sourcecode 5.8.16__tar.gz → 5.8.18__tar.gz

{sourcecode-5.8.16 → sourcecode-5.8.18}/CHANGELOG.md

@@ -1,5 +1,100 @@
 # Changelog
 
+## [5.8.18] — 2026-08-21
+
+*The eighth audit pass is closed. Every reported fix in that queue is shipped in
+an atomic commit with a focused regression assertion; the release battery passes
+except for the pre-existing RIS B11 test failure documented in the release check.*
+
+### Eighth audit pass closure
+
+- Fixed caller-count authority drift, compact unresolved samples, scan-truncation
+  disclosure, and the meta-annotation route prefix. (`AUD-593-N01`, `AUD-592-B01`,
+  `AUD-592-A02`, `E-38`)
+- Reconciled the compact budget across help and documentation, and corrected the
+  budget scope, interface-count metadata, and caller-list cap disclosures.
+  (`AUD-593-N02`, `AUD-593-N03`, `AUD-593-N05`, `AUD-593-N06`)
+- Corrected write-inventory wording, min-band filter disclosure, unknown enrich
+  rule handling, and build-commit provenance. (`AUD-592-D01`–`D04`)
+- Isolated the compact-cache test so the CLI regression battery is deterministic.
+  (`B29`)
+
+## [5.8.17] — 2026-08-21
+
+*The seventh audit pass, closed end to end: eleven rows from P0 to P3 plus the
+open question. The defects were not in the Java/Spring analysis — every one of
+them was in the contract an agent consumes.*
+
+### The write guarantee (P0)
+
+- `verify --init` wrote `<repo>/.ask/contracts.yml` under `--no-write` and
+  `ASK_READONLY=1`, publishing a `written_to` the mode exists to make
+  impossible. Guarded at the emitter, and the sweep the row required found two
+  more: `migrate-recipe --write`, and `verify-edit --install-hook` whose guard
+  sat on the hooks *directory* — which `git init` always creates, so it could
+  never fire on any repository. (`AUD-591-A01`)
+- The published writer inventory cited two flags that have never existed and
+  omitted three commands that write. Every backticked flag in it is now resolved
+  against that command's own parameters. (`AUD-591-A08`)
+
+### The endpoint census (P0)
+
+- `route_census` decomposes `total` into `distinct_routes` and `expansion_rows`,
+  from one helper both endpoint authorities call, so a census that moves can be
+  told apart from exposure that grew. `undocumented` declares itself an alias of
+  `no_security_signal` — they were always one number under two names.
+- Found by that triage: a method-level `@GetMapping({"/a","/b"})` published `/a`
+  and silently dropped `/b`, while the class-level form had always expanded.
+  shenyu 359 → 365 published routes. (`AUD-590-R01`)
+
+### Answers that described something else
+
+- A substring sweep no longer answers like a lookup: `impact O` matched 129
+  symbols and scored them `critical` under a basis reading *"resolved directly
+  from the requested target"*. `partial` now publishes the substring basis, a
+  null score with its reason, and candidates; `not_found` publishes `null`
+  rather than `risk_score: 0.0`. (`AUD-591-A03`)
+- One `repo_id` per tree, equal to the cache directory key. The CIR content hash
+  travels as `content_id`. (`AUD-590-B01`)
+- `direct_callers` declares its unit on both commands, and each names where the
+  other keeps the same figure; `resolution_vocabulary` publishes each command's
+  value set with a note mapping it onto the other's. (`AUD-590-B02`)
+- `verify --no-ci` published `exit_code: 2` and exited 0. `exit_code` is what the
+  process returns; `gate_exit_code` is what `--ci` would return.
+  (`AUD-591-A09`)
+- The cache advisory said *"snapshot/RIS present"* beside a payload publishing
+  `snapshot: "cold"`. Two layers, two answers. (`AUD-591-A05`)
+
+### Flags that did nothing
+
+- `--rule`, `--band` and `--top-n` select the answer in every format, not only
+  under `--table`, and publish a `_filter` block with `total_before_filter`.
+  `--rule` is rejected against the catalogue the analysis iterates, before the
+  analysis runs. (`AUD-591-A02`)
+- `--path-prefix` must be a route path — the Git Bash rewrite of `/owners` into
+  `C:/Program Files/Git/owners` used to yield `total: 0` with exit 0 — and
+  `validation` scopes the summary counts that can be scoped, declaring the ones
+  that cannot. (`AUD-591-A10`)
+
+### Cost and disclosure
+
+- Rejecting a malformed route cost a full IR build, because the build was an
+  argument expression evaluated before the syntactic parse that rejects it:
+  50.3 s → 0.31 s. A truncated file walk now publishes `scan_truncated` on the
+  answers built from it. (`AUD-591-A06`)
+- The root analysis prints the budget preamble every other long command prints,
+  and creates its `--output` file with a `partial: true` stub before the work
+  starts, so a killed run leaves a trace. (`AUD-590-B04`)
+- One `--compact` budget, from the module that enforces it, and help field names
+  equal to payload keys. The `security_surface` predicate is narrower than the
+  one behind the `GATE-*` rules, and the section now says so. (`AUD-590-B03`)
+
+### Answered
+
+- `cache_layers.snapshot` read `cold` in all 240 field invocations because only
+  the root analysis writes that layer. `Layer.written_by` records it and
+  `cache model` prints it. (`AUD-591-Q01`)
+
 ## [5.8.16] — 2026-08-20
 
 *Post-audit correction release with cache and compact-output hardening.*

{sourcecode-5.8.16 → sourcecode-5.8.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.16
+Version: 5.8.18
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -55,7 +55,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.16-blue)
+![Version](https://img.shields.io/badge/version-5.8.18-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -125,7 +125,7 @@ stops at 1 408 files and ends at 5.1s. Commands outside that phase-runner set
 must not be gated on this variable; their budget applicability remains visible in
 the [defect ledger](docs/DEFECT-LEDGER.md).
 
-**Current performance status.** Release 5.8.16 retains the shared Canonical IR
+**Current performance status.** Release 5.8.18 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. The one-model-per-declared-label path is
 also retained. These are implementation properties, not duration promises:
@@ -159,7 +159,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.16 — and, on a build that has aged,
+ask version                    # ask 5.8.18 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.16 → sourcecode-5.8.18}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.16-blue)
+![Version](https://img.shields.io/badge/version-5.8.18-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -80,7 +80,7 @@ stops at 1 408 files and ends at 5.1s. Commands outside that phase-runner set
 must not be gated on this variable; their budget applicability remains visible in
 the [defect ledger](docs/DEFECT-LEDGER.md).
 
-**Current performance status.** Release 5.8.16 retains the shared Canonical IR
+**Current performance status.** Release 5.8.18 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. The one-model-per-declared-label path is
 also retained. These are implementation properties, not duration promises:
@@ -114,7 +114,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.16 — and, on a build that has aged,
+ask version                    # ask 5.8.18 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.16 → sourcecode-5.8.18}/docs/CACHE.md

@@ -77,14 +77,14 @@ the enclosing monorepo, and `cache status` / `cache clear` resolve to that same
 ## The model
 
 <!-- BEGIN GENERATED: ask cache model --markdown -->
-| Layer | What it stores | What invalidates it | `cache warm` |
-|---|---|---|---|
-| `snapshot` | the rendered answer of the root command (L1 core analysis + L2 view) | tree state · analyzer fingerprint · analysis flags (--env-map, --depth, --docs, --exclude, …) for the core; presentation flags (--compact, --agent, --full, --format, …) for the view | built for the compact view (`--agent` also builds the agent view) |
-| `ris` | the Repository Intelligence Snapshot — structural index, endpoint index, summaries | tree state (the snapshot records the tree it describes) | rebuilt on every warm |
-| `cir` | the shared Canonical IR — the Java parse every knowledge command reuses | tree state · analyzer fingerprint · schema version | built |
-| `task` | one `prepare-context` task answer, per task and per option set | tree state · task · --symptom / --all / --include-config / --format | never — a warm does not run any task |
-| `timeline-samples` | one watched metric as measured at one sampled commit, so a series re-run over an overlapping range measures only what is new (C3-129) | the analyzer fingerprint and the commit sha, both in the key. The tree at a sha never changes, so an entry is never stale — the fingerprint is what keeps a corrected analysis from being served from a previous release. `timeline --no-cache` (or `ASK_TIMELINE_NO_SAMPLE_CACHE=1`) measures every sample again | never — a warm analyses the working tree, not history |
-| `parse` | the symbol extraction of one file, keyed by its bytes | the file's own bytes and the extractor's source — content-addressed, so it is never stale and never needs invalidating. Bounded by `ASK_PARSE_CACHE_MAX_MB` (default 512 MB, least-recently-used, swept every 32 MB written rather than on every write, and the last interval before a process exits is never swept — so the store rests up to one interval per writing process above its budget, and the figure to size a disk by is the ceiling `cache status` publishes beside it, not the budget itself (ASK-15)) and reported in `cache status` (F-AR) | filled for every Java file the warm parses |
+| Layer | What it stores | What invalidates it | `cache warm` | Written by |
+|---|---|---|---|---|
+| `snapshot` | the rendered answer of the root command (L1 core analysis + L2 view) | tree state · analyzer fingerprint · analysis flags (--env-map, --depth, --docs, --exclude, …) for the core; presentation flags (--compact, --agent, --full, --format, …) for the view | built for the compact view (`--agent` also builds the agent view) | the root analysis alone — `ask <repo>` and `ask cache warm`. AUD-591-Q01: `cache_layers.snapshot` read `cold` in all 240 field invocations across 16 repositories, including after `cache clear --all -y` plus two runs, because every one of those runs was of another command. No other command writes `core-*.json.gz`, so on any run but the root analysis this layer is `cold` by construction and its being cold says nothing about the cache. |
+| `ris` | the Repository Intelligence Snapshot — structural index, endpoint index, summaries | tree state (the snapshot records the tree it describes) | rebuilt on every warm | every command that reads it |
+| `cir` | the shared Canonical IR — the Java parse every knowledge command reuses | tree state · analyzer fingerprint · schema version | built | every command that reads it |
+| `task` | one `prepare-context` task answer, per task and per option set | tree state · task · --symptom / --all / --include-config / --format | never — a warm does not run any task | every command that reads it |
+| `timeline-samples` | one watched metric as measured at one sampled commit, so a series re-run over an overlapping range measures only what is new (C3-129) | the analyzer fingerprint and the commit sha, both in the key. The tree at a sha never changes, so an entry is never stale — the fingerprint is what keeps a corrected analysis from being served from a previous release. `timeline --no-cache` (or `ASK_TIMELINE_NO_SAMPLE_CACHE=1`) measures every sample again | never — a warm analyses the working tree, not history | every command that reads it |
+| `parse` | the symbol extraction of one file, keyed by its bytes | the file's own bytes and the extractor's source — content-addressed, so it is never stale and never needs invalidating. Bounded by `ASK_PARSE_CACHE_MAX_MB` (default 512 MB, least-recently-used, swept every 32 MB written rather than on every write, and the last interval before a process exits is never swept — so the store rests up to one interval per writing process above its budget, and the figure to size a disk by is the ceiling `cache status` publishes beside it, not the budget itself (ASK-15)) and reported in `cache status` (F-AR) | filled for every Java file the warm parses | every command that reads it |
 
 Measured on BroadleafCommerce (2 000+ Java files, dirty tree), warm machine, 3.2.2, each command in isolation.