sourcecode 5.8.15__py3-none-any.whl → 5.8.16__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.15"
+__version__ = "5.8.16"

sourcecode/_docs/DEFECT-LEDGER.md

@@ -16,22 +16,43 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
-**Latest attached audit of release `5.8.14`; correction battery targets `5.8.15`:** score **93/100**, coverage **53/61
-invocables (87%)**, byte-identical CIR across five versions, and no functional-result
-regression. One reproducible performance regression is now the primary release concern;
-the historical `risk` P0 remains open because five successful runs do not disprove two
-earlier exit-0/no-output failures. Only the fifth-pass section below declares present
-state; older audit rounds remain below for traceability.
+**Latest attached audit of release `5.8.15`:** score **90/100**, coverage **54/62
+invocables (87%)**, byte-identical CIR across six versions, and no longitudinal functional
+regression. A new P1 affects dirty-tree `verify-edit`; BUG-1 is reproduced on the
+Windows/NTFS audit host. The historical `risk` P0 remains open because nine successful
+runs do not disprove two earlier exit-0/no-output failures. Only the sixth-pass section
+below declares present state; older audit rounds remain for traceability.
 
 **Release status:** entries marked “pending `5.8.14`” in their historical wording are
 shipped in `5.8.14`; the correction battery fixes listed above are included in `5.8.15`.
 
+**Current release:** `5.8.16` includes two post-audit corrections: compact cold-start
+identity is preserved for `no_ris`, and manifest-cache keys include Python requirements
+files. The testing-repository hygiene exercise changed no external repository; it
+completed 108/108 read-only workflow runs with valid JSON and exit code 0.
+
 The battery also closed the following reproducible contract defects in `5.8.15`:
 `migrate-apply` is registered across help, progress, path-admission, output-purity,
 cache and schema authorities (`1d00ba2`); endpoint census output distinguishes excluded
 test modules from retained test-fixture routes (`f65336d`, `014dec7`, `1c6cd0b`);
 and compact posture output retains counts while omitting unresolved bodies (`dad5dad`).
 
+The sixth audit supersedes the previous queue where it has stronger evidence: BUG-3 is
+closed in stable-cache regime, BUG-1 is reproduced on the audit host, and BUG-4a is
+partial because `onboard` still has no machine-readable population block.
+
+### Sixth Audit Pass: `5.8.15` / `saint-server` / 2026-08-20
+
+| ID | Severity | Current status | Required direction |
+|---|---|---|---|
+| `BUG-6` / `AUD-588-F02` | P1 | **implemented in working tree** (`26b4ab0`), external clone integration pending: removed security findings now count as changes and both-direction unit coverage passes. | Prove the real `authenticated() -> permitAll()` clone case before release; access opening remains the gate. |
+| `BUG-1` / `AUD-511-R02`, `AUD-589-B02`, `AUD-513-N06` | P1 | **reproduced on Windows/NTFS**: `spring-audit` x1.66, `modernize` x1.67, `migrate-check` x1.90, `cache warm` x2.82 versus 5.8.13; output remains byte-identical. | Profile the target host and isolate the shared slow path; add a cross-host performance guard. |
+| `BUG-3` / `443b345` | P1 | **closed in stable-cache regime**: `data-exposure` is 15.6s median, 7.2s best versus 41–44s historically, with identical output. | Preserve shared-CIR reuse and record host/cache provenance. |
+| `BUG-4a` / `24b4185` | P2 | **implemented in working tree** (`89ee4a5`): the RIS fast path now publishes population/unit/total like the full path. | Validate and reconcile the 6939 versus 6947 scopes/bases before release. |
+| `BUG-2` / `b5acc63` | P0 | **open, hardened**: 4/4 current runs delivered artifacts; historical failures remain unrefuted. | Keep the real subprocess invariant and reproduce historical failure conditions before closure. |
+| `BUG-5` / `AUD-588-B12`, `AUD-588-F03` | P2 | **open**: cost anchors remain stale; `risk` model 77.2s versus ~305s observed, warm 166.7s versus 316s. | Rebuild anchors with host, cache state, version and sample provenance. |
+| `AUD-588-F05` | Validation gap | **partially covered**: dirty-tree `verify-edit` is covered; seven mutating/denied invocables remain. | Finish the clone-based matrix without modifying the original repository. |
+
 ### Fifth Audit Pass: `5.8.14` / `saint-server` / 2026-08-20
 
 | ID | Severity | Current status | Required direction |

sourcecode/_docs/USER_GUIDE.md

@@ -46,7 +46,7 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.8.15, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.8.16, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
@@ -142,7 +142,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.15
+# ask 5.8.16
 ```
 
 Requires Python 3.9+.

sourcecode/cli.py

@@ -15468,6 +15468,19 @@ def cold_start_cmd(
         # so. All three are the shared bound now, not a rule invented here.
         from sourcecode.output_bounds import compact_document, declare_cap
 
+        # Keep the compact contract attributable even when there is no RIS yet.
+        # There is no repository identity to recover in this case, so publish
+        # explicit unknowns rather than letting the `no_ris` stub lose the
+        # immutable provenance fields during compaction.
+        if result.get("status") == "no_ris":
+            result = {
+                "schema_version": "1.1",
+                "status": "no_ris",
+                "repo_id": None,
+                "git_head": None,
+                "current_git_head": None,
+            }
+
         _CS_ORIENTATION = (
             "summary", "entrypoints", "endpoints", "project_type", "validation",
         )

sourcecode/manifest_cache.py

@@ -22,7 +22,7 @@ def _key(root: Path) -> str:
     names = {
         "pom.xml", "build.gradle", "build.gradle.kts", "package.json",
         "package-lock.json", "pyproject.toml", "Cargo.toml", "go.mod",
-        "composer.json", "Gemfile",
+        "requirements.txt", "requirements-dev.txt", "composer.json", "Gemfile",
         "*.csproj", "packages.lock.json",
     }
     paths: set[Path] = set()

sourcecode/prepare_context.py

@@ -1171,6 +1171,24 @@ class TaskContextBuilder:
             if spec.enable_dependencies and not _ris_key_deps:
                 return None
 
+            # The RIS fast path used to omit the population block that the full
+            # onboarding scan publishes. That made a warm `onboard` answer
+            # unverifiable and left its prose count without a declared basis.
+            from sourcecode.path_filters import analysis_reads
+
+            source_total = 0
+            for candidate in self.root.rglob("*"):
+                if not candidate.is_file():
+                    continue
+                try:
+                    relative = candidate.relative_to(self.root).as_posix()
+                except ValueError:
+                    continue
+                if not analysis_reads(relative) or self._is_test(relative):
+                    continue
+                if self._is_source(relative):
+                    source_total += 1
+
             return TaskOutput(
                 task=task_name,
                 goal=spec.goal,
@@ -1185,6 +1203,11 @@ class TaskContextBuilder:
                 limitations=[],
                 confidence=compact.get("confidence") or compact.get("confidence_summary") or "high",
                 gaps=_gap_strs,
+                population={
+                    "name": "source files",
+                    "unit": "non-test source files in the scanned repository tree",
+                    "total": source_total,
+                },
             )
         except Exception:
             return None

sourcecode/verify_edit.py

@@ -664,7 +664,45 @@ def _tx_axis(cir_head: Any, cir_working: Any, root: Path) -> AxisResult:
 
 def _security_axis(cir_head: Any, cir_working: Any, root: Path) -> AxisResult:
     from sourcecode.spring_security_audit import run_security_audit
-    return _spring_finding_diff(cir_head, cir_working, root, run_security_audit)
+    try:
+        head_res = run_security_audit(cir_head, root=root)
+        work_res = run_security_audit(cir_working, root=root)
+    except Exception as exc:
+        return AxisResult(None, f"analyzer error: {exc}")
+
+    head_by_id = {finding.id: finding for finding in head_res.findings}
+    work_by_id = {finding.id: finding for finding in work_res.findings}
+    introduced = [work_by_id[key] for key in sorted(set(work_by_id) - set(head_by_id))]
+    removed = [head_by_id[key] for key in sorted(set(head_by_id) - set(work_by_id))]
+    if not introduced and not removed:
+        return AxisResult(False)
+
+    items = tuple(
+        {
+            "change": "introduced",
+            "pattern_id": finding.pattern_id,
+            "symbol": finding.symbol,
+            "severity": finding.severity,
+            "title": finding.title,
+            "source_file": finding.source_file,
+        }
+        for finding in introduced
+    ) + tuple(
+        {
+            "change": "removed",
+            "pattern_id": finding.pattern_id,
+            "symbol": finding.symbol,
+            "severity": finding.severity,
+            "title": finding.title,
+            "source_file": finding.source_file,
+        }
+        for finding in removed
+    )
+    return AxisResult(
+        True,
+        f"{len(items)} security finding(s) changed",
+        items,
+    )
 
 
 # ── bean-wiring axis (injects-graph diff) ───────────────────────────────────────

{sourcecode-5.8.15.dist-info → sourcecode-5.8.16.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.15
+Version: 5.8.16
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -55,7 +55,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.15-blue)
+![Version](https://img.shields.io/badge/version-5.8.16-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -125,7 +125,7 @@ stops at 1 408 files and ends at 5.1s. Commands outside that phase-runner set
 must not be gated on this variable; their budget applicability remains visible in
 the [defect ledger](docs/DEFECT-LEDGER.md).
 
-**Current performance status.** Release 5.8.15 retains the shared Canonical IR
+**Current performance status.** Release 5.8.16 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. The one-model-per-declared-label path is
 also retained. These are implementation properties, not duration promises:
@@ -159,7 +159,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.15 — and, on a build that has aged,
+ask version                    # ask 5.8.16 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.15.dist-info → sourcecode-5.8.16.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=XkjZwoLmFBIUN_v9TR2irdiEOzyJM_rnZSG49QAGn-Y,309
+sourcecode/__init__.py,sha256=Y0P-TJN2mc6gX2RJqq4IZpp8T5vA4rulRgfl6_vdaBs,309
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/answer_bounds.py,sha256=_51_DCuYEUmI_xwUFxDMiprSavkNakkLiIBbPjevQ3M,9793
 sourcecode/archetype.py,sha256=V_s5grgpbanrXb8qGEQb73W5Cg5iKW9FQHWKgg5KM8Y,41201
@@ -26,7 +26,7 @@ sourcecode/change_plan.py,sha256=drAoDsqFplutCLc6Y0xue7sYkTls0SpYh7aOXvttv3I,129
 sourcecode/ci_output.py,sha256=un1GjW0iw9hQA9g-7xpOseBxctQIrAic57WKxTbIGNA,2457
 sourcecode/cir_graphs.py,sha256=RytqSv1WF8kdlfXj2fPQz16LY4akS2kyThbdWL8beCQ,14835
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=zlW0T8FFy1gKwkC4gteKV5j3LdZ9OKZDYCQ7qhspPg8,749596
+sourcecode/cli.py,sha256=06_AbXWvfp4YYE8yWB5Q3VO82FKBulBK1IL0ARBocdw,750155
 sourcecode/client_calls.py,sha256=YOPnfRZzRyqmdHvXSVeiunW8cuiuCuWXacNIQRgKMCw,22640
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=FeDsbf7VACLcc6muA9mx_3iHmlDyq7QFqGPYGme9jtY,15141
@@ -84,7 +84,7 @@ sourcecode/identity_fallback.py,sha256=uRC_j_80uaI4Ue4tf-OhKX4h472dmufYcjEFGSxY2
 sourcecode/integration_coordinates.py,sha256=rvuApnS7WdRUbeQLg_oKj-Gi0koO2RKdw6HenXNgrDo,12443
 sourcecode/jdk_exports.py,sha256=fCrlwNAXUT9gge_joq6kMnY3zJxYB2pxqy-0w3o3MJI,874
 sourcecode/license.py,sha256=vvgE1vBUWh8ozWI7USYuteh6noxntnjuzDQIPF-l4rA,27795
-sourcecode/manifest_cache.py,sha256=HR0wPIFA5odNGzHrMHS_H2GdveU6ZnyBeoGThB0BLoY,2200
+sourcecode/manifest_cache.py,sha256=aPRHUs781d00fVbtlTiSaq0-AS9bAqS7_zJ0snZvlJs,2244
 sourcecode/mcp_nudge.py,sha256=lKemOqK_wny2u7Ymcr2Idi5Kx8pXY02jCi-_nJYLGMg,2992
 sourcecode/metrics_analyzer.py,sha256=gLoRWKygF18jLgwsqmGXSWopw-f5iO1VbM7Jjdif6ag,22809
 sourcecode/migrate_check.py,sha256=MtUQVI97_9KE_0qHrm5eFybzTSBVYwEu3QcIeLhzEmI,154366
@@ -109,7 +109,7 @@ sourcecode/pipe_contract.py,sha256=PML0Er5d8uDyec4OrdUXuyqHbGPUYndjeaKUjkFz2u4,8
 sourcecode/posture.py,sha256=6Rg4s-OUBYhXFlsVIbU_8H_bDB15zPjkhSNGzq3kUfs,85077
 sourcecode/pr_comment_renderer.py,sha256=239PmJdf95av_ZW236C7_tvq_ahECeuF9AZxrheJ4OQ,15573
 sourcecode/pr_impact.py,sha256=taHp0X57tLHyKQ5Qvx7UM1HhX4_csw5t0bgLdN7jYm8,37010
-sourcecode/prepare_context.py,sha256=fb28z60IXSR9rI9BMUc_xKl-mHtXtZap-wUgzenm8nA,239862
+sourcecode/prepare_context.py,sha256=Dc31QYmhgsvLvPav4py4E0RK_QBlj5K8oJ5TFn9ATi8,240881
 sourcecode/product_info.py,sha256=0zjZEutL7iDdp9aVyIumIrNyNn9VWYFc2lIytSbjBP4,727
 sourcecode/progress.py,sha256=naKbWFqf-eTE3vtLsi-eHYILz0p3pxCASAzMmvxUIAI,21643
 sourcecode/provenance.py,sha256=gLbsLv0gze7k7ChM4i5M3MwKfFPzs8wzM72rUd2C5sM,7342
@@ -173,7 +173,7 @@ sourcecode/tree_utils.py,sha256=8GAkIfQAsvtEudIeW1l4ooH_oRtrWR8cpJQJsEa_Pfw,2093
 sourcecode/type_usage_surface.py,sha256=51IrKRQoIoRnlsiDjHnqpJBn2rc6E59aRhgS0HTzAF0,4428
 sourcecode/validation_inference.py,sha256=-oWJqE6PqkqcZbCFDJeWCQHgI9Dbuv5ggJWD3LE_2IU,20817
 sourcecode/validation_surface.py,sha256=9hgQ4TmMHOhFatEK9Jn0eAsVMfUq83qAhB2QmjJEv9U,35861
-sourcecode/verify_edit.py,sha256=u2UeJ4n0zDzJ9gkq-1MiLv7Msfm8mLdUy0O_ZkaKxOE,51161
+sourcecode/verify_edit.py,sha256=6w1Y_qErPSxagBsQlkC-Yt4_ZS3vD8sd50BAsZrg1Dg,52433
 sourcecode/verify_repo.py,sha256=aHlNIUfoVVUxTXTNtSFryP4dOFBOvCfdyC31fFRXU6s,15346
 sourcecode/verify_rules.py,sha256=R3l6nLT6WQzUNBzxtmnxyGZcKj9qMDW38Y0c0gNdCGk,19973
 sourcecode/version_check.py,sha256=CHp6ZxTIfo8kyHPCBgJA1uFC0xQCoXMuuOfrW8QTL8o,4942
@@ -243,13 +243,13 @@ sourcecode/telemetry/consent.py,sha256=-Wb8BFGXEexOs8M0Eja7F-T6ZtLNPeRoZnHcHvlP7
 sourcecode/telemetry/events.py,sha256=l3Z2SQUO4_C2D2ItXOOdVNimAmHedUHnUxqYFTxnsAE,2900
 sourcecode/telemetry/filters.py,sha256=-lqT2oorECuqEIdeHb--7AZ6BCaUx0bya720a-Z5x6w,7335
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode/_docs/DEFECT-LEDGER.md,sha256=QjsZQsblTeWgYQYnpXLtk4JYKPQayYKCYy0UQbGEEbw,753566
+sourcecode/_docs/DEFECT-LEDGER.md,sha256=qrdrQYze1OwEQM1rOB35AaOdTzmABOSmv4TCSpoGQM4,756012
 sourcecode/_docs/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
 sourcecode/_docs/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode/_docs/USER_GUIDE.md,sha256=Cu0fOKFYcgt9lCnxjVulRUdMAn_u2770LSPbpWT3rJ4,90158
-sourcecode-5.8.15.dist-info/METADATA,sha256=a3C9w920U5rO3-wKGnwoo5e02M3qY--5fxHI-S-s3oc,53019
-sourcecode-5.8.15.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-5.8.15.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-5.8.15.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
-sourcecode-5.8.15.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode-5.8.15.dist-info/RECORD,,
+sourcecode/_docs/USER_GUIDE.md,sha256=V5n0CDPM7Is-33De21C3zSUrnHYImJ1ev4ENirmjOUo,90158
+sourcecode-5.8.16.dist-info/METADATA,sha256=kXcuCMqHb2TyOXJzhv8gOUDTDE2HMgAeGNmd2xHyaas,53019
+sourcecode-5.8.16.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-5.8.16.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-5.8.16.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
+sourcecode-5.8.16.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
+sourcecode-5.8.16.dist-info/RECORD,,