sourcecode 5.8.20__tar.gz → 5.8.21__tar.gz

{sourcecode-5.8.20 → sourcecode-5.8.21}/.gitignore

@@ -12,6 +12,8 @@ build/
 .mypy_cache/
 .ruff_cache/
 .pytest_cache/
+.testmondata
+.testmondata-*
 src/*.egg-info/
 
 # Editor / IDE

{sourcecode-5.8.20 → sourcecode-5.8.21}/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## [5.8.21] — 2026-08-22
+
+*The tenth audit-pass queue is closed: seven remaining P3 fixes shipped as
+separate commits, with the release documentation synchronized to the shipped
+contracts.*
+
+### Fixed — answer contracts and operational safety
+
+- **Repository identity (`AUD-596-D01`)** — the common response envelope now
+  publishes `repo_id` and `git_head` for repository-scoped JSON answers.
+- **Validation figures (`AUD-596-D03`)** — route constraint figures publish their
+  unit and counted population instead of relying on ambiguous field names.
+- **Compare candidates (`AUD-596-D08`)** — directory candidates are rejected
+  before model construction, and comparison results publish resolved counts.
+- **Grammar errors (`AUD-596-D11`)** — invalid command usage is now
+  `INVALID_USAGE`; semantic input failures remain `INVALID_INPUT`.
+- **Actionable hints (`AUD-596-D12`)** — rename, endpoint explanation and
+  regression inputs validate their shapes and provide next steps that can work.
+- **Schema pinning (`AUD-596-D14`)** — ambiguous identifiers such as `1.0`
+  publish `pinnable: false` and the canonical names to pin instead.
+- **Peak memory (`AUD-596-D10`)** — JSON answers publish `_meta.memory` with
+  peak RSS, and costly analyses enforce `ASK_MAX_RSS_MB` with a structured
+  `MEMORY_TOO_LARGE` refusal. Unset or `0` leaves the ceiling disabled.
+
+### Documentation
+
+- Updated the README, English and Spanish user guides, release metadata and
+  roadmap status to 5.8.21.
+- The generated `ask --help` remains the authority for command options and
+  now reports the installed 5.8.21 version.
+
 ## [5.8.20] — 2026-08-21
 
 *`C1-36` is closed on all four remedies. The row was opened by two field

{sourcecode-5.8.20 → sourcecode-5.8.21}/CONTRIBUTING.md

@@ -48,6 +48,18 @@ ask . prepare-context explain
 pytest tests/
 ```
 
+For the normal edit loop, use the incremental runner. The first run builds a
+local dependency map; later runs execute only tests affected by changed code:
+
+```bash
+scripts/test_fast.sh
+```
+
+Pass normal pytest arguments through when needed, for example
+`scripts/test_fast.sh tests/test_cli.py -x`. Run `pytest tests/` before merging
+or when changing shared infrastructure, because the incremental selection is a
+feedback optimization and the full suite remains the final regression gate.
+
 Run a single file:
 ```bash
 pytest tests/test_detector_nodejs.py -v

{sourcecode-5.8.20 → sourcecode-5.8.21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.20
+Version: 5.8.21
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -36,8 +36,11 @@ Provides-Extra: dev
 Requires-Dist: jsonschema>=4.18; extra == 'dev'
 Requires-Dist: mcp<2,>=1.2; extra == 'dev'
 Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest-testmon<2.2,>=2.1.4; (python_version < '3.10') and extra == 'dev'
+Requires-Dist: pytest-testmon>=2.2; (python_version >= '3.10') and extra == 'dev'
 Requires-Dist: pytest-xdist>=3.8; extra == 'dev'
-Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: pytest<9,>=8; (python_version < '3.10') and extra == 'dev'
+Requires-Dist: pytest>=8; (python_version >= '3.10') and extra == 'dev'
 Requires-Dist: ruff>=0.15; extra == 'dev'
 Provides-Extra: mcp
 Requires-Dist: mcp<2,>=1.2; extra == 'mcp'
@@ -55,7 +58,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.20-blue)
+![Version](https://img.shields.io/badge/version-5.8.21-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -125,7 +128,13 @@ stops at 1 408 files and ends at 5.1s. Commands outside that phase-runner set
 must not be gated on this variable; their budget applicability remains visible in
 the [defect ledger](docs/DEFECT-LEDGER.md).
 
-**Current performance status.** Release 5.8.20 retains the shared Canonical IR
+**Memory is measurable and bounded.** Repository-scoped JSON answers publish
+`_meta.memory.peak_rss_mb` and the configured ceiling. For a supervised deep run,
+set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
+answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
+unset, or set it to `0`, to disable the ceiling explicitly.
+
+**Current performance status.** Release 5.8.21 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. The one-model-per-declared-label path is
 also retained. These are implementation properties, not duration promises:
@@ -159,7 +168,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.20 — and, on a build that has aged,
+ask version                    # ask 5.8.21 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -480,7 +489,7 @@ reading JSON sees the same boundary a buyer reads here.
 
 | Not covered | Why | What answers it |
 |---|---|---|
-| **General request-input-to-sink taint analysis.** | `ask risk` includes two bounded slices for annotated HTTP parameters and positional calls in repository Java sources: known query sinks, and MyBatis statements that splice a value into their SQL. Anything broader needs value flow through a program, which is a different analysis with a different failure mode: an unsound one produces confident findings that are wrong, and every claim here is meant to be checkable against the line that produced it. | A dataflow scanner (Semgrep, CodeQL) for complete taint. What this product adds on top is reachability and, for the two bounded slices, whether an annotated HTTP input reaches a known concatenated query sink or a spliced SQL statement — the latter with a three-state verdict that says `undecidable` rather than clearing a route it could not follow. |
+| **General request-input-to-sink taint analysis.** | `ask risk` includes two bounded slices for annotated HTTP parameters and positional calls in repository Java sources: known query sinks, and MyBatis statements that splice a value into their SQL. “Known” is a published list — `risk` prints it as `query_sink_vocabulary`, with the calls it deliberately leaves out and why — so a concatenation into a call outside that list is not a miss to be discovered, it is a stated boundary. Anything broader needs value flow through a program, which is a different analysis with a different failure mode: an unsound one produces confident findings that are wrong, and every claim here is meant to be checkable against the line that produced it. | A dataflow scanner (Semgrep, CodeQL) for complete taint. What this product adds on top is reachability and, for the two bounded slices, whether an annotated HTTP input reaches a known concatenated query sink or a spliced SQL statement — the latter with a three-state verdict that says `undecidable` rather than clearing a route it could not follow. |
 | **Secrets outside Java, Spring configuration and the deployment descriptors — a Helm value, a CI variable file, a shell script.** | The file population this analyzer reads is the Java source, the Spring configuration convention and the descriptors it already parses to resolve an environment. A secret elsewhere is not missed by a weak rule; it is outside the set of files anything here opens. Narrowed by CL-10: a credential stored in `web.xml` or a Spring XML context IS reported (SEC-007), because those files were already being read. | A dedicated secret scanner over the whole tree (gitleaks, trufflehog). |
 | **Filter-chain order and per-filter URL patterns — the presence of a custom filter is structural only.** | Which filter runs first is decided by bean ordering this analyzer does not resolve. Where two active configurations both match a request, the answer published is `undecided` rather than a guess. | `ask posture --profile <set>` states per endpoint what the readable rules decide and what they leave undecided. |
 | **Known vulnerabilities in dependencies — no CVE database, no version advisory matching.** | Enriching a vulnerability feed is a different product with a different update cadence; a stale embedded database is worse than no database, because it reads as a clean bill of health. | A dependency scanner (Trivy, OWASP Dependency-Check). `impact-chain` then answers which of its findings anything actually reaches. |

{sourcecode-5.8.20 → sourcecode-5.8.21}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.20-blue)
+![Version](https://img.shields.io/badge/version-5.8.21-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -80,7 +80,13 @@ stops at 1 408 files and ends at 5.1s. Commands outside that phase-runner set
 must not be gated on this variable; their budget applicability remains visible in
 the [defect ledger](docs/DEFECT-LEDGER.md).
 
-**Current performance status.** Release 5.8.20 retains the shared Canonical IR
+**Memory is measurable and bounded.** Repository-scoped JSON answers publish
+`_meta.memory.peak_rss_mb` and the configured ceiling. For a supervised deep run,
+set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
+answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
+unset, or set it to `0`, to disable the ceiling explicitly.
+
+**Current performance status.** Release 5.8.21 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. The one-model-per-declared-label path is
 also retained. These are implementation properties, not duration promises:
@@ -114,7 +120,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.20 — and, on a build that has aged,
+ask version                    # ask 5.8.21 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -435,7 +441,7 @@ reading JSON sees the same boundary a buyer reads here.
 
 | Not covered | Why | What answers it |
 |---|---|---|
-| **General request-input-to-sink taint analysis.** | `ask risk` includes two bounded slices for annotated HTTP parameters and positional calls in repository Java sources: known query sinks, and MyBatis statements that splice a value into their SQL. Anything broader needs value flow through a program, which is a different analysis with a different failure mode: an unsound one produces confident findings that are wrong, and every claim here is meant to be checkable against the line that produced it. | A dataflow scanner (Semgrep, CodeQL) for complete taint. What this product adds on top is reachability and, for the two bounded slices, whether an annotated HTTP input reaches a known concatenated query sink or a spliced SQL statement — the latter with a three-state verdict that says `undecidable` rather than clearing a route it could not follow. |
+| **General request-input-to-sink taint analysis.** | `ask risk` includes two bounded slices for annotated HTTP parameters and positional calls in repository Java sources: known query sinks, and MyBatis statements that splice a value into their SQL. “Known” is a published list — `risk` prints it as `query_sink_vocabulary`, with the calls it deliberately leaves out and why — so a concatenation into a call outside that list is not a miss to be discovered, it is a stated boundary. Anything broader needs value flow through a program, which is a different analysis with a different failure mode: an unsound one produces confident findings that are wrong, and every claim here is meant to be checkable against the line that produced it. | A dataflow scanner (Semgrep, CodeQL) for complete taint. What this product adds on top is reachability and, for the two bounded slices, whether an annotated HTTP input reaches a known concatenated query sink or a spliced SQL statement — the latter with a three-state verdict that says `undecidable` rather than clearing a route it could not follow. |
 | **Secrets outside Java, Spring configuration and the deployment descriptors — a Helm value, a CI variable file, a shell script.** | The file population this analyzer reads is the Java source, the Spring configuration convention and the descriptors it already parses to resolve an environment. A secret elsewhere is not missed by a weak rule; it is outside the set of files anything here opens. Narrowed by CL-10: a credential stored in `web.xml` or a Spring XML context IS reported (SEC-007), because those files were already being read. | A dedicated secret scanner over the whole tree (gitleaks, trufflehog). |
 | **Filter-chain order and per-filter URL patterns — the presence of a custom filter is structural only.** | Which filter runs first is decided by bean ordering this analyzer does not resolve. Where two active configurations both match a request, the answer published is `undecided` rather than a guess. | `ask posture --profile <set>` states per endpoint what the readable rules decide and what they leave undecided. |
 | **Known vulnerabilities in dependencies — no CVE database, no version advisory matching.** | Enriching a vulnerability feed is a different product with a different update cadence; a stale embedded database is worse than no database, because it reads as a clean bill of health. | A dependency scanner (Trivy, OWASP Dependency-Check). `impact-chain` then answers which of its findings anything actually reaches. |