sourcecode 5.8.31__py3-none-any.whl → 5.8.32__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.31"
+__version__ = "5.8.32"

sourcecode/_build_commit.py

@@ -1,5 +1,5 @@
 """Generated at build time by hatch_build.py. Do not edit (AUD-592-D04)."""
 
-BUILD_COMMIT = '32e9b630f9276e5e481a33f0232c3a7876cd5751'
+BUILD_COMMIT = '4fcf033d0261c8c67fbce36a70f42a6456f90a69'
 CLOSURE_PROVENANCE = {'Window': {'commit': '', 'status': 'uncited'}, '`AUD-588-F05`': {'commit': '470e4a4', 'status': 'present'}, '`AUD-590-B01` / `B-01`, `F-01`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B02` / `B-02`, `F-02`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B03` / `B-03`, `F-03`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B04` / `B-04`, `F-04`': {'commit': '', 'status': 'uncited'}, '`AUD-590-R01` / `R-01`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A01` / `A-1`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A02` / `A-2`, `A-4`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A03` / `A-3`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A05` / `A-5`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A06` / `A-6`, `A-7`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A08` / `A-8`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A09` / `A-9`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A10` / `A-10`': {'commit': '', 'status': 'uncited'}, '`AUD-592-A02` / `A-1` second half, `§12.5`': {'commit': '63f3d61', 'status': 'present'}, '`AUD-592-B01` / `B-8`': {'commit': '8329614', 'status': 'present'}, '`AUD-592-D01` / `D-1`': {'commit': '0f8e03f', 'status': 'present'}, '`AUD-592-D02` / `D-2`': {'commit': '1d3db4d', 'status': 'present'}, '`AUD-592-D03` / `D-3`': {'commit': 'f28fe40', 'status': 'present'}, '`AUD-592-R01` / `A-1`': {'commit': '216025f', 'status': 'present'}, '`AUD-592-R02` / `N-4`, reopens `AUD-513-N04`': {'commit': 'ec3050d', 'status': 'present'}, '`AUD-593-N01` / `N-01`': {'commit': 'dd6a706', 'status': 'present'}, '`AUD-593-N02` / `N-02`': {'commit': 'f539787', 'status': 'present'}, '`AUD-593-N03` / `N-03`': {'commit': '1dd0b1c', 'status': 'present'}, '`AUD-593-N05` / `N-05`': {'commit': 'aa89388', 'status': 'present'}, '`AUD-593-N06` / `N-06`': {'commit': 'aa584a6', 'status': 'present'}, '`AUD-594-N04` / `D-5`, disclosure half of `B-3`': {'commit': 'a0060b7', 'status': 'present'}, '`AUD-594-X01` / `A-1`, residual of `AUD-593-N03`': {'commit': 'dd222b9', 'status': 'present'}, '`AUD-594-X02` / `A-1` second half': {'commit': '1193937', 'status': 'present'}, '`AUD-594-X03` / `X-03`, residual of `AUD-593-N01`': {'commit': 'e89e8f0', 'status': 'present'}, '`AUD-594-X04`': {'commit': '05b8cc9', 'status': 'present'}, '`AUD-595-A02` / `N-5`, advisory half of `AUD-588-B11`': {'commit': '3e15227', 'status': 'present'}, '`AUD-595-A03` / `B-6` exit-code half': {'commit': 'ab7285f', 'status': 'present'}, '`AUD-595-A05`': {'commit': 'e0b3d10', 'status': 'present'}, '`AUD-595-A07`, narrow half of `AUD-592-A02`': {'commit': 'cc15177', 'status': 'present'}, '`AUD-595-B01` / §B': {'commit': 'b77a1ad', 'status': 'present'}, '`AUD-595-Q01`': {'commit': '91a6566', 'status': 'present'}, '`AUD-596-A01` / `ASK-DET-001`': {'commit': 'fa508b4', 'status': 'present'}, '`AUD-596-A02` / `ASK-SELF-001`': {'commit': '4dfadc8', 'status': 'present'}, '`AUD-596-A03` / `ASK-C1-001`': {'commit': 'bffa3a6', 'status': 'present'}, '`AUD-596-A04` / `ASK-UX-003` + `ASK-UX-004`': {'commit': 'f0aac3c', 'status': 'present'}, '`AUD-596-B01` / `B-01`, harder witness for `BUG-6`': {'commit': '567d09d', 'status': 'present'}, '`AUD-596-B02` / `B-02`, class residual of `R2`': {'commit': '', 'status': 'uncited'}, '`AUD-596-B03` / `B-03`': {'commit': 'a8cb814', 'status': 'present'}, '`AUD-596-B06` / `B-06`': {'commit': '8107927', 'status': 'present'}, '`AUD-596-B07` / `B-07`, class residual of `AUD-592-R02`': {'commit': 'e060485', 'status': 'present'}, '`AUD-596-B09` / `B-09`': {'commit': '5b8146c', 'status': 'present'}, '`AUD-596-B10` / `B-10`': {'commit': '5cb994d', 'status': 'present'}, '`AUD-596-B16` / `B-16`': {'commit': '1507f69', 'status': 'present'}, '`AUD-596-D01` / `B-13` + `B-14`': {'commit': '0b1bdf0', 'status': 'present'}, '`AUD-596-D02` / `B-08`, residual of `AUD-594-N04`': {'commit': 'e7f73c3', 'status': 'present'}, '`AUD-596-D03` / `ASK-AGT-001`': {'commit': '8c46967', 'status': 'present'}, '`AUD-596-D04` / `B-18`': {'commit': '040f027', 'status': 'present'}, '`AUD-596-D05` / `B-19`': {'commit': 'fd2bf68', 'status': 'present'}, '`AUD-596-D06` / `B-20`': {'commit': '784cd83', 'status': 'present'}, '`AUD-596-D07` / `B-17`, half refuted': {'commit': 'c3ff822', 'status': 'present'}, '`AUD-596-D08` / `B-22`, class residual of `AUD-591-A06`': {'commit': 'b396c6a', 'status': 'present'}, '`AUD-596-D09` / `B-23`, surviving half of `B26`': {'commit': 'fd3d63f', 'status': 'present'}, '`AUD-596-D10` / `B-29`': {'commit': '', 'status': 'uncited'}, '`AUD-596-D11` / `ASK-UX-005`': {'commit': 'f4b4f77', 'status': 'present'}, '`AUD-596-D12` — six hints that send the reader back to the error': {'commit': '498df44', 'status': 'present'}, '`AUD-596-D13` / `B-28`': {'commit': '1014c72', 'status': 'present'}, '`AUD-596-D14` / `B-15`, narrow half of `B20`': {'commit': '10f2827', 'status': 'present'}, '`AUD-596-R01` / `B-05`': {'commit': '', 'status': 'uncited'}, '`AUD-596-X01` / `ASK-GATE-001`, gating half of `B24`': {'commit': 'e59c655', 'status': 'present'}, '`AUD-596-X02` / `ASK-UX-001` + `ASK-UX-002` + `B-21`': {'commit': 'f6ebf50', 'status': 'present'}, '`AUD-597-A01` / `ASK-UX-001` + `N-01`': {'commit': 'f8cf061', 'status': 'present'}, '`AUD-597-A02` / `ASK-UX-008` + `ASK-DOC-002`': {'commit': '9d47a4c', 'status': 'present'}, '`AUD-597-A03` / `ASK-DET-001`': {'commit': '4c7622a', 'status': 'present'}, '`AUD-597-A04` / `ASK-LEDGER-001`': {'commit': '46fb870', 'status': 'present'}, '`AUD-597-D01` / `B-04`': {'commit': '1094e6a', 'status': 'present'}, '`AUD-597-D02` / `ASK-DOC-001`': {'commit': 'ecb1bb7', 'status': 'present'}, '`AUD-597-D03` / `N-06`': {'commit': '9784333', 'status': 'present'}, '`AUD-597-D04` / `N-05`': {'commit': 'e51c087', 'status': 'present'}, '`AUD-597-D05` / `N-04`, fourth appearance of `C4-27`': {'commit': '9cccc15', 'status': 'present'}, '`AUD-597-D06` / `ASK-CLI-001`': {'commit': '178aa6d', 'status': 'present'}, '`AUD-597-D07` / `N-03`': {'commit': '9245e35', 'status': 'present'}, '`AUD-597-R01` / `ASK-PERF-001`': {'commit': '6910054', 'status': 'present'}, '`AUD-597-R02` / `ASK-ENC-001`': {'commit': 'ce6dac1', 'status': 'present'}, '`AUD-597-R03` / `ASK-UX-002`': {'commit': 'c57e50b', 'status': 'present'}, '`AUD-597-X01` / `ASK-BUILD-001` + `ASK-META-001` / `B-12`': {'commit': '354338b', 'status': 'present'}, '`AUD-598-B01` / `ASK-META-001`': {'commit': 'b2f7c65', 'status': 'present'}, '`AUD-598-B02` / `ASK-UX-002`': {'commit': '56a4bf7', 'status': 'present'}, '`AUD-598-B03` / `B-11`': {'commit': 'c63cb24', 'status': 'present'}, '`AUD-598-B04` / `N-02`': {'commit': '187937f', 'status': 'present'}, '`AUD-598-R01` / `ASK-PERF-002`': {'commit': '', 'status': 'uncited'}, '`AUD-598-X01` / `N-01` + `B-13` + `B-14` + `B-29` + `N-06`': {'commit': '6f2f5a4', 'status': 'present'}, '`AUD-600-B01` / `P-01`': {'commit': '366ffed', 'status': 'present'}, '`AUD-600-B02` / `P-02` + `ASK-PACK-002`': {'commit': '2a814c3', 'status': 'present'}, '`AUD-600-B03` / `ASK-PACK-001`': {'commit': '452f2a0', 'status': 'present'}, '`AUD-600-D01`': {'commit': '1224e1b', 'status': 'present'}, '`AUD-600-D02`': {'commit': 'eab8172', 'status': 'present'}, '`AUD-600-R01` / `R-01`': {'commit': '88add64', 'status': 'present'}, '`AUD-601-B01` / `N-02`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-B02` / `ASK-PACK-004`': {'commit': '', 'status': 'uncited'}, '`AUD-601-D01` / `N-01`, `ASK-UX-001`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-D02` / `B-13`, `B-14`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-M01` / `B-26`, `B-27` retracted': {'commit': '', 'status': 'uncited'}, '`AUD-601-R01` / `R-02`': {'commit': '', 'status': 'uncited'}, '`B-3`': {'commit': '773268d', 'status': 'present'}, '`B-6`': {'commit': '17c6e06', 'status': 'present'}, '`B-8`': {'commit': '8329614', 'status': 'present'}, '`BUG-3` / `443b345`': {'commit': '', 'status': 'uncited'}, '`BUG-4a` / `AUD-588-B11` residual': {'commit': '24b4185', 'status': 'present'}, '`BUG-4b` / `AUD-588-B11` residual': {'commit': '0376350', 'status': 'present'}, '`E-39`, class residual of `AUD-593-N06`': {'commit': '25fc11f', 'status': 'present'}, '`N-5`': {'commit': 'c68083f', 'status': 'present'}, '`N-7`': {'commit': '082e9de', 'status': 'present'}, '`R-1`': {'commit': '424fb1c', 'status': 'present'}, '`R-2`': {'commit': '5158b92', 'status': 'present'}, '`R-3`': {'commit': '88aec04', 'status': 'present'}, '`R-4`': {'commit': '04fd04f', 'status': 'present'}}
 CLOSURE_COVERAGE = {'closed_rows': 113, 'present': 88, 'absent': 0, 'unresolved': 0, 'uncited': 25, 'unknown': 0}

sourcecode/_docs/DEFECT-LEDGER.md

@@ -16,6 +16,24 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
+**External `5.8.31` audit received, 2026-08-26 - `AUD-606`.**
+[`AUDIT-2026-08-26-EXTERNAL-5.8.31.md`](AUDIT-2026-08-26-EXTERNAL-5.8.31.md)
+confirms the new progress and shared-cache controls, and records one actionable
+external-subject follow-up `AUD-606-O01`, where `posture --diff --compact --limit`
+was effectively unchanged on the auditor's nested output; the current checkout
+reproduces no such gap and its bounding batteries pass. It also opens the CLI
+consistency row `AUD-606-R01` for heterogeneous `retrieve` target flags, fixed
+in the current checkout by `be16c04` with help-parity coverage.
+The 137.8s cold run is a single-sample improvement and remains `AUD-606-P01`
+benchmark follow-up, not a parser regression. `AUD-606-P02` (`pack gate` timing)
+and `AUD-606-I01` (`pr-impact --files -` with `/dev/null`) are inconclusive due
+to process contamination and shell-specific stdin behaviour respectively.
+
+**Current `5.8.31` queue:** external-subject follow-up `AUD-606-O01`; controlled
+benchmark/portability follow-ups `AUD-606-P01`, `AUD-606-P02` and `AUD-606-I01`.
+The existing `AUD-604-R01` and `AUD-605` release-artifact verification items
+remain unchanged.
+
 **External pack audit received, 2026-08-26 - `AUD-605`.**
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md)
 adds two rows: `AUD-605-G01`, where an unresolved test file broadened pack-gate unknown
@@ -25,7 +43,7 @@ checkout by `52bcc36` and `f89ae18`, with focused regression batteries passing;
 artefact verification remains pending. The pack's `--since` timing is additional evidence
 for `AUD-604-P01`, not a duplicate performance finding.
 
-**Current `5.8.31` queue:** artefact verification for `AUD-604-R01`; the two `AUD-605`
+**Previous `5.8.31` pack queue:** artefact verification for `AUD-604-R01`; the two `AUD-605`
 fixes are included in this release and await release-artefact verification.
 
 **External `5.8.28` audit received, 2026-08-26 - `AUD-604`.**

sourcecode/_docs/USER_GUIDE.md

@@ -46,13 +46,13 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.8.31, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.8.32, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.8.31, with release-artifact verification
+the two pack fixes are included in release 5.8.32, with release-artifact verification
 remaining for detached execution and pack evidence.
 
 ---
@@ -115,6 +115,8 @@ ask pack list
 ask pack assessment . --profile prod --output-dir .ask/packs/assessment
 ask pack gate . --since origin/main --compact --output-dir .ask/packs/gate
 ask pack assessment . --format markdown -o assessment.md
+ask pack assessment . --only risk,posture --output-dir .ask/packs/assessment
+ask pack gate . --pr 123 --output-dir .ask/packs/gate
 ```
 
 To include deployment evidence, pass the environment artefacts that describe
@@ -129,8 +131,25 @@ The gate can emit native annotations for CI logs:
 ```bash
 ask pack gate . --since origin/main --format github-actions
 ask pack gate . --since origin/main --format gitlab
+ask pack gate . --since origin/main --format sarif -o gate.sarif
 ```
 
+`pack assessment --only` selects a comma-separated subset of the declared
+assessment components. The manifest records omitted components;
+`audit-report` may be selected only together with `risk`.
+
+MCP `get_assessment_pack` exposes the same capability through its `only`
+`list[str]` input. It uses the declared component order and validation rules;
+the reproducible CLI command in the `mcp` projection includes the selection.
+
+`pack gate --pr NUMBER` resolves changed files through the local `gh` CLI and
+uses the pull request's exact base commit. The base commit must already exist
+locally; the command does not fetch or modify the repository and cannot be
+combined with `--since`.
+
+The `sarif` gate format is a bounded SARIF 2.1.0 export of ASK-owned gate
+decisions. It does not re-emit findings produced by third-party scanners.
+
 The pack JSON preserves `manifest`, identity, fingerprints, evidence and each
 component's partial status. `PASS`, `BLOCK` and `UNVERIFIED` are data
 decisions; the process exit code is the pipeline signal. When `--output-dir` is
@@ -139,6 +158,10 @@ component remains a separate JSON artifact. An explicit `--output FILE` takes
 precedence. See the
 [Product Route contract](PRODUCT-ROUTE.md) for the boundaries.
 
+The MCP `get_change_safety_gate` tool accepts the same two comparison modes:
+`since` for a local Git ref or `pr` for GitHub pull-request resolution through
+the local `gh` CLI. Pass exactly one; PR mode requires the base SHA locally.
+
 See [Product Route](PRODUCT-ROUTE.md) for the evidence contract and scope.
 
 A distinct set of commands exists to feed **AI coding agents** rather than to be read by a
@@ -183,7 +206,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.31
+# ask 5.8.32
 ```
 
 Requires Python 3.9+.
@@ -1284,7 +1307,7 @@ explaining. The rest do one thing; `ask <command> --help` is the whole story.
 | `ask rename-class` | supported | Word-boundary Java rename across the repository |
 | `ask schema <name>` | supported | Print a published JSON Schema for this tool's output |
 | `ask archetype` | experimental | Evidence-based architectural archetype across four dimensions |
-| `ask retrieve` | parked | Typed knowledge queries over the model — kept working, no longer developed |
+| `ask retrieve` | parked | Typed knowledge queries over the model — kept working, no longer developed. Symbol-oriented queries accept `--target/-t`; `--module/-m`, `--subsystem/-s` and `--endpoint/-e` remain compatible domain aliases. |
 | `ask baseline capture\|diff\|trend` | supported | Versioned architectural metrics over time; see [`ask trend`](#ask-trend-dir--how-the-architecture-moved) |
 | `ask cache status\|warm\|model\|clear\|freshness` | supported | Cache inspection; `ask cache model` states what a warm buys each command |
 | `ask config` · `ask version` · `ask activate` · `ask auth` · `ask telemetry` · `ask mcp` | supported | Configuration, version, licence, authentication, telemetry (on by default), MCP integration |
@@ -1443,6 +1466,16 @@ the **RIS**, builds the **shared Canonical IR** and fills the **parse cache**. I
 `--exclude` change *what is analysed*, so they miss the warmed core and rescan — that is the
 171s the field measured after a 103s warm.
 
+Select the root views needed by a workflow explicitly:
+
+```bash
+ask cache warm . --views compact
+ask cache warm . --views compact,agent
+```
+
+Without `--views`, all declared root views are warmed. `cache model` reports the
+same per-view contract and names any view that was skipped.
+
 What invalidates what:
 
 - **Any change to the analysed files** → every layer keys on one signature of the tree state:

sourcecode/cli.py

@@ -17511,7 +17511,9 @@ def retrieve_subsystem_inventory_cmd(
 
 @retrieve_app.command("subsystem-members")
 def retrieve_subsystem_members_cmd(
-    subsystem: str = typer.Option(..., "--subsystem", "-s", help="Subsystem label or package prefix."),
+    subsystem: str = typer.Option(
+        ..., "--subsystem", "--target", "-s", "-t", help="Subsystem label or package prefix."
+    ),
     path: Path = typer.Argument(Path("."), help="Repository path (default: current directory)"),
     output_path: Optional[Path] = typer.Option(None, "--output", "-o", help="Write output to a file."),
     trace: bool = typer.Option(False, "--trace", help="Include the Query Plan Runtime trace."),
@@ -17530,7 +17532,9 @@ def retrieve_subsystem_members_cmd(
 
 @retrieve_app.command("module-dependents")
 def retrieve_module_dependents_cmd(
-    module: str = typer.Option(..., "--module", "-m", help="Module path or package prefix."),
+    module: str = typer.Option(
+        ..., "--module", "--target", "-m", "-t", help="Module path or package prefix."
+    ),
     path: Path = typer.Argument(Path("."), help="Repository path (default: current directory)"),
     output_path: Optional[Path] = typer.Option(None, "--output", "-o", help="Write output to a file."),
     trace: bool = typer.Option(False, "--trace", help="Include the Query Plan Runtime trace."),
@@ -17549,7 +17553,9 @@ def retrieve_module_dependents_cmd(
 
 @retrieve_app.command("module-dependencies")
 def retrieve_module_dependencies_cmd(
-    module: str = typer.Option(..., "--module", "-m", help="Module path or package prefix."),
+    module: str = typer.Option(
+        ..., "--module", "--target", "-m", "-t", help="Module path or package prefix."
+    ),
     path: Path = typer.Argument(Path("."), help="Repository path (default: current directory)"),
     output_path: Optional[Path] = typer.Option(None, "--output", "-o", help="Write output to a file."),
     trace: bool = typer.Option(False, "--trace", help="Include the Query Plan Runtime trace."),
@@ -17587,7 +17593,9 @@ def retrieve_type_dependents_cmd(
 
 @retrieve_app.command("endpoint-contract")
 def retrieve_endpoint_contract_cmd(
-    ref: str = typer.Option(..., "--endpoint", "-e", help="Endpoint path or handler symbol."),
+    ref: str = typer.Option(
+        ..., "--endpoint", "--target", "-e", "-t", help="Endpoint path or handler symbol."
+    ),
     path: Path = typer.Argument(Path("."), help="Repository path (default: current directory)"),
     output_path: Optional[Path] = typer.Option(None, "--output", "-o", help="Write output to a file."),
     trace: bool = typer.Option(False, "--trace", help="Include the Query Plan Runtime trace."),
@@ -17606,7 +17614,9 @@ def retrieve_endpoint_contract_cmd(
 
 @retrieve_app.command("endpoint-security")
 def retrieve_endpoint_security_cmd(
-    ref: str = typer.Option(..., "--endpoint", "-e", help="Endpoint path or handler symbol."),
+    ref: str = typer.Option(
+        ..., "--endpoint", "--target", "-e", "-t", help="Endpoint path or handler symbol."
+    ),
     path: Path = typer.Argument(Path("."), help="Repository path (default: current directory)"),
     output_path: Optional[Path] = typer.Option(None, "--output", "-o", help="Write output to a file."),
     trace: bool = typer.Option(False, "--trace", help="Include the Query Plan Runtime trace."),

sourcecode/mcp/server.py

@@ -300,7 +300,9 @@ def _pack_mcp_projection(
     *,
     repo_path: str,
     compact: bool,
+    selected_components: list[str] | None = None,
     since: str | None = None,
+    pr: int | None = None,
 ) -> dict[str, Any]:
     """Cap a pack for MCP without dropping its decision or evidence identity."""
     # MCP adds adapter metadata; never mutate the canonical pack returned by
@@ -310,8 +312,12 @@ def _pack_mcp_projection(
         return result
     command = "ask pack assessment" if tool_name == "get_assessment_pack" else "ask pack gate"
     args = f"{command} <repo>"
+    if selected_components:
+        args += f" --only {','.join(selected_components)}"
     if since:
         args += f" --since {since}"
+    elif pr is not None:
+        args += f" --pr {pr}"
     result["mcp"] = {
         "schema_version": MCP_PACK_PROJECTION_SCHEMA,
         "compact": compact,
@@ -385,6 +391,7 @@ def get_assessment_pack(
     repo_path: str = ".",
     profile: str = "",
     deployment: list[str] | None = None,
+    only: list[str] | None = None,
     compact: bool = True,
 ) -> dict:
     """Modernization and Risk Assessment pack for agents.
@@ -398,6 +405,10 @@ def get_assessment_pack(
     ``deployment`` is repeatable and names the deployment artefact(s) used to
     resolve the active profile: Kubernetes, Compose, Dockerfile, WebLogic,
     dotenv or launch script. It cannot be combined with ``profile``.
+
+    ``only`` selects a bounded subset of assessment components using the same
+    validation and execution order as the CLI ``--only`` option. Omitted
+    components are recorded as non-covered in the pack evidence.
     """
     _raw = repo_path
     try:
@@ -414,6 +425,15 @@ def get_assessment_pack(
                 INVALID_INPUT_CODE,
                 expected="list[str]",
             )
+        if only is not None and (
+            not isinstance(only, list)
+            or any(not isinstance(item, str) or not item.strip() for item in only)
+        ):
+            return _err(
+                "only must be a list of non-empty component names",
+                INVALID_INPUT_CODE,
+                expected="list[str]",
+            )
         if profile.strip() and deployment:
             return _err(
                 "profile and deployment cannot be combined",
@@ -424,16 +444,23 @@ def get_assessment_pack(
         path_err = _check_repo_path(repo_path)
         if path_err is not None:
             return path_err
-        from sourcecode.packs import run_assessment
+        from sourcecode.packs import assessment_components, run_assessment
+
+        try:
+            selected_components = assessment_components(only)
+        except ValueError as exc:
+            return _err(str(exc), INVALID_INPUT_CODE, expected="Declared assessment components.")
 
         data = run_assessment(
             Path(repo_path),
             profile=profile.strip() or None,
             deployment=[Path(item) for item in (deployment or [])] or None,
             compact=compact,
+            selected_components=selected_components,
         )
         return _ok(_pack_mcp_projection(
             "get_assessment_pack", data, repo_path=repo_path, compact=compact,
+            selected_components=selected_components if only is not None else None,
         ))
     except Exception as exc:
         return _err(
@@ -446,6 +473,7 @@ def get_assessment_pack(
 def get_change_safety_gate(
     repo_path: str = ".",
     since: str = "",
+    pr: int | None = None,
     profile: str = "",
     allow_unverified: bool = False,
     compact: bool = True,
@@ -455,18 +483,32 @@ def get_change_safety_gate(
     Returns the structured ``PASS``, ``BLOCK`` or ``UNVERIFIED`` pack with its
     component evidence and manifest. The response is report-only for MCP: a
     blocking or unverified result is data the agent must inspect, not a tool
-    transport error. ``since`` is required because the gate compares two states.
+    transport error. Exactly one of ``since`` or ``pr`` is required. ``pr``
+    resolves the GitHub pull request through the local ``gh`` CLI and requires
+    its base commit to exist locally.
     """
     _raw = repo_path
     try:
         if not isinstance(repo_path, str):
             return _err("repo_path must be a string", INVALID_INPUT_CODE)
-        if not isinstance(since, str) or not since.strip():
+        if not isinstance(since, str):
             return _err(
-                "since must be a non-empty git ref",
+                "since must be a string",
                 INVALID_INPUT_CODE,
-                hint="Pass since, for example `origin/main` or `HEAD~1`.",
-                expected="Non-empty git ref.",
+                expected="A git ref string or a pull request number.",
+            )
+        if pr is not None and (not isinstance(pr, int) or isinstance(pr, bool) or pr <= 0):
+            return _err(
+                "pr must be a positive pull request number",
+                INVALID_INPUT_CODE,
+                expected="Positive integer.",
+            )
+        if bool(since.strip()) == (pr is not None):
+            return _err(
+                "exactly one of since or pr is required",
+                INVALID_INPUT_CODE,
+                hint="Pass since for a local ref, or pr for GitHub pull-request mode.",
+                expected="One non-empty git ref or one positive pull request number.",
             )
         if not isinstance(profile, str):
             return _err("profile must be a string", INVALID_INPUT_CODE)
@@ -476,16 +518,32 @@ def get_change_safety_gate(
             return path_err
         from sourcecode.packs import run_gate
 
+        comparison_ref = since.strip()
+        if pr is not None:
+            try:
+                from sourcecode.github_diff import pull_request_base_ref
+
+                comparison_ref, _description = pull_request_base_ref(repo_path, pr)
+            except Exception as exc:
+                return _err(
+                    str(exc),
+                    INVALID_INPUT_CODE,
+                    hint="Ensure gh is installed/authenticated and the PR base commit is local.",
+                    expected="A resolvable GitHub pull request with a local base commit.",
+                )
+
         data = run_gate(
             Path(repo_path),
-            since=since.strip(),
+            since=comparison_ref,
+            pr=pr,
             profile=profile.strip() or None,
             allow_unverified=allow_unverified,
             compact=compact,
         )
         return _ok(_pack_mcp_projection(
             "get_change_safety_gate", data, repo_path=repo_path, compact=compact,
-            since=since.strip(),
+            since=since.strip() or None,
+            pr=pr,
         ))
     except Exception as exc:
         return _err(

{sourcecode-5.8.31.dist-info → sourcecode-5.8.32.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.31
+Version: 5.8.32
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.31-blue)
+![Version](https://img.shields.io/badge/version-5.8.32-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -88,6 +88,8 @@ workflow-shaped packs for users who want one consumable result:
 ask pack assessment . --profile prod --output-dir .ask/packs/assessment
 ask pack gate . --since origin/main --output-dir .ask/packs/gate
 ask pack assessment . --format markdown -o assessment.md
+ask pack assessment . --only risk,posture --output-dir .ask/packs/assessment
+ask pack gate . --pr 123 --output-dir .ask/packs/gate
 ```
 
 For deployment-aware posture evidence, pass the artefacts that describe the
@@ -104,8 +106,17 @@ contract:
 ```bash
 ask pack gate . --since origin/main --format github-actions
 ask pack gate . --since origin/main --format gitlab
+ask pack gate . --since origin/main --format sarif -o gate.sarif
 ```
 
+`pack gate --pr NUMBER` uses the local `gh` CLI to resolve changed files and
+the exact base commit; the base SHA must already exist locally. It does not
+fetch or modify the repository. `pack assessment --only` runs named assessment
+components and records omissions in the manifest. MCP's
+`get_assessment_pack` accepts the same selection as `only: list[str]` and
+returns the reproducible CLI command in its `mcp` projection. SARIF is a bounded
+export of ASK-owned gate decisions, not a re-emission of third-party findings.
+
 `PASS`, `BLOCK` and `UNVERIFIED` are data decisions. The process exit code is
 the CI signal; `--allow-unverified` can change only that exit code, never the
 reported verdict. Every pack carries a manifest with component invocations,
@@ -177,18 +188,19 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.8.31 retains the shared Canonical IR
+**Current performance status.** Release 5.8.32 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
 and bounded-output regressions for this release; use `ask cache model <repo>` and
 `--progress stderr` for supervised runs, and consult the
-[active pack audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md) before
+[latest external audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.31.md) before
 treating a historical timing or bounded flag as a current guarantee.
 
-**What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
+**What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
-IR) and the **compact view**. Pass `--agent` to warm the agent view as well. Deeper projections
+IR). Pass `--views compact` or `--views compact,agent` to warm only selected views; without
+`--views`, all declared views are warmed. Deeper projections
 are separate keys and are *not* covered by either — `--full`, `--env-map` and a raised `--depth`
 recompute on first use, as do most `prepare-context` tasks. Measured on a 3,342-file Spring
 monolith: `cache warm` 103s → `--compact --git-context` 1s (hit), but `--agent --full --env-map
@@ -210,7 +222,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.31 — and, on a build that has aged,
+ask version                    # ask 5.8.32 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -479,7 +491,7 @@ from it.
 | `plan` / `compare` / `delta` / `contract-diff` | supported | what to review for a change; candidates by measured cost; outcome of a change; public-contract break | no verdicts, measured cost only |
 | `validation` | supported | request-body validation coverage and gaps | |
 | `baseline capture\|diff` · `trend` | supported | versioned architectural metrics over time; `ask trend .` reads the series (a repository path or a baselines directory), `ask baseline diff .` compares the tree against its newest point | trend reporting, not gating. Baselines land in `.ask/baselines` **inside the repository** — the history travels with the code, not with a vendor; an audit that must not write passes `--dir`. `capture --auto` is the unattended form (one baseline per commit, never rewrites one, never fails the build) — automate it: [baseline-ci.yml](docs/baseline-ci.yml) |
-| `retrieve` | parked | typed knowledge queries over the model | |
+| `retrieve` | parked | typed knowledge queries over the model | symbol-oriented queries accept `--target/-t`; domain aliases such as `--module/-m`, `--subsystem/-s` and `--endpoint/-e` remain supported |
 | `timeline` | experimental | since when a number moved, and in which commit window | walks the commit series and re-runs the shipped analyses (`posture`, `data-exposure`, `endpoints`, `spring-audit`) on a read-only materialisation of each sampled tree; publishes transitions, not a per-commit dump. A sample that could not be analysed is `null` with a reason, never 0, and a transition under sampling carries the window it could have happened in |
 | `regress` | supported | what moved between two payloads of the same command, and which declaration accounts for it | attributes each delta to a declaration the answers carry (`test_source_excluded`, `symbols_excluded`, `coverage.gaps`, `*_cap`, `waivers`); a delta nothing explains is `unattributed`. Refuses the comparison when `cache_layers`, `base_env` or the analyzer fingerprint differ |
 | `explain-endpoint` | supported | the derivation behind one route's verdict | six steps — match, declaration, handler, chain, profiles, verdict — each naming the authority that produced it and the file it can be checked against; a step that could not be derived is `undetermined` with the reason, never absent |

{sourcecode-5.8.31.dist-info → sourcecode-5.8.32.dist-info}/RECORD

@@ -1,6 +1,6 @@
-sourcecode/__init__.py,sha256=x6huFekCWuzbMyWgV9DNW6WDTwRfZV3q9UlfspK-7AY,309
+sourcecode/__init__.py,sha256=N1r9fCES7GZKl-MnDEPXkIXKvlci7HGDYyd9T2K3GrQ,309
 sourcecode/__main__.py,sha256=qDFVkobwsdZrX0B3stiRqsUNivVpybKO-egzAwCW4xw,165
-sourcecode/_build_commit.py,sha256=gOxdbVEG8QZSIEAPML8CaTzP3DaBaqHqkVEV25ceY4U,8740
+sourcecode/_build_commit.py,sha256=zfltecl0ZxCjQsc4q7xcTp8qCwPBFSsHSPdUQeKA_u4,8740
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/analysis_budget.py,sha256=ZuNEboPF8A6GK-_V7WNt92ezgriga7_Rbr-vvSN4UEE,4183
 sourcecode/answer_bounds.py,sha256=_51_DCuYEUmI_xwUFxDMiprSavkNakkLiIBbPjevQ3M,9793
@@ -31,7 +31,7 @@ sourcecode/change_plan.py,sha256=drAoDsqFplutCLc6Y0xue7sYkTls0SpYh7aOXvttv3I,129
 sourcecode/ci_output.py,sha256=X4NRokWWMRF9Ex8OQrEO2g04GzJ00GDP5zYIoqI9YCc,4625
 sourcecode/cir_graphs.py,sha256=RytqSv1WF8kdlfXj2fPQz16LY4akS2kyThbdWL8beCQ,14835
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=kA6mou1cf-9nQ90E2K9oGNTFplI2BReBcTPjPUcTDVs,869605
+sourcecode/cli.py,sha256=F32dO1oD7NPdyS6LfkKQhnbjDfYj_VzJknBWjm8joVU,869765
 sourcecode/client_calls.py,sha256=YOPnfRZzRyqmdHvXSVeiunW8cuiuCuWXacNIQRgKMCw,22640
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=Lnfmm9I3k0H1jP1tV6ZJ-R7znjQPLPLCe5TzV1Jb_PM,15323
@@ -221,7 +221,7 @@ sourcecode/mcp/dependency_import.py,sha256=wfvw1rmDE3n2mHDj-yHnCuy9HZ7TtPqsHG2BU
 sourcecode/mcp/orchestrator.py,sha256=RUzx2uRfwk-rnEy1RKeXjTBPfUaQiBldo-b2FryL6yI,36826
 sourcecode/mcp/registry.py,sha256=kydzpUGGKckWM_F_GeGkWG1Z_qU3R8mZSbBWYKtDewU,69326
 sourcecode/mcp/runner.py,sha256=dRvI0xS2wa8DH0diYjJiAoaGeVdtf389PekWwwh8wRI,3083
-sourcecode/mcp/server.py,sha256=rnalEjQ9vcuCiXFekJI4Llx5u9HaBAwXN903NunupP8,73562
+sourcecode/mcp/server.py,sha256=L3xxLaG-bLe3Asr4ZESiEIYldhvKHkfpCMoucndvLvY,76070
 sourcecode/mcp/onboarding/__init__.py,sha256=sj2PWqEBmMc4zBNkomg89WtL0M6S7A9yb7_wAuSWNP4,66
 sourcecode/mcp/onboarding/applier.py,sha256=Sx9vHTaXr_M1Bs4uMjO7qa_a2_p4J9oz93oJsKQ7ds4,3298
 sourcecode/mcp/onboarding/backup.py,sha256=ihqGOR8QTX8HASRSEDyfFyXr5bkXrygPHamv4p9KTmk,1452
@@ -257,13 +257,13 @@ sourcecode/telemetry/consent.py,sha256=-Wb8BFGXEexOs8M0Eja7F-T6ZtLNPeRoZnHcHvlP7
 sourcecode/telemetry/events.py,sha256=l3Z2SQUO4_C2D2ItXOOdVNimAmHedUHnUxqYFTxnsAE,2900
 sourcecode/telemetry/filters.py,sha256=-lqT2oorECuqEIdeHb--7AZ6BCaUx0bya720a-Z5x6w,7335
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode/_docs/DEFECT-LEDGER.md,sha256=K5k1J1JDBBeXnB50o9KxIFnFJRHBillTJNoKoiQmLXY,1108377
+sourcecode/_docs/DEFECT-LEDGER.md,sha256=Jux3d0qM_L58-tJZwX6ret7HTK9R7QAVDmfohZfKZUs,1109556
 sourcecode/_docs/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
 sourcecode/_docs/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode/_docs/USER_GUIDE.md,sha256=w8YGMcBHQIRLwnFzqodOZhvP5eF8pfYMtw5FyUlRpNk,93284
-sourcecode-5.8.31.dist-info/METADATA,sha256=8XTeIYslvJubUEPmt2L6EObS9m9aw4BVKL6BfBDYN0w,55428
-sourcecode-5.8.31.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-5.8.31.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-5.8.31.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
-sourcecode-5.8.31.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode-5.8.31.dist-info/RECORD,,
+sourcecode/_docs/USER_GUIDE.md,sha256=O5lO0REhpaaC-dfwwkHtfdr4_zrEnXO4eXhBYA00ufI,94962
+sourcecode-5.8.32.dist-info/METADATA,sha256=nWMOqw-qy7BSXhnuO_CWY_xVz_du-216HYbPfE9nvXs,56341
+sourcecode-5.8.32.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-5.8.32.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-5.8.32.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
+sourcecode-5.8.32.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
+sourcecode-5.8.32.dist-info/RECORD,,