sourcecode 5.6.1__tar.gz → 5.8.0__tar.gz

{sourcecode-5.6.1 → sourcecode-5.8.0}/CHANGELOG.md

@@ -2,6 +2,347 @@
 
 ## [Unreleased]
 
+## [5.8.0] — 2026-08-16
+
+*The field queue from the two 5.7.3 validations, closed end to end: the blast
+radius stopped losing the relation everything else is projected over, and the
+answers that were floors stopped being published as totals. One commit per row,
+A/B measured against the parent commit on each.*
+
+### Fixed
+- A type that declares parameters of its own still declares a supertype (E-34).
+  The parameter block was matched as "everything up to the next `>`", which
+  stops inside `<T, V>`; to reach the body brace the group then swallowed the
+  whole `extends …` clause. `class Generic<T, V> extends Base {` produced **no
+  edge of either kind**, and 254 of 8 182 types across the fleet (3,1 %) had no
+  supertype anywhere in the model. The block is now a balanced `<…>` span, which
+  also settles the bounded-parameter trap `class E<T extends Map<String, X>>`.
+  Measured over 25 repositories: 0 type declarations lost, 0 gained; clauses
+  recovered wherever the shape occurs (dubbo +207, alfresco +130, jenkins +104).
+- A call made through an inherited member belongs to the class that makes it
+  (E-27). Neither pass climbed the supertype chain: the field map is keyed on
+  the class that declares the field, and the intra-class scan only ever saw the
+  methods a class declares itself. Both now resolve against `supertype_closure`,
+  one authority for what is above a type, nearest declaration first — Java's own
+  rule. On BroadleafCommerce, `ask impact ExploitProtectionService .` goes from
+  **38 to 276 endpoints affected** and from **34 to 247 security declarations**;
+  `ask impact FormBuilderService .` from 3 to 7 direct callers. Fleet: +1 021
+  call-graph edges on Broadleaf, +7 210 on killbill, **+0 on mall** — the
+  correct answer for a repository whose calls are not inheritance-mediated.
+- A filter is container-wired through the chain, not the clause (E-28). The
+  classification compared a class's *immediate* supertypes against the
+  framework's published extension points, so one repository-local hop hid a
+  filter: `AdminSecurityFilter` published `low` / `1.0` / `confidence: high` /
+  "Low-risk isolated change" over the admin chain, while its base class one
+  level up published `high`. Now `high` / `risk_score: null` / `container_wired`,
+  and the evidence names the hop (`inherits X via Y`) instead of citing a clause
+  the class never wrote. `ask spring-audit .` carries 20 → 42 authentication
+  pipeline relations.
+- Two routes that share one inherited handler are two endpoints (E-30). The
+  de-duplication was already keyed on `endpoint_id`; the loss was one step
+  earlier, in walking from a caller to its own class when the route's controller
+  is a subclass. `impact-chain ExploitProtectionService` 189 → 239 affected
+  endpoints, `FormBuilderService` 186 → 236.
+- A walk that stopped short says so (E-32). `bfs_truncated` reported whether the
+  hub guard cut the depth, not whether the closure was exhausted, so a run whose
+  frontier was still 76 nodes wide published `false` beside its depth. It now
+  means "the closure was not exhausted", with `closure_complete`,
+  `depth_capped_by_guard` and `frontier_open_at_depth_limit` beside it — the two
+  ways a walk stops early have different remedies — and the explanation says it
+  in prose.
+- The owner of an anonymous member, and the `throws` clause it declares (E-33).
+  `verify-edit` answered correctly and cited the wrong evidence twice: a method
+  of an anonymous `Runnable` reported as removed from the file's named type, and
+  a removed `throws PrivilegedActionException` not reported at all. Anonymous
+  class bodies now open a scope named the way Java names it (`Outer$1`), the
+  public-surface readers skip such owners, and the `throws` clause is part of the
+  compared signature (the DR-1 precedent).
+- A bean reached from a template is declared, not silently missed (E-31).
+  **NC-012** states that a SpEL `@beanName` reference in a template is outside
+  what a call-graph projection looks at, and what answers it today. The block
+  itself was published only by `pr-impact`; `impact`, `impact-chain` and `plan`
+  publish it now.
+- A JAX-RS client is an outbound integration (E-26). `export --integrations`
+  returned 0 on a codebase that exists to speak HTTP. The JAX-RS client API and
+  RESTEasy are admitted the way every other row is — an FQN-guarded import edge
+  to a type named by a published specification, never the build coordinate.
+  keycloak-config-cli 0 → 3, seven golden repositories byte-identical.
+- A statement is not a declaration (E-35). `return unknownHelper("x");` matched
+  the method-declaration shape and minted a method that does not exist, with a
+  call edge pointing at it: 1 047 such symbols on BroadleafCommerce (4,4 % of
+  its methods), 846 on killbill. The return-type slot is the discriminator;
+  `void` is deliberately not in the rejected set. Phantoms → 0, and the method
+  population falls by exactly that count, so no real declaration is lost.
+
+### Changed
+- `impact`, `impact-chain` and `plan` publish the `blast_radius` non-coverage
+  block (E-31), and `impact` publishes `closure_complete`,
+  `depth_capped_by_guard` and `frontier_open_at_depth_limit` (E-32).
+- The symbol population grows by the anonymous types now modelled and shrinks by
+  the phantom methods no longer minted (E-33, E-35). Endpoint populations are
+  byte-identical on every repository measured.
+
+### Positioning
+- **CL-30 reversed.** The exclusion claim it froze is measurable again — the
+  reversal condition the row set was met, not argued. The field revalidation on
+  the evaluator's repository is still owed before the differential promise goes
+  into commercial material, and the row says so.
+
+## [5.7.3] — 2026-08-16
+
+*Two more rows of the same family — a population published under the wrong name,
+and source read past the point it could be read — plus one row closed by
+measurement rather than by code.*
+
+### Fixed
+- A caller that never names the target is not a direct caller (E-11). On
+  `examples`, `ask impact OrdersService` reported critical/35.5 with four direct
+  callers; three were `MicroserviceUtils` and its nested classes, which contain
+  zero occurrences of `OrdersService` — what they touch is the `Service`
+  interface it implements. The DI recovery stays (a walk that stops at the
+  interface loses every real production dependent), but the population is
+  published under its own name — `interface_mediated_callers` — and scored on
+  the indirect axis, because a class that reaches the target only if the
+  container binds this implementation is at the same conditional distance as a
+  transitive caller. Reach is untouched: endpoints, transactions, mappers and
+  cross-module figures are unchanged. Measured across 8 symbols on 7
+  repositories: 7 byte-identical, `examples/OrdersService` 4 → 1 direct callers,
+  35.5 → 31.0, endpoints still 3.
+- Source that cannot compile is named as such (E-10). spaghetti-api's
+  `BrokenSyntax.java` has two opening braces and no closing one, and the payload
+  reported a clean class and method from it with nothing anywhere saying the file
+  was broken. A `parse_structure` gap now names files whose braces do not balance
+  once comments and strings are masked, and states what is missing from the
+  model. The symbols stay — a file that fails to compile still tells us its type
+  exists — and the cost is a `str.count` per file, with the mask running only for
+  the rare candidate, so braces inside strings and comments are not false
+  positives.
+
+### Verified
+- C3-112 was open on a stale state: B4 (5.7.0) already replaced the clean-tree
+  predicate with `_can_move_a_verdict`, and `analysis.disregarded_changes`
+  already publishes the paths git printed that no axis reads. Re-measured on
+  jobrunr with an untracked `.md` present: **0.44 s**, `model_built: false`,
+  against the 3.74 s the row recorded at 5.2.0. Closed by measurement; no code
+  was changed for it.
+
+## [5.7.2] — 2026-08-16
+
+*Four rows from the open ledger, chosen for one property: each was a number or a
+verdict the product published with more confidence than it had measured. Every
+change is measured on the golden corpus, and the surfaces that were already
+right are byte-identical.*
+
+### Fixed
+- Freshness is measured, and it says which store it measured (C1-47).
+  `_cache.is_stale` was a literal `False` on the cache-hit branch, and the head
+  printed beside it was overwritten with the current sha — so the one value that
+  could contradict the claim was replaced by the claim. Three repositories
+  published root `is_stale: false` while `ask cache freshness` published STALE
+  for the same tree; both were right about different stores. `is_stale` is now
+  derived from the two heads published next to it and is `null` when either
+  could not be read; the hit branch recovers `git_head_at_generation` from the
+  cached content; and a served-from-cache answer carries the RIS fact under its
+  own name (`ris_exists`, `ris_git_head`, `ris_is_stale`) with the sentence that
+  reconciles the two when they disagree. A fresh answer publishes no RIS verdict
+  on purpose — that run rebuilds the RIS after the block is written.
+- One authority for `risk_score`, and every answer names its axes (C1-48).
+  `impact` and `impact-chain` scored the identical symbol from two
+  independently-maintained formulas — different terms, different compression
+  constants, different band edges, an exposure floor only one of them had — and
+  disagreed on the **band** for `GuidesController`/sagan (high vs medium) and
+  `ApiGatewayController`/spring-petclinic-microservices (medium vs low). Both now
+  score through `risk_model`, whose weights, knee and band floors are `impact`'s
+  own, moved unchanged. Each command publishes the axes it measured, so a
+  remaining difference can only be a difference in measurement — which the
+  payload names. Measured on six symbols: `impact` byte-identical on 6 of 6, and
+  the two commands agree on the band on 6 of 6.
+- A name that matches four classes is not an answer about one (E-8). tutorials
+  declares four unrelated `PersonService` classes; `impact-chain` merged callers
+  from two of them into one chain and scored it `critical`/25.0 with nothing in
+  the payload naming the candidates. The callers stay (each is a real caller of
+  some candidate); the figure that reads as this symbol's risk is void, with the
+  reason beside the null, the four classes in `metadata.matched_classes`, and a
+  warning that names the way to a single-symbol answer.
+- A module leaving the surface is a judgement, and it is published (E-6). Apache
+  SkyWalking roots its e2e harness at a directory named `test/`, so the
+  module-name exclusion removed three deployable `@RestController` modules and
+  `ask endpoints` published `total: 0` with `coverage.gaps` empty.
+  `test_source_excluded_detail.excluded_by_module_name_rule` now names the
+  modules and the route annotations, states that the rule judges the module
+  rather than the file, and gives both ways back; `coverage.gaps` carries the
+  entry. Admission is unchanged — the judgement is the maintainer's, the silence
+  was the defect.
+
+### Contract
+- `impact-chain` is `core` tier, so neither fix widens a published enum inside a
+  major. The shared model's fifth level, `none`, maps to `low` at this command's
+  publication boundary and travels named as `risk_model.level_shared_model`; the
+  ambiguous case uses `unknown`, which its schema already documents. Every key
+  either fix adds appears only in the case it describes, so an unambiguous,
+  unaffected answer is byte-identical. 6.0.0 removes the level shim.
+
+## [5.7.1] — 2026-08-16
+
+*Second golden-repo battery over 5.7.0 (16 repositories, from spring-petclinic's 47
+Java files to the Baeldung `tutorials` monorepo's 24 074) plus a sweep of the
+suite's own vacuous assertions. Six rows closed, one suspicion refuted with the
+measurement that contradicts it, one row left open on purpose with a strict
+`xfail` holding the property.*
+
+### Fixed
+- A JAX-RS route declares its own admission class (E-5). `route.get("source",
+  "annotation")` made `annotation` the default, so a repository with no Spring
+  MVC at all was published as if it had: neo4j 4 → **0**, killbill 282 → **0**,
+  keycloak 695 → **0**, examples 3 → **0** `spring_mvc_annotations`;
+  spring-petclinic (17) and BroadleafCommerce (268/4/1) unchanged. The one-line
+  fix at the phase-2 construction site was not enough — the phase-3 inheritance
+  projection builds its own route dict and is not Spring-only, so the family is
+  read from the declaring symbol's annotations.
+- A bean annotation is resolved, not merely spelled (E-12). `_BEAN_ANNOTATIONS`
+  matched **simple names**, which is the vendor-agnostic rule inverted: neo4j's
+  34 beans were all its own `org.neo4j.annotations.service.Service` (0
+  occurrences of `org.springframework` in the tree) and carried
+  `spring_detected: true`. The annotation is now resolved against the `imports`
+  edges the graph already holds; nothing unresolved is left without a verdict.
+  neo4j 34 → **0** Spring beans, `spring_detected` true → false; sa-token's 35
+  beans were Solon's and jobrunr's 1 was Micronaut's. Controls unchanged
+  (petclinic 12, dubbo 133/133, mall 158/158, spring-boot-admin 199/199).
+- A field belongs to its class, and the edge says so (E-13). `_enclosing_class`
+  split on `#` only, so a field — spelled `Type.member` — was handed back
+  unchanged and its `contained_in` edge dropped: **0 of 14** fields on
+  spring-petclinic, **0 of 821** on mall, **0 of 1 086** on neo4j, **0 of 2 188**
+  on keycloak. The consequence was a silent gate: `ask verify`, the `core`-tier
+  CI gate, returned `pass` on repositories that violated their own declared
+  contract.
+- One authority for member → owner resolution (E-15). E-13's patch was at one
+  emission site and a second consumer with the same root made that the wrong
+  shape: no repository had ever published a `field_type`. `_owner_type_of(symbol,
+  kind)` is now the single resolution; spring-petclinic gains `field_type: 6,
+  field_type_arg: 3` and sagan `field_type: 22, field_type_arg: 10`, with the
+  other three contexts byte-identical — recovered, not double-counted.
+- A method's own declaration is not a security call site (E-7). The programmatic
+  policy regex matched the shape of a call and equally the shape of the method
+  that declares one, so sa-token's `AtCheckController` published every handler as
+  `programmatic` — including `ignore()`, annotated `@SaIgnore`, the explicit
+  opposite. Across all 23 golden repositories **22 of 23** policy censuses are
+  byte-identical; sa-token is the only mover.
+- The answer is the end of the work, and the wait to get there is visible
+  (C3-125, C3-126). A cold `ask <repo> --compact` on a 24 074-file repository
+  took **305 s**, roughly two thirds of it *after* the complete JSON had been
+  written: the L1 cache write renders the compact, agent and standard views a
+  second time, and each of them re-derived the spring-profiles block — five
+  derivations of one pure function, ~50 s apiece, 57 % of the sampled stacks.
+  Two costs inside it are gone: the per-profile file matcher built three
+  `pathlib.Path` objects per (profile, file) pair — 4,2 million of them against
+  a 24 000-file live heap — and now derives the stems once from the file list
+  under the same matching rule; and the block is memoized per snapshot, handing
+  back a copy so no caller can edit the next caller's answer. `agent_view`'s
+  event signal also stopped building its own CIR and asks
+  `context_cache.shared_cir`, the one door. Same repository, same
+  17 426-byte answer: **102 s** wall, 78 s CPU (2,98× / 3,54×). The post-answer
+  build now runs under a spinner reading *building cache entry (the answer above
+  is complete)*, so a caller that waits on process exit can tell "still working"
+  from "done, stuck" — the reason the field report read the silent tail as a
+  hang and killed it at 180 s. `ask cache warm` inherits the fix (131 s on the
+  same repository, warm `ask` at 2,2 s afterwards) and no longer captures the
+  child's stdout: it reads the exit code and, on failure, stderr, so a
+  repository-sized payload is no longer buffered in order to be dropped.
+
+### Changed
+- An assertion must be able to fail (E-13 residue, E-14). A sweep of the suite's
+  vacuous assertions: a test named `test_field_has_contained_in_edge` existed for
+  exactly the property E-13 broke and asserted nothing, and another ended in
+  `assert ... or True`. Both now assert; the Python re-export chain limit E-14
+  names is held by `xfail(strict=True)`, so the day it is fixed the suite turns
+  red rather than letting the fix land unnoticed.
+
+### Known
+- E-14 stays open by decision: a 3-level Python re-export chain resolves through
+  a documented 2-level limit and reports no limitation. Tracked by the strict
+  `xfail` above. Python import resolution is not the Java/Spring core this
+  product is bought for, and no headline field is built on it.
+
+## [5.7.0] — 2026-08-14
+
+*Field-defect battery over the ASK 5.5.6 and 5.6.1 audits: seven rows re-measured
+on the local corpus (spring-petclinic 47, open-banking-gateway 1 126,
+BroadleafCommerce 2 985, keycloak 7 885, neo4j 8 830 Java files), four of them
+closed here, two refuted with the measurement that contradicts them.*
+
+### Fixed
+- Every view declares what it cut, and none of them drops its own identity
+  (B14). `--compact` capped `key_dependencies` at 50, `env_map` and `code_notes`
+  at 15 and production entry points at 5 while publishing none of it — on
+  BroadleafCommerce that hid 40 dependencies, 144 environment variables and 64
+  code notes behind lists that read as complete. Each cap now publishes
+  `total`/`shown`/`omitted` and the registered statement of what a display cap
+  changes, in the same shape the rest of the product uses; a cap that did not
+  bite claims nothing. The root analysis also carries the response envelope it
+  never had in any view (`command`, `tool_version`, `run_id`, tree state, and
+  the analysed path rather than the working directory), and `--agent` keeps
+  `schema_version`.
+- `spring-audit` publishes the test-source exclusion its answer was measured
+  over, and `--include-tests` reaches the other population (ASK-08). The command
+  fell from 3 SEC-003 findings to 0 when 131 sources were classified
+  `test-source`, and neither the count nor the flag was anywhere in the payload
+  or the help. `metadata.test_source_excluded(_detail)` now carries the count,
+  the matched patterns, a sample and the basis, in the same shape `endpoints`
+  publishes, filled by the file walk that made the exclusion rather than by a
+  second classification. Measured: keycloak reports 2 258 excluded sources;
+  BroadleafCommerce goes from 20 to 26 findings with `--include-tests`.
+- `verify-edit` no longer rebuilds a repository-wide model when the only
+  differences from HEAD are files no axis reads (B4). A README, a build log or
+  this tool's own `.sourcecode-cache/` used to defeat the clean-tree short
+  circuit: measured on keycloak (7 885 Java files), `verify-edit .` took 32,5 s
+  to answer `changed_files: []`, `verdict: pass`. It now answers in 0,58 s with
+  `model_built: false`, and publishes `disregarded_changes` — the paths that do
+  differ and why none of them can move a verdict. An unrecognised extension is
+  never disregarded, and `.ask/` stays analysed because the custom-rule axis
+  reads `verify-rules.json` there.
+- One output-size policy for every command that prints a payload (ASK-03). The
+  ~50K estimated-token ceiling used to exist on `migrate-check` and `repo-ir`
+  only, so the same size was refused by one command and printed in silence by
+  another — `endpoints` on a 7 885-file repository emitted 353 112 B (~88K
+  tokens) with `exit=0`. The guard now runs at the single output seam, with the
+  same `OUTPUT_TOO_LARGE` code, the same `expected`, and escapes derived from
+  the running command's own options, so a hint never proposes a flag the caller
+  already passed. `--max-output-tokens N` and `ASK_MAX_OUTPUT_TOKENS` move the
+  ceiling for every command at once; `0` prints the payload whatever its size;
+  `--output FILE` and `--force` are unchanged.
+- The parse cache now describes the eviction it performs (ASK-05). `cache
+  status`, `cache model` and `docs/CACHE.md` said "least-recently-used, enforced
+  on write" and "the next write evicts" while the field watched the store grow
+  25 MB past its 512 MB budget. The sweep is periodic — once per 32 MB written,
+  per process — so the policy line names that interval, `sweep_interval_mb` is
+  published, and an over-budget store carries a note bounding the overshoot and
+  naming `ask cache clear --global`.
+- `cache warm` states what a warm buys **before** the cost is paid, and reads
+  the commands it buys nothing for from `cache model` instead of a
+  hand-written sentence (ASK-07). The old sentence named `endpoints` as gaining
+  nothing while the model measures it at 3,3 s → 1,4 s, which is how a field
+  battery timed the two commands a warm does not help and concluded a warm does
+  not amortize below ~1 500 Java files. No size threshold is published: measured
+  here, the root view goes 2,5 s → 0,3 s at 47 files and 15,4 s → 0,3 s at
+  2 985.
+- `migrate-check --compact` bounds the sections that scale with modules rather
+  than with findings (ASK-01b): `evidence_manifest.claims`/`sources`,
+  `java_lts_inventory.evidence` and `hibernate.module_exposure_map`, each with
+  the `*_cap` contract the other collections already publish. `--top-n N` now
+  reaches the compact answer instead of only the `--table` rendering, so a
+  caller refused by the output ceiling can ask for a smaller answer. On keycloak
+  the compact report goes 80 094 B → 36 190 B, and 26 665 B with `--top-n 1`;
+  the full report is unchanged.
+
+## [5.6.1] — 2026-08-13
+
+### Fixed
+- `endpoints` publishes `coverage`, `functional_routing`, `warnings` and
+  `zero_result_reason`, so an empty or partial HTTP surface names the routing
+  style it could not model instead of reading as "no public API".
+- Duplicate Spring audit serialization removed; `cache status` reports parse
+  store overage.
+
 ## [5.6.0] — 2026-08-13
 
 ### Legal And Provenance

{sourcecode-5.6.1 → sourcecode-5.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.6.1
+Version: 5.8.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -47,10 +47,10 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.6.1-blue)
+![Version](https://img.shields.io/badge/version-5.8.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
-Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.6.1 and
+Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
 later are proprietary; see [LICENSE](LICENSE) and [NOTICE](NOTICE). Releases up
 to and including 5.5.6 remain governed by their published Apache-2.0 terms.
 
@@ -135,7 +135,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.6.1 — and, on a build that has aged,
+ask version                    # ask 5.8.0 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -487,6 +487,13 @@ And one about blast radius:
 | Not covered | Why | What answers it |
 |---|---|---|
 | **The reach of a component the container invokes rather than the code — a security filter chain, an around-advice aspect, a `@ControllerAdvice`, a bean resolved through the interface it implements.** | Blast radius here is projected over the call graph: who calls the changed symbol, and which routes reach those callers. Nothing in the repository calls a container-wired component, so its measured call-graph fan-in is ~0 and every figure derived from it — affected endpoints, direct callers, rollback surface — reads as no impact. The fan-in figure is correct; using it as a risk proxy on this population is not. Publishing that as a low verdict would be a confident zero, which is the one thing this product does not do. | Such a change is flagged in `analysis_warnings` and its verdict is floored, never rated on fan-in. The reach itself is measured elsewhere and was there all along: `ask endpoints` resolves a gate annotation to the routes carrying it, `ask explain <class>` prints the request chain a configuration declares with its source line, and `ask posture --profile <set>` states what each profile leaves open. Projecting those into the blast radius (pointcut → routes, matcher → routes) is a measurement this command does not yet make. |
+| **A bean reached from a template rather than from code — a Thymeleaf or JSP expression that resolves a bean by name (`${@blExploitProtectionService.getCsrfTokenParameter()}`) and invokes a method on it.** | Every reacher this blast radius models is a typed edge or a structural fact recovered from Java: a call, an injection, a container extension point, a string literal inside a reflective lookup. A template is none of those — it is not compiled against the bean, and the reference lives in a file this analysis does not parse. So a component invoked only from a template has a measured fan-in of ~0 and, unlike every other blind spot here, that silence was published without a label: the field found `blind_spots: []` on a service two templates call by name. The miss is ordinary; presenting it as an empty result is the defect (E-31). | A SpEL bean reference in a template is fixed, published syntax (`@beanName` inside `${...}`), so a text search for the bean's name across `.html`/`.jsp` answers it today: `grep -rn '@<beanName>' src/main/resources`. Admitting it as a fourth reacher would be evidence-shaped for the same reason — the reference is a literal naming a bean this repository declares — and it is not modelled yet, which is what this row states rather than implies. |
+
+And one about request-body validation:
+
+| Not covered | Why | What answers it |
+|---|---|---|
+| **Programmatic Spring request-body validation wired with `org.springframework.validation.Validator` or `@InitBinder`.** | This surface reads declared bean-validation constraints recovered from OpenAPI or DTO annotations. A validator registered in controller code can enforce body rules without any declarative constraint on the payload, so treating the result as fully verified would overstate what the declared-constraint scan proves. | `@InitBinder` / `setValidator(...)` wiring, or a Spring `Validator` implementation, which this surface reports only as a coverage boundary. `validation` still shows the declared rules; the programmatic validator remains outside that model. |
 
 The one row above with a remedy in this build: `ask endpoints /path/to/repo --servlets`
 lists the servlet-mounted HTTP surface as a population of its own — `web.xml` mappings and

{sourcecode-5.6.1 → sourcecode-5.8.0}/README.md

@@ -4,10 +4,10 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.6.1-blue)
+![Version](https://img.shields.io/badge/version-5.8.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
-Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.6.1 and
+Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
 later are proprietary; see [LICENSE](LICENSE) and [NOTICE](NOTICE). Releases up
 to and including 5.5.6 remain governed by their published Apache-2.0 terms.
 
@@ -92,7 +92,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.6.1 — and, on a build that has aged,
+ask version                    # ask 5.8.0 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -444,6 +444,13 @@ And one about blast radius:
 | Not covered | Why | What answers it |
 |---|---|---|
 | **The reach of a component the container invokes rather than the code — a security filter chain, an around-advice aspect, a `@ControllerAdvice`, a bean resolved through the interface it implements.** | Blast radius here is projected over the call graph: who calls the changed symbol, and which routes reach those callers. Nothing in the repository calls a container-wired component, so its measured call-graph fan-in is ~0 and every figure derived from it — affected endpoints, direct callers, rollback surface — reads as no impact. The fan-in figure is correct; using it as a risk proxy on this population is not. Publishing that as a low verdict would be a confident zero, which is the one thing this product does not do. | Such a change is flagged in `analysis_warnings` and its verdict is floored, never rated on fan-in. The reach itself is measured elsewhere and was there all along: `ask endpoints` resolves a gate annotation to the routes carrying it, `ask explain <class>` prints the request chain a configuration declares with its source line, and `ask posture --profile <set>` states what each profile leaves open. Projecting those into the blast radius (pointcut → routes, matcher → routes) is a measurement this command does not yet make. |
+| **A bean reached from a template rather than from code — a Thymeleaf or JSP expression that resolves a bean by name (`${@blExploitProtectionService.getCsrfTokenParameter()}`) and invokes a method on it.** | Every reacher this blast radius models is a typed edge or a structural fact recovered from Java: a call, an injection, a container extension point, a string literal inside a reflective lookup. A template is none of those — it is not compiled against the bean, and the reference lives in a file this analysis does not parse. So a component invoked only from a template has a measured fan-in of ~0 and, unlike every other blind spot here, that silence was published without a label: the field found `blind_spots: []` on a service two templates call by name. The miss is ordinary; presenting it as an empty result is the defect (E-31). | A SpEL bean reference in a template is fixed, published syntax (`@beanName` inside `${...}`), so a text search for the bean's name across `.html`/`.jsp` answers it today: `grep -rn '@<beanName>' src/main/resources`. Admitting it as a fourth reacher would be evidence-shaped for the same reason — the reference is a literal naming a bean this repository declares — and it is not modelled yet, which is what this row states rather than implies. |
+
+And one about request-body validation:
+
+| Not covered | Why | What answers it |
+|---|---|---|
+| **Programmatic Spring request-body validation wired with `org.springframework.validation.Validator` or `@InitBinder`.** | This surface reads declared bean-validation constraints recovered from OpenAPI or DTO annotations. A validator registered in controller code can enforce body rules without any declarative constraint on the payload, so treating the result as fully verified would overstate what the declared-constraint scan proves. | `@InitBinder` / `setValidator(...)` wiring, or a Spring `Validator` implementation, which this surface reports only as a coverage boundary. `validation` still shows the declared rules; the programmatic validator remains outside that model. |
 
 The one row above with a remedy in this build: `ask endpoints /path/to/repo --servlets`
 lists the servlet-mounted HTTP surface as a population of its own — `web.xml` mappings and

{sourcecode-5.6.1 → sourcecode-5.8.0}/docs/CACHE.md

@@ -59,7 +59,7 @@ the enclosing monorepo, and `cache status` / `cache clear` resolve to that same
 | `ris` | the Repository Intelligence Snapshot — structural index, endpoint index, summaries | tree state (the snapshot records the tree it describes) | rebuilt on every warm |
 | `cir` | the shared Canonical IR — the Java parse every knowledge command reuses | tree state · analyzer fingerprint · schema version | built |
 | `task` | one `prepare-context` task answer, per task and per option set | tree state · task · --symptom / --all / --include-config / --format | never — a warm does not run any task |
-| `parse` | the symbol extraction of one file, keyed by its bytes | the file's own bytes and the extractor's source — content-addressed, so it is never stale and never needs invalidating. Bounded by `ASK_PARSE_CACHE_MAX_MB` (default 512 MB, least-recently-used, enforced on write) and reported in `cache status` (F-AR) | filled for every Java file the warm parses |
+| `parse` | the symbol extraction of one file, keyed by its bytes | the file's own bytes and the extractor's source — content-addressed, so it is never stale and never needs invalidating. Bounded by `ASK_PARSE_CACHE_MAX_MB` (default 512 MB, least-recently-used, swept every 32 MB written rather than on every write, so the size can sit one sweep interval per running process above the budget) and reported in `cache status` (F-AR) | filled for every Java file the warm parses |
 
 Measured on BroadleafCommerce (2 000+ Java files, dirty tree), warm machine, 3.2.2, each command in isolation.