sourcecode 5.8.11__py3-none-any.whl → 5.8.13__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.11"
+__version__ = "5.8.13"

sourcecode/_docs/DEFECT-LEDGER.md

@@ -16,20 +16,57 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
-**As of 2026-08-19, the `5.8.11` release commit:** this is the current status of
-the 5.8.9 re-audit queue. The audit observations below remain historical evidence;
-only the table here declares present state.
+**As of 2026-08-20, release `5.8.13` and the external `5.8.11` re-audit:** this is the current status of
+the 5.8.8/5.8.9 audit queue. The subject remained `saint-server` at `3dde0376`, with a
+byte-identical CIR and the same 53/61 invocables exercised. The score is **78/100**
+(75 in 5.8.8, 80 in 5.8.9). The observations below remain historical evidence; only
+this table declares present state.
 
 | Rows | Current status | Evidence |
 |---|---|---|
-| `AUD-588-B01`, `AUD-589-B01`, `C3-122` | **closed** | `20596c8`; failed writes cannot suppress the global output-promise guard, covering both `risk` and `audit-report` emit paths. |
-| `AUD-588-B03` | **closed** | `16a52cc`; `SEC-009`, static `@Profile` evidence and `permit_all_rules` are emitted with regressions. |
-| `AUD-588-B04` | **closed** | `fd34eb1`; `data-exposure` preserves the chain decision for every route. |
+| `AUD-588-B01`, `AUD-589-B01`, `C3-122` | **implemented in 5.8.12** | `9884488` requires `risk` and `audit-report` to deliver stdout or their requested artifact before exit 0; the remaining closure evidence is a field-scale subprocess reproduction. |
+| `AUD-511-R01` / `AUD-588-B03` | **implemented in 5.8.12** | `13362ec` makes SEC-009 read comment-blanked Java, so a Javadoc profile cannot override the live `@Profile("!m3")` declaration. |
+| `AUD-588-B04` | **retracted audit premise** | `data-exposure` correctly preserves `chain_decision`; the reported `coverage_unknown` routes were custom-gate annotations whose application was not configured. `fd34eb1` remains a valid additive disclosure, but no further B04 fix is due. |
 | `AUD-588-B05` | **closed** | `c15f5b6`; changed container-wired components block a false `unaffected` disposition. |
-| `AUD-588-B07` | **closed** | `5cc6ba7`; ASK-09 reads the envelope error contract and covers the wrapped shape. |
+| `AUD-511-R03` / `AUD-588-B07` | **implemented in 5.8.12** | `47aee1e` gives the published `OUTPUT_TOO_LARGE` envelope precedence over an inconsistent process status and preserves the excerpt in every branch. |
 | `AUD-588-B08` | **closed** | `c084555`; `impact` publishes its independent stdout-byte budget. |
-| `AUD-588-B11` (container/units subset) | **closed** | `ca72b61`, `a49cf6a`; plan/compare publish container wiring and impact-chain names security-surface units. |
-| `AUD-588-B02`, `B06`, B11 residuals, `B12` | **open** | Require provider non-coverage verification, remaining contract parity and controlled cost calibration; no closure is inferred from the release. |
+| `MCP-001` | **closed 5.8.13** | Deep corpus testing reproduced concurrent `CliRunner` stream capture leaking a tool response to the host stdout. `b2c9660` serializes the narrow process-global capture seam; concurrent real MCP calls and a regression test verify response isolation. |
+| `AUD-588-B11` (container/units subset) | **partially implemented in 5.8.12** | `d745d31` discovers nested Maven modules; `273ae8e` suppresses unsupported `pr-impact.unaffected_basis`. `impact` naming, source population units, risk tiers and plan narrative remain open. |
+| `AUD-511-R02` / `AUD-589-B02` | **partially mitigated in 5.8.12, still under investigation** | `b93f230` reuses one `SpringSemanticModel` across every declared `data-exposure` seed; `473f47a` routes `validation` through the shared CIR cache, and `91bd0c0` retains subcommand `--no-cache` compatibility. On the local BroadleafCommerce corpus at the final analyzer fingerprint, a first shared-CIR fill took 10.46 s and its warm `validation --compact` hit took 4.01 s with byte-identical output. This is a same-host cache-state observation, not the 5.8.9/5.8.11 external A/B: the six-run C3-120 comparison and the configured `saint-server` reproduction remain required. |
+| `AUD-588-B02`, `B06`, B11 residuals, `B12` | **partially open in 5.8.12** | `3869c87` excludes explicit EclipseLink from Hibernate applicability and effort; `037223e` publishes provider non-coverage. B11 parity and controlled cost calibration remain required. |
+
+### Re-audit Intake: 5.8.11
+
+The third external pass uses the same `saint-server` snapshot (`3dde0376`), read-only
+protocol and warm-cache preparation as 5.8.8 and 5.8.9. The CIR hash is identical across
+all three versions. It exercises 53/61 invocables (87%) and reports 78/100. That makes
+rule, output and execution changes attributable without claiming that the application was
+run or that the eight blocked invocables were covered.
+
+| ID | Priority | Finding | Required correction / verification |
+|---|---|---|---|
+| `AUD-588-B01`, `AUD-589-B01`, `C3-122` | P0 | `risk -o` can exit 0 with no file; `risk` and `audit-report` can finish with empty stdout. The failure has fast and slow composition paths. | Add a real-subprocess invariant: exit 0 must produce parseable stdout or the requested artifact. Exercise `risk` and `audit-report` with and without `-o`, plus budget-cut partial output. |
+| `AUD-511-R01` | P1 regression | SEC-009 takes `@Profile` from comments and reports an active `@Profile("!m3")` request chain as inactive. | Reuse comment-blanked source and declaration-local profile evidence, or consume posture's authority. Regress a misleading javadoc and both positive/negative profile forms. |
+| `AUD-511-R02` / `AUD-589-B02` | P1 investigation | `endpoints`, `impact`, `spring-audit`, `modernize`, `validation` and `timeline` measure 1.4-2.4x slower than 5.8.9; `data-exposure --config` remains high. | **Partial implementation:** `b93f230` shares the data-exposure semantic model across seeds and `473f47a` makes `validation` reuse the shared CIR; `91bd0c0` confirms `--no-cache` remains a compatibility no-op. Re-run the idle-host, isolated-cache, interleaved-control protocol against the audited `saint-server` configuration before attributing or closing the field regression. |
+| `AUD-511-R03`, `AUD-588-B07` | P1 regression | ASK-09 reports `not_applicable` even though its literal probe emits `OUTPUT_TOO_LARGE` 12x above the ceiling. | Derive branch selection exclusively from the output envelope. Publish `observed_payload_excerpt` for pass, fail, error and not-applicable rows. |
+| `AUD-588-B02` + `B06` | P1 | The EclipseLink repository still receives Hibernate readiness, rewrite-zone classification and 32.9-66.2 person-days; `non_coverage` is null. | A declared competing provider must remove the Hibernate axis from readiness, effort and classification and add provider non-coverage. EclipseLink automation remains out of scope. |
+| `AUD-588-B11` residual | P2 | `impact.matched_fqns` mixes exact resolution with 235 implementations; `migrate-recipe` misses nested Maven manifests; source-file populations lack units; `risk` tier labels diverge; plan/pr-impact prose trails their new container facts. | Bind consumers to established authorities, name populations and units, and add cross-command parity tests. Do not add parallel detection. |
+| `AUD-588-B12` | P2 | 5.1.0 anchors disagree in both directions with 5.8.11 measurements; `timeline` is advertised as foreground despite a 404s sample. | Recalibrate only after controlled measurements and align foreground advice with the explicit opt-in progress policy. |
+
+### Feature Recommendations: 5.8.11
+
+| ID | Recommendation | Current decision |
+|---|---|---|
+| `AUD-588-F01` | EclipseLink/JPA-provider migration axis. | **Deferred product feature.** First close B02/B06 so the current Hibernate answer is honest about non-coverage. |
+| `AUD-588-F02` | Shared answer-contract authority for profiles, units, populations, caveats and container reach. | **Partial.** The SEC-009 regression and B11 residuals show that new consumers are still re-deriving facts. |
+| `AUD-588-F03` | Versioned cost model by repository size and cache state. | **Partial.** Existing dimensions do not make stale 5.1.0 anchors operationally safe; controlled remeasurement is prerequisite. |
+| `AUD-588-F04` | Default foreground heartbeat without corrupting machine output. | **Explicit opt-in by decision.** Until revised, cost advice must not imply that long commands emit progress by default. |
+| `AUD-588-F05` | Raise audit coverage through safe operational paths and dirty-tree `verify-edit`. | **Locally verified only.** The external run remains 53/61; treat dirty-tree behavior as a validation gap, not a closed product claim. |
+
+**Recommended order:** composition-output invariant → SEC-009 profile regression → controlled
+performance measurement → EclipseLink applicability/non-coverage → ASK-09 → B11 narrative
+and parity residuals → cost-model calibration. Keep B04 closed as a retracted premise, and
+do not implement EclipseLink migration automation as part of this bug battery.
 
 **As of 2026-08-19, the `5.8.9` release commit:** the latest audit queue was implemented in
 committed post-5.8.7 fixes. This table is
@@ -558,7 +595,7 @@ class's subject, not its provenance.
 
 | ID | Item | Found | Severity | Status |
 |---|---|---|---|---|
-| P-1 | Telemetry is **opt-out**. Auditing a public-sector health client's code, it must be disabled *before* the first run, not after | 3.2.0 | **High (procurement)** | **closed 3.3.0** — opt-in: with no explicit choice on record, `is_enabled()` is False everywhere, so a fresh install transmits nothing on the run that prints the notice. The CI special case is gone with the default it existed to override; CI is still detected for one purpose, skipping a notice that has no terminal to appear on. The first-run notice became an invitation that states what *would* be collected. `telemetry status` distinguishes "no choice recorded" from "you chose disabled" (`stored_choice()` returns `None`, not `False`) — a buyer auditing this needs to know which one they have. An explicit choice made before the change is honoured unchanged |
+| P-1 | Telemetry default and procurement disclosure | 3.2.0 | **High (procurement)** | **reopened and corrected 5.8.12** — telemetry is on by default by explicit product decision, with `ask telemetry disable`, `SOURCECODE_TELEMETRY=0` and `DO_NOT_TRACK=1` honored before any event is sent. The first-run notice discloses the fields and the disable path. `telemetry status` distinguishes the default from an explicit disabled choice; the privacy policy documents the endpoint, 90-day retention and bounded anonymous fields. This supersedes the historical 3.3.0 opt-in closure for the current release |
 | P-2 | Licence state is ambiguous: `auth status` → `{"status":"unauthenticated","pro":true,"pro_reason":"early-adoption unlock"}`. The buyer cannot tell what it will cost or what they lose when the door closes | 3.2.0 | Medium | **closed 3.4.0** — one authority, `license.entitlement()`: `entitlement` (what runs), `source` (why: `license_key` / `early_adoption_unlock` / `free_tier`), `authenticated` (a separate fact — today one can be entitled without a credential), `paywall_active`, and `when_it_changes`, which states what the user loses when that source stops applying, in the terms the gate uses and **never as a price**. `is_pro` — what every gate reads — is now derived from it rather than computed beside it, which is how the status page came to contradict the commands. The legacy keys stay for consumers, are derived from the authority, and are listed in `deprecated_fields` |
 
 | P-3 | **The price is not published.** With P-2 closed the entitlement is unambiguous, but a buyer still cannot see what Pro costs or what a team of 25 pays. Eval #5 lists *"precio Pro público"* among the conditions for the top of its price band, beside the robustness fixes | 3.2.1 (eval #5) | Medium (procurement) | open — packaging question, not a page: the field's own reading is that **the value is frontal** (a first audit replaces 5–15 person-days) **and the recurring half is the CI gate**, so a full seat subscription on a product whose value peaks on run one *"genera churn en el mes 4"*. Model to test: one-off assessment **3–5 k€ per repo** + **8–12 €/dev/month** for the gate. Depends on C3-22: without the gate there is nothing recurring to sell |

sourcecode/_docs/USER_GUIDE.md

@@ -39,10 +39,12 @@ Evidence            — every answer is backed by auditable evidence, not a gues
 CLI commands        — impact, endpoints, spring-audit, explain, … each a projection
 ```
 
-The key idea: **the source is parsed once** into the Semantic IR; everything above that is
-computed from the IR, cached, and shared. `impact`, `endpoints`, and `spring-audit` are not
-three analyzers — they are three questions asked of the same graph. (The extraction and
-consumption contract is fixed in the architecture ADRs 0001–0004 under `docs/architecture/`.)
+The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
+where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
+warm buys for each command rather than implying that every projection costs the same. In
+5.8.12, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+model across all declared label seeds. (The extraction and consumption contract is fixed in
+the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 ---
 
@@ -136,7 +138,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.11
+# ask 5.8.13
 ```
 
 Requires Python 3.9+.
@@ -1197,7 +1199,7 @@ explaining. The rest do one thing; `ask <command> --help` is the whole story.
 | `ask retrieve` | parked | Typed knowledge queries over the model — kept working, no longer developed |
 | `ask baseline capture\|diff\|trend` | supported | Versioned architectural metrics over time; see [`ask trend`](#ask-trend-dir--how-the-architecture-moved) |
 | `ask cache status\|warm\|model\|clear\|freshness` | supported | Cache inspection; `ask cache model` states what a warm buys each command |
-| `ask config` · `ask version` · `ask activate` · `ask auth` · `ask telemetry` · `ask mcp` | supported | Configuration, version, licence, authentication, telemetry (off by default), MCP integration |
+| `ask config` · `ask version` · `ask activate` · `ask auth` · `ask telemetry` · `ask mcp` | supported | Configuration, version, licence, authentication, telemetry (on by default), MCP integration |
 
 ## Typical workflows
 
@@ -1285,7 +1287,7 @@ ask mcp serve
 ask mcp remove
 ```
 
-The MCP server exposes structural analysis tools to AI agents without requiring the agent to call the CLI directly. Claude Desktop and Cursor can query impact, endpoints, and context through the MCP protocol.
+The MCP server exposes structural analysis tools to AI agents without requiring the agent to call the CLI directly. Claude Desktop and Cursor can query impact, endpoints, and context through the MCP protocol. Concurrent requests are accepted safely: ASK serializes only the in-process CLI capture seam, because its stdout/stderr redirection is process-global, so one tool response cannot contaminate another.
 
 ---
 
@@ -1482,10 +1484,12 @@ the tree. Set `ASK_RUNS_IN_REPO=1` only when `.ask/runs` belongs in that
 repository's own artefacts, or `ASK_RUNS_DIR=/path/to/runs` to choose an external
 location explicitly.
 
-**Large-repo budgets.** Set `ASK_MAX_ANALYSIS_SECONDS=<seconds>` to bound a
-repo-wide or deep command. The budget is **honoured, not vetoed**: if the value
-is below the class floor ASK says so on stderr and runs anyway, and a run that
-spends its budget publishes what it measured with
+**Large-repo budgets.** Set `ASK_MAX_ANALYSIS_SECONDS=<seconds>` to bound the
+phase-runner commands `spring-audit`, `risk` and `audit-report`. It is not a
+process-wide timeout for every repo-wide or deep command. The budget is
+**honoured, not vetoed**: if the value is below the class floor ASK says so on
+stderr and runs anyway, and a run that spends its budget publishes what it
+measured with
 
 ```json
 "_partial": {"partial": true,
@@ -1505,7 +1509,9 @@ inventories `rules_run` / `rules_not_run` with `rules_run_count` and
 stops at 1 408 files inside the `SEC-004` group and ends at 5.1s.
 
 Every count in such an answer is a floor over what ran — a family or phase that
-never ran is named, never reported as an absence of findings. The mark lives
+never ran is named, never reported as an absence of findings. Commands outside
+that phase-runner set are not bounded by this variable and must not be CI-gated
+on it. The mark lives
 where the numbers are as well as at the root: `summary.partial`,
 `summary.counts_are_floor` and `summary.counts_basis`, with
 `confidence_level` capped at `low` and `confidence_basis` saying the cut is the

sourcecode/audit_recipe.py

@@ -127,6 +127,11 @@ MANUAL_BASIS: "dict[str, str]" = {
         "clause) and an injection sink for a value, and an executor cannot tell "
         "them apart without the caller's intent"
     ),
+    "SEC-009": (
+        "whether an anonymous request matcher is intentional depends on the "
+        "deployment profile and authorization policy, so removing it would be "
+        "an unreviewed behaviour change rather than a safe rewrite"
+    ),
     "DEAD-001": (
         "a disabled security control is a decision somebody made; re-enabling it "
         "changes runtime behaviour nobody has measured here"

sourcecode/cache_model.py

@@ -653,9 +653,9 @@ def cost_sentence() -> str:
         f"files, and a repository-wide audit measured {seconds:g} s on a "
         f"{_thousands(FIELD_ANCHOR_JAVA_FILES)}-file repository "
         f"({FIELD_ANCHOR_MEASURED_VERSION}{stale}).{gate} `ask cache model` prints "
-        f"the figure and the build behind it for every command; "
-        f"ASK_MAX_ANALYSIS_SECONDS/ASK_PROGRESS bound and narrate a run where CI "
-        f"wants an explicit budget."
+        f"the figure and the build behind it for every command; ASK_PROGRESS "
+        f"narrates supervised work, while ASK_MAX_ANALYSIS_SECONDS bounds only "
+        f"the phase-runner commands (spring-audit, risk and audit-report)."
     )
 
 

sourcecode/cli.py

@@ -572,7 +572,8 @@ def _build_help_text(scope: "Optional[Any]" = None) -> str:
 
 Deterministic Java/Spring semantics and reusable structural context for AI coding agents.
 
-Cache warms on first scan; later calls reuse pre-built context instead of rescanning.
+Content-addressed parse and context caches reuse prior knowledge where a command's
+scope matches; `ask cache model` says exactly what a warm buys per command.
 {_cost_sentence()}
 
 {_start_here_block(scope)}
@@ -584,6 +585,12 @@ Cache warms on first scan; later calls reuse pre-built context instead of rescan
   ask --compact --git-context  [dim]# + git hotspots and uncommitted files[/dim]
   ask --agent                  [dim]# full structured JSON for AI agents[/dim]
 
+[bold]Performance / CI:[/bold]
+  validation . --compact       [dim]# reuses the shared CIR on a warm matching scope[/dim]
+  data-exposure .              [dim]# one semantic model is shared across declared label seeds[/dim]
+  ASK_MAX_ANALYSIS_SECONDS=N   [dim]# deadline only for spring-audit, risk, audit-report[/dim]
+  [dim]Other commands are not time-bounded by this variable; use `--progress` or `--detach` where offered.[/dim]
+
 [bold]Change and risk:[/bold]
   impact-chain <Class> .       [dim]# blast radius; TX/SEC findings opt-in[/dim]
   impact <Class> .             [dim]# reverse deps → endpoints reached[/dim]
@@ -1954,6 +1961,7 @@ def _output_ceiling_error(content: str, *, to_file: bool) -> "Optional[dict[str,
 #: that cannot produce the file it was asked for must not be able to say it did.
 _OUTPUT_PROMISED: "Optional[str]" = None
 _OUTPUT_DELIVERED: bool = False
+_ANSWER_REQUIRED_BY: "Optional[str]" = None
 
 
 def _record_output_promise(argv: "list[str]") -> None:
@@ -1966,9 +1974,10 @@ def _record_output_promise(argv: "list[str]") -> None:
     parser owns that. It is used only to ask, at the end, whether a file the run
     promised exists.
     """
-    global _OUTPUT_PROMISED, _OUTPUT_DELIVERED
+    global _OUTPUT_PROMISED, _OUTPUT_DELIVERED, _ANSWER_REQUIRED_BY
     _OUTPUT_PROMISED = None
     _OUTPUT_DELIVERED = False
+    _ANSWER_REQUIRED_BY = None
     for i, token in enumerate(argv):
         value: "Optional[str]" = None
         if token in ("--output", "-o"):
@@ -1987,6 +1996,36 @@ def _mark_output_delivered() -> None:
     _OUTPUT_DELIVERED = True
 
 
+def _require_answer_delivery(command: str) -> None:
+    """Require a composed-report command to publish an answer before exit 0.
+
+    A file promise catches only ``-o``. Risk composition also has a stdout
+    contract: a successful invocation must leave one parseable document behind.
+    Keeping that obligation opt-in avoids changing intentionally quiet commands
+    while covering both expensive composition surfaces.
+    """
+    global _ANSWER_REQUIRED_BY
+    _ANSWER_REQUIRED_BY = command
+
+
+def _fail_on_missing_required_answer(exit_code: object) -> None:
+    """Turn a silent successful composed run into a typed failure (C3-122)."""
+    if exit_code not in (0, None) or _OUTPUT_DELIVERED or not _ANSWER_REQUIRED_BY:
+        return
+    _emit_error_json(
+        EXECUTION_FAILED_CODE,
+        f"{_ANSWER_REQUIRED_BY} finished without publishing an answer.",
+        hint=(
+            "The command returned successfully before its output was delivered. "
+            "Re-run with progress enabled and report the invocation; a composed "
+            "report must produce parseable stdout or its requested file."
+        ),
+        command=_ANSWER_REQUIRED_BY,
+        expected="parseable stdout or the requested output artifact",
+    )
+    raise SystemExit(1)
+
+
 def _fail_on_unkept_output_promise(exit_code: object) -> None:
     """Refuse to report success for an answer that was never produced (C3-122).
 
@@ -2994,13 +3033,59 @@ def _get_command_with_preprocessing(typer_instance: Any) -> Any:
 
     _orig_cmd_main = cmd.main
 
+    _TELEMETRY_COMMANDS = frozenset({
+        "repo-ir", "impact", "endpoints", "export", "validation", "delta", "contract-diff",
+        "plan", "compare", "trend", "timeline", "spring-audit", "verify-edit", "verify", "risk",
+        "enrich", "audit-report", "migrate-recipe", "data-exposure", "posture", "migrate-check",
+        "impact-chain", "pr-impact", "explain", "onboard", "review-pr", "fix-bug", "modernize",
+        "rename-class", "chunk-file", "activate", "selftest", "explain-endpoint", "regress", "version",
+        "schema", "config", "archetype", "cold-start", "telemetry", "mcp", "cache", "baseline",
+        "auth", "retrieve", "prepare-context",
+    })
+
+    def _telemetry_command(args_for_command: Optional[list[str]]) -> str:
+        """Extract only a registered CLI command, never a path or option value."""
+        tokens = list(args_for_command) if args_for_command is not None else sys.argv[1:]
+        for token in tokens:
+            if token in _TELEMETRY_COMMANDS:
+                return token
+        return "analyze"
+
+    def _telemetry_flags(args_for_command: Optional[list[str]]) -> list[str]:
+        tokens = list(args_for_command) if args_for_command is not None else sys.argv[1:]
+        try:
+            from sourcecode.telemetry.filters import _SAFE_FLAGS
+            return sorted({token for token in tokens if token in _SAFE_FLAGS})
+        except Exception:
+            return []
+
     def _cmd_main(args: Optional[list[str]] = None, **kwargs: Any) -> Any:
         if args is not None:
             # CliRunner / programmatic call: preprocess the explicit args list.
             _set_detected_path(".")
             args = _preprocess_args(list(args))
         # args=None → Click reads sys.argv; _preprocess_argv() in main_entry handled it.
-        return _orig_cmd_main(args=args, **kwargs)
+        started = time.monotonic()
+        command = _telemetry_command(args)
+        success = True
+        try:
+            return _orig_cmd_main(args=args, **kwargs)
+        except BaseException:
+            success = False
+            raise
+        finally:
+            try:
+                from sourcecode import telemetry as _tel
+                _tel.record(
+                    "execution_completed",
+                    cmd=("mcp" if command == "mcp" else "telemetry" if command == "telemetry" else "analyze"),
+                    command=command,
+                    flags=_telemetry_flags(args),
+                    duration_s=time.monotonic() - started,
+                    success=success,
+                )
+            except Exception:
+                pass
 
     cmd.main = _cmd_main
     return cmd
@@ -3016,7 +3101,7 @@ try:
 except Exception:
     pass
 
-telemetry_app = typer.Typer(help="Manage anonymous telemetry (off by default; opt-in).", rich_markup_mode="rich")
+telemetry_app = typer.Typer(help="Manage anonymous telemetry (on by default; disable any time).", rich_markup_mode="rich")
 app.add_typer(telemetry_app, name="telemetry")
 
 mcp_app = typer.Typer(help="MCP integration: setup, status, serve, remove.", rich_markup_mode="rich")
@@ -3044,9 +3129,8 @@ app.add_typer(retrieve_app, name="retrieve")
 def _maybe_show_telemetry_notice() -> None:
     """Show first-run telemetry notice once, on interactive TTYs only.
 
-    Telemetry is off by default (opt-in). The notice is an invitation, not a
-    disclosure: nothing has been collected when it appears. Marked as shown so it
-    appears only once.
+    Telemetry is on by default. The notice is a one-time disclosure of what is
+    collected and how to disable it.
     """
     try:
         from sourcecode.telemetry.config import has_been_asked, mark_asked
@@ -5275,26 +5359,7 @@ def main(
     perf.stop("serialize", _perf_serialize)
     perf.flush_recorder()
 
-    # 5. Telemetry (fire-and-forget, never blocks)
-    try:
-        from sourcecode import telemetry as _tel
-        _tel.record(
-            "execution_completed",
-            cmd="analyze",
-            flags=_active_flags(
-                dependencies, graph_modules, docs, full_metrics,
-                semantics, architecture, git_context, env_map,
-                code_notes, agent, compact, tree, no_redact, format,
-            ),
-            output_fmt=format,
-            file_count=len(sm.file_paths),
-            duration_s=time.monotonic() - _t0,
-            success=True,
-        )
-    except Exception:
-        pass
-
-    # 6. Write output (CLI-04)
+    # 5. Write output (CLI-04)
     _progress.finish()
     if format == "json":
         _uncommitted_fresh, _uncommitted_fresh_basis = _uncommitted_fact(
@@ -5887,17 +5952,6 @@ def prepare_context_cmd(
                 except Exception:
                     pass  # not JSON (or unreadable) → serve exactly what was stored
                 _emit_command_output(_cached_pctx, output_path, copy)
-                try:
-                    from sourcecode import telemetry as _tel
-                    _tel.record(
-                        "execution_completed",
-                        cmd="prepare-context",
-                        feature=task,
-                        output_fmt=format,
-                        duration_s=0.0,
-                    )
-                except Exception:
-                    pass
                 return
 
     _scope_files = None
@@ -6424,18 +6478,6 @@ def prepare_context_cmd(
         fmt=("yaml" if format == "yaml" else "json")
     )
 
-    try:
-        from sourcecode import telemetry as _tel
-        _tel.record(
-            "execution_completed",
-            cmd="prepare-context",
-            feature=task,
-            output_fmt=format,
-            duration_s=_time.perf_counter() - _t0,
-        )
-    except Exception:
-        pass
-
     from sourcecode.mcp_nudge import nudge_mcp_if_needed as _nudge
     _nudge()
 
@@ -6452,11 +6494,11 @@ def telemetry_status(
     enabled = is_enabled()
     choice = stored_choice()
     status = "enabled" if enabled else "disabled"
-    lines = [f"Telemetry: {status} (off by default; opt-in)"]
-    # "off because you said so" and "off because nobody asked you" are different
-    # answers, and a buyer auditing this needs to be told which one they have.
+    lines = [f"Telemetry: {status} (on by default; disable with `ask telemetry disable`)"]
+    # The default and an explicit disabled choice are different answers, and a
+    # buyer auditing this needs to be told which one they have.
     if choice is None:
-        lines.append("  No choice recorded — nothing has been collected or sent.")
+        lines.append("  No choice recorded — the on-by-default setting applies.")
     else:
         lines.append(f"  Your recorded choice: {'enabled' if choice else 'disabled'}.")
     lines.append(f"  Config: {config_file_path()}")
@@ -6469,7 +6511,7 @@ def telemetry_status(
 
 @telemetry_app.command("enable")
 def telemetry_enable() -> None:
-    """Opt in to anonymous telemetry."""
+    """Enable anonymous telemetry and remember the choice."""
     from sourcecode.telemetry.config import set_enabled
     from sourcecode import telemetry as _tel
     set_enabled(True)
@@ -6482,11 +6524,11 @@ def telemetry_enable() -> None:
 
 @telemetry_app.command("disable")
 def telemetry_disable() -> None:
-    """Opt out of anonymous telemetry."""
+    """Disable anonymous telemetry and remember the choice."""
     from sourcecode.telemetry.config import set_enabled
     set_enabled(False)
     typer.echo("Telemetry disabled. No data will be collected or sent.")
-    typer.echo("Telemetry is off by default; this choice is recorded so the notice stops asking.")
+    typer.echo("Telemetry is enabled by default; this choice is recorded so the notice stops appearing.")
     typer.echo("Re-enable at any time: ask telemetry enable")
 
 
@@ -7946,11 +7988,22 @@ def validation_cmd(
     target = _admit_path(path)
 
     from sourcecode.context_graph import ContextGraph
+    from sourcecode.repository_ir import find_java_files
     from sourcecode.validation_surface import build_validation_surface
     _prog = Progress()
     _prog.start("mapping validation surface")
-    # Structural facts come from the ContextGraph — the single access layer.
-    _graph = ContextGraph.build_from_root(target)
+    # Structural facts still come from the ContextGraph — the single access
+    # layer — but its CIR now follows the shared knowledge-cache door used by
+    # the other repository-wide commands. A validation run therefore does not
+    # parse the same tree again after `cache warm`, `impact`, or `explain`.
+    # `--no-cache` remains the published no-op for subcommands; the direct build
+    # is strictly the best-effort fallback if the shared layer cannot answer.
+    try:
+        from sourcecode.context_cache import shared_cir
+
+        _graph = ContextGraph.from_cir(shared_cir(target, find_java_files(target)))
+    except Exception:
+        _graph = ContextGraph.build_from_root(target)
     data = build_validation_surface(target, graph=_graph)
 
     # P1-C: classify the request-body validation *pattern* so a repo with a
@@ -10666,6 +10719,7 @@ def risk_cmd(
       ask risk . --table --rule SEC-008 --band high --top-n 20
       ask risk . --limit 10 -o risk.json
     """
+    _require_answer_delivery("risk")
     _apply_jobs(jobs)
     from sourcecode.risk import build_risk
 
@@ -11023,6 +11077,7 @@ def audit_report_cmd(
       ask audit-report . --profile prod --format markdown
       ask audit-report . --sign-key audit.key -o audit-report.json
     """
+    _require_answer_delivery("audit-report")
     from sourcecode.audit_report import build_audit_report, render_markdown
 
     path = _admit_path(path)
@@ -14138,7 +14193,7 @@ def config_cmd(
     _answer = _TextAnswer(output_path)
     _answer.say(f"ask {__version__}")
     _answer.say(f"Config:    {config_file_path()}")
-    _answer.say(f"Telemetry: {'enabled' if is_enabled() else 'disabled'} (off by default; opt-in)")
+    _answer.say(f"Telemetry: {'enabled' if is_enabled() else 'disabled'} (on by default; disable with `ask telemetry disable`)")
     _answer.say("")
 
     # F-AX: the declaration may sit outside the analysed tree, and *which* file
@@ -16406,8 +16461,10 @@ def main_entry() -> None:
     try:
         # prog_name pins usage/help to the canonical `ask`, whatever the alias.
         app(prog_name="ask")
+        _fail_on_missing_required_answer(0)
         _fail_on_unkept_output_promise(0)
     except SystemExit as _sysexit:
+        _fail_on_missing_required_answer(_sysexit.code)
         _fail_on_unkept_output_promise(_sysexit.code)
         raise
     except WriteRefused as _refused:

sourcecode/data_exposure.py

@@ -253,10 +253,30 @@ def build_data_exposure(
     rows: dict[str, dict] = {}
     seeds_report: list[dict] = []
 
+    # Every seed answers a different reachability question over the same CIR.
+    # `run_impact_chain` accepts a prepared model precisely so that a declaration
+    # with several types does not rebuild the repository-wide semantic indexes
+    # once per type. Build lazily: declarations whose labels do not resolve keep
+    # the existing failure isolation in `run_impact_chain`.
+    impact_model = model
+
     for label in decl.labels:
         for seed in label.seed_types:
             found_signature = _signature_routes(graph, seed, handlers)
-            chain = run_impact_chain(cir, seed, root=root, model=model, depth=depth)
+            if impact_model is None:
+                try:
+                    from sourcecode.spring_model import SpringSemanticModel
+
+                    impact_model = SpringSemanticModel.build(cir)
+                except Exception:
+                    # `run_impact_chain` owns its error envelope. Retaining None
+                    # here preserves that per-seed fallback if the model cannot be
+                    # assembled instead of turning a partial exposure answer into
+                    # a command failure.
+                    pass
+            chain = run_impact_chain(
+                cir, seed, root=root, model=impact_model, depth=depth,
+            )
             resolution = str(getattr(chain, "resolution", "not_found"))
             reached = list(getattr(chain, "endpoints_affected", []) or [])
 

sourcecode/endpoint_disposition.py

@@ -220,7 +220,7 @@ class DispositionSummary:
         return summary
 
     def to_dict(self) -> dict:
-        return {
+        out = {
             "affected": self.affected,
             "unknown": self.unknown,
             "unaffected": self.unaffected,
@@ -230,6 +230,11 @@ class DispositionSummary:
                 "three counts sum to `total`, so the negative set is published "
                 "rather than left to subtraction (P0-3)"
             ),
-            "unaffected_basis": UNAFFECTED_BASIS,
             "blockers": [b.to_dict() for b in self.blockers],
         }
+        # A basis is evidence for the published negative set, not boilerplate.
+        # When no route is excluded (or a blocker demotes that whole set), showing
+        # it reads like a certification the report did not earn.
+        if self.unaffected and not self.blockers:
+            out["unaffected_basis"] = UNAFFECTED_BASIS
+        return out

sourcecode/hibernate_strat.py

@@ -1108,7 +1108,14 @@ def analyze_hibernate(file_paths: list[str], root: Path) -> HibernateStratificat
     # right (it is the Spring Boot default) and was wrong in the field case that
     # billed 45.6 rewrite days to an EclipseLink repository.
     hibernate_evidence = dep_present or any_hibernate_import
-    transitive_starter_evidence = jpa_starter_present and not hibernate_evidence
+    # Spring Boot defaults the JPA starter to Hibernate, but an explicit provider
+    # declaration overrides that default. Treating both as evidence made an
+    # EclipseLink project inherit a fictional Boot-2 Hibernate-5 rewrite axis.
+    transitive_starter_evidence = (
+        jpa_starter_present
+        and not hibernate_evidence
+        and not competing_providers
+    )
     inferred_from_jpa_only = any_jpa_import and not hibernate_evidence and not transitive_starter_evidence
     # Another declared provider refutes the inference outright. It cannot refute
     # direct evidence: a repository may legitimately carry both.

sourcecode/mcp/runner.py

@@ -7,11 +7,15 @@ lookup, no process fork, no stdout encoding issues.
 from __future__ import annotations
 
 import json
+import threading
 from typing import Any
 
 from typer.testing import CliRunner
 
 _runner = CliRunner()
+# CliRunner temporarily replaces process-global stdout/stderr.  MCP dispatches
+# tools concurrently, so every in-process invocation must share this lock.
+_runner_lock = threading.RLock()
 
 
 class CommandError(RuntimeError):
@@ -44,7 +48,8 @@ def run_command(args: list[str]) -> Any:
     # Pass raw args to invoke — the _cmd_main hook inside cli.py handles path
     # extraction via _preprocess_args. Pre-processing here would strip the path
     # from args, then _cmd_main would re-process the stripped list and lose it.
-    result = _runner.invoke(app, list(args))
+    with _runner_lock:
+        result = _runner.invoke(app, list(args))
 
     if result.exit_code != 0:
         stdout_raw = getattr(result, "output", "")

sourcecode/mcp/server.py

@@ -51,9 +51,8 @@ def _record_tool_invocation(name: Any, success: bool, started: float) -> None:
 
     Aggregate only: which of our own tools ran, whether it succeeded, and a
     duration bucket. Never the arguments — those carry repository paths — and
-    never any result content. Honours the same opt-in as every other event
-    (off until `ask telemetry enable` or SOURCECODE_TELEMETRY=1); when
-    telemetry is off, `record` returns before building anything.
+    never any result content. Honours the same default-on setting as every other
+    event; `ask telemetry disable` or the documented environment controls stop it.
     """
     try:
         import time as _time
@@ -1480,7 +1479,7 @@ def telemetry(action: str) -> dict:
     """Manage telemetry settings.
 
     Maps to: ask telemetry <action>
-    action: one of "status" (show current state), "enable" (opt in), "disable" (opt out).
+    action: one of "status" (show current state), "enable", or "disable".
     Valid values: "status" | "enable" | "disable"
     """
     # FIX-P2-10: enumerate valid actions in docstring so agents don't guess.