sourcecode 5.8.29__py3-none-any.whl → 5.8.31__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.29"
+__version__ = "5.8.31"

sourcecode/_build_commit.py

@@ -1,5 +1,5 @@
 """Generated at build time by hatch_build.py. Do not edit (AUD-592-D04)."""
 
-BUILD_COMMIT = '80201ca55c42b510274aa7aa814e363963667c2f'
+BUILD_COMMIT = '32e9b630f9276e5e481a33f0232c3a7876cd5751'
 CLOSURE_PROVENANCE = {'Window': {'commit': '', 'status': 'uncited'}, '`AUD-588-F05`': {'commit': '470e4a4', 'status': 'present'}, '`AUD-590-B01` / `B-01`, `F-01`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B02` / `B-02`, `F-02`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B03` / `B-03`, `F-03`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B04` / `B-04`, `F-04`': {'commit': '', 'status': 'uncited'}, '`AUD-590-R01` / `R-01`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A01` / `A-1`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A02` / `A-2`, `A-4`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A03` / `A-3`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A05` / `A-5`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A06` / `A-6`, `A-7`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A08` / `A-8`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A09` / `A-9`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A10` / `A-10`': {'commit': '', 'status': 'uncited'}, '`AUD-592-A02` / `A-1` second half, `§12.5`': {'commit': '63f3d61', 'status': 'present'}, '`AUD-592-B01` / `B-8`': {'commit': '8329614', 'status': 'present'}, '`AUD-592-D01` / `D-1`': {'commit': '0f8e03f', 'status': 'present'}, '`AUD-592-D02` / `D-2`': {'commit': '1d3db4d', 'status': 'present'}, '`AUD-592-D03` / `D-3`': {'commit': 'f28fe40', 'status': 'present'}, '`AUD-592-R01` / `A-1`': {'commit': '216025f', 'status': 'present'}, '`AUD-592-R02` / `N-4`, reopens `AUD-513-N04`': {'commit': 'ec3050d', 'status': 'present'}, '`AUD-593-N01` / `N-01`': {'commit': 'dd6a706', 'status': 'present'}, '`AUD-593-N02` / `N-02`': {'commit': 'f539787', 'status': 'present'}, '`AUD-593-N03` / `N-03`': {'commit': '1dd0b1c', 'status': 'present'}, '`AUD-593-N05` / `N-05`': {'commit': 'aa89388', 'status': 'present'}, '`AUD-593-N06` / `N-06`': {'commit': 'aa584a6', 'status': 'present'}, '`AUD-594-N04` / `D-5`, disclosure half of `B-3`': {'commit': 'a0060b7', 'status': 'present'}, '`AUD-594-X01` / `A-1`, residual of `AUD-593-N03`': {'commit': 'dd222b9', 'status': 'present'}, '`AUD-594-X02` / `A-1` second half': {'commit': '1193937', 'status': 'present'}, '`AUD-594-X03` / `X-03`, residual of `AUD-593-N01`': {'commit': 'e89e8f0', 'status': 'present'}, '`AUD-594-X04`': {'commit': '05b8cc9', 'status': 'present'}, '`AUD-595-A02` / `N-5`, advisory half of `AUD-588-B11`': {'commit': '3e15227', 'status': 'present'}, '`AUD-595-A03` / `B-6` exit-code half': {'commit': 'ab7285f', 'status': 'present'}, '`AUD-595-A05`': {'commit': 'e0b3d10', 'status': 'present'}, '`AUD-595-A07`, narrow half of `AUD-592-A02`': {'commit': 'cc15177', 'status': 'present'}, '`AUD-595-B01` / §B': {'commit': 'b77a1ad', 'status': 'present'}, '`AUD-595-Q01`': {'commit': '91a6566', 'status': 'present'}, '`AUD-596-A01` / `ASK-DET-001`': {'commit': 'fa508b4', 'status': 'present'}, '`AUD-596-A02` / `ASK-SELF-001`': {'commit': '4dfadc8', 'status': 'present'}, '`AUD-596-A03` / `ASK-C1-001`': {'commit': 'bffa3a6', 'status': 'present'}, '`AUD-596-A04` / `ASK-UX-003` + `ASK-UX-004`': {'commit': 'f0aac3c', 'status': 'present'}, '`AUD-596-B01` / `B-01`, harder witness for `BUG-6`': {'commit': '567d09d', 'status': 'present'}, '`AUD-596-B02` / `B-02`, class residual of `R2`': {'commit': '', 'status': 'uncited'}, '`AUD-596-B03` / `B-03`': {'commit': 'a8cb814', 'status': 'present'}, '`AUD-596-B06` / `B-06`': {'commit': '8107927', 'status': 'present'}, '`AUD-596-B07` / `B-07`, class residual of `AUD-592-R02`': {'commit': 'e060485', 'status': 'present'}, '`AUD-596-B09` / `B-09`': {'commit': '5b8146c', 'status': 'present'}, '`AUD-596-B10` / `B-10`': {'commit': '5cb994d', 'status': 'present'}, '`AUD-596-B16` / `B-16`': {'commit': '1507f69', 'status': 'present'}, '`AUD-596-D01` / `B-13` + `B-14`': {'commit': '0b1bdf0', 'status': 'present'}, '`AUD-596-D02` / `B-08`, residual of `AUD-594-N04`': {'commit': 'e7f73c3', 'status': 'present'}, '`AUD-596-D03` / `ASK-AGT-001`': {'commit': '8c46967', 'status': 'present'}, '`AUD-596-D04` / `B-18`': {'commit': '040f027', 'status': 'present'}, '`AUD-596-D05` / `B-19`': {'commit': 'fd2bf68', 'status': 'present'}, '`AUD-596-D06` / `B-20`': {'commit': '784cd83', 'status': 'present'}, '`AUD-596-D07` / `B-17`, half refuted': {'commit': 'c3ff822', 'status': 'present'}, '`AUD-596-D08` / `B-22`, class residual of `AUD-591-A06`': {'commit': 'b396c6a', 'status': 'present'}, '`AUD-596-D09` / `B-23`, surviving half of `B26`': {'commit': 'fd3d63f', 'status': 'present'}, '`AUD-596-D10` / `B-29`': {'commit': '', 'status': 'uncited'}, '`AUD-596-D11` / `ASK-UX-005`': {'commit': 'f4b4f77', 'status': 'present'}, '`AUD-596-D12` — six hints that send the reader back to the error': {'commit': '498df44', 'status': 'present'}, '`AUD-596-D13` / `B-28`': {'commit': '1014c72', 'status': 'present'}, '`AUD-596-D14` / `B-15`, narrow half of `B20`': {'commit': '10f2827', 'status': 'present'}, '`AUD-596-R01` / `B-05`': {'commit': '', 'status': 'uncited'}, '`AUD-596-X01` / `ASK-GATE-001`, gating half of `B24`': {'commit': 'e59c655', 'status': 'present'}, '`AUD-596-X02` / `ASK-UX-001` + `ASK-UX-002` + `B-21`': {'commit': 'f6ebf50', 'status': 'present'}, '`AUD-597-A01` / `ASK-UX-001` + `N-01`': {'commit': 'f8cf061', 'status': 'present'}, '`AUD-597-A02` / `ASK-UX-008` + `ASK-DOC-002`': {'commit': '9d47a4c', 'status': 'present'}, '`AUD-597-A03` / `ASK-DET-001`': {'commit': '4c7622a', 'status': 'present'}, '`AUD-597-A04` / `ASK-LEDGER-001`': {'commit': '46fb870', 'status': 'present'}, '`AUD-597-D01` / `B-04`': {'commit': '1094e6a', 'status': 'present'}, '`AUD-597-D02` / `ASK-DOC-001`': {'commit': 'ecb1bb7', 'status': 'present'}, '`AUD-597-D03` / `N-06`': {'commit': '9784333', 'status': 'present'}, '`AUD-597-D04` / `N-05`': {'commit': 'e51c087', 'status': 'present'}, '`AUD-597-D05` / `N-04`, fourth appearance of `C4-27`': {'commit': '9cccc15', 'status': 'present'}, '`AUD-597-D06` / `ASK-CLI-001`': {'commit': '178aa6d', 'status': 'present'}, '`AUD-597-D07` / `N-03`': {'commit': '9245e35', 'status': 'present'}, '`AUD-597-R01` / `ASK-PERF-001`': {'commit': '6910054', 'status': 'present'}, '`AUD-597-R02` / `ASK-ENC-001`': {'commit': 'ce6dac1', 'status': 'present'}, '`AUD-597-R03` / `ASK-UX-002`': {'commit': 'c57e50b', 'status': 'present'}, '`AUD-597-X01` / `ASK-BUILD-001` + `ASK-META-001` / `B-12`': {'commit': '354338b', 'status': 'present'}, '`AUD-598-B01` / `ASK-META-001`': {'commit': 'b2f7c65', 'status': 'present'}, '`AUD-598-B02` / `ASK-UX-002`': {'commit': '56a4bf7', 'status': 'present'}, '`AUD-598-B03` / `B-11`': {'commit': 'c63cb24', 'status': 'present'}, '`AUD-598-B04` / `N-02`': {'commit': '187937f', 'status': 'present'}, '`AUD-598-R01` / `ASK-PERF-002`': {'commit': '', 'status': 'uncited'}, '`AUD-598-X01` / `N-01` + `B-13` + `B-14` + `B-29` + `N-06`': {'commit': '6f2f5a4', 'status': 'present'}, '`AUD-600-B01` / `P-01`': {'commit': '366ffed', 'status': 'present'}, '`AUD-600-B02` / `P-02` + `ASK-PACK-002`': {'commit': '2a814c3', 'status': 'present'}, '`AUD-600-B03` / `ASK-PACK-001`': {'commit': '452f2a0', 'status': 'present'}, '`AUD-600-D01`': {'commit': '1224e1b', 'status': 'present'}, '`AUD-600-D02`': {'commit': 'eab8172', 'status': 'present'}, '`AUD-600-R01` / `R-01`': {'commit': '88add64', 'status': 'present'}, '`AUD-601-B01` / `N-02`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-B02` / `ASK-PACK-004`': {'commit': '', 'status': 'uncited'}, '`AUD-601-D01` / `N-01`, `ASK-UX-001`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-D02` / `B-13`, `B-14`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-M01` / `B-26`, `B-27` retracted': {'commit': '', 'status': 'uncited'}, '`AUD-601-R01` / `R-02`': {'commit': '', 'status': 'uncited'}, '`B-3`': {'commit': '773268d', 'status': 'present'}, '`B-6`': {'commit': '17c6e06', 'status': 'present'}, '`B-8`': {'commit': '8329614', 'status': 'present'}, '`BUG-3` / `443b345`': {'commit': '', 'status': 'uncited'}, '`BUG-4a` / `AUD-588-B11` residual': {'commit': '24b4185', 'status': 'present'}, '`BUG-4b` / `AUD-588-B11` residual': {'commit': '0376350', 'status': 'present'}, '`E-39`, class residual of `AUD-593-N06`': {'commit': '25fc11f', 'status': 'present'}, '`N-5`': {'commit': 'c68083f', 'status': 'present'}, '`N-7`': {'commit': '082e9de', 'status': 'present'}, '`R-1`': {'commit': '424fb1c', 'status': 'present'}, '`R-2`': {'commit': '5158b92', 'status': 'present'}, '`R-3`': {'commit': '88aec04', 'status': 'present'}, '`R-4`': {'commit': '04fd04f', 'status': 'present'}}
 CLOSURE_COVERAGE = {'closed_rows': 113, 'present': 88, 'absent': 0, 'unresolved': 0, 'uncited': 25, 'unknown': 0}

sourcecode/_docs/DEFECT-LEDGER.md

@@ -16,6 +16,18 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
+**External pack audit received, 2026-08-26 - `AUD-605`.**
+[`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md)
+adds two rows: `AUD-605-G01`, where an unresolved test file broadened pack-gate unknown
+endpoints beyond its real production reach, and `AUD-605-U01`, where foreground `pack
+assessment` did not forward component progress. Both are implemented in the current
+checkout by `52bcc36` and `f89ae18`, with focused regression batteries passing; release
+artefact verification remains pending. The pack's `--since` timing is additional evidence
+for `AUD-604-P01`, not a duplicate performance finding.
+
+**Current `5.8.31` queue:** artefact verification for `AUD-604-R01`; the two `AUD-605`
+fixes are included in this release and await release-artefact verification.
+
 **External `5.8.28` audit received, 2026-08-26 - `AUD-604`.**
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28.md) confirms the
 semantic fixes from the previous round and adds three actionable rows: `AUD-604-O01`

sourcecode/_docs/USER_GUIDE.md

@@ -46,13 +46,14 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.8.29, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.8.31, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
-The current external audit intake is tracked in
-[`AUDIT-2026-08-26-EXTERNAL-5.8.27.md`](AUDIT-2026-08-26-EXTERNAL-5.8.27.md); in
-particular, detached execution and bounded output remain under verification.
+The current external pack audit intake is tracked in
+[`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
+the two pack fixes are included in release 5.8.31, with release-artifact verification
+remaining for detached execution and pack evidence.
 
 ---
 
@@ -182,7 +183,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.29
+# ask 5.8.31
 ```
 
 Requires Python 3.9+.

sourcecode/cache.py

@@ -82,6 +82,12 @@ CORE_SCHEMA_VERSION: str = "1"
 ANALYZER_CACHE_VERSION: str = "1"
 
 
+def _user_home() -> Path:
+    """Honor an explicit HOME override before Windows' USERPROFILE fallback."""
+    configured = os.environ.get("HOME")
+    return Path(configured) if configured else Path.home()
+
+
 def analyzer_fingerprint() -> str:
     """Content hash of the analysis code, memoised for the process.
 
@@ -325,7 +331,7 @@ def cache_dir(repo_root: Path) -> Path:
     Override the base via ``SOURCECODE_CACHE_DIR``.
     """
     env_base = os.environ.get("SOURCECODE_CACHE_DIR", "")
-    base: Path = Path(env_base) if env_base else Path.home() / ".sourcecode" / "cache"
+    base: Path = Path(env_base) if env_base else _user_home() / ".sourcecode" / "cache"
     return base / repo_id(repo_root)
 
 

sourcecode/cli.py

@@ -3415,7 +3415,6 @@ COMMANDS_WITHOUT_PROGRESS: "frozenset[str]" = frozenset({
     "baseline trend",   # same command under the group name
     "regress",          # reads two named JSON files; analyses no repository
     "pack list",        # fixed local catalog
-    "pack assessment",  # child progress is captured for aggregate JSON
     "pack gate",        # child progress is captured for aggregate JSON
 })
 
@@ -4332,6 +4331,11 @@ def pack_assessment_cmd(
         help="Deployment artefact for posture evidence (repeatable: k8s, Compose, Dockerfile, WebLogic, dotenv or launch script).",
     ),
     compact: bool = typer.Option(False, "--compact", help="Keep component reports bounded where supported."),
+    only: Optional[str] = typer.Option(
+        None,
+        "--only",
+        help="Comma-separated assessment components to run; audit-report requires risk.",
+    ),
     output_dir: Optional[Path] = typer.Option(
         None,
         "--output-dir",
@@ -4340,13 +4344,14 @@ def pack_assessment_cmd(
     format: str = _format_option(help="Output format: json, yaml or markdown."),
     copy: bool = _copy_option(),
     output_path: Optional[Path] = _output_option(),
+    progress_mode: Optional[str] = _progress_option(),
 ) -> None:
     """Modernization and Risk Assessment pack.
 
     Composes existing commands into one consumable report. Individual commands
     remain available and are the source of truth for every artifact.
     """
-    from sourcecode.packs import render_assessment_markdown, run_assessment
+    from sourcecode.packs import assessment_components, render_assessment_markdown, run_assessment
 
     root = _admit_path(path)
     if profile and deployment:
@@ -4357,28 +4362,51 @@ def pack_assessment_cmd(
         )
         raise typer.Exit(code=2)
     _enforce_format("pack-assessment", format)
-    data = run_assessment(
-        root, profile=profile, deployment=deployment, compact=compact, output_dir=output_dir,
-    )
+    try:
+        selected_components = assessment_components(only.split(",") if only is not None else None)
+    except ValueError as exc:
+        _emit_error_json(INVALID_INPUT_CODE, str(exc))
+        raise typer.Exit(code=2)
+    _progress = Progress().start("pack assessment")
+    try:
+        data = run_assessment(
+            root, profile=profile, deployment=deployment, compact=compact, output_dir=output_dir,
+            selected_components=selected_components,
+            progress=lambda done, total, component: _progress.work(
+                done, total, stage=f"pack assessment: {component}",
+                unit="components", estimate=False,
+            ),
+        )
+    except BaseException:
+        _progress.stop()
+        raise
     output = render_assessment_markdown(data) if format == "markdown" else _serialize_dict(data, format)
     # AUD-600-D01: when the pack decided at t=0 that it may not write into the
     # analysed tree, the aggregate must not be routed there either — the same
     # decision, one destination later.
     _dir = None if data.get("no_write_substitution") else output_dir
-    _emit_command_output(
-        output,
-        _pack_output_path(_dir, output_path, format),
-        copy,
-        stamp_envelope=(format != "markdown"),
-    )
-    if data["verdict"] == "UNVERIFIED":
-        raise typer.Exit(code=2)
+    try:
+        _emit_command_output(
+            output,
+            _pack_output_path(_dir, output_path, format),
+            copy,
+            stamp_envelope=(format != "markdown"),
+        )
+        if data["verdict"] == "UNVERIFIED":
+            raise typer.Exit(code=2)
+    finally:
+        _progress.finish()
 
 
 @pack_app.command("gate")
 def pack_gate_cmd(
     path: Path = typer.Argument(Path("."), help="Repository path (default: current directory)."),
-    since: str = typer.Option(..., "--since", help="Git ref used as the comparison base."),
+    since: Optional[str] = typer.Option(None, "--since", help="Local Git ref used as the comparison base."),
+    pr: Optional[int] = typer.Option(
+        None,
+        "--pr",
+        help="GitHub pull request number; resolves changed files and requires its base commit locally.",
+    ),
     profile: Optional[str] = typer.Option(None, "--profile", help="Profile set used for posture evidence."),
     compact: bool = typer.Option(False, "--compact", help="Omit component payload bodies from the aggregate."),
     allow_unverified: bool = typer.Option(False, "--allow-unverified", help="Allow an unverified component to exit 0."),
@@ -4404,7 +4432,37 @@ def pack_gate_cmd(
     from sourcecode.packs import run_gate
 
     root = _admit_path(path, exit_code=2)
-    data = run_gate(root, since=since, profile=profile, allow_unverified=allow_unverified, compact=compact, output_dir=output_dir)
+    if since is not None and pr is not None:
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            "--since and --pr describe mutually exclusive comparison bases.",
+            hint="Use --since REF for a local comparison or --pr NUMBER for GitHub pull-request mode.",
+        )
+        raise typer.Exit(code=2)
+    if since is None and pr is None:
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            "pack gate requires --since REF or --pr NUMBER.",
+            hint="Use --since origin/main, or --pr 123 when the GitHub base commit is available locally.",
+        )
+        raise typer.Exit(code=2)
+    comparison_ref = since
+    if pr is not None:
+        try:
+            from sourcecode.github_diff import pull_request_base_ref
+
+            comparison_ref, _description = pull_request_base_ref(root, pr)
+        except Exception as exc:
+            from sourcecode.github_diff import GitHubDiffError
+
+            if isinstance(exc, GitHubDiffError):
+                _emit_error_json(INVALID_INPUT_CODE, str(exc), pr=pr)
+                raise typer.Exit(code=2)
+            raise
+    data = run_gate(
+        root, since=comparison_ref or "", pr=pr, profile=profile,
+        allow_unverified=allow_unverified, compact=compact, output_dir=output_dir,
+    )
     if format in {"github-actions", "gitlab"}:
         from sourcecode.ci_output import render_pack_gate_github_actions, render_pack_gate_gitlab
         output = (render_pack_gate_github_actions(data)
@@ -18670,7 +18728,6 @@ def cache_warm_cmd(
     this command reports. Cache ~/.sourcecode/cache and ~/.sourcecode between jobs,
     or budget the cold run explicitly.
     """
-    import shutil as _shutil
     import subprocess as _sub
     import time as _warm_time
     # Warm exactly the path given. Resolving up to the enclosing git root warmed
@@ -18702,7 +18759,11 @@ def cache_warm_cmd(
             f"(scoped to {target}; the enclosing git repository is {_git_root} — "
             "git-derived signals are computed within the scope above)"
         )
-    _sc_bin = _shutil.which("sourcecode") or sys.argv[0]
+    # Launch the worker through this interpreter rather than resolving a second
+    # console script from PATH. A stale global script can otherwise warm one
+    # package installation while the caller reads another one, leaving a view
+    # apparently fresh even though its cache entry was never written.
+    _sc_bin = [sys.executable, "-m", "sourcecode"]
 
     # AUD-600-R01: which views a warm builds is `cache_model`'s fact, not a pair
     # of literals here. The warm used to run one child with `--compact` and an
@@ -18751,7 +18812,7 @@ def cache_warm_cmd(
     # stderr: the line above says it started, the spinner says it is still going.
     _warmed_ids: list[str] = []
     for _view in _selected:
-        cmd = [_sc_bin, str(target), *_warm_view_flags(_view.id)]
+        cmd = [*_sc_bin, str(target), *_warm_view_flags(_view.id)]
         _prog = Progress()
         _prog.start(f"running full analysis ({_view.id} view)")
         try:

sourcecode/envelope.py

@@ -81,7 +81,7 @@ def _tree_state(target: Path) -> "tuple[str, str, str]":
         return "", "", ""
     # Git for Windows emits forward slashes while Path resolves to native
     # separators. Restore the platform-native spelling for this path contract.
-    root = str(Path(root))
+    root = portable_path(Path(root))
     prefix = _git(["rev-parse", "--show-prefix"], target)
     head = _git(["rev-parse", "HEAD"], target) or "no-commit"
     dirty = _git(["status", "--porcelain"], target)

sourcecode/github_diff.py

@@ -1,6 +1,7 @@
 """Optional GitHub CLI adapter for obtaining a pull-request file list."""
 from __future__ import annotations
 
+import json
 import subprocess
 from pathlib import Path
 
@@ -32,3 +33,53 @@ def pull_request_files(root: Path, number: int) -> tuple[list[str], str]:
         )
     paths = [line.strip() for line in result.stdout.splitlines() if line.strip()]
     return paths, f"gh pr diff {number} --name-only"
+
+
+def pull_request_base_ref(root: Path, number: int) -> tuple[str, str]:
+    """Return the exact local comparison commit for a GitHub pull request.
+
+    The gate's posture component compares two repository states, unlike
+    `pr-impact`, which only needs GitHub's changed-file list. Resolve the base
+    SHA through `gh`, then require that the checkout actually has that object;
+    a missing base is an actionable CI checkout problem, not a reason to compare
+    against an arbitrary branch name.
+    """
+    if number < 1:
+        raise GitHubDiffError("pull request number must be a positive integer")
+    command = ["gh", "pr", "view", str(number), "--json", "baseRefName,baseRefOid"]
+    try:
+        result = subprocess.run(
+            command, cwd=root, capture_output=True, text=True, check=False,
+        )
+    except FileNotFoundError as exc:
+        raise GitHubDiffError(
+            "GitHub PR mode requires the `gh` CLI; install it or use --since"
+        ) from exc
+    except OSError as exc:
+        raise GitHubDiffError(f"could not start `gh`: {exc}") from exc
+    if result.returncode != 0:
+        detail = result.stderr.strip() or "GitHub CLI returned a non-zero status"
+        raise GitHubDiffError(
+            f"could not read pull request #{number}: {detail}. "
+            "Check `gh auth status` and the repository remote."
+        )
+    try:
+        payload = json.loads(result.stdout)
+    except json.JSONDecodeError as exc:
+        raise GitHubDiffError("GitHub CLI returned invalid pull-request metadata") from exc
+    base_oid = payload.get("baseRefOid")
+    base_name = payload.get("baseRefName")
+    if not isinstance(base_oid, str) or not base_oid:
+        raise GitHubDiffError("GitHub pull-request metadata did not include baseRefOid")
+    check = subprocess.run(
+        ["git", "cat-file", "-e", f"{base_oid}^{{commit}}"],
+        cwd=root, capture_output=True, text=True, check=False,
+    )
+    if check.returncode != 0:
+        label = base_name if isinstance(base_name, str) and base_name else base_oid
+        raise GitHubDiffError(
+            f"pull request #{number} base {label} ({base_oid}) is not present in this checkout. "
+            "Fetch the base commit first (for GitHub Actions, use actions/checkout with fetch-depth: 0), "
+            "or use --since with an available local ref."
+        )
+    return base_oid, f"gh pr view {number} base {base_name or base_oid} ({base_oid})"

sourcecode/license.py

@@ -89,11 +89,20 @@ if _SUPABASE_URL != _DEFAULT_SUPABASE_URL:
 # which case prompts point to the documented Pro plans instead of a placeholder link.
 _PURCHASE_URL: str = os.environ.get("SOURCECODE_PURCHASE_URL", "").strip()
 
+
+def _user_home() -> Path:
+    """Honor HOME overrides used by isolated subprocesses on every host."""
+    configured = os.environ.get("HOME") or os.environ.get("USERPROFILE")
+    if configured:
+        return Path(configured)
+    return Path.home()
+
+
 # Config home: ~/.ask is canonical (product = ASK Engine). The legacy ~/.sourcecode
 # stays READABLE so no existing user loses their license — reads prefer ~/.ask and
 # fall back to ~/.sourcecode; writes always land in ~/.ask. Backward-compatible.
-_LICENSE_DIR: Path = Path.home() / ".ask"
-_LEGACY_LICENSE_DIR: Path = Path.home() / ".sourcecode"
+_LICENSE_DIR: Path = _user_home() / ".ask"
+_LEGACY_LICENSE_DIR: Path = _user_home() / ".sourcecode"
 _LICENSE_FILE: Path = _LICENSE_DIR / "license.json"
 _DELTA_RUNS_FILE: Path = _LICENSE_DIR / "delta_runs.json"
 

sourcecode/mcp_nudge.py

@@ -18,11 +18,21 @@ Exit code of the calling command is unaffected.
 """
 from __future__ import annotations
 
+import os
 import sys
 from pathlib import Path
 
+
+def _home_dir() -> Path:
+    """Resolve the configured home even in minimal Windows subprocess envs."""
+    configured = os.environ.get("HOME") or os.environ.get("USERPROFILE")
+    if configured:
+        return Path(configured)
+    return Path.home()
+
+
 # Stable path used as a session-level "already shown" sentinel.
-_FLAG: Path = Path.home() / ".sourcecode" / "nudge_shown"
+_FLAG: Path = _home_dir() / ".sourcecode" / "nudge_shown"
 
 _MSG = (
     "→ Claude Desktop detected. "

sourcecode/migrate_check.py

@@ -3008,6 +3008,10 @@ def _scan_file(
     *,
     declared_types: "Optional[frozenset[str]]" = None,
 ) -> list[MigrationFinding]:
+    # Findings are a portable payload contract. Callers may have obtained the
+    # relative path with ``str(Path)`` on Windows, but the same repository file
+    # must retain one identity across hosts and subprocess boundaries.
+    rel_path = rel_path.replace("\\", "/")
     findings: list[MigrationFinding] = []
     type_deprecated = _primary_type_is_deprecated(source)
 

sourcecode/packs.py

@@ -24,7 +24,7 @@ import sys
 import tempfile
 import time
 from pathlib import Path
-from typing import Any, Optional
+from typing import Any, Callable, Optional, Sequence
 
 from sourcecode import pack_manifest
 from sourcecode.partial_contract import PARTIAL_EXIT_CODE
@@ -306,6 +306,47 @@ def pack_non_coverage(pack: str) -> dict[str, Any]:
     }
 
 
+def assessment_components(selected: "Optional[Sequence[str]]" = None) -> list[str]:
+    """Return requested assessment components in declared execution order."""
+    declared = list(PACKS["assessment"]["commands"])
+    if selected is None:
+        return declared
+    requested = [name.strip() for name in selected if name and name.strip()]
+    if not requested:
+        raise ValueError("--only requires at least one assessment component")
+    unknown = sorted(set(requested) - set(declared))
+    if unknown:
+        raise ValueError(
+            "unknown assessment component(s): " + ", ".join(unknown) + ". "
+            "Choose from: " + ", ".join(declared)
+        )
+    if len(set(requested)) != len(requested):
+        raise ValueError("--only must not name an assessment component more than once")
+    if "audit-report" in requested and "risk" not in requested:
+        raise ValueError("audit-report requires risk in --only")
+    return [name for name in declared if name in requested]
+
+
+def _assessment_non_coverage(commands: list[str]) -> dict[str, Any]:
+    """Add caller-selected omissions to the pack's normal coverage declaration."""
+    block = pack_non_coverage("assessment")
+    omitted = [name for name in PACKS["assessment"]["commands"] if name not in commands]
+    if not omitted:
+        return block
+    items = list(block.get("items") or [])
+    items.append({
+        "id": "NC-PACK-SELECTION",
+        "surface": "pack assessment",
+        "not_covered": "Assessment components omitted by --only: " + ", ".join(omitted) + ".",
+        "why": (
+            "The caller selected a bounded component subset. Silence from an omitted "
+            "component is not evidence about its subject."
+        ),
+        "instead": "Re-run ask pack assessment <repo> without --only, or name the component explicitly.",
+    })
+    return {**block, "items": items}
+
+
 #: What `--compact` keeps from each component, as dotted paths into that
 #: component's own payload.
 #:
@@ -771,17 +812,23 @@ def _carrier(result: "dict[str, Any]") -> "dict[str, Any]":
 def run_assessment(root: Path, *, profile: Optional[str] = None,
                    deployment: Optional[list[Path]] = None,
                    compact: bool = False,
-                   output_dir: Optional[Path] = None) -> dict[str, Any]:
+                   output_dir: Optional[Path] = None,
+                   progress: Optional[Callable[[int, int, str], None]] = None,
+                   selected_components: "Optional[Sequence[str]]" = None) -> dict[str, Any]:
     """Build the assessment pack from existing analysis commands."""
     no_write = _no_write_substitution("assessment", output_dir)
     if no_write is not None:
         output_dir = None
-    commands = ["migrate-check", "posture", "endpoints", "spring-audit", "risk"]
+    commands = assessment_components(selected_components)
+    analysis_commands = [command for command in commands if command != "audit-report"]
     results: dict[str, Any] = {}
     artifacts: dict[str, Optional[str]] = {}
     with tempfile.TemporaryDirectory(prefix="ask-assessment-") as temp:
         temp_root = Path(temp)
-        for command in commands:
+        total_components = len(commands)
+        for index, command in enumerate(analysis_commands, start=1):
+            if progress:
+                progress(index, total_components, command)
             extra: list[str] = []
             if compact and command in {"migrate-check", "posture", "endpoints", "spring-audit"}:
                 extra.append("--compact")
@@ -797,19 +844,22 @@ def run_assessment(root: Path, *, profile: Optional[str] = None,
             # that is not bounded by construction.
             artifacts[command] = _write_artifact(output_dir, command, _carrier(result))
 
-        report_extra = ["--from-risk", str(temp_root / "risk.json")]
-        if profile:
-            report_extra.extend(["--profile", profile])
-        report = _run_command("audit-report", root, temp_root / "audit-report.json", report_extra)
-        # The composed `--from-risk` path is a temporary file; what the manifest
-        # publishes is the reproducible form, which is `risk`'s own artifact.
-        report["invocation"] = [
-            "ask", "audit-report", "--from-risk", "risk.json",
-            *(["--profile", profile] if profile else []),
-            str(root), "--format", "json",
-        ]
-        results["audit-report"] = report
-        artifacts["audit-report"] = _write_artifact(output_dir, "audit-report", _carrier(report))
+        if "audit-report" in commands:
+            report_extra = ["--from-risk", str(temp_root / "risk.json")]
+            if profile:
+                report_extra.extend(["--profile", profile])
+            if progress:
+                progress(total_components, total_components, "audit-report")
+            report = _run_command("audit-report", root, temp_root / "audit-report.json", report_extra)
+            # The composed `--from-risk` path is a temporary file; what the manifest
+            # publishes is the reproducible form, which is `risk`'s own artifact.
+            report["invocation"] = [
+                "ask", "audit-report", "--from-risk", "risk.json",
+                *(["--profile", profile] if profile else []),
+                str(root), "--format", "json",
+            ]
+            results["audit-report"] = report
+            artifacts["audit-report"] = _write_artifact(output_dir, "audit-report", _carrier(report))
 
     components = _index(results, artifacts)
     failures = [name for name, item in results.items() if item["exit_code"] not in (0,)]
@@ -836,7 +886,7 @@ def run_assessment(root: Path, *, profile: Optional[str] = None,
         "exit_code": exit_code,
         "commands": list(results),
         "failures": failures,
-        "non_coverage": pack_non_coverage("assessment"),
+        "non_coverage": _assessment_non_coverage(commands),
         "aggregation_rule": PACK_AGGREGATION["assessment"],
         "manifest": pack_manifest.manifest(
             pack="assessment",
@@ -847,16 +897,28 @@ def run_assessment(root: Path, *, profile: Optional[str] = None,
             inputs={"profile": profile,
                     "deployment": [str(path) for path in (deployment or [])],
                     "compact": compact,
+                    "selected_components": commands,
                     "output_dir": str(output_dir.resolve()) if output_dir else None},
         ),
         "artifacts": artifact_payloads,
         "intersections": build_intersections(artifact_payloads),
         "output_dir": str(output_dir.resolve()) if output_dir else None,
+        "selection": {
+            "commands": commands,
+            "omitted_components": [
+                name for name in PACKS["assessment"]["commands"] if name not in commands
+            ],
+            "basis": (
+                "All declared assessment components ran."
+                if len(commands) == len(PACKS["assessment"]["commands"])
+                else "The caller selected this component subset with --only."
+            ),
+        },
         **({"no_write_substitution": no_write} if no_write else {}),
     }
 
 
-def run_gate(root: Path, *, since: str, profile: Optional[str] = None,
+def run_gate(root: Path, *, since: str, pr: Optional[int] = None, profile: Optional[str] = None,
              allow_unverified: bool = False, compact: bool = False,
              output_dir: Optional[Path] = None) -> dict[str, Any]:
     """Build one CI verdict from the existing gate-capable commands."""
@@ -885,7 +947,8 @@ def run_gate(root: Path, *, since: str, profile: Optional[str] = None,
         if profile:
             posture_extra.extend(["--profile", profile])
         results["posture"] = _run_command("posture", root, temp_root / "posture.json", posture_extra)
-        pr_impact = _run_command("pr-impact", root, temp_root / "pr-impact.json", ["--since", since])
+        pr_impact_args = ["--pr", str(pr)] if pr is not None else ["--since", since]
+        pr_impact = _run_command("pr-impact", root, temp_root / "pr-impact.json", pr_impact_args)
         # A clean comparison is a valid no-op, not a failed safety check. The
         # standalone command refuses an empty change set; the pack can state
         # that condition explicitly because it is the workflow orchestrator.
@@ -947,6 +1010,7 @@ def run_gate(root: Path, *, since: str, profile: Optional[str] = None,
         "pack": "gate",
         "repository": str(root.resolve()),
         "since": since,
+        "pr": pr,
         "profile": profile,
         "verdict": verdict,
         "exit_code": exit_code,
@@ -973,7 +1037,7 @@ def run_gate(root: Path, *, since: str, profile: Optional[str] = None,
             components=components,
             verdict=verdict,
             exit_code=exit_code,
-            inputs={"since": since, "profile": profile, "compact": compact,
+            inputs={"since": since, "pr": pr, "profile": profile, "compact": compact,
                     "allow_unverified": allow_unverified,
                     "output_dir": str(output_dir.resolve()) if output_dir else None},
         ),

sourcecode/pr_impact.py

@@ -43,6 +43,15 @@ _RISK_LABEL: dict[int, str] = {
 }
 
 
+def _split_unresolved_files(paths: list[str]) -> tuple[list[str], list[str]]:
+    """Separate unresolved production files from test-only evidence."""
+    from sourcecode.repository_ir import is_test_source_file
+
+    productive = [path for path in paths if not is_test_source_file(path)]
+    test_sources = [path for path in paths if is_test_source_file(path)]
+    return productive, test_sources
+
+
 # ---------------------------------------------------------------------------
 # Output model
 # ---------------------------------------------------------------------------
@@ -669,6 +678,17 @@ def _run_pr_impact_internal(
         changed_files, file_class_index, root
     )
     warnings.extend(file_warnings)
+    # A changed test source can be absent from the production CIR by design. It
+    # remains evidence in `unresolved_files`, but it must not turn every
+    # production endpoint into `unknown` or inflate the blast-radius verdict.
+    # Keep the classification in the same authority used by the source walk.
+    unresolved_productive, unresolved_excluded = _split_unresolved_files(unresolved_java)
+    if unresolved_excluded:
+        warnings.append(
+            f"{len(unresolved_excluded)} changed test-source file(s) were not mapped "
+            "to production classes by design; they do not broaden endpoint "
+            "uncertainty."
+        )
     non_java_changes = _classify_non_java(non_java)
 
     if not class_fqns:
@@ -694,6 +714,8 @@ def _run_pr_impact_internal(
                 "changed_files_count": len(changed_files),
                 "classes_analyzed": 0,
                 "unresolved_java_count": len(unresolved_java),
+                "unresolved_productive_count": len(unresolved_productive),
+                "unresolved_test_source_count": len(unresolved_excluded),
                 "non_java_count": len(non_java_changes),
             },
         )
@@ -785,7 +807,7 @@ def _run_pr_impact_internal(
         event_consumers,
         tx_methods,
         individual_risks,
-        unresolved_java,
+        unresolved_productive,
         container_wired=wired,
         risk_by_class=risk_by_class,
     )
@@ -841,11 +863,12 @@ def _run_pr_impact_internal(
                 "outside it is undetermined rather than excluded"
             ),
         ))
-    if unresolved_java:
+    if unresolved_productive:
         disposition_blockers.append(_disposition.Blocker(
             reason=_disposition.REASON_UNRESOLVED_CHANGED_FILE,
             detail=(
-                f"{len(unresolved_java)} changed Java file(s) mapped to no class, "
+                f"{len(unresolved_productive)} changed production Java file(s) mapped "
+                "to no class, "
                 "so part of the diff was never analysed and the surface it might "
                 "reach is unknown by construction"
             ),
@@ -904,6 +927,8 @@ def _run_pr_impact_internal(
                 "route population (`endpoints.total`)"
             ),
             "unresolved_java_count": len(unresolved_java),
+            "unresolved_productive_count": len(unresolved_productive),
+            "unresolved_test_source_count": len(unresolved_excluded),
             "non_java_count": len(non_java_changes),
             "analysis_time_ms": elapsed_ms,
         },

sourcecode/readonly.py

@@ -34,6 +34,8 @@ from __future__ import annotations
 import os
 import sys
 from pathlib import Path
+
+from sourcecode.path_display import portable_path
 from typing import Optional
 
 #: Reads the mode for a process that was not given a flag.
@@ -197,7 +199,7 @@ def as_dict() -> dict:
     """The mode as data, for a payload that wants to state what it ran under."""
     return {
         "no_write": is_readonly(),
-        "scope": str(_SCOPE) if _SCOPE else None,
+        "scope": portable_path(_SCOPE) if _SCOPE else None,
         "refused": refusals(),
         "guarantee": (
             "Nothing is created or modified inside the analysed repository. Shared caches "

{sourcecode-5.8.29.dist-info → sourcecode-5.8.31.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.29
+Version: 5.8.31
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.29-blue)
+![Version](https://img.shields.io/badge/version-5.8.31-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -177,14 +177,14 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.8.29 retains the shared Canonical IR
+**Current performance status.** Release 5.8.31 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
 and bounded-output regressions for this release; use `ask cache model <repo>` and
 `--progress stderr` for supervised runs, and consult the
-[active audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.27.md) before treating a
-historical timing or bounded flag as a current guarantee.
+[active pack audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md) before
+treating a historical timing or bounded flag as a current guarantee.
 
 **What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
@@ -210,7 +210,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.29 — and, on a build that has aged,
+ask version                    # ask 5.8.31 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.29.dist-info → sourcecode-5.8.31.dist-info}/RECORD

@@ -1,6 +1,6 @@
-sourcecode/__init__.py,sha256=BsyoEScwgZp_z4C0WinmN5nS1_OEYjyIMz8mZ9xet7k,309
+sourcecode/__init__.py,sha256=x6huFekCWuzbMyWgV9DNW6WDTwRfZV3q9UlfspK-7AY,309
 sourcecode/__main__.py,sha256=qDFVkobwsdZrX0B3stiRqsUNivVpybKO-egzAwCW4xw,165
-sourcecode/_build_commit.py,sha256=DVrTbRV7HbPiVF2bLsvg-m6ns5u__Yao6-ev4XPnxqk,8740
+sourcecode/_build_commit.py,sha256=gOxdbVEG8QZSIEAPML8CaTzP3DaBaqHqkVEV25ceY4U,8740
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/analysis_budget.py,sha256=ZuNEboPF8A6GK-_V7WNt92ezgriga7_Rbr-vvSN4UEE,4183
 sourcecode/answer_bounds.py,sha256=_51_DCuYEUmI_xwUFxDMiprSavkNakkLiIBbPjevQ3M,9793
@@ -19,7 +19,7 @@ sourcecode/breaking_changes.py,sha256=iaTEkegVGnR_DEQP45U66GQKMkq-_qNM60nv7XEPm7
 sourcecode/build_modules.py,sha256=rsT8reXoeOGztX28SNwem3yGdBhAC5VJx9RL2vRp_d0,15935
 sourcecode/build_stamp.py,sha256=YWlnT8CEFzMre5pacRQkc244BfZNG5owySIyP9Dq4pw,7677
 sourcecode/bundled_docs.py,sha256=KymEkB7P8oeg0-PjcD8eRSDhqQbwQxDUbHv1i00LQOc,2663
-sourcecode/cache.py,sha256=z_1T0ClTbC3DaG_Fo-6_HKRUdBXHbwNoVvj8gZmQVGo,45591
+sourcecode/cache.py,sha256=cCvSNJvm897M_i_nGHZYW-_T9TvXwCBnT5EYqFXkMSY,45799
 sourcecode/cache_model.py,sha256=fI5dEvK2-dA246a_-DHyq8zumBPR0rjYvyxx397SNW4,73716
 sourcecode/cache_observation.py,sha256=5E2BeqiYE5wBCbvDglkc5A9fTNhXkT_OhcDuuCqRu4Q,5622
 sourcecode/call_surface.py,sha256=fiqYfHooxN1fX9oQoysq1LS3LoZcobhyUNjAGEZKpwk,4148
@@ -31,7 +31,7 @@ sourcecode/change_plan.py,sha256=drAoDsqFplutCLc6Y0xue7sYkTls0SpYh7aOXvttv3I,129
 sourcecode/ci_output.py,sha256=X4NRokWWMRF9Ex8OQrEO2g04GzJ00GDP5zYIoqI9YCc,4625
 sourcecode/cir_graphs.py,sha256=RytqSv1WF8kdlfXj2fPQz16LY4akS2kyThbdWL8beCQ,14835
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=FMKLhy4DUkBX2usbxtMoOLXGnyxKVVJlSf-SqiukyOs,867099
+sourcecode/cli.py,sha256=kA6mou1cf-9nQ90E2K9oGNTFplI2BReBcTPjPUcTDVs,869605
 sourcecode/client_calls.py,sha256=YOPnfRZzRyqmdHvXSVeiunW8cuiuCuWXacNIQRgKMCw,22640
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=Lnfmm9I3k0H1jP1tV6ZJ-R7znjQPLPLCe5TzV1Jb_PM,15323
@@ -64,7 +64,7 @@ sourcecode/endpoint_literals.py,sha256=Qf4gTZzvNSFDGDuOvF0YRL9NvaYKKj24klhR5LIOa
 sourcecode/endpoint_metrics.py,sha256=sLSLUIgiIyvNdOynaxVgHd9SjRF_DbN3QxevaquykaU,2840
 sourcecode/entrypoint_classifier.py,sha256=jhTYlyqDJH2AtdEcLVaRU3lYRTJuF8DkxVzl4-W3zWE,5322
 sourcecode/env_analyzer.py,sha256=tU2CcW-Lkl__60DMd4ibYnXnxfmPbV5Z9GrToSWLdSA,22029
-sourcecode/envelope.py,sha256=gAvGZrH2Q1ovfDdqjuvx5gIc31zUNAJLVCHu6pMxAnI,17397
+sourcecode/envelope.py,sha256=rISj4NXJZTX0scP7O01fmxl6xnCr_D_c482LkpPzVc0,17407
 sourcecode/environment_resolution.py,sha256=e86HT3RNbIIUIRChvz1Pu9Um81UvYu22BkpHNnwbUQI,30650
 sourcecode/error_schema.py,sha256=uAWEknt3Z-6pNoNaiaSVeiDHdBe-bmt08BDlkS1YaAs,2951
 sourcecode/evidence_provider.py,sha256=GSSL44JEaouO5AHks2sB3d1YvC9xIKIld1yBYxZpXxo,4277
@@ -81,18 +81,18 @@ sourcecode/functional_routes.py,sha256=KXMrDoBwj_GC80w10FvgA3zddIGE1iW9KjpDtCllS
 sourcecode/gate_anchors.py,sha256=26v8wUtzOk1K1Un5uXdUxAu20mqSPX3jo82zuM05ByE,2066
 sourcecode/git_analyzer.py,sha256=irvEwddbd5_tbA_eYUZebf4mH7_nFhpjwaWAV1f7jUY,15755
 sourcecode/git_checkout.py,sha256=gCnkMwHpU6yLyc10FoGzE8W9-tI8KyYxKTgpbWPjayo,6009
-sourcecode/github_diff.py,sha256=EVjSR853IoEuKUn10lDjpqw2a6r0-jM_xsxwEOS-Wzs,1399
+sourcecode/github_diff.py,sha256=H1woYKuCjb6S9sofBPpMlOpn0L4LoVxuVP7ddnhsNaA,3848
 sourcecode/graph_analyzer.py,sha256=Gw2MzLp0P990TGx6D6Ie-WIPnjWVE6X6dNBQnoM9xPU,65857
 sourcecode/graph_evidence.py,sha256=rENNsYRZeNstX_ExNCLlbHJAruFQwxo5d00x6wO3xwI,15030
 sourcecode/hibernate_strat.py,sha256=kLAa5GMwYFZgOI7edl-nDcJTr4SFVYAoxtMy-fj2BsA,77954
 sourcecode/identity_fallback.py,sha256=uRC_j_80uaI4Ue4tf-OhKX4h472dmufYcjEFGSxY2jk,9190
 sourcecode/integration_coordinates.py,sha256=rvuApnS7WdRUbeQLg_oKj-Gi0koO2RKdw6HenXNgrDo,12443
 sourcecode/jdk_exports.py,sha256=fCrlwNAXUT9gge_joq6kMnY3zJxYB2pxqy-0w3o3MJI,874
-sourcecode/license.py,sha256=vvgE1vBUWh8ozWI7USYuteh6noxntnjuzDQIPF-l4rA,27795
+sourcecode/license.py,sha256=N5EpGnX3nL2x2goZFyyCMSFKj4gfUse5nigRIuPN0Ek,28049
 sourcecode/manifest_cache.py,sha256=aPRHUs781d00fVbtlTiSaq0-AS9bAqS7_zJ0snZvlJs,2244
-sourcecode/mcp_nudge.py,sha256=lKemOqK_wny2u7Ymcr2Idi5Kx8pXY02jCi-_nJYLGMg,2992
+sourcecode/mcp_nudge.py,sha256=beNjfyb7z09T1rnS4t6Q4qfbLzZQNaP6ddCA4XpmV0s,3256
 sourcecode/metrics_analyzer.py,sha256=gLoRWKygF18jLgwsqmGXSWopw-f5iO1VbM7Jjdif6ag,22809
-sourcecode/migrate_check.py,sha256=Y7q0H1Q4vS0xM8mTpdm1cJyI6wrCuRi8-u3YjcAsaxY,170803
+sourcecode/migrate_check.py,sha256=BJj_nTnZ0fAIh5X_buL9SR2i5YdilQR3a2mkTgJFwJc,171075
 sourcecode/migration_apply.py,sha256=36E9IUq7RbpGVt6RZ8PlSZKgDoEMHorZrXw6UVWPnpw,8692
 sourcecode/migration_blast.py,sha256=OPryWkM6-PbvcG3eJFdcWUnlpXBje41nu2BkrZnE2hg,9359
 sourcecode/non_coverage.py,sha256=x-P6nRWc3cfUgHLUjjFWkxiyENASlksUhVHJYwd-a_8,30024
@@ -104,7 +104,7 @@ sourcecode/output_ceiling.py,sha256=rMLDHbXeC6C_uP8iQSVbbCGiJ_n0gMr2YI9zt5nltFA,
 sourcecode/output_encoding.py,sha256=OxiZQtr7uWBDUtblNQviNHsTH1Xo9AZEpsegPlQWKFk,2139
 sourcecode/output_sink.py,sha256=Eya-PnXxqc3RGulJoLhuC9LUF73SZD0aO5O2B0xAMXU,8762
 sourcecode/pack_manifest.py,sha256=Qm6et6SQsFCLc-HJ-Uhz1XlcOa77ZDHgks4JVDEENss,20820
-sourcecode/packs.py,sha256=FoPBrJcfoZ5SyXNNNRhPTIhv3DFQkxbVFixtFEZZmxk,45763
+sourcecode/packs.py,sha256=y5IGuzF4LYzZl9z5WtkxjWFAmUNphDvmbHUFGkuUieE,48879
 sourcecode/parallel.py,sha256=QocwdZoUabdxzd_jEz7f6B2XMsYWFaCFaIl0tIEQs3g,10546
 sourcecode/parse_cache.py,sha256=BaPzh-KygmY4OpJQm2YGh6PWztYsj58vHWTu2eSF4s8,38769
 sourcecode/partial_contract.py,sha256=FZUBACkClvRAmPeYVjxNWeQmP6Y22KW4fPeeTfmT80A,5951
@@ -116,14 +116,14 @@ sourcecode/phased_run.py,sha256=MOLH5f3ZMyfpSQ-tLGRy1qzL4ETE_46qaS3G0O2QsPM,2347
 sourcecode/pipe_contract.py,sha256=PML0Er5d8uDyec4OrdUXuyqHbGPUYndjeaKUjkFz2u4,8369
 sourcecode/posture.py,sha256=OQX3r0wBzdRNwMs6fuJcpFKPuyoC_uAkAVoKsYuwqgE,87190
 sourcecode/pr_comment_renderer.py,sha256=239PmJdf95av_ZW236C7_tvq_ahECeuF9AZxrheJ4OQ,15573
-sourcecode/pr_impact.py,sha256=VjswKxvpuP-avRJE5YshFQRG0t8-vVbYv7uWXGb-EF4,37796
+sourcecode/pr_impact.py,sha256=8RgTJgvEThezh-Vm65eiFvJBdb45VjcbewEk5P144-0,39184
 sourcecode/prepare_context.py,sha256=U-iAQaLDc7qSjf2IKM4IznZFFZBDwWlFTRp_MBaALXQ,245016
 sourcecode/product_info.py,sha256=rpuCDf0KM2SD-WP8vw2tjdcbhWPsOGEVjSWqS8fkzlo,4966
 sourcecode/progress.py,sha256=naKbWFqf-eTE3vtLsi-eHYILz0p3pxCASAzMmvxUIAI,21643
 sourcecode/provenance.py,sha256=gLbsLv0gze7k7ChM4i5M3MwKfFPzs8wzM72rUd2C5sM,7342
 sourcecode/ranking_engine.py,sha256=ZAucq_YX2KkWUuAZf4P0lhtQ_38vEFnUhuGtSZd1S0E,12970
 sourcecode/readiness_timeline.py,sha256=KjghC1MWH7Tzto97TBR3N0F8FkR87w5z7lZ1QsWvAQE,8506
-sourcecode/readonly.py,sha256=9MdpSPC6wHSi9pRD4JrPcDfyJmgWehljiDS5u-ZTnjY,7401
+sourcecode/readonly.py,sha256=8MJfg5E5gjwHN2f2qw0RM7fdzxTFeOsdGwLNKHCh-xc,7462
 sourcecode/reconciliation.py,sha256=pmqc0JNcAagKGWDcjH2rLDlKlAbfJCVUj86vV--YEXQ,35689
 sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/reference_facts.py,sha256=mx7H-Ax5y8sKAQHrnJCXlgjkUzqZtQTByv9Zy2lxKQQ,15500
@@ -257,13 +257,13 @@ sourcecode/telemetry/consent.py,sha256=-Wb8BFGXEexOs8M0Eja7F-T6ZtLNPeRoZnHcHvlP7
 sourcecode/telemetry/events.py,sha256=l3Z2SQUO4_C2D2ItXOOdVNimAmHedUHnUxqYFTxnsAE,2900
 sourcecode/telemetry/filters.py,sha256=-lqT2oorECuqEIdeHb--7AZ6BCaUx0bya720a-Z5x6w,7335
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode/_docs/DEFECT-LEDGER.md,sha256=VuA98XjdYAgFuRA-JVL5Wj-wgtrHIbsaxzUA5-_G11U,1107575
+sourcecode/_docs/DEFECT-LEDGER.md,sha256=K5k1J1JDBBeXnB50o9KxIFnFJRHBillTJNoKoiQmLXY,1108377
 sourcecode/_docs/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
 sourcecode/_docs/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode/_docs/USER_GUIDE.md,sha256=2ytr23ckEE5DLam53rEckfPX3xIYGuX9VhLk4tCZrSM,93211
-sourcecode-5.8.29.dist-info/METADATA,sha256=H0NXHkNSGNEE6hCYJqCICsI33DOe-cW_Xvk9yvwD_uc,55418
-sourcecode-5.8.29.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-5.8.29.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-5.8.29.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
-sourcecode-5.8.29.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode-5.8.29.dist-info/RECORD,,
+sourcecode/_docs/USER_GUIDE.md,sha256=w8YGMcBHQIRLwnFzqodOZhvP5eF8pfYMtw5FyUlRpNk,93284
+sourcecode-5.8.31.dist-info/METADATA,sha256=8XTeIYslvJubUEPmt2L6EObS9m9aw4BVKL6BfBDYN0w,55428
+sourcecode-5.8.31.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-5.8.31.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-5.8.31.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
+sourcecode-5.8.31.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
+sourcecode-5.8.31.dist-info/RECORD,,