sourcecode 5.8.26__tar.gz → 5.8.27__tar.gz

{sourcecode-5.8.26 → sourcecode-5.8.27}/.github/workflows/windows-battery.yml

@@ -26,6 +26,8 @@ jobs:
       PYTHONIOENCODING: "utf-8"
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - uses: actions/setup-python@v5
         with:

{sourcecode-5.8.26 → sourcecode-5.8.27}/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [5.8.27] — 2026-08-26
+
+*Audit remediation release. Detached workers avoid the Windows console shim,
+security scanning excludes platform and deprecated encoder definitions, and
+non-applicable Boot 3 readiness is represented consistently. `selftest` warns
+when an implicit current-directory run contains nested Git repositories. The
+release also synchronizes the user-facing documentation with these guarantees.*
+
 ## [5.8.26] — 2026-08-23
 
 *Patch release for the expanded-corpus audit. It preserves endpoint declarations
@@ -469,7 +477,7 @@ the evidence for outstanding field reproduction and performance work.*
 
 *Performance-mitigation and release-hygiene update. The external cross-version
 performance regression remains open until it is reproduced under its controlled
-`saint-server` protocol; this release does not present local warm-cache results
+`reference-service` protocol; this release does not present local warm-cache results
 as that closure.*
 
 ### Changed
@@ -1225,7 +1233,7 @@ said to name no smaller variant when one exists.*
 - An analysed population does not move between releases without a field that
   explains the move (B17-sv / AS-16). 5.8.0's E-35 fix removed symbols that were
   never declarations — `return unknownHelper("x");` parsed as one — and
-  `metadata.symbols_analyzed` fell with them (`saint-server` 43 642 → 43 003,
+  `metadata.symbols_analyzed` fell with them (`reference-service` 43 642 → 43 003,
   −1,46 %, after five constant versions). The correction was right and the
   release said nothing, so the next field re-audit read it as lost coverage and
   filed it P0. Every command that publishes `symbols_analyzed` now publishes
@@ -1608,7 +1616,7 @@ closed here, two refuted with the measurement that contradicts them.*
 
 ## [5.5.5] — 2026-08-13
 
-**MSAS performance-audit corrections and read-only hygiene verification.**
+**reference corpus performance-audit corrections and read-only hygiene verification.**
 
 ### Fixed
 - `spring-audit` now preserves full default JSON when it fits the stdout
@@ -1627,7 +1635,7 @@ closed here, two refuted with the measurement that contradicts them.*
   explicitly where no semantic model is available.
 
 ### Documentation
-- Recorded the MSAS findings, their reproductions, the resolved commits, and
+- Recorded the reference corpus findings, their reproductions, the resolved commits, and
   the remaining bounded-output, schema, timeline, benchmark, and Git-basis
   work in the roadmap.
 
@@ -2377,7 +2385,7 @@ product does not model — Keycloak, 8 204 Java files, Quarkus + JAX-RS,
 `spring_detected: false` in all six audited modules, 47 invocations under
 `ASK_READONLY=1` — and it split the product cleanly in two: every structural axis
 worked alone, and the axes that guess produced 86 `high` findings with zero true
-positives. Eval #21 is the seventh measurement of `saint-server`, and its
+positives. Eval #21 is the seventh measurement of `reference-service`, and its
 contribution is a partition rather than a defect.
 
 **Fixed in this release:**
@@ -3507,7 +3515,7 @@ them.
 ### Documentation
 
 - README and user guide examples now report `4.8.0`.
-- The development roadmap records the saint-server field-evaluation fixes and
+- The development roadmap records the reference-service field-evaluation fixes and
   future feature queue.
 
 ## [4.7.0] — 2026-08-04
@@ -4253,7 +4261,7 @@ verification against 4.0.1.
 
 - **SEC-007 — a credential stored in a deployment descriptor** (CL-10). The audit
   found `monitor:{SHA-256}dc20b820…` in
-  `src/main/options/{DPA,M3,M3DEV}/WEB-INF/web.xml`: unsalted, the same hash in all
+  `src/main/options/{DPA,sample,tenant-dev}/WEB-INF/web.xml`: unsalted, the same hash in all
   three per-environment overlays, and found by hand because *"los overlays
   `src/main/options/**` son punto ciego"*. The gap was admission surface, not
   detection — those descriptors are files `environment_resolution`,
@@ -5677,13 +5685,13 @@ and `registries` in both `ask schema` and `ask version`) are additive.
 
 - **A class was reported as conditional on a profile *and* on its negation, contradicting
   `ask posture` in the same run.** Found in the third field evaluation (3.2.0): a
-  configuration class declaring `@Profile("!m3")` — active exactly when `m3` is **absent** —
-  appeared in `signals.spring_profiles.profile_conditional_beans` under `m3` as well. Read as
+  configuration class declaring `@Profile("!sample")` — active exactly when `sample` is **absent** —
+  appeared in `signals.spring_profiles.profile_conditional_beans` under `sample` as well. Read as
   a security fact, it inverts the answer.
   - Root cause, reproduced: the source scan attributed every `@Profile` to *the next type
     declaration ahead of it*, falling back to the file name when there was none. A
-  `@Profile("m3")` on a `@Bean` **method** inside that class was therefore attributed to the
-    class itself, next to the class-level `@Profile("!m3")`.
+  `@Profile("sample")` on a `@Bean` **method** inside that class was therefore attributed to the
+    class itself, next to the class-level `@Profile("!sample")`.
   - Attribution is now the declaration the annotation actually annotates: only annotations
     and modifiers may stand between it and a type declaration; a member-level annotation is
     reported as `Type#member`, and an annotation whose target cannot be read is **not
@@ -8640,7 +8648,7 @@ Dependency audit (`pip-audit`): no known vulnerabilities in runtime dependencies
 
 ### Added
 - **`export --c4` now emits `components.module_roots` — architectural module
-  enumeration + DDD/legacy classification.** Field test (saint-server C4 doc pass)
+  enumeration + DDD/legacy classification.** Field test (reference-service C4 doc pass)
   surfaced that the C4 export keyed modules by *leaf source directory*
   (`dirname(source_file)`), so a DDD module split across
   `domain/` / `application/` / `infrastructure/` subdirs fragmented into several

sourcecode-5.8.27/CODE_OF_CONDUCT.md

@@ -0,0 +1,27 @@
+# Code of Conduct
+
+## Our Pledge
+
+We pledge to make participation in this project a harassment-free experience for everyone,
+regardless of age, body size, disability, ethnicity, gender identity and expression, level of
+experience, nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+## Expected Behaviour
+
+- Use welcoming and inclusive language.
+- Respect differing viewpoints and experiences.
+- Give and accept constructive feedback.
+- Focus on what is best for the community and the project.
+
+## Unacceptable Behaviour
+
+Harassment, discriminatory language, personal attacks, publication of private information, or
+other conduct that would be inappropriate in a professional setting is not acceptable.
+
+## Enforcement
+
+Report unacceptable behaviour privately to the project maintainers. Maintainers will review
+reports promptly and may remove, edit, or reject contributions, or take other action needed to
+protect participants.
+

{sourcecode-5.8.26 → sourcecode-5.8.27}/CONTRIBUTING.md

@@ -189,6 +189,11 @@ Rules:
 - Docstrings are optional but welcome for non-obvious logic
 - No inline comments explaining what the code does — names should do that
 - Comments only for non-obvious constraints or workarounds
+- Do not add customer names, trademarks, private repository identities, or
+  licensed third-party material to source, fixtures, examples, documentation,
+  benchmark labels, or generated artefacts. Use neutral names such as
+  `sample-service`, `example.org`, and `tenant-a`. Required legal notices and
+  dependency attributions are the only exception and must remain verbatim.
 
 ---
 

{sourcecode-5.8.26 → sourcecode-5.8.27}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.26
+Version: 5.8.27
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -22,12 +22,13 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Utilities
 Requires-Python: >=3.9
+Requires-Dist: click<8.4,>=8.2
 Requires-Dist: defusedxml>=0.7
 Requires-Dist: mcp<2,>=1.2
 Requires-Dist: pathspec>=1.0
 Requires-Dist: ruamel-yaml>=0.18
 Requires-Dist: tomli>=2.0; python_version < '3.11'
-Requires-Dist: typer>=0.24
+Requires-Dist: typer<0.26,>=0.24
 Provides-Extra: ast
 Requires-Dist: tree-sitter-javascript>=0.21; extra == 'ast'
 Requires-Dist: tree-sitter-typescript>=0.21; extra == 'ast'
@@ -58,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.26-blue)
+![Version](https://img.shields.io/badge/version-5.8.27-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -176,15 +177,14 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.8.26 retains the shared Canonical IR
+**Current performance status.** Release 5.8.27 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
-runs; the no-label path remains parse-free. The one-model-per-declared-label path is
-also retained. These are implementation properties, not duration promises:
-run `ask cache model <repo>` to see which command benefits from a warm cache and
-use `--progress stderr` for supervised runs. The external `data-exposure --config`
-remeasurement and portable cost-anchor calibration remain open because measurements
-from different hosts are not interchangeable; see the
-[roadmap](docs/DEVELOPMENT-ROADMAP.md).
+runs; the no-label path remains parse-free. These are implementation properties,
+not duration promises. A controlled external warm-path audit has opened performance
+and bounded-output regressions for this release; use `ask cache model <repo>` and
+`--progress stderr` for supervised runs, and consult the
+[active audit intake](docs/AUDIT-2026-08-23-EXTERNAL-5.8.26.md) before treating a
+historical timing or bounded flag as a current guarantee.
 
 **What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
@@ -210,7 +210,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.26 — and, on a build that has aged,
+ask version                    # ask 5.8.27 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -218,16 +218,13 @@ ask version                    # ask 5.8.26 — and, on a build that has aged,
 > (renaming the distribution is a separate, breaking change). Installing it gives you the
 > canonical **`ask`** command plus the deprecated **`sourcecode`** alias.
 
-> **Platforms.** Developed and tested on macOS and Linux; every release runs its full
-> battery there. **Windows/PowerShell is a target we cannot verify:** the CLI is written
-> for it — UTF-8 streams are forced at both console entry points, a successful run writes
-> nothing to stderr (PowerShell 5.1 raises `NativeCommandError` on any stderr write), and
-> the MCP server strips the BOM PowerShell puts on stdin — but no Windows runner exists in
-> the battery. Three separate field reports of console mojibake (`—` rendering as `â€"`)
-> have never reproduced under measurement, and the only variable those reports share is the
-> platform we cannot exercise (C3-3, C3-12, C3-38 in the
-> [defect ledger](docs/DEFECT-LEDGER.md)). On Windows, prefer `--output <file>` over shell
-> redirection, and report a rendering problem rather than assuming it is known.
+> **Platforms.** macOS, Linux and Windows are exercised in CI. The Windows battery runs the
+> full suite on every push, with focused envelope and memory-footprint cases. UTF-8 streams
+> are forced at both console entry points; a successful run writes nothing to stderr
+> (PowerShell 5.1 raises `NativeCommandError` on any stderr write), and the MCP server strips
+> the BOM PowerShell can put on stdin. For PowerShell, prefer `--output <file>` over shell
+> redirection when retaining an artefact. A successful CI run is the portability evidence for
+> a release; report a rendering problem with the command, shell and encoding.
 
 ---
 

{sourcecode-5.8.26 → sourcecode-5.8.27}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.26-blue)
+![Version](https://img.shields.io/badge/version-5.8.27-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -128,15 +128,14 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.8.26 retains the shared Canonical IR
+**Current performance status.** Release 5.8.27 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
-runs; the no-label path remains parse-free. The one-model-per-declared-label path is
-also retained. These are implementation properties, not duration promises:
-run `ask cache model <repo>` to see which command benefits from a warm cache and
-use `--progress stderr` for supervised runs. The external `data-exposure --config`
-remeasurement and portable cost-anchor calibration remain open because measurements
-from different hosts are not interchangeable; see the
-[roadmap](docs/DEVELOPMENT-ROADMAP.md).
+runs; the no-label path remains parse-free. These are implementation properties,
+not duration promises. A controlled external warm-path audit has opened performance
+and bounded-output regressions for this release; use `ask cache model <repo>` and
+`--progress stderr` for supervised runs, and consult the
+[active audit intake](docs/AUDIT-2026-08-23-EXTERNAL-5.8.26.md) before treating a
+historical timing or bounded flag as a current guarantee.
 
 **What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
@@ -162,7 +161,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.26 — and, on a build that has aged,
+ask version                    # ask 5.8.27 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -170,16 +169,13 @@ ask version                    # ask 5.8.26 — and, on a build that has aged,
 > (renaming the distribution is a separate, breaking change). Installing it gives you the
 > canonical **`ask`** command plus the deprecated **`sourcecode`** alias.
 
-> **Platforms.** Developed and tested on macOS and Linux; every release runs its full
-> battery there. **Windows/PowerShell is a target we cannot verify:** the CLI is written
-> for it — UTF-8 streams are forced at both console entry points, a successful run writes
-> nothing to stderr (PowerShell 5.1 raises `NativeCommandError` on any stderr write), and
-> the MCP server strips the BOM PowerShell puts on stdin — but no Windows runner exists in
-> the battery. Three separate field reports of console mojibake (`—` rendering as `â€"`)
-> have never reproduced under measurement, and the only variable those reports share is the
-> platform we cannot exercise (C3-3, C3-12, C3-38 in the
-> [defect ledger](docs/DEFECT-LEDGER.md)). On Windows, prefer `--output <file>` over shell
-> redirection, and report a rendering problem rather than assuming it is known.
+> **Platforms.** macOS, Linux and Windows are exercised in CI. The Windows battery runs the
+> full suite on every push, with focused envelope and memory-footprint cases. UTF-8 streams
+> are forced at both console entry points; a successful run writes nothing to stderr
+> (PowerShell 5.1 raises `NativeCommandError` on any stderr write), and the MCP server strips
+> the BOM PowerShell can put on stdin. For PowerShell, prefer `--output <file>` over shell
+> redirection when retaining an artefact. A successful CI run is the portability evidence for
+> a release; report a rendering problem with the command, shell and encoding.
 
 ---
 

{sourcecode-5.8.26 → sourcecode-5.8.27}/docs/AUDIT-2026-08-22-5.8.22.md

@@ -3,7 +3,7 @@
 **Fecha:** 2026-08-22  
 **Artefacto auditado:** release `5.8.22`, `build_commit`
 `583c07c405358d3e76dd20968960f5ab928608fd`  
-**Sujeto principal:** MSAS / `banyan-v2`, HEAD `3dde0376`, 3.342 ficheros Java  
+**Sujeto principal:** reference corpus / `banyan-v2`, HEAD `3dde0376`, 3.342 ficheros Java
 **Registro relacionado:** [`docs/DEFECT-LEDGER.md`](DEFECT-LEDGER.md), entrada
 `AUD-598-X01` y filas derivadas
 
@@ -11,7 +11,7 @@
 
 Se consolidan dos rondas independientes sobre la misma release:
 
-- Ronda A: MSAS, 57 invocaciones, 52 cronometradas, 3 `pr-impact` y 5 ayudas,
+- Ronda A: reference corpus, 57 invocaciones, 52 cronometradas, 3 `pr-impact` y 5 ayudas,
   `ASK_READONLY=1`, presupuesto explícito y 0 escrituras.
 - Ronda B: banco de 16 repositorios Java/Spring, unas 95 invocaciones, Windows
   11 Pro, pipx y Git Bash.
@@ -54,7 +54,7 @@ El estado siguiente es el que debe usarse para planificación y release:
 | `AUD-598-X01` | `open` | El ledger del producto va por delante del wheel: cinco cierres declarados no se observan en el artefacto `583c07c`. |
 | `AUD-598-B01` / `ASK-META-001` | `open` | La auditoría de wheel no observa `_meta`, `content_id` ni memoria en 9/9 payloads inspeccionados. Debe resolverse dentro de un wheel construido, no sólo en checkout. |
 | `AUD-598-B02` / `ASK-UX-002` | `open` | `posture --diff` ofrece `--compact` y `--limit`, pero ambos son no-op en el caso medido y los hints forman un ciclo. |
-| `AUD-598-B03` / `B-11` | `open` | Persisten 17 anclas de coste con texto `on 5.1.0` dentro de un build 5.8.22; además `risk` no alcanza su ancla publicada en MSAS. |
+| `AUD-598-B03` / `B-11` | `open` | Persisten 17 anclas de coste con texto `on 5.1.0` dentro de un build 5.8.22; además `risk` no alcanza su ancla publicada en reference corpus. |
 | `AUD-598-B04` / `N-02` | `open` parcial | `1e9` y `1_000` son presupuestos válidos, pero se aceptan sin advertir que no vincularán el proceso. |
 
 ## Cierres que el artefacto no confirma

{sourcecode-5.8.26 → sourcecode-5.8.27}/docs/AUDIT-2026-08-23-5.8.24.md

@@ -4,7 +4,7 @@
 **Artefacto auditado:** release `5.8.24`, `build_commit`
 `61b9c12b0e354cda157038bc8be6e19384a42368`
 **Sujetos:** banco de 16 repositorios Java/Spring sobre Windows 11 Pro (ronda A, ~145
-invocaciones) · MSAS / `banyan-v2`, HEAD `3dde0376`, 3 342 ficheros Java (ronda B, octava
+invocaciones) · reference corpus / `banyan-v2`, HEAD `3dde0376`, 3 342 ficheros Java (ronda B, octava
 ronda sobre el mismo árbol bit a bit, ~55 invocaciones, `ASK_READONLY=1` y techo explícito
 en todas, 0 tracebacks, 0 escrituras)
 **Registro relacionado:** [`DEFECT-LEDGER.md`](DEFECT-LEDGER.md), *Fourteenth Audit Pass* y
@@ -15,7 +15,7 @@ filas `AUD-601-*`
 | Ronda | Nota | Anterior | Veredicto del auditor |
 |---|---:|---:|---|
 | A — banco de 16 repos | `8,7/10` | 8,3 | Adoptar |
-| B — MSAS | `8,88/10` | 8,84 | Comprar y actualizar, con una reserva operativa |
+| B — reference corpus | `8,88/10` | 8,84 | Comprar y actualizar, con una reserva operativa |
 
 Ronda B marca **su propio eje de rendimiento como provisional** y nombra el confound. Ronda A
 **retracta una fila propia** tras cuatro informes. Ambas cosas cuentan a favor del método y
@@ -202,7 +202,7 @@ byte-idéntico a 156 902 B en dos corridas donde antes oscilaba ±1–3 B por re
 
 **De rendimiento: las dos rondas se contradicen, y no se declara regresión.**
 
-| | Ronda A (banco, protocolo con `cache warm` explícito, intercalado ×4, mediana, primera descartada) | Ronda B (MSAS) |
+| | Ronda A (banco, protocolo con `cache warm` explícito, intercalado ×4, mediana, primera descartada) | Ronda B (reference corpus) |
 |---|---|---|
 | Lectura | **8 de 9 anclas mejoran 4–17 %**, y las seis que subieron en `5.8.23` vuelven todas a su banda o por debajo. `ask --help` a 1,74 s, bajo el ×1,25 de vigilancia | `posture` +55 %, `spring-audit` ×2,1, `migrate-check` ×2,2, `selftest` +45 %, `compare` +39 %, `export --c4` peor — y `ask . --compact` **mejor 1,3×** (94,6 → 74,9 s), `validation` 1,5×, `verify --init` 1,3× |
 | Estado | firme | **provisional, declarado por su autor** |

{sourcecode-5.8.26 → sourcecode-5.8.27}/docs/AUDIT-2026-08-23-EXTERNAL-5.8.25.md

@@ -2,7 +2,7 @@
 
 **Fecha de recepción:** 2026-08-23  
 **Artefacto auditado:** ASK Engine `5.8.25`, build `b6e0e0f157687a962ce66627afe2e9b388fb2f06`  
-**Entornos:** Windows 11 Pro y MSAS (`3dde0376`)  
+**Entornos:** Windows 11 Pro y reference corpus (`3dde0376`)
 **Alcance:** aproximadamente 180 invocaciones, 0 tracebacks, 0 escrituras observadas.
 
 ## Estado posterior del checkout

sourcecode-5.8.27/docs/AUDIT-2026-08-23-EXTERNAL-5.8.26.md

@@ -0,0 +1,43 @@
+# ASK Engine 5.8.26 - External Regression Audit Intake
+
+**Received:** 2026-08-23  
+**Audited artefact:** `5.8.26`, build `e2da5d84a30bc2e8c60325e1e2d48a8d736b8ad7`  
+**Subject:** reference corpus, commit `3dde0376`, 3,342 Java files
+**Scope:** 35 read-only invocations, explicit output ceiling, no writes and no tracebacks.
+
+This is an intake record, not a claim that the defects are fixed. The audited build predates
+the local Windows fallback commit `829631d`; that later change is unrelated to the findings
+below until it is measured in a new artefact.
+
+## Confirmed Regressions And Defects
+
+| ID | Priority | Status | Evidence and required correction |
+|---|---:|---|---|
+| `ASK-REG-001` | P1 | fixed in checkout, pending release verification | `impact-chain` lost its default bounded result: `impact-chain CommonService .` moved from rc 0 / 77,054 B in 5.8.25 to rc 1 / 3,845,253 B in 5.8.26. `--limit 20` reduced only 0.9%. The cap now covers the endpoint-disposition partition that was left exhaustive and sets the inline default to 20; totals remain exact and `--limit 0` retains the full partition. Re-measure the original reference corpus case before closing the released-artifact row. |
+| `ASK-UX-002` | P1 | fixed in checkout, pending release verification | The root-help recommendation `posture . --diff dev:prod --compact` exits 1 at 287,446 B. The compact vocabulary now bounds `endpoint_access.changed`, the per-request delta previously omitted from every recursive projection. Re-measure the original reference corpus route before closing the released-artifact row. |
+| `ASK-DET-002` | P2 | fixed previously, revalidated in checkout | The report's proposed mechanism does not exist in current source: commit `434d0e2` excludes runtime `_cache` provenance from `content_id`, and the dedicated cold/warm determinism test passes. Runtime provenance remains observable. Re-measure the original wheel before closing the release-artifact row. |
+| `ASK-PERF-003` | P2 | in progress | Sequential warm measurements remain materially slower than 5.8.24: `validation --compact` 7.2 -> 21.8 s, `compare` 23.3 -> 56.5 s, `verify --init --no-write` 16.7 -> 50.1 s, `endpoints --servlets --compact` 4.1 -> 11.0 s, and `posture --resolve-environments` 8.9 -> 22.4 s. `selftest` and `export --c4` also regress. The release gate now measures the four repository-wide flagged invocations under distinct identities, so a cheaper parent baseline cannot mask them. The reported reference corpus subject and a sequential controlled baseline are still required to attribute and restore the runtime cost; `compare`, `selftest` and `export --c4` remain outside this gate because their inputs or composition need separately declared fixtures. |
+| `ASK-PROV-001` | P3 | fixed in checkout, pending release verification | `closure_coverage.uncited` is a false-negative-prone provenance state: `AUD-601-D01` is uncited even though the corresponding help change exists. The published basis now explicitly means “no commit was recorded to verify”, never “ineffective fix”; cite the missing closure commits where practical. |
+| `AUD-596-D08` / `B-22` | P3 | fixed in checkout, pending release verification | `compare` spends 14.7 s rejecting invalid directory candidates, double the prior 7.2 s. The CLI now has a regression assertion proving it rejects a directory candidate before constructing the IR. Re-measure the external invocation because the reported cost does not reproduce through the current admission path. |
+
+## Verified Closures
+
+The auditor verifies `ASK-UX-001`, `ASK-ENV-001`, and `ASK-GATE-001` on this artefact.
+`ASK-PERF-003` is only partial and worsened. Closure is behavioural evidence, not the
+provenance table alone.
+
+## Measurement Limits
+
+The auditor deliberately did **not** measure root compact/agent paths, plain `risk`,
+`verify-edit`, `pack gate`, or `pack assessment`. This record makes no claim about those
+surfaces. A 13-15% cost increase in three bounded views after the cache-budget correction is
+recorded as a watch item, not a regression: it is below the declared 25% threshold but needs
+the next controlled baseline.
+
+## Next Iteration Order
+
+1. Restore `impact-chain` bounded behaviour and make its floor/remedy model agree with the emitted payload.
+2. Make `posture --diff --compact` truthful and usable; then derive root-help wording from the same contract.
+3. Re-verify the released wheel's deterministic fingerprint; current source already excludes runtime cache state.
+4. Profile the sustained warm-path performance regressions on the original subject; the four repository-wide audited variants are now gated.
+5. Clarify and complete closure provenance without treating it as behavioural proof.

sourcecode-5.8.27/docs/AUDIT-2026-08-26-EXTERNAL-5.8.26.md

@@ -0,0 +1,46 @@
+# ASK Engine 5.8.26 - External Audit Intake
+
+**Received:** 2026-08-26  
+**Audited artefact:** `5.8.26`, Windows 11 / Git Bash (MSYS), Python 3.14  
+**Scope:** reference and multi-stack repositories; the report's second round tested 44/46 subcommands across Spring, Quarkus, Micronaut and Jakarta EE.
+
+This record separates the first round's initial diagnosis from the controlled retest. The
+initial report called slow cold analyses hangs; the retest disproved a deadlock. The actual
+queue below contains only reproducible product defects or explicitly bounded investigations.
+
+## Confirmed Queue
+
+| ID | Priority | Status | Finding and acceptance criterion |
+|---|---:|---|---|
+| `AUD-602-R01` | P1 | implemented, pending Windows verification | `--detach` now launches the worker directly with the interpreter, requests job breakaway and no console, and closes the parent's log handle. Linux regression coverage passes; MSYS, cmd and PowerShell verification remains release evidence. |
+| `AUD-602-S01` | P1 | implemented, pending witness verification | `SEC-004` now excludes Spring Security package definitions while preserving application uses. A platform-definition negative control and existing positive controls pass; the five original witness shapes still require verification against the audit corpus. |
+| `AUD-602-D01` | P2 | implemented, pending witness verification | `migrate-check.boot3_readiness` now uses `null` for every non-applicable Boot 3 dimension, matching `applicable_dimensions.boot3.score`. Synthetic non-Spring and completed-axis controls pass; the four original witnesses remain release evidence. |
+| `AUD-602-M01` | P2 | investigation | `parsing manifests` consumed about 90 seconds of a roughly 116-second cold root run with one `pom.xml`. Profile `dependency_analyzer` before changing it; do not call this a regression until the profiler and a controlled baseline identify the cost and reproduce it on the same subject. |
+| `AUD-602-UX01` | P3 | implemented | The help already labels historical timing anchors and documents `--progress stderr` / `ASK_PROGRESS=1` for non-interactive runs. No timing claim was changed without a fresh benchmark. |
+| `AUD-602-UX02` | P3 | implemented, pending field verification | Implicit `selftest .` now detects nested Git repositories and emits a scoped warning without contaminating JSON stdout. A controlled fixture passes; field verification remains release evidence. |
+
+## Not Bugs / Retractions
+
+- `ask --compact`, `ask --agent`, bare `ask` and `risk --limit 3` were initially reported as
+  hangs. The retest completed them in about 116 seconds cold and 0.84 seconds warm with
+  progress enabled. They are cold-cost and communication issues, not deadlocks.
+- The Micronaut `WebScripts/Alfresco` message was not reproduced in five retests. Keep it as
+  an unconfirmed witness; do not open a defect row unless the exact command and fixture
+  reproduce it.
+- Root-only `--compact` on `verify`, `impact` and `onboard` correctly returns structured
+  `INVALID_USAGE` with an actionable hint. Uniformity may be a future UX decision, not a bug.
+- No prompt-injection, path-traversal, zombie-process or SIGTERM-cleanup defect was found.
+
+## Operational Notes
+
+The audit's positive controls remain useful: typed flag errors had no tracebacks, `--no-write`
+did not mutate the tree, and the output ceiling worked. The reported `SEC-004` result also
+clarifies that `total_defects` is an aggregate across rule families, not the SEC-004 count.
+
+## Order
+
+1. `AUD-602-R01` - repair and cross-shell verify detached execution.
+2. `AUD-602-S01` - remove security false positives before relying on the audit for security gating.
+3. `AUD-602-D01` - normalize the non-applicable migration sentinel.
+4. `AUD-602-M01` - profile manifest parsing and establish an attributable baseline.
+5. `AUD-602-UX01` and `AUD-602-UX02` - make cost and scale expectations explicit.

{sourcecode-5.8.26 → sourcecode-5.8.27}/docs/COMMERCIAL-OFFER.md

@@ -3,7 +3,7 @@
 The single, coherent Free/Pro offer, defined by **customer value** (not technical
 difficulty). Companion to [`PRODUCT_TIERS.md`](PRODUCT_TIERS.md) (the mechanical split)
 and [`MODERNIZATION.md`](MODERNIZATION.md) (the flagship product narrative). CLI command:
-`sourcecode`.
+`ask` (`sourcecode` remains the deprecated compatibility alias).
 
 ## The one-sentence offer
 

{sourcecode-5.8.26 → sourcecode-5.8.27}/docs/CUSTOMER-VALIDATION.md

@@ -23,7 +23,7 @@ Assumes a developer who has never seen ASK Engine and reads only the current rep
 
 ### What they understand in the first 30 seconds
 Reading the title + tagline + first paragraph (`README.md:1–20`):
-- It is a tool called **ASK Engine**; the CLI is `sourcecode`.
+- It is a tool called **ASK Engine**; the canonical CLI is `ask`.
 - It gives **AI coding agents** persistent structural context and a fast repeated-analysis
   cache; the headline benefit framed is **speed** (re-parse avoidance, ~17x on Keycloak).
 - It targets **large Java or TypeScript monoliths**.