sourcecode 5.8.12__tar.gz → 5.8.14__tar.gz

{sourcecode-5.8.12 → sourcecode-5.8.14}/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## [5.8.14] — 2026-08-20
+
+*Fourth-audit remediation release. The external `5.8.13` audit subject remains
+the evidence for outstanding field reproduction and performance work.*
+
+### Fixed
+- ASK-09 selftest now reads typed error documents from either stdout or stderr
+  and clears inherited execution controls that would change the ceiling probe.
+- Migration readiness names only dimensions that actually participate in its
+  aggregate, so an EclipseLink repository does not describe an excluded Hibernate
+  axis as an input.
+- `impact` separates directly resolved targets from expanded analysis seeds and
+  implementation classes. `plan` and `compare` retain the expanded cone while
+  publishing container-wired components in their checklist and cost dimensions.
+
+### Changed
+- `risk` now publishes its composition working set: source files, audit findings,
+  candidate defects and composed defects. This instruments the rare field-scale
+  zero-output report without claiming it is closed before reproduction.
+- The roadmap and defect ledger distinguish these shipped changes from the two
+  remaining field-gated items: `risk` output reproduction and controlled
+  `data-exposure --config` performance measurement.
+
+## [5.8.13] — 2026-08-20
+
+*MCP reliability release after deep multi-repository stress testing.*
+
+### Fixed
+- Concurrent MCP tool calls can no longer leak one invocation's CLI JSON to the
+  MCP host process. The in-process `CliRunner` invocation is serialized because
+  its stdout/stderr capture is process-global; each caller now receives only its
+  own response envelope.
+
+### Verified
+- The MCP regression suite passes, including a concurrent-runner regression and
+  live concurrent calls to `endpoints`, `validation` and `version` against the
+  testing corpus.
+
 ## [5.8.12] — 2026-08-19
 
 *Performance-mitigation and release-hygiene update. The external cross-version

{sourcecode-5.8.12 → sourcecode-5.8.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.12
+Version: 5.8.14
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -49,7 +49,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.8.12-blue)
+![Version](https://img.shields.io/badge/version-5.8.14-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -151,7 +151,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.12 — and, on a build that has aged,
+ask version                    # ask 5.8.14 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -580,18 +580,16 @@ ask config              # version, config file path, telemetry status
 ask config /repo        # + the repository's own sourcecode.config.json:
                         #   data labels, custom security annotations,
                         #   and any declaration that could not be used
-ask telemetry enable    # anonymous telemetry is OFF by default (opt-in)
+ask telemetry enable    # ensure anonymous telemetry is enabled
 ```
 
-**Nothing is collected or transmitted unless you turn telemetry on** — not on the first run,
-not in CI. If you do opt in, it collects version, OS, commands, flags, duration, repo-size
-range, and errors: **no source code, paths, secrets, or output**. Turn it off again with
+**Anonymous telemetry is ON by default**. It collects version, OS, commands, flags, duration,
+repo-size range, and errors: **no source code, paths, secrets, or output**. Turn it off with
 `ask telemetry disable`, `export SOURCECODE_TELEMETRY=0`, or `DO_NOT_TRACK=1`.
 
-> **Auditing someone else's code — regulated, client-owned or public-sector?** Nothing to do.
-> Telemetry was opt-out until 3.3.0; it is opt-in now (`docs/DEFECT-LEDGER.md` P-1), because a
-> default you must remember to disable is the wrong default for third-party code. An explicit
-> choice you made before is unchanged.
+> **Auditing someone else's code — regulated, client-owned or public-sector?** Set
+> `SOURCECODE_TELEMETRY=0` before the run. The setting is explicit, local and honored before
+> any event is sent.
 
 **A question is not a write — `--no-write` / `ASK_READONLY=1`.** One contract over
 every command: nothing is created inside the analysed repository, and a command

{sourcecode-5.8.12 → sourcecode-5.8.14}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.8.12-blue)
+![Version](https://img.shields.io/badge/version-5.8.14-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -106,7 +106,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.12 — and, on a build that has aged,
+ask version                    # ask 5.8.14 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -535,18 +535,16 @@ ask config              # version, config file path, telemetry status
 ask config /repo        # + the repository's own sourcecode.config.json:
                         #   data labels, custom security annotations,
                         #   and any declaration that could not be used
-ask telemetry enable    # anonymous telemetry is OFF by default (opt-in)
+ask telemetry enable    # ensure anonymous telemetry is enabled
 ```
 
-**Nothing is collected or transmitted unless you turn telemetry on** — not on the first run,
-not in CI. If you do opt in, it collects version, OS, commands, flags, duration, repo-size
-range, and errors: **no source code, paths, secrets, or output**. Turn it off again with
+**Anonymous telemetry is ON by default**. It collects version, OS, commands, flags, duration,
+repo-size range, and errors: **no source code, paths, secrets, or output**. Turn it off with
 `ask telemetry disable`, `export SOURCECODE_TELEMETRY=0`, or `DO_NOT_TRACK=1`.
 
-> **Auditing someone else's code — regulated, client-owned or public-sector?** Nothing to do.
-> Telemetry was opt-out until 3.3.0; it is opt-in now (`docs/DEFECT-LEDGER.md` P-1), because a
-> default you must remember to disable is the wrong default for third-party code. An explicit
-> choice you made before is unchanged.
+> **Auditing someone else's code — regulated, client-owned or public-sector?** Set
+> `SOURCECODE_TELEMETRY=0` before the run. The setting is explicit, local and honored before
+> any event is sent.
 
 **A question is not a write — `--no-write` / `ASK_READONLY=1`.** One contract over
 every command: nothing is created inside the analysed repository, and a command

{sourcecode-5.8.12 → sourcecode-5.8.14}/SECURITY.md

@@ -91,4 +91,6 @@ Third-party dependencies (`typer`, `ruamel.yaml`, etc.) could contain vulnerabil
 
 ## Telemetry and privacy
 
-Telemetry is **opt-in only** and disabled by default. If enabled, only anonymous usage metadata is collected — never code, paths, or content. See [docs/privacy.md](docs/privacy.md).
+Telemetry is **enabled by default** and can be disabled with `ask telemetry disable`,
+`SOURCECODE_TELEMETRY=0`, or `DO_NOT_TRACK=1`. Only bounded anonymous usage metadata is
+collected — never code, paths, or content. See [docs/privacy.md](docs/privacy.md).

{sourcecode-5.8.12 → sourcecode-5.8.14}/docs/DEFECT-LEDGER.md

@@ -16,23 +16,49 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
-**As of 2026-08-19, the external `5.8.11` re-audit:** this is the current status of
-the 5.8.8/5.8.9 audit queue. The subject remained `saint-server` at `3dde0376`, with a
-byte-identical CIR and the same 53/61 invocables exercised. The score is **78/100**
-(75 in 5.8.8, 80 in 5.8.9). The observations below remain historical evidence; only
-this table declares present state.
+**As of 2026-08-20, release `5.8.14` and the fourth external re-audit:** the audited
+snapshot remains `3dde0376`; the report compares the four audit rounds and scores this one
+**90/100** (75, 80, 78, 90). It exercised 53/61 invocables (87%), ran no application and
+left the repository unchanged. Its 40+ longitudinal functional anchors are unchanged, so
+there is no reported product regression. The `5.8.14` release ships the implementations
+recorded below; they remain distinguished from facts verified on the `5.8.13` subject.
+Only this table declares present state.
+
+**Release status:** entries marked “pending `5.8.14`” in their historical wording are
+shipped in `5.8.14`; a re-audit is still required wherever the row says so.
 
 | Rows | Current status | Evidence |
 |---|---|---|
-| `AUD-588-B01`, `AUD-589-B01`, `C3-122` | **implemented in 5.8.12** | `9884488` requires `risk` and `audit-report` to deliver stdout or their requested artifact before exit 0; the remaining closure evidence is a field-scale subprocess reproduction. |
+| `AUD-588-B01` / `AUD-589-B01`, `C3-122` | **open, P0 for `risk`; `audit-report` corrected** | `9884488` corrected `audit-report` to refuse with typed `OUTPUT_TOO_LARGE` and produce its requested artifact. `risk` nevertheless exited 0 twice on the first shared-cache invocations with 0 bytes and no `-o` file, then succeeded seven times. `5cfa9ba` now publishes the source, audit-finding, candidate-defect and composed-defect working set, including partial answers. Repeat the real entry-point protocol before closure. |
 | `AUD-511-R01` / `AUD-588-B03` | **implemented in 5.8.12** | `13362ec` makes SEC-009 read comment-blanked Java, so a Javadoc profile cannot override the live `@Profile("!m3")` declaration. |
 | `AUD-588-B04` | **retracted audit premise** | `data-exposure` correctly preserves `chain_decision`; the reported `coverage_unknown` routes were custom-gate annotations whose application was not configured. `fd34eb1` remains a valid additive disclosure, but no further B04 fix is due. |
 | `AUD-588-B05` | **closed** | `c15f5b6`; changed container-wired components block a false `unaffected` disposition. |
-| `AUD-511-R03` / `AUD-588-B07` | **implemented in 5.8.12** | `47aee1e` gives the published `OUTPUT_TOO_LARGE` envelope precedence over an inconsistent process status and preserves the excerpt in every branch. |
+| `AUD-511-R03` / `AUD-588-B07` | **implemented, pending 5.8.14 re-audit** | `f613df9` makes ASK-09 parse the typed document from stdout or stderr, including a progress-prefixed stderr stream, and removes the four inherited variables that change its precondition. The regression exercises the real typed refusal shape. The prior claim that the payload premise was false remains retracted as an environment-contamination artifact. |
 | `AUD-588-B08` | **closed** | `c084555`; `impact` publishes its independent stdout-byte budget. |
-| `AUD-588-B11` (container/units subset) | **partially implemented in 5.8.12** | `d745d31` discovers nested Maven modules; `273ae8e` suppresses unsupported `pr-impact.unaffected_basis`. `impact` naming, source population units, risk tiers and plan narrative remain open. |
-| `AUD-511-R02` / `AUD-589-B02` | **partially mitigated in 5.8.12, still under investigation** | `b93f230` reuses one `SpringSemanticModel` across every declared `data-exposure` seed; `473f47a` routes `validation` through the shared CIR cache, and `91bd0c0` retains subcommand `--no-cache` compatibility. On the local BroadleafCommerce corpus at the final analyzer fingerprint, a first shared-CIR fill took 10.46 s and its warm `validation --compact` hit took 4.01 s with byte-identical output. This is a same-host cache-state observation, not the 5.8.9/5.8.11 external A/B: the six-run C3-120 comparison and the configured `saint-server` reproduction remain required. |
-| `AUD-588-B02`, `B06`, B11 residuals, `B12` | **partially open in 5.8.12** | `3869c87` excludes explicit EclipseLink from Hibernate applicability and effort; `037223e` publishes provider non-coverage. B11 parity and controlled cost calibration remain required. |
+| `MCP-001` | **closed 5.8.13** | Deep corpus testing reproduced concurrent `CliRunner` stream capture leaking a tool response to the host stdout. `b2c9660` serializes the narrow process-global capture seam; concurrent real MCP calls and a regression test verify response isolation. |
+| `AUD-513-N01` (`N-1`) | **closed in 5.8.14** | `rename-class` rewrote three Petclinic files under both `ASK_READONLY=1` and `--no-write`, then exited 0. The audit restored the tree; this is a write-policy breach, not an artifact-directory exception. `readonly.guard_mutation()` now refuses before any planned source write or physical rename; help names the command as mutating and regressions cover both readonly controls plus `--dry-run`. |
+| `AUD-513-N02` / `B-4` / `N-5` | **N02/B-4 implemented in 5.8.14; N-5 open** | `posture.summary.unconditional` counted 1,697 on a non-Spring Struts tree and 1,573 on Mall, and `security` was `0/0/0` with no population. The posture projection now uses the canonical Spring IoC bean population, publishes its population/unit and separates unconditional security beans. Regressions cover non-Spring, mixed-bean and conditional/unconditional security fixtures. Progress/advice still use incompatible “Java files” scopes (`N-5`), so the `AUD-588-F02` family remains open. |
+| `AUD-513-B01` / `B-3` / `B-5` | **B01/B-5 implemented in 5.8.14; B-3 closed as revalidated** | A MyBatis XML paired with a `*Mapper.java` interface now takes precedence over an absent `@Mapper` annotation, preserving XML-backed/`@MapperScan` interfaces in `mapper_interfaces` rather than misclassifying them as DTO mappers. `imports_found` now contains only actual Java imports; code, XML and build matches are emitted as `evidence`, including in compact output. `B-3` was stale against the current source: both views consume `JAVA_SPRING_SECTIONS`; a real MyBatis Mapper/XML regression proves the section is retained by `--agent`. |
+| `AUD-513-N03/N04/N07/N08/N09`, `B-6/B-7/B-8`, `D-09` | **N03/N04/N07/N08/N09 implemented in 5.8.14; remainder open** | `impact` now always publishes the `candidates` field its not-found message names, including `[]` when no close symbol exists. Budget advice no longer calls partial snapshot/RIS evidence a warm cache: it identifies that presence and says context/parse are unknown before analysis, whose payload then reports all four actual layers. README operational sections (`clone`, install, build, getting started, troubleshooting and related headings) are never promoted into a project summary; with no descriptive prose compact output publishes `project_summary: null` and `summary_basis`. `security_posture.limitations` is now cache-state invariant; dynamic execution advice travels in `security_posture.operational_hints`. Every numeric output bound rejects negative values at parse time with a structured `INVALID_INPUT` envelope (`flag`, `value`, `expected`); `--limit 0` still means no cap wherever that behavior was published. Budgets overrun, timing coverage is inconsistent, compact hides unresolved identities and cost anchors remain stale. |
+| `AUD-588-B11` (container/units subset) | **partially implemented in 5.8.14** | `d745d31` discovers nested Maven modules; `273ae8e` suppresses unsupported `pr-impact.unaffected_basis`. `e53507d` separates direct impact matches from analysis seeds and implementation classes; `8386744` carries the established container-wiring fact into plan checklists and compare cost dimensions. Source population units and risk-tier wording remain open. |
+| `AUD-511-R02` / `AUD-589-B02` / `AUD-513-N06` | **partially corrected; `data-exposure` open, P1** | Nine of ten measured commands recovered, many to their best historical timings. `data-exposure --config` did not: 42.7 s versus 16.2 s in 5.8.8 and a 28.9 s model, with byte-equivalent output. Measure it with the idle-host, isolated-cache, interleaved-control protocol before changing code, then compare its reuse path with `validation`. |
+| `AUD-588-B02`, `B06`, B11 residuals, `B12` | **B02/B06 closed; B11/B12 open, P2** | `3869c87` excludes explicit EclipseLink from Hibernate applicability and effort; `037223e` publishes provider non-coverage. The re-audit verifies both and the payload reduction; `cf57457` makes aggregate wording name only applicable dimensions. Complete B11 consumer parity and calibrate B12 only from provenance-bearing controlled samples. |
+
+### Fourth Re-audit: 5.8.13
+
+The fourth pass verifies the current facts that supersede the prior intake. There is no
+crash/traceback and no regression in the published anchors. `B-2/D-05` remains a retracted
+servlet premise, and the audit additionally verifies EclipseLink applicability/non-coverage,
+typed `audit-report` refusal, nested Maven discovery and the `unaffected_basis` correction.
+It leaves the following concrete queue rather than reopening closed facts.
+
+| Recommendation | Status and direction |
+|---|---|
+| `AUD-588-F02` shared answer contracts | **Partial.** Reuse the existing authorities for exact target versus implementation cone, named source populations and container reach in plan/compare; do not add a parallel detector. |
+| `AUD-588-F03` versioned cost calibration | **Open.** Capture repository, cache state, sample count and host provenance. The immediately actionable measurement is `data-exposure --config`; clean data is required before recalibration. |
+| Risk cache observability | **Recommended hardening.** Publish working-set unit counts under progress or in the envelope to distinguish an empty compositor from a present-but-incomplete cache. |
+| `AUD-588-F05` coverage expansion | **Locally verified only.** Dirty-tree `verify-edit` and the eight mutating/denied invocables remain unexercised in all four external rounds. |
+| EclipseLink migration automation | **Deferred product feature.** The current applicability and non-coverage facts are verified; provider-specific migration automation is not a corrective fix. |
 
 ### Re-audit Intake: 5.8.11
 
@@ -594,7 +620,7 @@ class's subject, not its provenance.
 
 | ID | Item | Found | Severity | Status |
 |---|---|---|---|---|
-| P-1 | Telemetry is **opt-out**. Auditing a public-sector health client's code, it must be disabled *before* the first run, not after | 3.2.0 | **High (procurement)** | **closed 3.3.0** — opt-in: with no explicit choice on record, `is_enabled()` is False everywhere, so a fresh install transmits nothing on the run that prints the notice. The CI special case is gone with the default it existed to override; CI is still detected for one purpose, skipping a notice that has no terminal to appear on. The first-run notice became an invitation that states what *would* be collected. `telemetry status` distinguishes "no choice recorded" from "you chose disabled" (`stored_choice()` returns `None`, not `False`) — a buyer auditing this needs to know which one they have. An explicit choice made before the change is honoured unchanged |
+| P-1 | Telemetry default and procurement disclosure | 3.2.0 | **High (procurement)** | **reopened and corrected 5.8.12** — telemetry is on by default by explicit product decision, with `ask telemetry disable`, `SOURCECODE_TELEMETRY=0` and `DO_NOT_TRACK=1` honored before any event is sent. The first-run notice discloses the fields and the disable path. `telemetry status` distinguishes the default from an explicit disabled choice; the privacy policy documents the endpoint, 90-day retention and bounded anonymous fields. This supersedes the historical 3.3.0 opt-in closure for the current release |
 | P-2 | Licence state is ambiguous: `auth status` → `{"status":"unauthenticated","pro":true,"pro_reason":"early-adoption unlock"}`. The buyer cannot tell what it will cost or what they lose when the door closes | 3.2.0 | Medium | **closed 3.4.0** — one authority, `license.entitlement()`: `entitlement` (what runs), `source` (why: `license_key` / `early_adoption_unlock` / `free_tier`), `authenticated` (a separate fact — today one can be entitled without a credential), `paywall_active`, and `when_it_changes`, which states what the user loses when that source stops applying, in the terms the gate uses and **never as a price**. `is_pro` — what every gate reads — is now derived from it rather than computed beside it, which is how the status page came to contradict the commands. The legacy keys stay for consumers, are derived from the authority, and are listed in `deprecated_fields` |
 
 | P-3 | **The price is not published.** With P-2 closed the entitlement is unambiguous, but a buyer still cannot see what Pro costs or what a team of 25 pays. Eval #5 lists *"precio Pro público"* among the conditions for the top of its price band, beside the robustness fixes | 3.2.1 (eval #5) | Medium (procurement) | open — packaging question, not a page: the field's own reading is that **the value is frontal** (a first audit replaces 5–15 person-days) **and the recurring half is the CI gate**, so a full seat subscription on a product whose value peaks on run one *"genera churn en el mes 4"*. Model to test: one-off assessment **3–5 k€ per repo** + **8–12 €/dev/month** for the gate. Depends on C3-22: without the gate there is nothing recurring to sell |

{sourcecode-5.8.12 → sourcecode-5.8.14}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,29 +3,45 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT STATE — 2026-08-19 — 5.8.12 release**
->
-> The external 5.8.11 re-audit scores **78/100** over the same byte-identical
-> `saint-server` CIR and 53/61 invocables. It refutes two closures, exposes one new
-> security regression and measures a cross-command performance regression. The release
-> fixes remain valuable where verified: B05, B08 and the container/units B11 subset hold;
-> the B04 `data-exposure` premise is retracted by the auditor after configuration-based
-> verification. Historical tables below are superseded by this block where statuses differ.
+> **CURRENT STATE — 2026-08-20 — fourth independent re-audit of 5.8.13**
+>
+> The fourth pass against the unchanged `saint-server` snapshot (`3dde0376`) raises the
+> external score to **90/100** (75 -> 80 -> 78 -> 90), with the same **53/61 invocables
+> (87%)** and no repository writes. It reports **no functional regression**: the 40+
+> longitudinal anchors, including endpoints, posture, verify, contract, data-exposure and
+> MCP, remain byte-equivalent. The audit subject is release `5.8.13`; release `5.8.14`
+> ships the documented remediations without rewriting that external evidence.
+>
+> The prior 5.8.13 intake is superseded where it said that nine defects were new. The
+> re-audit verifies the EclipseLink applicability/non-coverage fix, `audit-report`'s typed
+> output refusal, servlet-mapping retraction, nested Maven discovery and the
+> `unaffected_basis` correction. It also confirms that performance recovered in 9 of 10
+> sampled commands. Historical rows remain below for traceability; this table is the only
+> current correction queue.
 >
 > | Priority | Work | Acceptance direction |
 > |---|---|---|
-> | P0 | `AUD-588-B01` / `AUD-589-B01` / `C3-122`: silent composition exits in `risk` and `audit-report`. | **Implemented in 5.8.12:** `9884488` turns an exit-0 return without delivered output into a typed failure. Field-scale subprocess reproduction remains required. |
-> | P1 | `AUD-511-R01`: SEC-009 profile evidence reads comments. | **Implemented in 5.8.12:** `13362ec` uses comment-blanked Java and regresses a misleading Javadoc. |
-> | P1 | `AUD-511-R02`: 1.4-2.4x performance slowdown. | **Partially mitigated in 5.8.12:** `b93f230` shares the `data-exposure` semantic model across label seeds; `473f47a` gives `validation` the shared CIR cache; `91bd0c0` preserves the published `--no-cache` no-op. Local Broadleaf warm validation is lower, but controlled 5.8.9/5.8.11 remeasurement remains the acceptance gate. |
-> | P1 | `AUD-511-R03`: ASK-09 false `not_applicable`. | **Implemented in 5.8.12:** `47aee1e` uses the emitted envelope as authority and retains evidence for every result. |
-> | P1 | `AUD-588-B02/B06`: EclipseLink is billed a Hibernate migration. | **Implemented in 5.8.12:** `3869c87` excludes the axis; `037223e` publishes the unsupported-provider gap. |
-> | P2 | `AUD-588-B11` residuals and `B12`. | `d745d31` and `273ae8e` close nested-build discovery and false exclusion prose. Finish naming/population/tier/plan parity, then recalibrate cost advice under controlled evidence. |
->
-> **Feature decisions:** `F01` (EclipseLink migration automation) remains deferred, but
-> provider non-coverage is a prerequisite bug fix. `F02` is partial and must consolidate
-> existing authorities rather than re-derive facts. `F03` is partial pending calibrated
-> measurements. `F04` remains opt-in, so foreground advice must not imply a heartbeat.
-> `F05` remains locally verified only; dirty-tree `verify-edit` is a validation gap.
+> | P0 | `AUD-588-B01` / `AUD-589-B01`: `risk` still has a rare early path that exits 0 with neither parseable stdout nor its requested `-o` artifact. | **Instrumented, still open:** `5cfa9ba` publishes source, finding, candidate-defect and composed-defect working-set counts in every final/partial answer. Reproduce at least five cold/shared-cache starts and enforce the real-subprocess output invariant if the early return remains. |
+> | P1 | `AUD-511-R03` / `AUD-588-B07`: ASK-09 remains `not_applicable` although its literal clean-environment probe emits `OUTPUT_TOO_LARGE`. | **Implemented in 5.8.14:** `f613df9` parses the typed document from stdout or stderr and clears the four execution variables that alter the probe. The row may close after a clean-environment field re-audit reports `pass`. |
+> | P2 | `AUD-588-B11` residuals: `impact.matched_fqns` says `resolution: exact` while representing a large implementation cone; population labels, container-reach consumers and plan/compare disclosures still diverge. | **Target/cone and consumers implemented in 5.8.14:** `e53507d` separates direct matches, expanded analysis seeds and implementation classes; `8386744` carries existing container wiring into plan checklists and compare cost dimensions. Name source populations and reconcile remaining risk-tier wording. |
+> | P2 | `AUD-588-B02/B06` wording and `AUD-588-B12/F03` calibration: `readiness_aggregate.note` still lists Hibernate after it was excluded, and cost advice needs clean current anchors. | **Wording implemented in 5.8.14:** `cf57457` derives aggregate names from applicable dimensions. Recalibrate only from controlled measurements and record repository, cache state, sample count and host provenance; do not promote the `SEC-009` severity observation into a defect without a product decision. |
+> | P0 | `AUD-513-N01` (`N-1`): `rename-class` ignores `ASK_READONLY=1` and `--no-write`, rewrites source and exits 0. | **closed in 5.8.14:** a mutation guard rejects before any source write or physical rename; help lists `rename-class` as mutating; regressions cover both controls and readonly `--dry-run`. |
+> | P1 | `AUD-513-N02` + `B-4` + `N-5`: posture counts IR types as unconditional beans, reports security `0/0/0` with no population, and calls two scopes “Java files”. | **N02/B-4 implemented in 5.8.14:** posture now counts only Spring IoC bean definitions and states bean/security populations, units and unconditional security beans. **N-5 remains open:** bind progress/advisory counts to the same named population. |
+> | P1 | `AUD-511-R02` / `AUD-589-B02` + `AUD-513-N06`: performance recovered in 9 of 10 measured commands, but `data-exposure --config` remains 42.7 s, 2.6x the 5.8.8 measurement and above the 28.9 s model despite output equivalence. | Before code changes, run the documented idle-host, isolated-cache, interleaved-control protocol. Compare its path with the shared-CIR reuse that recovered `validation`; do not call the performance family closed until this command converges. |
+> | P1 | `AUD-513-B01` / `B-3` / `B-5`: MyBatis facts conflict, `--agent` is not the help-promised maximum-signal superset, and `imports_found` can name a non-import declaration. | **B01/B-5 implemented in 5.8.14:** matching MyBatis XML outranks the no-`@Mapper` DTO heuristic, and `imports_found` now contains only actual Java imports while code/XML/build matches use `evidence`. **B-3 closed as revalidated:** `JAVA_SPRING_SECTIONS` is shared by both views; regression proves a real MyBatis section reaches `--agent`. |
+> | P2 | `AUD-513-N03/N04/N07/N08/N09`, `B-6/B-7/B-8`, and `D-09`. | **N03/N04/N07/N08/N09 implemented in 5.8.14:** `impact` always emits the `candidates` field it names, including an empty list; budget advice now identifies snapshot/RIS presence separately and leaves context/parse unknown until analysis, matching the four-layer payload; README summaries skip operational headings and publish `project_summary: null` plus `summary_basis` when no descriptive prose exists; cache-sensitive execution advice now lives in `security_posture.operational_hints`, not semantic limitations; all numeric output bounds reject negative values before analysis with structured `flag`, `value` and lower-bound `expected` fields, while published `--limit 0` no-cap behavior remains intact. Bound partial budgets, account timing coverage, preserve compact unresolved identities, and remeasure cost anchors. |
+>
+> **Release status:** all entries above marked “pending `5.8.14`” are shipped in
+> `5.8.14`; their external `5.8.13` verification status is intentionally unchanged.
+>
+> **Feature decisions:** `AUD-588-F02` remains the shared remediation for population,
+> unit and reach contracts; the fourth pass confirms it is still partial. `AUD-588-F03`
+> remains a versioned, provenance-bearing calibration feature: add repeated isolated-cache
+> measurements before changing anchors. `AUD-588-F05` remains locally verified only because
+> dirty-tree `verify-edit` and eight mutating/denied invocables were not exercised. The
+> suggested `risk` working-set instrumentation is accepted as observability hardening, not a
+> parallel analysis authority. EclipseLink automation stays deferred and progress stays
+> opt-in.
 
 > **CURRENT STATE — 2026-08-19 — 5.8.9 working tree**
 >

{sourcecode-5.8.12 → sourcecode-5.8.14}/docs/EXECUTIVE-ROADMAP.md

@@ -3,21 +3,62 @@
 *A software-knowledge platform for large codebases. Written for an engineering
 director; no internal implementation knowledge assumed.*
 
-> **DOCUMENT STATUS — 2026-08-19**
+> **DOCUMENT STATUS — 2026-08-20 — fourth independent re-audit of 5.8.13**
 >
-> The current release is **5.8.12**. Its external re-audit scores **78/100** on the
-> same repository and protocol as the two prior rounds (75, then 80). The repository
-> model is byte-identical, so the reported changes are execution, rule or presentation
-> behavior. This block supersedes earlier release claims where they conflict.
+> The current audited release is **5.8.13**. Its fourth independent Windows/Git Bash pass
+> against the unchanged `saint-server` snapshot scores **90/100**, up from 75, 80 and 78.
+> It keeps coverage at **53/61 invocables (87%)**, finds no crash/traceback or repository
+> write, and reports no regression in the 40+ longitudinal functional anchors. This is a
+> substantial correction to the previous intake: EclipseLink applicability and disclosure,
+> typed `audit-report` output refusal, nested Maven discovery and the endpoint-disposition
+> disclosure are verified, not open release claims.
 >
-> **Closed in the current working tree:** `B23`, `B24`, `B25`, `B26`, `B27`, `B28`, the
-> `C4-25` residual, `C4-27`, `C4-28`, additive `C1-49`, and `C3-130` for `plan`/`cold-start`,
-> plus .NET dependency-cache invalidation, `BUG-004` Java module exclusion, and `C3-55`.
-> **The round-11 bug queue is closed.** `B4` was closed after six convergent passes with an
-> interleaved `impact` control. `R2`, `P1-proc`, `C3-127`, `C3-129` and `B21` were already
-> shipped in 5.8.6; `C3-84` was corrected by measurement. Remaining roadmap work is feature,
-> profiling, compatibility-window or host-specific CI work, not an unresolved bug from that
-> audit. Historical scores and release claims below remain historical; this block is current.
+> **Release blockers:** `risk` still has a rare exit-0/no-output path and
+> `data-exposure --config` remains 2.6x slower than its 5.8.8 measurement. Release 5.8.14
+> instruments `risk`'s compositor for field reproduction, repairs ASK-09's typed
+> stderr-envelope probe, separates exact impact targets from implementation cones, carries
+> container reach into plan/compare, and corrects EclipseLink aggregate wording. Source
+> population names and provenance-based cost calibration remain P2 work. Dirty-tree
+> `verify-edit` and eight mutating or denied commands remain validation gaps, not asserted
+> failures.
+
+> **IMPLEMENTATION UPDATE — released in 5.8.14**
+>
+> `AUD-513-N01` closes the write-policy breach reported on `rename-class`. The policy now
+> distinguishes optional artifact creation from source mutation: a mutation guard stops the
+> entire rename plan before its first write, including the physical Java file rename. The
+> command is now explicit in root help's mutating-command table. Regressions exercise both
+> `--no-write` and `ASK_READONLY=1`, while retaining a successful readonly `--dry-run`.
+>
+> `AUD-513-N02` and `B-4` close the posture population falsehood: the bean summary is now
+> derived from the canonical Spring IoC registry, excludes plain/JPA-only/non-Spring symbols,
+> and declares both population units and unconditional security configurations. `N-5` remains
+> open because it concerns a different progress/advisory population.
+>
+> `AUD-513-B01` closes the MyBatis fact conflict: an XML-backed mapper interface is no longer
+> demoted to a DTO mapper merely because it omits `@Mapper` and relies on `@MapperScan`.
+> `AUD-513-B05` also closes: `imports_found` now names only Java imports, with generic trigger
+> evidence carried separately. `B-3` is closed as revalidated: the agent and compact views
+> share their Java/Spring section authority, now explicitly regressed with a MyBatis pair.
+
+> **Recommended product work**
+>
+> First make `risk`'s output promise an end-to-end invariant and expose its initial
+> working-set count so incomplete-cache behavior is diagnosable. Then repair the ASK-09
+> harness to read the emit-seam document and either sanitize or disclose inherited execution
+> variables. Measure `data-exposure` under the isolated-cache, interleaved-control protocol
+> before optimizing it. Complete the shared answer-contract layer (`AUD-588-F02`) by binding
+> existing authorities into impact, plan and compare, and recalibrate cost guidance only from
+> provenance-bearing measurements (`AUD-588-F03`). EclipseLink automation remains deferred;
+> its current applicability and non-coverage disclosure are already verified.
+
+> **MCP HARDENING — released in 5.8.13**
+>
+> Deep multi-repository stress testing found that concurrent MCP calls could race the
+> process-global stdout/stderr capture used by the in-process CLI adapter. `b2c9660`
+> serializes that narrow capture seam, preventing one tool response from reaching the MCP
+> host or another tool call. This does not change analysis contracts or reopen the external
+> audit queue; it makes the agent integration reliable under concurrent dispatch.
 
 > **5.8.11 RE-AUDIT CORRECTION**
 >

{sourcecode-5.8.12 → sourcecode-5.8.14}/docs/MANUAL-USUARIO.md

@@ -954,10 +954,13 @@ mantiene el alias breve de versión para compatibilidad.
 
 ```bash
 ask telemetry status    # ver el ajuste actual (y si llegaste a elegir)
-ask telemetry enable    # activar (opt-in)
-ask telemetry disable   # volver a desactivar
+ask telemetry enable    # activar
+ask telemetry disable   # desactivar
 ```
-La telemetría anónima está **desactivada por defecto (opt-in)**: no se recoge ni se envía nada hasta que la actives, ni siquiera en la primera ejecución. Nunca incluye tu código, rutas ni secretos.
+La telemetría anónima está **activada por defecto**. Recoge sólo versión, sistema, comandos,
+flags, duración aproximada, tamaño agrupado del repositorio y tipo de error. Nunca incluye tu
+código, rutas ni secretos. Desactívala con `ask telemetry disable`, `SOURCECODE_TELEMETRY=0`
+o `DO_NOT_TRACK=1`.
 
 ---
 

{sourcecode-5.8.12 → sourcecode-5.8.14}/docs/USER_GUIDE.md

@@ -138,7 +138,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.12
+# ask 5.8.14
 ```
 
 Requires Python 3.9+.
@@ -1199,7 +1199,7 @@ explaining. The rest do one thing; `ask <command> --help` is the whole story.
 | `ask retrieve` | parked | Typed knowledge queries over the model — kept working, no longer developed |
 | `ask baseline capture\|diff\|trend` | supported | Versioned architectural metrics over time; see [`ask trend`](#ask-trend-dir--how-the-architecture-moved) |
 | `ask cache status\|warm\|model\|clear\|freshness` | supported | Cache inspection; `ask cache model` states what a warm buys each command |
-| `ask config` · `ask version` · `ask activate` · `ask auth` · `ask telemetry` · `ask mcp` | supported | Configuration, version, licence, authentication, telemetry (off by default), MCP integration |
+| `ask config` · `ask version` · `ask activate` · `ask auth` · `ask telemetry` · `ask mcp` | supported | Configuration, version, licence, authentication, telemetry (on by default), MCP integration |
 
 ## Typical workflows
 
@@ -1287,7 +1287,7 @@ ask mcp serve
 ask mcp remove
 ```
 
-The MCP server exposes structural analysis tools to AI agents without requiring the agent to call the CLI directly. Claude Desktop and Cursor can query impact, endpoints, and context through the MCP protocol.
+The MCP server exposes structural analysis tools to AI agents without requiring the agent to call the CLI directly. Claude Desktop and Cursor can query impact, endpoints, and context through the MCP protocol. Concurrent requests are accepted safely: ASK serializes only the in-process CLI capture seam, because its stdout/stderr redirection is process-global, so one tool response cannot contaminate another.
 
 ---
 

{sourcecode-5.8.12 → sourcecode-5.8.14}/docs/privacy.md

@@ -1,8 +1,8 @@
 # Privacy & Telemetry
 
-`ask` includes an anonymous telemetry system that is **off until you turn it on (opt-in)**. Nothing is collected or transmitted before you run `ask telemetry enable` — not on the first run, not in CI, not anywhere. The data, if you do opt in, is strictly anonymous: no source code, paths, secrets, or repository content are ever collected.
+`ask` includes an anonymous telemetry system that is **on by default**. It collects only bounded usage metadata: no source code, paths, secrets, or repository content are ever collected. Disable it with `ask telemetry disable`, `SOURCECODE_TELEMETRY=0`, or `DO_NOT_TRACK=1`.
 
-**This changed in 3.3.0.** Telemetry used to be opt-out. Auditing regulated third-party code, the default is not a preference: a reviewer must be able to state that nothing left the machine, and "disable it after the first run" cannot give that guarantee. If you had explicitly enabled or disabled it before, your choice is unchanged; if you never chose, telemetry is now off.
+Telemetry is enabled by default because ASK's product operation depends on command and performance coverage. The disable controls are honored before any event is sent, including in CI.
 
 ---
 
@@ -10,8 +10,8 @@
 
 ```bash
 ask telemetry status   # check current setting, and whether you ever chose
-ask telemetry enable   # opt in (remembered)
-ask telemetry disable  # opt back out (remembered)
+ask telemetry enable   # enable (remembered)
+ask telemetry disable  # disable (remembered)
 
 export SOURCECODE_TELEMETRY=0  # disable via environment variable
 export SOURCECODE_TELEMETRY=1  # force enable via environment variable
@@ -23,13 +23,13 @@ Precedence, highest first:
 1. `SOURCECODE_TELEMETRY` environment variable (`0` = off, `1` = on)
 2. `DO_NOT_TRACK` environment variable (any value other than empty/`0` disables)
 3. Your saved choice in the config file (`telemetry enable` / `disable`)
-4. Default: **off**, everywhere — no choice on record means nothing is sent
+4. Default: **on** — no choice on record enables bounded anonymous events
 
 ---
 
 ## Why telemetry exists
 
-ASK Engine is a local analysis tool with no usage visibility by default.
+ASK Engine is a local analysis tool with bounded anonymous usage visibility by default.
 Anonymous telemetry helps answer questions like:
 
 - Which commands do developers actually use?
@@ -54,7 +54,8 @@ When telemetry is enabled, these fields are sent per command invocation:
 | `py` | `3.11` | Python major.minor only |
 | `os` | `macos` | OS family: linux / macos / windows / other |
 | `arch` | `x64` | CPU family: x64 / arm64 / other |
-| `cmd` | `analyze` | Command run: analyze / prepare-context |
+| `cmd` | `analyze` | Command family: analyze / prepare-context / telemetry / mcp |
+| `command` | `spring-audit` | Closed ASK command identifier; no arguments or paths |
 | `flags` | `["--agent"]` | Flag names only (allowlist), no values |
 | `output_fmt` | `json` | Output format: json or yaml |
 | `repo_size` | `small` | File count range bucket (see below) |
@@ -74,8 +75,8 @@ which capabilities agents actually use.
 The tool **arguments are never sent** — they carry repository paths. Neither is any part
 of the result. The name is a fixed identifier from ASK Engine's own tool registry, not
 user input, and it is still shape-validated by the sanitization layer before transmission.
-These events follow the same opt-in as everything else: until you enable telemetry, nothing
-is recorded.
+These events follow the same setting as everything else: they are recorded only while
+telemetry is enabled.
 
 ### Repo size buckets
 
@@ -135,11 +136,13 @@ This filter is tested in `tests/test_telemetry.py`. Tests explicitly verify that
 
 ## Data transmission
 
-- Events are sent to `https://t.sourcecode.dev/v1/event` (configurable via `SOURCECODE_TELEMETRY_ENDPOINT`)
+- Events are sent to `https://qkndlmyekvujjdgthtmz.supabase.co/functions/v1/telemetry` (configurable via `SOURCECODE_TELEMETRY_ENDPOINT`)
 - Transmission happens in a background daemon thread — it never blocks the CLI
 - Timeout is 3 seconds — if the request fails or times out, it is silently dropped
 - No retries — a missed event is acceptable
 - No queuing or batching to disk
+- The server rejects payloads over 16 KiB and applies an in-memory rate limit of 120 requests per minute per forwarding address
+- Events are retained for 90 days; the `purge_telemetry_events()` function is scheduled in the Supabase deployment
 
 ---
 
@@ -161,16 +164,16 @@ The file looks like:
 }
 ```
 
-If you run `ask telemetry enable` or `disable`, `enabled` is set accordingly and that choice is remembered. If you have never made an explicit choice, the `enabled` key is absent and telemetry is **off**. `ask telemetry status` tells you which of the two you have — "no choice recorded" and "you chose disabled" are different answers. You can edit or delete this file directly at any time.
+If you run `ask telemetry enable` or `disable`, `enabled` is set accordingly and that choice is remembered. If you have never made an explicit choice, the `enabled` key is absent and telemetry follows the **on** default. `ask telemetry status` tells you whether the default applies or you explicitly disabled it. You can edit or delete this file directly at any time.
 
 ---
 
 ## First-run notice
 
-The first time you run `ask` interactively (not in CI, not piped), you are shown a brief, one-time notice explaining that telemetry is **off**, what *would* be collected if you enabled it, and how to enable it if you want to help.
+The first time you run `ask` interactively (not in CI, not piped), you are shown a brief, one-time notice explaining that telemetry is **on**, what is collected, and how to disable it.
 
-- It is an **invitation, not a prompt** — no answer is required and your input is never read
-- Nothing has been collected when it appears, and printing it changes no setting
+- It is a disclosure, not a prompt — no answer is required and your input is never read
+- Printing it changes no setting
 - It is shown **once only**
 - In CI environments (GitHub Actions, CircleCI, etc.) the notice is skipped
 - When piped or run non-interactively, the notice is skipped
@@ -179,7 +182,7 @@ The first time you run `ask` interactively (not in CI, not piped), you are shown
 
 ## CI environments
 
-CI needs no special case any more: with no choice on record telemetry is off, in CI and out of it. An explicit opt-in (`ask telemetry enable` or `SOURCECODE_TELEMETRY=1`) is honored in CI as anywhere else. CI is still detected for one purpose only — skipping the first-run notice, which has no terminal to appear on:
+Telemetry remains on in CI unless `SOURCECODE_TELEMETRY=0` or `DO_NOT_TRACK=1` is set. CI is detected only to skip the first-run notice, which has no terminal to appear on:
 
 `CI`, `CONTINUOUS_INTEGRATION`, `GITHUB_ACTIONS`, `CIRCLECI`, `TRAVIS`, `JENKINS_URL`, `BUILDKITE`, `GITLAB_CI`, `TF_BUILD`, `TEAMCITY_VERSION`, `DRONE`, `SEMAPHORE`
 
@@ -191,7 +194,7 @@ The entire telemetry implementation is in `src/sourcecode/telemetry/`. You can r
 
 Key files:
 - `config.py` — configuration read/write
-- `consent.py` — first-run invitation notice
+- `consent.py` — first-run disclosure notice
 - `events.py` — event schema
 - `filters.py` — privacy sanitization (the critical safety layer)
 - `transport.py` — HTTP transmission

{sourcecode-5.8.12 → sourcecode-5.8.14}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.8.12"
+version = "5.8.14"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.8.12 → sourcecode-5.8.14}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.12"
+__version__ = "5.8.14"

{sourcecode-5.8.12 → sourcecode-5.8.14}/src/sourcecode/change_plan.py

@@ -139,7 +139,9 @@ def build_change_plan(
             ),
         }
 
-    seeds = list(blast["matched_fqns"])
+    # The user-facing match names the requested target; planning must retain the
+    # subtype-expanded seeds that the blast-radius authority actually analysed.
+    seeds = list(blast.get("analysis_seed_fqns") or blast["matched_fqns"])
     container_wired = [w.to_dict() for w in detect_classes(cir, seeds)]
     meta = _node_meta(cir)
     affected = _dependents_closure(cir.reverse_graph or {}, seeds, max_depth, _NODE_CAP)
@@ -210,6 +212,11 @@ def build_change_plan(
         checklist.append(
             f"{len(sec)} secured endpoint(s) in scope — re-check authorization."
         )
+    if container_wired:
+        checklist.append(
+            f"{len(container_wired)} container-wired component(s) are in scope — "
+            "review their declared framework wiring because fan-in does not measure it."
+        )
     txn = blast.get("transactional_boundaries_touched") or []
     if txn:
         checklist.append(f"{len(txn)} transactional boundary/boundaries in scope.")