sourcecode 5.8.25__py3-none-any.whl → 5.8.26__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.25"
+__version__ = "5.8.26"

sourcecode/_build_commit.py

@@ -1,5 +1,5 @@
 """Generated at build time by hatch_build.py. Do not edit (AUD-592-D04)."""
 
-BUILD_COMMIT = 'b6e0e0f157687a962ce66627afe2e9b388fb2f06'
+BUILD_COMMIT = 'e2da5d84a30bc2e8c60325e1e2d48a8d736b8ad7'
 CLOSURE_PROVENANCE = {'Window': {'commit': '', 'status': 'uncited'}, '`AUD-588-F05`': {'commit': '470e4a4', 'status': 'present'}, '`AUD-590-B01` / `B-01`, `F-01`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B02` / `B-02`, `F-02`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B03` / `B-03`, `F-03`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B04` / `B-04`, `F-04`': {'commit': '', 'status': 'uncited'}, '`AUD-590-R01` / `R-01`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A01` / `A-1`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A02` / `A-2`, `A-4`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A03` / `A-3`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A05` / `A-5`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A06` / `A-6`, `A-7`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A08` / `A-8`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A09` / `A-9`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A10` / `A-10`': {'commit': '', 'status': 'uncited'}, '`AUD-592-A02` / `A-1` second half, `§12.5`': {'commit': '63f3d61', 'status': 'present'}, '`AUD-592-B01` / `B-8`': {'commit': '8329614', 'status': 'present'}, '`AUD-592-D01` / `D-1`': {'commit': '0f8e03f', 'status': 'present'}, '`AUD-592-D02` / `D-2`': {'commit': '1d3db4d', 'status': 'present'}, '`AUD-592-D03` / `D-3`': {'commit': 'f28fe40', 'status': 'present'}, '`AUD-592-R01` / `A-1`': {'commit': '216025f', 'status': 'present'}, '`AUD-592-R02` / `N-4`, reopens `AUD-513-N04`': {'commit': 'ec3050d', 'status': 'present'}, '`AUD-593-N01` / `N-01`': {'commit': 'dd6a706', 'status': 'present'}, '`AUD-593-N02` / `N-02`': {'commit': 'f539787', 'status': 'present'}, '`AUD-593-N03` / `N-03`': {'commit': '1dd0b1c', 'status': 'present'}, '`AUD-593-N05` / `N-05`': {'commit': 'aa89388', 'status': 'present'}, '`AUD-593-N06` / `N-06`': {'commit': 'aa584a6', 'status': 'present'}, '`AUD-594-N04` / `D-5`, disclosure half of `B-3`': {'commit': 'a0060b7', 'status': 'present'}, '`AUD-594-X01` / `A-1`, residual of `AUD-593-N03`': {'commit': 'dd222b9', 'status': 'present'}, '`AUD-594-X02` / `A-1` second half': {'commit': '1193937', 'status': 'present'}, '`AUD-594-X03` / `X-03`, residual of `AUD-593-N01`': {'commit': 'e89e8f0', 'status': 'present'}, '`AUD-594-X04`': {'commit': '05b8cc9', 'status': 'present'}, '`AUD-595-A02` / `N-5`, advisory half of `AUD-588-B11`': {'commit': '3e15227', 'status': 'present'}, '`AUD-595-A03` / `B-6` exit-code half': {'commit': 'ab7285f', 'status': 'present'}, '`AUD-595-A05`': {'commit': 'e0b3d10', 'status': 'present'}, '`AUD-595-A07`, narrow half of `AUD-592-A02`': {'commit': 'cc15177', 'status': 'present'}, '`AUD-595-B01` / §B': {'commit': 'b77a1ad', 'status': 'present'}, '`AUD-595-Q01`': {'commit': '91a6566', 'status': 'present'}, '`AUD-596-A01` / `ASK-DET-001`': {'commit': 'fa508b4', 'status': 'present'}, '`AUD-596-A02` / `ASK-SELF-001`': {'commit': '4dfadc8', 'status': 'present'}, '`AUD-596-A03` / `ASK-C1-001`': {'commit': 'bffa3a6', 'status': 'present'}, '`AUD-596-A04` / `ASK-UX-003` + `ASK-UX-004`': {'commit': 'f0aac3c', 'status': 'present'}, '`AUD-596-B01` / `B-01`, harder witness for `BUG-6`': {'commit': '567d09d', 'status': 'present'}, '`AUD-596-B02` / `B-02`, class residual of `R2`': {'commit': '', 'status': 'uncited'}, '`AUD-596-B03` / `B-03`': {'commit': 'a8cb814', 'status': 'present'}, '`AUD-596-B06` / `B-06`': {'commit': '8107927', 'status': 'present'}, '`AUD-596-B07` / `B-07`, class residual of `AUD-592-R02`': {'commit': 'e060485', 'status': 'present'}, '`AUD-596-B09` / `B-09`': {'commit': '5b8146c', 'status': 'present'}, '`AUD-596-B10` / `B-10`': {'commit': '5cb994d', 'status': 'present'}, '`AUD-596-B16` / `B-16`': {'commit': '1507f69', 'status': 'present'}, '`AUD-596-D01` / `B-13` + `B-14`': {'commit': '0b1bdf0', 'status': 'present'}, '`AUD-596-D02` / `B-08`, residual of `AUD-594-N04`': {'commit': 'e7f73c3', 'status': 'present'}, '`AUD-596-D03` / `ASK-AGT-001`': {'commit': '8c46967', 'status': 'present'}, '`AUD-596-D04` / `B-18`': {'commit': '040f027', 'status': 'present'}, '`AUD-596-D05` / `B-19`': {'commit': 'fd2bf68', 'status': 'present'}, '`AUD-596-D06` / `B-20`': {'commit': '784cd83', 'status': 'present'}, '`AUD-596-D07` / `B-17`, half refuted': {'commit': 'c3ff822', 'status': 'present'}, '`AUD-596-D08` / `B-22`, class residual of `AUD-591-A06`': {'commit': 'b396c6a', 'status': 'present'}, '`AUD-596-D09` / `B-23`, surviving half of `B26`': {'commit': 'fd3d63f', 'status': 'present'}, '`AUD-596-D10` / `B-29`': {'commit': '', 'status': 'uncited'}, '`AUD-596-D11` / `ASK-UX-005`': {'commit': 'f4b4f77', 'status': 'present'}, '`AUD-596-D12` — six hints that send the reader back to the error': {'commit': '498df44', 'status': 'present'}, '`AUD-596-D13` / `B-28`': {'commit': '1014c72', 'status': 'present'}, '`AUD-596-D14` / `B-15`, narrow half of `B20`': {'commit': '10f2827', 'status': 'present'}, '`AUD-596-R01` / `B-05`': {'commit': '', 'status': 'uncited'}, '`AUD-596-X01` / `ASK-GATE-001`, gating half of `B24`': {'commit': 'e59c655', 'status': 'present'}, '`AUD-596-X02` / `ASK-UX-001` + `ASK-UX-002` + `B-21`': {'commit': 'f6ebf50', 'status': 'present'}, '`AUD-597-A01` / `ASK-UX-001` + `N-01`': {'commit': 'f8cf061', 'status': 'present'}, '`AUD-597-A02` / `ASK-UX-008` + `ASK-DOC-002`': {'commit': '9d47a4c', 'status': 'present'}, '`AUD-597-A03` / `ASK-DET-001`': {'commit': '4c7622a', 'status': 'present'}, '`AUD-597-A04` / `ASK-LEDGER-001`': {'commit': '46fb870', 'status': 'present'}, '`AUD-597-D01` / `B-04`': {'commit': '1094e6a', 'status': 'present'}, '`AUD-597-D02` / `ASK-DOC-001`': {'commit': 'ecb1bb7', 'status': 'present'}, '`AUD-597-D03` / `N-06`': {'commit': '9784333', 'status': 'present'}, '`AUD-597-D04` / `N-05`': {'commit': 'e51c087', 'status': 'present'}, '`AUD-597-D05` / `N-04`, fourth appearance of `C4-27`': {'commit': '9cccc15', 'status': 'present'}, '`AUD-597-D06` / `ASK-CLI-001`': {'commit': '178aa6d', 'status': 'present'}, '`AUD-597-D07` / `N-03`': {'commit': '9245e35', 'status': 'present'}, '`AUD-597-R01` / `ASK-PERF-001`': {'commit': '6910054', 'status': 'present'}, '`AUD-597-R02` / `ASK-ENC-001`': {'commit': 'ce6dac1', 'status': 'present'}, '`AUD-597-R03` / `ASK-UX-002`': {'commit': 'c57e50b', 'status': 'present'}, '`AUD-597-X01` / `ASK-BUILD-001` + `ASK-META-001` / `B-12`': {'commit': '354338b', 'status': 'present'}, '`AUD-598-B01` / `ASK-META-001`': {'commit': 'b2f7c65', 'status': 'present'}, '`AUD-598-B02` / `ASK-UX-002`': {'commit': '56a4bf7', 'status': 'present'}, '`AUD-598-B03` / `B-11`': {'commit': 'c63cb24', 'status': 'present'}, '`AUD-598-B04` / `N-02`': {'commit': '187937f', 'status': 'present'}, '`AUD-598-R01` / `ASK-PERF-002`': {'commit': '', 'status': 'uncited'}, '`AUD-598-X01` / `N-01` + `B-13` + `B-14` + `B-29` + `N-06`': {'commit': '6f2f5a4', 'status': 'present'}, '`AUD-600-B01` / `P-01`': {'commit': '366ffed', 'status': 'present'}, '`AUD-600-B02` / `P-02` + `ASK-PACK-002`': {'commit': '2a814c3', 'status': 'present'}, '`AUD-600-B03` / `ASK-PACK-001`': {'commit': '452f2a0', 'status': 'present'}, '`AUD-600-D01`': {'commit': '1224e1b', 'status': 'present'}, '`AUD-600-D02`': {'commit': 'eab8172', 'status': 'present'}, '`AUD-600-R01` / `R-01`': {'commit': '88add64', 'status': 'present'}, '`AUD-601-B01` / `N-02`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-B02` / `ASK-PACK-004`': {'commit': '', 'status': 'uncited'}, '`AUD-601-D01` / `N-01`, `ASK-UX-001`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-D02` / `B-13`, `B-14`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-M01` / `B-26`, `B-27` retracted': {'commit': '', 'status': 'uncited'}, '`AUD-601-R01` / `R-02`': {'commit': '', 'status': 'uncited'}, '`B-3`': {'commit': '773268d', 'status': 'present'}, '`B-6`': {'commit': '17c6e06', 'status': 'present'}, '`B-8`': {'commit': '8329614', 'status': 'present'}, '`BUG-3` / `443b345`': {'commit': '', 'status': 'uncited'}, '`BUG-4a` / `AUD-588-B11` residual': {'commit': '24b4185', 'status': 'present'}, '`BUG-4b` / `AUD-588-B11` residual': {'commit': '0376350', 'status': 'present'}, '`E-39`, class residual of `AUD-593-N06`': {'commit': '25fc11f', 'status': 'present'}, '`N-5`': {'commit': 'c68083f', 'status': 'present'}, '`N-7`': {'commit': '082e9de', 'status': 'present'}, '`R-1`': {'commit': '424fb1c', 'status': 'present'}, '`R-2`': {'commit': '5158b92', 'status': 'present'}, '`R-3`': {'commit': '88aec04', 'status': 'present'}, '`R-4`': {'commit': '04fd04f', 'status': 'present'}}
 CLOSURE_COVERAGE = {'closed_rows': 113, 'present': 88, 'absent': 0, 'unresolved': 0, 'uncited': 25, 'unknown': 0}

sourcecode/_docs/DEFECT-LEDGER.md

@@ -16,6 +16,75 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
+**Corpus ampliado recibido, 2026-08-23 — 17 hallazgos nuevos en intake.**
+[`AUDIT-2026-08-23-CORPUS-AMPLIADO.md`](AUDIT-2026-08-23-CORPUS-AMPLIADO.md) registra cuatro
+P0 (`AUD-CA-001`, `002`, `003`, `014`), ocho P1, cuatro P2 y un P3. La evidencia externa
+aporta reproducción y contraste manual, pero estas filas permanecen **pendientes de
+reproducción contra checkout/wheel**: no se declaran corregidas ni se atribuyen al código
+auditado. La prioridad inmediata es seguridad no modelada, colisiones de FQN y superficie
+HTTP Micronaut; después siguen contratos de inventario, cobertura y precisión de salida.
+
+**Correcciones iniciadas, 2026-08-23.** `AUD-CA-001` (declaración segura de Shiro),
+`AUD-CA-005` (autoridad de `src/main`), `AUD-CA-013` (sobrecargas y anclas de
+`explain`) y `AUD-CA-017` (contador estructurado) están corregidos en commits atómicos
+de `5.8.25`. `AUD-CA-014` tiene una corrección parcial: Micronaut ya aparece como
+superficie detectada-no-modelada y cuantificada, pero el soporte HTTP sigue pendiente.
+Los restantes hallazgos permanecen abiertos hasta reproducirlos y cubrirlos con pruebas.
+
+**Estado autoritativo del repositorio, 2026-08-23 — `5.8.25`, `HEAD 3d56d11`.** Este
+snapshot supersede cualquier estado de release indicado en las secciones históricas de
+este ledger. La batería completa pasa en verde cuando se configuran ambos almacenes
+temporales: `SOURCECODE_CONTEXT_CACHE_DIR` para CIR/parse y `SOURCECODE_CACHE_DIR` para
+snapshots/RIS. Usar sólo el primer directorio produce falsos fallos de persistencia.
+
+Los commits `125e486`, `735d766`, `434d0e2`, `cd3f8f1`, `e9f5861`, `49187f9` y `3d56d11` están incluidos
+en el checkout actual. Cubren rutas
+Windows, selftest con `ask.exe`, resolución bounded de comandos y flags, fallback de
+contexto, rutas POSIX del workspace, salida estable del job Windows, fingerprint sin estado
+runtime de caché, sweep final del parse cache, gate CI de migraciones, trazabilidad explícita
+de benchmarks históricos y aislamiento de observabilidad por invocación. Por tanto,
+`ASK-UX-001`, `ASK-UX-002` y `ASK-ENV-001` ya no deben describirse como fallos sin
+corrección: quedan **pendientes de verificación contra el wheel publicado y de confirmación
+en GitHub Windows**.
+
+La cola abierta actual es: validación externa de `ASK-DET-002`, `B-26` y `ASK-GATE-001`,
+regeneración reproducible de cifras `B-11`, `ASK-PERF-003` (medición aislada aún
+necesaria), `B-13`/`B-14` (reconciliación contra artefacto exacto), y la deuda P3 de filas
+sin cita y `B-30`. No quedan fallos locales reproducidos pendientes en esta batería.
+
+Las menciones posteriores a `5.8.24`, “release/commit pending” o “no audit, no release”
+son fotografías históricas de sus respectivas iteraciones. Se mantienen para trazabilidad,
+pero no representan el estado vigente ni deben usarse para decidir el siguiente release.
+
+**External `5.8.25` regression audit received, 2026-08-23 — triage recorded.**
+[`AUDIT-2026-08-23-EXTERNAL-5.8.25.md`](AUDIT-2026-08-23-EXTERNAL-5.8.25.md) separates the
+Windows/MSAS wheel evidence from this checkout. The only new confirmed product defect is
+`ASK-DET-002`: root `content_id` changes between cold and warm runs because `_cache` runtime
+state is included in the answer fingerprint. `ASK-UX-001`/`ASK-UX-002` and
+`ASK-GATE-001` remain actionable contract residues in the audited artefact; `ASK-ENV-001`
+is a Windows-specific witness still requiring reproduction. `B-26` is recorded as a fleet
+capacity issue (559.48 MB against 512 MB), not as a finding-analysis error. The reported
+performance deltas are not accepted as regressions until isolated measurements control cache
+state and concurrency. `B-13`/`B-14` require reconciliation against the exact wheel and
+repository pair because the source re-audit disagrees with the external field result.
+
+The validated commercial queue is now: deterministic/provenance envelope, bounded UX and
+hint correctness, coherent CI gates, Windows envelope verification, then PR semantic gate,
+bounded agent context, Java/Spring migration inventory, HTTP exposure provenance and SARIF
+enrichment. The complete CTO assessment and acceptance criteria are in the linked audit;
+they are not a claim that every auditor suggestion is a next-iteration fix.
+
+**ThingsBoard field audit, 2026-08-23 — five findings documented and corrected in the
+working tree; included in `5.8.25` and commit `2c551db`.**
+[`AUDIT-2026-08-23-THINGSBOARD-FINDINGS.md`](AUDIT-2026-08-23-THINGSBOARD-FINDINGS.md)
+records the evidence and acceptance tests for the missing negative scope (`AUD-THB-001`),
+TX-006 precision (`AUD-THB-002`), ambiguous `none_detected` exposure semantics
+(`AUD-THB-003`), incomplete evidence bounds in the generated report (`AUD-THB-004`) and
+contradictory migration summary wording (`AUD-THB-005`). The audit found no runtime
+regression, crash, write leakage or mutation of the audited checkout. The five authorities
+and focused regression tests were updated and released; these rows are product gaps/defects, not
+claims that ThingsBoard itself is broken.
+
 **`AUD-601` queue closed, 2026-08-23 — seven rows, one commit each, no release.** Six closed
 and one (`AUD-601-X01`) held with the half it was owed. Suite **12 702 / 0 red**,
 `__version__` unchanged at `5.8.24`. ⚠ **Three more reported mechanisms are corrected by the

sourcecode/audit_report.py

@@ -22,6 +22,36 @@ from sourcecode.partial_contract import floor_counts, read_count
 AUDIT_REPORT_SCHEMA = "audit-report-v1"
 
 
+def _evidence_bounds(
+    *, root: Path, profiles: Optional[set[str]], risk: dict[str, Any], posture: dict[str, Any]
+) -> dict[str, Any]:
+    """Publish the limits beside every bundled executive conclusion."""
+    identity = repository_identity(root)
+    non_coverage: list[Any] = []
+    for payload in (risk, posture):
+        block = payload.get("non_coverage") if isinstance(payload, dict) else None
+        if isinstance(block, dict):
+            non_coverage.extend(block.get("items") or [])
+        elif isinstance(block, list):
+            non_coverage.extend(block)
+    partial = bool(risk.get("partial") or risk.get("_partial"))
+    return {
+        "status": "partial" if partial else "bounded",
+        "repository": identity,
+        "commit": identity.get("git_head") or identity.get("commit") or "unknown",
+        "tree_state": identity.get("tree_state") or identity.get("git_status") or "unknown",
+        "profiles": sorted(profiles) if profiles else ["default"],
+        "scope": "risk + Spring posture evidence packaged by audit-report",
+        "unsupported_surfaces": list(dict.fromkeys(str(item) for item in non_coverage)),
+        "partial": partial,
+        "claim_rule": (
+            "absence from a partial, unresolved or unsupported population is not "
+            "evidence of absence; only explicitly modeled and complete populations "
+            "may support an exclusion"
+        ),
+    }
+
+
 def _canonical_json(data: dict[str, Any]) -> bytes:
     return json.dumps(data, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
 
@@ -121,6 +151,9 @@ def build_audit_report(
             "non_coverage": (risk.get("non_coverage") or {}).get("items", []),
         },
     }
+    unsigned["evidence_bounds"] = _evidence_bounds(
+        root=root, profiles=profiles, risk=risk, posture=posture
+    )
     # C3-89. A bundle whose evidence was cut says so **before** it is signed, and
     # says it where a reader of the summary sees it — a signature over a truncated
     # payload that does not declare the truncation is the worst artifact this
@@ -263,6 +296,16 @@ def render_markdown(report: dict[str, Any]) -> str:
         "## Limits",
         "",
         str((report.get("limits") or {}).get("statement", "")),
+        "",
+        "## Evidence Bounds",
+        "",
+        f"- Status: `{(report.get('evidence_bounds') or {}).get('status', 'unknown')}`",
+        f"- Commit: `{(report.get('evidence_bounds') or {}).get('commit', 'unknown')}`",
+        f"- Tree state: `{(report.get('evidence_bounds') or {}).get('tree_state', 'unknown')}`",
+        f"- Profiles: `{', '.join((report.get('evidence_bounds') or {}).get('profiles') or [])}`",
+        f"- Unsupported surfaces declared: `{len((report.get('evidence_bounds') or {}).get('unsupported_surfaces') or [])}`",
+        "",
+        str((report.get("evidence_bounds") or {}).get("claim_rule", "")),
     ])
     signature = report.get("signature")
     if isinstance(signature, dict):

sourcecode/baseline_autocapture.py

@@ -52,6 +52,11 @@ ENV_FLAG: str = "ASK_BASELINE_AUTOCAPTURE"
 _TRUE = frozenset({"1", "true", "yes", "on"})
 _FALSE = frozenset({"0", "false", "no", "off"})
 
+
+def _published_path(path: Path) -> str:
+    """Serialize a filesystem path with the stable separator used by payloads."""
+    return path.as_posix()
+
 # Actions.
 CAPTURED: str = "captured"
 SKIPPED: str = "skipped"
@@ -408,7 +413,7 @@ def decide(
     if already_captured is not None:
         return CaptureDecision(
             SKIPPED, COMMIT_ALREADY_CAPTURED,
-            baseline_file=str(already_captured), **common
+            baseline_file=_published_path(already_captured), **common
         )
     return CaptureDecision(
         CAPTURED, HISTORY_PRESENT if history_exists else EXPLICITLY_ENABLED, **common
@@ -498,12 +503,12 @@ def run(
     except Exception as exc:  # a side effect never decides the host command's verdict
         return CaptureDecision(
             SKIPPED, WRITE_FAILED,
-            history_dir=str(hist), commit=plan_.commit,
+            history_dir=_published_path(hist), commit=plan_.commit,
             history_size=plan_.history_size, error=f"{type(exc).__name__}: {exc}",
         )
     return CaptureDecision(
         CAPTURED, plan_.reason,
-        history_dir=str(hist), commit=plan_.commit,
-        baseline_file=str(written),
+        history_dir=_published_path(hist), commit=plan_.commit,
+        baseline_file=_published_path(written),
         history_size=(plan_.history_size or 0) + 1,
     )

sourcecode/cache_model.py

@@ -745,10 +745,9 @@ def field_anchor_note(row: "Optional[CommandCache]") -> "Optional[str]":
         return "build not recorded"
     if measured_on == __version__:
         return None
-    # Short on purpose: this rides along every `here:` line and every row of
-    # `cache model`, and the build is the whole fact. The sentence that explains
-    # what an older build means is `field_currency()['statement']`, printed once.
-    return f"on {measured_on}"
+    # Keep the warning local to every advice line: consumers must not mistake a
+    # historical measurement for a current release benchmark.
+    return f"historical; on {measured_on}; re-measure before using as a current benchmark"
 
 
 def field_subject(row: "CommandCache") -> str:

sourcecode/cli.py

@@ -534,7 +534,6 @@ def _resolve_bounded_invocation(invocation: str) -> "tuple[str, bool]":
     arrives with a first-look count and the line is still something to paste.
     """
     try:
-        import click
         import typer.main as _typer_main
 
         from sourcecode.output_ceiling import _BOUNDING_FLAGS, as_typed
@@ -543,9 +542,10 @@ def _resolve_bounded_invocation(invocation: str) -> "tuple[str, bool]":
         node: Any = _typer_main.get_command(app)
         consumed = 0
         for token in tokens:
-            if not isinstance(node, click.Group):
+            commands = getattr(node, "commands", None)
+            if not isinstance(commands, dict):
                 break
-            child = node.commands.get(token)
+            child = commands.get(token)
             if child is None:
                 break
             node, consumed = child, consumed + 1
@@ -571,7 +571,6 @@ def _declares_a_bound(invocation: str) -> bool:
     print belongs with the ones the reader has to plan for.
     """
     try:
-        import click
         import typer.main as _typer_main
 
         from sourcecode.output_ceiling import _BOUNDING_FLAGS
@@ -579,9 +578,10 @@ def _declares_a_bound(invocation: str) -> bool:
         node: Any = _typer_main.get_command(app)
         consumed = 0
         for token in invocation.split():
-            if not isinstance(node, click.Group):
+            commands = getattr(node, "commands", None)
+            if not isinstance(commands, dict):
                 break
-            child = node.commands.get(token)
+            child = commands.get(token)
             if child is None:
                 break
             node, consumed = child, consumed + 1
@@ -2064,9 +2064,36 @@ def _active_command_context() -> "tuple[str, Optional[Path]]":
 
         ctx = click.get_current_context(silent=True)
     except Exception:
-        return "", None
+        ctx = None
+
     if ctx is None:
-        return "", None
+        # Console scripts and embedded entry points can emit after Click has
+        # released its context. Derive the command from argv rather than
+        # publishing `unknown` for an otherwise valid answer.
+        argv = list(sys.argv[1:])
+        known: set[str] = set()
+        try:
+            known.update(
+                str(info.name or "") for info in app.registered_commands
+                if info.name
+            )
+            known.update(
+                str(info.name or "") for info in app.registered_groups
+                if info.name
+            )
+        except Exception:
+            pass
+        command = ""
+        for index, token in enumerate(argv):
+            if token.startswith("-") or token not in known:
+                continue
+            command = token
+            if token in {"retrieve", "cache", "auth", "mcp", "telemetry", "baseline", "pack"}:
+                if index + 1 < len(argv) and argv[index + 1] in known:
+                    command = f"{token} {argv[index + 1]}"
+            break
+        target = Path(_get_detected_path() or Path.cwd())
+        return command or _ROOT_COMMAND_NAME, target
 
     names: list[str] = []
     node: Any = ctx
@@ -3573,7 +3600,7 @@ def _pack_output_path(
     """
     if output_path is not None or output_dir is None:
         return output_path
-    suffix = {"json": ".json", "yaml": ".yaml", "markdown": ".md"}.get(
+    suffix = {"json": ".json", "yaml": ".yaml", "markdown": ".md", "sarif": ".sarif"}.get(
         format, ".json"
     )
     return output_dir / f"pack{suffix}"
@@ -4359,7 +4386,7 @@ def pack_gate_cmd(
         "--output-dir",
         help="Write component artifacts and, unless --output is set, the aggregate pack file.",
     ),
-    format: str = _format_option(help="Output format: json, yaml, github-actions or gitlab."),
+    format: str = _format_option(help="Output format: json, yaml, github-actions, gitlab or sarif."),
     copy: bool = _copy_option(),
     output_path: Optional[Path] = _output_option(),
 ) -> None:
@@ -4382,6 +4409,17 @@ def pack_gate_cmd(
         output = (render_pack_gate_github_actions(data)
                   if format == "github-actions" else render_pack_gate_gitlab(data))
         _emit_command_output(output, output_path, copy, stamp_envelope=False)
+    elif format == "sarif":
+        from sourcecode.sarif_emit import pack_gate_to_sarif
+        _emit_command_output(
+            _serialize_dict(pack_gate_to_sarif(data), "json"),
+            _pack_output_path(
+                None if data.get("no_write_substitution") else output_dir,
+                output_path,
+                format,
+            ),
+            copy,
+        )
     else:
         _emit_command_output(
             _serialize_dict(data, format),
@@ -5018,6 +5056,15 @@ def main(
       ask /path/to/repo --compact  analyze specific path
       ask --agent                agent-optimized output (full detail)
     """
+    # Cache observations belong to one CLI invocation. Typer's test runner and
+    # embedded callers reuse the Python process, so leaving the counters alive
+    # makes the next payload describe earlier lookups and can change its size.
+    try:
+        from sourcecode import cache_observation
+
+        cache_observation.reset()
+    except Exception:
+        pass
     _apply_jobs(jobs)
     # A root option so the ceiling is one policy rather than sixty flags, and an
     # environment variable so it survives into a subcommand's own parse: Click
@@ -11283,7 +11330,7 @@ def spring_audit_cmd(
         help="Write output to a file instead of stdout.",
     ),
     format: str = _format_option(
-        help="Output format: json (default), yaml, github-comment, or github-actions."
+        help="Output format: json (default), yaml, github-comment, github-actions, or sarif."
     ),
     copy: bool = _copy_option(),
     scope: str = typer.Option(
@@ -11565,6 +11612,9 @@ def spring_audit_cmd(
         ).finalize()
         if format == "github-comment":
             output = _render_spring_audit_github_comment(empty_result, min_severity)
+        elif format == "sarif":
+            from sourcecode.sarif_emit import spring_audit_to_sarif
+            output = _serialize_dict(spring_audit_to_sarif(empty_result.to_dict()), "json")
         else:
             output = _serialize_dict(empty_result.to_dict(), format)
         _emit_command_output(output, output_path, copy,
@@ -11991,7 +12041,11 @@ def spring_audit_cmd(
             )
             if _sel is not None:
                 data["_filter"] = _sel
-            output = _serialize_dict(data, format)
+            if format == "sarif":
+                from sourcecode.sarif_emit import spring_audit_to_sarif
+                output = _serialize_dict(spring_audit_to_sarif(data), "json")
+            else:
+                output = _serialize_dict(data, format)
         finally:
             # C3-54: `done` must not claim the answer exists before it does. The
             # field log showed `[ask] done (6.8m)` printed, then the process torn
@@ -12240,7 +12294,7 @@ def verify_cmd(
     output_path: Optional[Path] = typer.Option(
         None, "--output", "-o", help="Write the report JSON to a file instead of stdout."
     ),
-    format: str = _format_option(help="Output format: json (default), yaml, or github-actions."),
+    format: str = _format_option(help="Output format: json (default), yaml, github-actions, or sarif."),
     fail_on: str = typer.Option(
         "new",
         "--fail-on",
@@ -12552,6 +12606,9 @@ def verify_cmd(
             count=_verify_count,
             reason=(report.unverified_reason or "") if _verify_status == "unverified" else "",
         )
+    elif format == "sarif":
+        from sourcecode.sarif_emit import verify_to_sarif
+        output = _serialize_dict(verify_to_sarif(payload), "json")
     else:
         output = _serialize_dict(payload, format)
 
@@ -13571,6 +13628,14 @@ def migrate_apply_cmd(
     ),
     min_severity: str = typer.Option("low", "--min-severity"),
     include_hygiene: bool = typer.Option(False, "--include-hygiene"),
+    ci: bool = typer.Option(
+        False,
+        "--ci/--no-ci",
+        help=(
+            "Gate CI on migration_blocking_count from the pre-apply plan. "
+            "A failing gate never creates a migration worktree."
+        ),
+    ),
     output_path: Optional[Path] = typer.Option(None, "--output", "-o"),
     format: str = _format_option(help="Output format: json or yaml."),
     copy: bool = _copy_option(),
@@ -13622,16 +13687,23 @@ def migrate_apply_cmd(
             "status": "not_requested",
             "compile_requested": bool(compile_result),
         },
+        "gate": _migration_gate(report, ci),
     }
-    if not write:
+    if not write or (ci and data["gate"]["exit_code"]):
         data["execution"]["next_step"] = (
             "Review this plan, then rerun with --write --rewrite-version X.Y.Z. "
             "No source or branch was created."
         )
         _emit_command_output(
             _serialize_dict(data, format), output_path, copy,
-            success_msg="migration plan generated; nothing was changed",
+            success_msg=(
+                "migration gate failed; nothing was changed"
+                if ci and data["gate"]["exit_code"]
+                else "migration plan generated; nothing was changed"
+            ),
         )
+        if ci and data["gate"]["exit_code"]:
+            raise typer.Exit(code=1)
         return
 
     from sourcecode import readonly as _readonly
@@ -14195,6 +14267,21 @@ def _migration_blast_radius(
         )
 
 
+def _migration_gate(report: object, enabled: bool) -> dict[str, object]:
+    """Publish the migration CI decision from the report's blocking authority."""
+    count = int(getattr(report, "migration_blocking_count", 0) or 0)
+    return {
+        "enabled": bool(enabled),
+        "verdict": "fail" if count else "pass",
+        "exit_code": 1 if count else 0,
+        "blocking_count": count,
+        "basis": (
+            "--ci gates on migration_blocking_count: findings in the applicable "
+            "Boot/Jakarta/Spring migration dimensions; advisory hygiene is excluded"
+        ),
+    }
+
+
 @app.command("migrate-check")
 def migrate_check_cmd(
     path: Path = typer.Argument(
@@ -14264,6 +14351,14 @@ def migrate_check_cmd(
             "(hygiene_findings, summary.*) but not listed."
         ),
     ),
+    ci: bool = typer.Option(
+        False,
+        "--ci/--no-ci",
+        help=(
+            "Gate CI on migration_blocking_count. Without --ci the command remains "
+            "advisory and exits 0 after a complete report."
+        ),
+    ),
     target_jdk: Optional[int] = typer.Option(
         None,
         "--target-jdk",
@@ -14506,6 +14601,7 @@ def migrate_check_cmd(
     # here that the variable is advice on this command, rather than inferring a
     # bug from a deadline that did not fire.
     report.metadata["analysis_budget"] = _budget_disclosure("migrate-check")
+    report.metadata["gate"] = _migration_gate(report, ci)
 
     payload: Optional[dict[str, Any]] = None
     if table:
@@ -14611,6 +14707,9 @@ def migrate_check_cmd(
             f"{_snapshot_note}"
         ),
     )
+    if ci:
+        _gate = (payload or report.to_dict()).get("metadata", {}).get("gate", {})
+        raise typer.Exit(code=int(_gate.get("exit_code", 0)))
 
 
 # ── Spring Impact Chain ───────────────────────────────────────────────────────

sourcecode/envelope.py

@@ -275,10 +275,12 @@ def _volatile_keys() -> "frozenset[str]":
         # analysis report drift, which is the false positive that would have
         # made this id worth ignoring.
         conditions = {name for name, _label, _axes in _CONDITION_FIELDS}
-        return frozenset(_CLOCK_KEYS) | conditions | {_META_KEY}
+        # `_cache` is runtime provenance attached by cache layers. It can change
+        # between cold and warm runs without changing the analysis answer.
+        return frozenset(_CLOCK_KEYS) | conditions | {_META_KEY, "_cache"}
     except Exception:
         return frozenset({
-            _META_KEY, "generated_at", "run_id", "timings", "cache_layers",
+            _META_KEY, "_cache", "generated_at", "run_id", "timings", "cache_layers",
         })
 
 

sourcecode/explain.py

@@ -80,6 +80,7 @@ class ClassExplanation:
     stereotype: str
     purpose: str
     public_methods: list[str] = field(default_factory=list)
+    public_methods_detail: list[dict] = field(default_factory=list)
     incoming_callers: list[str] = field(default_factory=list)
     outgoing_deps: list[str] = field(default_factory=list)
     events_published: list[str] = field(default_factory=list)
@@ -134,7 +135,7 @@ class ClassExplanation:
         import dataclasses
 
         capped_fields = (
-            "public_methods", "incoming_callers", "outgoing_deps",
+            "public_methods", "public_methods_detail", "incoming_callers", "outgoing_deps",
             "events_published", "events_consumed", "transactions",
             "security_constraints", "rest_endpoints",
         )
@@ -160,6 +161,12 @@ class ClassExplanation:
             "stereotype": self.stereotype,
             "purpose": self.purpose,
             "public_methods": self.public_methods,
+            "public_methods_detail": self.public_methods_detail,
+            "public_methods_meta": {
+                "unit": "declared method",
+                "population": "public/protected methods and Spring @Bean factory members",
+                "basis": "canonical IR method nodes for the explained class",
+            },
             "incoming_callers": self.incoming_callers,
             "incoming_callers_count": self.incoming_callers_count,
             **declared_tags("explain.incoming_callers_count"),
@@ -187,6 +194,7 @@ class ClassExplanation:
             stereotype=d.get("stereotype", ""),
             purpose=d.get("purpose", ""),
             public_methods=list(d.get("public_methods", [])),
+            public_methods_detail=list(d.get("public_methods_detail", [])),
             incoming_callers=list(d.get("incoming_callers", [])),
             outgoing_deps=list(d.get("outgoing_deps", [])),
             events_published=list(d.get("events_published", [])),
@@ -434,6 +442,34 @@ def _build_public_methods(class_fqn: str, raw_nodes: list[dict]) -> list[str]:
     return sorted(set(methods))
 
 
+def _build_public_method_details(class_fqn: str, raw_nodes: list[dict]) -> list[dict]:
+    """Return one evidence row per public/protected method declaration."""
+    prefix = class_fqn + "#"
+    details: list[dict] = []
+    for node in raw_nodes:
+        fqn = str(node.get("fqn") or "")
+        if not fqn.startswith(prefix):
+            continue
+        kind = node.get("symbol_kind") or node.get("type") or ""
+        if kind == "bean":
+            eligible = True
+        elif kind in ("method", "endpoint", "constructor", ""):
+            eligible = "public" in (node.get("modifiers") or []) or "protected" in (
+                node.get("modifiers") or []
+            )
+        else:
+            eligible = False
+        if not eligible:
+            continue
+        details.append({
+            "name": fqn[len(prefix):],
+            "signature": str(node.get("signature") or ""),
+            "source_file": str(node.get("source_file") or node.get("declaring_file") or "") or None,
+            "line": node.get("line"),
+        })
+    return sorted(details, key=lambda row: (row["name"], row["signature"], row["source_file"] or ""))
+
+
 def _caller_class_fqns(
     class_fqn: str, cir: "CanonicalRepositoryIR", graph: "ContextGraph"
 ) -> list[str]:
@@ -784,6 +820,11 @@ def explain_class(
     public_methods = _section_of(
         "public_methods", lambda: _build_public_methods(class_fqn, raw_nodes), []
     )
+    public_methods_detail = _section_of(
+        "public_methods_detail",
+        lambda: _build_public_method_details(class_fqn, raw_nodes),
+        [],
+    )
     incoming_callers = _section_of(
         "incoming_callers", lambda: _build_callers(class_fqn, cir, graph), []
     )
@@ -819,6 +860,7 @@ def explain_class(
         stereotype=stereotype,
         purpose=purpose,
         public_methods=public_methods,
+        public_methods_detail=public_methods_detail,
         incoming_callers=incoming_callers,
         incoming_callers_count=len(incoming_callers),
         outgoing_deps=outgoing_deps,

sourcecode/format_contract.py

@@ -32,7 +32,7 @@ FORMAT_REGISTRY: "dict[str, tuple[str, ...]]" = {
     "main": ("json", "yaml"),
     "pack-list": ("json", "yaml"),
     "pack-assessment": ("json", "yaml", "markdown"),
-    "pack-gate": ("json", "yaml", "github-actions", "gitlab"),
+    "pack-gate": ("json", "yaml", "github-actions", "gitlab", "sarif"),
     "repo-ir": ("json", "yaml"),
     # C3-59: these eleven published `--format` and validated nothing, so
     # `ask risk . --format bogus` answered with JSON and no word about the value
@@ -57,7 +57,7 @@ FORMAT_REGISTRY: "dict[str, tuple[str, ...]]" = {
     "risk": ("json", "yaml"),
     "trend": ("json", "yaml"),
     "timeline": ("json", "yaml"),
-    "verify": ("json", "yaml", "github-actions"),
+    "verify": ("json", "yaml", "github-actions", "sarif"),
     "verify-edit": ("json", "yaml"),
     "impact": ("json", "yaml"),
     "endpoints": ("json", "yaml"),
@@ -74,7 +74,7 @@ FORMAT_REGISTRY: "dict[str, tuple[str, ...]]" = {
     "migrate-check": ("json", "text", "github-actions"),
     "migrate-recipe": ("json", "yaml"),
     "migrate-apply": ("json", "yaml"),
-    "spring-audit": ("json", "yaml", "github-comment", "github-actions"),
+    "spring-audit": ("json", "yaml", "github-comment", "github-actions", "sarif"),
     "explain": ("text", "json"),
     # `prepare-context` and the three commands that delegate to it gained yaml
     # with C3-59: the conversion happens in the shared emit seam, so it is the