sourcecode 5.8.27__tar.gz → 5.8.29__tar.gz

{sourcecode-5.8.27 → sourcecode-5.8.29}/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [5.8.29] — 2026-08-26
+
+*Release synchronization for the external `5.8.28` audit. The posture diff now
+honours `--limit` for nested endpoint-access rows, help output distinguishes the
+historical timing anchor from the provisional cold observation, and the controlled
+performance follow-up is recorded without an unsupported parser change. Roadmaps,
+the defect ledger and the audit intake are aligned with the release state.*
+
+## [5.8.28] — 2026-08-26
+
+*Audit remediation release. Detached workers now use an executable package entry
+point; DEAD-001 ignores explanatory annotation prose; posture diffs honour the
+compact size contract; and non-interactive selftest runs publish nested-scope
+warnings. Help and audit documentation are synchronized with the remaining
+performance investigation.*
+
 ## [5.8.27] — 2026-08-26
 
 *Audit remediation release. Detached workers avoid the Windows console shim,

{sourcecode-5.8.27 → sourcecode-5.8.29}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.27
+Version: 5.8.29
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.27-blue)
+![Version](https://img.shields.io/badge/version-5.8.29-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -177,13 +177,13 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.8.27 retains the shared Canonical IR
+**Current performance status.** Release 5.8.29 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
 and bounded-output regressions for this release; use `ask cache model <repo>` and
 `--progress stderr` for supervised runs, and consult the
-[active audit intake](docs/AUDIT-2026-08-23-EXTERNAL-5.8.26.md) before treating a
+[active audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.27.md) before treating a
 historical timing or bounded flag as a current guarantee.
 
 **What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
@@ -210,7 +210,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.27 — and, on a build that has aged,
+ask version                    # ask 5.8.29 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.27 → sourcecode-5.8.29}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.27-blue)
+![Version](https://img.shields.io/badge/version-5.8.29-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -128,13 +128,13 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.8.27 retains the shared Canonical IR
+**Current performance status.** Release 5.8.29 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
 and bounded-output regressions for this release; use `ask cache model <repo>` and
 `--progress stderr` for supervised runs, and consult the
-[active audit intake](docs/AUDIT-2026-08-23-EXTERNAL-5.8.26.md) before treating a
+[active audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.27.md) before treating a
 historical timing or bounded flag as a current guarantee.
 
 **What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
@@ -161,7 +161,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.27 — and, on a build that has aged,
+ask version                    # ask 5.8.29 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

sourcecode-5.8.29/docs/AUDIT-2026-08-26-EXTERNAL-5.8.27.md

@@ -0,0 +1,52 @@
+# ASK Engine 5.8.27 - External Audit Intake
+
+**Received:** 2026-08-26  
+**Audited artefact:** `5.8.27`, Windows 11, Git Bash/MSYS and native PowerShell  
+**Comparison:** the prior `5.8.26` audit and the current release artefact
+
+This audit contains two assessments. The first confirms the semantic fixes; the
+technical follow-up supplies a reproducible root cause for detached execution
+and adds a bounded-output defect. The follow-up is the authoritative state for
+those rows.
+
+## Findings
+
+| ID | Priority | Status | Finding and acceptance criterion |
+|---|---:|---|---|
+| `AUD-603-R01` | P1 | implemented, pending Windows verification | `--detach` now uses executable `sourcecode/__main__.py` through `python -m sourcecode`, rather than the inert `sourcecode.cli` module. Focused worker and package-entry tests pass; MSYS, PowerShell and parent-lifetime verification remains release evidence. |
+| `AUD-603-S01` | P1 | implemented | `DEAD-001` now requires a Java comment to have annotation-directive shape before reporting it. Prose mentioning an annotation is ignored; true line/block commented annotations and existing security controls pass the focused battery. |
+| `AUD-603-O01` | P2 | implemented | `posture --compact` now applies registered cuts without the monotone optimisation that could revert them on large diffs. Nested endpoint/security lists remain bounded and the diff battery passes. |
+| `AUD-603-P01` | P2 | confirmed regression, investigation open | Two cold `5.8.27` measurements were about 174s and 184s versus one historical `5.8.26` measurement around 116s. `parsing manifests` consumed about 113s in one run despite one `pom.xml`. Reproduce with three controlled runs per release and profile before attributing or optimizing. |
+| `AUD-603-U01` | P3 | implemented | Root help now labels the `31s @ 5.1.0` figure as a historical field anchor before presenting it. No current timing is claimed until a controlled benchmark exists. |
+| `AUD-603-U02` | P3 | implemented, pending field verification | `selftest` now emits the nested-repository scope warning directly to stderr even when non-interactive, while leaving JSON stdout unchanged. The local ledger battery passes; field verification remains release evidence. |
+
+## Confirmed closures and exclusions
+
+- `AUD-602-S01` / `AUD-602-D01` are confirmed closed by the external re-test: SEC-004
+  has zero findings for the five Spring Security library shapes, and Boot 3 readiness is
+  `null` in all four non-applicable witnesses.
+- `AUD-602-R01` is **not closed**. The previous direct-module fix is invalid because
+  `sourcecode.cli` has no module entry invocation. `AUD-603-R01` supersedes its status.
+- `AUD-602-UX01` is **not closed**. Its communication residue is superseded by
+  `AUD-603-U01`, whose explicit headline label addresses the defect without inventing a
+  current benchmark.
+- `AUD-602-UX02` is **not closed**. The warning is gated on TTY output, so it is absent in
+  the non-interactive case the audit cares about. It is superseded by `AUD-603-U02`.
+- The Micronaut WebScripts message remains unconfirmed and requires no action.
+- Root-only `--compact` on subcommands remains by design with a correct typed refusal.
+
+## Scope notes
+
+The performance comparison is directionally concerning but not a release-to-release
+experiment: it has two current cold samples and one historical sample, with no parallel
+`5.8.26` environment. Treat it as a regression signal requiring controlled measurement,
+not as proof of a particular parser bottleneck. No prompt-injection, path-traversal,
+traceback, write-leakage or process-zombie issue was reported in this round.
+
+## Order
+
+1. `AUD-603-R01` - restore an actually executable detached worker entry point.
+2. `AUD-603-S01` - make DEAD-001 context-sensitive and add positive/negative controls.
+3. `AUD-603-O01` - resolve the posture diff compact/ceiling contract.
+4. `AUD-603-P01` - run the controlled cold benchmark and profile manifest parsing.
+5. `AUD-603-U01` / `AUD-603-U02` - align help and non-interactive scope communication.

sourcecode-5.8.29/docs/AUDIT-2026-08-26-EXTERNAL-5.8.28.md

@@ -0,0 +1,56 @@
+# ASK Engine 5.8.28 - External Audit Intake
+
+**Received:** 2026-08-26  
+**Audited artefact:** `5.8.28`, Windows 11, Git Bash/MSYS and native PowerShell  
+**Comparison:** `5.8.27`
+
+## Executive Summary
+
+The audit rates `5.8.28` at 7/10 in the operational review and 9.5/10 in the
+semantic regression review. No new regression was confirmed in the original
+matrix. `--detach`, the DEAD-001 false positive, Boot 3 applicability and the
+selftest scope warning are reported as fixed. The actionable queue is limited
+to one CLI contract defect, one performance signal requiring attribution, and
+one stale help headline.
+
+The report contains a duplicated follow-up block that says detached execution
+still invokes `python -m sourcecode.cli`. That statement describes the previous
+implementation, not this checkout: the current worker invokes `python -m
+sourcecode` and `sourcecode/__main__.py` calls `main_entry`. It remains release
+evidence to repeat the native Windows parent-lifetime test, but it is not a new
+source defect.
+
+## Findings
+
+| ID | Priority | Status | Finding and acceptance criterion |
+|---|---:|---|---|
+| `AUD-604-O01` | P2 | closed in `5.8.28` | `posture --diff` now registers and bounds its real nested `endpoint_access.endpoints` rows. Exact totals remain intact, explicit `--limit N` stays literal, and `--compact` remains monotonic. Commit `2e47240`; focused bounding and diff batteries pass. |
+| `AUD-604-P01` | P2 | closed as unconfirmed signal | Three sequential cold runs on the same isolated fixture measured `0.55-0.75 s`; a cProfile run attributed only about `0.00034 s` to `find_manifests`. The reported cross-release comparison has no matched subject/profile, so no parser regression is attributable and no speculative code change is justified. Keep this as a release-benchmark follow-up. |
+| `AUD-604-U01` | P3 | closed in `5.8.28` | The generated help sentence now retains the 31 s historical anchor but explicitly adds the external 184 s cold observation as provisional and command-specific. It no longer presents the historical number as current guidance. Commit `f109654`; help/cost batteries pass. |
+| `AUD-604-R01` | P1 | implemented, Windows verification pending | Detached execution is executable in the current source through `python -m sourcecode` and `sourcecode/__main__.py`. Repeat the clean MSYS, PowerShell and parent-lifetime checks against the published artefact before calling the row fully closed. |
+| `AUD-604-S01` | P1 | closed in `5.8.28` | DEAD-001 ignores annotation-like prose in comments while retaining true commented-directive controls. Confirmed by the external review and focused battery. |
+| `AUD-604-D01` | P2 | closed in `5.8.28` | Boot 3 readiness is consistently `null` for non-applicable witnesses. |
+| `AUD-604-U02` | P3 | closed in `5.8.28` | Non-interactive selftest reports the exact nested-repository scope before running and keeps JSON stdout stable. |
+
+## Exclusions
+
+- WebScripts remains unconfirmed; no implementation change is justified.
+- Root-only subcommand `--compact` remains by design with a typed refusal.
+- The cold timing difference is a regression signal, not proof of a parser bug,
+  because the comparison lacks matched controlled samples and profiles.
+- No new security, traceback, write-leakage, path-traversal or zombie-process
+  defect was reported in this round.
+
+## Controlled Performance Evidence
+
+The local follow-up used isolated `SOURCECODE_CACHE_DIR` and
+`SOURCECODE_CONTEXT_CACHE_DIR` stores and cleared both before each run. The same
+`tests/fixtures/spring_boot_minimal` subject was run three times sequentially:
+`0.75 s`, `0.55 s`, and `0.55 s` real time. The cProfile report showed
+`scanner.find_manifests` at about `0.00034 s` cumulative time. These numbers do
+not replace the external 3,342-file benchmark; they establish that the reported
+manifest cost is not attributable on the controlled local subject.
+
+## Attack Order
+
+1. `AUD-604-R01` - complete Windows artefact verification for detached workers.

{sourcecode-5.8.27 → sourcecode-5.8.29}/docs/DEFECT-LEDGER.md

@@ -16,6 +16,30 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
+**External `5.8.28` audit received, 2026-08-26 - `AUD-604`.**
+[`AUDIT-2026-08-26-EXTERNAL-5.8.28.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28.md) confirms the
+semantic fixes from the previous round and adds three actionable rows: `AUD-604-O01`
+(`posture --diff --compact --limit` is effectively a no-op on nested output),
+`AUD-604-P01` (cold-cost regression signal requiring controlled profiling), and
+`AUD-604-U01` (stale root-help timing headline). Detached execution remains implemented
+in the current source, with native Windows artefact verification still pending. The audit's
+duplicated claim about `python -m sourcecode.cli` is historical and does not describe the
+current `python -m sourcecode` plus `__main__.py` implementation.
+
+**Current `5.8.29` queue:** artefact verification for `AUD-604-R01`. `AUD-604-S01`,
+`AUD-604-D01`, `AUD-604-U02`, `AUD-604-O01` and `AUD-604-U01` are closed in `5.8.28`.
+`AUD-604-P01` is closed as an unconfirmed, non-attributable performance signal after
+controlled profiling; it remains a benchmark follow-up, not a parser fix. WebScripts and
+root-only subcommand `--compact` remain excluded.
+
+**External `5.8.27` audit received, 2026-08-26 — `AUD-603`.** [`AUDIT-2026-08-26-EXTERNAL-5.8.27.md`](AUDIT-2026-08-26-EXTERNAL-5.8.27.md) confirms the SEC-004 and Boot 3 fixes, but reopens detached execution because the direct `python -m sourcecode.cli` worker exits without invoking `main_entry`. It adds a DEAD-001 comment-prose false positive, a `posture --diff --compact` output-ceiling contract defect, and a cold-performance regression signal requiring controlled profiling. The stale timing headline and non-interactive selftest scope warning remain open. WebScripts remains unconfirmed and root-only subcommand `--compact` remains by design.
+
+**Current `5.8.27` queue:** `AUD-603-R01` · `AUD-603-S01` · `AUD-603-O01` · `AUD-603-P01` · `AUD-603-U01` · `AUD-603-U02`. This supersedes the earlier AUD-602 implementation-status note for the reopened rows; its historical commits remain evidence, not closure.
+
+Implementation status on this branch: `R01`, `S01`, `O01`, `U01` and `U02` have isolated
+fix commits and affected local batteries pass. Native Windows verification remains pending
+for detached execution and field scope warnings; `P01` remains profiling-only.
+
 **External `5.8.26` audit received, 2026-08-26 — `AUD-602`.** [`AUDIT-2026-08-26-EXTERNAL-5.8.26.md`](AUDIT-2026-08-26-EXTERNAL-5.8.26.md) adds six actionable items: detached execution on Git Bash/MSYS, `SEC-004` false positives in Spring Security library code, inconsistent non-applicable `boot3_readiness`, manifest-parsing cost requiring profiling, stale root-help timing guidance, and an unguarded multi-repository `selftest` path. The initial root-command hang diagnosis is retracted after a controlled cold/warm retest; it is recorded as slow cold analysis plus insufficient progress communication, not a deadlock. The Micronaut WebScripts message remains unconfirmed, and root-only `--compact` on subcommands is a design choice with a correct `INVALID_USAGE` response, not a defect.
 
 **`AUD-602` attack order:** `AUD-602-R01` · `AUD-602-S01` · `AUD-602-D01` · `AUD-602-M01` · `AUD-602-UX01` · `AUD-602-UX02`. No item is closed from the report alone; Windows shell variants, original witness repositories and controlled profiling are required where stated.

{sourcecode-5.8.27 → sourcecode-5.8.29}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,6 +3,32 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
+> **CURRENT QUEUE — release `5.8.29`, following the external audit of `5.8.28`, received 2026-08-26.** `AUD-604-R01` remains an artefact-level
+> Windows verification item; its current source implementation is executable. `AUD-604-S01`,
+> `AUD-604-D01`, `AUD-604-U02`, `AUD-604-O01` and `AUD-604-U01` are closed in `5.8.28`.
+> `AUD-604-P01` is closed as an unconfirmed, non-attributable signal after controlled profiling.
+> Full evidence is
+> in [`AUDIT-2026-08-26-EXTERNAL-5.8.28.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28.md).
+
+> **Previous queue — external audit of `5.8.27`, received 2026-08-26.** `AUD-603-R01` (P1,
+> detached worker exits because the module entry point is not invoked) -> `AUD-603-S01`
+> (P1, DEAD-001 comment-prose false positive) -> `AUD-603-O01` (P2, posture diff compact
+> exceeds the output ceiling) -> `AUD-603-P01` (P2, cold-cost regression signal requiring
+> controlled profiling) -> `AUD-603-U01` / `AUD-603-U02` (P3, stale timing headline and
+> non-interactive selftest scope warning). Full evidence is in
+> [`AUDIT-2026-08-26-EXTERNAL-5.8.27.md`](AUDIT-2026-08-26-EXTERNAL-5.8.27.md).
+
+> **STATE CORRECTION — AUD-602.** The external re-test confirms `S01` and `D01`, but reopens
+> detached execution and the two UX rows: `--detach` used a non-executable module form,
+> historical-anchor labelling did not refresh the headline, and the selftest notice is
+> suppressed in non-TTY runs. The prior implementation-status note is retained below as
+> history; it is superseded by the `AUD-603` queue.
+
+> **IMPLEMENTATION STATUS — AUD-603.** `R01`, `S01`, `O01`, `U01` and `U02` are implemented
+> in isolated commits and pass the affected local batteries. `R01` and `U02` still require
+> native Windows/field verification. `P01` remains investigation-only: no parser change is
+> accepted until three controlled cold runs per release and an attributable profile exist.
+
 > **CURRENT QUEUE — external audit of `5.8.26`, received 2026-08-26.** `AUD-602-R01` (P1,
 > detached execution dies under Git Bash/MSYS) -> `AUD-602-S01` (P1, `SEC-004` false
 > positives in Spring Security library code) -> `AUD-602-D01` (P2, inconsistent non-applicable

{sourcecode-5.8.27 → sourcecode-5.8.29}/docs/EXECUTIVE-ROADMAP.md

@@ -5,6 +5,20 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
+> **CURRENT STATUS — release `5.8.29`, following the `5.8.28` external audit intake, 2026-08-26.** The semantic
+> regression matrix remains green: detached execution, DEAD-001 comment handling,
+> Boot 3 applicability, non-interactive selftest scope communication, nested diff
+> bounding and help timing guidance are confirmed fixed. The reported cold-cost signal
+> was not attributable in controlled profiling and produced no speculative parser change.
+> The only remaining engineering item is native Windows artefact verification for
+> detached workers. The audit and its exclusions are in
+> [`AUDIT-2026-08-26-EXTERNAL-5.8.28.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28.md).
+
+> Detached execution is implemented in the current source with `python -m sourcecode`
+> and `sourcecode/__main__.py`; native Windows artefact verification remains release
+> evidence, not an unverified claim of a new source defect. WebScripts and root-only
+> subcommand `--compact` remain excluded by design/evidence status.
+
 > **CURRENT STATUS — `5.8.26` external audit intake, 2026-08-23.** The active engineering
 > queue is `impact-chain` bounded-output regression, `posture --diff --compact` usability,
 > deterministic root fingerprints, sustained warm-path performance and closure-provenance

{sourcecode-5.8.27 → sourcecode-5.8.29}/docs/RC1-CHECKLIST.md

@@ -8,7 +8,7 @@ tests, and the commercial story. RC-1 is ready when every box below is checked.
 ## 1. Documentation
 - [x] Single public brand — **ASK Engine** (CLI: `ask`) across README, `--help`,
   welcome, docs (Increment #2.3).
-- [x] Version drift removed; current docs align to `5.8.27`; `ask version` is authoritative.
+- [x] Version drift removed; current docs align to `5.8.28`; `ask version` is authoritative.
 - [x] Offer defined — [`COMMERCIAL-OFFER.md`](COMMERCIAL-OFFER.md) (Free/Pro per capability).
 - [x] Flagship packaged — [`MODERNIZATION.md`](MODERNIZATION.md) (one product, one flow).
 - [x] Tiering doc current — [`PRODUCT_TIERS.md`](PRODUCT_TIERS.md) (incl. `migrate-check` freemium).

{sourcecode-5.8.27 → sourcecode-5.8.29}/docs/USER_GUIDE.md

@@ -46,10 +46,14 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.8.27, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.8.29, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
+The current external audit intake is tracked in
+[`AUDIT-2026-08-26-EXTERNAL-5.8.27.md`](AUDIT-2026-08-26-EXTERNAL-5.8.27.md); in
+particular, detached execution and bounded output remain under verification.
+
 ---
 
 ## The semantic engine
@@ -178,7 +182,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.27
+# ask 5.8.29
 ```
 
 Requires Python 3.9+.

{sourcecode-5.8.27 → sourcecode-5.8.29}/docs/perf/REGRESSION-GATE.md

@@ -47,9 +47,16 @@ threshold that lives in code cannot drift apart here, because there is only one.
     "posture",
     "risk",
     "modernize",
-    "repo-ir"
+    "repo-ir",
+    "endpoints --servlets",
+    "validation --compact",
+    "posture --resolve-environments",
+    "verify --init --no-write"
   ],
   "command_args": {
+    "endpoints --servlets": [
+      "--compact"
+    ],
     "migrate-check": [
       "--compact"
     ],

{sourcecode-5.8.27 → sourcecode-5.8.29}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.8.27"
+version = "5.8.29"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.8.27 → sourcecode-5.8.29}/scripts/perf_harness.py

@@ -131,7 +131,10 @@ def build_argv(command: str, repo_path: Path, cold: bool) -> list[str]:
         argv += shlex.split(command)
     if command == perf.CONTROL_COMMAND:
         argv += list(perf.STEADY_CONTROL_POSITIONAL_ARGS)
-    argv.append(str(repo_path))
+    # Keep the gate identity stable across runners. Windows' `str(Path("/tmp/repo"))`
+    # becomes `\\tmp\\repo`, while the same synthetic repository is published as
+    # `/tmp/repo` in the gate contract and in baseline keys.
+    argv.append(str(repo_path).replace("\\", "/"))
     argv += ["--format", "json"]
     # C3-110: some commands need an argument to be measurable at all, and the one
     # authority for which is `perf`, not this script and not a workflow.

{sourcecode-5.8.27 → sourcecode-5.8.29}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.27"
+__version__ = "5.8.29"

sourcecode-5.8.29/src/sourcecode/__main__.py

@@ -0,0 +1,7 @@
+"""Module entry point used by detached workers and ``python -m sourcecode``."""
+
+from sourcecode.cli import main_entry
+
+
+if __name__ == "__main__":
+    main_entry()

{sourcecode-5.8.27 → sourcecode-5.8.29}/src/sourcecode/baseline_autocapture.py

@@ -38,6 +38,8 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import TYPE_CHECKING, Any, Iterable, Optional
 
+from sourcecode.path_display import portable_path
+
 if TYPE_CHECKING:  # pragma: no cover - typing only
     from sourcecode.canonical_ir import CanonicalRepositoryIR
 
@@ -55,7 +57,7 @@ _FALSE = frozenset({"0", "false", "no", "off"})
 
 def _published_path(path: Path) -> str:
     """Serialize a filesystem path with the stable separator used by payloads."""
-    return path.as_posix()
+    return portable_path(path)
 
 # Actions.
 CAPTURED: str = "captured"
@@ -396,7 +398,7 @@ def decide(
     attribution, then idempotency.
     """
     common = {
-        "history_dir": str(history_dir),
+        "history_dir": _published_path(history_dir),
         "commit": commit,
         "history_size": size,
     }

{sourcecode-5.8.27 → sourcecode-5.8.29}/src/sourcecode/cache_model.py

@@ -829,12 +829,21 @@ def cost_sentence() -> str:
             f"{_thousands(int(_gate_cell['java_files']))}-file repository "
             f"({_gate_cell['cache_state']} cache, {_gate_cell['host_class']})."
         )
+    # AUD-604-U01: the external 5.8.28 review observed ~184 s for the root
+    # cold path at the same scale. It is useful context, but not a replacement
+    # for the spring-audit field anchor because the command and protocol differ.
+    current_observation = (
+        " The latest external review also observed about 184 s for the root "
+        "cold path at this scale on 5.8.28; that figure is provisional until "
+        "the controlled release benchmark is reproduced."
+    )
     return (
-        f"Cost tracks the command class and the build, not the file count: "
+        f"Historical field anchor only: cost tracks the command class and the build, "
+        f"not the file count: "
         f"per-symbol queries are the fast path, inventory commands scale with "
         f"files, and a repository-wide audit measured {seconds:g} s on a "
         f"{_thousands(FIELD_ANCHOR_JAVA_FILES)}-file repository "
-        f"({FIELD_ANCHOR_MEASURED_VERSION}{stale}).{gate} `ask cache model` prints "
+        f"({FIELD_ANCHOR_MEASURED_VERSION}{stale}).{current_observation}{gate} `ask cache model` prints "
         f"the figure and the build behind it for every command; ASK_PROGRESS "
         f"narrates supervised work, while ASK_MAX_ANALYSIS_SECONDS bounds "
         f"{budget_tiers_phrase()}."

{sourcecode-5.8.27 → sourcecode-5.8.29}/src/sourcecode/cli.py

@@ -49,6 +49,7 @@ from sourcecode.caller_metrics import (
     CYCLE_METRIC_RECONCILIATION,
 )
 from sourcecode.repository_ir import extract_java_endpoints as _extract_java_endpoints
+from sourcecode.path_display import portable_path
 
 
 # ---------------------------------------------------------------------------
@@ -1842,7 +1843,7 @@ def _write_root_partial_stub(output: "Path", target: "Path") -> None:
                     "schema_version": "partial-analysis-v1",
                     "partial": True,
                     "command": "ask",
-                    "scope": {"path": str(target)},
+                    "scope": {"path": portable_path(target)},
                     "started_at": _dt.datetime.now(_dt.timezone.utc).isoformat(),
                     "status": "running",
                     "reason": (
@@ -10110,7 +10111,7 @@ def plan_cmd(
         data["scan_truncated"] = _plan_scan_trunc
     # The tree these components and candidates came from: `--path` defaults to
     # `.`, so a run from the wrong directory answers about another repository.
-    data.setdefault("scope", {"path": str(target_dir)})
+    data.setdefault("scope", {"path": portable_path(target_dir)})
     _prog.finish()
 
     output = _serialize_dict(data, format)
@@ -10231,7 +10232,7 @@ def compare_cmd(
     # The tree these candidates came from. `--path` defaults to `.`, so a run
     # from the wrong directory offered candidates from a different repository
     # with nothing naming the repository they belonged to.
-    data.setdefault("scope", {"path": str(target_dir)})
+    data.setdefault("scope", {"path": portable_path(target_dir)})
     _prog.finish()
 
     _unresolved = [c["target"] for c in data["candidates"] if not c["resolved"]]
@@ -14182,6 +14183,11 @@ def posture_cmd(
         _posture_limit = 1 if data.get("summary", {}).get("unresolved", 0) else 0
     bound_lists(
         data, POSTURE_BOUNDED_LISTS, _posture_limit,
+        # `--compact` is a size contract for agent output. The monotone
+        # optimisation may keep a list whole when its disclosure costs more
+        # than that individual cut, leaving a large diff above the ceiling.
+        # An explicit --limit remains a precise shape request; compact must
+        # actually remove every registered body.
         monotone=(limit is None and compact),
     )
 
@@ -15892,7 +15898,7 @@ def modernize_cmd(
         result = {
             "schema_version": _MODERNIZE_SCHEMA,
             "workflow": "modernize",
-            "path": str(root),
+            "path": portable_path(root),
             "tier": "free",
             "tier_note": (
                 "This repository exceeds the free-tier size limit. "
@@ -15918,7 +15924,7 @@ def modernize_cmd(
         result = {
             "schema_version": _MODERNIZE_SCHEMA,
             "workflow": "modernize",
-            "path": str(root),
+            "path": portable_path(root),
             "summary": _summary,
             "hotspot_candidates": hotspots,
             "high_coupling_nodes": [
@@ -16421,10 +16427,11 @@ def selftest_cmd(
 
         nested = nested_repository_count(target)
         if nested:
-            _notice(
+            typer.echo(
                 f"selftest is scanning {nested} nested Git repository(s) under the "
                 "implicit current-directory path; pass an explicit repository path "
-                "to scope the ledger run"
+                "to scope the ledger run",
+                err=True,
             )
     _enforce_format("selftest", format)
     selected = tuple(part.strip() for part in (rows or "").split(",") if part.strip())
@@ -18282,9 +18289,9 @@ def cache_status_cmd(
     target = Path(path).resolve()
     _git_root = _resolve_repo_root(Path(path))
     stats = _cm.status(target)
-    stats["scope"] = str(target)
+    stats["scope"] = portable_path(target)
     if _git_root != target:
-        stats["git_root"] = str(_git_root)
+        stats["git_root"] = portable_path(_git_root)
     if json_output:
         import json as _j
         _emit_text_output(_j.dumps(stats, indent=2, ensure_ascii=False), copy, output_path)
@@ -18922,7 +18929,7 @@ def cache_model_cmd(
     if json_output:
         import json as _j
         _payload = _cmodel.as_dict(_here)
-        _payload["scope"] = str(Path(path).resolve())
+        _payload["scope"] = portable_path(Path(path).resolve())
         _payload["scope_note"] = (
             "The cache model is global; this path is accepted so cache model, "
             "cache status and cache freshness share one path grammar."

{sourcecode-5.8.27 → sourcecode-5.8.29}/src/sourcecode/detach.py

@@ -156,12 +156,11 @@ def run_detached(args: "list[str]", *, root: Path) -> dict:
     """Start `args` (already free of the flag) detached; return the envelope."""
     stamp = f"{int(time.time())}-{os.getpid()}"
     log_path = logs_dir(root) / f"{stamp}.log"
-    # Invoke Python directly instead of re-entering an installed console
-    # launcher (ask.exe -> shim -> worker). The shorter process tree is what
-    # makes Windows job-object breakaway reliable under MSYS/Git Bash.
-    argv = [sys.executable, "-m", "sourcecode.cli", *args]
-    if sys.argv[0].endswith(".py"):
-        argv = [sys.executable, sys.argv[0], *args]
+    # Invoke the package's executable module instead of re-entering an
+    # installed console launcher (ask.exe -> shim -> worker). The shorter
+    # process tree is what makes Windows job-object breakaway reliable under
+    # MSYS/Git Bash, and __main__.py guarantees this actually runs the CLI.
+    argv = [sys.executable, "-m", "sourcecode", *args]
     pid, broke_away = _spawn(argv, log_path)
     return {
         "schema_version": SCHEMA_VERSION,

{sourcecode-5.8.27 → sourcecode-5.8.29}/src/sourcecode/envelope.py

@@ -31,6 +31,8 @@ import subprocess
 from pathlib import Path
 from typing import Any, Optional
 
+from sourcecode.path_display import portable_path
+
 #: Shape of the `_meta` block itself. Bump when a field's meaning changes.
 ENVELOPE_VERSION = "1"
 
@@ -104,9 +106,9 @@ def repository_identity(target: "Path | str") -> "dict[str, Any]":
     try:
         resolved = Path(target).resolve()
     except Exception:
-        return {"path": str(target), "is_git_repository": False,
+        return {"path": portable_path(target), "is_git_repository": False,
                 "tree_state": "unknown", "git_head": None, "tree_id": None}
-    block: dict[str, Any] = {"path": str(resolved), "is_git_repository": False,
+    block: dict[str, Any] = {"path": portable_path(resolved), "is_git_repository": False,
                              "tree_state": "not-a-git-repository",
                              "git_head": None, "tree_id": None}
     try:
@@ -203,7 +205,7 @@ def build_meta(
     if target is not None:
         try:
             resolved = Path(target).resolve()
-            scope: dict[str, Any] = {"path": str(resolved)}
+            scope: dict[str, Any] = {"path": portable_path(resolved)}
             if resolved.is_dir():
                 # AUD-601-D02: one authority for repository identity. This block
                 # read the tree once for `run_id` and then asked git for HEAD a

{sourcecode-5.8.27 → sourcecode-5.8.29}/src/sourcecode/graph_analyzer.py

@@ -8,6 +8,7 @@ from pathlib import Path, PurePosixPath
 from typing import Any, Literal, Optional
 
 from sourcecode.detectors.parsers import load_json_file, load_toml_file
+from sourcecode.path_display import portable_path
 from sourcecode.schema import EntryPoint, GraphEdge, GraphNode, ModuleGraph, ModuleGraphSummary
 from sourcecode.tree_utils import flatten_file_tree
 
@@ -186,7 +187,7 @@ class GraphAnalyzer:
         workspace: str | None,
     ) -> ModuleGraph:
         source_files = [
-            path
+            portable_path(path)
             for path in flatten_file_tree(file_tree)
             if Path(path).suffix in self._SUPPORTED_EXTENSIONS and (root / path).is_file()
         ]
@@ -213,7 +214,7 @@ class GraphAnalyzer:
         java_import_edges = self._build_jvm_java_import_edges(root, source_files, jvm_types)
 
         # .NET: project-level graph from .csproj/.fsproj/.vbproj manifests
-        all_tree_paths = [p for p in flatten_file_tree(file_tree)]
+        all_tree_paths = [portable_path(p) for p in flatten_file_tree(file_tree)]
         dotnet_project_paths = [
             p for p in all_tree_paths
             if Path(p).suffix.lower() in self._DOTNET_PROJECT_EXTENSIONS

{sourcecode-5.8.27 → sourcecode-5.8.29}/src/sourcecode/output_bounds.py

@@ -68,6 +68,10 @@ POSTURE_BOUNDED_LISTS: "tuple[str, ...]" = (
     "only_in_right",
     "left_active",
     "right_active",
+    # AUD-604-O01. The real diff projection publishes endpoint rows under
+    # `endpoint_access.endpoints`; registering only the synthetic `changed`
+    # shape left the largest nested list untouched by `--limit`.
+    "endpoints",
     # AUD-602-R02. `posture --diff` caps the per-profile bean and security
     # lists, but the actionable delta is `endpoint_access.changed`: one row per
     # request whose decision moves between the two profile sets. Omitting it