sourcecode 5.8.8__py3-none-any.whl → 5.8.10__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.8"
+__version__ = "5.8.10"

sourcecode/_docs/DEFECT-LEDGER.md

@@ -16,8 +16,23 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
-**As of 2026-08-19, HEAD `f39432b`:** the latest audit queue was implemented in fourteen
-post-5.8.7 commits. These are committed follow-up fixes, not a tagged release. This table is
+**As of 2026-08-19, the `5.8.10` release commit:** this is the current status of
+the 5.8.9 re-audit queue. The audit observations below remain historical evidence;
+only the table here declares present state.
+
+| Rows | Current status | Evidence |
+|---|---|---|
+| `AUD-588-B01`, `AUD-589-B01`, `C3-122` | **closed** | `20596c8`; failed writes cannot suppress the global output-promise guard, covering both `risk` and `audit-report` emit paths. |
+| `AUD-588-B03` | **closed** | `16a52cc`; `SEC-009`, static `@Profile` evidence and `permit_all_rules` are emitted with regressions. |
+| `AUD-588-B04` | **closed** | `fd34eb1`; `data-exposure` preserves the chain decision for every route. |
+| `AUD-588-B05` | **closed** | `c15f5b6`; changed container-wired components block a false `unaffected` disposition. |
+| `AUD-588-B07` | **closed** | `5cc6ba7`; ASK-09 reads the envelope error contract and covers the wrapped shape. |
+| `AUD-588-B08` | **closed** | `c084555`; `impact` publishes its independent stdout-byte budget. |
+| `AUD-588-B11` (container/units subset) | **closed** | `ca72b61`, `a49cf6a`; plan/compare publish container wiring and impact-chain names security-surface units. |
+| `AUD-588-B02`, `B06`, B11 residuals, `B12` | **open** | Require provider non-coverage verification, remaining contract parity and controlled cost calibration; no closure is inferred from the release. |
+
+**As of 2026-08-19, the `5.8.9` release commit:** the latest audit queue was implemented in
+committed post-5.8.7 fixes. This table is
 the authoritative status for round 11; detailed rows retain their original findings and
 acceptance criteria for auditability.
 
@@ -38,6 +53,64 @@ acceptance criteria for auditability.
 | `C3-55` | **closed** | `63249df`; below-floor analysis budgets warn in noninteractive runs while execution continues |
 | `C3-55` regression | **closed** | `f39432b`; above-floor provenance remains quiet off-TTY and is emitted interactively |
 
+## Current Audit Intake: 5.8.8
+
+The external audit of `ask 5.8.8` against `saint-server` (`HEAD 3dde0376`, 3,342 Java
+files, Windows 11/Git Bash, `ASK_READONLY=1`) scored **75/100** and exercised **53/61
+invocables (87%)**. The repository stayed byte-identical. These findings are new relative
+to the closed round-11 queue and are not marked closed until reproduced and covered here.
+
+| ID | Severity | Defect | Initial status |
+|---|---|---|---|
+| `AUD-588-B01` | Critical | `risk` can exit 0 with empty stdout and fail to create `-o`; long runs also vary widely. | **open — reproduce first; require parseable output or typed non-zero error** |
+| `AUD-588-B02` | High | `migrate-check` includes an inapplicable Hibernate axis and publishes ghost effort for an EclipseLink repository. | **open — fix applicability/aggregate; add fixture** |
+| `AUD-588-B03` | High | `spring-audit` lacks an active `permitAll` rule and does not expose security-bean profile activation state. | **open — reuse posture access/profile projection** |
+| `AUD-588-B04` | High | `explain-endpoint` and `data-exposure` discard a derived `permit_all` chain decision and emit `coverage_unknown`. | **open — make verdict consume the chain authority** |
+| `AUD-588-B05` | High | `pr-impact.endpoint_disposition` marks all endpoints unaffected despite container-wired security changes. | **open — propagate to `unknown` or publish a disposition caveat** |
+| `AUD-588-B06` | Medium | `migrate-check` is the only audited command without `non_coverage`, hiding the EclipseLink gap. | **open — disclosure before product expansion** |
+| `AUD-588-B07` | Medium | ASK-09 selftest failure is not reproducible and the row omits its probe command and observed excerpt. | **open — publish probe provenance and assert error code first** |
+| `AUD-588-B08` | Medium | Output-too-large hints recommend a rejected subcommand flag and omit the independent byte budget. | **open — derive flags and disclose both budgets** |
+| `AUD-588-B09` | Medium | `rename-class` reuses `-f` for `--from`, conflicting with the CLI-wide format alias and allowing silent overwrite. | **open — remove collision or reject duplicate destinations** |
+| `AUD-588-B10` | Medium | `baseline diff` lacks `--dir`, breaking the external read-only capture/trend/diff flow. | **open — restore flag parity with regression coverage** |
+| `AUD-588-B11` | Medium | Seven cross-command contract inconsistencies mix naming, units, container-wired warnings, build discovery, populations and tier claims. | **open — solve through shared fact/units authorities** |
+| `AUD-588-B12` | Low/Medium | Cost model is stale by up to 1.74x at warm cache and long commands can be silent until timeout. | **open — remeasure 5.8.8 and add default foreground progress** |
+
+### Re-audit Intake: 5.8.9
+
+The same external auditor re-ran the same `saint-server` snapshot under the same
+read-only protocol against 5.8.9. Score: **80/100** (75 previously), still **53/61
+invocables (87%)**. The CIR remained byte-identical. This reopens false closures and
+adds one newly observable zero-output path; it does not duplicate the rows above.
+
+| ID / lineage | Status | Evidence and next action |
+|---|---|---|
+| `AUD-588-B01` / `C3-122` | **reopened, critical** | `risk` exits 0 with empty stdout and can omit a promised `-o` file. Fix early/partial composition and enforce a typed failure or parseable answer through the real entry point. |
+| `AUD-588-B02` + `B06` | **open, critical** | EclipseLink still receives a Hibernate axis and `non_coverage` is null. Make `not_applicable_reason` authoritative for applicability, effort and aggregate; publish provider non-coverage. |
+| `AUD-588-B03` | **partial** | `permitAll` evidence and profiles are present, but no rule or per-finding activation state exists; rename `active_permit_all` to an honest per-entry contract. |
+| `AUD-588-B04` | **partial** | `explain-endpoint` is fixed; `data-exposure` still reports `coverage_unknown` for chain-permitted routes. |
+| `AUD-588-B05` | **regression** | `unaffected_basis` claims no blocker while container-wired changes are present. Demote routes or publish a blocker/caveat; preserve `affected + unknown + unaffected = total`. |
+| `AUD-588-B07` | **partial** | Selftest publishes provenance but reads `error.code` at the wrong envelope level, producing a false `error` instead of `pass`. |
+| `AUD-588-B08` | **partial** | `impact` still trims stdout at 50,000 bytes after the token ceiling is raised without naming that second budget. |
+| `AUD-588-B11` | **open, six residuals** | `plan`/`compare` miss container reach; units, build discovery, populations and risk tier still diverge. |
+| `AUD-588-B12` | **partial** | Timeline completes, but cost anchors are stale and long foreground commands remain silent by default. |
+| `AUD-589-B01` | **new, high** | `audit-report` can exit 0 with empty stdout; its `-o` path diverges and leaves partial evidence when killed. Reuse the working `_partial` and output-promise contracts. |
+| `AUD-589-B02` | **unconfirmed performance suspicion** | `data-exposure --config` was measured 2.76x slower with identical output; require convergent controlled measurements before code changes. |
+
+### Recommended Features From This Audit
+
+| ID | Recommendation | Classification |
+|---|---|---|
+| `AUD-588-F01` | Explicit EclipseLink/JPA-provider migration axis, including namespace and coordinate changes. | **Deferred**; its prerequisite provider `non_coverage` disclosure is still open. |
+| `AUD-588-F02` | Shared answer-contract layer for units, populations, caveats and container-wired reach. | **Partially covered**; six consumers remain disconnected according to the re-audit. |
+| `AUD-588-F03` | Versioned cost-model calibration by repository size and cache state. | **Partially covered**; schema and dimensions exist, but 5.1.0-era anchors are stale. |
+| `AUD-588-F04` | Default progress/heartbeat for long foreground commands without contaminating machine-readable stdout. | **Explicit opt-in by decision**, not default coverage; update cost advice accordingly. |
+| `AUD-588-F05` | Controlled audit-coverage expansion from 87% to 90% via safe `auth logout`, reversible `telemetry disable` and dirty-tree `verify-edit` checks. | **Locally verified only**; external audit remains at 87% with eight blocked invocables. |
+
+**Recommended fix order:** `B01`, `B02`, `B04`, `B03`, `B05/B11`, `B08/B09`, `B07`,
+then `B06/B10/B12`. The dirty-tree `verify-edit` path remains unverified, not confirmed
+broken; the audit's positive results for inheritance, profile posture, caps, non-coverage,
+read-only flows and typed errors are regression anchors for this queue.
+
 The current full-suite exceptions are environmental or pre-existing measurement gaps,
 not silently accepted fixes: RIS tests cannot write the default `~/.sourcecode/cache`
 under the managed sandbox; `cold-start` therefore reports `no_ris`. The E-6 module-name

sourcecode/_docs/USER_GUIDE.md

@@ -136,7 +136,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.8
+# ask 5.8.10
 ```
 
 Requires Python 3.9+.

sourcecode/change_plan.py

@@ -28,6 +28,7 @@ from typing import TYPE_CHECKING
 
 from sourcecode import non_coverage as _non_coverage
 from sourcecode.canonical_ir import project_blast_radius
+from sourcecode.container_wiring import detect_classes
 from sourcecode.repository_ir import _all_callers_from_rg
 from sourcecode.security_posture import _graph_nodes
 from sourcecode.path_filters import is_test_path
@@ -139,6 +140,7 @@ def build_change_plan(
         }
 
     seeds = list(blast["matched_fqns"])
+    container_wired = [w.to_dict() for w in detect_classes(cir, seeds)]
     meta = _node_meta(cir)
     affected = _dependents_closure(cir.reverse_graph or {}, seeds, max_depth, _NODE_CAP)
 
@@ -221,6 +223,7 @@ def build_change_plan(
             "count": len(prod),
             "components": prod[:_LIST_CAP],
         },
+        "container_wired": container_wired,
         "covering_tests": (
             {
                 "count": len(tests),

sourcecode/cli.py

@@ -2112,12 +2112,14 @@ def _emit_command_output(
             raise typer.Exit(1)
     if output_path is not None:
         _receipt = _safe_write_file(output_path, content)
-        _mark_output_delivered()
         if not _receipt.get("written"):
             # B15: the answer was produced and thrown away, on request. Saying
             # "written to nul" would be the one thing worse than the error this
             # used to raise.
             typer.echo(_receipt.get("note") or f"Discarded to {output_path}")
+            # A failed write is never delivery. The guard separately exempts
+            # discard sinks and existing files by path, so no state flag is
+            # needed here.
         elif success_msg:
             # C3-26/C3-18: the payload went to the file, so stdout is free and
             # this confirmation is the run's whole answer — `cache warm` and
@@ -2126,12 +2128,14 @@ def _emit_command_output(
             # stderr battery listed its commands by hand. Measured before the
             # fix on spring-petclinic: stdout 0 bytes, stderr 155.
             typer.echo(success_msg)
+            _mark_output_delivered()
         else:
             # C3-122: a command whose emit seam carries no sentence of its own
             # confirmed a 444-second run with total silence. The receipt is a
             # notice, so a pipeline and a PowerShell capture stay exactly as
             # they were (C3-26) and a person at a terminal is told.
             _notice(f"✓ {_receipt.get('bytes', 0)} bytes written to {output_path}")
+            _mark_output_delivered()
     else:
         try:
             sys.stdout.buffer.write(content.encode("utf-8"))
@@ -2154,7 +2158,8 @@ def _emit_command_output(
             _notice("✓ copied to clipboard")
     # The answer has been handed over. Any `done (Xs)` a command deferred is now
     # a true claim and prints here — never before this line (C3-54).
-    _progress_output_emitted()
+    if _OUTPUT_DELIVERED:
+        _progress_output_emitted()
 
 
 def _emit_text_output(
@@ -2860,15 +2865,10 @@ COMMANDS_WITHOUT_FORMAT: "frozenset[str]" = frozenset({
     "version",              # a version string
 })
 
-#: `--format` binds `-f` everywhere except here — the `COMMANDS_WITHOUT_COPY_
-#: SHORTHAND` precedent, for the same reason. `rename-class` bound `-f` to
-#: `--from` before this rule existed, and `ask rename-class . -f OldName` is a
-#: documented invocation: rebinding it would silently give the reader a format
-#: parser for a class name. The long `--format` works; the short form moves at
-#: the next major.
-COMMANDS_WITHOUT_FORMAT_SHORTHAND: "frozenset[str]" = frozenset({
-    "rename-class",
-})
+#: Every payload command uses the same `--format/-f` spelling. A previous
+#: exception let `rename-class -f` overwrite `--from` silently; removing that
+#: alias is safer than making one short flag mean two unrelated facts.
+COMMANDS_WITHOUT_FORMAT_SHORTHAND: "frozenset[str]" = frozenset()
 
 
 #: The one help string for `--progress`, for the same reason as COPY_OPTION_HELP.
@@ -6988,6 +6988,16 @@ def impact_cmd(
         cir._raw_ir, target, max_depth=depth, list_limit=0 if _to_file else None,
         root=root, covered_types=_covered_types,
     )
+    # Token ceilings and this command's byte budget are independent controls.
+    # Publish both at the point where the impact answer is shaped so raising
+    # ASK_MAX_OUTPUT_TOKENS cannot be mistaken for disabling stdout trimming.
+    result["stdout_byte_budget"] = BUDGET_IMPACT if not _to_file else None
+    result["stdout_byte_budget_basis"] = (
+        "impact stdout rendering is capped independently at 50,000 UTF-8 bytes; "
+        "ASK_MAX_OUTPUT_TOKENS does not disable this byte budget"
+        if not _to_file else
+        "No stdout byte budget applies when --output writes the complete answer."
+    )
     result = _apply_budget(result, BUDGET_IMPACT, label="impact", output_path=output_path)
     if _misread and result.get("resolution") == "not_found":
         result["analysis_warnings"] = [*(result.get("analysis_warnings") or []), _misread]
@@ -8722,6 +8732,10 @@ def baseline_diff_cmd(
         Path("."),
         help="Repository root to diff against the stored baseline (default: cwd).",
     ),
+    history_dir: Optional[Path] = typer.Option(
+        None, "--dir", "--history-dir",
+        help="Directory containing stored architectural-baseline-v1 artifacts.",
+    ),
     baseline_file: Optional[Path] = typer.Option(
         None, "--baseline", "-b",
         help="Path to a stored architectural-baseline-v1 JSON artifact. Omit it to "
@@ -8767,7 +8781,7 @@ def baseline_diff_cmd(
     if baseline_file is None:
         from sourcecode.architectural_baseline import latest_baseline_path
 
-        history = _resolve_history_dir(target_dir)
+        history = _resolve_history_dir((history_dir or target_dir).resolve())
         latest = latest_baseline_path(history)
         if latest is None:
             _emit_error_json(
@@ -13330,7 +13344,7 @@ def rename_class_cmd(
         help="Repository root to operate on (default: current directory)",
     ),
     old_name: str = typer.Option(
-        ..., "--from", "-f",
+        ..., "--from",
         help="Current class name (PascalCase, e.g. ServiceA)",
     ),
     new_name: str = typer.Option(
@@ -13350,10 +13364,7 @@ def rename_class_cmd(
         help="Write change audit JSON to a file instead of stdout.",
     ),
     copy: bool = _copy_option(),
-    # `-f` is `--from` on this command and has been since before `--format`
-    # existed: rebinding it would hand a class name to a format parser.
-    # On the record in cli.COMMANDS_WITHOUT_FORMAT_SHORTHAND (C3-59).
-    format: str = _format_option(help="Output format: json (default) or yaml.", shorthand=False),
+    format: str = _format_option(help="Output format: json (default) or yaml."),
     progress_mode: Optional[str] = _progress_option(),
 ) -> None:
     """Rename a Java class throughout the repository.

sourcecode/compare.py

@@ -262,6 +262,7 @@ def build_comparison(
             "resolution": resolution,
             "resolved": resolved,
             "cost": cost,
+            "container_wired": plan.get("container_wired") if resolved else None,
             "why": _evidence_trail(cost, blast, resolved, plan),
         }
         # C1-13/C2-1: when the walk was capped, some magnitudes are floors. The

sourcecode/data_exposure.py

@@ -83,6 +83,7 @@ class ExposedRoute:
     verdict: str
     access: Optional[str] = None
     access_decision: Optional[str] = None
+    chain_decision: Optional[str] = None
 
     def to_dict(self) -> dict:
         out = {
@@ -100,6 +101,8 @@ class ExposedRoute:
         if self.access is not None:
             out["access_under_profile"] = self.access
             out["access_decision"] = self.access_decision
+        if self.chain_decision is not None:
+            out["chain_decision"] = self.chain_decision
         return out
 
 
@@ -232,12 +235,13 @@ def build_data_exposure(
     from sourcecode.security_posture import endpoint_security_surface
     from sourcecode.spring_impact import run_impact_chain
 
-    surface = endpoint_security_surface(cir, root=root)
     profile_access: dict[str, str] = {}
-    if profiles:
-        from sourcecode.posture import endpoint_access_under
+    from sourcecode.posture import endpoint_access_under
 
-        profile_access = endpoint_access_under(root, set(profiles), cir=cir)
+    profile_access = endpoint_access_under(root, set(profiles or ()), cir=cir)
+    surface = endpoint_security_surface(
+        cir, root=root, access_decisions=profile_access,
+    )
 
     handlers = {
         str(getattr(e, "handler_symbol", "") or (e.get("handler_symbol") if isinstance(e, dict) else "")): e
@@ -374,6 +378,10 @@ def _finish_route(
         verdict=verdict,
         access=access,
         access_decision=decision,
+        chain_decision=(
+            str(bound["chain_decision"])
+            if bound.get("chain_decision") is not None else None
+        ),
     )
 
 

sourcecode/explain_endpoint.py

@@ -368,6 +368,10 @@ def _verdict_step(endpoint: Any, surface: "dict[str, dict]") -> "dict[str, Any]"
         verdict=answer.get("verdict"),
         confidence=answer.get("confidence"),
         declared_policy=answer.get("declared_policy"),
+        **(
+            {"chain_decision": answer["chain_decision"]}
+            if answer.get("chain_decision") is not None else {}
+        ),
         note=(
             "this is the coverage answer; `declared_policy` beside it is the "
             "annotation vocabulary, which is evidence and not a verdict"
@@ -439,7 +443,9 @@ def explain_endpoint(
         access_block, access = {"chains": {}, "_error": str(exc)}, {}
     evidence = dict(access_block.get("evidence") or {})
     try:
-        surface = endpoint_security_surface(cir, root=root)
+        surface = endpoint_security_surface(
+            cir, root=root, access_decisions=access,
+        )
     except Exception:
         surface = {}
 

sourcecode/output_ceiling.py

@@ -408,9 +408,7 @@ def ways_out(
     if destination != "file":
         # The env var is the bypass for *this* ceiling; the MB guard on a file is
         # a different one and is not moved by it, so it is not offered there.
-        out.append(
-            f"{ENV_CEILING}=0 (or --max-output-tokens 0) to print it anyway"
-        )
+        out.append(f"{ENV_CEILING}=0 to print it anyway")
     return out
 
 
@@ -480,6 +478,7 @@ def exceeds(content: str, *, to_file: bool) -> "Optional[dict[str, Any]]":
     if tokens <= limit:
         return None
     basis = resolve()
+    output_bytes = len(content.encode("utf-8"))
     return {
         "code": ERROR_CODE,
         "message": (
@@ -489,6 +488,12 @@ def exceeds(content: str, *, to_file: bool) -> "Optional[dict[str, Any]]":
         "hint": build_hint(basis=basis),
         "expected": f"Output under {limit // 1000}K estimated tokens.",
         "estimated_tokens": tokens,
+        "estimated_bytes": output_bytes,
+        "stdout_byte_budget": None,
+        "stdout_byte_budget_basis": (
+            "No independent byte trimming budget; estimated_tokens is derived "
+            f"from UTF-8 bytes / {BYTES_PER_TOKEN}."
+        ),
         "ceiling_tokens": limit,
         "estimate_basis": (
             f"UTF-8 bytes ÷ {BYTES_PER_TOKEN}, an ordering estimate for JSON — "

sourcecode/pr_impact.py

@@ -786,6 +786,23 @@ def _run_pr_impact_internal(
     # `ProductHandlerMapping → blCatalogService → ProductDaoImpl` chain, caught
     # structurally rather than by recognising a name.
     disposition_blockers: list[_disposition.Blocker] = []
+    changed_wired = [
+        item for item in wired
+        if set(getattr(item, "kinds", ()) or ())
+        & {"container_configuration", "interception_point"}
+    ]
+    if changed_wired:
+        _named = ", ".join(item.symbol for item in changed_wired[:3])
+        disposition_blockers.append(_disposition.Blocker(
+            reason=_disposition.REASON_CONTAINER_DISPATCH,
+            detail=(
+                f"{len(changed_wired)} changed container-wired component(s) "
+                f"({_named}{', …' if len(changed_wired) > 3 else ''}) are framework "
+                "dispatch points. Their route reach is not represented by the call "
+                "cone, so routes with no modeled path are unknown rather than "
+                "unaffected (NC-010)."
+            ),
+        ))
     wired_in_cone = detect_container_wired_classes(
         cir, sorted(cone_classes - class_fqns_set)
     )

sourcecode/rule_catalog.py

@@ -56,6 +56,7 @@ RULES: tuple[Rule, ...] = (
     Rule("SEC-006", "SEC", "Cookie created without the Secure attribute"),
     Rule("SEC-007", "SEC", "Credential stored in a deployment descriptor"),
     Rule("SEC-008", "SEC", "SQL built by MyBatis string interpolation"),
+    Rule("SEC-009", "SEC", "Anonymous request-chain exception"),
     Rule("DEAD-001", "DEAD", "Security control present but disabled"),
     Rule("GATE-001", "GATE", "Custom AOP/security gate can be bypassed by proxy limits"),
     Rule("GATE-002", "GATE", "Custom gate advice appears to fail open"),

sourcecode/security_config_scan.py

@@ -258,6 +258,28 @@ def _enclosing_type(source: str, offset: int, fallback: str) -> str:
 def _scan_java(source: str, rel: str) -> "list[SecurityConfigObservation]":
     out: "list[SecurityConfigObservation]" = []
 
+    # SEC-009 — an anonymous request-chain exception is a finding in its own
+    # right. Keep the matcher context requirement narrow so unrelated method
+    # names containing `permitAll()` do not become security findings.
+    permit = re.search(r"\bpermitAll\s*\(\s*\)", source)
+    if permit and re.search(
+        r"SecurityFilterChain|authorizeHttpRequests|authorizeRequests|"
+        r"requestMatchers|anyRequest",
+        source,
+    ):
+        out.append(SecurityConfigObservation(
+            rule="SEC-009",
+            file=rel,
+            line=_line_of(source, permit.start()),
+            symbol=_enclosing_type(source, permit.start(), Path(rel).stem),
+            evidence=permit.group(0),
+            detail=(
+                "The active source contains a request-chain rule that permits "
+                "anonymous access. Verify its matcher and profile condition; this "
+                "exception does not prove that the whole chain is public."
+            ),
+        ))
+
     # SEC-004 — a password stored under a fast unsalted digest.
     if any(tok in source for tok in _ENCODER_CONTEXT):
         for token in _WEAK_DIGESTS:

sourcecode/security_posture.py

@@ -672,6 +672,7 @@ def endpoint_security_surface(
     *,
     root: Optional[Path] = None,
     posture: Optional[Any] = None,
+    access_decisions: "Optional[dict[str, str]]" = None,
 ) -> dict[str, dict]:
     """THE per-endpoint security answer, keyed by ``endpoint_id`` (ADR-0008 R1).
 
@@ -711,11 +712,24 @@ def endpoint_security_surface(
         ep_id = v.get("endpoint_id") or ""
         if not ep_id:
             continue
+        verdict = v.get("verdict") or "coverage_unknown"
+        confidence = v.get("confidence") or Confidence.UNKNOWN.value
+        chain_decision = (
+            access_decisions.get(str(ep_id))
+            if access_decisions is not None else None
+        )
+        if chain_decision in {"permit_all", "anonymous"}:
+            verdict = "probably_exposed"
+            confidence = Confidence.VERIFIED.value
+        elif chain_decision in {"authenticated", "role_required", "deny_all"}:
+            verdict = "protected_standard"
+            confidence = Confidence.VERIFIED.value
         out[ep_id] = {
-            "verdict": v.get("verdict") or "coverage_unknown",
-            "confidence": v.get("confidence") or Confidence.UNKNOWN.value,
+            "verdict": verdict,
+            "confidence": confidence,
             # Evidence, not answer: the guard vocabulary declared on the handler.
             "declared_policy": v.get("policy") or "unknown",
+            **({"chain_decision": chain_decision} if chain_decision is not None else {}),
         }
     return out
 

sourcecode/selftest.py

@@ -131,25 +131,49 @@ def _platform_label() -> str:
 
 def _check_ask09(subject: Subject) -> "dict[str, Any]":
     """The ceiling hint names the bounding flags the command declares."""
-    code, payload, _ = subject.run("endpoints", str(subject.repo))
-    body = _payload_of(payload)
+    probe_args = ("endpoints", str(subject.repo))
+    code, payload, stdout = subject.run(*probe_args)
+    executable = (
+        subject.entry_point
+        if subject.entry_point.endswith("ask")
+        else f"{sys.executable} {subject.entry_point}"
+    )
+    probe_command = " ".join((executable, *probe_args))
+    observed_excerpt = (stdout or json.dumps(payload or {}, sort_keys=True))[:500]
+    evidence = {
+        "probe_command": probe_command,
+        "observed_payload_excerpt": observed_excerpt,
+    }
+    document = payload if isinstance(payload, dict) else {}
+    body = _payload_of(document)
     if code == 0:
         return _result(
             NOT_APPLICABLE,
             "this repository's `endpoints` answer fits under the output ceiling, "
             "so the guard this row is about never ran — a bigger repository is "
             "needed to exercise it here",
+            **evidence,
         )
-    error = body.get("error")
+    # The output seam may wrap the command payload and keep the envelope error
+    # beside it. Read both shapes; dropping the envelope first turns a real
+    # OUTPUT_TOO_LARGE refusal into a false ERROR with code=None.
+    error = document.get("error") or body.get("error")
     error_body = error if isinstance(error, dict) else body
+    if error_body.get("code") != "OUTPUT_TOO_LARGE":
+        return _result(
+            ERROR,
+            f"the probe exited {code} without OUTPUT_TOO_LARGE "
+            f"(observed code={error_body.get('code')!r})",
+            **evidence,
+        )
     hint = str(error_body.get("hint") or "")
-    basis = body.get("hint_basis") or {}
+    basis = document.get("hint_basis") or body.get("hint_basis") or {}
     declared = list(basis.get("declared_flags") or [])
     if "No smaller inline variant is available" in hint and declared:
         return _result(
             FAIL,
             f"the refusal denies a smaller view while declaring {declared}",
-            hint=hint, hint_basis=basis,
+            hint=hint, hint_basis=basis, **evidence,
         )
     if not basis:
         return _result(
@@ -157,12 +181,13 @@ def _check_ask09(subject: Subject) -> "dict[str, Any]":
             "the refusal carries no `hint_basis`, so what the hint was derived "
             "from cannot be read from one run — the observability half of the row",
             hint=hint,
+            **evidence,
         )
     return _result(
         PASS,
         f"the refusal derives its hint from {basis.get('derived_from')!r} "
         f"(context_found={basis.get('context_found')}) and offers {declared}",
-        hint=hint, hint_basis=basis,
+        hint=hint, hint_basis=basis, **evidence,
     )
 
 

sourcecode/spring_impact.py

@@ -1588,6 +1588,10 @@ class ImpactOrchestrator:
                 "indirect_caller_symbol_count_unit": "indirect caller list entries",
                 "caller_metric_note": CALLER_METRIC_RECONCILIATION,
                 "endpoints_total": len(endpoints_affected),
+                "security_surfaces_unit": (
+                    "endpoint rows in the impact chain; each row is one affected "
+                    "endpoint and carries its security posture verdict"
+                ),
                 "findings_in_chain": len(impact_findings),
                 "findings_status": findings_status,
                 "findings_status_note": (

sourcecode/spring_security_audit.py

@@ -508,6 +508,7 @@ class _SEC00XConfigurationWeaknesses:
         # A credential every reader of the repository already holds.
         "SEC-007": "high",
         "SEC-008": "high",
+        "SEC-009": "medium",
         # C3-101 (c), decided in 5.8.7 and recorded here rather than absorbed.
         # The row left this open on purpose after (a) and (b) shipped: 8 `high`
         # findings and 0 true positives is a reason to ask whether the severity
@@ -527,6 +528,7 @@ class _SEC00XConfigurationWeaknesses:
         "SEC-006": "Cookie created without the Secure attribute",
         "SEC-007": "Credential stored in a deployment descriptor",
         "SEC-008": "SQL built by MyBatis string interpolation",
+        "SEC-009": "Anonymous request-chain exception",
         "DEAD-001": "Security control present but disabled",
     }
     #: A pattern that emits more than one rule id declares them all, so a catalogue
@@ -560,6 +562,11 @@ class _SEC00XConfigurationWeaknesses:
             "an identifier such as an ORDER BY column, map it through a closed "
             "allowlist before it reaches the mapper."
         ),
+        "SEC-009": (
+            "Confirm the matcher is intentionally public under the applicable "
+            "profile, keep it as narrow as possible, and do not treat it as "
+            "evidence that unrelated routes are protected or public."
+        ),
         "DEAD-001": (
             "Decide explicitly: either restore the commented control and verify it in "
             "the active profile, or delete the dead block with a note explaining the "
@@ -590,6 +597,11 @@ class _SEC00XConfigurationWeaknesses:
 
         findings: list[SpringFinding] = []
         for obs in observations:
+            profile_condition, active_by_default = _profile_evidence(root, obs.file)
+            evidence = {"matched": obs.evidence, "line": obs.line, "rule": obs.rule}
+            if profile_condition is not None:
+                evidence["profile_condition"] = profile_condition
+                evidence["active_under_default_profiles"] = active_by_default
             findings.append(SpringFinding(
                 id=SpringFinding.make_id(obs.rule, f"{obs.file}:{obs.line}"),
                 pattern_id=obs.rule,
@@ -602,7 +614,7 @@ class _SEC00XConfigurationWeaknesses:
                 symbol=obs.symbol,
                 source_file=obs.file,
                 first_line=obs.line,
-                evidence={"matched": obs.evidence, "line": obs.line, "rule": obs.rule},
+                evidence=evidence,
                 explanation=obs.detail,
                 fix_hint=self._FIX.get(obs.rule, ""),
                 limitations=[
@@ -618,6 +630,23 @@ def _line_of(source: str, offset: int) -> int:
     return source.count("\n", 0, max(0, offset)) + 1
 
 
+def _profile_evidence(root: Optional[Path], rel: str) -> tuple[Optional[str], Optional[bool]]:
+    """Return static @Profile evidence without claiming runtime activation."""
+    if root is None:
+        return None, None
+    try:
+        source = (Path(root) / rel).read_text(encoding="utf-8", errors="replace")
+    except OSError:
+        return None, None
+    match = re.search(r"@Profile\s*\((?P<expr>[^)]*)\)", source)
+    if match is None:
+        return None, True
+    expr = match.group("expr").strip()
+    names = re.findall(r'"([^"]+)"', expr)
+    active_by_default = bool(names) and all(name.startswith("!") for name in names)
+    return expr, active_by_default
+
+
 _JAVA_METHOD_RE = re.compile(
     r"(?P<mods>(?:(?:public|protected|private|static|final|synchronized|abstract|native)\s+)*)"
     r"(?P<ret>[\w.$<>\[\], ?]+)\s+"
@@ -1288,6 +1317,45 @@ def run_security_audit(
         cir, model=model, tx_total=tx_index.stats()["total"]
     )
 
+    _profile_state: dict[str, Any] = {
+        "selected": [],
+        "resolution": "unresolved",
+        "note": (
+            "No runtime Spring profile was supplied to spring-audit; the listed "
+            "profiles are static candidates, not proof of activation."
+        ),
+    }
+    _permit_all_rules: list[dict[str, Any]] = []
+    if root is not None:
+        try:
+            from sourcecode.spring_profiles import profile_population
+            from sourcecode.source_text import blank_java_comments
+
+            _profile_state["population"] = profile_population(
+                Path(root), list(cir.files or [])
+            ).to_dict()
+            for rel in (cir.files or []):
+                if not isinstance(rel, str) or not rel.endswith(".java"):
+                    continue
+                try:
+                    source = (Path(root) / rel).read_text(
+                        encoding="utf-8", errors="replace"
+                    )
+                except OSError:
+                    continue
+                live = blank_java_comments(source)
+                for match in re.finditer(r"\bpermitAll\s*\(\s*\)", live):
+                    profile_condition, active_by_default = _profile_evidence(root, rel)
+                    _permit_all_rules.append({
+                        "file": rel,
+                        "line": live[:match.start()].count("\n") + 1,
+                        "evidence": match.group(0),
+                        "profile_condition": profile_condition,
+                        "active_under_default_profiles": active_by_default,
+                    })
+        except Exception as exc:
+            _profile_state["population_error"] = str(exc)
+
     _sec_limitations = [
         "first_line is the earliest source token recorded for the symbol (SourceSpan index) — inside the declaration, not necessarily the declaration line itself; null when the symbol has no recorded span",
         "SEC-001: only emitted for annotation_based security model",
@@ -1361,6 +1429,15 @@ def run_security_audit(
                 "separately under non_spring_rest_surface)."
             ),
             "security_model": cir.metadata.get("security_model", "unknown"),
+            "security_profiles": _profile_state,
+            "permit_all_rules": {
+                "rules": _permit_all_rules,
+                "count": len(_permit_all_rules),
+                "note": (
+                    "Rules are live source evidence. Profile fields are static hints; "
+                    "runtime activation still depends on the selected Spring profile."
+                ),
+            },
             "analysis_time_ms": elapsed_ms,
             # C3-71: which families answered, and which the budget cut. Present on
             # every run, so "all of them" is a published fact rather than an

{sourcecode-5.8.8.dist-info → sourcecode-5.8.10.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.8
+Version: 5.8.10
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -49,7 +49,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.8.8-blue)
+![Version](https://img.shields.io/badge/version-5.8.10-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -139,7 +139,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.8 — and, on a build that has aged,
+ask version                    # ask 5.8.10 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.8.dist-info → sourcecode-5.8.10.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=yZjHsrmtVA5g1MKeZTpLxBVjvxCMkraqyf_rqnp0jpE,308
+sourcecode/__init__.py,sha256=N6jOxr62_YHW3o1udlxIduDuvRxhmGvpOs9L3F4lv28,309
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/answer_bounds.py,sha256=_51_DCuYEUmI_xwUFxDMiprSavkNakkLiIBbPjevQ3M,9793
 sourcecode/archetype.py,sha256=uubguXP5ltQt25ACNVm9kX4KRTe7JCqkFfg4H9zckCo,40971
@@ -22,13 +22,13 @@ sourcecode/caller_metrics.py,sha256=--sFGDnIog_YGu9xZHMcB91F5xZakfaAKvy15xU54hg,
 sourcecode/caller_reach.py,sha256=M7Ffs5CtlimihfdSy3HtC4WpDP97bRFX15QYOlOfMJw,16626
 sourcecode/canonical_ir.py,sha256=UmCvjGIz7kyjcKdZFYZuxa9y02EfsmDGZj3kUEKzCvo,36200
 sourcecode/chain_rules.py,sha256=Bi6UHfgd-GxWswmnHRcPz5jdbAuqka3Zkz_P-MTvqhw,12767
-sourcecode/change_plan.py,sha256=FAbLtexNThXp51STU-F2a_3AQd1LWd3NsKWMnMNJrPo,12333
+sourcecode/change_plan.py,sha256=wJ896V27a3qb-2vcZhrcOSOqFAwCmEyzbhdbdxM2LlQ,12504
 sourcecode/cir_graphs.py,sha256=RytqSv1WF8kdlfXj2fPQz16LY4akS2kyThbdWL8beCQ,14835
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=FW8siR2aWLMR5Db81zH4N_pVGOqfPoi5RS_IOrWgK1s,723704
+sourcecode/cli.py,sha256=BV6v8OKXO6mW-lFuc7NX5Z2yPToTZnSRptxr7Qekmic,724322
 sourcecode/client_calls.py,sha256=YOPnfRZzRyqmdHvXSVeiunW8cuiuCuWXacNIQRgKMCw,22640
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
-sourcecode/compare.py,sha256=2GdDy0qkDSgmkkpgvoCHitoLj3mt30EeFgJ8PGEXJng,14712
+sourcecode/compare.py,sha256=Lj8epBqrHLWBhiccE2X0ZbaP2H3hNb7qecoN9Jvsj7c,14794
 sourcecode/confidence_analyzer.py,sha256=5li0NyOdS3Ie-f2ZY1gBmnjtkuRvI50l4OnGaKkXAOU,22358
 sourcecode/constraint_diff.py,sha256=hWIO5vsxvHjsgQx23K3r_JMy1W6wQ2Ca4DqB9R_iMnY,5831
 sourcecode/consumer_join.py,sha256=ERwx9SOu0ZE3NgCBYvB0l67iDLnWMdMpVhlCmbA_3Sw,19618
@@ -42,7 +42,7 @@ sourcecode/contract_init.py,sha256=bXRCqWM9tvrDLeT8j7ea6IWf87jB4VJxnlSzGBsRRXo,1
 sourcecode/contract_model.py,sha256=nRxJKPMs1VHwFTa8AVXhGmaLjti3Lr2sjHDpWgv1bfE,3917
 sourcecode/contract_pipeline.py,sha256=4XE-xhab7ysdExXyUOBl2hAH4MABo7moKnT9V4XcEwQ,30243
 sourcecode/coverage_parser.py,sha256=X9scuUWxacahYTrTBGea2Ku-sf-WCVcnc9OEB35_3IU,19340
-sourcecode/data_exposure.py,sha256=8yhlPhLLQt1gcnFfsFO2OFOdDdPkSbzElugrB_nsIJ8,17706
+sourcecode/data_exposure.py,sha256=PR-kX1UdG4_9A7ZDsKQVrPtos5GNTEMEIkpk9Aveoo0,18018
 sourcecode/data_labels.py,sha256=c_hmgudTE68cVRdywfbfonr7nUWIL-JH2HOXB8Pplv0,8453
 sourcecode/declarations.py,sha256=Jr7oJDg004sFw0TvJySNVggXFT2jB6hQgbeQK2qreVo,7000
 sourcecode/defect_identity.py,sha256=XS2VFDImg9NLaRImybKTeyk-CoDSsXmchldg0dwvM7c,7028
@@ -64,7 +64,7 @@ sourcecode/error_schema.py,sha256=uwosfNaSujtYm11_732Hu92z5ITV040fQDaIyefSvR4,16
 sourcecode/evidence_provider.py,sha256=GSSL44JEaouO5AHks2sB3d1YvC9xIKIld1yBYxZpXxo,4277
 sourcecode/execution_plan.py,sha256=5LyoIsgM5Fg2D1hz-dTD7iqU3xVFS3EyR5yHBlJW5M8,25679
 sourcecode/explain.py,sha256=o1xE-PEWOealHgdT-ZbfpdjHItghzz_HMR1CRCJQySg,31938
-sourcecode/explain_endpoint.py,sha256=rkNPoPAEkXLIH-rlYrOQDlJVbl6V_s3mkHtFBrdl3us,19604
+sourcecode/explain_endpoint.py,sha256=NtAoNs4czD2WbBccWQx9KNHs40MyVEvTvutTIQhmEm4,19796
 sourcecode/field_deprecations.py,sha256=AL-0VWD0rolQQWfJAjLrfiYrhVEHlKuG0xadg1yBckc,7001
 sourcecode/file_chunker.py,sha256=3vkM3mDQ5eE_yTPvUgjyjpGFBIjkW6_mrBmIbrylnA8,16444
 sourcecode/file_classifier.py,sha256=pJCeN9KqWpAwKMCgGP4KDsBjuWMeo4zlbj5fv3hk9dA,15587
@@ -92,7 +92,7 @@ sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk
 sourcecode/openrewrite_recipe.py,sha256=4dyY5twRB6Xew-G9Zy5FafNZwlMU1S7DnRa2FqPkhpQ,12233
 sourcecode/output_bounds.py,sha256=OtT7_g8ofuWkXRWlEeUSxx9X-CLMckXAbLCzzyG30so,7694
 sourcecode/output_budget.py,sha256=GxoFnbwk0dvqScgmMRPZHj7m-zRIoHLwUKplrH0u89s,13872
-sourcecode/output_ceiling.py,sha256=deQ5ExPfuOGKRpIKqHUVElrsRhvpYkIpf05B1sKdbAo,20745
+sourcecode/output_ceiling.py,sha256=DZt9BtlMLuCLCwMdnLvFi8qEME2AKhDVuKZR5Ws1bMI,21003
 sourcecode/output_encoding.py,sha256=OxiZQtr7uWBDUtblNQviNHsTH1Xo9AZEpsegPlQWKFk,2139
 sourcecode/output_sink.py,sha256=Eya-PnXxqc3RGulJoLhuC9LUF73SZD0aO5O2B0xAMXU,8762
 sourcecode/parallel.py,sha256=QocwdZoUabdxzd_jEz7f6B2XMsYWFaCFaIl0tIEQs3g,10546
@@ -105,7 +105,7 @@ sourcecode/phased_run.py,sha256=fZxxiCX-CykagFVR_Fp2Tin3H6FDSV8YRpYGtsRAXj8,1835
 sourcecode/pipe_contract.py,sha256=PML0Er5d8uDyec4OrdUXuyqHbGPUYndjeaKUjkFz2u4,8369
 sourcecode/posture.py,sha256=m1sYDLtGvVkvDEVqMxuDvAKz4-KPj0z5Q6x3V_5U-FM,83276
 sourcecode/pr_comment_renderer.py,sha256=239PmJdf95av_ZW236C7_tvq_ahECeuF9AZxrheJ4OQ,15573
-sourcecode/pr_impact.py,sha256=JRVKV0LiVpE0aTy_Wcy-o0EhWdd1OChxHRIcS0pZHl4,36216
+sourcecode/pr_impact.py,sha256=taHp0X57tLHyKQ5Qvx7UM1HhX4_csw5t0bgLdN7jYm8,37010
 sourcecode/prepare_context.py,sha256=-FFvr8NgCAHckTp93ZjWEdI3fFURaLkTZiwt3_0eqgg,239532
 sourcecode/product_info.py,sha256=0zjZEutL7iDdp9aVyIumIrNyNn9VWYFc2lIytSbjBP4,727
 sourcecode/progress.py,sha256=naKbWFqf-eTE3vtLsi-eHYILz0p3pxCASAzMmvxUIAI,21643
@@ -127,7 +127,7 @@ sourcecode/repository_ir.py,sha256=-tV6QuCu56kUaosz4-SgkPdL46DuOlvlRAYxMOhtvXU,4
 sourcecode/ris.py,sha256=zlns4esv1tK8VDIYzOzRmw5yM6VLx7oxaPNB_kN3it4,28617
 sourcecode/risk.py,sha256=hXddUjiI-SS_yQ0gZyhufs4lzKwWySOKY4Lj96gL9_A,89733
 sourcecode/risk_model.py,sha256=RoC-G15qZP5BLEwwmcr4eJ0APgvIbh1WTqhTVT-5YFE,10895
-sourcecode/rule_catalog.py,sha256=pTkgkQZ1u7atB3fkQJ9BPWo8lNiamvEuRN7MtRgle0c,5263
+sourcecode/rule_catalog.py,sha256=QCx6ToFTMCtDt5uuX1uBMLuw3b9Cd92gGRsX34kud4U,5328
 sourcecode/rule_pass.py,sha256=DTNxD-nAecMJhIzI1LCd9FyRumInQSZjitacNh4Zoc8,14671
 sourcecode/runs.py,sha256=o4oXkB3WFJGScbK_C10OAWzsE18B9Zc55u_IE8_yl4M,6291
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
@@ -138,9 +138,9 @@ sourcecode/schema_producers.py,sha256=4XzW4wZXnFHOaJT7XenirXGCo0pPZhkdhb7zcDtqFn
 sourcecode/schema_registry.py,sha256=ny9yqt_Mwt92TwRRviEXA8jfpeld-xB9KUTOaTiyhZs,20996
 sourcecode/security_chain.py,sha256=1YZVeFLwy65kntMBhMNvz1cUpOoKCmvEqYICgxs66Gw,6823
 sourcecode/security_config.py,sha256=LUppRDYQK0oKM4qdEOLObaeU3frFTS-paEZo7dMgtY8,5467
-sourcecode/security_config_scan.py,sha256=iXDeulgdbAwUFR01p9PgrJED2vd4HE2FCZgqrxX5D0E,32824
-sourcecode/security_posture.py,sha256=rVCu5-InQshwI0bWqanxg5rg_fhV3o8d35ifQeQEM7M,55197
-sourcecode/selftest.py,sha256=mGvShPbOwNqayTJ8GnpTGsscMIh5gMSItLQvDiSmb2w,17999
+sourcecode/security_config_scan.py,sha256=Wv7QqEx_KbgmhbOGuX7RQfotzkkif43PFU1LohKNWCM,33818
+sourcecode/security_posture.py,sha256=wj6WwvasIh6r-minwBz3oz1T9Zl8SPsPhn7zxDD-yng,55861
+sourcecode/selftest.py,sha256=a-6B-0k8tdVapGlXy0oC4FBxqgHgb0m4kb8oxDknnvI,19109
 sourcecode/semantic_analyzer.py,sha256=xGwQvhU9xeOlZ4N-TPXFZT8HBHx4Rg0nPwu8nDFl00Y,95621
 sourcecode/semantic_impact_engine.py,sha256=t09IirGC3JjQDy33JZd1_WKzQVKXkoNl3-XEUr5kjis,20563
 sourcecode/semantic_integration_engine.py,sha256=ZjyKJKOj-adScWlYBuWx8Ee_P0F4_OImUJVnCYgopuU,20952
@@ -150,11 +150,11 @@ sourcecode/servlet_surface.py,sha256=CeiebkxLXKojUQxIf7HV7tdQAwLM32ggDUwBnVQIjdo
 sourcecode/source_text.py,sha256=R52gmSljz7L6YVPbixv5W-LOZ5eKUVvSUP3S-QH_IWc,9047
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=cW6NiQAFUM9mDYPitJr6MrQg--YBI41LxrSEMI9aeIQ,25272
-sourcecode/spring_impact.py,sha256=NaAZbY8N8gmtf9NHBh5o550yvuiewtmBE7PfAEkCIk8,88321
+sourcecode/spring_impact.py,sha256=yngLmb3ABL9_6b59xSuU6sn2bAJj1MVCGy9dsjgNaic,88539
 sourcecode/spring_model.py,sha256=7GqgcWnHC96ixusRJmD-9tDV93qTdkMh-8e7CBNK0pc,24126
 sourcecode/spring_profiles.py,sha256=-kwrCK0O-MRjrCp6SA1d31t--o4Tg87iqPVrTwxoIUs,19605
 sourcecode/spring_properties.py,sha256=kPTk5qAJxdbHc1hclhHAP0O-hCIzBn8PTh3lzl-I4a4,8400
-sourcecode/spring_security_audit.py,sha256=sn0FtdcBKbRFPZj6mZ3CMHbpGoqcj2Md9MlOt5uUUSY,66246
+sourcecode/spring_security_audit.py,sha256=TJHQG_Qen_Fr3rLjDbvfZ08rp7LK-nYVBPIx3eG-qq8,69673
 sourcecode/spring_semantic.py,sha256=UrmLg_4gmBVmMqvSnUMgSReVEERVGv3X7LYDBEs6k_o,16598
 sourcecode/spring_tx_analyzer.py,sha256=WBibPgkjQm33kFgERx6zLtp87FpJNE5V_4JI3xZ5zD4,50094
 sourcecode/sql_taint.py,sha256=As1DbEdjXMBFjCTXU5ojksOzuKkP6LmnuMVnzzmckzc,26998
@@ -240,13 +240,13 @@ sourcecode/telemetry/consent.py,sha256=pQdl-QeLl6Gcibn0eWHSKZrm-HYSsjpVqOnjrgFp8
 sourcecode/telemetry/events.py,sha256=4_yeO58U-Cwc1Qb27VB0_EjhmroY0k91n3_VGxeALB8,2776
 sourcecode/telemetry/filters.py,sha256=RzxauTz8HliO4BllQnXEXc7zTeqdCZi5MgqGEDuW7OQ,6570
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode/_docs/DEFECT-LEDGER.md,sha256=0XJFc2Eve4ht3IwZFqAbd4ct34uv4vB-PC7d8NZ6nv8,728714
+sourcecode/_docs/DEFECT-LEDGER.md,sha256=l9rGV6X-RmLgpWuYBqMcvjjjBx2NHcmdlDH8epSd33A,736756
 sourcecode/_docs/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
 sourcecode/_docs/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode/_docs/USER_GUIDE.md,sha256=Sk3P7oOjsYF6YxhKaxIUsM8Y0Dm1pQqrpOYXD2dUnqg,86739
-sourcecode-5.8.8.dist-info/METADATA,sha256=vQdqwv4iB9WEAQyW1ihkDlzKeIlg8gvWVKNyqC-NTKY,50807
-sourcecode-5.8.8.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-5.8.8.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-5.8.8.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
-sourcecode-5.8.8.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode-5.8.8.dist-info/RECORD,,
+sourcecode/_docs/USER_GUIDE.md,sha256=PTMJ0zh_RAXmctfwsNA9-xBNudO62y1Io5rSYlI-Oqs,86740
+sourcecode-5.8.10.dist-info/METADATA,sha256=WEFjTsf2cYQHfik7y8eS6Jy3Pp7JfLyMc2HjbVc-DE8,50810
+sourcecode-5.8.10.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-5.8.10.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-5.8.10.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
+sourcecode-5.8.10.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
+sourcecode-5.8.10.dist-info/RECORD,,