sourcecode 5.4.1__tar.gz → 5.5.0__tar.gz

{sourcecode-5.4.1 → sourcecode-5.5.0}/CHANGELOG.md

@@ -2,6 +2,59 @@
 
 ## [Unreleased]
 
+## [5.5.0] — 2026-08-12
+
+**Audit backlog resolved and performance signals made explicit.**
+This release folds in the latest external audit queue: programmatic Spring
+validation now contributes to `validation` gaps and confidence, servlet and
+endpoint publishing preserve extension mappings and `ANY` methods, reference
+classification distinguishes class literals from config wires, and the cache
+model now warns about large repositories against the correct scale. The roadmap
+also records the audit backlog, including the command-execution timing
+regression called out in the report.
+
+### Fixed
+- **Programmatic validation is now surfaced.** `Validator` and `@InitBinder`
+  evidence now affect `validation` gaps and overall confidence, and the payload
+  carries the non-coverage note for that limit.
+- **Servlet extension mappings stay visible.** Patterns such as `*.ftl` and
+  `*.vm` are preserved in the servlet surface instead of being dropped.
+- **Methodless request mappings publish as `ANY`.** `@RequestMapping` without a
+  declared method is no longer narrowed to `GET`.
+- **Class literals count as references.** `Foo.class` hits now promote the
+  type to `referenced` instead of `unknown_framework_dispatch`.
+- **Large-repository cache advice compares against the right scale.** The size
+  warning now tells the operator when the repository exceeds the measured
+  reference population.
+
+### Documentation
+- Added the external 2026-08-12 audit queue and its performance backlog to the
+  roadmap.
+
+## [5.4.2] — 2026-08-12
+
+**External audit fixes and roadmap alignment.**
+This release preserves bounded SQL interpolation evidence in composed risk
+payloads, declares the population of existing test counts, and removes routes
+declared only by abstract controller classes. The external audit queue and
+defect ledger are synchronized with the shipped behavior.
+
+### Fixed
+- **Bounded SQL interpolations remain auditable in `risk` and `enrich`.** The
+  `sql_taint.bounded_interpolations` rows now survive composition serialization
+  beside `sinks_total`.
+- **`existing_test_count` declares its population.** The payload now identifies
+  the all-path, multi-language `prepare-context` population and distinguishes it
+  from the Java IR test-gap population.
+- **Abstract controller declarations no longer emit phantom routes.** Their
+  endpoints remain available for projection onto concrete subtypes, but the
+  abstract class itself is not treated as a registered handler bean.
+
+### Documentation
+- Added the external 5.4.2 audit queue and recommended capability work to the
+  semantic IR roadmap.
+- Synchronized the distributed defect ledger with the 5.4.1/5.4.2 build state.
+
 ## [5.4.1] — 2026-08-12
 
 **Two correctness fixes and a release bump.**

{sourcecode-5.4.1 → sourcecode-5.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.4.1
+Version: 5.5.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.4.1-blue)
+![Version](https://img.shields.io/badge/version-5.5.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -126,7 +126,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.4.1 — and, on a build that has aged,
+ask version                    # ask 5.5.0 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.4.1 → sourcecode-5.5.0}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.4.1-blue)
+![Version](https://img.shields.io/badge/version-5.5.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -88,7 +88,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.4.1 — and, on a build that has aged,
+ask version                    # ask 5.5.0 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.4.1 → sourcecode-5.5.0}/docs/DEFECT-LEDGER.md

@@ -59,7 +59,7 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 | C1-40 | **`cache model` promises `onboard` an answer-level cache hit and the second run recomputes.** `ask cache model .` publishes `onboard` → *"the answer (repeat cached)"* `[task, ris]`. Measured: first run 56 s (cold, expected), **second run on a warm cache 23,5 s** — not an answer hit, a partial recomputation. Corroborated by `cache context-stats .`: `Contexts: 1 · Hits: 1 · Misses: 1 · Hit ratio: 0.5 · Avg lookup 1029,1 ms (p95 1955,2 ms) · Avg build 18332,5 ms · Bytes stored 9 969 057`. A **full second to decide whether there is a hit**, over a single 10 MB entry, is the signature of deserialising the whole payload to read its key | 4.10.4 (eval #14) | **Medium** — `cache model` exists so a user can plan instead of guess; a row that overstates what a warm buys is the one defect that command cannot afford. The lookup half is the second field measurement of C3-47 | **closed (4.10.6), and the claim was the false half.** Reproduced at home on keycloak (5 486 sources): **with** a `cache warm`, `onboard` costs 0,7 s — the row's promise holds. **Without** one, a second identical run costs 9,4 s against 10,2 s cold: the warm is what stores the answer, and the command does not store its own. The row said `repeat cached`, the field ran it twice with no warm, and got 56 s → 23,5 s. `repeat` is now `false` for `onboard` and the measured figures are published at two scales, with and without a warm, so the reader can tell which run they are about to make. Half (b) shipped too: the validity keys (`ev`/`kl`/`sig`) live in an uncompressed sidecar beside the blob, so deciding *is this entry still valid?* is a small file read instead of decompressing and parsing a 10 MB envelope — the case that matters most, an entry invalidated by a changed signature, used to pay all of it and then discard the result. A genuine hit still pays for the payload it returns; that is the answer, not overhead. Entries written before the sidecar existed fall back to the old full read. Original remedy note: two halves. (a) Reconcile the claim: either `onboard` really caches its answer, or its row says `shared work`, not `the answer`. (b) Split key metadata (hash + validity) from the payload into a sidecar index so a hit is decided without deserialising the blob; target < 5 ms against the ~1 029 ms measured. Related F-AA |
 | C1-43 | **"Does this repository configure a request filter chain?" has two authorities, and the one that decides whether a `high` finding family runs is the older, weaker one.** `posture._security_config_types` reads the question off the IR's own edges — a type that `extends`/`implements` a chain SPI type, **or a member that `returns` one**, i.e. the `@Bean SecurityFilterChain` shape — and the docstring beside it records why: *"a repository that wires its chain with a `@Bean SecurityFilterChain` and no `@EnableWebSecurity` reported `security.active: 0` — a false zero on the axis this command exists for."* `repository_ir._filter_based`, which decides `security_model` and therefore whether **SEC-001 runs at all**, still tests only `@EnableWebSecurity` (`_FILTER_SECURITY_ANNOTATIONS`, deliberately one entry) and `extends WebSecurityConfigurerAdapter`. A Spring Security 6 repository that declares its chain as a bean is therefore classified `annotation_based`, and SEC-001 then asserts, per unannotated handler, *"In an annotation_based security model there is no centralized filter — any caller can reach this endpoint without authentication"* | 4.18.0 (eval #24) | **High** — a confident falsehood on the strongest axis, and the only one of the series: measured on a greenfield Boot 3 module, the single SEC-001 finding is `POST /api/v1/auth/login`, which the repository's `SecurityConfig` lists in `PUBLIC_ENDPOINTS` with `permitAll()` under a closing `anyRequest().authenticated()` — the chain the model says does not exist both admits that route *and* protects the other 24. The evaluator adjudicated it by reading the source: *"la herramienta lo marca `high` porque solo lee la anotación del método, no la cadena de filtros"* | **in-progress** — the premise half shipped on `fix/sec-001-chain-authority`. One authority, `security_chain`, holds the request-chain SPI vocabulary, the member rule (*a member returning the SPI type makes its declaring class the configuration*) and the name normalisation; `posture` and both `repository_ir` sites read it, so the mechanism can no longer differ. **Two questions are named apart there rather than merged, because only one of them may silence a finding:** `declares_request_chain` (is there a chain at all — the annotation, the pre-5.7 adapter, or a member producing a `SecurityFilterChain`) is SEC-001's premise and is deliberately narrow, while `chain_participant_types` (what takes part in configuring it, filters included) is `posture`'s question. Widening the first to the second would silence SEC-001 on repositories with no centralized authorization — the P1-A failure mode, and the one with no symptom. Measured end-to-end on a fixture of the reported shape: `security_model` `annotation_based` → `mixed`, and the SEC-001 finding on `POST /api/v1/auth/login` disappears; recall asserted in the same battery (no chain → still reported; `@EnableMethodSecurity` alone → still reported). Fleet A/B over 5 repositories × 3 commands: 15/15 payloads identical in content, which is the expected result and the point of running it — no fleet repository declares a chain in either shape, so nothing could move. **Open: the verdict half.** Where the chain resolves, the per-endpoint answer should come from the resolved chain rather than from the model classification (C1-8's `matched_path` machinery already exists), and where it does not resolve, SEC-001 abstains — never *"any caller can reach this endpoint"* over a chain the run did not read |
 | C1-44 | **`has_uncommitted_changes: false` sits in the same document as `git_context.uncommitted_files: 1`, and it is the field cache freshness is decided on.** `ask <repo> --compact --git-context` publishes both, one run, one payload: `git_context.uncommitted_files` counts the file, `_cache.has_uncommitted_changes` says there is none, and `git status --porcelain` on the same tree prints `?? .claude/settings.json`. The third authority in the build agrees with the first — `--changed-only` reports `changed_files_count: 1` for that file and its `--help` defines the set it counts as *"staged, unstaged, untracked"* — so two of three surfaces admit the file and the one a consumer trusts for staleness does not. Under that published definition the boolean is simply false | 5.3.1 (audit #28) | Medium | **closed 5.4.0** — one predicate (`baseline_autocapture.counts_as_dirty`), extracted from `worktree_dirty` and read by the count in both the fresh path and the cache-hit patch, so the boolean cannot drift from the function that defines it. What it excludes is published (`uncommitted_files_not_read`, `uncommitted_files_basis`) rather than subtracted in silence, and only when something was actually excluded. Original remedy note: one predicate over one definition of *the working set*, read by both fields; the boolean is derived from the count rather than measured a second time, and where the two cannot be derived from one another the document may not publish both |
-| C1-46 | **`existing_test_count: 6` sits beside `test_files: 0` and `has_test_sources: false` in one `prepare-context generate-tests` payload, and the 6 are five production files in a business package.** C3-115 closed the half that was reported — `test_gaps` now declares its population — and left a second authority for *"how many tests are there"* answering a different number in the same document. Re-measured in the field: 0 Java tests, 1 `.spec.ts`, 3 karma/jest configs; no population is worth 6. Root cause is in `test_sources.declared_test_root`: `_TEST_DIR_NAMES` carries the bare segment `it`, the final loop accepts it **at any depth**, and the only disarm — `_under_main_root` — knows `src/main` alone, which is a Maven layout. An Angular app lives under `src/app`, so `saint-client/src/app/shared/akita/it/` — *Incapacidad Temporal*, a business entity whose `it.model.ts` declares `ENFERMEDAD COMÚN` and `ACCIDENTE DE TRABAJO` — is read as a test source root and contributes 5 files; the 6th is the one real `.spec.ts`, and the reconciliation is exact. **It generalizes off this repository:** `it` is also the ISO 639-1 code for Italian, so `web/src/assets/i18n/it/messages.json` and `app/locales/it/common.ts` both answer `is_test_path: true` on the shipped build. Sibling of C1-28, in the direction C1-28 was written to prevent | 5.4.0 (audit #29) | **Medium** — the number is small and the shape is the one the maintenance rule exists for: an authority closed on a narrower restatement than the one reported | **open** |
+| C1-46 | **`existing_test_count: 6` sits beside `test_files: 0` and `has_test_sources: false` in one `prepare-context generate-tests` payload, and the 6 are five production files in a business package.** C3-115 closed the half that was reported — `test_gaps` now declares its population — and left a second authority for *"how many tests are there"* answering a different number in the same document. Re-measured in the field: 0 Java tests, 1 `.spec.ts`, 3 karma/jest configs; no population is worth 6. Root cause is in `test_sources.declared_test_root`: `_TEST_DIR_NAMES` carries the bare segment `it`, the final loop accepts it **at any depth**, and the only disarm — `_under_main_root` — knows `src/main` alone, which is a Maven layout. An Angular app lives under `src/app`, so `saint-client/src/app/shared/akita/it/` — *Incapacidad Temporal*, a business entity whose `it.model.ts` declares `ENFERMEDAD COMÚN` and `ACCIDENTE DE TRABAJO` — is read as a test source root and contributes 5 files; the 6th is the one real `.spec.ts`, and the reconciliation is exact. **It generalizes off this repository:** `it` is also the ISO 639-1 code for Italian, so `web/src/assets/i18n/it/messages.json` and `app/locales/it/common.ts` both answer `is_test_path: true` on the shipped build. Sibling of C1-28, in the direction C1-28 was written to prevent | 5.4.0 (audit #29) | **Medium** — the path-classification half is closed in 5.4.1; `existing_test_count_unit` now declares its all-path, multi-language task population in 5.4.2, distinct from the Java IR population | **closed 5.4.2** |
 | C1-45 | **The SQL taint join keys a sink on a bare statement id, so a mapper method in one namespace is joined to a call site that resolves to another — and the result is published as the repository's #1 critical risk with a call trace that does not exist.** `risk`'s top row on a 3 342-file monolith is `severity_effective: 29.57` at `ProcesosGerenciaMapper.xml:74`, `factors.query_construction = http_input_reaches_sql_interpolation`, with evidence naming `AutocoberturasRestController#actualizar(id, obj)` *calls* `actualizar(…)` in `ProcesosGerenciaMapper`. The controller calls its own service's `actualizar`; the join matched on the method name alone. **The correct key already exists in the code and is not used** — `sql_taint` line 76 returns `f"{self.namespace}#{self.statement_id}" if self.namespace else self.statement_id`, and `namespace` is captured (141, 151) and then spent only on an explanatory sentence (313-314), while the published basis claims the sinks are *"keyed by namespace and statement id"*. **Accompanying defect, same row:** the interpolated expression is stored (72, 144) and emitted (86) and never inspected, so `bloqueada = ${dto.bloqueada ? "'S'" : "'N'"}` — an OGNL ternary whose two branches are string literals, a closed allowlist by construction and precisely the mitigation SEC-008's own `fix_hint` recommends — is ranked as a text-controllable sink | 5.3.1 (audit #28) | **High** — F-BF's whole argument is that this axis fires on evidence rather than on multiplication by 1,0; a name-collision join inverts the first row of the ranking, which is the product | **closed 5.4.0** — both sides keyed on `namespace#statement_id`: a call carries the type its receiver resolves to and is that statement's only when the receiver resolves to the mapper it lives in; an unresolved receiver is not the same answer as any type name, so the sink stays `undecidable` rather than `reaches`. `does_not_reach` carries the same qualification, because it is a confident no. `splices_free_text` reads the interpolation at last — anything it cannot prove closed is free text, and what it closes leaves the population into a published `bounded_interpolations` list. The regression fixture this row specified is in the suite. Original remedy note: key both sides on `namespace#statement_id` (the property is already written, the call sites read the wrong half), and give the interpolation a three-state read: an expression whose reachable values are all literals is `does_not_reach`, an unresolvable one stays `undecidable`, never `reaches` by default. Regression fixture: two mappers in different namespaces sharing a `statement_id`, one reached by HTTP input and one not — expected one `reaches`, one `undecidable`; today, two `reaches` |
 
 
@@ -231,8 +231,8 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 | C3-120 | **The composition engine became unusable at 3 342 files, and one line of C1-45's fix is why.** Measured against 5.3.1 artefacts on the same subject: `risk` 38,37 s → **601,74 s** under a 300 s budget, returning `partial: true` with **0 of 98** defects composed; `risk` under a 3 000 s budget → 444 s complete (×11,6); `enrich` 36,30 s → **>600 s**, stopped without completing; `audit-report` not run at all after two hangs. Median ratio over 48 comparable pairs is **1,00x** — the regression is confined to this family. Root cause is `sql_taint._receiver_type`: `_RECEIVER_RE` is anchored `…\s*$` and is applied as `search(method.body[:body_index])`, which copies an O(body_index) prefix **and** makes the regex engine try every start position in it before concluding. `_called_names` pays that for **every call of every method in the repository**, unfiltered and unbounded, where 5.3.1 did `names.add(call.group(1))` at O(1); a service body of 1 650+ lines makes the pass quadratic. Auditor's microbenchmark on the shipped regex, results byte-identical to a windowed `search(body, start, endpos)`: 8,6 KB/200 calls **36,9×**, 43 KB/1 000 calls **186,9×**, 215 KB/5 000 calls **916,5×** — 5× the calls, 25× the time | 5.4.0 (audit #29) | **Critical** — three of the seven experimental commands, and the ones that carry the price premium, do not return on the repository this product is sold for | **closed 5.4.1** — the read is windowed (`search(body, start, body_index)`: the `$` still ends at the call, no prefix is copied and the engine is offered a bounded number of start positions), and the window start retreats over any identifier it lands inside so a receiver wider than 128 characters is resolved whole rather than by its suffix — `""` is *unresolved* here and must never be reached by truncation. Second half: `_called_names` takes the statement ids being decided as its scope, because the only question asked of that set is `(mapper, statement id) in called`, so a name no statement carries can change no verdict. Re-measured on the shipped regex: 5 000 calls over a 159 KB body, **18 079 ms → 28 ms**, results identical at every call site. Four regression assertions, including a wall-clock gate on the pass |
 | C3-121 | **The budget does not bind in the composition family, and one invocation froze the process.** `ASK_MAX_ANALYSIS_SECONDS=300 ask risk .` ran **601,74 s** of wall clock and wrote `elapsed_seconds: 600.92` into its own `_partial`; `ASK_MAX_ANALYSIS_SECONDS=150 ask enrich . --sarif` passed 600 s and was stopped by hand; a third `risk` invocation stopped responding until the working session was killed. This is the failure mode C3-82/C3-118 closed for `generate-tests` — *the budget must be checked where the walk can be cut, not only between phases* — reappearing in another family, and the lesson did not travel. Second half, independent of the overrun: a **respected** budget yields no answer — at 300 s the payload is `phases_completed: ["audit"]`, `phases_pending: ["compose"]`, `composition_stopped_after.defects_composed: 0`, which in CI is an empty envelope after ten minutes. The degradation shape itself is exemplary and is not what this row is against: `_partial` names the completed and pending phases, `why_stopped`, the repo-wide walks it skipped and the axes left `unknown`. ⚠ Re-measure after C3-120 before investigating separately — same subsystem, same triage C3-114 got against E-3 | 5.4.0 (audit #29) | **High** — a budget that does not cut is worse than no budget: it sells CI a guarantee it does not keep, and a hard freeze consumes the runner | **closed 5.4.1** — the deadline is asked *inside* the two repository-wide walks that hold the wall time, not only at their doors: the method parse samples the clock every 16 files and the two propagation walks sample it on their own units. A walk cut while running raises rather than returning what it had — every verdict these walks publish below `reaches` is a statement about the **whole** repository, and a negative over a partial universe is a confident no built on an unfinished read — so the measurement is dropped, the axis reads `unknown`, and the walk is named in `_partial.composition_walks_not_run` exactly as a walk that never started is. Nothing partial is cached on the CIR, so a later caller cannot be served a repository with files missing. Two assertions, both non-vacuous: the walk cut inside, and the composer naming it. ⚠ The residue this row does not close: the walks that are still gated only at the door (`inferring the security posture`, `indexing the validation surface`, `resolving the conditional bean graph`) — none of them was measured holding the overrun, and giving each a sampling seam is its own increment |
 | C3-122 | **`ask risk <repo> -o <path>` spent 444 s, exited 0, printed nothing and wrote no file.** One occurrence, from bash with a Windows path in forward slashes; a later recursive search found the file nowhere in the user tree. The same path shapes worked in the same session for `ask endpoints -o`, `ask config` and `ask baseline capture --dir`. Not reproduced — the auditor stopped invoking `risk` after the freeze in C3-121 — and recorded with that limitation. An analysis command that consumes 444 s and reports success without producing its output owes the reader a line on stderr at minimum | 5.4.0 (audit #29) | **Low** (unreproduced) — but it is a C5 shape: the exit code is the published fact and it is wrong | **open** |
-| C3-123 | **A static asset reaches `broken_integrations`, the one verdict this command presents as unconditional.** C3-119 did the main work — 19 → 1, with 14 relocated to `partial_client_calls` and the `meaning` stating its condition. The survivor is `GET /assets/i18n/{}.json` from `transloco-root.module.ts:18`: a translation bundle served by the container, not a Spring route. True under the published definition and not a broken integration in any sense a reader means. Remedy: exclude paths under known asset roots (`/assets/`, `/static/`, `/public/`) or ending in a static file extension, and say so in the `meaning` | 5.4.0 (audit #29) | **Low** | **open** |
-| C3-124 | **`risk` renamed three published keys inside a minor with no alias.** 5.3.1 emitted `total_defects`, `total_findings` and `risks_cap`; 5.4.0 emits `total_defects_floor`, `total_findings_floor` (plus `counts_basis`, `counts_are_floor`, `partial`, `_partial`) and dropped `risks_cap`. Permitted by the command's own experimental tier — *shape may change in a minor* — and the new names are better; the payload still carries no notice, so a consumer bound to the old keys reads `None` with nothing telling it why. `auth status` already publishes a `deprecated_fields` block: the channel exists and this command did not use it | 5.4.0 (audit #29) | **Informative** | **open** |
+| C3-123 | **A static asset reaches `broken_integrations`, the one verdict this command presents as unconditional.** C3-119 did the main work — 19 → 1, with 14 relocated to `partial_client_calls` and the `meaning` stating its condition. The survivor is `GET /assets/i18n/{}.json` from `transloco-root.module.ts:18`: a translation bundle served by the container, not a Spring route. True under the published definition and not a broken integration in any sense a reader means. Remedy: exclude paths under known asset roots (`/assets/`, `/static/`, `/public/`) or ending in a static file extension, and say so in the `meaning` | 5.4.0 (audit #29) | **Low** | **closed 5.4.1** — static asset roots and file extensions are excluded and the meaning names the exclusion |
+| C3-124 | **`risk` renamed three published keys inside a minor with no alias.** 5.3.1 emitted `total_defects`, `total_findings` and `risks_cap`; 5.4.0 emits `total_defects_floor`, `total_findings_floor` (plus `counts_basis`, `counts_are_floor`, `partial`, `_partial`) and dropped `risks_cap`. Permitted by the command's own experimental tier — *shape may change in a minor* — and the new names are better; the payload still carries no notice, so a consumer bound to the old keys reads `None` with nothing telling it why. `auth status` already publishes a `deprecated_fields` block: the channel exists and this command did not use it | 5.4.0 (audit #29) | **Informative** | **closed 5.4.1 as not a defect** — a complete 5.4.1 run retains the legacy keys; the renamed floor fields are emitted only for budget-cut payloads and are explicitly marked as floors |
 
 ## Class C4 — Discoverability (the ceiling as of 3.2.0)
 

{sourcecode-5.4.1 → sourcecode-5.5.0}/docs/USER_GUIDE.md

@@ -136,7 +136,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.4.1
+# ask 5.5.0
 ```
 
 Requires Python 3.9+.

{sourcecode-5.4.1 → sourcecode-5.5.0}/docs/architecture/semantic-ir-roadmap.md

@@ -297,3 +297,43 @@ milestone; hash-neutral; suite green.
 > completion), then `integration_detector` migration (Move 3). Both are named here
 > only to show the arc — neither is begun until P6.0's evidence is in hand and the
 > user selects it.
+
+---
+
+## Part V — External re-audit queue (5.4.1 → 5.4.2)
+
+The latest external re-audit was run against the installed `5.4.1` build using
+the same read-only harness and repository as the previous rounds. This section
+records only findings that are not already represented elsewhere in this
+roadmap; previously closed findings remain historical evidence, not duplicate
+work items.
+
+### Bugs to fix
+
+| ID | Finding | Severity | Resolution / acceptance criterion |
+|----|---------|----------|------------------------------------|
+| D-01 | `risk` drops `bounded_interpolations` while serializing the `sql_taint` block, so `sinks_total` is not auditable. | Medium | Preserve the bounded rows in the published payload. A fixture with one bounded and one free interpolation must report `sinks_total == 1` and one `bounded_interpolations` entry in both `risk` and `enrich`. |
+| D-02 | `existing_test_count` has no population/unit declaration and is confused with the IR's `test_gap_ranking.population.test_files`. | Medium | Publish an explicit unit naming the all-paths, multi-language task population, or remove the redundant field. The chosen authority must be covered end to end. |
+| D-03 | Route projection emits endpoints declared by abstract controller classes, creating phantom routes and inflating the unprotected census. | Low | Carry class modifiers into route-surface metadata and exclude abstract declarers from emitted routes; concrete subtype projection remains unchanged. |
+| D-04 | The distributed defect ledger can claim `C3-123` is open although the `5.4.1` build already excludes static assets. | Informational | Synchronize ledger status with the shipped build and close the stale row. Documentation artifacts must describe the wheel they accompany. |
+| D-05 | `risk -o` once exited successfully without writing a file; the four current invocations did write correctly. | Unreproduced | Keep as an observation only. Do not implement or mark it closed without a reproducible fixture. |
+
+The audit explicitly retracted the apparent `N-01` global performance regression
+after cache-settled, consecutive measurements, and retracted `REG-07` schema
+breakage after a complete run preserved the legacy keys. Neither is a bug queue
+item. The already closed `REG-01` through `REG-06` findings are likewise not
+reopened here.
+
+### Recommended capabilities and engineering work
+
+These are recommendations from the audit, not fixes to mix into the bug commits:
+
+| Item | Recommendation | Product rationale |
+|------|----------------|-------------------|
+| Performance budget gate | Add a release-time assertion for IR construction and keep comparable cold/warm measurements. | Two consecutive releases had performance concerns before the cache-settled protocol separated real regressions from first-build cost. |
+| Cache measurement protocol | Require an established cache and two concordant runs before publishing a performance claim; retain cold/warm values separately. | A single measurement inside a warming batch is not a stable comparison. |
+| CLI grammar closure | Finish the unresolved CLI grammar/command-surface work tracked by `C4-25`. | The audit still identifies inconsistent or incomplete command syntax as an open usability risk. |
+
+The existing P6.0 semantic-IR milestone is intentionally not repeated here;
+its class-level type usage and semantic impact work remains the roadmap's
+architectural feature track.

{sourcecode-5.4.1 → sourcecode-5.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.4.1"
+version = "5.5.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.4.1 → sourcecode-5.5.0}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.4.1"
+__version__ = "5.5.0"

{sourcecode-5.4.1 → sourcecode-5.5.0}/src/sourcecode/cache_model.py

@@ -492,6 +492,7 @@ class Conditioning:
     scope: str                              # "3 342 Java files, cache cold"
     transfers: "Optional[bool]"             # do the reference figures apply here?
     per_command: "dict[str, str]"           # command → how it can be run here
+    java_files: "Optional[int]" = None      # measured scope size, if available
 
     def statement(self) -> str:
         """One sentence about whether the figures below transfer to this scope."""
@@ -500,6 +501,14 @@ class Conditioning:
                 f"This repository ({self.scope}) was not measured, so nothing below "
                 f"is claimed about it: the figures are the reference repository's."
             )
+        if self.java_files is not None and self.java_files > REFERENCE_JAVA_FILES:
+            return (
+                f"This repository ({self.scope}) is larger than the repository the "
+                f"figures below were measured on ({REFERENCE_JAVA_FILES} Java files), "
+                f"and what cost tracks here is the build rather than the file count: "
+                f"{FIELD_ANCHOR}. Read each figure as the reference's, not as yours; "
+                f"the `here:` lines say how each command can be run on this one."
+            )
         if self.transfers:
             return (
                 f"This repository ({self.scope}) is within the size the figures "

{sourcecode-5.4.1 → sourcecode-5.5.0}/src/sourcecode/cli.py

@@ -27,6 +27,7 @@ from sourcecode.phased_run import PhasedRun
 from sourcecode.partial_contract import PARTIAL_EXIT_CODE as _PARTIAL_EXIT
 from sourcecode.partial_contract import read_count as _read_count
 from sourcecode import perf
+from sourcecode.non_coverage import block as _non_coverage_block
 from sourcecode.caller_metrics import (
     CALLER_METRIC_RECONCILIATION,
     CYCLE_METRIC_RECONCILIATION,
@@ -5461,6 +5462,12 @@ def prepare_context_cmd(
             _et_count = getattr(output, "existing_test_count", None)
             if _et_count is not None:
                 out["existing_test_count"] = _et_count
+                out["existing_test_count_unit"] = (
+                    "test source files present in the complete prepare-context path "
+                    "universe, across all detected languages; this is a task-scope "
+                    "count and is not the Java IR population in "
+                    "`test_gap_ranking.population.test_files`"
+                )
     # C3-13: the basis of the ranked list travels with it — emitted even when the
     # list is empty, because "no gaps" and "no measurement" are different answers.
     if task == "generate-tests":
@@ -7281,6 +7288,23 @@ def validation_cmd(
     except Exception:
         pass
 
+    if data.get("programmatic_validation", {}).get("detected"):
+        data.setdefault("non_coverage", _non_coverage_block("validation"))
+        _vc = data.get("validation_confidence")
+        if isinstance(_vc, dict):
+            _vc["overall"] = "Likely"
+            _vc["claim"] = (
+                "Declared constraints are present, but programmatic Spring "
+                "Validator wiring was detected outside this surface's model"
+            )
+            limits = _vc.setdefault("known_precision_limits", [])
+            note = (
+                "Programmatic Spring Validator / @InitBinder wiring is outside the "
+                "declared-constraint surface."
+            )
+            if note not in limits:
+                limits.append(note)
+
     if path_prefix:
         data["endpoints"] = [
             e for e in data.get("endpoints", [])
@@ -14381,7 +14405,8 @@ def _cache_model_conditioning(path: Path) -> Any:
                 line += f" ({found.reference})"
             per_command[row.command] = line
         return _cmodel.Conditioning(
-            scope=scope.describe(), transfers=transfers, per_command=per_command
+            scope=scope.describe(), transfers=transfers, per_command=per_command,
+            java_files=scope.java_files,
         )
     except Exception:
         # A cost note is never worth failing a command that answers.

{sourcecode-5.4.1 → sourcecode-5.5.0}/src/sourcecode/non_coverage.py

@@ -321,6 +321,27 @@ NON_COVERAGE: tuple[NonCoverage, ...] = (
             "routes) is a measurement this command does not yet make."
         ),
     ),
+    NonCoverage(
+        id="NC-011",
+        surface="validation",
+        not_covered=(
+            "Programmatic Spring request-body validation wired with "
+            "`org.springframework.validation.Validator` or `@InitBinder`."
+        ),
+        why=(
+            "This surface reads declared bean-validation constraints recovered from "
+            "OpenAPI or DTO annotations. A validator registered in controller code "
+            "can enforce body rules without any declarative constraint on the "
+            "payload, so treating the result as fully verified would overstate what "
+            "the declared-constraint scan proves."
+        ),
+        instead=(
+            "`@InitBinder` / `setValidator(...)` wiring, or a Spring `Validator` "
+            "implementation, which this surface reports only as a coverage "
+            "boundary. `validation` still shows the declared rules; the programmatic "
+            "validator remains outside that model."
+        ),
+    ),
 )
 
 

{sourcecode-5.4.1 → sourcecode-5.5.0}/src/sourcecode/reference_facts.py

@@ -162,7 +162,7 @@ _QUALIFIED_TYPE_RE = re.compile(r"\b[A-Z][A-Za-z0-9_$]*\.[A-Z][A-Za-z0-9_$]*")
 
 def _scan_repository(
     root: Path, simple_names: "set[str]", nested: "dict[str, tuple[str, str]]"
-) -> "tuple[dict[str, str], dict[str, str]]":
+) -> "tuple[dict[str, str], dict[str, str], dict[str, str]]":
     """One walk, two questions — `(config-wired names, nested types other code names)`.
 
     Both scans need the whole tree, and walking it twice doubled the cost of the
@@ -175,6 +175,7 @@ def _scan_repository(
     """
     config_hits: dict[str, str] = {}
     nested_hits: dict[str, str] = {}
+    literal_hits: dict[str, str] = {}
     pending = set(simple_names)
     by_qualified: dict[str, list[str]] = {}
     for fqn, (qualified, _own) in nested.items():
@@ -183,7 +184,7 @@ def _scan_repository(
     scan_config = bool(pending)
     scan_java = bool(by_qualified)
     if not scan_config and not scan_java:
-        return config_hits, nested_hits
+        return config_hits, nested_hits, literal_hits
 
     scanned = 0
     for dirpath, dirnames, filenames in os.walk(root):
@@ -191,7 +192,7 @@ def _scan_repository(
         for filename in filenames:
             is_java = filename.endswith(".java")
             is_config = os.path.splitext(filename)[1].lower() in _CONFIG_REF_EXTS
-            if not ((is_java and scan_java) or (is_config and scan_config)):
+            if not ((is_java and (scan_java or scan_config)) or (is_config and scan_config)):
                 continue
             if scanned >= _SCAN_MAX_FILES:
                 break
@@ -206,6 +207,17 @@ def _scan_repository(
                     pending.discard(hit)
                     config_hits[hit] = rel
                 scan_config = bool(pending)
+            if is_java and scan_config:
+                # A `Foo.class` literal is a real static reference, and the
+                # field audit found one of these on the annotation-dispatch path.
+                class_hits = {
+                    hit for hit in pending
+                    if f"{hit}.class" in text
+                }
+                for hit in class_hits:
+                    pending.discard(hit)
+                    literal_hits[hit] = rel
+                scan_config = bool(pending)
             if is_java and scan_java:
                 for hit in set(_QUALIFIED_TYPE_RE.findall(text)) & set(by_qualified):
                     for fqn in by_qualified[hit]:
@@ -213,10 +225,10 @@ def _scan_repository(
                             nested_hits[fqn] = rel
                 scan_java = len(nested_hits) < len(nested)
             if not scan_config and not scan_java:
-                return config_hits, nested_hits
+                return config_hits, nested_hits, literal_hits
         if scanned >= _SCAN_MAX_FILES:
             break
-    return config_hits, nested_hits
+    return config_hits, nested_hits, literal_hits
 
 
 def analyze_type_references(nodes: "list[dict]", root: Path) -> ReferenceFacts:
@@ -226,7 +238,15 @@ def analyze_type_references(nodes: "list[dict]", root: Path) -> ReferenceFacts:
     examined, because a method with no callers is a different question.
     """
     root = Path(root)
-    types = [n for n in nodes or [] if n.get("type") in ("class", "interface") and n.get("fqn")]
+    def _node_kind(node: dict) -> str:
+        kind = str(node.get("symbol_kind") or node.get("kind") or node.get("type") or "")
+        if kind in ("class", "interface", "enum", "annotation", "record"):
+            return kind
+        if kind == "@interface":
+            return "annotation"
+        return str(node.get("type") or "")
+
+    types = [n for n in nodes or [] if _node_kind(n) in ("class", "interface", "enum", "annotation", "record") and n.get("fqn")]
     if not types:
         return ReferenceFacts(0, {s: 0 for s in STATUSES}, ())
 
@@ -237,7 +257,7 @@ def analyze_type_references(nodes: "list[dict]", root: Path) -> ReferenceFacts:
             entries.append(TypeReference(
                 fqn=str(node["fqn"]), status=REFERENCED,
                 basis="incoming edge in the call-graph",
-                type=str(node.get("type") or ""), role=str(node.get("role") or "other"),
+                type=_node_kind(node), role=str(node.get("role") or "other"),
             ))
         else:
             candidates.append(node)
@@ -271,22 +291,30 @@ def analyze_type_references(nodes: "list[dict]", root: Path) -> ReferenceFacts:
                 f"{parts[-2]}.{parts[-1]}",
                 str(node.get("source_file") or "").replace("\\", "/"),
             )
-    config_hits, nested_hits = _scan_repository(root, set(by_simple), nested_candidates)
+    config_hits, nested_hits, literal_hits = _scan_repository(root, set(by_simple), nested_candidates)
+    literal_refs: dict[str, str] = {}
     for simple, config_file in config_hits.items():
         for node in by_simple.get(simple, []):
             dispatch_basis[str(node["fqn"])] = f"named in {config_file}"
+    for simple, literal_file in literal_hits.items():
+        for node in by_simple.get(simple, []):
+            literal_refs[str(node["fqn"])] = literal_file
 
     for node in candidates:
         fqn = str(node["fqn"])
         common = {
             "fqn": fqn,
-            "type": str(node.get("type") or ""),
+            "type": _node_kind(node),
             "role": str(node.get("role") or "other"),
         }
-        if fqn in nested_hits:
+        if fqn in nested_hits or fqn in literal_refs:
             entries.append(TypeReference(
                 status=REFERENCED,
-                basis=f"named as a qualified nested type in {nested_hits[fqn]}",
+                basis=(
+                    f"named as a qualified nested type in {nested_hits[fqn]}"
+                    if fqn in nested_hits
+                    else f"referenced by a class literal in {literal_refs[fqn]}"
+                ),
                 **common,
             ))
         elif fqn in dispatch_basis:

{sourcecode-5.4.1 → sourcecode-5.5.0}/src/sourcecode/repository_ir.py

@@ -3778,7 +3778,11 @@ def _parse_route_http_method(ann_name: str, args_str: str) -> str:
     if explicit:
         return explicit
     m = re.search(r'method\s*=\s*(?:RequestMethod\.)?(\w+)', args_str or "")
-    return m.group(1).upper() if m else ""
+    if m:
+        return m.group(1).upper()
+    if ann_name == "@RequestMapping":
+        return "ANY"
+    return ""
 
 
 def _parse_route_extras(args_str: str) -> dict:
@@ -4959,6 +4963,7 @@ def _build_route_surface(
             "fqn": sym.symbol,
             "prefixes": prefixes,
             "own_endpoints": [],
+            "abstract": "abstract" in (sym.modifiers or []),
             "has_path_ann": "@Path" in sym.annotations or "@RequestMapping" in sym.annotations,
         }
 
@@ -5016,6 +5021,12 @@ def _build_route_surface(
                 (method, suffix, sym.symbol, sym.stable_id)
             )
 
+        # Abstract controllers contribute declarations for concrete subtype
+        # projection, but Spring does not register the abstract class itself as
+        # a handler bean.
+        if class_info.get(cls_simple, {}).get("abstract"):
+            continue
+
         # P1 FIX: extract security annotations (method-level first, class fallback)
         _cls_sym_for_sec = class_sym_by_simple.get(cls_simple)
         _sec = _route_security_from_sym(sym, _cls_sym_for_sec, custom_security)

{sourcecode-5.4.1 → sourcecode-5.5.0}/src/sourcecode/risk.py

@@ -1555,7 +1555,8 @@ def _assemble_payload(
         payload["sql_taint"] = {
             key: _taint[key]
             for key in ("schema_version", "answered", "sinks_total", "summary",
-                        "statement", "verdict_lattice", "basis")
+                        "statement", "verdict_lattice", "basis",
+                        "bounded_interpolations")
             if key in _taint
         }
     # F-AY: three of this command's six axes are Spring-shaped (access, the

{sourcecode-5.4.1 → sourcecode-5.5.0}/src/sourcecode/validation_surface.py

@@ -34,6 +34,7 @@ from pathlib import Path
 from typing import TYPE_CHECKING, Any, Optional
 
 from sourcecode.path_filters import is_test_path
+from sourcecode.non_coverage import block as non_coverage_block
 
 if TYPE_CHECKING:
     from sourcecode.context_graph import ContextGraph
@@ -471,6 +472,47 @@ def _is_body_endpoint(ep: "dict[str, Any]") -> bool:
     return method in ("POST", "PUT", "PATCH")
 
 
+def _programmatic_validation_signals(graph: "ContextGraph") -> "list[str]":
+    """Presence-only evidence for Spring Validator / InitBinder wiring.
+
+    The validation surface does not model these flows, but the command still
+    needs to say when a repo is using them so the declared-constraint summary is
+    not read as a full proof."""
+    evidence: list[str] = []
+
+    for t in graph.types():
+        if _is_excluded(t.source_file):
+            continue
+        sig = (t.signature or "")
+        if "org.springframework.validation.Validator" not in sig:
+            continue
+        if "ConstraintValidator" in sig:
+            continue
+        evidence.append(f"{t.fqn} implements org.springframework.validation.Validator")
+
+    for m in graph.symbols(kind="method"):
+        if _is_excluded(m.source_file):
+            continue
+        if m.has_annotation("InitBinder"):
+            evidence.append(f"{m.fqn} is annotated with @InitBinder")
+
+    if evidence:
+        return sorted(dict.fromkeys(evidence))
+
+    try:
+        for edge in graph.cir.call_graph:
+            target = str(edge.get("to") or edge.get("to_symbol") or "")
+            if target.endswith("setValidator"):
+                source = str(edge.get("from") or edge.get("from_symbol") or "")
+                if source:
+                    evidence.append(f"{source} calls {target}")
+                    break
+    except Exception:
+        pass
+
+    return sorted(dict.fromkeys(evidence))
+
+
 def build_validation_surface(
     root: Path,
     endpoints_data: "Optional[dict[str, Any]]" = None,
@@ -494,6 +536,7 @@ def build_validation_surface(
         graph = _build_graph(root)
 
     catalog = discover_custom_validators(root, graph)
+    programmatic_evidence = _programmatic_validation_signals(graph)
 
     out_endpoints: "list[dict[str, Any]]" = []
     gaps: "list[dict[str, Any]]" = []
@@ -579,6 +622,11 @@ def build_validation_surface(
             "gaps": len(gaps),
         },
     }
+    if programmatic_evidence:
+        result["programmatic_validation"] = {
+            "detected": True,
+            "evidence": programmatic_evidence,
+        }
     spec_path = endpoints_data.get("openapi_spec")
     if spec_path:
         result["openapi_spec"] = spec_path
@@ -661,7 +709,48 @@ def build_validation_surface(
                 "expected for such repos, not a missing-validation finding."
             )
 
+    if programmatic_evidence:
+        result["non_coverage"] = non_coverage_block("validation")
+        result["note"] = (
+            result.get("note", "")
+            + " Programmatic Spring Validator wiring was detected, which is "
+            "outside the declared-constraint surface this command models."
+        ).strip()
+        if not result.get("gaps"):
+            result["gaps"] = [
+                {
+                    "method": "",
+                    "path": "",
+                    "controller": "",
+                    "reason": "programmatic_validator_wiring_unmodeled",
+                    "basis": "programmatic_validation",
+                    "confidence": "Likely",
+                }
+            ]
+            result["summary"]["gaps"] = 1
+
     _reconcile_with_code_axis(result, graph, root)
+    if programmatic_evidence:
+        result["non_coverage"] = non_coverage_block("validation")
+        note = result.get("note", "")
+        programmatic_note = (
+            " Programmatic Spring Validator wiring was detected, which is "
+            "outside the declared-constraint surface this command models."
+        )
+        if programmatic_note.strip() not in note:
+            result["note"] = (note + programmatic_note).strip()
+        if not result.get("gaps"):
+            result["gaps"] = [
+                {
+                    "method": "",
+                    "path": "",
+                    "controller": "",
+                    "reason": "programmatic_validator_wiring_unmodeled",
+                    "basis": "programmatic_validation",
+                    "confidence": "Likely",
+                }
+            ]
+            result["summary"]["gaps"] = 1
     return result