sourcecode 5.8.29__tar.gz → 5.8.30__tar.gz

{sourcecode-5.8.29 → sourcecode-5.8.30}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [5.8.30] — 2026-08-26
+
+*Pack audit remediation release. Unresolved test-only Java files no longer broaden
+`pack gate` endpoint uncertainty, and foreground `pack assessment` now reports
+component progress through the stderr-only heartbeat contract. Documentation and
+release evidence are synchronized with the AUD-605 fixes.*
+
 ## [5.8.29] — 2026-08-26
 
 *Release synchronization for the external `5.8.28` audit. The posture diff now

{sourcecode-5.8.29 → sourcecode-5.8.30}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.29
+Version: 5.8.30
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.29-blue)
+![Version](https://img.shields.io/badge/version-5.8.30-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -177,14 +177,14 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.8.29 retains the shared Canonical IR
+**Current performance status.** Release 5.8.30 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
 and bounded-output regressions for this release; use `ask cache model <repo>` and
 `--progress stderr` for supervised runs, and consult the
-[active audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.27.md) before treating a
-historical timing or bounded flag as a current guarantee.
+[active pack audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md) before
+treating a historical timing or bounded flag as a current guarantee.
 
 **What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
@@ -210,7 +210,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.29 — and, on a build that has aged,
+ask version                    # ask 5.8.30 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.29 → sourcecode-5.8.30}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.29-blue)
+![Version](https://img.shields.io/badge/version-5.8.30-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -128,14 +128,14 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.8.29 retains the shared Canonical IR
+**Current performance status.** Release 5.8.30 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
 and bounded-output regressions for this release; use `ask cache model <repo>` and
 `--progress stderr` for supervised runs, and consult the
-[active audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.27.md) before treating a
-historical timing or bounded flag as a current guarantee.
+[active pack audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md) before
+treating a historical timing or bounded flag as a current guarantee.
 
 **What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
@@ -161,7 +161,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.29 — and, on a build that has aged,
+ask version                    # ask 5.8.30 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

sourcecode-5.8.30/docs/AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md

@@ -0,0 +1,35 @@
+# ASK Engine 5.8.28 - External Pack Audit Intake
+
+**Received:** 2026-08-26  
+**Audited surface:** `pack list`, `pack assessment` and `pack gate` on
+`spring-petclinic`  
+**Related release:** `5.8.28` (remediation release: `5.8.30`)
+
+## Findings
+
+| ID | Priority | Status | Finding and acceptance criterion |
+|---|---:|---|---|
+| `AUD-605-G01` | P2 | implemented in current checkout | `pack gate --since HEAD~3` marked unrelated endpoints `unknown` when a changed Java test file contributed no CIR symbols. Unresolved test files remain evidence, while only unresolved production files can broaden endpoint uncertainty. Regression coverage is in `tests/test_pr_impact.py`; release-artifact verification remains pending. |
+| `AUD-605-U01` | P2 | implemented in current checkout | Foreground `pack assessment` emitted no `ASK_PROGRESS` heartbeat for more than five minutes while its subprocess components ran. The parent now reports components `1/6` through `6/6` through the existing stderr-only progress contract, preserving JSON stdout and component attribution. Regression coverage is in `tests/test_packs.py`; release-artifact verification remains pending. |
+
+## Existing Signal, Not A New Row
+
+`pack gate --since` took about 49 s, with posture accounting for about 44 s.
+This is additional evidence for `AUD-604-P01` / the controlled cold-cost follow-up,
+not a separate regression: the audit did not provide a matched release benchmark
+or an attributable profile. Pack list, assessment's verdict composition and
+`no_contracts_declared` handling were otherwise correct.
+
+The SARIF repository URL observation was verified as a false positive. No new
+security, traceback, write-leakage or process-zombie defect was found.
+
+## Order
+
+1. `AUD-605-G01` - narrow unresolved-file uncertainty to its actual production reach.
+2. `AUD-605-U01` - forward coarse progress from pack components.
+
+## Remediation Evidence
+
+- `52bcc36` - `fix(pr-impact): ignore test-only unresolved files`
+- `f89ae18` - `fix(pack): report assessment component progress`
+- Focused batteries: 49 impact/disposition tests and 49 pack/heartbeat/stderr tests passed.

{sourcecode-5.8.29 → sourcecode-5.8.30}/docs/DEFECT-LEDGER.md

@@ -16,6 +16,18 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
+**External pack audit received, 2026-08-26 - `AUD-605`.**
+[`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md)
+adds two rows: `AUD-605-G01`, where an unresolved test file broadened pack-gate unknown
+endpoints beyond its real production reach, and `AUD-605-U01`, where foreground `pack
+assessment` did not forward component progress. Both are implemented in the current
+checkout by `52bcc36` and `f89ae18`, with focused regression batteries passing; release
+artefact verification remains pending. The pack's `--since` timing is additional evidence
+for `AUD-604-P01`, not a duplicate performance finding.
+
+**Current `5.8.30` queue:** artefact verification for `AUD-604-R01`; the two `AUD-605`
+fixes are included in this release and await release-artefact verification.
+
 **External `5.8.28` audit received, 2026-08-26 - `AUD-604`.**
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28.md) confirms the
 semantic fixes from the previous round and adds three actionable rows: `AUD-604-O01`

{sourcecode-5.8.29 → sourcecode-5.8.30}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,12 +3,18 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT QUEUE — release `5.8.29`, following the external audit of `5.8.28`, received 2026-08-26.** `AUD-604-R01` remains an artefact-level
+> **CURRENT QUEUE — release `5.8.30`, following the external pack audit of `5.8.28`, received 2026-08-26.** `AUD-605-G01` (P2,
+> unresolved test files broadened pack-gate uncertainty to unrelated endpoints) and `AUD-605-U01` (P2, pack assessment did not
+> forward foreground progress) are implemented in the current checkout in commits `52bcc36` and `f89ae18`; focused batteries pass.
+> The pack audit adds evidence to `AUD-604-P01`, but does not open a duplicate performance row.
+> `AUD-604-R01` remains an artefact-level
 > Windows verification item; its current source implementation is executable. `AUD-604-S01`,
 > `AUD-604-D01`, `AUD-604-U02`, `AUD-604-O01` and `AUD-604-U01` are closed in `5.8.28`.
 > `AUD-604-P01` is closed as an unconfirmed, non-attributable signal after controlled profiling.
 > Full evidence is
 > in [`AUDIT-2026-08-26-EXTERNAL-5.8.28.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28.md).
+> Pack evidence is in [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md). Release-artifact
+> verification of the two pack fixes remains after `AUD-604-R01`.
 
 > **Previous queue — external audit of `5.8.27`, received 2026-08-26.** `AUD-603-R01` (P1,
 > detached worker exits because the module entry point is not invoked) -> `AUD-603-S01`

{sourcecode-5.8.29 → sourcecode-5.8.30}/docs/EXECUTIVE-ROADMAP.md

@@ -5,7 +5,7 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
-> **CURRENT STATUS — release `5.8.29`, following the `5.8.28` external audit intake, 2026-08-26.** The semantic
+> **CURRENT STATUS — release `5.8.30`, following the `5.8.28` external audit intake, 2026-08-26.** The semantic
 > regression matrix remains green: detached execution, DEAD-001 comment handling,
 > Boot 3 applicability, non-interactive selftest scope communication, nested diff
 > bounding and help timing guidance are confirmed fixed. The reported cold-cost signal
@@ -19,6 +19,15 @@
 > evidence, not an unverified claim of a new source defect. WebScripts and root-only
 > subcommand `--compact` remain excluded by design/evidence status.
 
+> **PACK AUDIT UPDATE — `AUD-605`, 2026-08-26.** Two pack-specific issues were identified:
+> a test-only unresolved Java file could broaden `pack gate` uncertainty to unrelated
+> endpoints, and foreground `pack assessment` did not show component progress. Both are
+> implemented in the current checkout (`52bcc36`, `f89ae18`) with focused batteries green;
+> release-artifact verification remains pending. The
+> pack's slower `--since` run is evidence for the existing cold-cost investigation,
+> not a separate regression claim. Details are in
+> [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md).
+
 > **CURRENT STATUS — `5.8.26` external audit intake, 2026-08-23.** The active engineering
 > queue is `impact-chain` bounded-output regression, `posture --diff --compact` usability,
 > deterministic root fingerprints, sustained warm-path performance and closure-provenance

{sourcecode-5.8.29 → sourcecode-5.8.30}/docs/USER_GUIDE.md

@@ -46,13 +46,14 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.8.29, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.8.30, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
-The current external audit intake is tracked in
-[`AUDIT-2026-08-26-EXTERNAL-5.8.27.md`](AUDIT-2026-08-26-EXTERNAL-5.8.27.md); in
-particular, detached execution and bounded output remain under verification.
+The current external pack audit intake is tracked in
+[`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
+the two pack fixes are included in release 5.8.30, with release-artifact verification
+remaining for detached execution and pack evidence.
 
 ---
 
@@ -182,7 +183,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.29
+# ask 5.8.30
 ```
 
 Requires Python 3.9+.

{sourcecode-5.8.29 → sourcecode-5.8.30}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.8.29"
+version = "5.8.30"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.8.29 → sourcecode-5.8.30}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.29"
+__version__ = "5.8.30"

{sourcecode-5.8.29 → sourcecode-5.8.30}/src/sourcecode/cli.py

@@ -4357,22 +4357,34 @@ def pack_assessment_cmd(
         )
         raise typer.Exit(code=2)
     _enforce_format("pack-assessment", format)
-    data = run_assessment(
-        root, profile=profile, deployment=deployment, compact=compact, output_dir=output_dir,
-    )
+    _progress = Progress().start("pack assessment")
+    try:
+        data = run_assessment(
+            root, profile=profile, deployment=deployment, compact=compact, output_dir=output_dir,
+            progress=lambda done, total, component: _progress.work(
+                done, total, stage=f"pack assessment: {component}",
+                unit="components", estimate=False,
+            ),
+        )
+    except BaseException:
+        _progress.stop()
+        raise
     output = render_assessment_markdown(data) if format == "markdown" else _serialize_dict(data, format)
     # AUD-600-D01: when the pack decided at t=0 that it may not write into the
     # analysed tree, the aggregate must not be routed there either — the same
     # decision, one destination later.
     _dir = None if data.get("no_write_substitution") else output_dir
-    _emit_command_output(
-        output,
-        _pack_output_path(_dir, output_path, format),
-        copy,
-        stamp_envelope=(format != "markdown"),
-    )
-    if data["verdict"] == "UNVERIFIED":
-        raise typer.Exit(code=2)
+    try:
+        _emit_command_output(
+            output,
+            _pack_output_path(_dir, output_path, format),
+            copy,
+            stamp_envelope=(format != "markdown"),
+        )
+        if data["verdict"] == "UNVERIFIED":
+            raise typer.Exit(code=2)
+    finally:
+        _progress.finish()
 
 
 @pack_app.command("gate")

{sourcecode-5.8.29 → sourcecode-5.8.30}/src/sourcecode/packs.py

@@ -24,7 +24,7 @@ import sys
 import tempfile
 import time
 from pathlib import Path
-from typing import Any, Optional
+from typing import Any, Callable, Optional
 
 from sourcecode import pack_manifest
 from sourcecode.partial_contract import PARTIAL_EXIT_CODE
@@ -771,7 +771,8 @@ def _carrier(result: "dict[str, Any]") -> "dict[str, Any]":
 def run_assessment(root: Path, *, profile: Optional[str] = None,
                    deployment: Optional[list[Path]] = None,
                    compact: bool = False,
-                   output_dir: Optional[Path] = None) -> dict[str, Any]:
+                   output_dir: Optional[Path] = None,
+                   progress: Optional[Callable[[int, int, str], None]] = None) -> dict[str, Any]:
     """Build the assessment pack from existing analysis commands."""
     no_write = _no_write_substitution("assessment", output_dir)
     if no_write is not None:
@@ -781,7 +782,10 @@ def run_assessment(root: Path, *, profile: Optional[str] = None,
     artifacts: dict[str, Optional[str]] = {}
     with tempfile.TemporaryDirectory(prefix="ask-assessment-") as temp:
         temp_root = Path(temp)
-        for command in commands:
+        total_components = len(commands) + 1  # the aggregate audit-report is a component too
+        for index, command in enumerate(commands, start=1):
+            if progress:
+                progress(index, total_components, command)
             extra: list[str] = []
             if compact and command in {"migrate-check", "posture", "endpoints", "spring-audit"}:
                 extra.append("--compact")
@@ -800,6 +804,8 @@ def run_assessment(root: Path, *, profile: Optional[str] = None,
         report_extra = ["--from-risk", str(temp_root / "risk.json")]
         if profile:
             report_extra.extend(["--profile", profile])
+        if progress:
+            progress(total_components, total_components, "audit-report")
         report = _run_command("audit-report", root, temp_root / "audit-report.json", report_extra)
         # The composed `--from-risk` path is a temporary file; what the manifest
         # publishes is the reproducible form, which is `risk`'s own artifact.

{sourcecode-5.8.29 → sourcecode-5.8.30}/src/sourcecode/pr_impact.py

@@ -43,6 +43,15 @@ _RISK_LABEL: dict[int, str] = {
 }
 
 
+def _split_unresolved_files(paths: list[str]) -> tuple[list[str], list[str]]:
+    """Separate unresolved production files from test-only evidence."""
+    from sourcecode.repository_ir import is_test_source_file
+
+    productive = [path for path in paths if not is_test_source_file(path)]
+    test_sources = [path for path in paths if is_test_source_file(path)]
+    return productive, test_sources
+
+
 # ---------------------------------------------------------------------------
 # Output model
 # ---------------------------------------------------------------------------
@@ -669,6 +678,17 @@ def _run_pr_impact_internal(
         changed_files, file_class_index, root
     )
     warnings.extend(file_warnings)
+    # A changed test source can be absent from the production CIR by design. It
+    # remains evidence in `unresolved_files`, but it must not turn every
+    # production endpoint into `unknown` or inflate the blast-radius verdict.
+    # Keep the classification in the same authority used by the source walk.
+    unresolved_productive, unresolved_excluded = _split_unresolved_files(unresolved_java)
+    if unresolved_excluded:
+        warnings.append(
+            f"{len(unresolved_excluded)} changed test-source file(s) were not mapped "
+            "to production classes by design; they do not broaden endpoint "
+            "uncertainty."
+        )
     non_java_changes = _classify_non_java(non_java)
 
     if not class_fqns:
@@ -694,6 +714,8 @@ def _run_pr_impact_internal(
                 "changed_files_count": len(changed_files),
                 "classes_analyzed": 0,
                 "unresolved_java_count": len(unresolved_java),
+                "unresolved_productive_count": len(unresolved_productive),
+                "unresolved_test_source_count": len(unresolved_excluded),
                 "non_java_count": len(non_java_changes),
             },
         )
@@ -785,7 +807,7 @@ def _run_pr_impact_internal(
         event_consumers,
         tx_methods,
         individual_risks,
-        unresolved_java,
+        unresolved_productive,
         container_wired=wired,
         risk_by_class=risk_by_class,
     )
@@ -841,11 +863,12 @@ def _run_pr_impact_internal(
                 "outside it is undetermined rather than excluded"
             ),
         ))
-    if unresolved_java:
+    if unresolved_productive:
         disposition_blockers.append(_disposition.Blocker(
             reason=_disposition.REASON_UNRESOLVED_CHANGED_FILE,
             detail=(
-                f"{len(unresolved_java)} changed Java file(s) mapped to no class, "
+                f"{len(unresolved_productive)} changed production Java file(s) mapped "
+                "to no class, "
                 "so part of the diff was never analysed and the surface it might "
                 "reach is unknown by construction"
             ),
@@ -904,6 +927,8 @@ def _run_pr_impact_internal(
                 "route population (`endpoints.total`)"
             ),
             "unresolved_java_count": len(unresolved_java),
+            "unresolved_productive_count": len(unresolved_productive),
+            "unresolved_test_source_count": len(unresolved_excluded),
             "non_java_count": len(non_java_changes),
             "analysis_time_ms": elapsed_ms,
         },