sourcecode 5.8.11__tar.gz → 5.8.12__tar.gz

{sourcecode-5.8.11 → sourcecode-5.8.12}/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [5.8.12] — 2026-08-19
+
+*Performance-mitigation and release-hygiene update. The external cross-version
+performance regression remains open until it is reproduced under its controlled
+`saint-server` protocol; this release does not present local warm-cache results
+as that closure.*
+
+### Changed
+- `validation` now reuses the shared Canonical IR for matching repository scopes;
+  `data-exposure` builds its Spring semantic model once per invocation and shares
+  it across declared label seeds.
+- Root help, README and the user guide state cache reuse by command scope rather
+  than promising one universal parse path.
+- `ASK_MAX_ANALYSIS_SECONDS` is documented accurately: it enforces a deadline
+  for `spring-audit`, `risk` and `audit-report`, not every deep command.
+
+### Verified
+- On the local BroadleafCommerce corpus, the final analyzer fingerprint filled
+  the shared CIR in 10.46s and a warm `validation --compact` hit took 4.01s with
+  byte-identical output. This is local cache-state evidence only.
+
 ## [5.8.11] — 2026-08-19
 
 *Packaging re-release after the failed PyPI upload of 5.8.10. No functional or

{sourcecode-5.8.11 → sourcecode-5.8.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.11
+Version: 5.8.12
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -49,7 +49,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.8.11-blue)
+![Version](https://img.shields.io/badge/version-5.8.12-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -102,10 +102,12 @@ intentional. Use `ask audit-report --from-risk risk.json` to package an existing
 risk run instead of recomputing it.
 
 **A budget is honoured, never a veto.** `ASK_MAX_ANALYSIS_SECONDS=<seconds>`
-bounds a repo-wide/deep command. A value below the class floor prints what that
-class typically needs and **runs anyway** — refusing to answer is the opposite of
-this product's doctrine. A run that spends its budget stops on the loop that is
-spending the time, not only between phases: a rule family cut in flight is
+currently bounds the phase-runner commands `spring-audit`, `risk` and
+`audit-report`; it is not a process-wide timeout for every command. A value below
+the class floor prints what that class typically needs and **runs anyway** —
+refusing to answer is the opposite of this product's doctrine. A run that spends
+its budget stops on the loop that is spending the time, not only between phases:
+a rule family cut in flight is
 published as `rules_partially_run` with how far it reached, families that never
 started are named in `rules_not_run`, `_partial` names the phases that completed
 and the ones that did not, and the findings measured before the cut are kept.
@@ -113,7 +115,17 @@ The answer marks itself where the numbers are — `summary.partial`,
 `counts_are_floor`, `counts_basis` — and `confidence_level` is capped at `low`,
 because the confidence of the findings that exist says nothing about the family
 that did not run. Measured on BroadleafCommerce (2 766 Java files): a 4.5s budget
-stops at 1 408 files and ends at 5.1s.
+stops at 1 408 files and ends at 5.1s. Commands outside that phase-runner set
+must not be gated on this variable; their budget applicability remains visible in
+the [defect ledger](docs/DEFECT-LEDGER.md).
+
+**Current performance status.** In 5.8.12, `validation` reuses the shared
+Canonical IR and `data-exposure` reuses one semantic model across all declared
+label seeds. On the local BroadleafCommerce corpus, the final fingerprint filled
+the shared CIR in 10.46s and a warm `validation --compact` run took 4.01s with
+byte-identical output. This is a same-host cache observation, not a replacement
+for the controlled `saint-server` cross-version comparison still tracked in the
+[roadmap](docs/DEVELOPMENT-ROADMAP.md).
 
 **What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
@@ -139,7 +151,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.11 — and, on a build that has aged,
+ask version                    # ask 5.8.12 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.11 → sourcecode-5.8.12}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.8.11-blue)
+![Version](https://img.shields.io/badge/version-5.8.12-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -57,10 +57,12 @@ intentional. Use `ask audit-report --from-risk risk.json` to package an existing
 risk run instead of recomputing it.
 
 **A budget is honoured, never a veto.** `ASK_MAX_ANALYSIS_SECONDS=<seconds>`
-bounds a repo-wide/deep command. A value below the class floor prints what that
-class typically needs and **runs anyway** — refusing to answer is the opposite of
-this product's doctrine. A run that spends its budget stops on the loop that is
-spending the time, not only between phases: a rule family cut in flight is
+currently bounds the phase-runner commands `spring-audit`, `risk` and
+`audit-report`; it is not a process-wide timeout for every command. A value below
+the class floor prints what that class typically needs and **runs anyway** —
+refusing to answer is the opposite of this product's doctrine. A run that spends
+its budget stops on the loop that is spending the time, not only between phases:
+a rule family cut in flight is
 published as `rules_partially_run` with how far it reached, families that never
 started are named in `rules_not_run`, `_partial` names the phases that completed
 and the ones that did not, and the findings measured before the cut are kept.
@@ -68,7 +70,17 @@ The answer marks itself where the numbers are — `summary.partial`,
 `counts_are_floor`, `counts_basis` — and `confidence_level` is capped at `low`,
 because the confidence of the findings that exist says nothing about the family
 that did not run. Measured on BroadleafCommerce (2 766 Java files): a 4.5s budget
-stops at 1 408 files and ends at 5.1s.
+stops at 1 408 files and ends at 5.1s. Commands outside that phase-runner set
+must not be gated on this variable; their budget applicability remains visible in
+the [defect ledger](docs/DEFECT-LEDGER.md).
+
+**Current performance status.** In 5.8.12, `validation` reuses the shared
+Canonical IR and `data-exposure` reuses one semantic model across all declared
+label seeds. On the local BroadleafCommerce corpus, the final fingerprint filled
+the shared CIR in 10.46s and a warm `validation --compact` run took 4.01s with
+byte-identical output. This is a same-host cache observation, not a replacement
+for the controlled `saint-server` cross-version comparison still tracked in the
+[roadmap](docs/DEVELOPMENT-ROADMAP.md).
 
 **What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
@@ -94,7 +106,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.11 — and, on a build that has aged,
+ask version                    # ask 5.8.12 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.11 → sourcecode-5.8.12}/docs/DEFECT-LEDGER.md

@@ -16,20 +16,56 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
-**As of 2026-08-19, the `5.8.11` release commit:** this is the current status of
-the 5.8.9 re-audit queue. The audit observations below remain historical evidence;
-only the table here declares present state.
+**As of 2026-08-19, the external `5.8.11` re-audit:** this is the current status of
+the 5.8.8/5.8.9 audit queue. The subject remained `saint-server` at `3dde0376`, with a
+byte-identical CIR and the same 53/61 invocables exercised. The score is **78/100**
+(75 in 5.8.8, 80 in 5.8.9). The observations below remain historical evidence; only
+this table declares present state.
 
 | Rows | Current status | Evidence |
 |---|---|---|
-| `AUD-588-B01`, `AUD-589-B01`, `C3-122` | **closed** | `20596c8`; failed writes cannot suppress the global output-promise guard, covering both `risk` and `audit-report` emit paths. |
-| `AUD-588-B03` | **closed** | `16a52cc`; `SEC-009`, static `@Profile` evidence and `permit_all_rules` are emitted with regressions. |
-| `AUD-588-B04` | **closed** | `fd34eb1`; `data-exposure` preserves the chain decision for every route. |
+| `AUD-588-B01`, `AUD-589-B01`, `C3-122` | **implemented in 5.8.12** | `9884488` requires `risk` and `audit-report` to deliver stdout or their requested artifact before exit 0; the remaining closure evidence is a field-scale subprocess reproduction. |
+| `AUD-511-R01` / `AUD-588-B03` | **implemented in 5.8.12** | `13362ec` makes SEC-009 read comment-blanked Java, so a Javadoc profile cannot override the live `@Profile("!m3")` declaration. |
+| `AUD-588-B04` | **retracted audit premise** | `data-exposure` correctly preserves `chain_decision`; the reported `coverage_unknown` routes were custom-gate annotations whose application was not configured. `fd34eb1` remains a valid additive disclosure, but no further B04 fix is due. |
 | `AUD-588-B05` | **closed** | `c15f5b6`; changed container-wired components block a false `unaffected` disposition. |
-| `AUD-588-B07` | **closed** | `5cc6ba7`; ASK-09 reads the envelope error contract and covers the wrapped shape. |
+| `AUD-511-R03` / `AUD-588-B07` | **implemented in 5.8.12** | `47aee1e` gives the published `OUTPUT_TOO_LARGE` envelope precedence over an inconsistent process status and preserves the excerpt in every branch. |
 | `AUD-588-B08` | **closed** | `c084555`; `impact` publishes its independent stdout-byte budget. |
-| `AUD-588-B11` (container/units subset) | **closed** | `ca72b61`, `a49cf6a`; plan/compare publish container wiring and impact-chain names security-surface units. |
-| `AUD-588-B02`, `B06`, B11 residuals, `B12` | **open** | Require provider non-coverage verification, remaining contract parity and controlled cost calibration; no closure is inferred from the release. |
+| `AUD-588-B11` (container/units subset) | **partially implemented in 5.8.12** | `d745d31` discovers nested Maven modules; `273ae8e` suppresses unsupported `pr-impact.unaffected_basis`. `impact` naming, source population units, risk tiers and plan narrative remain open. |
+| `AUD-511-R02` / `AUD-589-B02` | **partially mitigated in 5.8.12, still under investigation** | `b93f230` reuses one `SpringSemanticModel` across every declared `data-exposure` seed; `473f47a` routes `validation` through the shared CIR cache, and `91bd0c0` retains subcommand `--no-cache` compatibility. On the local BroadleafCommerce corpus at the final analyzer fingerprint, a first shared-CIR fill took 10.46 s and its warm `validation --compact` hit took 4.01 s with byte-identical output. This is a same-host cache-state observation, not the 5.8.9/5.8.11 external A/B: the six-run C3-120 comparison and the configured `saint-server` reproduction remain required. |
+| `AUD-588-B02`, `B06`, B11 residuals, `B12` | **partially open in 5.8.12** | `3869c87` excludes explicit EclipseLink from Hibernate applicability and effort; `037223e` publishes provider non-coverage. B11 parity and controlled cost calibration remain required. |
+
+### Re-audit Intake: 5.8.11
+
+The third external pass uses the same `saint-server` snapshot (`3dde0376`), read-only
+protocol and warm-cache preparation as 5.8.8 and 5.8.9. The CIR hash is identical across
+all three versions. It exercises 53/61 invocables (87%) and reports 78/100. That makes
+rule, output and execution changes attributable without claiming that the application was
+run or that the eight blocked invocables were covered.
+
+| ID | Priority | Finding | Required correction / verification |
+|---|---|---|---|
+| `AUD-588-B01`, `AUD-589-B01`, `C3-122` | P0 | `risk -o` can exit 0 with no file; `risk` and `audit-report` can finish with empty stdout. The failure has fast and slow composition paths. | Add a real-subprocess invariant: exit 0 must produce parseable stdout or the requested artifact. Exercise `risk` and `audit-report` with and without `-o`, plus budget-cut partial output. |
+| `AUD-511-R01` | P1 regression | SEC-009 takes `@Profile` from comments and reports an active `@Profile("!m3")` request chain as inactive. | Reuse comment-blanked source and declaration-local profile evidence, or consume posture's authority. Regress a misleading javadoc and both positive/negative profile forms. |
+| `AUD-511-R02` / `AUD-589-B02` | P1 investigation | `endpoints`, `impact`, `spring-audit`, `modernize`, `validation` and `timeline` measure 1.4-2.4x slower than 5.8.9; `data-exposure --config` remains high. | **Partial implementation:** `b93f230` shares the data-exposure semantic model across seeds and `473f47a` makes `validation` reuse the shared CIR; `91bd0c0` confirms `--no-cache` remains a compatibility no-op. Re-run the idle-host, isolated-cache, interleaved-control protocol against the audited `saint-server` configuration before attributing or closing the field regression. |
+| `AUD-511-R03`, `AUD-588-B07` | P1 regression | ASK-09 reports `not_applicable` even though its literal probe emits `OUTPUT_TOO_LARGE` 12x above the ceiling. | Derive branch selection exclusively from the output envelope. Publish `observed_payload_excerpt` for pass, fail, error and not-applicable rows. |
+| `AUD-588-B02` + `B06` | P1 | The EclipseLink repository still receives Hibernate readiness, rewrite-zone classification and 32.9-66.2 person-days; `non_coverage` is null. | A declared competing provider must remove the Hibernate axis from readiness, effort and classification and add provider non-coverage. EclipseLink automation remains out of scope. |
+| `AUD-588-B11` residual | P2 | `impact.matched_fqns` mixes exact resolution with 235 implementations; `migrate-recipe` misses nested Maven manifests; source-file populations lack units; `risk` tier labels diverge; plan/pr-impact prose trails their new container facts. | Bind consumers to established authorities, name populations and units, and add cross-command parity tests. Do not add parallel detection. |
+| `AUD-588-B12` | P2 | 5.1.0 anchors disagree in both directions with 5.8.11 measurements; `timeline` is advertised as foreground despite a 404s sample. | Recalibrate only after controlled measurements and align foreground advice with the explicit opt-in progress policy. |
+
+### Feature Recommendations: 5.8.11
+
+| ID | Recommendation | Current decision |
+|---|---|---|
+| `AUD-588-F01` | EclipseLink/JPA-provider migration axis. | **Deferred product feature.** First close B02/B06 so the current Hibernate answer is honest about non-coverage. |
+| `AUD-588-F02` | Shared answer-contract authority for profiles, units, populations, caveats and container reach. | **Partial.** The SEC-009 regression and B11 residuals show that new consumers are still re-deriving facts. |
+| `AUD-588-F03` | Versioned cost model by repository size and cache state. | **Partial.** Existing dimensions do not make stale 5.1.0 anchors operationally safe; controlled remeasurement is prerequisite. |
+| `AUD-588-F04` | Default foreground heartbeat without corrupting machine output. | **Explicit opt-in by decision.** Until revised, cost advice must not imply that long commands emit progress by default. |
+| `AUD-588-F05` | Raise audit coverage through safe operational paths and dirty-tree `verify-edit`. | **Locally verified only.** The external run remains 53/61; treat dirty-tree behavior as a validation gap, not a closed product claim. |
+
+**Recommended order:** composition-output invariant → SEC-009 profile regression → controlled
+performance measurement → EclipseLink applicability/non-coverage → ASK-09 → B11 narrative
+and parity residuals → cost-model calibration. Keep B04 closed as a retracted premise, and
+do not implement EclipseLink migration automation as part of this bug battery.
 
 **As of 2026-08-19, the `5.8.9` release commit:** the latest audit queue was implemented in
 committed post-5.8.7 fixes. This table is

{sourcecode-5.8.11 → sourcecode-5.8.12}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,19 +3,29 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT STATE — 2026-08-19 — 5.8.11 release**
->
-> The 5.8.9 re-audit battery closed the reproducible output, envelope, security-chain
-> and container-reach defects in atomic commits. `20596c8` fixes the output-promise
-> seam; `16a52cc` adds `SEC-009` and profile evidence; `fd34eb1`, `c15f5b6`,
-> `5cc6ba7`, `c084555`, `ca72b61` and `a49cf6a` close the independent consumer
-> regressions. Targeted cross-command regression suites pass.
->
-> Remaining work is explicit: provider-specific migration non-coverage (`B02/B06`),
-> the unresolved portions of answer-contract parity (`B11`), controlled cost-model
-> recalibration and the opt-in progress decision (`B12`). EclipseLink migration support
-> remains a deferred feature, not a bug fix. Historical 5.8.9 intake tables below are
-> superseded by this block where their statuses differ.
+> **CURRENT STATE — 2026-08-19 — 5.8.12 release**
+>
+> The external 5.8.11 re-audit scores **78/100** over the same byte-identical
+> `saint-server` CIR and 53/61 invocables. It refutes two closures, exposes one new
+> security regression and measures a cross-command performance regression. The release
+> fixes remain valuable where verified: B05, B08 and the container/units B11 subset hold;
+> the B04 `data-exposure` premise is retracted by the auditor after configuration-based
+> verification. Historical tables below are superseded by this block where statuses differ.
+>
+> | Priority | Work | Acceptance direction |
+> |---|---|---|
+> | P0 | `AUD-588-B01` / `AUD-589-B01` / `C3-122`: silent composition exits in `risk` and `audit-report`. | **Implemented in 5.8.12:** `9884488` turns an exit-0 return without delivered output into a typed failure. Field-scale subprocess reproduction remains required. |
+> | P1 | `AUD-511-R01`: SEC-009 profile evidence reads comments. | **Implemented in 5.8.12:** `13362ec` uses comment-blanked Java and regresses a misleading Javadoc. |
+> | P1 | `AUD-511-R02`: 1.4-2.4x performance slowdown. | **Partially mitigated in 5.8.12:** `b93f230` shares the `data-exposure` semantic model across label seeds; `473f47a` gives `validation` the shared CIR cache; `91bd0c0` preserves the published `--no-cache` no-op. Local Broadleaf warm validation is lower, but controlled 5.8.9/5.8.11 remeasurement remains the acceptance gate. |
+> | P1 | `AUD-511-R03`: ASK-09 false `not_applicable`. | **Implemented in 5.8.12:** `47aee1e` uses the emitted envelope as authority and retains evidence for every result. |
+> | P1 | `AUD-588-B02/B06`: EclipseLink is billed a Hibernate migration. | **Implemented in 5.8.12:** `3869c87` excludes the axis; `037223e` publishes the unsupported-provider gap. |
+> | P2 | `AUD-588-B11` residuals and `B12`. | `d745d31` and `273ae8e` close nested-build discovery and false exclusion prose. Finish naming/population/tier/plan parity, then recalibrate cost advice under controlled evidence. |
+>
+> **Feature decisions:** `F01` (EclipseLink migration automation) remains deferred, but
+> provider non-coverage is a prerequisite bug fix. `F02` is partial and must consolidate
+> existing authorities rather than re-derive facts. `F03` is partial pending calibrated
+> measurements. `F04` remains opt-in, so foreground advice must not imply a heartbeat.
+> `F05` remains locally verified only; dirty-tree `verify-edit` is a validation gap.
 
 > **CURRENT STATE — 2026-08-19 — 5.8.9 working tree**
 >

{sourcecode-5.8.11 → sourcecode-5.8.12}/docs/EXECUTIVE-ROADMAP.md

@@ -5,10 +5,10 @@ director; no internal implementation knowledge assumed.*
 
 > **DOCUMENT STATUS — 2026-08-19**
 >
-> The current release is **5.8.11**. It closes the reproducible output-delivery,
-> security-chain, selftest-envelope and container-reach defects from the 5.8.9
-> re-audit. The 5.8.7 and 5.8.9 findings below are historical evidence and must be
-> read with this status block.
+> The current release is **5.8.12**. Its external re-audit scores **78/100** on the
+> same repository and protocol as the two prior rounds (75, then 80). The repository
+> model is byte-identical, so the reported changes are execution, rule or presentation
+> behavior. This block supersedes earlier release claims where they conflict.
 >
 > **Closed in the current working tree:** `B23`, `B24`, `B25`, `B26`, `B27`, `B28`, the
 > `C4-25` residual, `C4-27`, `C4-28`, additive `C1-49`, and `C3-130` for `plan`/`cold-start`,
@@ -19,17 +19,40 @@ director; no internal implementation knowledge assumed.*
 > profiling, compatibility-window or host-specific CI work, not an unresolved bug from that
 > audit. Historical scores and release claims below remain historical; this block is current.
 
-> **5.8.11 AUDIT REMEDIATION**
+> **5.8.11 RE-AUDIT CORRECTION**
 >
-> A requested output file now either exists or the command returns a typed failure;
-> `selftest` can validate a genuine output-ceiling refusal; security exceptions and
-> their static profile conditions are visible as findings; and change-planning views
-> retain container-driven reach instead of treating it as an empty call cone. The
-> release also distinguishes the token ceiling from `impact`'s independent byte cap.
+> The re-audit confirms the container-reach correction (`pr-impact`, `plan`, `compare`),
+> the independent `impact` byte budget and the `impact-chain` security-surface unit.
+> It also retracts the earlier `data-exposure` premise: routes reported as
+> `coverage_unknown` were custom-gate annotations whose runtime application had not been
+> declared, not lost `permit_all` decisions.
 >
-> The open roadmap is narrower: provider-specific EclipseLink migration disclosure,
-> residual cross-command parity and controlled cost calibration. EclipseLink migration
-> automation remains a future product capability rather than a claim of this release.
+> Three priorities replace the previous closure claim. First, `risk` and `audit-report`
+> can still return success with no usable stdout or requested file. Second, the new
+> `SEC-009` profile evidence can read a comment and mark the active public chain inactive.
+> Third, controlled measurements show a 1.4-2.4x slowdown in several commands. The
+> selftest ceiling row is also reopened: it now hides a genuine refusal as
+> `not_applicable`.
+>
+> EclipseLink migration automation remains a future product capability. Its prerequisite
+> is not optional: current migration readiness must stop charging an inapplicable
+> Hibernate axis and publish the unsupported-provider gap. Shared answer contracts,
+> calibrated cost advice and foreground-progress policy remain partial work, not release
+> claims.
+
+> **IMPLEMENTATION UPDATE — released in 5.8.12**
+>
+> The output invariant (`9884488`), comment-safe SEC-009 profile evidence (`13362ec`),
+> ASK-09 envelope precedence (`47aee1e`), EclipseLink applicability and disclosure
+> (`3869c87`, `037223e`), nested Maven discovery (`d745d31`) and guarded negative-set
+> prose (`273ae8e`) are implemented with targeted regressions. Performance work has also
+> landed but is not called closed: `b93f230` removes one semantic-model rebuild per
+> `data-exposure` label seed, `473f47a` lets `validation` reuse the shared repository
+> model, and `91bd0c0` preserves the documented `--no-cache` compatibility behavior.
+> A local BroadleafCommerce warm cache hit measured 4.01 s for `validation --compact`
+> after a 10.46 s first shared-CIR fill, with byte-identical output; this is not an
+> external-version comparison. The controlled performance A/B, remaining B11 parity and
+> field-scale validation of the composition paths still prevent declaring the roadmap clean.
 
 > **NEW AUDIT INTAKE — ASK 5.8.8 / `saint-server` — 2026-08-19**
 >

{sourcecode-5.8.11 → sourcecode-5.8.12}/docs/USER_GUIDE.md

@@ -39,10 +39,12 @@ Evidence            — every answer is backed by auditable evidence, not a gues
 CLI commands        — impact, endpoints, spring-audit, explain, … each a projection
 ```
 
-The key idea: **the source is parsed once** into the Semantic IR; everything above that is
-computed from the IR, cached, and shared. `impact`, `endpoints`, and `spring-audit` are not
-three analyzers — they are three questions asked of the same graph. (The extraction and
-consumption contract is fixed in the architecture ADRs 0001–0004 under `docs/architecture/`.)
+The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
+where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
+warm buys for each command rather than implying that every projection costs the same. In
+5.8.12, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+model across all declared label seeds. (The extraction and consumption contract is fixed in
+the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 ---
 
@@ -136,7 +138,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.11
+# ask 5.8.12
 ```
 
 Requires Python 3.9+.
@@ -1482,10 +1484,12 @@ the tree. Set `ASK_RUNS_IN_REPO=1` only when `.ask/runs` belongs in that
 repository's own artefacts, or `ASK_RUNS_DIR=/path/to/runs` to choose an external
 location explicitly.
 
-**Large-repo budgets.** Set `ASK_MAX_ANALYSIS_SECONDS=<seconds>` to bound a
-repo-wide or deep command. The budget is **honoured, not vetoed**: if the value
-is below the class floor ASK says so on stderr and runs anyway, and a run that
-spends its budget publishes what it measured with
+**Large-repo budgets.** Set `ASK_MAX_ANALYSIS_SECONDS=<seconds>` to bound the
+phase-runner commands `spring-audit`, `risk` and `audit-report`. It is not a
+process-wide timeout for every repo-wide or deep command. The budget is
+**honoured, not vetoed**: if the value is below the class floor ASK says so on
+stderr and runs anyway, and a run that spends its budget publishes what it
+measured with
 
 ```json
 "_partial": {"partial": true,
@@ -1505,7 +1509,9 @@ inventories `rules_run` / `rules_not_run` with `rules_run_count` and
 stops at 1 408 files inside the `SEC-004` group and ends at 5.1s.
 
 Every count in such an answer is a floor over what ran — a family or phase that
-never ran is named, never reported as an absence of findings. The mark lives
+never ran is named, never reported as an absence of findings. Commands outside
+that phase-runner set are not bounded by this variable and must not be CI-gated
+on it. The mark lives
 where the numbers are as well as at the root: `summary.partial`,
 `summary.counts_are_floor` and `summary.counts_basis`, with
 `confidence_level` capped at `low` and `confidence_basis` saying the cut is the

{sourcecode-5.8.11 → sourcecode-5.8.12}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.8.11"
+version = "5.8.12"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.8.11 → sourcecode-5.8.12}/scripts/perf_harness.py

@@ -116,6 +116,8 @@ def build_argv(command: str, repo_path: Path, cold: bool) -> list[str]:
     argv = [ASK_BIN]
     if command:
         argv.append(command)
+    if command == perf.CONTROL_COMMAND:
+        argv += list(perf.STEADY_CONTROL_POSITIONAL_ARGS)
     argv.append(str(repo_path))
     argv += ["--format", "json"]
     # C3-110: some commands need an argument to be measurable at all, and the one
@@ -247,6 +249,18 @@ def measure_steady(
     Nothing here decides whether a release is fast. It decides whether the
     numbers are measurements at all — an unconverged sample publishes no figure.
     """
+    if repo_path.name != perf.STEADY_CONTROL_REPOSITORY:
+        return {
+            "schema_version": "perf-steady-v1",
+            "tool_version": TOOL_VERSION,
+            "protocol": perf.measurement_protocol(),
+            "measured": False,
+            "reason": (
+                "the steady protocol control is pinned to "
+                f"{perf.STEADY_CONTROL_REPOSITORY}, not {repo_path.name}; "
+                "choose the declared corpus or add a separately validated control"
+            ),
+        }
     host = perf.host_verdict()
     if not host["idle_enough"] and not allow_busy_host:
         return {

{sourcecode-5.8.11 → sourcecode-5.8.12}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.11"
+__version__ = "5.8.12"

{sourcecode-5.8.11 → sourcecode-5.8.12}/src/sourcecode/audit_recipe.py

@@ -127,6 +127,11 @@ MANUAL_BASIS: "dict[str, str]" = {
         "clause) and an injection sink for a value, and an executor cannot tell "
         "them apart without the caller's intent"
     ),
+    "SEC-009": (
+        "whether an anonymous request matcher is intentional depends on the "
+        "deployment profile and authorization policy, so removing it would be "
+        "an unreviewed behaviour change rather than a safe rewrite"
+    ),
     "DEAD-001": (
         "a disabled security control is a decision somebody made; re-enabling it "
         "changes runtime behaviour nobody has measured here"

{sourcecode-5.8.11 → sourcecode-5.8.12}/src/sourcecode/cache_model.py

@@ -653,9 +653,9 @@ def cost_sentence() -> str:
         f"files, and a repository-wide audit measured {seconds:g} s on a "
         f"{_thousands(FIELD_ANCHOR_JAVA_FILES)}-file repository "
         f"({FIELD_ANCHOR_MEASURED_VERSION}{stale}).{gate} `ask cache model` prints "
-        f"the figure and the build behind it for every command; "
-        f"ASK_MAX_ANALYSIS_SECONDS/ASK_PROGRESS bound and narrate a run where CI "
-        f"wants an explicit budget."
+        f"the figure and the build behind it for every command; ASK_PROGRESS "
+        f"narrates supervised work, while ASK_MAX_ANALYSIS_SECONDS bounds only "
+        f"the phase-runner commands (spring-audit, risk and audit-report)."
     )
 
 

{sourcecode-5.8.11 → sourcecode-5.8.12}/src/sourcecode/cli.py

@@ -572,7 +572,8 @@ def _build_help_text(scope: "Optional[Any]" = None) -> str:
 
 Deterministic Java/Spring semantics and reusable structural context for AI coding agents.
 
-Cache warms on first scan; later calls reuse pre-built context instead of rescanning.
+Content-addressed parse and context caches reuse prior knowledge where a command's
+scope matches; `ask cache model` says exactly what a warm buys per command.
 {_cost_sentence()}
 
 {_start_here_block(scope)}
@@ -584,6 +585,12 @@ Cache warms on first scan; later calls reuse pre-built context instead of rescan
   ask --compact --git-context  [dim]# + git hotspots and uncommitted files[/dim]
   ask --agent                  [dim]# full structured JSON for AI agents[/dim]
 
+[bold]Performance / CI:[/bold]
+  validation . --compact       [dim]# reuses the shared CIR on a warm matching scope[/dim]
+  data-exposure .              [dim]# one semantic model is shared across declared label seeds[/dim]
+  ASK_MAX_ANALYSIS_SECONDS=N   [dim]# deadline only for spring-audit, risk, audit-report[/dim]
+  [dim]Other commands are not time-bounded by this variable; use `--progress` or `--detach` where offered.[/dim]
+
 [bold]Change and risk:[/bold]
   impact-chain <Class> .       [dim]# blast radius; TX/SEC findings opt-in[/dim]
   impact <Class> .             [dim]# reverse deps → endpoints reached[/dim]
@@ -1954,6 +1961,7 @@ def _output_ceiling_error(content: str, *, to_file: bool) -> "Optional[dict[str,
 #: that cannot produce the file it was asked for must not be able to say it did.
 _OUTPUT_PROMISED: "Optional[str]" = None
 _OUTPUT_DELIVERED: bool = False
+_ANSWER_REQUIRED_BY: "Optional[str]" = None
 
 
 def _record_output_promise(argv: "list[str]") -> None:
@@ -1966,9 +1974,10 @@ def _record_output_promise(argv: "list[str]") -> None:
     parser owns that. It is used only to ask, at the end, whether a file the run
     promised exists.
     """
-    global _OUTPUT_PROMISED, _OUTPUT_DELIVERED
+    global _OUTPUT_PROMISED, _OUTPUT_DELIVERED, _ANSWER_REQUIRED_BY
     _OUTPUT_PROMISED = None
     _OUTPUT_DELIVERED = False
+    _ANSWER_REQUIRED_BY = None
     for i, token in enumerate(argv):
         value: "Optional[str]" = None
         if token in ("--output", "-o"):
@@ -1987,6 +1996,36 @@ def _mark_output_delivered() -> None:
     _OUTPUT_DELIVERED = True
 
 
+def _require_answer_delivery(command: str) -> None:
+    """Require a composed-report command to publish an answer before exit 0.
+
+    A file promise catches only ``-o``. Risk composition also has a stdout
+    contract: a successful invocation must leave one parseable document behind.
+    Keeping that obligation opt-in avoids changing intentionally quiet commands
+    while covering both expensive composition surfaces.
+    """
+    global _ANSWER_REQUIRED_BY
+    _ANSWER_REQUIRED_BY = command
+
+
+def _fail_on_missing_required_answer(exit_code: object) -> None:
+    """Turn a silent successful composed run into a typed failure (C3-122)."""
+    if exit_code not in (0, None) or _OUTPUT_DELIVERED or not _ANSWER_REQUIRED_BY:
+        return
+    _emit_error_json(
+        EXECUTION_FAILED_CODE,
+        f"{_ANSWER_REQUIRED_BY} finished without publishing an answer.",
+        hint=(
+            "The command returned successfully before its output was delivered. "
+            "Re-run with progress enabled and report the invocation; a composed "
+            "report must produce parseable stdout or its requested file."
+        ),
+        command=_ANSWER_REQUIRED_BY,
+        expected="parseable stdout or the requested output artifact",
+    )
+    raise SystemExit(1)
+
+
 def _fail_on_unkept_output_promise(exit_code: object) -> None:
     """Refuse to report success for an answer that was never produced (C3-122).
 
@@ -7946,11 +7985,22 @@ def validation_cmd(
     target = _admit_path(path)
 
     from sourcecode.context_graph import ContextGraph
+    from sourcecode.repository_ir import find_java_files
     from sourcecode.validation_surface import build_validation_surface
     _prog = Progress()
     _prog.start("mapping validation surface")
-    # Structural facts come from the ContextGraph — the single access layer.
-    _graph = ContextGraph.build_from_root(target)
+    # Structural facts still come from the ContextGraph — the single access
+    # layer — but its CIR now follows the shared knowledge-cache door used by
+    # the other repository-wide commands. A validation run therefore does not
+    # parse the same tree again after `cache warm`, `impact`, or `explain`.
+    # `--no-cache` remains the published no-op for subcommands; the direct build
+    # is strictly the best-effort fallback if the shared layer cannot answer.
+    try:
+        from sourcecode.context_cache import shared_cir
+
+        _graph = ContextGraph.from_cir(shared_cir(target, find_java_files(target)))
+    except Exception:
+        _graph = ContextGraph.build_from_root(target)
     data = build_validation_surface(target, graph=_graph)
 
     # P1-C: classify the request-body validation *pattern* so a repo with a
@@ -10666,6 +10716,7 @@ def risk_cmd(
       ask risk . --table --rule SEC-008 --band high --top-n 20
       ask risk . --limit 10 -o risk.json
     """
+    _require_answer_delivery("risk")
     _apply_jobs(jobs)
     from sourcecode.risk import build_risk
 
@@ -11023,6 +11074,7 @@ def audit_report_cmd(
       ask audit-report . --profile prod --format markdown
       ask audit-report . --sign-key audit.key -o audit-report.json
     """
+    _require_answer_delivery("audit-report")
     from sourcecode.audit_report import build_audit_report, render_markdown
 
     path = _admit_path(path)
@@ -16406,8 +16458,10 @@ def main_entry() -> None:
     try:
         # prog_name pins usage/help to the canonical `ask`, whatever the alias.
         app(prog_name="ask")
+        _fail_on_missing_required_answer(0)
         _fail_on_unkept_output_promise(0)
     except SystemExit as _sysexit:
+        _fail_on_missing_required_answer(_sysexit.code)
         _fail_on_unkept_output_promise(_sysexit.code)
         raise
     except WriteRefused as _refused:

{sourcecode-5.8.11 → sourcecode-5.8.12}/src/sourcecode/data_exposure.py

@@ -253,10 +253,30 @@ def build_data_exposure(
     rows: dict[str, dict] = {}
     seeds_report: list[dict] = []
 
+    # Every seed answers a different reachability question over the same CIR.
+    # `run_impact_chain` accepts a prepared model precisely so that a declaration
+    # with several types does not rebuild the repository-wide semantic indexes
+    # once per type. Build lazily: declarations whose labels do not resolve keep
+    # the existing failure isolation in `run_impact_chain`.
+    impact_model = model
+
     for label in decl.labels:
         for seed in label.seed_types:
             found_signature = _signature_routes(graph, seed, handlers)
-            chain = run_impact_chain(cir, seed, root=root, model=model, depth=depth)
+            if impact_model is None:
+                try:
+                    from sourcecode.spring_model import SpringSemanticModel
+
+                    impact_model = SpringSemanticModel.build(cir)
+                except Exception:
+                    # `run_impact_chain` owns its error envelope. Retaining None
+                    # here preserves that per-seed fallback if the model cannot be
+                    # assembled instead of turning a partial exposure answer into
+                    # a command failure.
+                    pass
+            chain = run_impact_chain(
+                cir, seed, root=root, model=impact_model, depth=depth,
+            )
             resolution = str(getattr(chain, "resolution", "not_found"))
             reached = list(getattr(chain, "endpoints_affected", []) or [])