sourcecode 5.8.30__tar.gz → 5.8.32__tar.gz

sourcecode-5.8.32/.github/workflows/build-windows.yml

@@ -0,0 +1,78 @@
+name: Build Windows EXE
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build-windows:
+    runs-on: windows-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install build
+          pip install nuitka
+
+      - name: Build wheel artifact
+        run: python -m build --wheel --outdir build/wheel
+
+      - name: Install wheel artifact
+        run: pip install build/wheel/*.whl
+
+      - name: Build EXE
+        run: |
+          python -m nuitka ^
+            --onefile ^
+            --standalone ^
+            --follow-imports ^
+            --assume-yes-for-downloads ^
+            --output-dir=build ^
+            run_cli.py
+        shell: cmd
+
+      - name: Verify detached worker from installed artifact
+        shell: pwsh
+        run: |
+          $root = Join-Path $env:RUNNER_TEMP "ask-detached-repo"
+          $output = Join-Path $env:RUNNER_TEMP "ask-detached.json"
+          New-Item -ItemType Directory -Force (Join-Path $root "src/main/java/com/acme") | Out-Null
+          Set-Content -Path (Join-Path $root "pom.xml") -Value '<project><modelVersion>4.0.0</modelVersion><groupId>com.acme</groupId><artifactId>app</artifactId><version>1</version></project>'
+          Set-Content -Path (Join-Path $root "src/main/java/com/acme/App.java") -Value 'package com.acme; public class App {}'
+          python -m sourcecode spring-audit $root --output $output --detach
+          for ($i = 0; $i -lt 60 -and -not (Test-Path $output); $i++) { Start-Sleep -Seconds 1 }
+          if (-not (Test-Path $output)) { throw "Detached worker did not write its artifact" }
+          $payload = Get-Content $output -Raw | ConvertFrom-Json
+          if (-not $payload) { throw "Detached artifact is not valid JSON" }
+
+      - name: Verify pack fixes from installed artifact
+        shell: pwsh
+        run: |
+          $root = Join-Path $env:RUNNER_TEMP "ask-pack-repo"
+          New-Item -ItemType Directory -Force (Join-Path $root "src/main/java/com/acme") | Out-Null
+          New-Item -ItemType Directory -Force (Join-Path $root "src/test/java/com/acme") | Out-Null
+          Set-Content -Path (Join-Path $root "pom.xml") -Value '<project><modelVersion>4.0.0</modelVersion><groupId>com.acme</groupId><artifactId>app</artifactId><version>1</version></project>'
+          Set-Content -Path (Join-Path $root "src/main/java/com/acme/App.java") -Value 'package com.acme; public class App {}'
+          Set-Content -Path (Join-Path $root "src/test/java/com/acme/AppTest.java") -Value 'package com.acme; public class AppTest {}'
+          git -C $root init --quiet
+          git -C $root config user.email ci@example.invalid
+          git -C $root config user.name ASK-CI
+          git -C $root add .
+          git -C $root commit --quiet -m baseline
+          Add-Content -Path (Join-Path $root "src/test/java/com/acme/AppTest.java") -Value '// test-only change'
+          python -m sourcecode pack gate $root --since HEAD --format json --output-dir (Join-Path $env:RUNNER_TEMP "ask-gate")
+          python -m sourcecode pack assessment $root --only posture,risk --compact --progress stderr
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: sourcecode-windows
+          path: build/**/*.exe

{sourcecode-5.8.30 → sourcecode-5.8.32}/.github/workflows/windows-battery.yml

@@ -17,8 +17,6 @@ jobs:
   battery:
     runs-on: windows-latest
     env:
-      NO_COLOR: "1"
-      TERM: "dumb"
       # CLI payloads and diagnostics are UTF-8 contracts. Without this Windows
       # decodes child-process output with the active code page, turning a valid
       # JSON answer containing source text into an empty/failed test response.

{sourcecode-5.8.30 → sourcecode-5.8.32}/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## [5.8.32] — 2026-08-26
+
+*MCP and documentation alignment release. MCP assessment packs now support
+validated selective component execution through `only`, with omitted coverage
+and a reproducible CLI command recorded in the projection. MCP pull-request
+gates, pack guidance and the public roadmap are synchronized with the current
+release state.*
+
+## [5.8.31] — 2026-08-26
+
+*Windows portability and release-evidence remediation. Cache and licensing test
+isolation now honours explicit `HOME` overrides, warm workers use the active
+interpreter, migration and identity paths remain portable, and the Windows CI
+battery no longer disables the rendered help contract. Unix-only permission probes
+are skipped on Windows. Local full-suite verification is green; native Windows
+release-artifact verification remains the CI acceptance step.*
+
 ## [5.8.30] — 2026-08-26
 
 *Pack audit remediation release. Unresolved test-only Java files no longer broaden

{sourcecode-5.8.30 → sourcecode-5.8.32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.30
+Version: 5.8.32
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.30-blue)
+![Version](https://img.shields.io/badge/version-5.8.32-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -88,6 +88,8 @@ workflow-shaped packs for users who want one consumable result:
 ask pack assessment . --profile prod --output-dir .ask/packs/assessment
 ask pack gate . --since origin/main --output-dir .ask/packs/gate
 ask pack assessment . --format markdown -o assessment.md
+ask pack assessment . --only risk,posture --output-dir .ask/packs/assessment
+ask pack gate . --pr 123 --output-dir .ask/packs/gate
 ```
 
 For deployment-aware posture evidence, pass the artefacts that describe the
@@ -104,8 +106,17 @@ contract:
 ```bash
 ask pack gate . --since origin/main --format github-actions
 ask pack gate . --since origin/main --format gitlab
+ask pack gate . --since origin/main --format sarif -o gate.sarif
 ```
 
+`pack gate --pr NUMBER` uses the local `gh` CLI to resolve changed files and
+the exact base commit; the base SHA must already exist locally. It does not
+fetch or modify the repository. `pack assessment --only` runs named assessment
+components and records omissions in the manifest. MCP's
+`get_assessment_pack` accepts the same selection as `only: list[str]` and
+returns the reproducible CLI command in its `mcp` projection. SARIF is a bounded
+export of ASK-owned gate decisions, not a re-emission of third-party findings.
+
 `PASS`, `BLOCK` and `UNVERIFIED` are data decisions. The process exit code is
 the CI signal; `--allow-unverified` can change only that exit code, never the
 reported verdict. Every pack carries a manifest with component invocations,
@@ -177,18 +188,19 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.8.30 retains the shared Canonical IR
+**Current performance status.** Release 5.8.32 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
 and bounded-output regressions for this release; use `ask cache model <repo>` and
 `--progress stderr` for supervised runs, and consult the
-[active pack audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md) before
+[latest external audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.31.md) before
 treating a historical timing or bounded flag as a current guarantee.
 
-**What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
+**What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
-IR) and the **compact view**. Pass `--agent` to warm the agent view as well. Deeper projections
+IR). Pass `--views compact` or `--views compact,agent` to warm only selected views; without
+`--views`, all declared views are warmed. Deeper projections
 are separate keys and are *not* covered by either — `--full`, `--env-map` and a raised `--depth`
 recompute on first use, as do most `prepare-context` tasks. Measured on a 3,342-file Spring
 monolith: `cache warm` 103s → `--compact --git-context` 1s (hit), but `--agent --full --env-map
@@ -210,7 +222,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.30 — and, on a build that has aged,
+ask version                    # ask 5.8.32 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -479,7 +491,7 @@ from it.
 | `plan` / `compare` / `delta` / `contract-diff` | supported | what to review for a change; candidates by measured cost; outcome of a change; public-contract break | no verdicts, measured cost only |
 | `validation` | supported | request-body validation coverage and gaps | |
 | `baseline capture\|diff` · `trend` | supported | versioned architectural metrics over time; `ask trend .` reads the series (a repository path or a baselines directory), `ask baseline diff .` compares the tree against its newest point | trend reporting, not gating. Baselines land in `.ask/baselines` **inside the repository** — the history travels with the code, not with a vendor; an audit that must not write passes `--dir`. `capture --auto` is the unattended form (one baseline per commit, never rewrites one, never fails the build) — automate it: [baseline-ci.yml](docs/baseline-ci.yml) |
-| `retrieve` | parked | typed knowledge queries over the model | |
+| `retrieve` | parked | typed knowledge queries over the model | symbol-oriented queries accept `--target/-t`; domain aliases such as `--module/-m`, `--subsystem/-s` and `--endpoint/-e` remain supported |
 | `timeline` | experimental | since when a number moved, and in which commit window | walks the commit series and re-runs the shipped analyses (`posture`, `data-exposure`, `endpoints`, `spring-audit`) on a read-only materialisation of each sampled tree; publishes transitions, not a per-commit dump. A sample that could not be analysed is `null` with a reason, never 0, and a transition under sampling carries the window it could have happened in |
 | `regress` | supported | what moved between two payloads of the same command, and which declaration accounts for it | attributes each delta to a declaration the answers carry (`test_source_excluded`, `symbols_excluded`, `coverage.gaps`, `*_cap`, `waivers`); a delta nothing explains is `unattributed`. Refuses the comparison when `cache_layers`, `base_env` or the analyzer fingerprint differ |
 | `explain-endpoint` | supported | the derivation behind one route's verdict | six steps — match, declaration, handler, chain, profiles, verdict — each naming the authority that produced it and the file it can be checked against; a step that could not be derived is `undetermined` with the reason, never absent |

{sourcecode-5.8.30 → sourcecode-5.8.32}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.30-blue)
+![Version](https://img.shields.io/badge/version-5.8.32-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -39,6 +39,8 @@ workflow-shaped packs for users who want one consumable result:
 ask pack assessment . --profile prod --output-dir .ask/packs/assessment
 ask pack gate . --since origin/main --output-dir .ask/packs/gate
 ask pack assessment . --format markdown -o assessment.md
+ask pack assessment . --only risk,posture --output-dir .ask/packs/assessment
+ask pack gate . --pr 123 --output-dir .ask/packs/gate
 ```
 
 For deployment-aware posture evidence, pass the artefacts that describe the
@@ -55,8 +57,17 @@ contract:
 ```bash
 ask pack gate . --since origin/main --format github-actions
 ask pack gate . --since origin/main --format gitlab
+ask pack gate . --since origin/main --format sarif -o gate.sarif
 ```
 
+`pack gate --pr NUMBER` uses the local `gh` CLI to resolve changed files and
+the exact base commit; the base SHA must already exist locally. It does not
+fetch or modify the repository. `pack assessment --only` runs named assessment
+components and records omissions in the manifest. MCP's
+`get_assessment_pack` accepts the same selection as `only: list[str]` and
+returns the reproducible CLI command in its `mcp` projection. SARIF is a bounded
+export of ASK-owned gate decisions, not a re-emission of third-party findings.
+
 `PASS`, `BLOCK` and `UNVERIFIED` are data decisions. The process exit code is
 the CI signal; `--allow-unverified` can change only that exit code, never the
 reported verdict. Every pack carries a manifest with component invocations,
@@ -128,18 +139,19 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.8.30 retains the shared Canonical IR
+**Current performance status.** Release 5.8.32 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
 and bounded-output regressions for this release; use `ask cache model <repo>` and
 `--progress stderr` for supervised runs, and consult the
-[active pack audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md) before
+[latest external audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.31.md) before
 treating a historical timing or bounded flag as a current guarantee.
 
-**What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
+**What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
-IR) and the **compact view**. Pass `--agent` to warm the agent view as well. Deeper projections
+IR). Pass `--views compact` or `--views compact,agent` to warm only selected views; without
+`--views`, all declared views are warmed. Deeper projections
 are separate keys and are *not* covered by either — `--full`, `--env-map` and a raised `--depth`
 recompute on first use, as do most `prepare-context` tasks. Measured on a 3,342-file Spring
 monolith: `cache warm` 103s → `--compact --git-context` 1s (hit), but `--agent --full --env-map
@@ -161,7 +173,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.30 — and, on a build that has aged,
+ask version                    # ask 5.8.32 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -430,7 +442,7 @@ from it.
 | `plan` / `compare` / `delta` / `contract-diff` | supported | what to review for a change; candidates by measured cost; outcome of a change; public-contract break | no verdicts, measured cost only |
 | `validation` | supported | request-body validation coverage and gaps | |
 | `baseline capture\|diff` · `trend` | supported | versioned architectural metrics over time; `ask trend .` reads the series (a repository path or a baselines directory), `ask baseline diff .` compares the tree against its newest point | trend reporting, not gating. Baselines land in `.ask/baselines` **inside the repository** — the history travels with the code, not with a vendor; an audit that must not write passes `--dir`. `capture --auto` is the unattended form (one baseline per commit, never rewrites one, never fails the build) — automate it: [baseline-ci.yml](docs/baseline-ci.yml) |
-| `retrieve` | parked | typed knowledge queries over the model | |
+| `retrieve` | parked | typed knowledge queries over the model | symbol-oriented queries accept `--target/-t`; domain aliases such as `--module/-m`, `--subsystem/-s` and `--endpoint/-e` remain supported |
 | `timeline` | experimental | since when a number moved, and in which commit window | walks the commit series and re-runs the shipped analyses (`posture`, `data-exposure`, `endpoints`, `spring-audit`) on a read-only materialisation of each sampled tree; publishes transitions, not a per-commit dump. A sample that could not be analysed is `null` with a reason, never 0, and a transition under sampling carries the window it could have happened in |
 | `regress` | supported | what moved between two payloads of the same command, and which declaration accounts for it | attributes each delta to a declaration the answers carry (`test_source_excluded`, `symbols_excluded`, `coverage.gaps`, `*_cap`, `waivers`); a delta nothing explains is `unattributed`. Refuses the comparison when `cache_layers`, `base_env` or the analyzer fingerprint differ |
 | `explain-endpoint` | supported | the derivation behind one route's verdict | six steps — match, declaration, handler, chain, profiles, verdict — each naming the authority that produced it and the file it can be checked against; a step that could not be derived is `undetermined` with the reason, never absent |

sourcecode-5.8.32/docs/AUDIT-2026-08-26-EXTERNAL-5.8.31.md

@@ -0,0 +1,87 @@
+# External Audit — 5.8.31
+
+Received 2026-08-26. This note records the external comparison of release
+`5.8.31` against `5.8.30` and separates reproduced defects from mitigations,
+performance observations and shell-dependent measurements.
+
+## Executive Result
+
+The external score was **8/10**, up from 7/10. The auditor verified useful
+capabilities in this release:
+
+- `--progress off|stderr|file:<path>` works for `pack assessment` and `cache warm`;
+- `cache clear --all/--global` removes shared parse/CIR state and makes a
+  cold-cache reset explicit;
+- `auth status` documents the deprecation window for legacy fields;
+- the root help labels the `31s` figure as a historical field anchor.
+
+The progress control is a mitigation, not an automatic foreground heartbeat:
+without `--progress`, the command remains silent until its final answer. The
+external run also measured a cold-cache improvement (`215.6s` to `137.8s`),
+but one sample is insufficient to attribute a stable release-level change.
+
+## Actionable Findings
+
+### `AUD-606-O01` — `posture --diff --compact --limit` remains ineffective
+
+**Priority:** P2. **Status:** not reproduced in the current checkout; retained as
+an external-subject follow-up.
+
+The report measured `estimated_tokens` changing from `71847` to `71808` with
+`--limit 20`, while the bounded floor remained `47764`. The error wording now
+correctly stops recommending a flag that was already tried, but the reported
+payload-size symptom remains. The earlier `AUD-604-O01` closure was based on a
+different subject and must not be treated as proof against this report. A
+controlled current-checkout reproduction over the real `diff_posture` shape
+confirmed that all generated nested lists are in the bounding registry and are
+cut by explicit `--limit`; the existing bounding batteries pass.
+
+Acceptance if the original subject is supplied: reproduce on a controlled fixture, identify the nested population
+outside the posture bounded-list registry, and either make the explicit limit
+bound that population or publish a precise non-coverage/refusal. Add a regression
+assertion over the affected payload shape.
+
+### `AUD-606-R01` — inconsistent target option names in `retrieve`
+
+**Priority:** P2. **Status:** closed in the current checkout (`be16c04`).
+
+The retrieval surface uses `--target/-t` for most symbol-oriented commands,
+`--module/-m` for module queries, `--subsystem/-s` for subsystem membership and
+`--endpoint/-e` for endpoint queries. This is a discoverability and automation
+cost, not an analysis correctness failure. Domain-specific flags remain valid,
+and symbol-like domain queries now also accept universal `--target/-t`. Help
+parity coverage spans all five affected commands.
+
+Acceptance: choose and document one compatibility policy. The preferred fix is
+to expose a universal `--target/-t` alias where the semantic target is a symbol,
+while retaining domain-specific names where the input is genuinely a module,
+subsystem or endpoint. Sweep the command registry and add help/parity tests.
+
+## Conditional Follow-ups
+
+### `AUD-606-P01` — cold-cache timing requires more samples
+
+The observed 137.8s cold run is an improvement over the reported 5.8.30 value,
+but it is a single measurement and still above the older baseline. No parser or
+performance regression should be opened from it alone. Run 2-3 sequential,
+isolated samples with cache state, repository, host and version recorded.
+
+### `AUD-606-P02` — `pack gate --since HEAD` measurement contaminated
+
+The 70.2s and >120s observations were taken while two other ASK processes were
+running. This is not evidence of an ASK inconsistency. Re-test in an isolated
+session with three sequential samples before changing the gate or its cache
+path.
+
+### `AUD-606-I01` — `pr-impact --files -` with redirected null stdin
+
+`--files -` works with an actual empty pipe, but the reported `< /dev/null`
+path is classified as a terminal under the auditor's shell. This may be
+Git Bash/MSYS descriptor behaviour rather than an ASK defect. Reproduce in
+native PowerShell and `cmd.exe` before changing stdin detection.
+
+## Not Reopened
+
+The verified cache, auth, progress and historical-anchor changes are recorded
+as release capabilities, not new defects. Previously closed pack fixes are not
+duplicated; their remaining release-artifact verification stays in the ledger.

{sourcecode-5.8.30 → sourcecode-5.8.32}/docs/DEFECT-LEDGER.md

@@ -16,6 +16,24 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
+**External `5.8.31` audit received, 2026-08-26 - `AUD-606`.**
+[`AUDIT-2026-08-26-EXTERNAL-5.8.31.md`](AUDIT-2026-08-26-EXTERNAL-5.8.31.md)
+confirms the new progress and shared-cache controls, and records one actionable
+external-subject follow-up `AUD-606-O01`, where `posture --diff --compact --limit`
+was effectively unchanged on the auditor's nested output; the current checkout
+reproduces no such gap and its bounding batteries pass. It also opens the CLI
+consistency row `AUD-606-R01` for heterogeneous `retrieve` target flags, fixed
+in the current checkout by `be16c04` with help-parity coverage.
+The 137.8s cold run is a single-sample improvement and remains `AUD-606-P01`
+benchmark follow-up, not a parser regression. `AUD-606-P02` (`pack gate` timing)
+and `AUD-606-I01` (`pr-impact --files -` with `/dev/null`) are inconclusive due
+to process contamination and shell-specific stdin behaviour respectively.
+
+**Current `5.8.31` queue:** external-subject follow-up `AUD-606-O01`; controlled
+benchmark/portability follow-ups `AUD-606-P01`, `AUD-606-P02` and `AUD-606-I01`.
+The existing `AUD-604-R01` and `AUD-605` release-artifact verification items
+remain unchanged.
+
 **External pack audit received, 2026-08-26 - `AUD-605`.**
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md)
 adds two rows: `AUD-605-G01`, where an unresolved test file broadened pack-gate unknown
@@ -25,7 +43,7 @@ checkout by `52bcc36` and `f89ae18`, with focused regression batteries passing;
 artefact verification remains pending. The pack's `--since` timing is additional evidence
 for `AUD-604-P01`, not a duplicate performance finding.
 
-**Current `5.8.30` queue:** artefact verification for `AUD-604-R01`; the two `AUD-605`
+**Previous `5.8.31` pack queue:** artefact verification for `AUD-604-R01`; the two `AUD-605`
 fixes are included in this release and await release-artefact verification.
 
 **External `5.8.28` audit received, 2026-08-26 - `AUD-604`.**

{sourcecode-5.8.30 → sourcecode-5.8.32}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,7 +3,11 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT QUEUE — release `5.8.30`, following the external pack audit of `5.8.28`, received 2026-08-26.** `AUD-605-G01` (P2,
+> **CURRENT QUEUE — release `5.8.32`, following the external audit of `5.8.31`, received 2026-08-26.** `AUD-606-O01` (P2,
+> posture diff explicit `--limit` was ineffective on the auditor's nested output but is not reproduced in the current
+> checkout) and `AUD-606-R01` (P2, heterogeneous `retrieve` target flags) is fixed in the current checkout by `be16c04`. `AUD-606-P01` is a one-sample cold-cache improvement requiring
+> controlled confirmation; `AUD-606-P02` and `AUD-606-I01` are inconclusive measurements, not confirmed regressions.
+> `AUD-605-G01` (P2,
 > unresolved test files broadened pack-gate uncertainty to unrelated endpoints) and `AUD-605-U01` (P2, pack assessment did not
 > forward foreground progress) are implemented in the current checkout in commits `52bcc36` and `f89ae18`; focused batteries pass.
 > The pack audit adds evidence to `AUD-604-P01`, but does not open a duplicate performance row.
@@ -13,9 +17,60 @@ customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 > `AUD-604-P01` is closed as an unconfirmed, non-attributable signal after controlled profiling.
 > Full evidence is
 > in [`AUDIT-2026-08-26-EXTERNAL-5.8.28.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28.md).
-> Pack evidence is in [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md). Release-artifact
+> Pack evidence is in [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md). The latest audit
+> synthesis is in [`AUDIT-2026-08-26-EXTERNAL-5.8.31.md`](AUDIT-2026-08-26-EXTERNAL-5.8.31.md). Release-artifact
 > verification of the two pack fixes remains after `AUD-604-R01`.
 
+> **STRATEGY DECISION — 2026-08-26.** Two external strategy reports were reconciled into
+> [`STRATEGY-2026-08-26-AGENT-CONTEXT.md`](STRATEGY-2026-08-26-AGENT-CONTEXT.md).
+> The winning route is verified Spring domain context infrastructure for agentic coding and CI platforms:
+> reliability and semantic accuracy first, then a stable MCP/API contract, with `pack gate` as the adoption wedge.
+> Generic multi-framework expansion, dashboards, consulting-led positioning and a premature `ask defects` command
+> are deferred or rejected. This supersedes conflicting strategy suggestions below while preserving them as history.
+
+## Current Product Direction
+
+This is the adopted interpretation of the external strategy report. It supersedes
+the report's broader or duplicate proposals while retaining the historical queues
+below as evidence. The governing product boundary remains the deterministic,
+source-backed Java/Spring evidence layer in [`PRODUCT-ROUTE.md`](PRODUCT-ROUTE.md).
+
+### Fixes
+
+| ID | Priority | Scope | Acceptance criteria | Status/order |
+|---|---:|---|---|---|
+| `DIR-F01` | P1 | Replace pattern-only security decisions with shared semantic authorities. Distinguish definitions from invocations and production code from tests, examples and library code. | Each affected rule has a named population, source-backed reason and `non_coverage`; false-positive fixtures cover the reported `SEC-004` / `DEAD-001` shapes. | **Implemented:** current security scans exclude platform definitions, imports, Javadoc and live controls; future rules must use the same authority. |
+| `DIR-F02` | P1 | Extend safe guardrails to genuinely heavy commands and compositions. | A bounded run stops the phase doing the work, publishes partial counts and confidence reduction, preserves completed evidence, and never presents an advisory-only command as enforceable. | **Implemented:** `BUDGETED_ANALYSIS_COMMANDS`, `PhasedRun` and partial-answer contracts bind the current heavy population. New heavy commands must join this registry. |
+| `DIR-F03` | P1 | Finish CI gate ergonomics without weakening its evidence contract. | Verify the `5.8.32` pack fixes in release artefacts, then add only evidence-backed improvements such as PR-native change resolution and selective component control. `AUD-605-G01` is already fixed; test-only unresolved files must not return as a roadmap item. | **Implemented in `d662ca3` and `ea27e27`:** `pack gate --pr` uses GitHub changed files and requires the exact local base SHA; MCP exposes the same PR mode and selective assessment control. Release-artifact verification remains. |
+| `DIR-F04` | P2 | Consolidate reusable semantic predicates used by security and dead-code rules. | One authority is consumed by all relevant rules; population and parity tests prevent a rule from silently reverting to textual matching. This is an implementation constraint, not a new user-facing command. | **Implemented for current rules:** `source_text` owns comment/Javadoc views and security scans consume them. Future rules remain bound to this constraint. |
+| `DIR-F05` | P2 | Continue operational observability for cost and confidence. | Timed answers publish cache state, phase/component progress, coverage, confidence and attributable run conditions; no cross-repository SLA or single-machine duration promise is published. | **Implemented for current timed surfaces;** continuous admission rule for new ones. |
+
+### Features
+
+| ID | Priority | Feature | Boundary and acceptance criteria | Status/order |
+|---|---:|---|---|---|
+| `DIR-X01` | P1 | Narrow Spring data-flow analysis. | Start with HTTP inputs, SQL/command/network/template sinks and explicit sanitizers. Publish confirmed paths, confidence and non-coverage; do not claim CodeQL-equivalent coverage. Design only after `DIR-F01` and `DIR-F02` are stable. | Conditional medium-term bet |
+| `DIR-X02` | P2 | CI and developer-surface integrations. | Prefer a thin GitHub Action and existing SARIF/CI renderers over another analyzer. A future IDE integration must consume ASK JSON/MCP evidence, preserve attribution and add no second semantic model. | **Implemented baseline:** MCP, SARIF and GitHub/GitLab renderers ship. A distributable Action or IDE surface needs named-buyer validation. |
+| `DIR-X03` | P2 | Selective and reusable pack execution. | `pack assessment` may select or reuse declared components only when tree state, inputs and fingerprints prove reuse; the manifest must say what ran and what was reused. This extends existing `S-24`, not a new pack architecture. | **Selection implemented in `9f4c0e1` and exposed through MCP in `ea27e27`:** declared components run in canonical order and omissions are published. Artifact reuse remains evidence-gated. |
+| `DIR-X04` | P3 | Targeted Spring ecosystem coverage. | Admit Spring Cloud, GraphQL or another adjacent surface only when a named buyer supplies a reproducible gap and the new parser/rule set preserves the same evidence contract. | Evidence-gated |
+
+### Explicitly Rejected
+
+These are not roadmap work: `--format` and `--compact` remain separate contracts;
+`ask defects` is not a product priority; broad .NET/Node/TypeScript expansion is
+deferred; ML-based prioritisation and automatic refactoring stay outside ASK's
+deterministic core; SBOM/dashboard/hosted-agent scope is outside the product route;
+and competitor accuracy claims require a reproducible benchmark before they can be
+documented as facts.
+
+### Decision Order
+
+1. Verify the `5.8.32` release artefacts, especially Windows detached execution and packs.
+2. Keep `DIR-F01`, `DIR-F02`, `DIR-F04` and `DIR-F05` as admission constraints for every new rule or heavy command.
+3. Validate `DIR-F03` and `DIR-X03` on named CI repositories before adding artifact reuse or a packaged Action.
+4. Design `DIR-X01` only after a source/sink/sanitizer corpus establishes its coverage contract; admit `DIR-X04` only from buyer evidence.
+5. Keep all rejected items out of active planning unless the product route is explicitly revised.
+
 > **Previous queue — external audit of `5.8.27`, received 2026-08-26.** `AUD-603-R01` (P1,
 > detached worker exits because the module entry point is not invoked) -> `AUD-603-S01`
 > (P1, DEAD-001 comment-prose false positive) -> `AUD-603-O01` (P2, posture diff compact

{sourcecode-5.8.30 → sourcecode-5.8.32}/docs/EXECUTIVE-ROADMAP.md

@@ -5,7 +5,15 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
-> **CURRENT STATUS — release `5.8.30`, following the `5.8.28` external audit intake, 2026-08-26.** The semantic
+> **CURRENT STATUS — release `5.8.32`, following the `5.8.31` external audit intake, 2026-08-26.** The latest
+> audit leaves one actionable residue: `AUD-606-R01` (inconsistent target option names across `retrieve`),
+> fixed in the current checkout by `be16c04`.
+> `AUD-606-O01` (posture diff explicit `--limit`) is retained as an external-subject follow-up because it does
+> not reproduce in the current checkout. The reported cold-cost
+> improvement needs controlled samples; `pack gate` timing and `/dev/null` stdin behaviour remain inconclusive.
+> Details are in [`AUDIT-2026-08-26-EXTERNAL-5.8.31.md`](AUDIT-2026-08-26-EXTERNAL-5.8.31.md).
+>
+> The semantic
 > regression matrix remains green: detached execution, DEAD-001 comment handling,
 > Boot 3 applicability, non-interactive selftest scope communication, nested diff
 > bounding and help timing guidance are confirmed fixed. The reported cold-cost signal
@@ -28,6 +36,37 @@
 > not a separate regression claim. Details are in
 > [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md).
 
+> **ADOPTED DIRECTION — strategy review, 2026-08-26.** ASK will deepen its existing
+> moat instead of becoming a general SAST or AI platform. Semantic security accuracy,
+> safe guardrails and honest operational metrics are now implementation constraints;
+> CI gate ergonomics and selective pack execution are implemented in `d662ca3` and
+> `ea27e27`. The remaining strategic candidates are a narrowly scoped Spring data-flow
+> prototype and evidence-led coverage of adjacent Spring surfaces.
+
+> **STRATEGY RECONCILIATION — two reports, 2026-08-26.** The selected route is
+> deterministic Spring domain context infrastructure for agentic coding and CI platforms:
+> reliability first, then a stable MCP/API integration contract, with `pack gate` as the entry wedge.
+> Spring remains the focus; generic framework expansion, dashboards, consulting-led positioning and a premature
+> `ask defects` product surface are deferred or rejected. The full decision and rationale are in
+> [`STRATEGY-2026-08-26-AGENT-CONTEXT.md`](STRATEGY-2026-08-26-AGENT-CONTEXT.md).
+
+> **What this means in practice.** Every fix must name its analysed population, source
+> authority, confidence and non-coverage, and ship with a regression fixture. Every new
+> feature must reuse the shared semantic model, preserve deterministic evidence and have
+> a named buyer or reproducible user gap. `AUD-605-G01` is already fixed in 5.8.32; it is
+> not reopened as a future feature merely because the report described the old behaviour.
+
+> **Explicitly out of scope.** `--format` and `--compact` remain separate contracts;
+> a defect-ledger command, broad .NET/Node/TypeScript support, ML prioritisation,
+> automatic refactoring, generic SBOM/dashboard management and a hosted coding agent
+> are rejected for this route. Competitor accuracy figures are not roadmap evidence
+> without a reproducible benchmark.
+
+> **Order:** verify the 5.8.32 artefacts; validate the new CI/pack paths with named buyers;
+> then admit data-flow only with a source/sink/sanitizer corpus and ecosystem work only with
+> buyer evidence. Detailed IDs, boundaries and acceptance criteria are in
+> [`DEVELOPMENT-ROADMAP.md`](DEVELOPMENT-ROADMAP.md) under *Current Product Direction*.
+
 > **CURRENT STATUS — `5.8.26` external audit intake, 2026-08-23.** The active engineering
 > queue is `impact-chain` bounded-output regression, `posture --diff --compact` usability,
 > deterministic root fingerprints, sustained warm-path performance and closure-provenance

{sourcecode-5.8.30 → sourcecode-5.8.32}/docs/MANUAL-USUARIO.md

@@ -75,6 +75,8 @@ los agrupan para un flujo de trabajo completo:
 ask pack list
 ask pack assessment . --profile prod --output-dir .ask/packs/assessment
 ask pack gate . --since origin/main --output-dir .ask/packs/gate
+ask pack assessment . --only risk,posture --output-dir .ask/packs/assessment
+ask pack gate . --pr 123 --output-dir .ask/packs/gate
 ```
 
 `assessment` entrega la foto de modernización y riesgo. `gate` entrega
@@ -96,8 +98,21 @@ GitHub Actions o GitLab:
 ```bash
 ask pack gate . --since origin/main --format github-actions
 ask pack gate . --since origin/main --format gitlab
+ask pack gate . --since origin/main --format sarif -o gate.sarif
 ```
 
+`pack assessment --only` permite ejecutar solo los componentes declarados que
+necesite el flujo. El `manifest` deja constancia de los componentes omitidos;
+`audit-report` requiere incluir también `risk`.
+
+`pack gate --pr NUMBER` obtiene los ficheros modificados mediante el `gh` local
+y usa el commit base exacto de la pull request. Ese commit debe estar disponible
+localmente; no hace `fetch` ni modifica el repositorio y es incompatible con
+`--since`.
+
+El formato `sarif` del gate genera un SARIF 2.1.0 acotado a las decisiones
+propias de ASK. No vuelve a emitir resultados de analizadores externos.
+
 El `manifest` identifica cada componente, su invocación y su fingerprint. Un
 resultado `BLOCK` o `UNVERIFIED` sigue siendo un resultado estructurado; el
 código de salida es la señal que debe consumir el pipeline.
@@ -985,7 +1000,8 @@ foto).
 
 ```bash
 ask cache status      # estadísticas de la caché del repo
-ask cache warm        # pre-construye la caché antes de una sesión
+ask cache warm        # pre-construye todas las vistas declaradas
+ask cache warm . --views compact,agent  # limita el calentamiento a esas vistas
 ask cache clear       # borra las fotos cacheadas del repo
 ask cache freshness   # frescura del RIS respecto al HEAD de git actual
 ask cache model .     # qué mejora realmente una caché caliente por comando
@@ -1017,8 +1033,12 @@ Además de las consultas individuales, MCP expone los packs como operaciones
 estructuradas de alto nivel:
 
 - `get_assessment_pack`: assessment de modernización y riesgo con `manifest` e
-  identidad de cada componente.
+  identidad de cada componente. Admite `only` como lista de componentes para
+  una evaluación acotada; las omisiones quedan registradas como no cubiertas.
 - `get_change_safety_gate`: gate de cambios con `PASS`, `BLOCK` o `UNVERIFIED`.
+  Acepta `since` para una referencia Git local o `pr` para resolver una pull
+  request mediante `gh`; son opciones mutuamente excluyentes y el SHA base debe
+  estar disponible localmente.
 
 Ambas herramientas usan `compact=true` por defecto para agentes. Un resultado
 `BLOCK` o `UNVERIFIED` es una respuesta válida con datos, no un error de

{sourcecode-5.8.30 → sourcecode-5.8.32}/docs/PRODUCT-ROUTE.md

@@ -43,8 +43,12 @@ The assessment pack composes `migrate-check`, `posture`, `endpoints`,
 
 ```bash
 ask pack assessment . --profile prod --output-dir .ask/packs/assessment
+ask pack assessment . --only risk,posture --output-dir .ask/packs/assessment
 ```
 
+`--only` runs a comma-separated subset of declared assessment components and
+records omitted components in the manifest. `audit-report` requires `risk`.
+
 When the repository contains several possible environments, pass the artefact
 that describes the deployment being assessed. The option is repeatable and
 keeps disagreement between deployment descriptions visible:
@@ -82,6 +86,16 @@ The gate composes `verify`, `verify-edit`, `posture --since` and
 ask pack gate . --since origin/main --output-dir .ask/packs/gate
 ```
 
+For a GitHub pull request, the gate can resolve the changed files directly:
+
+```bash
+ask pack gate . --pr 123 --output-dir .ask/packs/gate
+```
+
+This uses the local `gh` CLI and requires the pull request's exact base SHA to
+be available locally. It does not fetch or mutate the repository and cannot be
+combined with `--since`.
+
 Its exit contract is:
 
 - `0` / `PASS`: all component gates passed;
@@ -100,9 +114,13 @@ ask pack gate . --since origin/main --format github-actions
 
 # GitLab collapsible job-log section
 ask pack gate . --since origin/main --format gitlab
+
+# SARIF 2.1.0 decisions owned by ASK
+ask pack gate . --since origin/main --format sarif -o gate.sarif
 ```
 
-Both formats are bounded summaries only. Persist `--output-dir .ask/packs/gate`
+The CI formats are bounded summaries or decisions only. The SARIF renderer
+does not re-emit third-party scanner findings. Persist `--output-dir .ask/packs/gate`
 when the job must publish component evidence and the aggregate `pack.json`; use
 `--output FILE` when the aggregate needs a separately controlled path. The
 process exit code remains the only pass/fail signal for the job.