sourcecode 5.8.31__tar.gz → 5.8.32__tar.gz

{sourcecode-5.8.31 → sourcecode-5.8.32}/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [5.8.32] — 2026-08-26
+
+*MCP and documentation alignment release. MCP assessment packs now support
+validated selective component execution through `only`, with omitted coverage
+and a reproducible CLI command recorded in the projection. MCP pull-request
+gates, pack guidance and the public roadmap are synchronized with the current
+release state.*
+
 ## [5.8.31] — 2026-08-26
 
 *Windows portability and release-evidence remediation. Cache and licensing test

{sourcecode-5.8.31 → sourcecode-5.8.32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.31
+Version: 5.8.32
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.31-blue)
+![Version](https://img.shields.io/badge/version-5.8.32-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -88,6 +88,8 @@ workflow-shaped packs for users who want one consumable result:
 ask pack assessment . --profile prod --output-dir .ask/packs/assessment
 ask pack gate . --since origin/main --output-dir .ask/packs/gate
 ask pack assessment . --format markdown -o assessment.md
+ask pack assessment . --only risk,posture --output-dir .ask/packs/assessment
+ask pack gate . --pr 123 --output-dir .ask/packs/gate
 ```
 
 For deployment-aware posture evidence, pass the artefacts that describe the
@@ -104,8 +106,17 @@ contract:
 ```bash
 ask pack gate . --since origin/main --format github-actions
 ask pack gate . --since origin/main --format gitlab
+ask pack gate . --since origin/main --format sarif -o gate.sarif
 ```
 
+`pack gate --pr NUMBER` uses the local `gh` CLI to resolve changed files and
+the exact base commit; the base SHA must already exist locally. It does not
+fetch or modify the repository. `pack assessment --only` runs named assessment
+components and records omissions in the manifest. MCP's
+`get_assessment_pack` accepts the same selection as `only: list[str]` and
+returns the reproducible CLI command in its `mcp` projection. SARIF is a bounded
+export of ASK-owned gate decisions, not a re-emission of third-party findings.
+
 `PASS`, `BLOCK` and `UNVERIFIED` are data decisions. The process exit code is
 the CI signal; `--allow-unverified` can change only that exit code, never the
 reported verdict. Every pack carries a manifest with component invocations,
@@ -177,18 +188,19 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.8.31 retains the shared Canonical IR
+**Current performance status.** Release 5.8.32 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
 and bounded-output regressions for this release; use `ask cache model <repo>` and
 `--progress stderr` for supervised runs, and consult the
-[active pack audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md) before
+[latest external audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.31.md) before
 treating a historical timing or bounded flag as a current guarantee.
 
-**What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
+**What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
-IR) and the **compact view**. Pass `--agent` to warm the agent view as well. Deeper projections
+IR). Pass `--views compact` or `--views compact,agent` to warm only selected views; without
+`--views`, all declared views are warmed. Deeper projections
 are separate keys and are *not* covered by either — `--full`, `--env-map` and a raised `--depth`
 recompute on first use, as do most `prepare-context` tasks. Measured on a 3,342-file Spring
 monolith: `cache warm` 103s → `--compact --git-context` 1s (hit), but `--agent --full --env-map
@@ -210,7 +222,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.31 — and, on a build that has aged,
+ask version                    # ask 5.8.32 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -479,7 +491,7 @@ from it.
 | `plan` / `compare` / `delta` / `contract-diff` | supported | what to review for a change; candidates by measured cost; outcome of a change; public-contract break | no verdicts, measured cost only |
 | `validation` | supported | request-body validation coverage and gaps | |
 | `baseline capture\|diff` · `trend` | supported | versioned architectural metrics over time; `ask trend .` reads the series (a repository path or a baselines directory), `ask baseline diff .` compares the tree against its newest point | trend reporting, not gating. Baselines land in `.ask/baselines` **inside the repository** — the history travels with the code, not with a vendor; an audit that must not write passes `--dir`. `capture --auto` is the unattended form (one baseline per commit, never rewrites one, never fails the build) — automate it: [baseline-ci.yml](docs/baseline-ci.yml) |
-| `retrieve` | parked | typed knowledge queries over the model | |
+| `retrieve` | parked | typed knowledge queries over the model | symbol-oriented queries accept `--target/-t`; domain aliases such as `--module/-m`, `--subsystem/-s` and `--endpoint/-e` remain supported |
 | `timeline` | experimental | since when a number moved, and in which commit window | walks the commit series and re-runs the shipped analyses (`posture`, `data-exposure`, `endpoints`, `spring-audit`) on a read-only materialisation of each sampled tree; publishes transitions, not a per-commit dump. A sample that could not be analysed is `null` with a reason, never 0, and a transition under sampling carries the window it could have happened in |
 | `regress` | supported | what moved between two payloads of the same command, and which declaration accounts for it | attributes each delta to a declaration the answers carry (`test_source_excluded`, `symbols_excluded`, `coverage.gaps`, `*_cap`, `waivers`); a delta nothing explains is `unattributed`. Refuses the comparison when `cache_layers`, `base_env` or the analyzer fingerprint differ |
 | `explain-endpoint` | supported | the derivation behind one route's verdict | six steps — match, declaration, handler, chain, profiles, verdict — each naming the authority that produced it and the file it can be checked against; a step that could not be derived is `undetermined` with the reason, never absent |

{sourcecode-5.8.31 → sourcecode-5.8.32}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.8.31-blue)
+![Version](https://img.shields.io/badge/version-5.8.32-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -39,6 +39,8 @@ workflow-shaped packs for users who want one consumable result:
 ask pack assessment . --profile prod --output-dir .ask/packs/assessment
 ask pack gate . --since origin/main --output-dir .ask/packs/gate
 ask pack assessment . --format markdown -o assessment.md
+ask pack assessment . --only risk,posture --output-dir .ask/packs/assessment
+ask pack gate . --pr 123 --output-dir .ask/packs/gate
 ```
 
 For deployment-aware posture evidence, pass the artefacts that describe the
@@ -55,8 +57,17 @@ contract:
 ```bash
 ask pack gate . --since origin/main --format github-actions
 ask pack gate . --since origin/main --format gitlab
+ask pack gate . --since origin/main --format sarif -o gate.sarif
 ```
 
+`pack gate --pr NUMBER` uses the local `gh` CLI to resolve changed files and
+the exact base commit; the base SHA must already exist locally. It does not
+fetch or modify the repository. `pack assessment --only` runs named assessment
+components and records omissions in the manifest. MCP's
+`get_assessment_pack` accepts the same selection as `only: list[str]` and
+returns the reproducible CLI command in its `mcp` projection. SARIF is a bounded
+export of ASK-owned gate decisions, not a re-emission of third-party findings.
+
 `PASS`, `BLOCK` and `UNVERIFIED` are data decisions. The process exit code is
 the CI signal; `--allow-unverified` can change only that exit code, never the
 reported verdict. Every pack carries a manifest with component invocations,
@@ -128,18 +139,19 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.8.31 retains the shared Canonical IR
+**Current performance status.** Release 5.8.32 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
 and bounded-output regressions for this release; use `ask cache model <repo>` and
 `--progress stderr` for supervised runs, and consult the
-[active pack audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md) before
+[latest external audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.31.md) before
 treating a historical timing or bounded flag as a current guarantee.
 
-**What a warm actually covers.** `ask cache warm` runs the compact analysis: it rebuilds the
+**What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
-IR) and the **compact view**. Pass `--agent` to warm the agent view as well. Deeper projections
+IR). Pass `--views compact` or `--views compact,agent` to warm only selected views; without
+`--views`, all declared views are warmed. Deeper projections
 are separate keys and are *not* covered by either — `--full`, `--env-map` and a raised `--depth`
 recompute on first use, as do most `prepare-context` tasks. Measured on a 3,342-file Spring
 monolith: `cache warm` 103s → `--compact --git-context` 1s (hit), but `--agent --full --env-map
@@ -161,7 +173,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.31 — and, on a build that has aged,
+ask version                    # ask 5.8.32 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -430,7 +442,7 @@ from it.
 | `plan` / `compare` / `delta` / `contract-diff` | supported | what to review for a change; candidates by measured cost; outcome of a change; public-contract break | no verdicts, measured cost only |
 | `validation` | supported | request-body validation coverage and gaps | |
 | `baseline capture\|diff` · `trend` | supported | versioned architectural metrics over time; `ask trend .` reads the series (a repository path or a baselines directory), `ask baseline diff .` compares the tree against its newest point | trend reporting, not gating. Baselines land in `.ask/baselines` **inside the repository** — the history travels with the code, not with a vendor; an audit that must not write passes `--dir`. `capture --auto` is the unattended form (one baseline per commit, never rewrites one, never fails the build) — automate it: [baseline-ci.yml](docs/baseline-ci.yml) |
-| `retrieve` | parked | typed knowledge queries over the model | |
+| `retrieve` | parked | typed knowledge queries over the model | symbol-oriented queries accept `--target/-t`; domain aliases such as `--module/-m`, `--subsystem/-s` and `--endpoint/-e` remain supported |
 | `timeline` | experimental | since when a number moved, and in which commit window | walks the commit series and re-runs the shipped analyses (`posture`, `data-exposure`, `endpoints`, `spring-audit`) on a read-only materialisation of each sampled tree; publishes transitions, not a per-commit dump. A sample that could not be analysed is `null` with a reason, never 0, and a transition under sampling carries the window it could have happened in |
 | `regress` | supported | what moved between two payloads of the same command, and which declaration accounts for it | attributes each delta to a declaration the answers carry (`test_source_excluded`, `symbols_excluded`, `coverage.gaps`, `*_cap`, `waivers`); a delta nothing explains is `unattributed`. Refuses the comparison when `cache_layers`, `base_env` or the analyzer fingerprint differ |
 | `explain-endpoint` | supported | the derivation behind one route's verdict | six steps — match, declaration, handler, chain, profiles, verdict — each naming the authority that produced it and the file it can be checked against; a step that could not be derived is `undetermined` with the reason, never absent |

sourcecode-5.8.32/docs/AUDIT-2026-08-26-EXTERNAL-5.8.31.md

@@ -0,0 +1,87 @@
+# External Audit — 5.8.31
+
+Received 2026-08-26. This note records the external comparison of release
+`5.8.31` against `5.8.30` and separates reproduced defects from mitigations,
+performance observations and shell-dependent measurements.
+
+## Executive Result
+
+The external score was **8/10**, up from 7/10. The auditor verified useful
+capabilities in this release:
+
+- `--progress off|stderr|file:<path>` works for `pack assessment` and `cache warm`;
+- `cache clear --all/--global` removes shared parse/CIR state and makes a
+  cold-cache reset explicit;
+- `auth status` documents the deprecation window for legacy fields;
+- the root help labels the `31s` figure as a historical field anchor.
+
+The progress control is a mitigation, not an automatic foreground heartbeat:
+without `--progress`, the command remains silent until its final answer. The
+external run also measured a cold-cache improvement (`215.6s` to `137.8s`),
+but one sample is insufficient to attribute a stable release-level change.
+
+## Actionable Findings
+
+### `AUD-606-O01` — `posture --diff --compact --limit` remains ineffective
+
+**Priority:** P2. **Status:** not reproduced in the current checkout; retained as
+an external-subject follow-up.
+
+The report measured `estimated_tokens` changing from `71847` to `71808` with
+`--limit 20`, while the bounded floor remained `47764`. The error wording now
+correctly stops recommending a flag that was already tried, but the reported
+payload-size symptom remains. The earlier `AUD-604-O01` closure was based on a
+different subject and must not be treated as proof against this report. A
+controlled current-checkout reproduction over the real `diff_posture` shape
+confirmed that all generated nested lists are in the bounding registry and are
+cut by explicit `--limit`; the existing bounding batteries pass.
+
+Acceptance if the original subject is supplied: reproduce on a controlled fixture, identify the nested population
+outside the posture bounded-list registry, and either make the explicit limit
+bound that population or publish a precise non-coverage/refusal. Add a regression
+assertion over the affected payload shape.
+
+### `AUD-606-R01` — inconsistent target option names in `retrieve`
+
+**Priority:** P2. **Status:** closed in the current checkout (`be16c04`).
+
+The retrieval surface uses `--target/-t` for most symbol-oriented commands,
+`--module/-m` for module queries, `--subsystem/-s` for subsystem membership and
+`--endpoint/-e` for endpoint queries. This is a discoverability and automation
+cost, not an analysis correctness failure. Domain-specific flags remain valid,
+and symbol-like domain queries now also accept universal `--target/-t`. Help
+parity coverage spans all five affected commands.
+
+Acceptance: choose and document one compatibility policy. The preferred fix is
+to expose a universal `--target/-t` alias where the semantic target is a symbol,
+while retaining domain-specific names where the input is genuinely a module,
+subsystem or endpoint. Sweep the command registry and add help/parity tests.
+
+## Conditional Follow-ups
+
+### `AUD-606-P01` — cold-cache timing requires more samples
+
+The observed 137.8s cold run is an improvement over the reported 5.8.30 value,
+but it is a single measurement and still above the older baseline. No parser or
+performance regression should be opened from it alone. Run 2-3 sequential,
+isolated samples with cache state, repository, host and version recorded.
+
+### `AUD-606-P02` — `pack gate --since HEAD` measurement contaminated
+
+The 70.2s and >120s observations were taken while two other ASK processes were
+running. This is not evidence of an ASK inconsistency. Re-test in an isolated
+session with three sequential samples before changing the gate or its cache
+path.
+
+### `AUD-606-I01` — `pr-impact --files -` with redirected null stdin
+
+`--files -` works with an actual empty pipe, but the reported `< /dev/null`
+path is classified as a terminal under the auditor's shell. This may be
+Git Bash/MSYS descriptor behaviour rather than an ASK defect. Reproduce in
+native PowerShell and `cmd.exe` before changing stdin detection.
+
+## Not Reopened
+
+The verified cache, auth, progress and historical-anchor changes are recorded
+as release capabilities, not new defects. Previously closed pack fixes are not
+duplicated; their remaining release-artifact verification stays in the ledger.

{sourcecode-5.8.31 → sourcecode-5.8.32}/docs/DEFECT-LEDGER.md

@@ -16,6 +16,24 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
+**External `5.8.31` audit received, 2026-08-26 - `AUD-606`.**
+[`AUDIT-2026-08-26-EXTERNAL-5.8.31.md`](AUDIT-2026-08-26-EXTERNAL-5.8.31.md)
+confirms the new progress and shared-cache controls, and records one actionable
+external-subject follow-up `AUD-606-O01`, where `posture --diff --compact --limit`
+was effectively unchanged on the auditor's nested output; the current checkout
+reproduces no such gap and its bounding batteries pass. It also opens the CLI
+consistency row `AUD-606-R01` for heterogeneous `retrieve` target flags, fixed
+in the current checkout by `be16c04` with help-parity coverage.
+The 137.8s cold run is a single-sample improvement and remains `AUD-606-P01`
+benchmark follow-up, not a parser regression. `AUD-606-P02` (`pack gate` timing)
+and `AUD-606-I01` (`pr-impact --files -` with `/dev/null`) are inconclusive due
+to process contamination and shell-specific stdin behaviour respectively.
+
+**Current `5.8.31` queue:** external-subject follow-up `AUD-606-O01`; controlled
+benchmark/portability follow-ups `AUD-606-P01`, `AUD-606-P02` and `AUD-606-I01`.
+The existing `AUD-604-R01` and `AUD-605` release-artifact verification items
+remain unchanged.
+
 **External pack audit received, 2026-08-26 - `AUD-605`.**
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md)
 adds two rows: `AUD-605-G01`, where an unresolved test file broadened pack-gate unknown
@@ -25,7 +43,7 @@ checkout by `52bcc36` and `f89ae18`, with focused regression batteries passing;
 artefact verification remains pending. The pack's `--since` timing is additional evidence
 for `AUD-604-P01`, not a duplicate performance finding.
 
-**Current `5.8.31` queue:** artefact verification for `AUD-604-R01`; the two `AUD-605`
+**Previous `5.8.31` pack queue:** artefact verification for `AUD-604-R01`; the two `AUD-605`
 fixes are included in this release and await release-artefact verification.
 
 **External `5.8.28` audit received, 2026-08-26 - `AUD-604`.**

{sourcecode-5.8.31 → sourcecode-5.8.32}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,7 +3,11 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT QUEUE — release `5.8.31`, following the external pack audit of `5.8.28`, received 2026-08-26.** `AUD-605-G01` (P2,
+> **CURRENT QUEUE — release `5.8.32`, following the external audit of `5.8.31`, received 2026-08-26.** `AUD-606-O01` (P2,
+> posture diff explicit `--limit` was ineffective on the auditor's nested output but is not reproduced in the current
+> checkout) and `AUD-606-R01` (P2, heterogeneous `retrieve` target flags) is fixed in the current checkout by `be16c04`. `AUD-606-P01` is a one-sample cold-cache improvement requiring
+> controlled confirmation; `AUD-606-P02` and `AUD-606-I01` are inconclusive measurements, not confirmed regressions.
+> `AUD-605-G01` (P2,
 > unresolved test files broadened pack-gate uncertainty to unrelated endpoints) and `AUD-605-U01` (P2, pack assessment did not
 > forward foreground progress) are implemented in the current checkout in commits `52bcc36` and `f89ae18`; focused batteries pass.
 > The pack audit adds evidence to `AUD-604-P01`, but does not open a duplicate performance row.
@@ -13,9 +17,17 @@ customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 > `AUD-604-P01` is closed as an unconfirmed, non-attributable signal after controlled profiling.
 > Full evidence is
 > in [`AUDIT-2026-08-26-EXTERNAL-5.8.28.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28.md).
-> Pack evidence is in [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md). Release-artifact
+> Pack evidence is in [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md). The latest audit
+> synthesis is in [`AUDIT-2026-08-26-EXTERNAL-5.8.31.md`](AUDIT-2026-08-26-EXTERNAL-5.8.31.md). Release-artifact
 > verification of the two pack fixes remains after `AUD-604-R01`.
 
+> **STRATEGY DECISION — 2026-08-26.** Two external strategy reports were reconciled into
+> [`STRATEGY-2026-08-26-AGENT-CONTEXT.md`](STRATEGY-2026-08-26-AGENT-CONTEXT.md).
+> The winning route is verified Spring domain context infrastructure for agentic coding and CI platforms:
+> reliability and semantic accuracy first, then a stable MCP/API contract, with `pack gate` as the adoption wedge.
+> Generic multi-framework expansion, dashboards, consulting-led positioning and a premature `ask defects` command
+> are deferred or rejected. This supersedes conflicting strategy suggestions below while preserving them as history.
+
 ## Current Product Direction
 
 This is the adopted interpretation of the external strategy report. It supersedes
@@ -29,7 +41,7 @@ source-backed Java/Spring evidence layer in [`PRODUCT-ROUTE.md`](PRODUCT-ROUTE.m
 |---|---:|---|---|---|
 | `DIR-F01` | P1 | Replace pattern-only security decisions with shared semantic authorities. Distinguish definitions from invocations and production code from tests, examples and library code. | Each affected rule has a named population, source-backed reason and `non_coverage`; false-positive fixtures cover the reported `SEC-004` / `DEAD-001` shapes. | **Implemented:** current security scans exclude platform definitions, imports, Javadoc and live controls; future rules must use the same authority. |
 | `DIR-F02` | P1 | Extend safe guardrails to genuinely heavy commands and compositions. | A bounded run stops the phase doing the work, publishes partial counts and confidence reduction, preserves completed evidence, and never presents an advisory-only command as enforceable. | **Implemented:** `BUDGETED_ANALYSIS_COMMANDS`, `PhasedRun` and partial-answer contracts bind the current heavy population. New heavy commands must join this registry. |
-| `DIR-F03` | P1 | Finish CI gate ergonomics without weakening its evidence contract. | Verify the `5.8.31` pack fixes in release artefacts, then add only evidence-backed improvements such as PR-native change resolution and selective component control. `AUD-605-G01` is already fixed; test-only unresolved files must not return as a roadmap item. | **Implemented in `4d87532`:** `pack gate --pr` uses GitHub changed files and requires the exact local base SHA. Release-artifact verification remains. |
+| `DIR-F03` | P1 | Finish CI gate ergonomics without weakening its evidence contract. | Verify the `5.8.32` pack fixes in release artefacts, then add only evidence-backed improvements such as PR-native change resolution and selective component control. `AUD-605-G01` is already fixed; test-only unresolved files must not return as a roadmap item. | **Implemented in `d662ca3` and `ea27e27`:** `pack gate --pr` uses GitHub changed files and requires the exact local base SHA; MCP exposes the same PR mode and selective assessment control. Release-artifact verification remains. |
 | `DIR-F04` | P2 | Consolidate reusable semantic predicates used by security and dead-code rules. | One authority is consumed by all relevant rules; population and parity tests prevent a rule from silently reverting to textual matching. This is an implementation constraint, not a new user-facing command. | **Implemented for current rules:** `source_text` owns comment/Javadoc views and security scans consume them. Future rules remain bound to this constraint. |
 | `DIR-F05` | P2 | Continue operational observability for cost and confidence. | Timed answers publish cache state, phase/component progress, coverage, confidence and attributable run conditions; no cross-repository SLA or single-machine duration promise is published. | **Implemented for current timed surfaces;** continuous admission rule for new ones. |
 
@@ -39,7 +51,7 @@ source-backed Java/Spring evidence layer in [`PRODUCT-ROUTE.md`](PRODUCT-ROUTE.m
 |---|---:|---|---|---|
 | `DIR-X01` | P1 | Narrow Spring data-flow analysis. | Start with HTTP inputs, SQL/command/network/template sinks and explicit sanitizers. Publish confirmed paths, confidence and non-coverage; do not claim CodeQL-equivalent coverage. Design only after `DIR-F01` and `DIR-F02` are stable. | Conditional medium-term bet |
 | `DIR-X02` | P2 | CI and developer-surface integrations. | Prefer a thin GitHub Action and existing SARIF/CI renderers over another analyzer. A future IDE integration must consume ASK JSON/MCP evidence, preserve attribution and add no second semantic model. | **Implemented baseline:** MCP, SARIF and GitHub/GitLab renderers ship. A distributable Action or IDE surface needs named-buyer validation. |
-| `DIR-X03` | P2 | Selective and reusable pack execution. | `pack assessment` may select or reuse declared components only when tree state, inputs and fingerprints prove reuse; the manifest must say what ran and what was reused. This extends existing `S-24`, not a new pack architecture. | **Selection implemented in `9f4c0e1`:** `--only` runs declared components and publishes omissions. Artifact reuse remains evidence-gated. |
+| `DIR-X03` | P2 | Selective and reusable pack execution. | `pack assessment` may select or reuse declared components only when tree state, inputs and fingerprints prove reuse; the manifest must say what ran and what was reused. This extends existing `S-24`, not a new pack architecture. | **Selection implemented in `9f4c0e1` and exposed through MCP in `ea27e27`:** declared components run in canonical order and omissions are published. Artifact reuse remains evidence-gated. |
 | `DIR-X04` | P3 | Targeted Spring ecosystem coverage. | Admit Spring Cloud, GraphQL or another adjacent surface only when a named buyer supplies a reproducible gap and the new parser/rule set preserves the same evidence contract. | Evidence-gated |
 
 ### Explicitly Rejected
@@ -53,7 +65,7 @@ documented as facts.
 
 ### Decision Order
 
-1. Verify the `5.8.31` release artefacts, especially Windows detached execution and packs.
+1. Verify the `5.8.32` release artefacts, especially Windows detached execution and packs.
 2. Keep `DIR-F01`, `DIR-F02`, `DIR-F04` and `DIR-F05` as admission constraints for every new rule or heavy command.
 3. Validate `DIR-F03` and `DIR-X03` on named CI repositories before adding artifact reuse or a packaged Action.
 4. Design `DIR-X01` only after a source/sink/sanitizer corpus establishes its coverage contract; admit `DIR-X04` only from buyer evidence.

{sourcecode-5.8.31 → sourcecode-5.8.32}/docs/EXECUTIVE-ROADMAP.md

@@ -5,7 +5,15 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
-> **CURRENT STATUS — release `5.8.31`, following the `5.8.28` external audit intake, 2026-08-26.** The semantic
+> **CURRENT STATUS — release `5.8.32`, following the `5.8.31` external audit intake, 2026-08-26.** The latest
+> audit leaves one actionable residue: `AUD-606-R01` (inconsistent target option names across `retrieve`),
+> fixed in the current checkout by `be16c04`.
+> `AUD-606-O01` (posture diff explicit `--limit`) is retained as an external-subject follow-up because it does
+> not reproduce in the current checkout. The reported cold-cost
+> improvement needs controlled samples; `pack gate` timing and `/dev/null` stdin behaviour remain inconclusive.
+> Details are in [`AUDIT-2026-08-26-EXTERNAL-5.8.31.md`](AUDIT-2026-08-26-EXTERNAL-5.8.31.md).
+>
+> The semantic
 > regression matrix remains green: detached execution, DEAD-001 comment handling,
 > Boot 3 applicability, non-interactive selftest scope communication, nested diff
 > bounding and help timing guidance are confirmed fixed. The reported cold-cost signal
@@ -31,14 +39,21 @@
 > **ADOPTED DIRECTION — strategy review, 2026-08-26.** ASK will deepen its existing
 > moat instead of becoming a general SAST or AI platform. Semantic security accuracy,
 > safe guardrails and honest operational metrics are now implementation constraints;
-> CI gate ergonomics and selective pack execution are implemented in `4d87532` and
-> `9f4c0e1`. The remaining strategic candidates are a narrowly scoped Spring data-flow
+> CI gate ergonomics and selective pack execution are implemented in `d662ca3` and
+> `ea27e27`. The remaining strategic candidates are a narrowly scoped Spring data-flow
 > prototype and evidence-led coverage of adjacent Spring surfaces.
 
+> **STRATEGY RECONCILIATION — two reports, 2026-08-26.** The selected route is
+> deterministic Spring domain context infrastructure for agentic coding and CI platforms:
+> reliability first, then a stable MCP/API integration contract, with `pack gate` as the entry wedge.
+> Spring remains the focus; generic framework expansion, dashboards, consulting-led positioning and a premature
+> `ask defects` product surface are deferred or rejected. The full decision and rationale are in
+> [`STRATEGY-2026-08-26-AGENT-CONTEXT.md`](STRATEGY-2026-08-26-AGENT-CONTEXT.md).
+
 > **What this means in practice.** Every fix must name its analysed population, source
 > authority, confidence and non-coverage, and ship with a regression fixture. Every new
 > feature must reuse the shared semantic model, preserve deterministic evidence and have
-> a named buyer or reproducible user gap. `AUD-605-G01` is already fixed in 5.8.31; it is
+> a named buyer or reproducible user gap. `AUD-605-G01` is already fixed in 5.8.32; it is
 > not reopened as a future feature merely because the report described the old behaviour.
 
 > **Explicitly out of scope.** `--format` and `--compact` remain separate contracts;
@@ -47,7 +62,7 @@
 > are rejected for this route. Competitor accuracy figures are not roadmap evidence
 > without a reproducible benchmark.
 
-> **Order:** verify the 5.8.31 artefacts; validate the new CI/pack paths with named buyers;
+> **Order:** verify the 5.8.32 artefacts; validate the new CI/pack paths with named buyers;
 > then admit data-flow only with a source/sink/sanitizer corpus and ecosystem work only with
 > buyer evidence. Detailed IDs, boundaries and acceptance criteria are in
 > [`DEVELOPMENT-ROADMAP.md`](DEVELOPMENT-ROADMAP.md) under *Current Product Direction*.

{sourcecode-5.8.31 → sourcecode-5.8.32}/docs/MANUAL-USUARIO.md

@@ -75,6 +75,8 @@ los agrupan para un flujo de trabajo completo:
 ask pack list
 ask pack assessment . --profile prod --output-dir .ask/packs/assessment
 ask pack gate . --since origin/main --output-dir .ask/packs/gate
+ask pack assessment . --only risk,posture --output-dir .ask/packs/assessment
+ask pack gate . --pr 123 --output-dir .ask/packs/gate
 ```
 
 `assessment` entrega la foto de modernización y riesgo. `gate` entrega
@@ -96,8 +98,21 @@ GitHub Actions o GitLab:
 ```bash
 ask pack gate . --since origin/main --format github-actions
 ask pack gate . --since origin/main --format gitlab
+ask pack gate . --since origin/main --format sarif -o gate.sarif
 ```
 
+`pack assessment --only` permite ejecutar solo los componentes declarados que
+necesite el flujo. El `manifest` deja constancia de los componentes omitidos;
+`audit-report` requiere incluir también `risk`.
+
+`pack gate --pr NUMBER` obtiene los ficheros modificados mediante el `gh` local
+y usa el commit base exacto de la pull request. Ese commit debe estar disponible
+localmente; no hace `fetch` ni modifica el repositorio y es incompatible con
+`--since`.
+
+El formato `sarif` del gate genera un SARIF 2.1.0 acotado a las decisiones
+propias de ASK. No vuelve a emitir resultados de analizadores externos.
+
 El `manifest` identifica cada componente, su invocación y su fingerprint. Un
 resultado `BLOCK` o `UNVERIFIED` sigue siendo un resultado estructurado; el
 código de salida es la señal que debe consumir el pipeline.
@@ -985,7 +1000,8 @@ foto).
 
 ```bash
 ask cache status      # estadísticas de la caché del repo
-ask cache warm        # pre-construye la caché antes de una sesión
+ask cache warm        # pre-construye todas las vistas declaradas
+ask cache warm . --views compact,agent  # limita el calentamiento a esas vistas
 ask cache clear       # borra las fotos cacheadas del repo
 ask cache freshness   # frescura del RIS respecto al HEAD de git actual
 ask cache model .     # qué mejora realmente una caché caliente por comando
@@ -1017,8 +1033,12 @@ Además de las consultas individuales, MCP expone los packs como operaciones
 estructuradas de alto nivel:
 
 - `get_assessment_pack`: assessment de modernización y riesgo con `manifest` e
-  identidad de cada componente.
+  identidad de cada componente. Admite `only` como lista de componentes para
+  una evaluación acotada; las omisiones quedan registradas como no cubiertas.
 - `get_change_safety_gate`: gate de cambios con `PASS`, `BLOCK` o `UNVERIFIED`.
+  Acepta `since` para una referencia Git local o `pr` para resolver una pull
+  request mediante `gh`; son opciones mutuamente excluyentes y el SHA base debe
+  estar disponible localmente.
 
 Ambas herramientas usan `compact=true` por defecto para agentes. Un resultado
 `BLOCK` o `UNVERIFIED` es una respuesta válida con datos, no un error de

{sourcecode-5.8.31 → sourcecode-5.8.32}/docs/PRODUCT-ROUTE.md

@@ -43,8 +43,12 @@ The assessment pack composes `migrate-check`, `posture`, `endpoints`,
 
 ```bash
 ask pack assessment . --profile prod --output-dir .ask/packs/assessment
+ask pack assessment . --only risk,posture --output-dir .ask/packs/assessment
 ```
 
+`--only` runs a comma-separated subset of declared assessment components and
+records omitted components in the manifest. `audit-report` requires `risk`.
+
 When the repository contains several possible environments, pass the artefact
 that describes the deployment being assessed. The option is repeatable and
 keeps disagreement between deployment descriptions visible:
@@ -82,6 +86,16 @@ The gate composes `verify`, `verify-edit`, `posture --since` and
 ask pack gate . --since origin/main --output-dir .ask/packs/gate
 ```
 
+For a GitHub pull request, the gate can resolve the changed files directly:
+
+```bash
+ask pack gate . --pr 123 --output-dir .ask/packs/gate
+```
+
+This uses the local `gh` CLI and requires the pull request's exact base SHA to
+be available locally. It does not fetch or mutate the repository and cannot be
+combined with `--since`.
+
 Its exit contract is:
 
 - `0` / `PASS`: all component gates passed;
@@ -100,9 +114,13 @@ ask pack gate . --since origin/main --format github-actions
 
 # GitLab collapsible job-log section
 ask pack gate . --since origin/main --format gitlab
+
+# SARIF 2.1.0 decisions owned by ASK
+ask pack gate . --since origin/main --format sarif -o gate.sarif
 ```
 
-Both formats are bounded summaries only. Persist `--output-dir .ask/packs/gate`
+The CI formats are bounded summaries or decisions only. The SARIF renderer
+does not re-emit third-party scanner findings. Persist `--output-dir .ask/packs/gate`
 when the job must publish component evidence and the aggregate `pack.json`; use
 `--output FILE` when the aggregate needs a separately controlled path. The
 process exit code remains the only pass/fail signal for the job.

sourcecode-5.8.32/docs/STRATEGY-2026-08-26-AGENT-CONTEXT.md

@@ -0,0 +1,83 @@
+# Strategy Decision — ASK As Verified Spring Context Infrastructure
+
+Received 2026-08-26 from two external strategy reports about release `5.8.31`.
+This document records the synthesis and the decisions that govern the roadmap;
+it is not a commitment to every proposal in either report.
+
+## Decision
+
+ASK will be positioned as a deterministic, source-backed **Spring domain context
+engine for agentic coding and CI platforms**. The primary commercial surface is
+an embeddable MCP/API and evidence contract. The standalone CLI and `pack gate`
+remain the adoption wedge and the independent fallback.
+
+The reports agree on this direction. They also agree that ASK should not compete
+head-on with SonarQube on dashboards, Semgrep on generic patterns or CodeQL on
+query breadth. ASK's defensible asset is the semantic model of profiles, beans,
+effective endpoints, security posture, change reach and migration evidence,
+rendered for machines and agents without unsupported claims.
+
+## Winning Roadmap
+
+### F1 — Reliability before dependency status
+
+Make cold/warm state, phase cost, progress, output bounds and non-coverage
+observable and attributable. No hard SLA or release-level performance promise is
+published until sequential controlled measurements establish a reproducible
+baseline. `AUD-606` timing follow-ups remain evidence work, not speculative
+parser rewrites.
+
+### F2 — Semantic accuracy as a release gate
+
+Continue closing context-sensitive false positives at the authority level rather
+than adding case-by-case exceptions. Every security or reachability change must
+name its population, source authority, confidence and non-coverage, and carry a
+regression fixture.
+
+### F3 — Stable integration contract
+
+Treat MCP/API, JSON envelopes, schemas, manifests and exit codes as a licensable
+integration contract. Define compatibility policy, deprecation windows and
+conformance tests before promising a commercial no-breaking-change period. MCP
+must expose the same evidence as the CLI, with no second semantic model.
+
+### F4 — Two entry paths, one engine
+
+Use `pack gate` as the low-friction CI entry point (`PASS`, `BLOCK`,
+`UNVERIFIED`) and MCP/API as the platform integration path for live agent
+context. Both consume the same evidence and fingerprints. A packaged Action may
+follow only after named-buyer validation.
+
+### F5 — Narrow domain expansion
+
+Deepen Spring first: security, profiles, transaction boundaries, endpoint
+reachability, migration and bounded agent context. Consider adjacent Spring
+surfaces only when a buyer supplies a reproducible gap. Do not expand to Django,
+Rails, NestJS or generic multi-language analysis before the Spring integration
+contract and reliability bar are established.
+
+### F6 — Evidence-led commercial proof
+
+Publish domain-specific precision and cost comparisons only when the benchmark
+corpus, versions, cache state and exclusions are recorded. Keep the defect ledger
+as trust evidence and a future generated projection, but do not make `ask
+defects` a near-term product surface until a named buyer needs it.
+
+## Deferred Or Rejected
+
+- Generic SAST breadth, broad language support and ML prioritisation are rejected.
+- A Sonar-style human dashboard is deferred; it competes on the wrong terrain.
+- Audit/consulting as the core business is rejected; it converts a repeatable
+  engine into non-scalable hours.
+- A freemium/self-serve SaaS funnel is optional experimentation, not the primary
+  channel while B2B integration is being validated.
+- Automatic foreground progress is not enabled from the reports alone; the
+  explicit `--progress` contract remains the safe behaviour.
+
+## Risks And Tests
+
+The main risks are platform dependence, partner build-versus-buy decisions,
+Spring concentration and rapid fixes being read as instability. Mitigations are
+an independent CLI/pack path, a versioned evidence contract, controlled benchmark
+evidence and release batteries that prevent a fix from outrunning its regression
+proof.