sourcecode 5.8.15__tar.gz → 5.8.16__tar.gz

{sourcecode-5.8.15 → sourcecode-5.8.16}/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [5.8.16] — 2026-08-20
+
+*Post-audit correction release with cache and compact-output hardening.*
+
+### Fixed
+- `cold-start --compact` now preserves its immutable identity contract even when
+  no Repository Intelligence Snapshot exists; unknown identity fields remain
+  explicit instead of being silently omitted.
+- Dependency manifest cache keys now include `requirements.txt` and
+  `requirements-dev.txt`, preventing stale empty results after Python dependency
+  manifests are added or changed.
+
+### Verified
+- ASK exercised against all 36 repositories under `documents/workspace/testing`
+  across context, endpoint inventory and migration-check workflows: 108/108 runs
+  returned valid JSON with exit code 0.
+- Focused regression coverage for compact identity, RIS, manifest caching and the
+  prior correction battery passes.
+
 ## [5.8.15] — 2026-08-20
 
 *Correction battery release based on the fifth 5.8.14 audit.*

{sourcecode-5.8.15 → sourcecode-5.8.16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.15
+Version: 5.8.16
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -55,7 +55,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.15-blue)
+![Version](https://img.shields.io/badge/version-5.8.16-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -125,7 +125,7 @@ stops at 1 408 files and ends at 5.1s. Commands outside that phase-runner set
 must not be gated on this variable; their budget applicability remains visible in
 the [defect ledger](docs/DEFECT-LEDGER.md).
 
-**Current performance status.** Release 5.8.15 retains the shared Canonical IR
+**Current performance status.** Release 5.8.16 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. The one-model-per-declared-label path is
 also retained. These are implementation properties, not duration promises:
@@ -159,7 +159,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.15 — and, on a build that has aged,
+ask version                    # ask 5.8.16 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.15 → sourcecode-5.8.16}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.15-blue)
+![Version](https://img.shields.io/badge/version-5.8.16-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -80,7 +80,7 @@ stops at 1 408 files and ends at 5.1s. Commands outside that phase-runner set
 must not be gated on this variable; their budget applicability remains visible in
 the [defect ledger](docs/DEFECT-LEDGER.md).
 
-**Current performance status.** Release 5.8.15 retains the shared Canonical IR
+**Current performance status.** Release 5.8.16 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. The one-model-per-declared-label path is
 also retained. These are implementation properties, not duration promises:
@@ -114,7 +114,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.15 — and, on a build that has aged,
+ask version                    # ask 5.8.16 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.15 → sourcecode-5.8.16}/docs/DEFECT-LEDGER.md

@@ -16,22 +16,43 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
-**Latest attached audit of release `5.8.14`; correction battery targets `5.8.15`:** score **93/100**, coverage **53/61
-invocables (87%)**, byte-identical CIR across five versions, and no functional-result
-regression. One reproducible performance regression is now the primary release concern;
-the historical `risk` P0 remains open because five successful runs do not disprove two
-earlier exit-0/no-output failures. Only the fifth-pass section below declares present
-state; older audit rounds remain below for traceability.
+**Latest attached audit of release `5.8.15`:** score **90/100**, coverage **54/62
+invocables (87%)**, byte-identical CIR across six versions, and no longitudinal functional
+regression. A new P1 affects dirty-tree `verify-edit`; BUG-1 is reproduced on the
+Windows/NTFS audit host. The historical `risk` P0 remains open because nine successful
+runs do not disprove two earlier exit-0/no-output failures. Only the sixth-pass section
+below declares present state; older audit rounds remain for traceability.
 
 **Release status:** entries marked “pending `5.8.14`” in their historical wording are
 shipped in `5.8.14`; the correction battery fixes listed above are included in `5.8.15`.
 
+**Current release:** `5.8.16` includes two post-audit corrections: compact cold-start
+identity is preserved for `no_ris`, and manifest-cache keys include Python requirements
+files. The testing-repository hygiene exercise changed no external repository; it
+completed 108/108 read-only workflow runs with valid JSON and exit code 0.
+
 The battery also closed the following reproducible contract defects in `5.8.15`:
 `migrate-apply` is registered across help, progress, path-admission, output-purity,
 cache and schema authorities (`1d00ba2`); endpoint census output distinguishes excluded
 test modules from retained test-fixture routes (`f65336d`, `014dec7`, `1c6cd0b`);
 and compact posture output retains counts while omitting unresolved bodies (`dad5dad`).
 
+The sixth audit supersedes the previous queue where it has stronger evidence: BUG-3 is
+closed in stable-cache regime, BUG-1 is reproduced on the audit host, and BUG-4a is
+partial because `onboard` still has no machine-readable population block.
+
+### Sixth Audit Pass: `5.8.15` / `saint-server` / 2026-08-20
+
+| ID | Severity | Current status | Required direction |
+|---|---|---|---|
+| `BUG-6` / `AUD-588-F02` | P1 | **implemented in working tree** (`26b4ab0`), external clone integration pending: removed security findings now count as changes and both-direction unit coverage passes. | Prove the real `authenticated() -> permitAll()` clone case before release; access opening remains the gate. |
+| `BUG-1` / `AUD-511-R02`, `AUD-589-B02`, `AUD-513-N06` | P1 | **reproduced on Windows/NTFS**: `spring-audit` x1.66, `modernize` x1.67, `migrate-check` x1.90, `cache warm` x2.82 versus 5.8.13; output remains byte-identical. | Profile the target host and isolate the shared slow path; add a cross-host performance guard. |
+| `BUG-3` / `443b345` | P1 | **closed in stable-cache regime**: `data-exposure` is 15.6s median, 7.2s best versus 41–44s historically, with identical output. | Preserve shared-CIR reuse and record host/cache provenance. |
+| `BUG-4a` / `24b4185` | P2 | **implemented in working tree** (`89ee4a5`): the RIS fast path now publishes population/unit/total like the full path. | Validate and reconcile the 6939 versus 6947 scopes/bases before release. |
+| `BUG-2` / `b5acc63` | P0 | **open, hardened**: 4/4 current runs delivered artifacts; historical failures remain unrefuted. | Keep the real subprocess invariant and reproduce historical failure conditions before closure. |
+| `BUG-5` / `AUD-588-B12`, `AUD-588-F03` | P2 | **open**: cost anchors remain stale; `risk` model 77.2s versus ~305s observed, warm 166.7s versus 316s. | Rebuild anchors with host, cache state, version and sample provenance. |
+| `AUD-588-F05` | Validation gap | **partially covered**: dirty-tree `verify-edit` is covered; seven mutating/denied invocables remain. | Finish the clone-based matrix without modifying the original repository. |
+
 ### Fifth Audit Pass: `5.8.14` / `saint-server` / 2026-08-20
 
 | ID | Severity | Current status | Required direction |

{sourcecode-5.8.15 → sourcecode-5.8.16}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,36 +3,53 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT STATE — correction battery for 5.8.15, based on the fifth 5.8.14 audit, `saint-server`, 2026-08-20**
+> **CURRENT STATE — sixth audit of 5.8.15, `saint-server`, 2026-08-20**
 >
-> The audit scores **93/100** (`75 → 80 → 78 → 90 → 93`), covers **53/61 invocables
-> (87%)**, and reports a byte-identical CIR across five versions. There are no new
-> functional-result regressions. The correction battery reproduced no BUG-1/BUG-2
-> regression locally; six-run steady `risk` converged at 6.56s with a clean control.
+> The audit scores **90/100** (`75 → 80 → 78 → 90 → 93 → 90`), covers **54/62 invocables
+> (87%)**, and reports a byte-identical CIR across six versions. It found a new P1 in
+> dirty-tree `verify-edit` and reproduced BUG-1 on the Windows/NTFS audit host; the
+> longitudinal functional anchors remain unchanged.
 >
 > The posture bean anchor intentionally changed from 6,667 unconditional types to
 > **1,904 Spring IoC bean definitions** (`conditional=5`, `active=3`, `inactive=2`,
 > `unconditional=1,899`). This is a corrected population with explicit units, not a
 > regression. The current correction/performance queue is:
 
-> The reproducible contract gaps found while executing the battery are also shipped in
-> `5.8.15`: `migrate-apply` is integrated in help/progress/admission/schema matrices;
+> The reproducible contract gaps found while executing the battery are shipped in
+> `5.8.16`: `migrate-apply` is integrated in help/progress/admission/schema matrices;
 > endpoint output names excluded test modules and preserves test-fixture scope;
 > `posture --compact` bounds unresolved bodies without changing summary counts; and
 > `cold-start` is treated as a bounded RIS projection rather than an artificial ceiling
 > overflow case.
+
+> **POST-AUDIT CORRECTION RELEASE — 5.8.16:** `cold-start --compact` now preserves
+> immutable identity fields when no RIS exists, and manifest-cache invalidation includes
+> `requirements.txt` and `requirements-dev.txt`. The 36-repository testing exercise
+> completed 108/108 context, endpoint and migration-check runs with valid JSON and
+> exit code 0. The unrelated `tests/test_cli.py` double-preprocessing case remains a
+> test-harness issue and is not classified as a product defect.
+
+> The sixth audit verifies BUG-3 closed in stable-cache regime (`data-exposure` 15.6s
+> median, 7.2s best, byte-equivalent output), but downgrades BUG-4a to partial because
+> `onboard` still has no machine-readable population block. It reports that
+> `verify-edit` returns `security_delta.changed=false` and `pass` for both
+> `permitAll() -> authenticated()` and the dangerous reverse direction. It also
+> reproduces the cost regression: `spring-audit` x1.66, `modernize` x1.67,
+> `migrate-check` x1.90 and `cache warm` x2.82 versus 5.8.13.
 >
 > | Priority | Work | Acceptance direction |
 > |---|---|---|
-> | P1 | **BUG-1 / `AUD-511-R02`, `AUD-589-B02`, `AUD-513-N06`**: reported performance regression not reproduced by the local idle-host/interleaved controls. | Repeat the six-run 5.8.13/5.8.15 comparison on the audit host before changing code; preserve byte-identical output and the corrected posture population. |
+> | P1 | **BUG-6 / `AUD-588-F02`**: dirty-tree `verify-edit` misses active security-chain changes in both directions. | **Implemented in working tree** (`26b4ab0`): removed security findings are now treated as changes; added/removed regression tests pass. Release it only after the clone-based integration case proves access opening. |
+> | P1 | **BUG-1 / `AUD-511-R02`, `AUD-589-B02`, `AUD-513-N06`**: reproduced on Windows/NTFS: `spring-audit` x1.66, `modernize` x1.67, `migrate-check` x1.90, `cache warm` x2.82 versus 5.8.13. | Reproduce and profile on the target host; preserve byte-identical output and isolate the shared slow path. |
 > | P0 | **BUG-2 / `AUD-588-B01`, `AUD-589-B01`, `C3-122`**: historical `risk` exit-0/no-output failures were not reproduced locally. | Keep the real-entry-point invariant and require external cold/shared-cache reproduction before closure. Hardening remains `b5acc63`. |
-> | P1 | **BUG-3 / `AUD-511-R02`, `AUD-589-B02`, `AUD-513-N06`**: historical `data-exposure --config` cost remained high despite byte-equivalent output. | **Fixed in 5.8.15** (`443b345`): labelled CLI runs reuse the shared CIR; the no-label fast path remains parse-free. Re-run the external benchmark before claiming a numeric improvement. |
-> | P2 | **BUG-4a/4b**: population units and risk-tier wording were inconsistent. | **Fixed in 5.8.15** (`24b4185`, `0376350`): `onboard`/`archetype` publish source populations and help/tier authority agrees. |
+> | P1 | **BUG-3 / `443b345`**: historical `data-exposure --config` cost remained high. | **Closed in stable-cache regime**: 15.6s median and 7.2s best versus 41–44s historically, with identical output. Preserve provenance-bearing anchors. |
+> | P2 | **BUG-4a/4b**: population units and risk-tier wording were inconsistent. | **4b closed** (`0376350`). **4a implemented in working tree** (`89ee4a5`): the RIS fast path now publishes the same population block as the full onboarding path; validate against the external 6939/6947 scope discrepancy before release. |
 > | P2 / product decision | **BUG-4c**: `SEC-009` severity for active `anyRequest().permitAll()` with CSRF disabled remains `medium`. | **Resolved by design in 5.8.15** (`fb7632a`): severity remains medium and is pinned by calibration; active/profile evidence remains the decision context. |
 > | P2 | **BUG-5 / `AUD-588-B12`, `AUD-588-F03`**: cost anchors are stale in both directions, worst for `risk` (77.2s model versus 461–846s measured). | Recalibrate only from provenance-bearing measurements: repository, cache state, host, samples, version and command. Align foreground advice with the explicit progress policy. |
-> | Validation gap | **`AUD-588-F05`**: dirty-tree `verify-edit` and eight mutating/denied invocables remain unexercised externally. | Use a cloned Git repository, not an extracted archive, to test the dirty-tree path without touching the audited tree. |
+> | Validation gap | **`AUD-588-F05`**: dirty-tree `verify-edit` is covered, but seven mutating/denied invocables and several long commands remain unverified. | Keep the no-hardlinks clone protocol and finish the matrix without touching the audited tree. |
 >
-> **Remaining order:** external BUG-1/BUG-2 reproduction → BUG-5 portable cost-anchor calibration.
+> **Remaining order:** BUG-6 `verify-edit.security_delta` → BUG-1 Windows cost isolation →
+> BUG-4a onboarding population contract → BUG-5 portable cost-anchor calibration.
 > Keep the risk P0 open until the real subprocess invariant is exercised again. EclipseLink
 > migration automation remains deferred; provider non-coverage is the correct current answer.
 >

{sourcecode-5.8.15 → sourcecode-5.8.16}/docs/EXECUTIVE-ROADMAP.md

@@ -3,35 +3,44 @@
 *A software-knowledge platform for large codebases. Written for an engineering
 director; no internal implementation knowledge assumed.*
 
-> **DOCUMENT STATUS — correction battery for `5.8.15`, based on the fifth audit of `5.8.14`, `saint-server`, 2026-08-20**
+> **DOCUMENT STATUS — sixth audit of `5.8.15`, `saint-server`, 2026-08-20**
 >
-> The latest audit scores **93/100**, covers **53/61 invocables (87%)**, and reports a
-> byte-identical CIR across five versions. No functional-result regression is reported.
-> The confirmed regression is performance: `spring-audit` and `modernize` are about 1.7x
-> slower, `migrate-check` 1.83x slower, and `cache warm` 2.20x slower than 5.8.13.
-> `risk`'s historical P0 remains open because successful local runs do not disprove two
-> earlier exit-0/no-output failures.
+> The latest audit scores **90/100**, covers **54/62 invocables (87%)**, and reports a
+> byte-identical CIR across six versions. It found a new high-priority functional defect:
+> dirty-tree `verify-edit` misses security-chain changes and passes both tightening and
+> the dangerous access-opening direction. It also reproduces the performance regression
+> on Windows/NTFS: `spring-audit` x1.66, `modernize` x1.67, `migrate-check` x1.90 and
+> `cache warm` x2.82 versus 5.8.13. `data-exposure` is now closed in stable-cache regime;
+> `risk`'s historical P0 remains open.
 >
-> **Current queue:** repeat the external performance controls and risk output invariant;
-> confirm the `data-exposure --config` improvement externally after shared-CIR reuse; then
-> recalibrate cost anchors with portable provenance. Dirty-tree
-> `verify-edit` and eight mutating or denied commands remain validation gaps, not asserted
-> failures. EclipseLink migration automation remains deferred behind honest non-coverage.
+> **Current queue:** fix `verify-edit.security_delta` by consuming the posture/spring-audit
+> authority, isolate BUG-1 on the target Windows host, add the missing `onboard` population
+> contract, and recalibrate cost anchors with portable provenance. Seven mutating or denied
+> commands remain validation gaps. EclipseLink migration automation remains deferred behind
+> honest non-coverage.
 
 > **CURRENT PRIORITY**
 >
-> 1. Repeat BUG-1/BUG-2 controls on the audit host.
-> 2. Re-run `data-exposure --config` externally after shared-CIR reuse.
-> 3. Recalibrate cost anchors with repository, cache, host, samples and version.
-> 4. Keep the locally verified F05 validation gap visible until external coverage exists.
+> 1. Fix and gate `verify-edit.security_delta`, especially access opening.
+> 2. Reproduce and isolate BUG-1 on Windows/NTFS, including cache warm and long-tail variability.
+> 3. Add shared machine-readable population fields to `onboard`.
+> 4. Recalibrate cost anchors with repository, cache, host, samples and version.
+> 5. Finish the remaining F05 mutating/denied command validation.
+
+> **RELEASED IN 5.8.16:** compact cold-start output now remains attributable when no
+> RIS exists, and Python requirements manifests participate in dependency-cache
+> invalidation. A 36-repository hygiene exercise completed 108/108 read-only workflow
+> runs successfully.
 
 > **RECOMMENDED FEATURES**
 >
 > The audit recommends timing/cache provenance, a unified cache-state authority, compact/agent
 > sibling-view disclosure or parity, bounded-budget semantics, shared population units, a
 > reusable fuzzy symbol resolver, and automated breaking-change registry enforcement. These
-> continue `AUD-588-F02`/`F03`; EclipseLink automation remains deferred behind provider
-> non-coverage disclosure (`AUD-588-F01`).
+> continue `AUD-588-F02`/`F03`. The sixth pass adds security-diff parity for `verify-edit`,
+> Windows/NTFS performance isolation, and a shared onboarding population contract. Long-tail
+> latency in `validation` and `data-exposure` must be measured before attribution. EclipseLink
+> automation remains deferred behind provider non-coverage disclosure (`AUD-588-F01`).
 
 > **FIFTH-PASS INTERPRETATION:** `posture.summary` intentionally changed to the corrected
 > Spring IoC population: `1,904` beans (`5` conditional, `3` active, `2` inactive,

{sourcecode-5.8.15 → sourcecode-5.8.16}/docs/MANUAL-USUARIO.md

@@ -1,6 +1,6 @@
 # Manual de usuario — ASK Engine
 
-> Versión de la herramienta: **5.8.15**  ·  El comando que se ejecuta es `ask`.
+> Versión de la herramienta: **5.8.16**  ·  El comando que se ejecuta es `ask`.
 > (`sourcecode` sigue funcionando como alias en desactivación y reenvía a `ask`.)
 > Público: personas que van a usar `ask` por primera vez, sin conocimiento previo.
 

{sourcecode-5.8.15 → sourcecode-5.8.16}/docs/USER_GUIDE.md

@@ -46,7 +46,7 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.8.15, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.8.16, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
@@ -142,7 +142,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.15
+# ask 5.8.16
 ```
 
 Requires Python 3.9+.

{sourcecode-5.8.15 → sourcecode-5.8.16}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.8.15"
+version = "5.8.16"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.8.15 → sourcecode-5.8.16}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.15"
+__version__ = "5.8.16"

{sourcecode-5.8.15 → sourcecode-5.8.16}/src/sourcecode/cli.py

@@ -15468,6 +15468,19 @@ def cold_start_cmd(
         # so. All three are the shared bound now, not a rule invented here.
         from sourcecode.output_bounds import compact_document, declare_cap
 
+        # Keep the compact contract attributable even when there is no RIS yet.
+        # There is no repository identity to recover in this case, so publish
+        # explicit unknowns rather than letting the `no_ris` stub lose the
+        # immutable provenance fields during compaction.
+        if result.get("status") == "no_ris":
+            result = {
+                "schema_version": "1.1",
+                "status": "no_ris",
+                "repo_id": None,
+                "git_head": None,
+                "current_git_head": None,
+            }
+
         _CS_ORIENTATION = (
             "summary", "entrypoints", "endpoints", "project_type", "validation",
         )

{sourcecode-5.8.15 → sourcecode-5.8.16}/src/sourcecode/manifest_cache.py

@@ -22,7 +22,7 @@ def _key(root: Path) -> str:
     names = {
         "pom.xml", "build.gradle", "build.gradle.kts", "package.json",
         "package-lock.json", "pyproject.toml", "Cargo.toml", "go.mod",
-        "composer.json", "Gemfile",
+        "requirements.txt", "requirements-dev.txt", "composer.json", "Gemfile",
         "*.csproj", "packages.lock.json",
     }
     paths: set[Path] = set()

{sourcecode-5.8.15 → sourcecode-5.8.16}/src/sourcecode/prepare_context.py

@@ -1171,6 +1171,24 @@ class TaskContextBuilder:
             if spec.enable_dependencies and not _ris_key_deps:
                 return None
 
+            # The RIS fast path used to omit the population block that the full
+            # onboarding scan publishes. That made a warm `onboard` answer
+            # unverifiable and left its prose count without a declared basis.
+            from sourcecode.path_filters import analysis_reads
+
+            source_total = 0
+            for candidate in self.root.rglob("*"):
+                if not candidate.is_file():
+                    continue
+                try:
+                    relative = candidate.relative_to(self.root).as_posix()
+                except ValueError:
+                    continue
+                if not analysis_reads(relative) or self._is_test(relative):
+                    continue
+                if self._is_source(relative):
+                    source_total += 1
+
             return TaskOutput(
                 task=task_name,
                 goal=spec.goal,
@@ -1185,6 +1203,11 @@ class TaskContextBuilder:
                 limitations=[],
                 confidence=compact.get("confidence") or compact.get("confidence_summary") or "high",
                 gaps=_gap_strs,
+                population={
+                    "name": "source files",
+                    "unit": "non-test source files in the scanned repository tree",
+                    "total": source_total,
+                },
             )
         except Exception:
             return None

{sourcecode-5.8.15 → sourcecode-5.8.16}/src/sourcecode/verify_edit.py

@@ -664,7 +664,45 @@ def _tx_axis(cir_head: Any, cir_working: Any, root: Path) -> AxisResult:
 
 def _security_axis(cir_head: Any, cir_working: Any, root: Path) -> AxisResult:
     from sourcecode.spring_security_audit import run_security_audit
-    return _spring_finding_diff(cir_head, cir_working, root, run_security_audit)
+    try:
+        head_res = run_security_audit(cir_head, root=root)
+        work_res = run_security_audit(cir_working, root=root)
+    except Exception as exc:
+        return AxisResult(None, f"analyzer error: {exc}")
+
+    head_by_id = {finding.id: finding for finding in head_res.findings}
+    work_by_id = {finding.id: finding for finding in work_res.findings}
+    introduced = [work_by_id[key] for key in sorted(set(work_by_id) - set(head_by_id))]
+    removed = [head_by_id[key] for key in sorted(set(head_by_id) - set(work_by_id))]
+    if not introduced and not removed:
+        return AxisResult(False)
+
+    items = tuple(
+        {
+            "change": "introduced",
+            "pattern_id": finding.pattern_id,
+            "symbol": finding.symbol,
+            "severity": finding.severity,
+            "title": finding.title,
+            "source_file": finding.source_file,
+        }
+        for finding in introduced
+    ) + tuple(
+        {
+            "change": "removed",
+            "pattern_id": finding.pattern_id,
+            "symbol": finding.symbol,
+            "severity": finding.severity,
+            "title": finding.title,
+            "source_file": finding.source_file,
+        }
+        for finding in removed
+    )
+    return AxisResult(
+        True,
+        f"{len(items)} security finding(s) changed",
+        items,
+    )
 
 
 # ── bean-wiring axis (injects-graph diff) ───────────────────────────────────────