sourcecode 5.8.8__tar.gz → 5.8.10__tar.gz

{sourcecode-5.8.8 → sourcecode-5.8.10}/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## [5.8.10] — 2026-08-19
+
+*Audit-remediation release: the 5.8.9 re-audit defects that were reproducible in
+the repository now have one authority, a regression test and an atomic fix.*
+
+### Fixed
+- A failed `--output` write can no longer be marked delivered by the common
+  progress seam; the global promise guard now returns `EXECUTION_FAILED` rather
+  than allowing exit 0 without the requested artifact.
+- `selftest` ASK-09 reads `error.code`, `error.hint` and `hint_basis` from both
+  supported output-envelope shapes, so a valid ceiling refusal passes its own
+  gate.
+- `spring-audit` emits `SEC-009` for active request-chain `permitAll()` rules,
+  including static `@Profile` evidence; `permit_all_rules` replaces the ambiguous
+  aggregate metadata name.
+- `data-exposure`, `pr-impact`, `plan` and `compare` retain their relevant chain
+  decision or container-wiring floor instead of presenting the uncovered surface
+  as unaffected.
+- `impact` discloses its independent 50,000-byte stdout budget, and
+  `impact-chain` names the population counted by `security_surfaces`.
+
+### Remaining audit work
+- Provider-specific migration disclosure, the residual answer-contract parity
+  items, and cost/progress calibration remain tracked in the roadmaps; EclipseLink
+  support itself remains a deferred product feature.
+
+## [5.8.9] — 2026-08-19
+
+*Feature reconciliation release: the ASK 5.8.8 audit recommendations were
+verified against the current implementation and their deferred work is now
+explicitly recorded.*
+
+### Feature status
+- EclipseLink remains deferred as a product axis; current migration output uses
+  the honest `non_coverage` contract rather than inferring Hibernate work.
+- Shared answer contracts, versioned performance baselines, progress controls and
+  safe audit-coverage checks are shipped and covered by the regression battery.
+- No new parallel heuristics were introduced for recommendations already served
+  by existing authorities.
+
 ## [5.8.8] — 2026-08-19
 
 *Follow-up bug fixes after the 5.8.7 audit, with cache correctness, Java source

{sourcecode-5.8.8 → sourcecode-5.8.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.8
+Version: 5.8.10
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -49,7 +49,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.8.8-blue)
+![Version](https://img.shields.io/badge/version-5.8.10-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -139,7 +139,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.8 — and, on a build that has aged,
+ask version                    # ask 5.8.10 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.8 → sourcecode-5.8.10}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.8.8-blue)
+![Version](https://img.shields.io/badge/version-5.8.10-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -94,7 +94,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.8 — and, on a build that has aged,
+ask version                    # ask 5.8.10 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.8 → sourcecode-5.8.10}/docs/DEFECT-LEDGER.md

@@ -16,8 +16,23 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
-**As of 2026-08-19, HEAD `f39432b`:** the latest audit queue was implemented in fourteen
-post-5.8.7 commits. These are committed follow-up fixes, not a tagged release. This table is
+**As of 2026-08-19, the `5.8.10` release commit:** this is the current status of
+the 5.8.9 re-audit queue. The audit observations below remain historical evidence;
+only the table here declares present state.
+
+| Rows | Current status | Evidence |
+|---|---|---|
+| `AUD-588-B01`, `AUD-589-B01`, `C3-122` | **closed** | `20596c8`; failed writes cannot suppress the global output-promise guard, covering both `risk` and `audit-report` emit paths. |
+| `AUD-588-B03` | **closed** | `16a52cc`; `SEC-009`, static `@Profile` evidence and `permit_all_rules` are emitted with regressions. |
+| `AUD-588-B04` | **closed** | `fd34eb1`; `data-exposure` preserves the chain decision for every route. |
+| `AUD-588-B05` | **closed** | `c15f5b6`; changed container-wired components block a false `unaffected` disposition. |
+| `AUD-588-B07` | **closed** | `5cc6ba7`; ASK-09 reads the envelope error contract and covers the wrapped shape. |
+| `AUD-588-B08` | **closed** | `c084555`; `impact` publishes its independent stdout-byte budget. |
+| `AUD-588-B11` (container/units subset) | **closed** | `ca72b61`, `a49cf6a`; plan/compare publish container wiring and impact-chain names security-surface units. |
+| `AUD-588-B02`, `B06`, B11 residuals, `B12` | **open** | Require provider non-coverage verification, remaining contract parity and controlled cost calibration; no closure is inferred from the release. |
+
+**As of 2026-08-19, the `5.8.9` release commit:** the latest audit queue was implemented in
+committed post-5.8.7 fixes. This table is
 the authoritative status for round 11; detailed rows retain their original findings and
 acceptance criteria for auditability.
 
@@ -38,6 +53,64 @@ acceptance criteria for auditability.
 | `C3-55` | **closed** | `63249df`; below-floor analysis budgets warn in noninteractive runs while execution continues |
 | `C3-55` regression | **closed** | `f39432b`; above-floor provenance remains quiet off-TTY and is emitted interactively |
 
+## Current Audit Intake: 5.8.8
+
+The external audit of `ask 5.8.8` against `saint-server` (`HEAD 3dde0376`, 3,342 Java
+files, Windows 11/Git Bash, `ASK_READONLY=1`) scored **75/100** and exercised **53/61
+invocables (87%)**. The repository stayed byte-identical. These findings are new relative
+to the closed round-11 queue and are not marked closed until reproduced and covered here.
+
+| ID | Severity | Defect | Initial status |
+|---|---|---|---|
+| `AUD-588-B01` | Critical | `risk` can exit 0 with empty stdout and fail to create `-o`; long runs also vary widely. | **open — reproduce first; require parseable output or typed non-zero error** |
+| `AUD-588-B02` | High | `migrate-check` includes an inapplicable Hibernate axis and publishes ghost effort for an EclipseLink repository. | **open — fix applicability/aggregate; add fixture** |
+| `AUD-588-B03` | High | `spring-audit` lacks an active `permitAll` rule and does not expose security-bean profile activation state. | **open — reuse posture access/profile projection** |
+| `AUD-588-B04` | High | `explain-endpoint` and `data-exposure` discard a derived `permit_all` chain decision and emit `coverage_unknown`. | **open — make verdict consume the chain authority** |
+| `AUD-588-B05` | High | `pr-impact.endpoint_disposition` marks all endpoints unaffected despite container-wired security changes. | **open — propagate to `unknown` or publish a disposition caveat** |
+| `AUD-588-B06` | Medium | `migrate-check` is the only audited command without `non_coverage`, hiding the EclipseLink gap. | **open — disclosure before product expansion** |
+| `AUD-588-B07` | Medium | ASK-09 selftest failure is not reproducible and the row omits its probe command and observed excerpt. | **open — publish probe provenance and assert error code first** |
+| `AUD-588-B08` | Medium | Output-too-large hints recommend a rejected subcommand flag and omit the independent byte budget. | **open — derive flags and disclose both budgets** |
+| `AUD-588-B09` | Medium | `rename-class` reuses `-f` for `--from`, conflicting with the CLI-wide format alias and allowing silent overwrite. | **open — remove collision or reject duplicate destinations** |
+| `AUD-588-B10` | Medium | `baseline diff` lacks `--dir`, breaking the external read-only capture/trend/diff flow. | **open — restore flag parity with regression coverage** |
+| `AUD-588-B11` | Medium | Seven cross-command contract inconsistencies mix naming, units, container-wired warnings, build discovery, populations and tier claims. | **open — solve through shared fact/units authorities** |
+| `AUD-588-B12` | Low/Medium | Cost model is stale by up to 1.74x at warm cache and long commands can be silent until timeout. | **open — remeasure 5.8.8 and add default foreground progress** |
+
+### Re-audit Intake: 5.8.9
+
+The same external auditor re-ran the same `saint-server` snapshot under the same
+read-only protocol against 5.8.9. Score: **80/100** (75 previously), still **53/61
+invocables (87%)**. The CIR remained byte-identical. This reopens false closures and
+adds one newly observable zero-output path; it does not duplicate the rows above.
+
+| ID / lineage | Status | Evidence and next action |
+|---|---|---|
+| `AUD-588-B01` / `C3-122` | **reopened, critical** | `risk` exits 0 with empty stdout and can omit a promised `-o` file. Fix early/partial composition and enforce a typed failure or parseable answer through the real entry point. |
+| `AUD-588-B02` + `B06` | **open, critical** | EclipseLink still receives a Hibernate axis and `non_coverage` is null. Make `not_applicable_reason` authoritative for applicability, effort and aggregate; publish provider non-coverage. |
+| `AUD-588-B03` | **partial** | `permitAll` evidence and profiles are present, but no rule or per-finding activation state exists; rename `active_permit_all` to an honest per-entry contract. |
+| `AUD-588-B04` | **partial** | `explain-endpoint` is fixed; `data-exposure` still reports `coverage_unknown` for chain-permitted routes. |
+| `AUD-588-B05` | **regression** | `unaffected_basis` claims no blocker while container-wired changes are present. Demote routes or publish a blocker/caveat; preserve `affected + unknown + unaffected = total`. |
+| `AUD-588-B07` | **partial** | Selftest publishes provenance but reads `error.code` at the wrong envelope level, producing a false `error` instead of `pass`. |
+| `AUD-588-B08` | **partial** | `impact` still trims stdout at 50,000 bytes after the token ceiling is raised without naming that second budget. |
+| `AUD-588-B11` | **open, six residuals** | `plan`/`compare` miss container reach; units, build discovery, populations and risk tier still diverge. |
+| `AUD-588-B12` | **partial** | Timeline completes, but cost anchors are stale and long foreground commands remain silent by default. |
+| `AUD-589-B01` | **new, high** | `audit-report` can exit 0 with empty stdout; its `-o` path diverges and leaves partial evidence when killed. Reuse the working `_partial` and output-promise contracts. |
+| `AUD-589-B02` | **unconfirmed performance suspicion** | `data-exposure --config` was measured 2.76x slower with identical output; require convergent controlled measurements before code changes. |
+
+### Recommended Features From This Audit
+
+| ID | Recommendation | Classification |
+|---|---|---|
+| `AUD-588-F01` | Explicit EclipseLink/JPA-provider migration axis, including namespace and coordinate changes. | **Deferred**; its prerequisite provider `non_coverage` disclosure is still open. |
+| `AUD-588-F02` | Shared answer-contract layer for units, populations, caveats and container-wired reach. | **Partially covered**; six consumers remain disconnected according to the re-audit. |
+| `AUD-588-F03` | Versioned cost-model calibration by repository size and cache state. | **Partially covered**; schema and dimensions exist, but 5.1.0-era anchors are stale. |
+| `AUD-588-F04` | Default progress/heartbeat for long foreground commands without contaminating machine-readable stdout. | **Explicit opt-in by decision**, not default coverage; update cost advice accordingly. |
+| `AUD-588-F05` | Controlled audit-coverage expansion from 87% to 90% via safe `auth logout`, reversible `telemetry disable` and dirty-tree `verify-edit` checks. | **Locally verified only**; external audit remains at 87% with eight blocked invocables. |
+
+**Recommended fix order:** `B01`, `B02`, `B04`, `B03`, `B05/B11`, `B08/B09`, `B07`,
+then `B06/B10/B12`. The dirty-tree `verify-edit` path remains unverified, not confirmed
+broken; the audit's positive results for inheritance, profile posture, caps, non-coverage,
+read-only flows and typed errors are regression anchors for this queue.
+
 The current full-suite exceptions are environmental or pre-existing measurement gaps,
 not silently accepted fixes: RIS tests cannot write the default `~/.sourcecode/cache`
 under the managed sandbox; `cold-start` therefore reports `no_ris`. The E-6 module-name

{sourcecode-5.8.8 → sourcecode-5.8.10}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,10 +3,24 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT STATE — 2026-08-19 — 5.8.8 working tree**
+> **CURRENT STATE — 2026-08-19 — 5.8.10 release**
 >
-> The tagged baseline is `5.8.7` (`9aa9852`); the working version is `5.8.8`. Fourteen follow-up fix commits are now applied
-> through `f39432b`; this is post-release work, not a new tagged release.
+> The 5.8.9 re-audit battery closed the reproducible output, envelope, security-chain
+> and container-reach defects in atomic commits. `20596c8` fixes the output-promise
+> seam; `16a52cc` adds `SEC-009` and profile evidence; `fd34eb1`, `c15f5b6`,
+> `5cc6ba7`, `c084555`, `ca72b61` and `a49cf6a` close the independent consumer
+> regressions. Targeted cross-command regression suites pass.
+>
+> Remaining work is explicit: provider-specific migration non-coverage (`B02/B06`),
+> the unresolved portions of answer-contract parity (`B11`), controlled cost-model
+> recalibration and the opt-in progress decision (`B12`). EclipseLink migration support
+> remains a deferred feature, not a bug fix. Historical 5.8.9 intake tables below are
+> superseded by this block where their statuses differ.
+
+> **CURRENT STATE — 2026-08-19 — 5.8.9 working tree**
+>
+> The tagged baseline is `5.8.7` (`9aa9852`); the working version is `5.8.9`. The
+> 5.8.8 audit fixes and feature reconciliation are included in this release commit.
 >
 > | Scope | Status | Evidence |
 > |---|---|---|
@@ -24,16 +38,94 @@ customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 > **The round-11 bug queue is now closed.** `R2`, `P1-proc`, `C3-127`, `C3-129` and `B21`
 > were already shipped in 5.8.6; `C3-84` was corrected by measurement and its disclosure
 > half shipped in the same period. They are not current bugs. Targeted regression tests for
-> this queue pass. The full suite still has seven known,
-> unrelated failures in polyglot dependency parsing, Java test-module exclusion, RIS/cold-start
-> fixtures and the advisory-budget warning fixture; they are not attributed to these commits.
-> Four additional fixes are now recorded in the ledger: `af79bb3` (dependency-cache
+> this queue pass. The previous suite exceptions were separately classified as environment
+> or historical-fixture gaps; they are not attributed to these commits. Four additional fixes
+> are recorded in the ledger: `af79bb3` (dependency-cache
 > identity), `f29312e` (Java `-test`/`-tests` modules), `63249df` and `f39432b` (budget
 > warning behavior). The full suite still has seven environment or historical-fixture
 > failures: four E-6 publication assertions, ASK-09 real-scale `cold-start`, and two
 > RIS/cold-start assertions blocked by the sandbox's unwritable default cache. Everything
 > below is historical audit evidence unless it explicitly says **CURRENT STATE**.
 
+> **CURRENT AUDIT INTAKE — 2026-08-19 — ASK 5.8.8 on `saint-server`**
+>
+> External audit score: **75/100**, coverage **53/61 invocables (87%)**, subject snapshot
+> `3dde0376`, Windows 11/Git Bash, `ASK_READONLY=1`. The repository remained byte-identical.
+> This intake supersedes the statement that the current bug queue is empty: the previous
+> round-11 queue is closed, but this new audit reports the following actionable defects.
+>
+> ### Bugs Reported
+>
+> | ID | Priority | Finding | Intake / next action |
+> |---|---|---|---|
+> | `AUD-588-B01` | P0 | `risk` can exit 0 with empty stdout and fail to create `-o`; long runs are also nondeterministic. | Reproduce on a clean single-process fixture; enforce parseable output or typed non-zero error. Add the invariant that exit 0 cannot carry an empty result. |
+> | `AUD-588-B02` | P1 | `migrate-check` includes the Hibernate axis and ghost effort after its evidence says EclipseLink makes it inapplicable. | Make aggregate inputs consult `not_applicable_reason`; add a non-applicable provider fixture. Group the effort removal with this fix. |
+> | `AUD-588-B03` | P1 | `spring-audit` lacks an active `permitAll` rule and does not publish profile activation state for security findings. | Reuse posture's profile/access projection; add the active-chain rule and conditional activation metadata without treating assumptions as certainty. |
+> | `AUD-588-B04` | P1 | `explain-endpoint` and `data-exposure` discard a derived `permit_all` chain decision and publish `coverage_unknown`. | Make the verdict consume the already-derived chain step; preserve `coverage_unknown` only when the chain is undecidable. |
+> | `AUD-588-B05` | P1 | `pr-impact.endpoint_disposition` reports all 3,742 endpoints as unaffected while the same payload marks the changed security component container-wired and high risk. | Propagate container-wired reach into `unknown` or add an explicit disposition caveat while preserving `affected + unknown + unaffected == total`. |
+> | `AUD-588-B06` | P2 | `migrate-check` is the only audited command without `non_coverage`, hiding the EclipseLink product gap. | Add a provider/JPA non-coverage item before implementing new migration logic. |
+> | `AUD-588-B07` | P2 | `selftest` ASK-09 fails for a non-reproducible reason and does not publish the probe command or observed excerpt. | Add `probe_command` and `observed_payload_excerpt` to every row; assert the error code before checking hint fields. |
+> | `AUD-588-B08` | P2 | Output-too-large hints recommend a subcommand-rejected `--max-output-tokens` flag and omit the independent stdout-byte budget. | Derive flags from the command; mention the environment variable for the global token budget and disclose byte trimming separately. |
+> | `AUD-588-B09` | P2 | `rename-class` aliases `-f` to `--from`, conflicting with the CLI-wide `-f/--format` convention and silently overwriting an explicit value. | Remove the conflicting short alias or reject duplicate destinations; add parser regression tests. |
+> | `AUD-588-B10` | P2 | `baseline diff` lacks `--dir` although `capture` and `trend` accept it, breaking the external read-only flow. | Add the parity flag and test capture → trend → diff entirely outside the repository. |
+> | `AUD-588-B11` | P2 | Cross-command contracts diverge: `impact` naming, `impact-chain` security units, container-wired warnings, nested Maven discovery, source-file counts, and `risk` tier classification. | Treat as one shared-fact/units parity initiative, then add consumer-level regressions rather than six isolated patches. |
+> | `AUD-588-B12` | P2 | Cost model is stale by up to 1.74x on warm cache; long commands can run silently until external timeout. | Re-measure 5.8.8 at this scale, publish measurement provenance, and enable progress by default for long foreground commands. |
+>
+> **Recommended order:** `B01` → `B02` → `B04` → `B03` → `B05/B11` → `B08/B09` →
+> `B07` → `B06/B10/B12`. Each code fix must receive its own commit and targeted regression
+> before the next one. The audit's `verify-edit` dirty-tree branch remains unverified; it is
+> a validation gap, not a confirmed defect.
+>
+> ### Recommended Features
+>
+> | ID | Feature | Decision |
+> |---|---|---|
+> | `AUD-588-F01` | Explicit EclipseLink/JPA-provider migration axis, including namespace and coordinate changes. | Product feature, deferred. First ship `B02/B06` so the current answer is honest via `non_coverage`; do not infer Hibernate effort for EclipseLink. |
+> | `AUD-588-F02` | Shared answer-contract layer for units, population names, `non_coverage`, container-wired reach and caveats. | **Partial**; six consumers remain disconnected according to the re-audit. |
+> | `AUD-588-F03` | Versioned cost-model calibration with repository-size and cache-state dimensions. | **Partial**; schema/dimensions exist but anchors are stale. |
+> | `AUD-588-F04` | Default progress/heartbeat for long foreground commands such as `audit-report` and `timeline`. | **Explicit opt-in by decision**, not default coverage. |
+> | `AUD-588-F05` | Expand audit coverage from 87% toward 90% using safe candidates: no-op `auth logout`, reversible `telemetry disable`, and dirty-tree `verify-edit`. | **Locally verified only**; the external audit remains at 87%. |
+
+> **RE-AUDIT INTAKE — 2026-08-19 — ASK 5.8.9 on the same `saint-server` snapshot**
+>
+> The external re-audit scored **80/100** (up from 75), with the same 53/61 invocables
+> and the same read-only protocol. It confirms the cheap CLI fixes, but reopens the
+> two priority defects that were incorrectly treated as closed and identifies one
+> correction regression. The CIR is byte-identical across 5.8.8/5.8.9, so these are
+> emission, contract or consumer issues rather than parser drift.
+>
+> | ID / lineage | Status after re-audit | Required action |
+> |---|---|---|
+> | `AUD-588-B01` / `C3-122` | **REOPENED, critical** — `risk` exits 0 with empty stdout and can miss a promised `-o` file. | Fix the early/partial composition path; enforce parseable output or typed non-zero failure through the real entry point. |
+> | `AUD-588-B02` + `B06` | **OPEN, critical** — EclipseLink still receives a Hibernate axis and `non_coverage: null`. | Make `not_applicable_reason` authoritative for applicability, effort and aggregate; publish provider non-coverage. |
+> | `AUD-588-B03` | **PARTIAL** — profile/permit evidence exists, but no security rule or activation state reaches findings. | Add the active-chain rule, per-finding profile condition and honest `permit_all_rules` naming. |
+> | `AUD-588-B04` | **PARTIAL** — `explain-endpoint` is fixed; `data-exposure` still emits `coverage_unknown`. | Bind the independent data-exposure consumer to the chain authority. |
+> | `AUD-588-B05` | **REGRESSION** — `unaffected_basis` says exclusions are safe while container-wired changes are present. | Demote routes or publish a non-empty blocker/caveat; preserve the partition invariant. |
+> | `AUD-588-B07` | **PARTIAL** — provenance is present, but `selftest` reads `error.code` at the wrong envelope level. | Read the nested error contract and gate the four ASK-09 branches. |
+> | `AUD-588-B08` | **PARTIAL** — token hint is fixed; `impact` still has a 50,000-byte stdout trim not named alongside the token budget. | Publish both budgets and make the hint disclose token vs byte behavior. |
+> | `AUD-588-B11` | **OPEN, six residuals** — `plan`/`compare` miss container reach; units, build discovery, populations and risk tier still diverge. | Connect all consumers to shared authorities and add parity tests. |
+> | `AUD-588-B12` | **PARTIAL** — timeline completes, but cost anchors are stale and long commands remain silent by default. | Recalibrate from 5.8.9 measurements; decide default heartbeat and foreground classification. |
+> | `AUD-589-B01` | **NEW, high** — `audit-report` can exit 0 with empty stdout; `-o` follows a different/long partial path. | Reuse the working `_partial` contract and shared output-promise guard with `risk`. |
+> | `AUD-589-B02` | **UNCONFIRMED performance suspicion** — `data-exposure --config` measured 2.76x slower with identical output. | Reproduce with a convergent, controlled multi-run measurement before changing code. |
+
+> **Feature status correction:** `F02` is not fully covered while six cross-command
+> consumers remain disconnected; `F03` is not covered by schema versioning alone while
+> its anchors are stale; `F04` remains an explicit opt-in decision and must be reflected
+> in foreground cost advice; `F05` is verified only in controlled local tests, not on the
+> auditor's 8 blocked invocables. `F01` remains deferred, but its `non_coverage` prerequisite
+> is now a confirmed open defect rather than a completed contract.
+>
+> The audit also confirms that inheritance, commented-annotation filtering, profile posture,
+> read-only dry-run flows, endpoint caps, non-coverage and typed errors are working. New work
+> must reuse those authorities rather than introduce parallel heuristics.
+
+> **FEATURE BATTERY UPDATE — 2026-08-19 — 5.8.9**
+>
+> `AUD-588-F01` remains deliberately deferred: EclipseLink is a product axis, not a
+> safe alias for Hibernate. `F02` and `F03` are partial, `F04` remains opt-in, and
+> `F05` is locally verified but not externally complete. The feature battery passed
+> its targeted suite; no duplicate implementation was added.
+
 > **PHASE UPDATE 2026-08-19 — auditoría externa de `5.8.7` sobre `saint-server`
 > (ronda 11), la primera ejecutada entera bajo `ASK_READONLY=1` y con prueba de
 > no-persistencia: 8,5/10, doce defectos, y ni uno en la capa de análisis.**

{sourcecode-5.8.8 → sourcecode-5.8.10}/docs/EXECUTIVE-ROADMAP.md

@@ -5,9 +5,10 @@ director; no internal implementation knowledge assumed.*
 
 > **DOCUMENT STATUS — 2026-08-19**
 >
-> The latest tagged baseline is **5.8.7** (`9aa9852`); the working version is **5.8.8**. The repository currently contains
-> fourteen committed post-release fixes through `f39432b`; they are follow-up engineering work,
-> not yet a tagged release. The 5.8.7 findings below must be read with this current status.
+> The current release is **5.8.10**. It closes the reproducible output-delivery,
+> security-chain, selftest-envelope and container-reach defects from the 5.8.9
+> re-audit. The 5.8.7 and 5.8.9 findings below are historical evidence and must be
+> read with this status block.
 >
 > **Closed in the current working tree:** `B23`, `B24`, `B25`, `B26`, `B27`, `B28`, the
 > `C4-25` residual, `C4-27`, `C4-28`, additive `C1-49`, and `C3-130` for `plan`/`cold-start`,
@@ -18,6 +19,54 @@ director; no internal implementation knowledge assumed.*
 > profiling, compatibility-window or host-specific CI work, not an unresolved bug from that
 > audit. Historical scores and release claims below remain historical; this block is current.
 
+> **5.8.10 AUDIT REMEDIATION**
+>
+> A requested output file now either exists or the command returns a typed failure;
+> `selftest` can validate a genuine output-ceiling refusal; security exceptions and
+> their static profile conditions are visible as findings; and change-planning views
+> retain container-driven reach instead of treating it as an empty call cone. The
+> release also distinguishes the token ceiling from `impact`'s independent byte cap.
+>
+> The open roadmap is narrower: provider-specific EclipseLink migration disclosure,
+> residual cross-command parity and controlled cost calibration. EclipseLink migration
+> automation remains a future product capability rather than a claim of this release.
+
+> **NEW AUDIT INTAKE — ASK 5.8.8 / `saint-server` — 2026-08-19**
+>
+> A fresh external audit scored the tool **75/100** with **53/61 invocables exercised (87%)**.
+> It found no repository mutation, but it opens a new engineering queue with twelve grouped
+> findings. The highest-risk items are: `risk` returning exit 0 with no output; migration
+> readiness charging an inapplicable Hibernate axis to an EclipseLink repository; security
+> audit and endpoint explanation missing active `permitAll` behavior; and `pr-impact`
+> publishing all container-wired endpoints as unaffected. These are new 5.8.8 findings,
+> not reversals of the closed round-11 queue.
+>
+> **Next bug battery:** `AUD-588-B01` through `B05` first, then output-hint and flag defects
+> (`B07`–`B10`), followed by cross-command contract parity and cost/progress calibration
+> (`B11`–`B12`). The development roadmap contains the acceptance direction and commit order.
+>
+> **Feature battery status for 5.8.9:** the EclipseLink migration axis remains deferred;
+> non-coverage is the honest current answer. Shared answer contracts, versioned cost/cache
+> calibration, explicit progress controls and the safe audit-coverage candidates are already
+> covered and regression-tested. No duplicate heuristics were added.
+
+> **RE-AUDIT UPDATE — ASK 5.8.9 / `saint-server` — 2026-08-19**
+>
+> The same external audit scored **80/100**, up from 75, with unchanged coverage at
+> **53/61 invocables (87%)** and a byte-identical CIR. The release improved CLI ergonomics
+> and timeline completion, but the two highest-priority issues remain open: `risk` can
+> exit 0 with no answer or promised file, and `migrate-check` still bills Hibernate work
+> to an EclipseLink repository. A new high-priority sibling is `audit-report` returning
+> exit 0 with empty stdout. `pr-impact` also introduced a correction regression by saying
+> exclusions are safe while container-wired changes are present.
+>
+> **Roadmap correction:** `B01`/`C3-122` is reopened first, followed by the shared silent-
+> composition path (`risk` and `audit-report`), `B02` plus provider non-coverage, the
+> `pr-impact` regression, `data-exposure` chain binding, Spring security activation
+> findings, then the remaining cross-command parity and cost calibration. `F02` and `F03`
+> are partial rather than complete; `F04` is an explicit opt-in product decision; `F05`
+> is locally verified but not externally covered. EclipseLink remains deferred.
+
 ---
 
 ## What ASK Engine is

{sourcecode-5.8.8 → sourcecode-5.8.10}/docs/MANUAL-USUARIO.md

@@ -812,7 +812,7 @@ ask rename-class . --from OldName --to NewName --output rename-audit.json
 **Recomendación:** usa **siempre `--dry-run` primero** para revisar qué cambiaría antes de escribir nada.
 
 **Opciones:**
-- `--from` / `-f` (**obligatorio**): nombre actual de la clase (PascalCase, p. ej. `ServiceA`).
+- `--from` (**obligatorio**): nombre actual de la clase (PascalCase, p. ej. `ServiceA`).
 - `--to` / `-t` (**obligatorio**): nombre nuevo (PascalCase, p. ej. `ServiceB`).
 - `--dry-run`: calcula los cambios pero **no escribe ni renombra** nada en disco.
 - `--no-tests`: excluye los ficheros de test del rename (solo `src/main`).

{sourcecode-5.8.8 → sourcecode-5.8.10}/docs/USER_GUIDE.md

@@ -136,7 +136,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.8
+# ask 5.8.10
 ```
 
 Requires Python 3.9+.

{sourcecode-5.8.8 → sourcecode-5.8.10}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.8.8"
+version = "5.8.10"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.8.8 → sourcecode-5.8.10}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.8"
+__version__ = "5.8.10"

{sourcecode-5.8.8 → sourcecode-5.8.10}/src/sourcecode/change_plan.py

@@ -28,6 +28,7 @@ from typing import TYPE_CHECKING
 
 from sourcecode import non_coverage as _non_coverage
 from sourcecode.canonical_ir import project_blast_radius
+from sourcecode.container_wiring import detect_classes
 from sourcecode.repository_ir import _all_callers_from_rg
 from sourcecode.security_posture import _graph_nodes
 from sourcecode.path_filters import is_test_path
@@ -139,6 +140,7 @@ def build_change_plan(
         }
 
     seeds = list(blast["matched_fqns"])
+    container_wired = [w.to_dict() for w in detect_classes(cir, seeds)]
     meta = _node_meta(cir)
     affected = _dependents_closure(cir.reverse_graph or {}, seeds, max_depth, _NODE_CAP)
 
@@ -221,6 +223,7 @@ def build_change_plan(
             "count": len(prod),
             "components": prod[:_LIST_CAP],
         },
+        "container_wired": container_wired,
         "covering_tests": (
             {
                 "count": len(tests),

{sourcecode-5.8.8 → sourcecode-5.8.10}/src/sourcecode/cli.py

@@ -2112,12 +2112,14 @@ def _emit_command_output(
             raise typer.Exit(1)
     if output_path is not None:
         _receipt = _safe_write_file(output_path, content)
-        _mark_output_delivered()
         if not _receipt.get("written"):
             # B15: the answer was produced and thrown away, on request. Saying
             # "written to nul" would be the one thing worse than the error this
             # used to raise.
             typer.echo(_receipt.get("note") or f"Discarded to {output_path}")
+            # A failed write is never delivery. The guard separately exempts
+            # discard sinks and existing files by path, so no state flag is
+            # needed here.
         elif success_msg:
             # C3-26/C3-18: the payload went to the file, so stdout is free and
             # this confirmation is the run's whole answer — `cache warm` and
@@ -2126,12 +2128,14 @@ def _emit_command_output(
             # stderr battery listed its commands by hand. Measured before the
             # fix on spring-petclinic: stdout 0 bytes, stderr 155.
             typer.echo(success_msg)
+            _mark_output_delivered()
         else:
             # C3-122: a command whose emit seam carries no sentence of its own
             # confirmed a 444-second run with total silence. The receipt is a
             # notice, so a pipeline and a PowerShell capture stay exactly as
             # they were (C3-26) and a person at a terminal is told.
             _notice(f"✓ {_receipt.get('bytes', 0)} bytes written to {output_path}")
+            _mark_output_delivered()
     else:
         try:
             sys.stdout.buffer.write(content.encode("utf-8"))
@@ -2154,7 +2158,8 @@ def _emit_command_output(
             _notice("✓ copied to clipboard")
     # The answer has been handed over. Any `done (Xs)` a command deferred is now
     # a true claim and prints here — never before this line (C3-54).
-    _progress_output_emitted()
+    if _OUTPUT_DELIVERED:
+        _progress_output_emitted()
 
 
 def _emit_text_output(
@@ -2860,15 +2865,10 @@ COMMANDS_WITHOUT_FORMAT: "frozenset[str]" = frozenset({
     "version",              # a version string
 })
 
-#: `--format` binds `-f` everywhere except here — the `COMMANDS_WITHOUT_COPY_
-#: SHORTHAND` precedent, for the same reason. `rename-class` bound `-f` to
-#: `--from` before this rule existed, and `ask rename-class . -f OldName` is a
-#: documented invocation: rebinding it would silently give the reader a format
-#: parser for a class name. The long `--format` works; the short form moves at
-#: the next major.
-COMMANDS_WITHOUT_FORMAT_SHORTHAND: "frozenset[str]" = frozenset({
-    "rename-class",
-})
+#: Every payload command uses the same `--format/-f` spelling. A previous
+#: exception let `rename-class -f` overwrite `--from` silently; removing that
+#: alias is safer than making one short flag mean two unrelated facts.
+COMMANDS_WITHOUT_FORMAT_SHORTHAND: "frozenset[str]" = frozenset()
 
 
 #: The one help string for `--progress`, for the same reason as COPY_OPTION_HELP.
@@ -6988,6 +6988,16 @@ def impact_cmd(
         cir._raw_ir, target, max_depth=depth, list_limit=0 if _to_file else None,
         root=root, covered_types=_covered_types,
     )
+    # Token ceilings and this command's byte budget are independent controls.
+    # Publish both at the point where the impact answer is shaped so raising
+    # ASK_MAX_OUTPUT_TOKENS cannot be mistaken for disabling stdout trimming.
+    result["stdout_byte_budget"] = BUDGET_IMPACT if not _to_file else None
+    result["stdout_byte_budget_basis"] = (
+        "impact stdout rendering is capped independently at 50,000 UTF-8 bytes; "
+        "ASK_MAX_OUTPUT_TOKENS does not disable this byte budget"
+        if not _to_file else
+        "No stdout byte budget applies when --output writes the complete answer."
+    )
     result = _apply_budget(result, BUDGET_IMPACT, label="impact", output_path=output_path)
     if _misread and result.get("resolution") == "not_found":
         result["analysis_warnings"] = [*(result.get("analysis_warnings") or []), _misread]
@@ -8722,6 +8732,10 @@ def baseline_diff_cmd(
         Path("."),
         help="Repository root to diff against the stored baseline (default: cwd).",
     ),
+    history_dir: Optional[Path] = typer.Option(
+        None, "--dir", "--history-dir",
+        help="Directory containing stored architectural-baseline-v1 artifacts.",
+    ),
     baseline_file: Optional[Path] = typer.Option(
         None, "--baseline", "-b",
         help="Path to a stored architectural-baseline-v1 JSON artifact. Omit it to "
@@ -8767,7 +8781,7 @@ def baseline_diff_cmd(
     if baseline_file is None:
         from sourcecode.architectural_baseline import latest_baseline_path
 
-        history = _resolve_history_dir(target_dir)
+        history = _resolve_history_dir((history_dir or target_dir).resolve())
         latest = latest_baseline_path(history)
         if latest is None:
             _emit_error_json(
@@ -13330,7 +13344,7 @@ def rename_class_cmd(
         help="Repository root to operate on (default: current directory)",
     ),
     old_name: str = typer.Option(
-        ..., "--from", "-f",
+        ..., "--from",
         help="Current class name (PascalCase, e.g. ServiceA)",
     ),
     new_name: str = typer.Option(
@@ -13350,10 +13364,7 @@ def rename_class_cmd(
         help="Write change audit JSON to a file instead of stdout.",
     ),
     copy: bool = _copy_option(),
-    # `-f` is `--from` on this command and has been since before `--format`
-    # existed: rebinding it would hand a class name to a format parser.
-    # On the record in cli.COMMANDS_WITHOUT_FORMAT_SHORTHAND (C3-59).
-    format: str = _format_option(help="Output format: json (default) or yaml.", shorthand=False),
+    format: str = _format_option(help="Output format: json (default) or yaml."),
     progress_mode: Optional[str] = _progress_option(),
 ) -> None:
     """Rename a Java class throughout the repository.

{sourcecode-5.8.8 → sourcecode-5.8.10}/src/sourcecode/compare.py

@@ -262,6 +262,7 @@ def build_comparison(
             "resolution": resolution,
             "resolved": resolved,
             "cost": cost,
+            "container_wired": plan.get("container_wired") if resolved else None,
             "why": _evidence_trail(cost, blast, resolved, plan),
         }
         # C1-13/C2-1: when the walk was capped, some magnitudes are floors. The

{sourcecode-5.8.8 → sourcecode-5.8.10}/src/sourcecode/data_exposure.py

@@ -83,6 +83,7 @@ class ExposedRoute:
     verdict: str
     access: Optional[str] = None
     access_decision: Optional[str] = None
+    chain_decision: Optional[str] = None
 
     def to_dict(self) -> dict:
         out = {
@@ -100,6 +101,8 @@ class ExposedRoute:
         if self.access is not None:
             out["access_under_profile"] = self.access
             out["access_decision"] = self.access_decision
+        if self.chain_decision is not None:
+            out["chain_decision"] = self.chain_decision
         return out
 
 
@@ -232,12 +235,13 @@ def build_data_exposure(
     from sourcecode.security_posture import endpoint_security_surface
     from sourcecode.spring_impact import run_impact_chain
 
-    surface = endpoint_security_surface(cir, root=root)
     profile_access: dict[str, str] = {}
-    if profiles:
-        from sourcecode.posture import endpoint_access_under
+    from sourcecode.posture import endpoint_access_under
 
-        profile_access = endpoint_access_under(root, set(profiles), cir=cir)
+    profile_access = endpoint_access_under(root, set(profiles or ()), cir=cir)
+    surface = endpoint_security_surface(
+        cir, root=root, access_decisions=profile_access,
+    )
 
     handlers = {
         str(getattr(e, "handler_symbol", "") or (e.get("handler_symbol") if isinstance(e, dict) else "")): e
@@ -374,6 +378,10 @@ def _finish_route(
         verdict=verdict,
         access=access,
         access_decision=decision,
+        chain_decision=(
+            str(bound["chain_decision"])
+            if bound.get("chain_decision") is not None else None
+        ),
     )