sourcecode 5.8.17__tar.gz → 5.8.20__tar.gz

{sourcecode-5.8.17 → sourcecode-5.8.20}/.gitignore

@@ -43,3 +43,6 @@ tests/contextgraph_baseline/baseline/artifacts/
 supabase/.temp/
 # Internal agent playbook (not distributed)
 docs/PLAYBOOK_V2.md
+
+# AUD-592-D04: written by hatch_build.py during a build, never by hand.
+src/sourcecode/_build_commit.py

{sourcecode-5.8.17 → sourcecode-5.8.20}/CHANGELOG.md

@@ -1,5 +1,121 @@
 # Changelog
 
+## [5.8.20] — 2026-08-21
+
+*`C1-36` is closed on all four remedies. The row was opened by two field
+evaluations, reproduced on two builds, and returned twice under other numbers
+(`E-24`, `E-28`); its last remedy stayed open for nine releases because the
+first three were correct and none of them measured anything.*
+
+### Fixed — the last open false negative in a `core` command
+
+- **`C1-36` remedy (4) / `F-Y`** — a container-wired component publishes the
+  routes it is in front of. **pointcut → surface**: an `@Aspect` reaches the
+  handlers its pointcut selects, so `@Around("@annotation(X)")` is measured
+  against the routes carrying `X` instead of against a call graph that has no
+  edge to them. **matcher → routes**: a chain covers the routes its matchers
+  select, read through `chain_rules` — the authority `posture` already uses —
+  rather than a second extractor. One authority (`wired_surface`), three
+  consumers (`impact` / `plan` / `compare`, `impact-chain`, `pr-impact`), and an
+  assertion that the first two publish the same count for one symbol.
+- The verdict is **unchanged on purpose**: `risk_level` stays `high` and
+  `risk_score` stays `null` (`C1-41`). The band is a floor established without
+  the fan-in, and measuring the reach is not a licence to lower it.
+- A component that declares neither mechanism publishes `null`, never `0`, and
+  a matcher rule this analysis does not evaluate is counted `undecided`, never
+  covered. `NC-010` now names what is measured and what is still not.
+- **`CL-16`** — `pr-impact` keeps `core` on the evidence the tier promises. The
+  row's condition (*"while this is open, `pr-impact` cannot honestly stay in
+  core"*) is discharged rather than argued.
+
+### Added — process
+
+- **`defect-classes-v1`**, a published registry: one sweep per defect class,
+  over a population named as `module:symbol`, with the guard asserted to *bind*
+  to that symbol. Answers, over the population it names, "12 classes registered,
+  10 swept, 6 recurrences over 12 closures". The rate carries its own basis and
+  population, because a rate over a chosen subset published as the product's
+  rate is the confident figure this registry exists to refuse.
+- `container_wiring` publishes `KINDS`. Five loose constants were never a
+  population, which is the mechanism behind this release's headline row closing
+  three times.
+- `ask schema <name>` resolves each registry to **its own** document. It matched
+  on "is a registry" and printed the fact registry for every one of them —
+  correct while a single registry reached it.
+
+## [5.8.19] — 2026-08-21
+
+*The ninth audit pass is closed: all twelve rows, one atomic commit each with a
+regression assertion written over the catalogue rather than over the reported
+symbol. No row in this pass was a regression, and the suite is green end to end
+(11 008 passing) rather than carrying the pre-existing failure the last release
+shipped with.*
+
+### Fixed — contracts
+
+- **`AUD-594-X01`** — `ASK_MAX_ANALYSIS_SECONDS` is described from one authority.
+  Three hand-written sentences still named three commands where the generated
+  line names eight, and one told the reader the repository-wide analysis *"must
+  not be CI-gated"*, which `AUD-590-B04` had made false.
+- **`AUD-595-A03`** — a budget-cut run publishes `gate_exit_code`, `exit_code`
+  and their basis, from the same decision function the exit paths read, and
+  `--allow-partial` lets a gating pipeline accept a cut answer deliberately. The
+  reported premise is half refuted: `--ci` already exited 75.
+- **`AUD-595-A02`** — every Java-file count names its population, and the audit
+  payload publishes `java_population_count` beside `java_population`. Sixth
+  report; the two figures count different populations, which is why the obvious
+  one-line fix would have been a second falsehood.
+- **`AUD-594-X03`** — every catalogued fan-in figure emits `*_unit` **and**
+  `*_population`. The sweep found four more figures shipping one tag, none of
+  them reported.
+- **`AUD-594-X02`** — `--agent` publishes the ceiling it already enforced.
+  `--agent` was never over budget; the earlier `+61 %` measured against a band
+  that has since been deleted.
+- **`AUD-594-N04`** — `sibling_view` names the blocks it omitted, computed from
+  both view constructors, and `--compact` gains the reciprocal pointer.
+- **`AUD-592-D02`** — `--min-band` publishes the same `_filter` disclosure in
+  `risk` and in `enrich`, from one module.
+- **`AUD-595-A05`** — `endpoints` publishes `scope` and `repo_id`, and says *"the
+  analysed tree"* where the tree is not one repository.
+- **`AUD-595-A07`** — the analysis cap and the sizing scan's cap each name the
+  walk they bound.
+- **`E-39`** — the MyBatis pairing lists declare their cap and publish their
+  zero instead of vanishing; this also closes criterion 3 of `B-1`, unverifiable
+  for four reports for want of a fixture.
+- **`AUD-595-B01`** — `cache_layers` distinguishes validated reuse from mere
+  presence, and the parse store publishes counted lookups. This is the field that
+  caused three retracted performance regressions in three passes.
+
+### Fixed — provenance and process
+
+- **`AUD-592-D04`** — the build stamps the commit it was made from. The reader
+  shipped five reports ago; nothing wrote it, and an installed wheel has no
+  checkout to fall back to.
+- **`AUD-594-X04`** — a ledger row filed under a *"closed in X"* heading can no
+  longer ship reading `open`, enforced by the release battery.
+- **`AUD-595-Q01`** — `selftest` grows from 7 rows to 10, covering `repo_id`
+  cardinality, cross-command fan-in agreement, and the unit/population contract.
+  Third request.
+
+## [5.8.18] — 2026-08-21
+
+*The eighth audit pass is closed. Every reported fix in that queue is shipped in
+an atomic commit with a focused regression assertion; the release battery passes
+except for the pre-existing RIS B11 test failure documented in the release check.*
+
+### Eighth audit pass closure
+
+- Fixed caller-count authority drift, compact unresolved samples, scan-truncation
+  disclosure, and the meta-annotation route prefix. (`AUD-593-N01`, `AUD-592-B01`,
+  `AUD-592-A02`, `E-38`)
+- Reconciled the compact budget across help and documentation, and corrected the
+  budget scope, interface-count metadata, and caller-list cap disclosures.
+  (`AUD-593-N02`, `AUD-593-N03`, `AUD-593-N05`, `AUD-593-N06`)
+- Corrected write-inventory wording, min-band filter disclosure, unknown enrich
+  rule handling, and build-commit provenance. (`AUD-592-D01`–`D04`)
+- Isolated the compact-cache test so the CLI regression battery is deterministic.
+  (`B29`)
+
 ## [5.8.17] — 2026-08-21
 
 *The seventh audit pass, closed end to end: eleven rows from P0 to P3 plus the

{sourcecode-5.8.17 → sourcecode-5.8.20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.17
+Version: 5.8.20
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -55,7 +55,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.17-blue)
+![Version](https://img.shields.io/badge/version-5.8.20-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -125,7 +125,7 @@ stops at 1 408 files and ends at 5.1s. Commands outside that phase-runner set
 must not be gated on this variable; their budget applicability remains visible in
 the [defect ledger](docs/DEFECT-LEDGER.md).
 
-**Current performance status.** Release 5.8.17 retains the shared Canonical IR
+**Current performance status.** Release 5.8.20 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. The one-model-per-declared-label path is
 also retained. These are implementation properties, not duration promises:
@@ -159,7 +159,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.17 — and, on a build that has aged,
+ask version                    # ask 5.8.20 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.17 → sourcecode-5.8.20}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.17-blue)
+![Version](https://img.shields.io/badge/version-5.8.20-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -80,7 +80,7 @@ stops at 1 408 files and ends at 5.1s. Commands outside that phase-runner set
 must not be gated on this variable; their budget applicability remains visible in
 the [defect ledger](docs/DEFECT-LEDGER.md).
 
-**Current performance status.** Release 5.8.17 retains the shared Canonical IR
+**Current performance status.** Release 5.8.20 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. The one-model-per-declared-label path is
 also retained. These are implementation properties, not duration promises:
@@ -114,7 +114,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.17 — and, on a build that has aged,
+ask version                    # ask 5.8.20 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```