sourcecode 5.8.13__tar.gz → 5.8.14__tar.gz

{sourcecode-5.8.13 → sourcecode-5.8.14}/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [5.8.14] — 2026-08-20
+
+*Fourth-audit remediation release. The external `5.8.13` audit subject remains
+the evidence for outstanding field reproduction and performance work.*
+
+### Fixed
+- ASK-09 selftest now reads typed error documents from either stdout or stderr
+  and clears inherited execution controls that would change the ceiling probe.
+- Migration readiness names only dimensions that actually participate in its
+  aggregate, so an EclipseLink repository does not describe an excluded Hibernate
+  axis as an input.
+- `impact` separates directly resolved targets from expanded analysis seeds and
+  implementation classes. `plan` and `compare` retain the expanded cone while
+  publishing container-wired components in their checklist and cost dimensions.
+
+### Changed
+- `risk` now publishes its composition working set: source files, audit findings,
+  candidate defects and composed defects. This instruments the rare field-scale
+  zero-output report without claiming it is closed before reproduction.
+- The roadmap and defect ledger distinguish these shipped changes from the two
+  remaining field-gated items: `risk` output reproduction and controlled
+  `data-exposure --config` performance measurement.
+
 ## [5.8.13] — 2026-08-20
 
 *MCP reliability release after deep multi-repository stress testing.*

{sourcecode-5.8.13 → sourcecode-5.8.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.13
+Version: 5.8.14
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -49,7 +49,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.8.13-blue)
+![Version](https://img.shields.io/badge/version-5.8.14-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -151,7 +151,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.13 — and, on a build that has aged,
+ask version                    # ask 5.8.14 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.13 → sourcecode-5.8.14}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.8.13-blue)
+![Version](https://img.shields.io/badge/version-5.8.14-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -106,7 +106,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.13 — and, on a build that has aged,
+ask version                    # ask 5.8.14 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.13 → sourcecode-5.8.14}/docs/DEFECT-LEDGER.md

@@ -16,24 +16,49 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
-**As of 2026-08-20, release `5.8.13` and the external `5.8.11` re-audit:** this is the current status of
-the 5.8.8/5.8.9 audit queue. The subject remained `saint-server` at `3dde0376`, with a
-byte-identical CIR and the same 53/61 invocables exercised. The score is **78/100**
-(75 in 5.8.8, 80 in 5.8.9). The observations below remain historical evidence; only
-this table declares present state.
+**As of 2026-08-20, release `5.8.14` and the fourth external re-audit:** the audited
+snapshot remains `3dde0376`; the report compares the four audit rounds and scores this one
+**90/100** (75, 80, 78, 90). It exercised 53/61 invocables (87%), ran no application and
+left the repository unchanged. Its 40+ longitudinal functional anchors are unchanged, so
+there is no reported product regression. The `5.8.14` release ships the implementations
+recorded below; they remain distinguished from facts verified on the `5.8.13` subject.
+Only this table declares present state.
+
+**Release status:** entries marked “pending `5.8.14`” in their historical wording are
+shipped in `5.8.14`; a re-audit is still required wherever the row says so.
 
 | Rows | Current status | Evidence |
 |---|---|---|
-| `AUD-588-B01`, `AUD-589-B01`, `C3-122` | **implemented in 5.8.12** | `9884488` requires `risk` and `audit-report` to deliver stdout or their requested artifact before exit 0; the remaining closure evidence is a field-scale subprocess reproduction. |
+| `AUD-588-B01` / `AUD-589-B01`, `C3-122` | **open, P0 for `risk`; `audit-report` corrected** | `9884488` corrected `audit-report` to refuse with typed `OUTPUT_TOO_LARGE` and produce its requested artifact. `risk` nevertheless exited 0 twice on the first shared-cache invocations with 0 bytes and no `-o` file, then succeeded seven times. `5cfa9ba` now publishes the source, audit-finding, candidate-defect and composed-defect working set, including partial answers. Repeat the real entry-point protocol before closure. |
 | `AUD-511-R01` / `AUD-588-B03` | **implemented in 5.8.12** | `13362ec` makes SEC-009 read comment-blanked Java, so a Javadoc profile cannot override the live `@Profile("!m3")` declaration. |
 | `AUD-588-B04` | **retracted audit premise** | `data-exposure` correctly preserves `chain_decision`; the reported `coverage_unknown` routes were custom-gate annotations whose application was not configured. `fd34eb1` remains a valid additive disclosure, but no further B04 fix is due. |
 | `AUD-588-B05` | **closed** | `c15f5b6`; changed container-wired components block a false `unaffected` disposition. |
-| `AUD-511-R03` / `AUD-588-B07` | **implemented in 5.8.12** | `47aee1e` gives the published `OUTPUT_TOO_LARGE` envelope precedence over an inconsistent process status and preserves the excerpt in every branch. |
+| `AUD-511-R03` / `AUD-588-B07` | **implemented, pending 5.8.14 re-audit** | `f613df9` makes ASK-09 parse the typed document from stdout or stderr, including a progress-prefixed stderr stream, and removes the four inherited variables that change its precondition. The regression exercises the real typed refusal shape. The prior claim that the payload premise was false remains retracted as an environment-contamination artifact. |
 | `AUD-588-B08` | **closed** | `c084555`; `impact` publishes its independent stdout-byte budget. |
 | `MCP-001` | **closed 5.8.13** | Deep corpus testing reproduced concurrent `CliRunner` stream capture leaking a tool response to the host stdout. `b2c9660` serializes the narrow process-global capture seam; concurrent real MCP calls and a regression test verify response isolation. |
-| `AUD-588-B11` (container/units subset) | **partially implemented in 5.8.12** | `d745d31` discovers nested Maven modules; `273ae8e` suppresses unsupported `pr-impact.unaffected_basis`. `impact` naming, source population units, risk tiers and plan narrative remain open. |
-| `AUD-511-R02` / `AUD-589-B02` | **partially mitigated in 5.8.12, still under investigation** | `b93f230` reuses one `SpringSemanticModel` across every declared `data-exposure` seed; `473f47a` routes `validation` through the shared CIR cache, and `91bd0c0` retains subcommand `--no-cache` compatibility. On the local BroadleafCommerce corpus at the final analyzer fingerprint, a first shared-CIR fill took 10.46 s and its warm `validation --compact` hit took 4.01 s with byte-identical output. This is a same-host cache-state observation, not the 5.8.9/5.8.11 external A/B: the six-run C3-120 comparison and the configured `saint-server` reproduction remain required. |
-| `AUD-588-B02`, `B06`, B11 residuals, `B12` | **partially open in 5.8.12** | `3869c87` excludes explicit EclipseLink from Hibernate applicability and effort; `037223e` publishes provider non-coverage. B11 parity and controlled cost calibration remain required. |
+| `AUD-513-N01` (`N-1`) | **closed in 5.8.14** | `rename-class` rewrote three Petclinic files under both `ASK_READONLY=1` and `--no-write`, then exited 0. The audit restored the tree; this is a write-policy breach, not an artifact-directory exception. `readonly.guard_mutation()` now refuses before any planned source write or physical rename; help names the command as mutating and regressions cover both readonly controls plus `--dry-run`. |
+| `AUD-513-N02` / `B-4` / `N-5` | **N02/B-4 implemented in 5.8.14; N-5 open** | `posture.summary.unconditional` counted 1,697 on a non-Spring Struts tree and 1,573 on Mall, and `security` was `0/0/0` with no population. The posture projection now uses the canonical Spring IoC bean population, publishes its population/unit and separates unconditional security beans. Regressions cover non-Spring, mixed-bean and conditional/unconditional security fixtures. Progress/advice still use incompatible “Java files” scopes (`N-5`), so the `AUD-588-F02` family remains open. |
+| `AUD-513-B01` / `B-3` / `B-5` | **B01/B-5 implemented in 5.8.14; B-3 closed as revalidated** | A MyBatis XML paired with a `*Mapper.java` interface now takes precedence over an absent `@Mapper` annotation, preserving XML-backed/`@MapperScan` interfaces in `mapper_interfaces` rather than misclassifying them as DTO mappers. `imports_found` now contains only actual Java imports; code, XML and build matches are emitted as `evidence`, including in compact output. `B-3` was stale against the current source: both views consume `JAVA_SPRING_SECTIONS`; a real MyBatis Mapper/XML regression proves the section is retained by `--agent`. |
+| `AUD-513-N03/N04/N07/N08/N09`, `B-6/B-7/B-8`, `D-09` | **N03/N04/N07/N08/N09 implemented in 5.8.14; remainder open** | `impact` now always publishes the `candidates` field its not-found message names, including `[]` when no close symbol exists. Budget advice no longer calls partial snapshot/RIS evidence a warm cache: it identifies that presence and says context/parse are unknown before analysis, whose payload then reports all four actual layers. README operational sections (`clone`, install, build, getting started, troubleshooting and related headings) are never promoted into a project summary; with no descriptive prose compact output publishes `project_summary: null` and `summary_basis`. `security_posture.limitations` is now cache-state invariant; dynamic execution advice travels in `security_posture.operational_hints`. Every numeric output bound rejects negative values at parse time with a structured `INVALID_INPUT` envelope (`flag`, `value`, `expected`); `--limit 0` still means no cap wherever that behavior was published. Budgets overrun, timing coverage is inconsistent, compact hides unresolved identities and cost anchors remain stale. |
+| `AUD-588-B11` (container/units subset) | **partially implemented in 5.8.14** | `d745d31` discovers nested Maven modules; `273ae8e` suppresses unsupported `pr-impact.unaffected_basis`. `e53507d` separates direct impact matches from analysis seeds and implementation classes; `8386744` carries the established container-wiring fact into plan checklists and compare cost dimensions. Source population units and risk-tier wording remain open. |
+| `AUD-511-R02` / `AUD-589-B02` / `AUD-513-N06` | **partially corrected; `data-exposure` open, P1** | Nine of ten measured commands recovered, many to their best historical timings. `data-exposure --config` did not: 42.7 s versus 16.2 s in 5.8.8 and a 28.9 s model, with byte-equivalent output. Measure it with the idle-host, isolated-cache, interleaved-control protocol before changing code, then compare its reuse path with `validation`. |
+| `AUD-588-B02`, `B06`, B11 residuals, `B12` | **B02/B06 closed; B11/B12 open, P2** | `3869c87` excludes explicit EclipseLink from Hibernate applicability and effort; `037223e` publishes provider non-coverage. The re-audit verifies both and the payload reduction; `cf57457` makes aggregate wording name only applicable dimensions. Complete B11 consumer parity and calibrate B12 only from provenance-bearing controlled samples. |
+
+### Fourth Re-audit: 5.8.13
+
+The fourth pass verifies the current facts that supersede the prior intake. There is no
+crash/traceback and no regression in the published anchors. `B-2/D-05` remains a retracted
+servlet premise, and the audit additionally verifies EclipseLink applicability/non-coverage,
+typed `audit-report` refusal, nested Maven discovery and the `unaffected_basis` correction.
+It leaves the following concrete queue rather than reopening closed facts.
+
+| Recommendation | Status and direction |
+|---|---|
+| `AUD-588-F02` shared answer contracts | **Partial.** Reuse the existing authorities for exact target versus implementation cone, named source populations and container reach in plan/compare; do not add a parallel detector. |
+| `AUD-588-F03` versioned cost calibration | **Open.** Capture repository, cache state, sample count and host provenance. The immediately actionable measurement is `data-exposure --config`; clean data is required before recalibration. |
+| Risk cache observability | **Recommended hardening.** Publish working-set unit counts under progress or in the envelope to distinguish an empty compositor from a present-but-incomplete cache. |
+| `AUD-588-F05` coverage expansion | **Locally verified only.** Dirty-tree `verify-edit` and the eight mutating/denied invocables remain unexercised in all four external rounds. |
+| EclipseLink migration automation | **Deferred product feature.** The current applicability and non-coverage facts are verified; provider-specific migration automation is not a corrective fix. |
 
 ### Re-audit Intake: 5.8.11
 

{sourcecode-5.8.13 → sourcecode-5.8.14}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,34 +3,45 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT STATE — 2026-08-20 — 5.8.13 release**
->
-> The external 5.8.11 re-audit scores **78/100** over the same byte-identical
-> `saint-server` CIR and 53/61 invocables. It refutes two closures, exposes one new
-> security regression and measures a cross-command performance regression. The release
-> fixes remain valuable where verified: B05, B08 and the container/units B11 subset hold.
-> The deep `testing` corpus battery also closed an in-process MCP concurrency defect:
-> `CliRunner`'s global stream capture allowed one response to escape to the host stdout.
-> `b2c9660` serializes that seam and proves response isolation under concurrent calls.
-> The audit queue remains unchanged; this was additional hardening found during verification.
-> The B04 `data-exposure` premise is retracted by the auditor after configuration-based
-> verification. Historical tables below are superseded by this block where statuses differ.
+> **CURRENT STATE — 2026-08-20 — fourth independent re-audit of 5.8.13**
+>
+> The fourth pass against the unchanged `saint-server` snapshot (`3dde0376`) raises the
+> external score to **90/100** (75 -> 80 -> 78 -> 90), with the same **53/61 invocables
+> (87%)** and no repository writes. It reports **no functional regression**: the 40+
+> longitudinal anchors, including endpoints, posture, verify, contract, data-exposure and
+> MCP, remain byte-equivalent. The audit subject is release `5.8.13`; release `5.8.14`
+> ships the documented remediations without rewriting that external evidence.
+>
+> The prior 5.8.13 intake is superseded where it said that nine defects were new. The
+> re-audit verifies the EclipseLink applicability/non-coverage fix, `audit-report`'s typed
+> output refusal, servlet-mapping retraction, nested Maven discovery and the
+> `unaffected_basis` correction. It also confirms that performance recovered in 9 of 10
+> sampled commands. Historical rows remain below for traceability; this table is the only
+> current correction queue.
 >
 > | Priority | Work | Acceptance direction |
 > |---|---|---|
-> | P0 | `AUD-588-B01` / `AUD-589-B01` / `C3-122`: silent composition exits in `risk` and `audit-report`. | **Implemented in 5.8.12:** `9884488` turns an exit-0 return without delivered output into a typed failure. Field-scale subprocess reproduction remains required. |
-> | P1 | `AUD-511-R01`: SEC-009 profile evidence reads comments. | **Implemented in 5.8.12:** `13362ec` uses comment-blanked Java and regresses a misleading Javadoc. |
-> | P1 | `AUD-511-R02`: 1.4-2.4x performance slowdown. | **Partially mitigated in 5.8.12:** `b93f230` shares the `data-exposure` semantic model across label seeds; `473f47a` gives `validation` the shared CIR cache; `91bd0c0` preserves the published `--no-cache` no-op. Local Broadleaf warm validation is lower, but controlled 5.8.9/5.8.11 remeasurement remains the acceptance gate. |
-> | P1 | `AUD-511-R03`: ASK-09 false `not_applicable`. | **Implemented in 5.8.12:** `47aee1e` uses the emitted envelope as authority and retains evidence for every result. |
-> | P1 | `AUD-588-B02/B06`: EclipseLink is billed a Hibernate migration. | **Implemented in 5.8.12:** `3869c87` excludes the axis; `037223e` publishes the unsupported-provider gap. |
-> | P1 | `MCP-001`: concurrent MCP calls can leak a CLI response to host stdout. | **Closed in 5.8.13:** `b2c9660` serializes the process-global `CliRunner` capture seam and regresses overlapping calls. |
-> | P2 | `AUD-588-B11` residuals and `B12`. | `d745d31` and `273ae8e` close nested-build discovery and false exclusion prose. Finish naming/population/tier/plan parity, then recalibrate cost advice under controlled evidence. |
->
-> **Feature decisions:** `F01` (EclipseLink migration automation) remains deferred, but
-> provider non-coverage is a prerequisite bug fix. `F02` is partial and must consolidate
-> existing authorities rather than re-derive facts. `F03` is partial pending calibrated
-> measurements. `F04` remains opt-in, so foreground advice must not imply a heartbeat.
-> `F05` remains locally verified only; dirty-tree `verify-edit` is a validation gap.
+> | P0 | `AUD-588-B01` / `AUD-589-B01`: `risk` still has a rare early path that exits 0 with neither parseable stdout nor its requested `-o` artifact. | **Instrumented, still open:** `5cfa9ba` publishes source, finding, candidate-defect and composed-defect working-set counts in every final/partial answer. Reproduce at least five cold/shared-cache starts and enforce the real-subprocess output invariant if the early return remains. |
+> | P1 | `AUD-511-R03` / `AUD-588-B07`: ASK-09 remains `not_applicable` although its literal clean-environment probe emits `OUTPUT_TOO_LARGE`. | **Implemented in 5.8.14:** `f613df9` parses the typed document from stdout or stderr and clears the four execution variables that alter the probe. The row may close after a clean-environment field re-audit reports `pass`. |
+> | P2 | `AUD-588-B11` residuals: `impact.matched_fqns` says `resolution: exact` while representing a large implementation cone; population labels, container-reach consumers and plan/compare disclosures still diverge. | **Target/cone and consumers implemented in 5.8.14:** `e53507d` separates direct matches, expanded analysis seeds and implementation classes; `8386744` carries existing container wiring into plan checklists and compare cost dimensions. Name source populations and reconcile remaining risk-tier wording. |
+> | P2 | `AUD-588-B02/B06` wording and `AUD-588-B12/F03` calibration: `readiness_aggregate.note` still lists Hibernate after it was excluded, and cost advice needs clean current anchors. | **Wording implemented in 5.8.14:** `cf57457` derives aggregate names from applicable dimensions. Recalibrate only from controlled measurements and record repository, cache state, sample count and host provenance; do not promote the `SEC-009` severity observation into a defect without a product decision. |
+> | P0 | `AUD-513-N01` (`N-1`): `rename-class` ignores `ASK_READONLY=1` and `--no-write`, rewrites source and exits 0. | **closed in 5.8.14:** a mutation guard rejects before any source write or physical rename; help lists `rename-class` as mutating; regressions cover both controls and readonly `--dry-run`. |
+> | P1 | `AUD-513-N02` + `B-4` + `N-5`: posture counts IR types as unconditional beans, reports security `0/0/0` with no population, and calls two scopes “Java files”. | **N02/B-4 implemented in 5.8.14:** posture now counts only Spring IoC bean definitions and states bean/security populations, units and unconditional security beans. **N-5 remains open:** bind progress/advisory counts to the same named population. |
+> | P1 | `AUD-511-R02` / `AUD-589-B02` + `AUD-513-N06`: performance recovered in 9 of 10 measured commands, but `data-exposure --config` remains 42.7 s, 2.6x the 5.8.8 measurement and above the 28.9 s model despite output equivalence. | Before code changes, run the documented idle-host, isolated-cache, interleaved-control protocol. Compare its path with the shared-CIR reuse that recovered `validation`; do not call the performance family closed until this command converges. |
+> | P1 | `AUD-513-B01` / `B-3` / `B-5`: MyBatis facts conflict, `--agent` is not the help-promised maximum-signal superset, and `imports_found` can name a non-import declaration. | **B01/B-5 implemented in 5.8.14:** matching MyBatis XML outranks the no-`@Mapper` DTO heuristic, and `imports_found` now contains only actual Java imports while code/XML/build matches use `evidence`. **B-3 closed as revalidated:** `JAVA_SPRING_SECTIONS` is shared by both views; regression proves a real MyBatis section reaches `--agent`. |
+> | P2 | `AUD-513-N03/N04/N07/N08/N09`, `B-6/B-7/B-8`, and `D-09`. | **N03/N04/N07/N08/N09 implemented in 5.8.14:** `impact` always emits the `candidates` field it names, including an empty list; budget advice now identifies snapshot/RIS presence separately and leaves context/parse unknown until analysis, matching the four-layer payload; README summaries skip operational headings and publish `project_summary: null` plus `summary_basis` when no descriptive prose exists; cache-sensitive execution advice now lives in `security_posture.operational_hints`, not semantic limitations; all numeric output bounds reject negative values before analysis with structured `flag`, `value` and lower-bound `expected` fields, while published `--limit 0` no-cap behavior remains intact. Bound partial budgets, account timing coverage, preserve compact unresolved identities, and remeasure cost anchors. |
+>
+> **Release status:** all entries above marked “pending `5.8.14`” are shipped in
+> `5.8.14`; their external `5.8.13` verification status is intentionally unchanged.
+>
+> **Feature decisions:** `AUD-588-F02` remains the shared remediation for population,
+> unit and reach contracts; the fourth pass confirms it is still partial. `AUD-588-F03`
+> remains a versioned, provenance-bearing calibration feature: add repeated isolated-cache
+> measurements before changing anchors. `AUD-588-F05` remains locally verified only because
+> dirty-tree `verify-edit` and eight mutating/denied invocables were not exercised. The
+> suggested `risk` working-set instrumentation is accepted as observability hardening, not a
+> parallel analysis authority. EclipseLink automation stays deferred and progress stays
+> opt-in.
 
 > **CURRENT STATE — 2026-08-19 — 5.8.9 working tree**
 >

{sourcecode-5.8.13 → sourcecode-5.8.14}/docs/EXECUTIVE-ROADMAP.md

@@ -3,21 +3,54 @@
 *A software-knowledge platform for large codebases. Written for an engineering
 director; no internal implementation knowledge assumed.*
 
-> **DOCUMENT STATUS — 2026-08-20**
+> **DOCUMENT STATUS — 2026-08-20 — fourth independent re-audit of 5.8.13**
 >
-> The current release is **5.8.13**. Its external re-audit scores **78/100** on the
-> same repository and protocol as the two prior rounds (75, then 80). The repository
-> model is byte-identical, so the reported changes are execution, rule or presentation
-> behavior. This block supersedes earlier release claims where they conflict.
+> The current audited release is **5.8.13**. Its fourth independent Windows/Git Bash pass
+> against the unchanged `saint-server` snapshot scores **90/100**, up from 75, 80 and 78.
+> It keeps coverage at **53/61 invocables (87%)**, finds no crash/traceback or repository
+> write, and reports no regression in the 40+ longitudinal functional anchors. This is a
+> substantial correction to the previous intake: EclipseLink applicability and disclosure,
+> typed `audit-report` output refusal, nested Maven discovery and the endpoint-disposition
+> disclosure are verified, not open release claims.
 >
-> **Closed in the current working tree:** `B23`, `B24`, `B25`, `B26`, `B27`, `B28`, the
-> `C4-25` residual, `C4-27`, `C4-28`, additive `C1-49`, and `C3-130` for `plan`/`cold-start`,
-> plus .NET dependency-cache invalidation, `BUG-004` Java module exclusion, and `C3-55`.
-> **The round-11 bug queue is closed.** `B4` was closed after six convergent passes with an
-> interleaved `impact` control. `R2`, `P1-proc`, `C3-127`, `C3-129` and `B21` were already
-> shipped in 5.8.6; `C3-84` was corrected by measurement. Remaining roadmap work is feature,
-> profiling, compatibility-window or host-specific CI work, not an unresolved bug from that
-> audit. Historical scores and release claims below remain historical; this block is current.
+> **Release blockers:** `risk` still has a rare exit-0/no-output path and
+> `data-exposure --config` remains 2.6x slower than its 5.8.8 measurement. Release 5.8.14
+> instruments `risk`'s compositor for field reproduction, repairs ASK-09's typed
+> stderr-envelope probe, separates exact impact targets from implementation cones, carries
+> container reach into plan/compare, and corrects EclipseLink aggregate wording. Source
+> population names and provenance-based cost calibration remain P2 work. Dirty-tree
+> `verify-edit` and eight mutating or denied commands remain validation gaps, not asserted
+> failures.
+
+> **IMPLEMENTATION UPDATE — released in 5.8.14**
+>
+> `AUD-513-N01` closes the write-policy breach reported on `rename-class`. The policy now
+> distinguishes optional artifact creation from source mutation: a mutation guard stops the
+> entire rename plan before its first write, including the physical Java file rename. The
+> command is now explicit in root help's mutating-command table. Regressions exercise both
+> `--no-write` and `ASK_READONLY=1`, while retaining a successful readonly `--dry-run`.
+>
+> `AUD-513-N02` and `B-4` close the posture population falsehood: the bean summary is now
+> derived from the canonical Spring IoC registry, excludes plain/JPA-only/non-Spring symbols,
+> and declares both population units and unconditional security configurations. `N-5` remains
+> open because it concerns a different progress/advisory population.
+>
+> `AUD-513-B01` closes the MyBatis fact conflict: an XML-backed mapper interface is no longer
+> demoted to a DTO mapper merely because it omits `@Mapper` and relies on `@MapperScan`.
+> `AUD-513-B05` also closes: `imports_found` now names only Java imports, with generic trigger
+> evidence carried separately. `B-3` is closed as revalidated: the agent and compact views
+> share their Java/Spring section authority, now explicitly regressed with a MyBatis pair.
+
+> **Recommended product work**
+>
+> First make `risk`'s output promise an end-to-end invariant and expose its initial
+> working-set count so incomplete-cache behavior is diagnosable. Then repair the ASK-09
+> harness to read the emit-seam document and either sanitize or disclose inherited execution
+> variables. Measure `data-exposure` under the isolated-cache, interleaved-control protocol
+> before optimizing it. Complete the shared answer-contract layer (`AUD-588-F02`) by binding
+> existing authorities into impact, plan and compare, and recalibrate cost guidance only from
+> provenance-bearing measurements (`AUD-588-F03`). EclipseLink automation remains deferred;
+> its current applicability and non-coverage disclosure are already verified.
 
 > **MCP HARDENING — released in 5.8.13**
 >

{sourcecode-5.8.13 → sourcecode-5.8.14}/docs/USER_GUIDE.md

@@ -138,7 +138,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.13
+# ask 5.8.14
 ```
 
 Requires Python 3.9+.

{sourcecode-5.8.13 → sourcecode-5.8.14}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.8.13"
+version = "5.8.14"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.8.13 → sourcecode-5.8.14}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.13"
+__version__ = "5.8.14"

{sourcecode-5.8.13 → sourcecode-5.8.14}/src/sourcecode/change_plan.py

@@ -139,7 +139,9 @@ def build_change_plan(
             ),
         }
 
-    seeds = list(blast["matched_fqns"])
+    # The user-facing match names the requested target; planning must retain the
+    # subtype-expanded seeds that the blast-radius authority actually analysed.
+    seeds = list(blast.get("analysis_seed_fqns") or blast["matched_fqns"])
     container_wired = [w.to_dict() for w in detect_classes(cir, seeds)]
     meta = _node_meta(cir)
     affected = _dependents_closure(cir.reverse_graph or {}, seeds, max_depth, _NODE_CAP)
@@ -210,6 +212,11 @@ def build_change_plan(
         checklist.append(
             f"{len(sec)} secured endpoint(s) in scope — re-check authorization."
         )
+    if container_wired:
+        checklist.append(
+            f"{len(container_wired)} container-wired component(s) are in scope — "
+            "review their declared framework wiring because fan-in does not measure it."
+        )
     txn = blast.get("transactional_boundaries_touched") or []
     if txn:
         checklist.append(f"{len(txn)} transactional boundary/boundaries in scope.")

{sourcecode-5.8.13 → sourcecode-5.8.14}/src/sourcecode/cli.py

@@ -6,6 +6,7 @@ import hashlib
 import json
 import difflib
 import os
+import re
 import sys
 import tempfile
 import threading
@@ -287,6 +288,7 @@ COMMANDS_THAT_WRITE: "tuple[tuple[str, str], ...]" = (
     ("migrate-check", "`<repo>/.ask/readiness-history/` — only with `--history`"),
     ("verify", "`<repo>/.ask/contracts-baseline.json` — only with `--update-baseline`"),
     ("verify-edit", "the repository's git hooks directory — only with `--install-hook`"),
+    ("rename-class", "`<repo>/**/*.java` — only without `--dry-run`; existing sources change and the declaring file is renamed"),
     ("*", "`<repo>/.ask/runs/` — only when `ASK_RUNS_IN_REPO=1` is set"),
 )
 
@@ -294,7 +296,7 @@ COMMANDS_THAT_WRITE: "tuple[tuple[str, str], ...]" = (
 def _writes_help_block() -> str:
     """The `--no-write` table as `--help` prints it — generated, never typed."""
     lines = [
-        "Commands that create files inside the repository (everything else reads only):",
+        "Commands that modify files inside the repository (everything else reads only):",
         "",
     ]
     width = max(len(name) for name, _ in COMMANDS_THAT_WRITE)
@@ -1625,7 +1627,10 @@ def _budget_evidence(command: str, path: "Optional[Path]") -> "tuple[Optional[st
         if path is not None:
             measured = _plan.scope_for(Path(path))
             if measured is not None and measured.measured:
-                scope = measured.describe()
+                # The scope probe can cheaply see only the snapshot/RIS store.
+                # Do not turn that partial observation into "cache warm" while
+                # a command's actual context/parse state is still unknown.
+                scope = measured.describe_for_budget()
     except Exception:
         pass  # a message about cost must never be the reason a run fails
     return anchors, scope
@@ -2325,6 +2330,32 @@ def _root_flag_usage(flag: str) -> str:
         return f"`ask {flag} <path>`"
 
 
+def _numeric_range_error_context(message: str) -> dict[str, object]:
+    """Extract structured facts from Click's lower-bound validation message.
+
+    Click owns parser-time validation, so commands never start work for an
+    invalid value. Its stock message contains the useful facts but leaves
+    automation to parse prose; expose those facts in the shared error envelope.
+    """
+    prefix, separator, remainder = message.partition(": ")
+    if not separator or not prefix.startswith("Invalid value for "):
+        return {}
+    minimum = re.search(
+        r"is not in (?:the )?range (?:x>=(\d+)|(\d+)<=x(?:<=\d+)?)",
+        remainder,
+    )
+    value = re.match(r"(-?\d+)\s+is not in", remainder)
+    flags = re.findall(r"'(--[^']+)'", prefix)
+    if minimum is None or value is None or not flags:
+        return {}
+    lower_bound = minimum.group(1) or minimum.group(2)
+    return {
+        "flag": flags[0],
+        "value": int(value.group(1)),
+        "expected": f"an integer >= {lower_bound}",
+    }
+
+
 try:
     import click.exceptions as _click_exc
 
@@ -2386,7 +2417,11 @@ try:
 
     def _json_click_usage_error_show(self: Any, file: Any = None) -> None:  # type: ignore[override]
         import json as _je
+        _message = self.format_message()
+        _numeric_context = _numeric_range_error_context(_message)
         _flag, _hint = _misplaced_global_flag_hint(self)
+        if _numeric_context:
+            _flag = str(_numeric_context["flag"])
         if not _hint:
             _nearby = _nearby_command_flag_hint(self)
             if _nearby:
@@ -2396,10 +2431,13 @@ try:
             _context["flag"] = _flag
         if _hint:
             _context["scope"] = "root"
+        if _numeric_context:
+            _context["value"] = _numeric_context["value"]
         payload = build_error_envelope(
             INVALID_INPUT_CODE,
-            self.format_message(),
+            _message,
             hint=_hint,
+            expected=(str(_numeric_context["expected"]) if _numeric_context else None),
             **_context,
         )
         sys.stderr.write(_je.dumps(payload, ensure_ascii=_json_ensure_ascii()) + "\n")
@@ -5086,7 +5124,9 @@ def main(
         sm.key_dependencies = _deduped_deps  # no cap — all direct deps included
 
     # LQN-02: deterministic NL summary
-    sm.project_summary = ProjectSummarizer(target).generate(sm)
+    _summarizer = ProjectSummarizer(target)
+    sm.project_summary = _summarizer.generate(sm)
+    sm.summary_basis = _summarizer.summary_basis
     sm.architecture_summary = ArchitectureSummarizer(target).generate(sm)
 
     # Phase 13 Plan 04: Architectural Inference (--architecture flag)
@@ -6593,11 +6633,13 @@ def repo_ir_cmd(
         None,
         "--max-nodes",
         help="Limit graph.nodes to top N by impact score (reduces output size)",
+        min=0,
     ),
     max_edges: Optional[int] = typer.Option(
         None,
         "--max-edges",
         help="Limit graph.edges to N (priority: edges between kept nodes)",
+        min=0,
     ),
     summary_only: bool = typer.Option(
         False,
@@ -7188,6 +7230,7 @@ def endpoints_cmd(
     limit: Optional[int] = typer.Option(
         None, "--limit", "-n",
         help="Maximum number of endpoints to return.",
+        min=0,
     ),
     compact: bool = typer.Option(
         False, "--compact",
@@ -7946,6 +7989,7 @@ def validation_cmd(
         None, "--limit",
         help="Keep at most N rows per list (endpoints, gaps, validators); the "
              "summary stays whole and each cut list declares what it omitted.",
+        min=0,
     ),
     compact: bool = typer.Option(
         False, "--compact",
@@ -10630,7 +10674,7 @@ def risk_cmd(
         help="Repository path (default: current directory).",
     ),
     limit: int = typer.Option(
-        50, "--limit", help="How many composed risks to publish (highest first)."
+        50, "--limit", help="How many composed risks to publish (highest first).", min=0,
     ),
     table: bool = typer.Option(
         False,
@@ -10841,7 +10885,7 @@ def enrich_cmd(
         ),
     ),
     limit: int = typer.Option(
-        50, "--limit", help="How many enriched findings to publish (highest first)."
+        50, "--limit", help="How many enriched findings to publish (highest first).", min=0,
     ),
     table: bool = typer.Option(
         False,
@@ -11501,6 +11545,7 @@ def posture_cmd(
         "--limit",
         help="Keep at most N beans per list (active/inactive/unresolved); the "
              "counts stay whole and each cut list declares what it omitted.",
+        min=0,
     ),
     compact: bool = typer.Option(
         False,
@@ -11988,6 +12033,8 @@ def migrate_check_cmd(
     depth: int = typer.Option(
         4, "--depth",
         help="Caller BFS depth for --blast-radius (1-8, default: 4).",
+        min=1,
+        max=8,
     ),
     detach: bool = _detach_option(),
     progress_mode: Optional[str] = _progress_option(),
@@ -12313,6 +12360,7 @@ def impact_chain_cmd(
         help="Maximum items per list section (callers, endpoints, security "
              "surfaces). Totals stay exact in metadata/truncated_lists. "
              "0 disables the cap.",
+        min=0,
     ),
     with_findings: bool = typer.Option(
         False, "--with-findings",
@@ -12636,7 +12684,8 @@ def explain_cmd(
     limit: int = typer.Option(
         50, "--limit",
         help="Maximum items per list section (callers, methods, deps). "
-             "0 disables the cap. Truncation is always reported in warnings.",
+        "0 disables the cap. Truncation is always reported in warnings.",
+        min=0,
     ),
     copy: bool = _copy_option(),
     progress_mode: Optional[str] = _progress_option(),
@@ -13502,10 +13551,12 @@ def chunk_file_cmd(
     max_lines: int = typer.Option(
         500, "--max-lines", "-n",
         help="Target max lines per chunk (default: 500). Methods > max_lines emit size_warning.",
+        min=1,
     ),
     chunk_id: Optional[int] = typer.Option(
         None, "--chunk", "-c",
         help="Return only this chunk by ID (1-based). Omit to return all chunks.",
+        min=1,
     ),
     metadata_only: bool = typer.Option(
         False, "--metadata-only",
@@ -16476,7 +16527,7 @@ def main_entry() -> None:
             INVALID_INPUT_CODE,
             str(_refused),
             hint=(
-                "The run was asked to create something inside the repository while "
+                "The run was asked to modify something inside the repository while "
                 "--no-write (ASK_READONLY=1) was in force. Drop the flag that "
                 "persists — or point its directory option outside the repository — "
                 "and the same answer is produced with the artefact."

{sourcecode-5.8.13 → sourcecode-5.8.14}/src/sourcecode/compare.py

@@ -40,7 +40,7 @@ COMPARE_SCHEMA: str = "candidate-comparison-v1"
 _COST_FIELDS: tuple[str, ...] = (
     "blast_radius", "affected_endpoints", "modules_spanned",
     "secured_endpoints", "transactional_boundaries", "tests_at_risk",
-    "rollback_files",
+    "rollback_files", "container_wired_components",
 )
 
 # Resolutions on which D3's build_change_plan returns a bare resolution notice
@@ -108,6 +108,7 @@ def _cost_vector(plan: dict, blast: dict) -> dict[str, int]:
         "modules_spanned": modules,
         "secured_endpoints": secured,
         "transactional_boundaries": txn,
+        "container_wired_components": len(plan.get("container_wired") or []),
     }
 
 
@@ -151,6 +152,7 @@ def _rank_key(cand: dict) -> tuple:
         -c["transactional_boundaries"],
         -c["tests_at_risk"],
         -c["rollback_files"],
+        -c["container_wired_components"],
         cand["target"],
     )
 
@@ -299,6 +301,10 @@ def build_comparison(
             ),
             "tests_at_risk": "covering test symbols that reach the change",
             "rollback_files": "files the change would touch on revert",
+            "container_wired_components": (
+                "components reached by declared framework/container wiring; this is "
+                "separate from reverse-call fan-in"
+            ),
         },
         "candidates": candidates,
         "provenance": (