sourcecode 5.8.18__tar.gz → 5.8.21__tar.gz

{sourcecode-5.8.18 → sourcecode-5.8.21}/.gitignore

@@ -12,6 +12,8 @@ build/
 .mypy_cache/
 .ruff_cache/
 .pytest_cache/
+.testmondata
+.testmondata-*
 src/*.egg-info/
 
 # Editor / IDE
@@ -43,3 +45,6 @@ tests/contextgraph_baseline/baseline/artifacts/
 supabase/.temp/
 # Internal agent playbook (not distributed)
 docs/PLAYBOOK_V2.md
+
+# AUD-592-D04: written by hatch_build.py during a build, never by hand.
+src/sourcecode/_build_commit.py

{sourcecode-5.8.18 → sourcecode-5.8.21}/CHANGELOG.md

@@ -1,5 +1,133 @@
 # Changelog
 
+## [5.8.21] — 2026-08-22
+
+*The tenth audit-pass queue is closed: seven remaining P3 fixes shipped as
+separate commits, with the release documentation synchronized to the shipped
+contracts.*
+
+### Fixed — answer contracts and operational safety
+
+- **Repository identity (`AUD-596-D01`)** — the common response envelope now
+  publishes `repo_id` and `git_head` for repository-scoped JSON answers.
+- **Validation figures (`AUD-596-D03`)** — route constraint figures publish their
+  unit and counted population instead of relying on ambiguous field names.
+- **Compare candidates (`AUD-596-D08`)** — directory candidates are rejected
+  before model construction, and comparison results publish resolved counts.
+- **Grammar errors (`AUD-596-D11`)** — invalid command usage is now
+  `INVALID_USAGE`; semantic input failures remain `INVALID_INPUT`.
+- **Actionable hints (`AUD-596-D12`)** — rename, endpoint explanation and
+  regression inputs validate their shapes and provide next steps that can work.
+- **Schema pinning (`AUD-596-D14`)** — ambiguous identifiers such as `1.0`
+  publish `pinnable: false` and the canonical names to pin instead.
+- **Peak memory (`AUD-596-D10`)** — JSON answers publish `_meta.memory` with
+  peak RSS, and costly analyses enforce `ASK_MAX_RSS_MB` with a structured
+  `MEMORY_TOO_LARGE` refusal. Unset or `0` leaves the ceiling disabled.
+
+### Documentation
+
+- Updated the README, English and Spanish user guides, release metadata and
+  roadmap status to 5.8.21.
+- The generated `ask --help` remains the authority for command options and
+  now reports the installed 5.8.21 version.
+
+## [5.8.20] — 2026-08-21
+
+*`C1-36` is closed on all four remedies. The row was opened by two field
+evaluations, reproduced on two builds, and returned twice under other numbers
+(`E-24`, `E-28`); its last remedy stayed open for nine releases because the
+first three were correct and none of them measured anything.*
+
+### Fixed — the last open false negative in a `core` command
+
+- **`C1-36` remedy (4) / `F-Y`** — a container-wired component publishes the
+  routes it is in front of. **pointcut → surface**: an `@Aspect` reaches the
+  handlers its pointcut selects, so `@Around("@annotation(X)")` is measured
+  against the routes carrying `X` instead of against a call graph that has no
+  edge to them. **matcher → routes**: a chain covers the routes its matchers
+  select, read through `chain_rules` — the authority `posture` already uses —
+  rather than a second extractor. One authority (`wired_surface`), three
+  consumers (`impact` / `plan` / `compare`, `impact-chain`, `pr-impact`), and an
+  assertion that the first two publish the same count for one symbol.
+- The verdict is **unchanged on purpose**: `risk_level` stays `high` and
+  `risk_score` stays `null` (`C1-41`). The band is a floor established without
+  the fan-in, and measuring the reach is not a licence to lower it.
+- A component that declares neither mechanism publishes `null`, never `0`, and
+  a matcher rule this analysis does not evaluate is counted `undecided`, never
+  covered. `NC-010` now names what is measured and what is still not.
+- **`CL-16`** — `pr-impact` keeps `core` on the evidence the tier promises. The
+  row's condition (*"while this is open, `pr-impact` cannot honestly stay in
+  core"*) is discharged rather than argued.
+
+### Added — process
+
+- **`defect-classes-v1`**, a published registry: one sweep per defect class,
+  over a population named as `module:symbol`, with the guard asserted to *bind*
+  to that symbol. Answers, over the population it names, "12 classes registered,
+  10 swept, 6 recurrences over 12 closures". The rate carries its own basis and
+  population, because a rate over a chosen subset published as the product's
+  rate is the confident figure this registry exists to refuse.
+- `container_wiring` publishes `KINDS`. Five loose constants were never a
+  population, which is the mechanism behind this release's headline row closing
+  three times.
+- `ask schema <name>` resolves each registry to **its own** document. It matched
+  on "is a registry" and printed the fact registry for every one of them —
+  correct while a single registry reached it.
+
+## [5.8.19] — 2026-08-21
+
+*The ninth audit pass is closed: all twelve rows, one atomic commit each with a
+regression assertion written over the catalogue rather than over the reported
+symbol. No row in this pass was a regression, and the suite is green end to end
+(11 008 passing) rather than carrying the pre-existing failure the last release
+shipped with.*
+
+### Fixed — contracts
+
+- **`AUD-594-X01`** — `ASK_MAX_ANALYSIS_SECONDS` is described from one authority.
+  Three hand-written sentences still named three commands where the generated
+  line names eight, and one told the reader the repository-wide analysis *"must
+  not be CI-gated"*, which `AUD-590-B04` had made false.
+- **`AUD-595-A03`** — a budget-cut run publishes `gate_exit_code`, `exit_code`
+  and their basis, from the same decision function the exit paths read, and
+  `--allow-partial` lets a gating pipeline accept a cut answer deliberately. The
+  reported premise is half refuted: `--ci` already exited 75.
+- **`AUD-595-A02`** — every Java-file count names its population, and the audit
+  payload publishes `java_population_count` beside `java_population`. Sixth
+  report; the two figures count different populations, which is why the obvious
+  one-line fix would have been a second falsehood.
+- **`AUD-594-X03`** — every catalogued fan-in figure emits `*_unit` **and**
+  `*_population`. The sweep found four more figures shipping one tag, none of
+  them reported.
+- **`AUD-594-X02`** — `--agent` publishes the ceiling it already enforced.
+  `--agent` was never over budget; the earlier `+61 %` measured against a band
+  that has since been deleted.
+- **`AUD-594-N04`** — `sibling_view` names the blocks it omitted, computed from
+  both view constructors, and `--compact` gains the reciprocal pointer.
+- **`AUD-592-D02`** — `--min-band` publishes the same `_filter` disclosure in
+  `risk` and in `enrich`, from one module.
+- **`AUD-595-A05`** — `endpoints` publishes `scope` and `repo_id`, and says *"the
+  analysed tree"* where the tree is not one repository.
+- **`AUD-595-A07`** — the analysis cap and the sizing scan's cap each name the
+  walk they bound.
+- **`E-39`** — the MyBatis pairing lists declare their cap and publish their
+  zero instead of vanishing; this also closes criterion 3 of `B-1`, unverifiable
+  for four reports for want of a fixture.
+- **`AUD-595-B01`** — `cache_layers` distinguishes validated reuse from mere
+  presence, and the parse store publishes counted lookups. This is the field that
+  caused three retracted performance regressions in three passes.
+
+### Fixed — provenance and process
+
+- **`AUD-592-D04`** — the build stamps the commit it was made from. The reader
+  shipped five reports ago; nothing wrote it, and an installed wheel has no
+  checkout to fall back to.
+- **`AUD-594-X04`** — a ledger row filed under a *"closed in X"* heading can no
+  longer ship reading `open`, enforced by the release battery.
+- **`AUD-595-Q01`** — `selftest` grows from 7 rows to 10, covering `repo_id`
+  cardinality, cross-command fan-in agreement, and the unit/population contract.
+  Third request.
+
 ## [5.8.18] — 2026-08-21
 
 *The eighth audit pass is closed. Every reported fix in that queue is shipped in

{sourcecode-5.8.18 → sourcecode-5.8.21}/CONTRIBUTING.md

@@ -48,6 +48,18 @@ ask . prepare-context explain
 pytest tests/
 ```
 
+For the normal edit loop, use the incremental runner. The first run builds a
+local dependency map; later runs execute only tests affected by changed code:
+
+```bash
+scripts/test_fast.sh
+```
+
+Pass normal pytest arguments through when needed, for example
+`scripts/test_fast.sh tests/test_cli.py -x`. Run `pytest tests/` before merging
+or when changing shared infrastructure, because the incremental selection is a
+feedback optimization and the full suite remains the final regression gate.
+
 Run a single file:
 ```bash
 pytest tests/test_detector_nodejs.py -v

{sourcecode-5.8.18 → sourcecode-5.8.21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.18
+Version: 5.8.21
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -36,8 +36,11 @@ Provides-Extra: dev
 Requires-Dist: jsonschema>=4.18; extra == 'dev'
 Requires-Dist: mcp<2,>=1.2; extra == 'dev'
 Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest-testmon<2.2,>=2.1.4; (python_version < '3.10') and extra == 'dev'
+Requires-Dist: pytest-testmon>=2.2; (python_version >= '3.10') and extra == 'dev'
 Requires-Dist: pytest-xdist>=3.8; extra == 'dev'
-Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: pytest<9,>=8; (python_version < '3.10') and extra == 'dev'
+Requires-Dist: pytest>=8; (python_version >= '3.10') and extra == 'dev'
 Requires-Dist: ruff>=0.15; extra == 'dev'
 Provides-Extra: mcp
 Requires-Dist: mcp<2,>=1.2; extra == 'mcp'
@@ -55,7 +58,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.18-blue)
+![Version](https://img.shields.io/badge/version-5.8.21-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -125,7 +128,13 @@ stops at 1 408 files and ends at 5.1s. Commands outside that phase-runner set
 must not be gated on this variable; their budget applicability remains visible in
 the [defect ledger](docs/DEFECT-LEDGER.md).
 
-**Current performance status.** Release 5.8.18 retains the shared Canonical IR
+**Memory is measurable and bounded.** Repository-scoped JSON answers publish
+`_meta.memory.peak_rss_mb` and the configured ceiling. For a supervised deep run,
+set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
+answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
+unset, or set it to `0`, to disable the ceiling explicitly.
+
+**Current performance status.** Release 5.8.21 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. The one-model-per-declared-label path is
 also retained. These are implementation properties, not duration promises:
@@ -159,7 +168,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.18 — and, on a build that has aged,
+ask version                    # ask 5.8.21 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -480,7 +489,7 @@ reading JSON sees the same boundary a buyer reads here.
 
 | Not covered | Why | What answers it |
 |---|---|---|
-| **General request-input-to-sink taint analysis.** | `ask risk` includes two bounded slices for annotated HTTP parameters and positional calls in repository Java sources: known query sinks, and MyBatis statements that splice a value into their SQL. Anything broader needs value flow through a program, which is a different analysis with a different failure mode: an unsound one produces confident findings that are wrong, and every claim here is meant to be checkable against the line that produced it. | A dataflow scanner (Semgrep, CodeQL) for complete taint. What this product adds on top is reachability and, for the two bounded slices, whether an annotated HTTP input reaches a known concatenated query sink or a spliced SQL statement — the latter with a three-state verdict that says `undecidable` rather than clearing a route it could not follow. |
+| **General request-input-to-sink taint analysis.** | `ask risk` includes two bounded slices for annotated HTTP parameters and positional calls in repository Java sources: known query sinks, and MyBatis statements that splice a value into their SQL. “Known” is a published list — `risk` prints it as `query_sink_vocabulary`, with the calls it deliberately leaves out and why — so a concatenation into a call outside that list is not a miss to be discovered, it is a stated boundary. Anything broader needs value flow through a program, which is a different analysis with a different failure mode: an unsound one produces confident findings that are wrong, and every claim here is meant to be checkable against the line that produced it. | A dataflow scanner (Semgrep, CodeQL) for complete taint. What this product adds on top is reachability and, for the two bounded slices, whether an annotated HTTP input reaches a known concatenated query sink or a spliced SQL statement — the latter with a three-state verdict that says `undecidable` rather than clearing a route it could not follow. |
 | **Secrets outside Java, Spring configuration and the deployment descriptors — a Helm value, a CI variable file, a shell script.** | The file population this analyzer reads is the Java source, the Spring configuration convention and the descriptors it already parses to resolve an environment. A secret elsewhere is not missed by a weak rule; it is outside the set of files anything here opens. Narrowed by CL-10: a credential stored in `web.xml` or a Spring XML context IS reported (SEC-007), because those files were already being read. | A dedicated secret scanner over the whole tree (gitleaks, trufflehog). |
 | **Filter-chain order and per-filter URL patterns — the presence of a custom filter is structural only.** | Which filter runs first is decided by bean ordering this analyzer does not resolve. Where two active configurations both match a request, the answer published is `undecided` rather than a guess. | `ask posture --profile <set>` states per endpoint what the readable rules decide and what they leave undecided. |
 | **Known vulnerabilities in dependencies — no CVE database, no version advisory matching.** | Enriching a vulnerability feed is a different product with a different update cadence; a stale embedded database is worse than no database, because it reads as a clean bill of health. | A dependency scanner (Trivy, OWASP Dependency-Check). `impact-chain` then answers which of its findings anything actually reaches. |

{sourcecode-5.8.18 → sourcecode-5.8.21}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.18-blue)
+![Version](https://img.shields.io/badge/version-5.8.21-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -80,7 +80,13 @@ stops at 1 408 files and ends at 5.1s. Commands outside that phase-runner set
 must not be gated on this variable; their budget applicability remains visible in
 the [defect ledger](docs/DEFECT-LEDGER.md).
 
-**Current performance status.** Release 5.8.18 retains the shared Canonical IR
+**Memory is measurable and bounded.** Repository-scoped JSON answers publish
+`_meta.memory.peak_rss_mb` and the configured ceiling. For a supervised deep run,
+set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
+answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
+unset, or set it to `0`, to disable the ceiling explicitly.
+
+**Current performance status.** Release 5.8.21 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. The one-model-per-declared-label path is
 also retained. These are implementation properties, not duration promises:
@@ -114,7 +120,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.18 — and, on a build that has aged,
+ask version                    # ask 5.8.21 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -435,7 +441,7 @@ reading JSON sees the same boundary a buyer reads here.
 
 | Not covered | Why | What answers it |
 |---|---|---|
-| **General request-input-to-sink taint analysis.** | `ask risk` includes two bounded slices for annotated HTTP parameters and positional calls in repository Java sources: known query sinks, and MyBatis statements that splice a value into their SQL. Anything broader needs value flow through a program, which is a different analysis with a different failure mode: an unsound one produces confident findings that are wrong, and every claim here is meant to be checkable against the line that produced it. | A dataflow scanner (Semgrep, CodeQL) for complete taint. What this product adds on top is reachability and, for the two bounded slices, whether an annotated HTTP input reaches a known concatenated query sink or a spliced SQL statement — the latter with a three-state verdict that says `undecidable` rather than clearing a route it could not follow. |
+| **General request-input-to-sink taint analysis.** | `ask risk` includes two bounded slices for annotated HTTP parameters and positional calls in repository Java sources: known query sinks, and MyBatis statements that splice a value into their SQL. “Known” is a published list — `risk` prints it as `query_sink_vocabulary`, with the calls it deliberately leaves out and why — so a concatenation into a call outside that list is not a miss to be discovered, it is a stated boundary. Anything broader needs value flow through a program, which is a different analysis with a different failure mode: an unsound one produces confident findings that are wrong, and every claim here is meant to be checkable against the line that produced it. | A dataflow scanner (Semgrep, CodeQL) for complete taint. What this product adds on top is reachability and, for the two bounded slices, whether an annotated HTTP input reaches a known concatenated query sink or a spliced SQL statement — the latter with a three-state verdict that says `undecidable` rather than clearing a route it could not follow. |
 | **Secrets outside Java, Spring configuration and the deployment descriptors — a Helm value, a CI variable file, a shell script.** | The file population this analyzer reads is the Java source, the Spring configuration convention and the descriptors it already parses to resolve an environment. A secret elsewhere is not missed by a weak rule; it is outside the set of files anything here opens. Narrowed by CL-10: a credential stored in `web.xml` or a Spring XML context IS reported (SEC-007), because those files were already being read. | A dedicated secret scanner over the whole tree (gitleaks, trufflehog). |
 | **Filter-chain order and per-filter URL patterns — the presence of a custom filter is structural only.** | Which filter runs first is decided by bean ordering this analyzer does not resolve. Where two active configurations both match a request, the answer published is `undecided` rather than a guess. | `ask posture --profile <set>` states per endpoint what the readable rules decide and what they leave undecided. |
 | **Known vulnerabilities in dependencies — no CVE database, no version advisory matching.** | Enriching a vulnerability feed is a different product with a different update cadence; a stale embedded database is worse than no database, because it reads as a clean bill of health. | A dependency scanner (Trivy, OWASP Dependency-Check). `impact-chain` then answers which of its findings anything actually reaches. |