sourcecode 5.8.10__py3-none-any.whl → 5.8.12__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.10"
+__version__ = "5.8.12"

sourcecode/_docs/DEFECT-LEDGER.md

@@ -16,20 +16,56 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
-**As of 2026-08-19, the `5.8.10` release commit:** this is the current status of
-the 5.8.9 re-audit queue. The audit observations below remain historical evidence;
-only the table here declares present state.
+**As of 2026-08-19, the external `5.8.11` re-audit:** this is the current status of
+the 5.8.8/5.8.9 audit queue. The subject remained `saint-server` at `3dde0376`, with a
+byte-identical CIR and the same 53/61 invocables exercised. The score is **78/100**
+(75 in 5.8.8, 80 in 5.8.9). The observations below remain historical evidence; only
+this table declares present state.
 
 | Rows | Current status | Evidence |
 |---|---|---|
-| `AUD-588-B01`, `AUD-589-B01`, `C3-122` | **closed** | `20596c8`; failed writes cannot suppress the global output-promise guard, covering both `risk` and `audit-report` emit paths. |
-| `AUD-588-B03` | **closed** | `16a52cc`; `SEC-009`, static `@Profile` evidence and `permit_all_rules` are emitted with regressions. |
-| `AUD-588-B04` | **closed** | `fd34eb1`; `data-exposure` preserves the chain decision for every route. |
+| `AUD-588-B01`, `AUD-589-B01`, `C3-122` | **implemented in 5.8.12** | `9884488` requires `risk` and `audit-report` to deliver stdout or their requested artifact before exit 0; the remaining closure evidence is a field-scale subprocess reproduction. |
+| `AUD-511-R01` / `AUD-588-B03` | **implemented in 5.8.12** | `13362ec` makes SEC-009 read comment-blanked Java, so a Javadoc profile cannot override the live `@Profile("!m3")` declaration. |
+| `AUD-588-B04` | **retracted audit premise** | `data-exposure` correctly preserves `chain_decision`; the reported `coverage_unknown` routes were custom-gate annotations whose application was not configured. `fd34eb1` remains a valid additive disclosure, but no further B04 fix is due. |
 | `AUD-588-B05` | **closed** | `c15f5b6`; changed container-wired components block a false `unaffected` disposition. |
-| `AUD-588-B07` | **closed** | `5cc6ba7`; ASK-09 reads the envelope error contract and covers the wrapped shape. |
+| `AUD-511-R03` / `AUD-588-B07` | **implemented in 5.8.12** | `47aee1e` gives the published `OUTPUT_TOO_LARGE` envelope precedence over an inconsistent process status and preserves the excerpt in every branch. |
 | `AUD-588-B08` | **closed** | `c084555`; `impact` publishes its independent stdout-byte budget. |
-| `AUD-588-B11` (container/units subset) | **closed** | `ca72b61`, `a49cf6a`; plan/compare publish container wiring and impact-chain names security-surface units. |
-| `AUD-588-B02`, `B06`, B11 residuals, `B12` | **open** | Require provider non-coverage verification, remaining contract parity and controlled cost calibration; no closure is inferred from the release. |
+| `AUD-588-B11` (container/units subset) | **partially implemented in 5.8.12** | `d745d31` discovers nested Maven modules; `273ae8e` suppresses unsupported `pr-impact.unaffected_basis`. `impact` naming, source population units, risk tiers and plan narrative remain open. |
+| `AUD-511-R02` / `AUD-589-B02` | **partially mitigated in 5.8.12, still under investigation** | `b93f230` reuses one `SpringSemanticModel` across every declared `data-exposure` seed; `473f47a` routes `validation` through the shared CIR cache, and `91bd0c0` retains subcommand `--no-cache` compatibility. On the local BroadleafCommerce corpus at the final analyzer fingerprint, a first shared-CIR fill took 10.46 s and its warm `validation --compact` hit took 4.01 s with byte-identical output. This is a same-host cache-state observation, not the 5.8.9/5.8.11 external A/B: the six-run C3-120 comparison and the configured `saint-server` reproduction remain required. |
+| `AUD-588-B02`, `B06`, B11 residuals, `B12` | **partially open in 5.8.12** | `3869c87` excludes explicit EclipseLink from Hibernate applicability and effort; `037223e` publishes provider non-coverage. B11 parity and controlled cost calibration remain required. |
+
+### Re-audit Intake: 5.8.11
+
+The third external pass uses the same `saint-server` snapshot (`3dde0376`), read-only
+protocol and warm-cache preparation as 5.8.8 and 5.8.9. The CIR hash is identical across
+all three versions. It exercises 53/61 invocables (87%) and reports 78/100. That makes
+rule, output and execution changes attributable without claiming that the application was
+run or that the eight blocked invocables were covered.
+
+| ID | Priority | Finding | Required correction / verification |
+|---|---|---|---|
+| `AUD-588-B01`, `AUD-589-B01`, `C3-122` | P0 | `risk -o` can exit 0 with no file; `risk` and `audit-report` can finish with empty stdout. The failure has fast and slow composition paths. | Add a real-subprocess invariant: exit 0 must produce parseable stdout or the requested artifact. Exercise `risk` and `audit-report` with and without `-o`, plus budget-cut partial output. |
+| `AUD-511-R01` | P1 regression | SEC-009 takes `@Profile` from comments and reports an active `@Profile("!m3")` request chain as inactive. | Reuse comment-blanked source and declaration-local profile evidence, or consume posture's authority. Regress a misleading javadoc and both positive/negative profile forms. |
+| `AUD-511-R02` / `AUD-589-B02` | P1 investigation | `endpoints`, `impact`, `spring-audit`, `modernize`, `validation` and `timeline` measure 1.4-2.4x slower than 5.8.9; `data-exposure --config` remains high. | **Partial implementation:** `b93f230` shares the data-exposure semantic model across seeds and `473f47a` makes `validation` reuse the shared CIR; `91bd0c0` confirms `--no-cache` remains a compatibility no-op. Re-run the idle-host, isolated-cache, interleaved-control protocol against the audited `saint-server` configuration before attributing or closing the field regression. |
+| `AUD-511-R03`, `AUD-588-B07` | P1 regression | ASK-09 reports `not_applicable` even though its literal probe emits `OUTPUT_TOO_LARGE` 12x above the ceiling. | Derive branch selection exclusively from the output envelope. Publish `observed_payload_excerpt` for pass, fail, error and not-applicable rows. |
+| `AUD-588-B02` + `B06` | P1 | The EclipseLink repository still receives Hibernate readiness, rewrite-zone classification and 32.9-66.2 person-days; `non_coverage` is null. | A declared competing provider must remove the Hibernate axis from readiness, effort and classification and add provider non-coverage. EclipseLink automation remains out of scope. |
+| `AUD-588-B11` residual | P2 | `impact.matched_fqns` mixes exact resolution with 235 implementations; `migrate-recipe` misses nested Maven manifests; source-file populations lack units; `risk` tier labels diverge; plan/pr-impact prose trails their new container facts. | Bind consumers to established authorities, name populations and units, and add cross-command parity tests. Do not add parallel detection. |
+| `AUD-588-B12` | P2 | 5.1.0 anchors disagree in both directions with 5.8.11 measurements; `timeline` is advertised as foreground despite a 404s sample. | Recalibrate only after controlled measurements and align foreground advice with the explicit opt-in progress policy. |
+
+### Feature Recommendations: 5.8.11
+
+| ID | Recommendation | Current decision |
+|---|---|---|
+| `AUD-588-F01` | EclipseLink/JPA-provider migration axis. | **Deferred product feature.** First close B02/B06 so the current Hibernate answer is honest about non-coverage. |
+| `AUD-588-F02` | Shared answer-contract authority for profiles, units, populations, caveats and container reach. | **Partial.** The SEC-009 regression and B11 residuals show that new consumers are still re-deriving facts. |
+| `AUD-588-F03` | Versioned cost model by repository size and cache state. | **Partial.** Existing dimensions do not make stale 5.1.0 anchors operationally safe; controlled remeasurement is prerequisite. |
+| `AUD-588-F04` | Default foreground heartbeat without corrupting machine output. | **Explicit opt-in by decision.** Until revised, cost advice must not imply that long commands emit progress by default. |
+| `AUD-588-F05` | Raise audit coverage through safe operational paths and dirty-tree `verify-edit`. | **Locally verified only.** The external run remains 53/61; treat dirty-tree behavior as a validation gap, not a closed product claim. |
+
+**Recommended order:** composition-output invariant → SEC-009 profile regression → controlled
+performance measurement → EclipseLink applicability/non-coverage → ASK-09 → B11 narrative
+and parity residuals → cost-model calibration. Keep B04 closed as a retracted premise, and
+do not implement EclipseLink migration automation as part of this bug battery.
 
 **As of 2026-08-19, the `5.8.9` release commit:** the latest audit queue was implemented in
 committed post-5.8.7 fixes. This table is

sourcecode/_docs/USER_GUIDE.md

@@ -39,10 +39,12 @@ Evidence            — every answer is backed by auditable evidence, not a gues
 CLI commands        — impact, endpoints, spring-audit, explain, … each a projection
 ```
 
-The key idea: **the source is parsed once** into the Semantic IR; everything above that is
-computed from the IR, cached, and shared. `impact`, `endpoints`, and `spring-audit` are not
-three analyzers — they are three questions asked of the same graph. (The extraction and
-consumption contract is fixed in the architecture ADRs 0001–0004 under `docs/architecture/`.)
+The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
+where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
+warm buys for each command rather than implying that every projection costs the same. In
+5.8.12, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+model across all declared label seeds. (The extraction and consumption contract is fixed in
+the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 ---
 
@@ -136,7 +138,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.10
+# ask 5.8.12
 ```
 
 Requires Python 3.9+.
@@ -1482,10 +1484,12 @@ the tree. Set `ASK_RUNS_IN_REPO=1` only when `.ask/runs` belongs in that
 repository's own artefacts, or `ASK_RUNS_DIR=/path/to/runs` to choose an external
 location explicitly.
 
-**Large-repo budgets.** Set `ASK_MAX_ANALYSIS_SECONDS=<seconds>` to bound a
-repo-wide or deep command. The budget is **honoured, not vetoed**: if the value
-is below the class floor ASK says so on stderr and runs anyway, and a run that
-spends its budget publishes what it measured with
+**Large-repo budgets.** Set `ASK_MAX_ANALYSIS_SECONDS=<seconds>` to bound the
+phase-runner commands `spring-audit`, `risk` and `audit-report`. It is not a
+process-wide timeout for every repo-wide or deep command. The budget is
+**honoured, not vetoed**: if the value is below the class floor ASK says so on
+stderr and runs anyway, and a run that spends its budget publishes what it
+measured with
 
 ```json
 "_partial": {"partial": true,
@@ -1505,7 +1509,9 @@ inventories `rules_run` / `rules_not_run` with `rules_run_count` and
 stops at 1 408 files inside the `SEC-004` group and ends at 5.1s.
 
 Every count in such an answer is a floor over what ran — a family or phase that
-never ran is named, never reported as an absence of findings. The mark lives
+never ran is named, never reported as an absence of findings. Commands outside
+that phase-runner set are not bounded by this variable and must not be CI-gated
+on it. The mark lives
 where the numbers are as well as at the root: `summary.partial`,
 `summary.counts_are_floor` and `summary.counts_basis`, with
 `confidence_level` capped at `low` and `confidence_basis` saying the cut is the

sourcecode/audit_recipe.py

@@ -127,6 +127,11 @@ MANUAL_BASIS: "dict[str, str]" = {
         "clause) and an injection sink for a value, and an executor cannot tell "
         "them apart without the caller's intent"
     ),
+    "SEC-009": (
+        "whether an anonymous request matcher is intentional depends on the "
+        "deployment profile and authorization policy, so removing it would be "
+        "an unreviewed behaviour change rather than a safe rewrite"
+    ),
     "DEAD-001": (
         "a disabled security control is a decision somebody made; re-enabling it "
         "changes runtime behaviour nobody has measured here"

sourcecode/cache_model.py

@@ -653,9 +653,9 @@ def cost_sentence() -> str:
         f"files, and a repository-wide audit measured {seconds:g} s on a "
         f"{_thousands(FIELD_ANCHOR_JAVA_FILES)}-file repository "
         f"({FIELD_ANCHOR_MEASURED_VERSION}{stale}).{gate} `ask cache model` prints "
-        f"the figure and the build behind it for every command; "
-        f"ASK_MAX_ANALYSIS_SECONDS/ASK_PROGRESS bound and narrate a run where CI "
-        f"wants an explicit budget."
+        f"the figure and the build behind it for every command; ASK_PROGRESS "
+        f"narrates supervised work, while ASK_MAX_ANALYSIS_SECONDS bounds only "
+        f"the phase-runner commands (spring-audit, risk and audit-report)."
     )
 
 

sourcecode/cli.py

@@ -572,7 +572,8 @@ def _build_help_text(scope: "Optional[Any]" = None) -> str:
 
 Deterministic Java/Spring semantics and reusable structural context for AI coding agents.
 
-Cache warms on first scan; later calls reuse pre-built context instead of rescanning.
+Content-addressed parse and context caches reuse prior knowledge where a command's
+scope matches; `ask cache model` says exactly what a warm buys per command.
 {_cost_sentence()}
 
 {_start_here_block(scope)}
@@ -584,6 +585,12 @@ Cache warms on first scan; later calls reuse pre-built context instead of rescan
   ask --compact --git-context  [dim]# + git hotspots and uncommitted files[/dim]
   ask --agent                  [dim]# full structured JSON for AI agents[/dim]
 
+[bold]Performance / CI:[/bold]
+  validation . --compact       [dim]# reuses the shared CIR on a warm matching scope[/dim]
+  data-exposure .              [dim]# one semantic model is shared across declared label seeds[/dim]
+  ASK_MAX_ANALYSIS_SECONDS=N   [dim]# deadline only for spring-audit, risk, audit-report[/dim]
+  [dim]Other commands are not time-bounded by this variable; use `--progress` or `--detach` where offered.[/dim]
+
 [bold]Change and risk:[/bold]
   impact-chain <Class> .       [dim]# blast radius; TX/SEC findings opt-in[/dim]
   impact <Class> .             [dim]# reverse deps → endpoints reached[/dim]
@@ -1954,6 +1961,7 @@ def _output_ceiling_error(content: str, *, to_file: bool) -> "Optional[dict[str,
 #: that cannot produce the file it was asked for must not be able to say it did.
 _OUTPUT_PROMISED: "Optional[str]" = None
 _OUTPUT_DELIVERED: bool = False
+_ANSWER_REQUIRED_BY: "Optional[str]" = None
 
 
 def _record_output_promise(argv: "list[str]") -> None:
@@ -1966,9 +1974,10 @@ def _record_output_promise(argv: "list[str]") -> None:
     parser owns that. It is used only to ask, at the end, whether a file the run
     promised exists.
     """
-    global _OUTPUT_PROMISED, _OUTPUT_DELIVERED
+    global _OUTPUT_PROMISED, _OUTPUT_DELIVERED, _ANSWER_REQUIRED_BY
     _OUTPUT_PROMISED = None
     _OUTPUT_DELIVERED = False
+    _ANSWER_REQUIRED_BY = None
     for i, token in enumerate(argv):
         value: "Optional[str]" = None
         if token in ("--output", "-o"):
@@ -1987,6 +1996,36 @@ def _mark_output_delivered() -> None:
     _OUTPUT_DELIVERED = True
 
 
+def _require_answer_delivery(command: str) -> None:
+    """Require a composed-report command to publish an answer before exit 0.
+
+    A file promise catches only ``-o``. Risk composition also has a stdout
+    contract: a successful invocation must leave one parseable document behind.
+    Keeping that obligation opt-in avoids changing intentionally quiet commands
+    while covering both expensive composition surfaces.
+    """
+    global _ANSWER_REQUIRED_BY
+    _ANSWER_REQUIRED_BY = command
+
+
+def _fail_on_missing_required_answer(exit_code: object) -> None:
+    """Turn a silent successful composed run into a typed failure (C3-122)."""
+    if exit_code not in (0, None) or _OUTPUT_DELIVERED or not _ANSWER_REQUIRED_BY:
+        return
+    _emit_error_json(
+        EXECUTION_FAILED_CODE,
+        f"{_ANSWER_REQUIRED_BY} finished without publishing an answer.",
+        hint=(
+            "The command returned successfully before its output was delivered. "
+            "Re-run with progress enabled and report the invocation; a composed "
+            "report must produce parseable stdout or its requested file."
+        ),
+        command=_ANSWER_REQUIRED_BY,
+        expected="parseable stdout or the requested output artifact",
+    )
+    raise SystemExit(1)
+
+
 def _fail_on_unkept_output_promise(exit_code: object) -> None:
     """Refuse to report success for an answer that was never produced (C3-122).
 
@@ -7946,11 +7985,22 @@ def validation_cmd(
     target = _admit_path(path)
 
     from sourcecode.context_graph import ContextGraph
+    from sourcecode.repository_ir import find_java_files
     from sourcecode.validation_surface import build_validation_surface
     _prog = Progress()
     _prog.start("mapping validation surface")
-    # Structural facts come from the ContextGraph — the single access layer.
-    _graph = ContextGraph.build_from_root(target)
+    # Structural facts still come from the ContextGraph — the single access
+    # layer — but its CIR now follows the shared knowledge-cache door used by
+    # the other repository-wide commands. A validation run therefore does not
+    # parse the same tree again after `cache warm`, `impact`, or `explain`.
+    # `--no-cache` remains the published no-op for subcommands; the direct build
+    # is strictly the best-effort fallback if the shared layer cannot answer.
+    try:
+        from sourcecode.context_cache import shared_cir
+
+        _graph = ContextGraph.from_cir(shared_cir(target, find_java_files(target)))
+    except Exception:
+        _graph = ContextGraph.build_from_root(target)
     data = build_validation_surface(target, graph=_graph)
 
     # P1-C: classify the request-body validation *pattern* so a repo with a
@@ -10666,6 +10716,7 @@ def risk_cmd(
       ask risk . --table --rule SEC-008 --band high --top-n 20
       ask risk . --limit 10 -o risk.json
     """
+    _require_answer_delivery("risk")
     _apply_jobs(jobs)
     from sourcecode.risk import build_risk
 
@@ -11023,6 +11074,7 @@ def audit_report_cmd(
       ask audit-report . --profile prod --format markdown
       ask audit-report . --sign-key audit.key -o audit-report.json
     """
+    _require_answer_delivery("audit-report")
     from sourcecode.audit_report import build_audit_report, render_markdown
 
     path = _admit_path(path)
@@ -16406,8 +16458,10 @@ def main_entry() -> None:
     try:
         # prog_name pins usage/help to the canonical `ask`, whatever the alias.
         app(prog_name="ask")
+        _fail_on_missing_required_answer(0)
         _fail_on_unkept_output_promise(0)
     except SystemExit as _sysexit:
+        _fail_on_missing_required_answer(_sysexit.code)
         _fail_on_unkept_output_promise(_sysexit.code)
         raise
     except WriteRefused as _refused:

sourcecode/data_exposure.py

@@ -253,10 +253,30 @@ def build_data_exposure(
     rows: dict[str, dict] = {}
     seeds_report: list[dict] = []
 
+    # Every seed answers a different reachability question over the same CIR.
+    # `run_impact_chain` accepts a prepared model precisely so that a declaration
+    # with several types does not rebuild the repository-wide semantic indexes
+    # once per type. Build lazily: declarations whose labels do not resolve keep
+    # the existing failure isolation in `run_impact_chain`.
+    impact_model = model
+
     for label in decl.labels:
         for seed in label.seed_types:
             found_signature = _signature_routes(graph, seed, handlers)
-            chain = run_impact_chain(cir, seed, root=root, model=model, depth=depth)
+            if impact_model is None:
+                try:
+                    from sourcecode.spring_model import SpringSemanticModel
+
+                    impact_model = SpringSemanticModel.build(cir)
+                except Exception:
+                    # `run_impact_chain` owns its error envelope. Retaining None
+                    # here preserves that per-seed fallback if the model cannot be
+                    # assembled instead of turning a partial exposure answer into
+                    # a command failure.
+                    pass
+            chain = run_impact_chain(
+                cir, seed, root=root, model=impact_model, depth=depth,
+            )
             resolution = str(getattr(chain, "resolution", "not_found"))
             reached = list(getattr(chain, "endpoints_affected", []) or [])
 

sourcecode/endpoint_disposition.py

@@ -220,7 +220,7 @@ class DispositionSummary:
         return summary
 
     def to_dict(self) -> dict:
-        return {
+        out = {
             "affected": self.affected,
             "unknown": self.unknown,
             "unaffected": self.unaffected,
@@ -230,6 +230,11 @@ class DispositionSummary:
                 "three counts sum to `total`, so the negative set is published "
                 "rather than left to subtraction (P0-3)"
             ),
-            "unaffected_basis": UNAFFECTED_BASIS,
             "blockers": [b.to_dict() for b in self.blockers],
         }
+        # A basis is evidence for the published negative set, not boilerplate.
+        # When no route is excluded (or a blocker demotes that whole set), showing
+        # it reads like a certification the report did not earn.
+        if self.unaffected and not self.blockers:
+            out["unaffected_basis"] = UNAFFECTED_BASIS
+        return out

sourcecode/hibernate_strat.py

@@ -1108,7 +1108,14 @@ def analyze_hibernate(file_paths: list[str], root: Path) -> HibernateStratificat
     # right (it is the Spring Boot default) and was wrong in the field case that
     # billed 45.6 rewrite days to an EclipseLink repository.
     hibernate_evidence = dep_present or any_hibernate_import
-    transitive_starter_evidence = jpa_starter_present and not hibernate_evidence
+    # Spring Boot defaults the JPA starter to Hibernate, but an explicit provider
+    # declaration overrides that default. Treating both as evidence made an
+    # EclipseLink project inherit a fictional Boot-2 Hibernate-5 rewrite axis.
+    transitive_starter_evidence = (
+        jpa_starter_present
+        and not hibernate_evidence
+        and not competing_providers
+    )
     inferred_from_jpa_only = any_jpa_import and not hibernate_evidence and not transitive_starter_evidence
     # Another declared provider refutes the inference outright. It cannot refute
     # direct evidence: a repository may legitimately carry both.

sourcecode/migrate_check.py

@@ -2322,6 +2322,27 @@ class MigrationReport:
 
     def to_dict(self) -> dict:
         _listed, _floor = self._listed_findings()
+        _provider_non_coverage: list[dict] = []
+        _hib_evidence = self.hibernate.evidence if self.hibernate is not None else {}
+        _providers = _hib_evidence.get("competing_jpa_providers") or []
+        if _providers and _hib_evidence.get("not_applicable_reason"):
+            _provider_non_coverage.append({
+                "id": "NC-MIGRATION-001",
+                "surface": "migrate-check",
+                "not_covered": (
+                    "Provider-specific migration work for declared JPA provider(s): "
+                    + ", ".join(str(provider) for provider in _providers)
+                ),
+                "why": (
+                    "The Hibernate 5→6 model is inapplicable when a competing "
+                    "provider is declared and no direct Hibernate evidence exists."
+                ),
+                "instead": (
+                    "Use the provider's migration guide and its own compatibility "
+                    "tooling; ASK currently reports Jakarta and Spring migration "
+                    "evidence without estimating provider-specific rewrite effort."
+                ),
+            })
         d: dict = {
             "schema_version": self.schema_version,
             "generated_at": self.generated_at,
@@ -2365,6 +2386,7 @@ class MigrationReport:
             "effort_breakdown": self.effort_breakdown,
             "hygiene_findings": self.hygiene_findings,
             "non_blocking": self.non_blocking,
+            "non_coverage": {"items": _provider_non_coverage},
             "spring_present": self.spring_present,
             "spring_boot_present": self.spring_boot_present,
             "spring_test_only": self.spring_test_only,

sourcecode/openrewrite_recipe.py

@@ -123,12 +123,29 @@ class RecipePlan:
 
 def detect_build_tool(root: Path) -> str:
     """`maven` | `gradle` | `unknown`, from what the repository actually declares."""
+    import os
+
     root = Path(root)
     if (root / "pom.xml").is_file():
         return "maven"
     for name in ("build.gradle", "build.gradle.kts", "settings.gradle", "settings.gradle.kts"):
         if (root / name).is_file():
             return "gradle"
+    # A multi-module repository can declare its only build below the checkout
+    # root. The recipe remains rooted at the checkout, but its invocation must
+    # name the build system used by the analysed source module.
+    skip = {".git", ".gradle", "build", "target", "node_modules", "out", "dist"}
+    found_gradle = False
+    for _directory, directories, files in os.walk(root):
+        directories[:] = [name for name in directories if name not in skip]
+        if "pom.xml" in files:
+            return "maven"
+        if any(name in files for name in (
+            "build.gradle", "build.gradle.kts", "settings.gradle", "settings.gradle.kts"
+        )):
+            found_gradle = True
+    if found_gradle:
+        return "gradle"
     return "unknown"
 
 

sourcecode/perf.py

@@ -1171,6 +1171,13 @@ CONTROL_DISPERSION_LIMIT = 1.15
 #: up in it first.
 CONTROL_COMMAND = "impact"
 
+# The control is a real invocation, not a command name. `impact` takes a target
+# before the repository path; omitting it timed an argument error rather than
+# the shared IR work that the protocol is meant to observe. This symbol is part
+# of the fixed Broadleaf corpus used by the field protocol.
+STEADY_CONTROL_REPOSITORY = "BroadleafCommerce"
+STEADY_CONTROL_POSITIONAL_ARGS: tuple[str, ...] = ("BasicPersistenceModule",)
+
 
 def dispersion(samples: "Sequence[float]") -> "float | None":
     """`max/min` over a sample. `None` when there is nothing to divide."""

sourcecode/selftest.py

@@ -146,48 +146,50 @@ def _check_ask09(subject: Subject) -> "dict[str, Any]":
     }
     document = payload if isinstance(payload, dict) else {}
     body = _payload_of(document)
-    if code == 0:
-        return _result(
-            NOT_APPLICABLE,
-            "this repository's `endpoints` answer fits under the output ceiling, "
-            "so the guard this row is about never ran — a bigger repository is "
-            "needed to exercise it here",
-            **evidence,
-        )
     # The output seam may wrap the command payload and keep the envelope error
     # beside it. Read both shapes; dropping the envelope first turns a real
-    # OUTPUT_TOO_LARGE refusal into a false ERROR with code=None.
+    # OUTPUT_TOO_LARGE refusal into a false N/A when an entry point reports an
+    # inconsistent process code.
     error = document.get("error") or body.get("error")
     error_body = error if isinstance(error, dict) else body
-    if error_body.get("code") != "OUTPUT_TOO_LARGE":
-        return _result(
-            ERROR,
-            f"the probe exited {code} without OUTPUT_TOO_LARGE "
-            f"(observed code={error_body.get('code')!r})",
-            **evidence,
-        )
-    hint = str(error_body.get("hint") or "")
-    basis = document.get("hint_basis") or body.get("hint_basis") or {}
-    declared = list(basis.get("declared_flags") or [])
-    if "No smaller inline variant is available" in hint and declared:
+    if error_body.get("code") == "OUTPUT_TOO_LARGE":
+        hint = str(error_body.get("hint") or "")
+        basis = document.get("hint_basis") or body.get("hint_basis") or {}
+        declared = list(basis.get("declared_flags") or [])
+        if "No smaller inline variant is available" in hint and declared:
+            return _result(
+                FAIL,
+                f"the refusal denies a smaller view while declaring {declared}",
+                hint=hint, hint_basis=basis, **evidence,
+            )
+        if not basis:
+            return _result(
+                FAIL,
+                "the refusal carries no `hint_basis`, so what the hint was derived "
+                "from cannot be read from one run — the observability half of the row",
+                hint=hint,
+                **evidence,
+            )
         return _result(
-            FAIL,
-            f"the refusal denies a smaller view while declaring {declared}",
+            PASS,
+            f"the refusal derives its hint from {basis.get('derived_from')!r} "
+            f"(context_found={basis.get('context_found')}) and offers {declared}",
             hint=hint, hint_basis=basis, **evidence,
         )
-    if not basis:
+    if code == 0:
         return _result(
-            FAIL,
-            "the refusal carries no `hint_basis`, so what the hint was derived "
-            "from cannot be read from one run — the observability half of the row",
-            hint=hint,
+            NOT_APPLICABLE,
+            "this repository's `endpoints` answer fits under the output ceiling, "
+            "so the guard this row is about never ran — a bigger repository is "
+            "needed to exercise it here",
             **evidence,
         )
     return _result(
-        PASS,
-        f"the refusal derives its hint from {basis.get('derived_from')!r} "
-        f"(context_found={basis.get('context_found')}) and offers {declared}",
-        hint=hint, hint_basis=basis, **evidence,
+        NOT_APPLICABLE,
+        f"the probe exited {code} without OUTPUT_TOO_LARGE "
+        f"(observed code={error_body.get('code')!r}), so this run did not "
+        "exercise the output-ceiling refusal",
+        **evidence,
     )
 
 

sourcecode/spring_security_audit.py

@@ -631,14 +631,19 @@ def _line_of(source: str, offset: int) -> int:
 
 
 def _profile_evidence(root: Optional[Path], rel: str) -> tuple[Optional[str], Optional[bool]]:
-    """Return static @Profile evidence without claiming runtime activation."""
+    """Return live static @Profile evidence without claiming runtime activation."""
     if root is None:
         return None, None
     try:
         source = (Path(root) / rel).read_text(encoding="utf-8", errors="replace")
     except OSError:
         return None, None
-    match = re.search(r"@Profile\s*\((?P<expr>[^)]*)\)", source)
+    # The security scanner already evaluates only live Java. This evidence layer
+    # must read the same lexical view: otherwise a Javadoc example can override
+    # the actual declaration and invert the profile verdict on SEC-009.
+    from sourcecode.source_text import blank_java_comments
+
+    match = re.search(r"@Profile\s*\((?P<expr>[^)]*)\)", blank_java_comments(source))
     if match is None:
         return None, True
     expr = match.group("expr").strip()

{sourcecode-5.8.10.dist-info → sourcecode-5.8.12.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.10
+Version: 5.8.12
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -49,7 +49,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.8.10-blue)
+![Version](https://img.shields.io/badge/version-5.8.12-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -102,10 +102,12 @@ intentional. Use `ask audit-report --from-risk risk.json` to package an existing
 risk run instead of recomputing it.
 
 **A budget is honoured, never a veto.** `ASK_MAX_ANALYSIS_SECONDS=<seconds>`
-bounds a repo-wide/deep command. A value below the class floor prints what that
-class typically needs and **runs anyway** — refusing to answer is the opposite of
-this product's doctrine. A run that spends its budget stops on the loop that is
-spending the time, not only between phases: a rule family cut in flight is
+currently bounds the phase-runner commands `spring-audit`, `risk` and
+`audit-report`; it is not a process-wide timeout for every command. A value below
+the class floor prints what that class typically needs and **runs anyway** —
+refusing to answer is the opposite of this product's doctrine. A run that spends
+its budget stops on the loop that is spending the time, not only between phases:
+a rule family cut in flight is
 published as `rules_partially_run` with how far it reached, families that never
 started are named in `rules_not_run`, `_partial` names the phases that completed
 and the ones that did not, and the findings measured before the cut are kept.
@@ -113,7 +115,17 @@ The answer marks itself where the numbers are — `summary.partial`,
 `counts_are_floor`, `counts_basis` — and `confidence_level` is capped at `low`,
 because the confidence of the findings that exist says nothing about the family
 that did not run. Measured on BroadleafCommerce (2 766 Java files): a 4.5s budget
-stops at 1 408 files and ends at 5.1s.
+stops at 1 408 files and ends at 5.1s. Commands outside that phase-runner set
+must not be gated on this variable; their budget applicability remains visible in
+the [defect ledger](docs/DEFECT-LEDGER.md).
+
+**Current performance status.** In 5.8.12, `validation` reuses the shared
+Canonical IR and `data-exposure` reuses one semantic model across all declared
+label seeds. On the local BroadleafCommerce corpus, the final fingerprint filled
+the shared CIR in 10.46s and a warm `validation --compact` run took 4.01s with
+byte-identical output. This is a same-host cache observation, not a replacement
+for the controlled `saint-server` cross-version comparison still tracked in the
+[roadmap](docs/DEVELOPMENT-ROADMAP.md).
 
 **What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
@@ -139,7 +151,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.10 — and, on a build that has aged,
+ask version                    # ask 5.8.12 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.10.dist-info → sourcecode-5.8.12.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=N6jOxr62_YHW3o1udlxIduDuvRxhmGvpOs9L3F4lv28,309
+sourcecode/__init__.py,sha256=Q8fdci0rXXKy6QVw6aRGJjGkWAMdn3wJ1bKYNOpngK4,309
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/answer_bounds.py,sha256=_51_DCuYEUmI_xwUFxDMiprSavkNakkLiIBbPjevQ3M,9793
 sourcecode/archetype.py,sha256=uubguXP5ltQt25ACNVm9kX4KRTe7JCqkFfg4H9zckCo,40971
@@ -8,7 +8,7 @@ sourcecode/architecture_analyzer.py,sha256=GFc4ek-s1IHWM7pl-0L32WahZ93AmDgrAMcOu
 sourcecode/architecture_summary.py,sha256=BVVRHd952cjRhjHnR6CPrvKgaa-tdM16l-pBi1yDCPs,32395
 sourcecode/ast_extractor.py,sha256=aXJjZ7XjAdxa99hWNm4SyzPqx4gNWiTbUYjNWGNl-Vc,51213
 sourcecode/audit_clusters.py,sha256=9uqUh8x2qlsqD0eiXdtu7RQEtFBCiC254xustlCcK40,12769
-sourcecode/audit_recipe.py,sha256=SHDsu5whNawo5kVFFPTWMo2lwo34-MNmTXw_ujkeFpo,12567
+sourcecode/audit_recipe.py,sha256=bpFqKuf84SSZAjtTnfFsLUz_20SXx-B_ggppdXedNwY,12817
 sourcecode/audit_report.py,sha256=ZPzFAcSyGBmHY2nVWCdEqPV0MIRKFI5Kl4ehLJsZOas,10740
 sourcecode/audit_since.py,sha256=bkl2tUuYcmS0epvKR9SltXMYx7RSoWedJL0zDGe8xGI,9601
 sourcecode/baseline_autocapture.py,sha256=i6wQLlmET-njeiZOKNk35x0sdlnWUIbnn4n7_MtCi4g,19980
@@ -16,7 +16,7 @@ sourcecode/breaking_changes.py,sha256=Ouof18CtVf9as9VA9n9vo9jm0WlZLMSO3Hdcc-H-c5
 sourcecode/build_modules.py,sha256=rsT8reXoeOGztX28SNwem3yGdBhAC5VJx9RL2vRp_d0,15935
 sourcecode/bundled_docs.py,sha256=hvQeUNDo9SEp_Mtf6o9bexKUmJ8YW76rXKn9spRfQQs,2581
 sourcecode/cache.py,sha256=fozQb7ohE8TwwOhEcxA0lwsmvIuZNW7jxAeiget50z4,43471
-sourcecode/cache_model.py,sha256=cfhEhJWf5JJW_Zv_tCgGSwjJa-SZEALimCp4D_Gi2RM,60129
+sourcecode/cache_model.py,sha256=Fvz3f8PBY6Hu9YXBHcICKtyQJejoKbjkwbYDkd2QrH8,60179
 sourcecode/call_surface.py,sha256=fiqYfHooxN1fX9oQoysq1LS3LoZcobhyUNjAGEZKpwk,4148
 sourcecode/caller_metrics.py,sha256=--sFGDnIog_YGu9xZHMcB91F5xZakfaAKvy15xU54hg,7904
 sourcecode/caller_reach.py,sha256=M7Ffs5CtlimihfdSy3HtC4WpDP97bRFX15QYOlOfMJw,16626
@@ -25,7 +25,7 @@ sourcecode/chain_rules.py,sha256=Bi6UHfgd-GxWswmnHRcPz5jdbAuqka3Zkz_P-MTvqhw,127
 sourcecode/change_plan.py,sha256=wJ896V27a3qb-2vcZhrcOSOqFAwCmEyzbhdbdxM2LlQ,12504
 sourcecode/cir_graphs.py,sha256=RytqSv1WF8kdlfXj2fPQz16LY4akS2kyThbdWL8beCQ,14835
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=BV6v8OKXO6mW-lFuc7NX5Z2yPToTZnSRptxr7Qekmic,724322
+sourcecode/cli.py,sha256=BPjurFlS8pfrQ7fiYUMZM6JGma79pdn6-q9-A-JMlHo,726997
 sourcecode/client_calls.py,sha256=YOPnfRZzRyqmdHvXSVeiunW8cuiuCuWXacNIQRgKMCw,22640
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=Lj8epBqrHLWBhiccE2X0ZbaP2H3hNb7qecoN9Jvsj7c,14794
@@ -42,7 +42,7 @@ sourcecode/contract_init.py,sha256=bXRCqWM9tvrDLeT8j7ea6IWf87jB4VJxnlSzGBsRRXo,1
 sourcecode/contract_model.py,sha256=nRxJKPMs1VHwFTa8AVXhGmaLjti3Lr2sjHDpWgv1bfE,3917
 sourcecode/contract_pipeline.py,sha256=4XE-xhab7ysdExXyUOBl2hAH4MABo7moKnT9V4XcEwQ,30243
 sourcecode/coverage_parser.py,sha256=X9scuUWxacahYTrTBGea2Ku-sf-WCVcnc9OEB35_3IU,19340
-sourcecode/data_exposure.py,sha256=PR-kX1UdG4_9A7ZDsKQVrPtos5GNTEMEIkpk9Aveoo0,18018
+sourcecode/data_exposure.py,sha256=1bcylZRC5vWO-C5jvUqECdS5rRTfiuQU9XHudvKDq-E,19009
 sourcecode/data_labels.py,sha256=c_hmgudTE68cVRdywfbfonr7nUWIL-JH2HOXB8Pplv0,8453
 sourcecode/declarations.py,sha256=Jr7oJDg004sFw0TvJySNVggXFT2jB6hQgbeQK2qreVo,7000
 sourcecode/defect_identity.py,sha256=XS2VFDImg9NLaRImybKTeyk-CoDSsXmchldg0dwvM7c,7028
@@ -53,7 +53,7 @@ sourcecode/detach.py,sha256=PvkCcbIuTaDKKt5TGqtQLahmsmCkflui33jLnMEWkvg,8006
 sourcecode/doc_analyzer.py,sha256=05bjTUbDbmnbajD_cgRnACzS8T7xxBKVX4CjkJlhZg8,24411
 sourcecode/dynamic_argument_surface.py,sha256=u6zJoY-zChYVw1-SrgiyAq-rUwqMZ5ZqBwLfbPJ_8ng,2960
 sourcecode/empty_reach.py,sha256=evKK2DyHbjqe_Wimq4-HfgD40Fdk-j6WiZwQaVXQ5t4,15671
-sourcecode/endpoint_disposition.py,sha256=FsgV-AYkqf9Wxae5Uj9zJR_Irm7YVovGQd7Rkyt7g3o,9295
+sourcecode/endpoint_disposition.py,sha256=WXNoHIjQW2uORG54zUygi8LUJKWj6E_y8q9rps2rWoU,9595
 sourcecode/endpoint_literals.py,sha256=Qf4gTZzvNSFDGDuOvF0YRL9NvaYKKj24klhR5LIOaXc,3263
 sourcecode/endpoint_metrics.py,sha256=sLSLUIgiIyvNdOynaxVgHd9SjRF_DbN3QxevaquykaU,2840
 sourcecode/entrypoint_classifier.py,sha256=jhTYlyqDJH2AtdEcLVaRU3lYRTJuF8DkxVzl4-W3zWE,5322
@@ -77,7 +77,7 @@ sourcecode/git_analyzer.py,sha256=irvEwddbd5_tbA_eYUZebf4mH7_nFhpjwaWAV1f7jUY,15
 sourcecode/git_checkout.py,sha256=gCnkMwHpU6yLyc10FoGzE8W9-tI8KyYxKTgpbWPjayo,6009
 sourcecode/graph_analyzer.py,sha256=lp0eB1PWC20BYF-GpPhAyegRpKrUKgOmXZIcZSIX_Ks,65777
 sourcecode/graph_evidence.py,sha256=rENNsYRZeNstX_ExNCLlbHJAruFQwxo5d00x6wO3xwI,15030
-sourcecode/hibernate_strat.py,sha256=I8e7AwrOnjvQcSbcCOKbRlCBYSVjyQegqoHVxNPyaG8,77657
+sourcecode/hibernate_strat.py,sha256=kLAa5GMwYFZgOI7edl-nDcJTr4SFVYAoxtMy-fj2BsA,77954
 sourcecode/identity_fallback.py,sha256=uRC_j_80uaI4Ue4tf-OhKX4h472dmufYcjEFGSxY2jk,9190
 sourcecode/integration_coordinates.py,sha256=rvuApnS7WdRUbeQLg_oKj-Gi0koO2RKdw6HenXNgrDo,12443
 sourcecode/jdk_exports.py,sha256=fCrlwNAXUT9gge_joq6kMnY3zJxYB2pxqy-0w3o3MJI,874
@@ -85,11 +85,11 @@ sourcecode/license.py,sha256=vvgE1vBUWh8ozWI7USYuteh6noxntnjuzDQIPF-l4rA,27795
 sourcecode/manifest_cache.py,sha256=HR0wPIFA5odNGzHrMHS_H2GdveU6ZnyBeoGThB0BLoY,2200
 sourcecode/mcp_nudge.py,sha256=lKemOqK_wny2u7Ymcr2Idi5Kx8pXY02jCi-_nJYLGMg,2992
 sourcecode/metrics_analyzer.py,sha256=gLoRWKygF18jLgwsqmGXSWopw-f5iO1VbM7Jjdif6ag,22809
-sourcecode/migrate_check.py,sha256=fI77EFwAfWV8cSzM7Uqr9GoO2VhjIVaaM_tBItSt598,152697
+sourcecode/migrate_check.py,sha256=oJmLOWhdl02g_TvwxsycPDnLKGayZ8upmiOX6Bk9IHw,153902
 sourcecode/migration_blast.py,sha256=OPryWkM6-PbvcG3eJFdcWUnlpXBje41nu2BkrZnE2hg,9359
 sourcecode/non_coverage.py,sha256=I8ofuFpMqii6Kcrx4A7Dl6Vfltu3-uqlVzh7Fn3-F6s,25281
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
-sourcecode/openrewrite_recipe.py,sha256=4dyY5twRB6Xew-G9Zy5FafNZwlMU1S7DnRa2FqPkhpQ,12233
+sourcecode/openrewrite_recipe.py,sha256=0pS-61falE6rSfkos2MPnmoDamvoeTT-8Kmj7smj_DI,12987
 sourcecode/output_bounds.py,sha256=OtT7_g8ofuWkXRWlEeUSxx9X-CLMckXAbLCzzyG30so,7694
 sourcecode/output_budget.py,sha256=GxoFnbwk0dvqScgmMRPZHj7m-zRIoHLwUKplrH0u89s,13872
 sourcecode/output_ceiling.py,sha256=DZt9BtlMLuCLCwMdnLvFi8qEME2AKhDVuKZR5Ws1bMI,21003
@@ -100,7 +100,7 @@ sourcecode/parse_cache.py,sha256=cVYF2ZSC9F5RCRp4UBuAyMG_u_Tm0ZG78gBzMrER1Sg,367
 sourcecode/partial_contract.py,sha256=x_N_0bF3mpNNjXd7JFB1zr6LSIroo2zN5GCz14GXvXQ,3510
 sourcecode/path_admission.py,sha256=OGNSoluhVh8YYOBZBnACUrkmH4Tp_yxjGLifkcsxQpo,5838
 sourcecode/path_filters.py,sha256=y2SmiExrKQMn-FUGgSelqo5Gr0SimDSQBwwnqtMcy3U,12491
-sourcecode/perf.py,sha256=2Rz0QdDI7KeMRXsuepFJYVBtACdZLTP-TVe1dAcVvDg,60446
+sourcecode/perf.py,sha256=xooForXgzeOrL5KErEM9L0CezkmpdHYjMs1edRE8NnM,60871
 sourcecode/phased_run.py,sha256=fZxxiCX-CykagFVR_Fp2Tin3H6FDSV8YRpYGtsRAXj8,18356
 sourcecode/pipe_contract.py,sha256=PML0Er5d8uDyec4OrdUXuyqHbGPUYndjeaKUjkFz2u4,8369
 sourcecode/posture.py,sha256=m1sYDLtGvVkvDEVqMxuDvAKz4-KPj0z5Q6x3V_5U-FM,83276
@@ -140,7 +140,7 @@ sourcecode/security_chain.py,sha256=1YZVeFLwy65kntMBhMNvz1cUpOoKCmvEqYICgxs66Gw,
 sourcecode/security_config.py,sha256=LUppRDYQK0oKM4qdEOLObaeU3frFTS-paEZo7dMgtY8,5467
 sourcecode/security_config_scan.py,sha256=Wv7QqEx_KbgmhbOGuX7RQfotzkkif43PFU1LohKNWCM,33818
 sourcecode/security_posture.py,sha256=wj6WwvasIh6r-minwBz3oz1T9Zl8SPsPhn7zxDD-yng,55861
-sourcecode/selftest.py,sha256=a-6B-0k8tdVapGlXy0oC4FBxqgHgb0m4kb8oxDknnvI,19109
+sourcecode/selftest.py,sha256=z9SHFKXr1gi_zVxpTjYKaH-1Fk-J5gK6DL0-jgtoMbU,19300
 sourcecode/semantic_analyzer.py,sha256=xGwQvhU9xeOlZ4N-TPXFZT8HBHx4Rg0nPwu8nDFl00Y,95621
 sourcecode/semantic_impact_engine.py,sha256=t09IirGC3JjQDy33JZd1_WKzQVKXkoNl3-XEUr5kjis,20563
 sourcecode/semantic_integration_engine.py,sha256=ZjyKJKOj-adScWlYBuWx8Ee_P0F4_OImUJVnCYgopuU,20952
@@ -154,7 +154,7 @@ sourcecode/spring_impact.py,sha256=yngLmb3ABL9_6b59xSuU6sn2bAJj1MVCGy9dsjgNaic,8
 sourcecode/spring_model.py,sha256=7GqgcWnHC96ixusRJmD-9tDV93qTdkMh-8e7CBNK0pc,24126
 sourcecode/spring_profiles.py,sha256=-kwrCK0O-MRjrCp6SA1d31t--o4Tg87iqPVrTwxoIUs,19605
 sourcecode/spring_properties.py,sha256=kPTk5qAJxdbHc1hclhHAP0O-hCIzBn8PTh3lzl-I4a4,8400
-sourcecode/spring_security_audit.py,sha256=TJHQG_Qen_Fr3rLjDbvfZ08rp7LK-nYVBPIx3eG-qq8,69673
+sourcecode/spring_security_audit.py,sha256=_5WBaSOfRh52O7jP4LHK2MxnP2Wpd4D6aNAjd7gl-eg,69992
 sourcecode/spring_semantic.py,sha256=UrmLg_4gmBVmMqvSnUMgSReVEERVGv3X7LYDBEs6k_o,16598
 sourcecode/spring_tx_analyzer.py,sha256=WBibPgkjQm33kFgERx6zLtp87FpJNE5V_4JI3xZ5zD4,50094
 sourcecode/sql_taint.py,sha256=As1DbEdjXMBFjCTXU5ojksOzuKkP6LmnuMVnzzmckzc,26998
@@ -240,13 +240,13 @@ sourcecode/telemetry/consent.py,sha256=pQdl-QeLl6Gcibn0eWHSKZrm-HYSsjpVqOnjrgFp8
 sourcecode/telemetry/events.py,sha256=4_yeO58U-Cwc1Qb27VB0_EjhmroY0k91n3_VGxeALB8,2776
 sourcecode/telemetry/filters.py,sha256=RzxauTz8HliO4BllQnXEXc7zTeqdCZi5MgqGEDuW7OQ,6570
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode/_docs/DEFECT-LEDGER.md,sha256=l9rGV6X-RmLgpWuYBqMcvjjjBx2NHcmdlDH8epSd33A,736756
+sourcecode/_docs/DEFECT-LEDGER.md,sha256=eD0lIU59OtcDZow3n6TDuXeO3TWEzG3YeGi7qox65i8,742831
 sourcecode/_docs/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
 sourcecode/_docs/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode/_docs/USER_GUIDE.md,sha256=PTMJ0zh_RAXmctfwsNA9-xBNudO62y1Io5rSYlI-Oqs,86740
-sourcecode-5.8.10.dist-info/METADATA,sha256=WEFjTsf2cYQHfik7y8eS6Jy3Pp7JfLyMc2HjbVc-DE8,50810
-sourcecode-5.8.10.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-5.8.10.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-5.8.10.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
-sourcecode-5.8.10.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode-5.8.10.dist-info/RECORD,,
+sourcecode/_docs/USER_GUIDE.md,sha256=u6BDmr3Kv9l10u5X7xpkP8fYf-aA-BreovysiPFaYTA,87104
+sourcecode-5.8.12.dist-info/METADATA,sha256=QHhr0IK_Y1Nj9KJrieY-vs-xH60_Qr-dhDE-wHi4pt0,51594
+sourcecode-5.8.12.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-5.8.12.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-5.8.12.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
+sourcecode-5.8.12.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
+sourcecode-5.8.12.dist-info/RECORD,,