sourcecode 5.8.27__tar.gz → 5.8.28__tar.gz

{sourcecode-5.8.27 → sourcecode-5.8.28}/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [5.8.28] — 2026-08-26
+
+*Audit remediation release. Detached workers now use an executable package entry
+point; DEAD-001 ignores explanatory annotation prose; posture diffs honour the
+compact size contract; and non-interactive selftest runs publish nested-scope
+warnings. Help and audit documentation are synchronized with the remaining
+performance investigation.*
+
 ## [5.8.27] — 2026-08-26
 
 *Audit remediation release. Detached workers avoid the Windows console shim,

{sourcecode-5.8.27 → sourcecode-5.8.28}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.27
+Version: 5.8.28
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.27-blue)
+![Version](https://img.shields.io/badge/version-5.8.28-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -177,13 +177,13 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.8.27 retains the shared Canonical IR
+**Current performance status.** Release 5.8.28 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
 and bounded-output regressions for this release; use `ask cache model <repo>` and
 `--progress stderr` for supervised runs, and consult the
-[active audit intake](docs/AUDIT-2026-08-23-EXTERNAL-5.8.26.md) before treating a
+[active audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.27.md) before treating a
 historical timing or bounded flag as a current guarantee.
 
 **What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
@@ -210,7 +210,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.27 — and, on a build that has aged,
+ask version                    # ask 5.8.28 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.27 → sourcecode-5.8.28}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.27-blue)
+![Version](https://img.shields.io/badge/version-5.8.28-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -128,13 +128,13 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.8.27 retains the shared Canonical IR
+**Current performance status.** Release 5.8.28 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
 and bounded-output regressions for this release; use `ask cache model <repo>` and
 `--progress stderr` for supervised runs, and consult the
-[active audit intake](docs/AUDIT-2026-08-23-EXTERNAL-5.8.26.md) before treating a
+[active audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.27.md) before treating a
 historical timing or bounded flag as a current guarantee.
 
 **What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
@@ -161,7 +161,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.27 — and, on a build that has aged,
+ask version                    # ask 5.8.28 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

sourcecode-5.8.28/docs/AUDIT-2026-08-26-EXTERNAL-5.8.27.md

@@ -0,0 +1,52 @@
+# ASK Engine 5.8.27 - External Audit Intake
+
+**Received:** 2026-08-26  
+**Audited artefact:** `5.8.27`, Windows 11, Git Bash/MSYS and native PowerShell  
+**Comparison:** the prior `5.8.26` audit and the current release artefact
+
+This audit contains two assessments. The first confirms the semantic fixes; the
+technical follow-up supplies a reproducible root cause for detached execution
+and adds a bounded-output defect. The follow-up is the authoritative state for
+those rows.
+
+## Findings
+
+| ID | Priority | Status | Finding and acceptance criterion |
+|---|---:|---|---|
+| `AUD-603-R01` | P1 | implemented, pending Windows verification | `--detach` now uses executable `sourcecode/__main__.py` through `python -m sourcecode`, rather than the inert `sourcecode.cli` module. Focused worker and package-entry tests pass; MSYS, PowerShell and parent-lifetime verification remains release evidence. |
+| `AUD-603-S01` | P1 | implemented | `DEAD-001` now requires a Java comment to have annotation-directive shape before reporting it. Prose mentioning an annotation is ignored; true line/block commented annotations and existing security controls pass the focused battery. |
+| `AUD-603-O01` | P2 | implemented | `posture --compact` now applies registered cuts without the monotone optimisation that could revert them on large diffs. Nested endpoint/security lists remain bounded and the diff battery passes. |
+| `AUD-603-P01` | P2 | confirmed regression, investigation open | Two cold `5.8.27` measurements were about 174s and 184s versus one historical `5.8.26` measurement around 116s. `parsing manifests` consumed about 113s in one run despite one `pom.xml`. Reproduce with three controlled runs per release and profile before attributing or optimizing. |
+| `AUD-603-U01` | P3 | implemented | Root help now labels the `31s @ 5.1.0` figure as a historical field anchor before presenting it. No current timing is claimed until a controlled benchmark exists. |
+| `AUD-603-U02` | P3 | implemented, pending field verification | `selftest` now emits the nested-repository scope warning directly to stderr even when non-interactive, while leaving JSON stdout unchanged. The local ledger battery passes; field verification remains release evidence. |
+
+## Confirmed closures and exclusions
+
+- `AUD-602-S01` / `AUD-602-D01` are confirmed closed by the external re-test: SEC-004
+  has zero findings for the five Spring Security library shapes, and Boot 3 readiness is
+  `null` in all four non-applicable witnesses.
+- `AUD-602-R01` is **not closed**. The previous direct-module fix is invalid because
+  `sourcecode.cli` has no module entry invocation. `AUD-603-R01` supersedes its status.
+- `AUD-602-UX01` is **not closed**. Its communication residue is superseded by
+  `AUD-603-U01`, whose explicit headline label addresses the defect without inventing a
+  current benchmark.
+- `AUD-602-UX02` is **not closed**. The warning is gated on TTY output, so it is absent in
+  the non-interactive case the audit cares about. It is superseded by `AUD-603-U02`.
+- The Micronaut WebScripts message remains unconfirmed and requires no action.
+- Root-only `--compact` on subcommands remains by design with a correct typed refusal.
+
+## Scope notes
+
+The performance comparison is directionally concerning but not a release-to-release
+experiment: it has two current cold samples and one historical sample, with no parallel
+`5.8.26` environment. Treat it as a regression signal requiring controlled measurement,
+not as proof of a particular parser bottleneck. No prompt-injection, path-traversal,
+traceback, write-leakage or process-zombie issue was reported in this round.
+
+## Order
+
+1. `AUD-603-R01` - restore an actually executable detached worker entry point.
+2. `AUD-603-S01` - make DEAD-001 context-sensitive and add positive/negative controls.
+3. `AUD-603-O01` - resolve the posture diff compact/ceiling contract.
+4. `AUD-603-P01` - run the controlled cold benchmark and profile manifest parsing.
+5. `AUD-603-U01` / `AUD-603-U02` - align help and non-interactive scope communication.

{sourcecode-5.8.27 → sourcecode-5.8.28}/docs/DEFECT-LEDGER.md

@@ -16,6 +16,14 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
+**External `5.8.27` audit received, 2026-08-26 — `AUD-603`.** [`AUDIT-2026-08-26-EXTERNAL-5.8.27.md`](AUDIT-2026-08-26-EXTERNAL-5.8.27.md) confirms the SEC-004 and Boot 3 fixes, but reopens detached execution because the direct `python -m sourcecode.cli` worker exits without invoking `main_entry`. It adds a DEAD-001 comment-prose false positive, a `posture --diff --compact` output-ceiling contract defect, and a cold-performance regression signal requiring controlled profiling. The stale timing headline and non-interactive selftest scope warning remain open. WebScripts remains unconfirmed and root-only subcommand `--compact` remains by design.
+
+**Current `5.8.27` queue:** `AUD-603-R01` · `AUD-603-S01` · `AUD-603-O01` · `AUD-603-P01` · `AUD-603-U01` · `AUD-603-U02`. This supersedes the earlier AUD-602 implementation-status note for the reopened rows; its historical commits remain evidence, not closure.
+
+Implementation status on this branch: `R01`, `S01`, `O01`, `U01` and `U02` have isolated
+fix commits and affected local batteries pass. Native Windows verification remains pending
+for detached execution and field scope warnings; `P01` remains profiling-only.
+
 **External `5.8.26` audit received, 2026-08-26 — `AUD-602`.** [`AUDIT-2026-08-26-EXTERNAL-5.8.26.md`](AUDIT-2026-08-26-EXTERNAL-5.8.26.md) adds six actionable items: detached execution on Git Bash/MSYS, `SEC-004` false positives in Spring Security library code, inconsistent non-applicable `boot3_readiness`, manifest-parsing cost requiring profiling, stale root-help timing guidance, and an unguarded multi-repository `selftest` path. The initial root-command hang diagnosis is retracted after a controlled cold/warm retest; it is recorded as slow cold analysis plus insufficient progress communication, not a deadlock. The Micronaut WebScripts message remains unconfirmed, and root-only `--compact` on subcommands is a design choice with a correct `INVALID_USAGE` response, not a defect.
 
 **`AUD-602` attack order:** `AUD-602-R01` · `AUD-602-S01` · `AUD-602-D01` · `AUD-602-M01` · `AUD-602-UX01` · `AUD-602-UX02`. No item is closed from the report alone; Windows shell variants, original witness repositories and controlled profiling are required where stated.

{sourcecode-5.8.27 → sourcecode-5.8.28}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,6 +3,25 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
+> **CURRENT QUEUE — external audit of `5.8.27`, received 2026-08-26.** `AUD-603-R01` (P1,
+> detached worker exits because the module entry point is not invoked) -> `AUD-603-S01`
+> (P1, DEAD-001 comment-prose false positive) -> `AUD-603-O01` (P2, posture diff compact
+> exceeds the output ceiling) -> `AUD-603-P01` (P2, cold-cost regression signal requiring
+> controlled profiling) -> `AUD-603-U01` / `AUD-603-U02` (P3, stale timing headline and
+> non-interactive selftest scope warning). Full evidence is in
+> [`AUDIT-2026-08-26-EXTERNAL-5.8.27.md`](AUDIT-2026-08-26-EXTERNAL-5.8.27.md).
+
+> **STATE CORRECTION — AUD-602.** The external re-test confirms `S01` and `D01`, but reopens
+> detached execution and the two UX rows: `--detach` used a non-executable module form,
+> historical-anchor labelling did not refresh the headline, and the selftest notice is
+> suppressed in non-TTY runs. The prior implementation-status note is retained below as
+> history; it is superseded by the `AUD-603` queue.
+
+> **IMPLEMENTATION STATUS — AUD-603.** `R01`, `S01`, `O01`, `U01` and `U02` are implemented
+> in isolated commits and pass the affected local batteries. `R01` and `U02` still require
+> native Windows/field verification. `P01` remains investigation-only: no parser change is
+> accepted until three controlled cold runs per release and an attributable profile exist.
+
 > **CURRENT QUEUE — external audit of `5.8.26`, received 2026-08-26.** `AUD-602-R01` (P1,
 > detached execution dies under Git Bash/MSYS) -> `AUD-602-S01` (P1, `SEC-004` false
 > positives in Spring Security library code) -> `AUD-602-D01` (P2, inconsistent non-applicable

{sourcecode-5.8.27 → sourcecode-5.8.28}/docs/RC1-CHECKLIST.md

@@ -8,7 +8,7 @@ tests, and the commercial story. RC-1 is ready when every box below is checked.
 ## 1. Documentation
 - [x] Single public brand — **ASK Engine** (CLI: `ask`) across README, `--help`,
   welcome, docs (Increment #2.3).
-- [x] Version drift removed; current docs align to `5.8.27`; `ask version` is authoritative.
+- [x] Version drift removed; current docs align to `5.8.28`; `ask version` is authoritative.
 - [x] Offer defined — [`COMMERCIAL-OFFER.md`](COMMERCIAL-OFFER.md) (Free/Pro per capability).
 - [x] Flagship packaged — [`MODERNIZATION.md`](MODERNIZATION.md) (one product, one flow).
 - [x] Tiering doc current — [`PRODUCT_TIERS.md`](PRODUCT_TIERS.md) (incl. `migrate-check` freemium).

{sourcecode-5.8.27 → sourcecode-5.8.28}/docs/USER_GUIDE.md

@@ -46,10 +46,14 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.8.27, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.8.28, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
+The current external audit intake is tracked in
+[`AUDIT-2026-08-26-EXTERNAL-5.8.27.md`](AUDIT-2026-08-26-EXTERNAL-5.8.27.md); in
+particular, detached execution and bounded output remain under verification.
+
 ---
 
 ## The semantic engine
@@ -178,7 +182,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.27
+# ask 5.8.28
 ```
 
 Requires Python 3.9+.

{sourcecode-5.8.27 → sourcecode-5.8.28}/docs/perf/REGRESSION-GATE.md

@@ -47,9 +47,16 @@ threshold that lives in code cannot drift apart here, because there is only one.
     "posture",
     "risk",
     "modernize",
-    "repo-ir"
+    "repo-ir",
+    "endpoints --servlets",
+    "validation --compact",
+    "posture --resolve-environments",
+    "verify --init --no-write"
   ],
   "command_args": {
+    "endpoints --servlets": [
+      "--compact"
+    ],
     "migrate-check": [
       "--compact"
     ],

{sourcecode-5.8.27 → sourcecode-5.8.28}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.8.27"
+version = "5.8.28"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.8.27 → sourcecode-5.8.28}/scripts/perf_harness.py

@@ -131,7 +131,10 @@ def build_argv(command: str, repo_path: Path, cold: bool) -> list[str]:
         argv += shlex.split(command)
     if command == perf.CONTROL_COMMAND:
         argv += list(perf.STEADY_CONTROL_POSITIONAL_ARGS)
-    argv.append(str(repo_path))
+    # Keep the gate identity stable across runners. Windows' `str(Path("/tmp/repo"))`
+    # becomes `\\tmp\\repo`, while the same synthetic repository is published as
+    # `/tmp/repo` in the gate contract and in baseline keys.
+    argv.append(repo_path.as_posix())
     argv += ["--format", "json"]
     # C3-110: some commands need an argument to be measurable at all, and the one
     # authority for which is `perf`, not this script and not a workflow.

{sourcecode-5.8.27 → sourcecode-5.8.28}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.27"
+__version__ = "5.8.28"

sourcecode-5.8.28/src/sourcecode/__main__.py

@@ -0,0 +1,7 @@
+"""Module entry point used by detached workers and ``python -m sourcecode``."""
+
+from sourcecode.cli import main_entry
+
+
+if __name__ == "__main__":
+    main_entry()

{sourcecode-5.8.27 → sourcecode-5.8.28}/src/sourcecode/cache_model.py

@@ -830,7 +830,8 @@ def cost_sentence() -> str:
             f"({_gate_cell['cache_state']} cache, {_gate_cell['host_class']})."
         )
     return (
-        f"Cost tracks the command class and the build, not the file count: "
+        f"Historical field anchor only: cost tracks the command class and the build, "
+        f"not the file count: "
         f"per-symbol queries are the fast path, inventory commands scale with "
         f"files, and a repository-wide audit measured {seconds:g} s on a "
         f"{_thousands(FIELD_ANCHOR_JAVA_FILES)}-file repository "

{sourcecode-5.8.27 → sourcecode-5.8.28}/src/sourcecode/cli.py

@@ -14182,7 +14182,12 @@ def posture_cmd(
         _posture_limit = 1 if data.get("summary", {}).get("unresolved", 0) else 0
     bound_lists(
         data, POSTURE_BOUNDED_LISTS, _posture_limit,
-        monotone=(limit is None and compact),
+        # `--compact` is a size contract for agent output. The monotone
+        # optimisation may keep a list whole when its disclosure costs more
+        # than that individual cut, leaving a large diff above the ceiling.
+        # An explicit --limit remains a precise shape request; compact must
+        # actually remove every registered body.
+        monotone=False,
     )
 
     _emit_command_output(
@@ -16421,10 +16426,11 @@ def selftest_cmd(
 
         nested = nested_repository_count(target)
         if nested:
-            _notice(
+            typer.echo(
                 f"selftest is scanning {nested} nested Git repository(s) under the "
                 "implicit current-directory path; pass an explicit repository path "
-                "to scope the ledger run"
+                "to scope the ledger run",
+                err=True,
             )
     _enforce_format("selftest", format)
     selected = tuple(part.strip() for part in (rows or "").split(",") if part.strip())

{sourcecode-5.8.27 → sourcecode-5.8.28}/src/sourcecode/detach.py

@@ -156,12 +156,11 @@ def run_detached(args: "list[str]", *, root: Path) -> dict:
     """Start `args` (already free of the flag) detached; return the envelope."""
     stamp = f"{int(time.time())}-{os.getpid()}"
     log_path = logs_dir(root) / f"{stamp}.log"
-    # Invoke Python directly instead of re-entering an installed console
-    # launcher (ask.exe -> shim -> worker). The shorter process tree is what
-    # makes Windows job-object breakaway reliable under MSYS/Git Bash.
-    argv = [sys.executable, "-m", "sourcecode.cli", *args]
-    if sys.argv[0].endswith(".py"):
-        argv = [sys.executable, sys.argv[0], *args]
+    # Invoke the package's executable module instead of re-entering an
+    # installed console launcher (ask.exe -> shim -> worker). The shorter
+    # process tree is what makes Windows job-object breakaway reliable under
+    # MSYS/Git Bash, and __main__.py guarantees this actually runs the CLI.
+    argv = [sys.executable, "-m", "sourcecode", *args]
     pid, broke_away = _spawn(argv, log_path)
     return {
         "schema_version": SCHEMA_VERSION,

{sourcecode-5.8.27 → sourcecode-5.8.28}/src/sourcecode/security_config_scan.py

@@ -548,6 +548,23 @@ def _control_is_live_below(live_source: str, end: int, pattern: "re.Pattern") ->
     return bool(pattern.search(window[:stop]))
 
 
+def _is_commented_annotation_directive(text: str) -> bool:
+    """Distinguish a commented annotation from prose that mentions one."""
+    for line in text.splitlines():
+        candidate = line.strip()
+        if candidate.startswith("//"):
+            candidate = candidate[2:].lstrip()
+        elif candidate.startswith("/*"):
+            candidate = candidate[2:].lstrip("* ")
+        elif candidate.startswith("*"):
+            candidate = candidate[1:].lstrip()
+        else:
+            continue
+        if candidate.startswith("@"):
+            return True
+    return False
+
+
 def _scan_commented_controls(
     source: str,
     rel: str,
@@ -586,6 +603,12 @@ def _scan_commented_controls(
         for pattern, symbol, detail in rules:
             if not pattern.search(text):
                 continue
+            if (
+                not xml
+                and symbol == "commented_security_annotation"
+                and not _is_commented_annotation_directive(text)
+            ):
+                continue
             if not xml and _control_is_live_below(live_source or "", end, pattern):
                 continue
             line = _line_of(source, start)