sourcecode 5.8.28__tar.gz → 5.8.30__tar.gz

{sourcecode-5.8.28 → sourcecode-5.8.30}/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [5.8.30] — 2026-08-26
+
+*Pack audit remediation release. Unresolved test-only Java files no longer broaden
+`pack gate` endpoint uncertainty, and foreground `pack assessment` now reports
+component progress through the stderr-only heartbeat contract. Documentation and
+release evidence are synchronized with the AUD-605 fixes.*
+
+## [5.8.29] — 2026-08-26
+
+*Release synchronization for the external `5.8.28` audit. The posture diff now
+honours `--limit` for nested endpoint-access rows, help output distinguishes the
+historical timing anchor from the provisional cold observation, and the controlled
+performance follow-up is recorded without an unsupported parser change. Roadmaps,
+the defect ledger and the audit intake are aligned with the release state.*
+
 ## [5.8.28] — 2026-08-26
 
 *Audit remediation release. Detached workers now use an executable package entry

{sourcecode-5.8.28 → sourcecode-5.8.30}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.28
+Version: 5.8.30
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.28-blue)
+![Version](https://img.shields.io/badge/version-5.8.30-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -177,14 +177,14 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.8.28 retains the shared Canonical IR
+**Current performance status.** Release 5.8.30 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
 and bounded-output regressions for this release; use `ask cache model <repo>` and
 `--progress stderr` for supervised runs, and consult the
-[active audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.27.md) before treating a
-historical timing or bounded flag as a current guarantee.
+[active pack audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md) before
+treating a historical timing or bounded flag as a current guarantee.
 
 **What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
@@ -210,7 +210,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.28 — and, on a build that has aged,
+ask version                    # ask 5.8.30 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.28 → sourcecode-5.8.30}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.28-blue)
+![Version](https://img.shields.io/badge/version-5.8.30-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -128,14 +128,14 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.8.28 retains the shared Canonical IR
+**Current performance status.** Release 5.8.30 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
 and bounded-output regressions for this release; use `ask cache model <repo>` and
 `--progress stderr` for supervised runs, and consult the
-[active audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.27.md) before treating a
-historical timing or bounded flag as a current guarantee.
+[active pack audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md) before
+treating a historical timing or bounded flag as a current guarantee.
 
 **What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
@@ -161,7 +161,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.28 — and, on a build that has aged,
+ask version                    # ask 5.8.30 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

sourcecode-5.8.30/docs/AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md

@@ -0,0 +1,35 @@
+# ASK Engine 5.8.28 - External Pack Audit Intake
+
+**Received:** 2026-08-26  
+**Audited surface:** `pack list`, `pack assessment` and `pack gate` on
+`spring-petclinic`  
+**Related release:** `5.8.28` (remediation release: `5.8.30`)
+
+## Findings
+
+| ID | Priority | Status | Finding and acceptance criterion |
+|---|---:|---|---|
+| `AUD-605-G01` | P2 | implemented in current checkout | `pack gate --since HEAD~3` marked unrelated endpoints `unknown` when a changed Java test file contributed no CIR symbols. Unresolved test files remain evidence, while only unresolved production files can broaden endpoint uncertainty. Regression coverage is in `tests/test_pr_impact.py`; release-artifact verification remains pending. |
+| `AUD-605-U01` | P2 | implemented in current checkout | Foreground `pack assessment` emitted no `ASK_PROGRESS` heartbeat for more than five minutes while its subprocess components ran. The parent now reports components `1/6` through `6/6` through the existing stderr-only progress contract, preserving JSON stdout and component attribution. Regression coverage is in `tests/test_packs.py`; release-artifact verification remains pending. |
+
+## Existing Signal, Not A New Row
+
+`pack gate --since` took about 49 s, with posture accounting for about 44 s.
+This is additional evidence for `AUD-604-P01` / the controlled cold-cost follow-up,
+not a separate regression: the audit did not provide a matched release benchmark
+or an attributable profile. Pack list, assessment's verdict composition and
+`no_contracts_declared` handling were otherwise correct.
+
+The SARIF repository URL observation was verified as a false positive. No new
+security, traceback, write-leakage or process-zombie defect was found.
+
+## Order
+
+1. `AUD-605-G01` - narrow unresolved-file uncertainty to its actual production reach.
+2. `AUD-605-U01` - forward coarse progress from pack components.
+
+## Remediation Evidence
+
+- `52bcc36` - `fix(pr-impact): ignore test-only unresolved files`
+- `f89ae18` - `fix(pack): report assessment component progress`
+- Focused batteries: 49 impact/disposition tests and 49 pack/heartbeat/stderr tests passed.

sourcecode-5.8.30/docs/AUDIT-2026-08-26-EXTERNAL-5.8.28.md

@@ -0,0 +1,56 @@
+# ASK Engine 5.8.28 - External Audit Intake
+
+**Received:** 2026-08-26  
+**Audited artefact:** `5.8.28`, Windows 11, Git Bash/MSYS and native PowerShell  
+**Comparison:** `5.8.27`
+
+## Executive Summary
+
+The audit rates `5.8.28` at 7/10 in the operational review and 9.5/10 in the
+semantic regression review. No new regression was confirmed in the original
+matrix. `--detach`, the DEAD-001 false positive, Boot 3 applicability and the
+selftest scope warning are reported as fixed. The actionable queue is limited
+to one CLI contract defect, one performance signal requiring attribution, and
+one stale help headline.
+
+The report contains a duplicated follow-up block that says detached execution
+still invokes `python -m sourcecode.cli`. That statement describes the previous
+implementation, not this checkout: the current worker invokes `python -m
+sourcecode` and `sourcecode/__main__.py` calls `main_entry`. It remains release
+evidence to repeat the native Windows parent-lifetime test, but it is not a new
+source defect.
+
+## Findings
+
+| ID | Priority | Status | Finding and acceptance criterion |
+|---|---:|---|---|
+| `AUD-604-O01` | P2 | closed in `5.8.28` | `posture --diff` now registers and bounds its real nested `endpoint_access.endpoints` rows. Exact totals remain intact, explicit `--limit N` stays literal, and `--compact` remains monotonic. Commit `2e47240`; focused bounding and diff batteries pass. |
+| `AUD-604-P01` | P2 | closed as unconfirmed signal | Three sequential cold runs on the same isolated fixture measured `0.55-0.75 s`; a cProfile run attributed only about `0.00034 s` to `find_manifests`. The reported cross-release comparison has no matched subject/profile, so no parser regression is attributable and no speculative code change is justified. Keep this as a release-benchmark follow-up. |
+| `AUD-604-U01` | P3 | closed in `5.8.28` | The generated help sentence now retains the 31 s historical anchor but explicitly adds the external 184 s cold observation as provisional and command-specific. It no longer presents the historical number as current guidance. Commit `f109654`; help/cost batteries pass. |
+| `AUD-604-R01` | P1 | implemented, Windows verification pending | Detached execution is executable in the current source through `python -m sourcecode` and `sourcecode/__main__.py`. Repeat the clean MSYS, PowerShell and parent-lifetime checks against the published artefact before calling the row fully closed. |
+| `AUD-604-S01` | P1 | closed in `5.8.28` | DEAD-001 ignores annotation-like prose in comments while retaining true commented-directive controls. Confirmed by the external review and focused battery. |
+| `AUD-604-D01` | P2 | closed in `5.8.28` | Boot 3 readiness is consistently `null` for non-applicable witnesses. |
+| `AUD-604-U02` | P3 | closed in `5.8.28` | Non-interactive selftest reports the exact nested-repository scope before running and keeps JSON stdout stable. |
+
+## Exclusions
+
+- WebScripts remains unconfirmed; no implementation change is justified.
+- Root-only subcommand `--compact` remains by design with a typed refusal.
+- The cold timing difference is a regression signal, not proof of a parser bug,
+  because the comparison lacks matched controlled samples and profiles.
+- No new security, traceback, write-leakage, path-traversal or zombie-process
+  defect was reported in this round.
+
+## Controlled Performance Evidence
+
+The local follow-up used isolated `SOURCECODE_CACHE_DIR` and
+`SOURCECODE_CONTEXT_CACHE_DIR` stores and cleared both before each run. The same
+`tests/fixtures/spring_boot_minimal` subject was run three times sequentially:
+`0.75 s`, `0.55 s`, and `0.55 s` real time. The cProfile report showed
+`scanner.find_manifests` at about `0.00034 s` cumulative time. These numbers do
+not replace the external 3,342-file benchmark; they establish that the reported
+manifest cost is not attributable on the controlled local subject.
+
+## Attack Order
+
+1. `AUD-604-R01` - complete Windows artefact verification for detached workers.

{sourcecode-5.8.28 → sourcecode-5.8.30}/docs/DEFECT-LEDGER.md

@@ -16,6 +16,34 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
+**External pack audit received, 2026-08-26 - `AUD-605`.**
+[`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md)
+adds two rows: `AUD-605-G01`, where an unresolved test file broadened pack-gate unknown
+endpoints beyond its real production reach, and `AUD-605-U01`, where foreground `pack
+assessment` did not forward component progress. Both are implemented in the current
+checkout by `52bcc36` and `f89ae18`, with focused regression batteries passing; release
+artefact verification remains pending. The pack's `--since` timing is additional evidence
+for `AUD-604-P01`, not a duplicate performance finding.
+
+**Current `5.8.30` queue:** artefact verification for `AUD-604-R01`; the two `AUD-605`
+fixes are included in this release and await release-artefact verification.
+
+**External `5.8.28` audit received, 2026-08-26 - `AUD-604`.**
+[`AUDIT-2026-08-26-EXTERNAL-5.8.28.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28.md) confirms the
+semantic fixes from the previous round and adds three actionable rows: `AUD-604-O01`
+(`posture --diff --compact --limit` is effectively a no-op on nested output),
+`AUD-604-P01` (cold-cost regression signal requiring controlled profiling), and
+`AUD-604-U01` (stale root-help timing headline). Detached execution remains implemented
+in the current source, with native Windows artefact verification still pending. The audit's
+duplicated claim about `python -m sourcecode.cli` is historical and does not describe the
+current `python -m sourcecode` plus `__main__.py` implementation.
+
+**Current `5.8.29` queue:** artefact verification for `AUD-604-R01`. `AUD-604-S01`,
+`AUD-604-D01`, `AUD-604-U02`, `AUD-604-O01` and `AUD-604-U01` are closed in `5.8.28`.
+`AUD-604-P01` is closed as an unconfirmed, non-attributable performance signal after
+controlled profiling; it remains a benchmark follow-up, not a parser fix. WebScripts and
+root-only subcommand `--compact` remain excluded.
+
 **External `5.8.27` audit received, 2026-08-26 — `AUD-603`.** [`AUDIT-2026-08-26-EXTERNAL-5.8.27.md`](AUDIT-2026-08-26-EXTERNAL-5.8.27.md) confirms the SEC-004 and Boot 3 fixes, but reopens detached execution because the direct `python -m sourcecode.cli` worker exits without invoking `main_entry`. It adds a DEAD-001 comment-prose false positive, a `posture --diff --compact` output-ceiling contract defect, and a cold-performance regression signal requiring controlled profiling. The stale timing headline and non-interactive selftest scope warning remain open. WebScripts remains unconfirmed and root-only subcommand `--compact` remains by design.
 
 **Current `5.8.27` queue:** `AUD-603-R01` · `AUD-603-S01` · `AUD-603-O01` · `AUD-603-P01` · `AUD-603-U01` · `AUD-603-U02`. This supersedes the earlier AUD-602 implementation-status note for the reopened rows; its historical commits remain evidence, not closure.

{sourcecode-5.8.28 → sourcecode-5.8.30}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,7 +3,20 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT QUEUE — external audit of `5.8.27`, received 2026-08-26.** `AUD-603-R01` (P1,
+> **CURRENT QUEUE — release `5.8.30`, following the external pack audit of `5.8.28`, received 2026-08-26.** `AUD-605-G01` (P2,
+> unresolved test files broadened pack-gate uncertainty to unrelated endpoints) and `AUD-605-U01` (P2, pack assessment did not
+> forward foreground progress) are implemented in the current checkout in commits `52bcc36` and `f89ae18`; focused batteries pass.
+> The pack audit adds evidence to `AUD-604-P01`, but does not open a duplicate performance row.
+> `AUD-604-R01` remains an artefact-level
+> Windows verification item; its current source implementation is executable. `AUD-604-S01`,
+> `AUD-604-D01`, `AUD-604-U02`, `AUD-604-O01` and `AUD-604-U01` are closed in `5.8.28`.
+> `AUD-604-P01` is closed as an unconfirmed, non-attributable signal after controlled profiling.
+> Full evidence is
+> in [`AUDIT-2026-08-26-EXTERNAL-5.8.28.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28.md).
+> Pack evidence is in [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md). Release-artifact
+> verification of the two pack fixes remains after `AUD-604-R01`.
+
+> **Previous queue — external audit of `5.8.27`, received 2026-08-26.** `AUD-603-R01` (P1,
 > detached worker exits because the module entry point is not invoked) -> `AUD-603-S01`
 > (P1, DEAD-001 comment-prose false positive) -> `AUD-603-O01` (P2, posture diff compact
 > exceeds the output ceiling) -> `AUD-603-P01` (P2, cold-cost regression signal requiring

{sourcecode-5.8.28 → sourcecode-5.8.30}/docs/EXECUTIVE-ROADMAP.md

@@ -5,6 +5,29 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
+> **CURRENT STATUS — release `5.8.30`, following the `5.8.28` external audit intake, 2026-08-26.** The semantic
+> regression matrix remains green: detached execution, DEAD-001 comment handling,
+> Boot 3 applicability, non-interactive selftest scope communication, nested diff
+> bounding and help timing guidance are confirmed fixed. The reported cold-cost signal
+> was not attributable in controlled profiling and produced no speculative parser change.
+> The only remaining engineering item is native Windows artefact verification for
+> detached workers. The audit and its exclusions are in
+> [`AUDIT-2026-08-26-EXTERNAL-5.8.28.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28.md).
+
+> Detached execution is implemented in the current source with `python -m sourcecode`
+> and `sourcecode/__main__.py`; native Windows artefact verification remains release
+> evidence, not an unverified claim of a new source defect. WebScripts and root-only
+> subcommand `--compact` remain excluded by design/evidence status.
+
+> **PACK AUDIT UPDATE — `AUD-605`, 2026-08-26.** Two pack-specific issues were identified:
+> a test-only unresolved Java file could broaden `pack gate` uncertainty to unrelated
+> endpoints, and foreground `pack assessment` did not show component progress. Both are
+> implemented in the current checkout (`52bcc36`, `f89ae18`) with focused batteries green;
+> release-artifact verification remains pending. The
+> pack's slower `--since` run is evidence for the existing cold-cost investigation,
+> not a separate regression claim. Details are in
+> [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md).
+
 > **CURRENT STATUS — `5.8.26` external audit intake, 2026-08-23.** The active engineering
 > queue is `impact-chain` bounded-output regression, `posture --diff --compact` usability,
 > deterministic root fingerprints, sustained warm-path performance and closure-provenance

{sourcecode-5.8.28 → sourcecode-5.8.30}/docs/USER_GUIDE.md

@@ -46,13 +46,14 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.8.28, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.8.30, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
-The current external audit intake is tracked in
-[`AUDIT-2026-08-26-EXTERNAL-5.8.27.md`](AUDIT-2026-08-26-EXTERNAL-5.8.27.md); in
-particular, detached execution and bounded output remain under verification.
+The current external pack audit intake is tracked in
+[`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
+the two pack fixes are included in release 5.8.30, with release-artifact verification
+remaining for detached execution and pack evidence.
 
 ---
 
@@ -182,7 +183,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.28
+# ask 5.8.30
 ```
 
 Requires Python 3.9+.

{sourcecode-5.8.28 → sourcecode-5.8.30}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.8.28"
+version = "5.8.30"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.8.28 → sourcecode-5.8.30}/scripts/perf_harness.py

@@ -134,7 +134,7 @@ def build_argv(command: str, repo_path: Path, cold: bool) -> list[str]:
     # Keep the gate identity stable across runners. Windows' `str(Path("/tmp/repo"))`
     # becomes `\\tmp\\repo`, while the same synthetic repository is published as
     # `/tmp/repo` in the gate contract and in baseline keys.
-    argv.append(repo_path.as_posix())
+    argv.append(str(repo_path).replace("\\", "/"))
     argv += ["--format", "json"]
     # C3-110: some commands need an argument to be measurable at all, and the one
     # authority for which is `perf`, not this script and not a workflow.

{sourcecode-5.8.28 → sourcecode-5.8.30}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.28"
+__version__ = "5.8.30"

{sourcecode-5.8.28 → sourcecode-5.8.30}/src/sourcecode/baseline_autocapture.py

@@ -38,6 +38,8 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import TYPE_CHECKING, Any, Iterable, Optional
 
+from sourcecode.path_display import portable_path
+
 if TYPE_CHECKING:  # pragma: no cover - typing only
     from sourcecode.canonical_ir import CanonicalRepositoryIR
 
@@ -55,7 +57,7 @@ _FALSE = frozenset({"0", "false", "no", "off"})
 
 def _published_path(path: Path) -> str:
     """Serialize a filesystem path with the stable separator used by payloads."""
-    return path.as_posix()
+    return portable_path(path)
 
 # Actions.
 CAPTURED: str = "captured"
@@ -396,7 +398,7 @@ def decide(
     attribution, then idempotency.
     """
     common = {
-        "history_dir": str(history_dir),
+        "history_dir": _published_path(history_dir),
         "commit": commit,
         "history_size": size,
     }

{sourcecode-5.8.28 → sourcecode-5.8.30}/src/sourcecode/cache_model.py

@@ -829,13 +829,21 @@ def cost_sentence() -> str:
             f"{_thousands(int(_gate_cell['java_files']))}-file repository "
             f"({_gate_cell['cache_state']} cache, {_gate_cell['host_class']})."
         )
+    # AUD-604-U01: the external 5.8.28 review observed ~184 s for the root
+    # cold path at the same scale. It is useful context, but not a replacement
+    # for the spring-audit field anchor because the command and protocol differ.
+    current_observation = (
+        " The latest external review also observed about 184 s for the root "
+        "cold path at this scale on 5.8.28; that figure is provisional until "
+        "the controlled release benchmark is reproduced."
+    )
     return (
         f"Historical field anchor only: cost tracks the command class and the build, "
         f"not the file count: "
         f"per-symbol queries are the fast path, inventory commands scale with "
         f"files, and a repository-wide audit measured {seconds:g} s on a "
         f"{_thousands(FIELD_ANCHOR_JAVA_FILES)}-file repository "
-        f"({FIELD_ANCHOR_MEASURED_VERSION}{stale}).{gate} `ask cache model` prints "
+        f"({FIELD_ANCHOR_MEASURED_VERSION}{stale}).{current_observation}{gate} `ask cache model` prints "
         f"the figure and the build behind it for every command; ASK_PROGRESS "
         f"narrates supervised work, while ASK_MAX_ANALYSIS_SECONDS bounds "
         f"{budget_tiers_phrase()}."

{sourcecode-5.8.28 → sourcecode-5.8.30}/src/sourcecode/cli.py

@@ -49,6 +49,7 @@ from sourcecode.caller_metrics import (
     CYCLE_METRIC_RECONCILIATION,
 )
 from sourcecode.repository_ir import extract_java_endpoints as _extract_java_endpoints
+from sourcecode.path_display import portable_path
 
 
 # ---------------------------------------------------------------------------
@@ -1842,7 +1843,7 @@ def _write_root_partial_stub(output: "Path", target: "Path") -> None:
                     "schema_version": "partial-analysis-v1",
                     "partial": True,
                     "command": "ask",
-                    "scope": {"path": str(target)},
+                    "scope": {"path": portable_path(target)},
                     "started_at": _dt.datetime.now(_dt.timezone.utc).isoformat(),
                     "status": "running",
                     "reason": (
@@ -4356,22 +4357,34 @@ def pack_assessment_cmd(
         )
         raise typer.Exit(code=2)
     _enforce_format("pack-assessment", format)
-    data = run_assessment(
-        root, profile=profile, deployment=deployment, compact=compact, output_dir=output_dir,
-    )
+    _progress = Progress().start("pack assessment")
+    try:
+        data = run_assessment(
+            root, profile=profile, deployment=deployment, compact=compact, output_dir=output_dir,
+            progress=lambda done, total, component: _progress.work(
+                done, total, stage=f"pack assessment: {component}",
+                unit="components", estimate=False,
+            ),
+        )
+    except BaseException:
+        _progress.stop()
+        raise
     output = render_assessment_markdown(data) if format == "markdown" else _serialize_dict(data, format)
     # AUD-600-D01: when the pack decided at t=0 that it may not write into the
     # analysed tree, the aggregate must not be routed there either — the same
     # decision, one destination later.
     _dir = None if data.get("no_write_substitution") else output_dir
-    _emit_command_output(
-        output,
-        _pack_output_path(_dir, output_path, format),
-        copy,
-        stamp_envelope=(format != "markdown"),
-    )
-    if data["verdict"] == "UNVERIFIED":
-        raise typer.Exit(code=2)
+    try:
+        _emit_command_output(
+            output,
+            _pack_output_path(_dir, output_path, format),
+            copy,
+            stamp_envelope=(format != "markdown"),
+        )
+        if data["verdict"] == "UNVERIFIED":
+            raise typer.Exit(code=2)
+    finally:
+        _progress.finish()
 
 
 @pack_app.command("gate")
@@ -10110,7 +10123,7 @@ def plan_cmd(
         data["scan_truncated"] = _plan_scan_trunc
     # The tree these components and candidates came from: `--path` defaults to
     # `.`, so a run from the wrong directory answers about another repository.
-    data.setdefault("scope", {"path": str(target_dir)})
+    data.setdefault("scope", {"path": portable_path(target_dir)})
     _prog.finish()
 
     output = _serialize_dict(data, format)
@@ -10231,7 +10244,7 @@ def compare_cmd(
     # The tree these candidates came from. `--path` defaults to `.`, so a run
     # from the wrong directory offered candidates from a different repository
     # with nothing naming the repository they belonged to.
-    data.setdefault("scope", {"path": str(target_dir)})
+    data.setdefault("scope", {"path": portable_path(target_dir)})
     _prog.finish()
 
     _unresolved = [c["target"] for c in data["candidates"] if not c["resolved"]]
@@ -14187,7 +14200,7 @@ def posture_cmd(
         # than that individual cut, leaving a large diff above the ceiling.
         # An explicit --limit remains a precise shape request; compact must
         # actually remove every registered body.
-        monotone=False,
+        monotone=(limit is None and compact),
     )
 
     _emit_command_output(
@@ -15897,7 +15910,7 @@ def modernize_cmd(
         result = {
             "schema_version": _MODERNIZE_SCHEMA,
             "workflow": "modernize",
-            "path": str(root),
+            "path": portable_path(root),
             "tier": "free",
             "tier_note": (
                 "This repository exceeds the free-tier size limit. "
@@ -15923,7 +15936,7 @@ def modernize_cmd(
         result = {
             "schema_version": _MODERNIZE_SCHEMA,
             "workflow": "modernize",
-            "path": str(root),
+            "path": portable_path(root),
             "summary": _summary,
             "hotspot_candidates": hotspots,
             "high_coupling_nodes": [
@@ -18288,9 +18301,9 @@ def cache_status_cmd(
     target = Path(path).resolve()
     _git_root = _resolve_repo_root(Path(path))
     stats = _cm.status(target)
-    stats["scope"] = str(target)
+    stats["scope"] = portable_path(target)
     if _git_root != target:
-        stats["git_root"] = str(_git_root)
+        stats["git_root"] = portable_path(_git_root)
     if json_output:
         import json as _j
         _emit_text_output(_j.dumps(stats, indent=2, ensure_ascii=False), copy, output_path)
@@ -18928,7 +18941,7 @@ def cache_model_cmd(
     if json_output:
         import json as _j
         _payload = _cmodel.as_dict(_here)
-        _payload["scope"] = str(Path(path).resolve())
+        _payload["scope"] = portable_path(Path(path).resolve())
         _payload["scope_note"] = (
             "The cache model is global; this path is accepted so cache model, "
             "cache status and cache freshness share one path grammar."

{sourcecode-5.8.28 → sourcecode-5.8.30}/src/sourcecode/envelope.py

@@ -31,6 +31,8 @@ import subprocess
 from pathlib import Path
 from typing import Any, Optional
 
+from sourcecode.path_display import portable_path
+
 #: Shape of the `_meta` block itself. Bump when a field's meaning changes.
 ENVELOPE_VERSION = "1"
 
@@ -104,9 +106,9 @@ def repository_identity(target: "Path | str") -> "dict[str, Any]":
     try:
         resolved = Path(target).resolve()
     except Exception:
-        return {"path": str(target), "is_git_repository": False,
+        return {"path": portable_path(target), "is_git_repository": False,
                 "tree_state": "unknown", "git_head": None, "tree_id": None}
-    block: dict[str, Any] = {"path": str(resolved), "is_git_repository": False,
+    block: dict[str, Any] = {"path": portable_path(resolved), "is_git_repository": False,
                              "tree_state": "not-a-git-repository",
                              "git_head": None, "tree_id": None}
     try:
@@ -203,7 +205,7 @@ def build_meta(
     if target is not None:
         try:
             resolved = Path(target).resolve()
-            scope: dict[str, Any] = {"path": str(resolved)}
+            scope: dict[str, Any] = {"path": portable_path(resolved)}
             if resolved.is_dir():
                 # AUD-601-D02: one authority for repository identity. This block
                 # read the tree once for `run_id` and then asked git for HEAD a

{sourcecode-5.8.28 → sourcecode-5.8.30}/src/sourcecode/graph_analyzer.py

@@ -8,6 +8,7 @@ from pathlib import Path, PurePosixPath
 from typing import Any, Literal, Optional
 
 from sourcecode.detectors.parsers import load_json_file, load_toml_file
+from sourcecode.path_display import portable_path
 from sourcecode.schema import EntryPoint, GraphEdge, GraphNode, ModuleGraph, ModuleGraphSummary
 from sourcecode.tree_utils import flatten_file_tree
 
@@ -186,7 +187,7 @@ class GraphAnalyzer:
         workspace: str | None,
     ) -> ModuleGraph:
         source_files = [
-            path
+            portable_path(path)
             for path in flatten_file_tree(file_tree)
             if Path(path).suffix in self._SUPPORTED_EXTENSIONS and (root / path).is_file()
         ]
@@ -213,7 +214,7 @@ class GraphAnalyzer:
         java_import_edges = self._build_jvm_java_import_edges(root, source_files, jvm_types)
 
         # .NET: project-level graph from .csproj/.fsproj/.vbproj manifests
-        all_tree_paths = [p for p in flatten_file_tree(file_tree)]
+        all_tree_paths = [portable_path(p) for p in flatten_file_tree(file_tree)]
         dotnet_project_paths = [
             p for p in all_tree_paths
             if Path(p).suffix.lower() in self._DOTNET_PROJECT_EXTENSIONS

{sourcecode-5.8.28 → sourcecode-5.8.30}/src/sourcecode/output_bounds.py

@@ -68,6 +68,10 @@ POSTURE_BOUNDED_LISTS: "tuple[str, ...]" = (
     "only_in_right",
     "left_active",
     "right_active",
+    # AUD-604-O01. The real diff projection publishes endpoint rows under
+    # `endpoint_access.endpoints`; registering only the synthetic `changed`
+    # shape left the largest nested list untouched by `--limit`.
+    "endpoints",
     # AUD-602-R02. `posture --diff` caps the per-profile bean and security
     # lists, but the actionable delta is `endpoint_access.changed`: one row per
     # request whose decision moves between the two profile sets. Omitting it

{sourcecode-5.8.28 → sourcecode-5.8.30}/src/sourcecode/packs.py

@@ -24,7 +24,7 @@ import sys
 import tempfile
 import time
 from pathlib import Path
-from typing import Any, Optional
+from typing import Any, Callable, Optional
 
 from sourcecode import pack_manifest
 from sourcecode.partial_contract import PARTIAL_EXIT_CODE
@@ -771,7 +771,8 @@ def _carrier(result: "dict[str, Any]") -> "dict[str, Any]":
 def run_assessment(root: Path, *, profile: Optional[str] = None,
                    deployment: Optional[list[Path]] = None,
                    compact: bool = False,
-                   output_dir: Optional[Path] = None) -> dict[str, Any]:
+                   output_dir: Optional[Path] = None,
+                   progress: Optional[Callable[[int, int, str], None]] = None) -> dict[str, Any]:
     """Build the assessment pack from existing analysis commands."""
     no_write = _no_write_substitution("assessment", output_dir)
     if no_write is not None:
@@ -781,7 +782,10 @@ def run_assessment(root: Path, *, profile: Optional[str] = None,
     artifacts: dict[str, Optional[str]] = {}
     with tempfile.TemporaryDirectory(prefix="ask-assessment-") as temp:
         temp_root = Path(temp)
-        for command in commands:
+        total_components = len(commands) + 1  # the aggregate audit-report is a component too
+        for index, command in enumerate(commands, start=1):
+            if progress:
+                progress(index, total_components, command)
             extra: list[str] = []
             if compact and command in {"migrate-check", "posture", "endpoints", "spring-audit"}:
                 extra.append("--compact")
@@ -800,6 +804,8 @@ def run_assessment(root: Path, *, profile: Optional[str] = None,
         report_extra = ["--from-risk", str(temp_root / "risk.json")]
         if profile:
             report_extra.extend(["--profile", profile])
+        if progress:
+            progress(total_components, total_components, "audit-report")
         report = _run_command("audit-report", root, temp_root / "audit-report.json", report_extra)
         # The composed `--from-risk` path is a temporary file; what the manifest
         # publishes is the reproducible form, which is `risk`'s own artifact.