+    root: Path,
+    endpoints: "Iterable[dict]",
+    consumers: "Iterable[Path]",
+    *,
+    access: "Optional[dict[str, str]]" = None,
+) -> dict:
+    """The surface-reduction plan: what to fix, what to delete, what is undecided.
+
+    `access` maps `METHOD path` to the access verdict `posture` publishes
+    (`open` / `unknown` / `protected`). Absent, the plan still splits called from
+    uncalled — it just cannot say which half is urgent.
+    """
+    from sourcecode import non_coverage
+
+    rows = list(endpoints)
+    by_key: "dict[str, list[dict]]" = {}
+    consumer_rows: list[dict] = []
+    unresolved_total = 0
+    for base in consumers:
+        base = Path(base)
+        if not base.is_dir():
+            consumer_rows.append({
+                "path": base.as_posix(), "read": False,
+                "why": "not a readable directory — nothing from it is in this join",
+            })
+            continue
+        calls, unresolved, read = _consumer_calls(base)
+        unresolved_total += len(unresolved)
+        for call in calls:
+            by_key.setdefault(call.key, []).append({
+                **call.to_dict(), "consumer": base.name or base.as_posix(),
+            })
+        consumer_rows.append({
+            "path": base.as_posix(),
+            "name": base.name or base.as_posix(),
+            "read": True,
+            "files_read": read,
+            "calls_found": len(calls),
+            "calls_unresolved": len(unresolved),
+            "unresolved_sample": unresolved[:10],
+        })
+
+    matched_keys: set[str] = set()
+    routes: list[dict] = []
+    for endpoint in rows:
+        method = str(endpoint.get("method") or "").upper()
+        path = str(endpoint.get("path") or endpoint.get("effective_path") or "")
+        key = f"{method} {normalize_path(path)}"
+        witnesses = by_key.get(key, [])
+        if witnesses:
+            matched_keys.add(key)
+        verdict = (access or {}).get(f"{method} {path}") or (access or {}).get(key) or "unknown"
+        routes.append({
+            "method": method,
+            "path": path,
+            "join_key": key,
+            "access": verdict,
+            "consumed": bool(witnesses),
+            "match": (
+                "normalised" if witnesses and "{}" in key else
+                "exact" if witnesses else None
+            ),
+            "consumers": sorted({w["consumer"] for w in witnesses}),
+            "call_sites": witnesses[:5],
+        })
+
+    def _bucket(consumed: bool, open_only: bool) -> list[dict]:
+        return [
+            r for r in routes
+            if r["consumed"] is consumed
+            and ((r["access"] == "open") if open_only else True)
+        ]
+
+    fix_now = _bucket(True, True)
+    delete_candidates = _bucket(False, True)
+    unmatched = [
+        {"join_key": key, "call_sites": group[:5], "consumers": sorted({g["consumer"] for g in group})}
+        for key, group in sorted(by_key.items()) if key not in matched_keys
+    ]
+
+    aliases: list[dict] = []
+    by_slug: "dict[str, list[dict]]" = {}
+    for row in routes:
+        by_slug.setdefault(f"{row['method']} {_slug(row['path'])}", []).append(row)
+    for slug, group in sorted(by_slug.items()):
+        if len(group) < 2:
+            continue
+        live = [r for r in group if r["consumed"]]
+        aliases.append({
+            "slug": slug,
+            "paths": [r["path"] for r in group],
+            "consumed_paths": [r["path"] for r in live],
+            "reading": (
+                "every spelling is called — these are live aliases"
+                if len(live) == len(group) else
+                f"{len(live)} of {len(group)} spellings are called; the rest are "
+                "candidates for debris"
+                if live else
+                "no spelling is called by a consumer that was read"
+            ),
+        })
+
+    read_any = any(c.get("read") for c in consumer_rows)
+    return {
+        "schema_version": SCHEMA_VERSION,
+        "consumers": consumer_rows,
+        "summary": {
+            "routes": len(routes),
+            "consumed": sum(1 for r in routes if r["consumed"]),
+            "not_consumed": sum(1 for r in routes if not r["consumed"]),
+            "open_and_consumed": len(fix_now),
+            "open_and_not_consumed": len(delete_candidates),
+            "client_calls_matching_no_route": len(unmatched),
+            "calls_unresolved": unresolved_total,
+        },
+        "reduction_plan": {
+            "fix_now": {
+                "count": len(fix_now),
+                "meaning": (
+                    "a readable rule leaves these reachable without authentication "
+                    "AND a consumer that was read calls them"
+                ),
+                "routes": [r["path"] for r in fix_now[:50]],
+            },
+            "delete_candidates": {
+                "count": len(delete_candidates),
+                "meaning": (
+                    "a readable rule leaves these open and no consumer that was read "
+                    "calls them — candidates for deletion, which removes the exposure "
+                    "instead of guarding it"
+                ),
+                "routes": [r["path"] for r in delete_candidates[:50]],
+                "before_acting": (
+                    "This is a candidate list, not a dead-route proof: only the "
+                    "consumers named above were read, only in call shapes whose verb "
+                    "and path are written at the call site. Confirm against traffic "
+                    "before deleting."
+                ),
+            },
+            "broken_integrations": {
+                "count": len(unmatched),
+                "meaning": (
+                    "a consumer makes this request and this server serves no route "
+                    "for it — the one direction that needs no assumption about "
+                    "coverage to be true"
+                ),
+            },
+        },
+        "aliases": aliases,
+        "routes": routes,
+        "unmatched_client_calls": unmatched,
+        "direction": "under_reports",
+        "reading": (
+            "Of the routes a readable rule leaves open, the consumed ones are work "
+            "and the unconsumed ones are surface that can be removed. The population "
+            "read is the consumers named on the command line — this is a third "
+            "declared population beside the endpoint census and the servlet surface, "
+            "and it is never merged into either."
+            if read_any else
+            "No consumer repository could be read, so nothing was joined: every route "
+            "is `consumed: false` because there was nothing to call it. That is an "
+            "absence of evidence, published as one."
+        ),
+        "non_coverage": non_coverage.block("client_usage"),
+    }

sourcecode/environment_resolution.py

@@ -363,13 +363,68 @@ def _signal(
     )
 
 
-def collect_env_file_signals(path: Path, *, root: Optional[Path] = None) -> list[Signal]:
-    """Signals from a caller-supplied deployment env/dotenv file.
+#: The XML shape a deployment plan uses to override an environment entry: a name
+#: tag naming the setting, and its value in the next tag. WebLogic deployment
+#: plans (`<variable><name>…</name><value>…</value></variable>`) and servlet
+#: `<context-param>` blocks are the same shape with different tag names.
+_XML_NAME_TAG = re.compile(
+    r"<(?:param-)?name>\s*(?:" + re.escape(_PROPERTY_KEY) + r"|" + _ENV_KEY
+    + r")\s*</(?:param-)?name>",
+    re.IGNORECASE,
+)
+_XML_VALUE_TAG = re.compile(r"<(?:param-)?value>\s*([^<]*)</(?:param-)?value>")
+
+#: The tree scan ends an unquoted `KEY=value` at the first comma, because in a
+#: repository a comma is usually the next item of a flow list rather than the
+#: next profile. A deployment artefact the caller *names* is the opposite case:
+#: `SPRING_PROFILES_ACTIVE=prod,metrics` is one deployment activating two
+#: profiles, and dropping `metrics` would answer under a profile set the
+#: deployment does not run. Same patterns otherwise, comma admitted.
+_DEPLOYMENT_LINE_PATTERNS: tuple[tuple[str, re.Pattern], ...] = tuple(
+    (label, re.compile(_ENV_KEY + r"\s*[:=]\s*([^\s\"']+)")) if label == "env"
+    else (label, pattern)
+    for label, pattern in _LINE_PATTERNS
+)
+
+
+def _next_xml_value(lines: list[str], after: int) -> Optional[str]:
+    """The `<value>`/`<param-value>` that belongs to the name tag on line *after*.
+
+    Bounded to the next few lines on purpose: a value that is not adjacent to its
+    name is not a pair this reader can prove, and guessing at distance is how a
+    deployment artefact starts deciding things it does not say.
+    """
+    for line in lines[after - 1:after + 3]:
+        match = _XML_VALUE_TAG.search(line)
+        if match:
+            return _clean(match.group(1))
+    return None
+
 
-    Unlike repository artefacts, this is evidence the reviewer explicitly supplies
-    for the deployment being audited, so a deciding value outranks defaults found
-    in the tree. It still travels as ordinary evidence: file, line, raw text and
-    placeholder handling are the same as repository scans.
+def collect_deployment_artefact_signals(
+    path: Path, *, root: Optional[Path] = None
+) -> list[Signal]:
+    """Signals from ONE deployment artefact the caller names (F-BG).
+
+    The artefact that decides the profile set lives outside the code — a
+    Kubernetes manifest, a compose file, a WebLogic deployment plan, a
+    Dockerfile, a dotenv, a launch script — and `posture` used to end at exactly
+    that boundary: *"SPRING_PROFILES_ACTIVE in the process environment outranks
+    every artefact below it, and this analysis cannot see the process
+    environment"*. It still cannot see the process environment; what it can now
+    read is the file that fills it, when a reviewer says which one.
+
+    This is evidence the reviewer explicitly supplies for the deployment being
+    audited, so a deciding value here outranks defaults found in the tree. It
+    travels as ordinary evidence — `file:line`, the raw text, the same
+    placeholder handling — and it decides nothing on its own: a value that is a
+    `${...}` placeholder, or absent, leaves the repository's own verdict standing
+    rather than inventing one.
+
+    Every shape is read the same way as the repository scan, because they are the
+    same artefact families: the three line patterns (`-D`, `KEY=`, `key: `), the
+    two-line Kubernetes `name:`/`value:` pair, and the XML name/value pair used by
+    deployment plans and `<context-param>` blocks.
     """
     source = Path(path).expanduser().resolve()
     root_path = Path(root).resolve() if root is not None else None
@@ -380,21 +435,154 @@ def collect_env_file_signals(path: Path, *, root: Optional[Path] = None) -> list
         rel = source.as_posix()
 
     signals: list[Signal] = []
-    for index, line in enumerate(text.splitlines(), start=1):
+    lines = text.splitlines()
+    for index, line in enumerate(lines, start=1):
         stripped = line.strip()
+        # A commented line states nothing: dotenv and YAML both use `#`, and an
+        # artefact's history is not its content.
         if not stripped or stripped.startswith("#"):
             continue
-        for _label, pattern in _LINE_PATTERNS:
+        for _label, pattern in _DEPLOYMENT_LINE_PATTERNS:
             match = pattern.search(line)
-            if match:
+            if not match:
+                continue
+            value = _clean(match.group(1))
+            if not value and _K8S_NAME.search(stripped):
+                value = _next_k8s_value(lines, index)
+            signals.append(_signal("deployment_input", rel, index, line, value, explicit=True))
+            break
+        else:
+            if _K8S_NAME.search(stripped):
                 signals.append(_signal(
-                    "deployment_input", rel, index, line, _clean(match.group(1)),
-                    explicit=True,
+                    "deployment_input", rel, index, line,
+                    _next_k8s_value(lines, index), explicit=True,
+                ))
+            elif _XML_NAME_TAG.search(line):
+                signals.append(_signal(
+                    "deployment_input", rel, index, line,
+                    _next_xml_value(lines, index), explicit=True,
                 ))
-                break
     return signals
 
 
+def collect_env_file_signals(path: Path, *, root: Optional[Path] = None) -> list[Signal]:
+    """Signals from a caller-supplied deployment env/dotenv file.
+
+    Retained name for `--env-file`; the reader is the general one (F-BG), because
+    a dotenv is one deployment artefact shape and there was never a reason for it
+    to be the only one this product could be handed.
+    """
+    return collect_deployment_artefact_signals(path, root=root)
+
+
+#: The `--profile-from` block. Versioned separately from the resolution above
+#: because it answers a narrower question — *did the artefacts you named decide
+#: the profile set* — and a consumer may read it without reading anything else.
+PROFILE_FROM_SCHEMA = "profile-from-v1"
+
+#: The deciding outcome of `--profile-from`. Deliberately *not* `DECIDED`: that
+#: constant says "this repository decides it", and the whole point of this flag is
+#: that the deciding artefact lives outside the repository.
+DECIDED_BY_ARTEFACT = "decided_by_deployment_artefact"
+
+#: What outranks every artefact, said once and reused wherever the block is
+#: published, so the one caveat that matters cannot be dropped by a caller.
+PROCESS_ENV_CAVEAT = (
+    "SPRING_PROFILES_ACTIVE in the process environment outranks every artefact, "
+    "including this one; what is claimed is what the named artefact sets, not "
+    "what the running process was given."
+)
+
+
+def decide_profiles_from_artefacts(
+    paths: Iterable[Path], *, root: Optional[Path] = None
+) -> dict:
+    """Read the named deployment artefacts and say whether they decide the profile set.
+
+    Three outcomes, and only the first one changes what `posture` answers:
+
+    * **decided** — exactly one distinct profile set across every artefact named.
+      The set is published with the `file:line` that states it.
+    * **artefacts_disagree** — two artefacts name different sets. They are two
+      deployments, not a contradiction to resolve, so nothing is decided here for
+      the same reason the repository scan refuses it.
+    * **not_decided** — the artefacts name the setting without a value, or state a
+      placeholder resolved elsewhere, or never mention it at all. The repository's
+      own verdict stands untouched; this is the undecidable-first contract, and it
+      is what makes the flag safe to point at the wrong file.
+    """
+    root_path = Path(root).resolve() if root is not None else None
+    artefacts: list[dict] = []
+    signals: list[Signal] = []
+    for raw_path in paths:
+        source = Path(raw_path).expanduser()
+        found = collect_deployment_artefact_signals(source, root=root_path)
+        signals.extend(found)
+        artefacts.append({
+            "path": source.as_posix(),
+            "signals": [s.to_dict() for s in found],
+            "states_the_setting": bool(found),
+        })
+
+    deciding = [s for s in signals if s.value]
+    distinct = sorted({s.value for s in deciding if s.value})
+
+    block: dict = {
+        "schema_version": PROFILE_FROM_SCHEMA,
+        "artefacts": artefacts,
+        "outranked_by": PROCESS_ENV_CAVEAT,
+    }
+    if len(distinct) > 1:
+        block.update({
+            "decided": False,
+            "reason": DISAGREE,
+            "profiles": None,
+            "decided_by": None,
+            "statement": (
+                "The artefacts you named set different active profile sets ("
+                + ", ".join(repr(v) for v in distinct)
+                + "). These are different deployments, not a contradiction to "
+                "resolve — name the one artefact that describes the deployment "
+                "you are auditing. Until then the repository's own verdict stands."
+            ),
+        })
+        return block
+    if not distinct:
+        named = sum(1 for a in artefacts if a["states_the_setting"])
+        block.update({
+            "decided": False,
+            "reason": "no_value_here",
+            "profiles": None,
+            "decided_by": None,
+            "statement": (
+                (
+                    f"{named} artefact(s) name the setting and none of them states a "
+                    "value here — a placeholder or an empty entry names where the "
+                    "value comes from, not what it is. "
+                    if named else
+                    "The artefact(s) you named do not set `spring.profiles.active` or "
+                    "`SPRING_PROFILES_ACTIVE`. "
+                )
+                + "The repository's own verdict is unchanged."
+            ),
+        })
+        return block
+
+    first = next(s for s in deciding if s.value == distinct[0])
+    block.update({
+        "decided": True,
+        "reason": DECIDED_BY_ARTEFACT,
+        "profiles": list(_split_profiles(distinct[0])),
+        "decided_by": f"{first.file}:{first.line}",
+        "statement": (
+            f"{first.file}:{first.line} sets the active profile set to "
+            f"{distinct[0]!r}, so that is the profile set this posture answers "
+            "under. " + PROCESS_ENV_CAVEAT
+        ),
+    })
+    return block
+
+
 def resolve_environment(
     root: Path,
     deployment_signals: Optional[Iterable[Signal]] = None,

sourcecode/format_contract.py

@@ -50,6 +50,7 @@ FORMAT_REGISTRY: "dict[str, tuple[str, ...]]" = {
     "rename-class": ("json", "yaml"),
     "risk": ("json", "yaml"),
     "trend": ("json", "yaml"),
+    "timeline": ("json", "yaml"),
     "verify": ("json", "yaml"),
     "verify-edit": ("json", "yaml"),
     "impact": ("json", "yaml"),

sourcecode/non_coverage.py

@@ -119,17 +119,21 @@ NON_COVERAGE: tuple[NonCoverage, ...] = (
             "General request-input-to-sink taint analysis."
         ),
         why=(
-            "`ask risk` includes a bounded slice for annotated HTTP parameters, "
-            "positional calls in repository Java sources and known query sinks. "
-            "Anything broader needs value flow through a program, which is a "
-            "different analysis with a different failure mode: an unsound one "
-            "produces confident findings that are wrong, and every claim here is "
-            "meant to be checkable against the line that produced it."
+            "`ask risk` includes two bounded slices for annotated HTTP parameters "
+            "and positional calls in repository Java sources: known query sinks, "
+            "and MyBatis statements that splice a value into their SQL. Anything "
+            "broader needs value flow through a program, which is a different "
+            "analysis with a different failure mode: an unsound one produces "
+            "confident findings that are wrong, and every claim here is meant to "
+            "be checkable against the line that produced it."
         ),
         instead=(
             "A dataflow scanner (Semgrep, CodeQL) for complete taint. What this "
-            "product adds on top is reachability and, for the bounded slice, "
-            "whether an annotated HTTP input reaches a known concatenated query sink."
+            "product adds on top is reachability and, for the two bounded slices, "
+            "whether an annotated HTTP input reaches a known concatenated query "
+            "sink or a spliced SQL statement — the latter with a three-state "
+            "verdict that says `undecidable` rather than clearing a route it could "
+            "not follow."
         ),
     ),
     NonCoverage(

sourcecode/perf.py

@@ -460,7 +460,7 @@ RELEASE_GATE_MIN_RUNS = 5
 #: what is left out is left out for a reason, and the reason is published below.
 RELEASE_GATE_COMMANDS: tuple[str, ...] = (
     "", "endpoints", "spring-audit", "migrate-check", "validation", "posture",
-    "risk", "modernize", "repo-ir", "data-exposure",
+    "risk", "modernize", "repo-ir",
 )
 
 #: Extra arguments a gated command needs to be measured at all — one authority,
@@ -473,6 +473,13 @@ RELEASE_GATE_COMMANDS: tuple[str, ...] = (
 #: form the harness already uses to count symbols.
 RELEASE_GATE_COMMAND_ARGS: dict[str, tuple[str, ...]] = {
     "repo-ir": ("--summary-only",),
+    # The first gated release found this one: `ask migrate-check <gate repo>`
+    # exits 1 with OUTPUT_TOO_LARGE (~269 K estimated tokens on 2 985 files), and
+    # for five releases the harness recorded the timing anyway — the analysis did
+    # run, so the number looked plausible (8,72 s) and it was the cost of a run
+    # that ended in a refusal. `--compact` is the command's own published remedy
+    # ("bounded decision summary, same report") and it measures the same scan.
+    "migrate-check": ("--compact",),
 }
 
 #: What the gate does **not** cover, and why — published rather than omitted, so
@@ -491,6 +498,13 @@ RELEASE_GATE_EXCLUSIONS: tuple[tuple[str, str], ...] = (
     ("pr-impact / review-pr", "diff-dependent — their cost follows a diff the "
                               "gate would have to invent, and an invented diff "
                               "measures the invention"),
+    ("data-exposure", "needs `dataLabels` declared in the repository under audit, "
+                      "and the gate repository declares none: measured at 0,28 s "
+                      "on the first gated release, which is the cost of the "
+                      "abstention (`answered: false`) and not of the command. A "
+                      "cell that times a refusal is worse than no cell — it is a "
+                      "green light for work nobody did (found by this gate, on "
+                      "its first run over a release)"),
 )