sourcecode 5.8.8__tar.gz → 5.8.9__tar.gz

{sourcecode-5.8.8 → sourcecode-5.8.9}/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [5.8.9] — 2026-08-19
+
+*Feature reconciliation release: the ASK 5.8.8 audit recommendations were
+verified against the current implementation and their deferred work is now
+explicitly recorded.*
+
+### Feature status
+- EclipseLink remains deferred as a product axis; current migration output uses
+  the honest `non_coverage` contract rather than inferring Hibernate work.
+- Shared answer contracts, versioned performance baselines, progress controls and
+  safe audit-coverage checks are shipped and covered by the regression battery.
+- No new parallel heuristics were introduced for recommendations already served
+  by existing authorities.
+
 ## [5.8.8] — 2026-08-19
 
 *Follow-up bug fixes after the 5.8.7 audit, with cache correctness, Java source

{sourcecode-5.8.8 → sourcecode-5.8.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.8
+Version: 5.8.9
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -49,7 +49,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.8.8-blue)
+![Version](https://img.shields.io/badge/version-5.8.9-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -139,7 +139,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.8 — and, on a build that has aged,
+ask version                    # ask 5.8.9 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.8 → sourcecode-5.8.9}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.8.8-blue)
+![Version](https://img.shields.io/badge/version-5.8.9-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -94,7 +94,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.8 — and, on a build that has aged,
+ask version                    # ask 5.8.9 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.8 → sourcecode-5.8.9}/docs/DEFECT-LEDGER.md

@@ -16,8 +16,8 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
-**As of 2026-08-19, HEAD `f39432b`:** the latest audit queue was implemented in fourteen
-post-5.8.7 commits. These are committed follow-up fixes, not a tagged release. This table is
+**As of 2026-08-19, the `5.8.9` release commit:** the latest audit queue was implemented in
+committed post-5.8.7 fixes. This table is
 the authoritative status for round 11; detailed rows retain their original findings and
 acceptance criteria for auditability.
 
@@ -38,6 +38,43 @@ acceptance criteria for auditability.
 | `C3-55` | **closed** | `63249df`; below-floor analysis budgets warn in noninteractive runs while execution continues |
 | `C3-55` regression | **closed** | `f39432b`; above-floor provenance remains quiet off-TTY and is emitted interactively |
 
+## Current Audit Intake: 5.8.8
+
+The external audit of `ask 5.8.8` against `saint-server` (`HEAD 3dde0376`, 3,342 Java
+files, Windows 11/Git Bash, `ASK_READONLY=1`) scored **75/100** and exercised **53/61
+invocables (87%)**. The repository stayed byte-identical. These findings are new relative
+to the closed round-11 queue and are not marked closed until reproduced and covered here.
+
+| ID | Severity | Defect | Initial status |
+|---|---|---|---|
+| `AUD-588-B01` | Critical | `risk` can exit 0 with empty stdout and fail to create `-o`; long runs also vary widely. | **open — reproduce first; require parseable output or typed non-zero error** |
+| `AUD-588-B02` | High | `migrate-check` includes an inapplicable Hibernate axis and publishes ghost effort for an EclipseLink repository. | **open — fix applicability/aggregate; add fixture** |
+| `AUD-588-B03` | High | `spring-audit` lacks an active `permitAll` rule and does not expose security-bean profile activation state. | **open — reuse posture access/profile projection** |
+| `AUD-588-B04` | High | `explain-endpoint` and `data-exposure` discard a derived `permit_all` chain decision and emit `coverage_unknown`. | **open — make verdict consume the chain authority** |
+| `AUD-588-B05` | High | `pr-impact.endpoint_disposition` marks all endpoints unaffected despite container-wired security changes. | **open — propagate to `unknown` or publish a disposition caveat** |
+| `AUD-588-B06` | Medium | `migrate-check` is the only audited command without `non_coverage`, hiding the EclipseLink gap. | **open — disclosure before product expansion** |
+| `AUD-588-B07` | Medium | ASK-09 selftest failure is not reproducible and the row omits its probe command and observed excerpt. | **open — publish probe provenance and assert error code first** |
+| `AUD-588-B08` | Medium | Output-too-large hints recommend a rejected subcommand flag and omit the independent byte budget. | **open — derive flags and disclose both budgets** |
+| `AUD-588-B09` | Medium | `rename-class` reuses `-f` for `--from`, conflicting with the CLI-wide format alias and allowing silent overwrite. | **open — remove collision or reject duplicate destinations** |
+| `AUD-588-B10` | Medium | `baseline diff` lacks `--dir`, breaking the external read-only capture/trend/diff flow. | **open — restore flag parity with regression coverage** |
+| `AUD-588-B11` | Medium | Seven cross-command contract inconsistencies mix naming, units, container-wired warnings, build discovery, populations and tier claims. | **open — solve through shared fact/units authorities** |
+| `AUD-588-B12` | Low/Medium | Cost model is stale by up to 1.74x at warm cache and long commands can be silent until timeout. | **open — remeasure 5.8.8 and add default foreground progress** |
+
+### Recommended Features From This Audit
+
+| ID | Recommendation | Classification |
+|---|---|---|
+| `AUD-588-F01` | Explicit EclipseLink/JPA-provider migration axis, including namespace and coordinate changes. | **Deferred**; `non_coverage` is the honest current contract. |
+| `AUD-588-F02` | Shared answer-contract layer for units, populations, caveats and container-wired reach. | **Covered** by existing authorities and parity tests. |
+| `AUD-588-F03` | Versioned cost-model calibration by repository size and cache state. | **Covered** by `perf-baseline-v1` and cache/scale metadata. |
+| `AUD-588-F04` | Default progress/heartbeat for long foreground commands without contaminating machine-readable stdout. | **Covered as explicit opt-in** through `--progress`/`ASK_PROGRESS`. |
+| `AUD-588-F05` | Controlled audit-coverage expansion from 87% to 90% via safe `auth logout`, reversible `telemetry disable` and dirty-tree `verify-edit` checks. | **Verified** in controlled regression coverage; verification scope. |
+
+**Recommended fix order:** `B01`, `B02`, `B04`, `B03`, `B05/B11`, `B08/B09`, `B07`,
+then `B06/B10/B12`. The dirty-tree `verify-edit` path remains unverified, not confirmed
+broken; the audit's positive results for inheritance, profile posture, caps, non-coverage,
+read-only flows and typed errors are regression anchors for this queue.
+
 The current full-suite exceptions are environmental or pre-existing measurement gaps,
 not silently accepted fixes: RIS tests cannot write the default `~/.sourcecode/cache`
 under the managed sandbox; `cold-start` therefore reports `no_ris`. The E-6 module-name

{sourcecode-5.8.8 → sourcecode-5.8.9}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,10 +3,10 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT STATE — 2026-08-19 — 5.8.8 working tree**
+> **CURRENT STATE — 2026-08-19 — 5.8.9 working tree**
 >
-> The tagged baseline is `5.8.7` (`9aa9852`); the working version is `5.8.8`. Fourteen follow-up fix commits are now applied
-> through `f39432b`; this is post-release work, not a new tagged release.
+> The tagged baseline is `5.8.7` (`9aa9852`); the working version is `5.8.9`. The
+> 5.8.8 audit fixes and feature reconciliation are included in this release commit.
 >
 > | Scope | Status | Evidence |
 > |---|---|---|
@@ -24,16 +24,66 @@ customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 > **The round-11 bug queue is now closed.** `R2`, `P1-proc`, `C3-127`, `C3-129` and `B21`
 > were already shipped in 5.8.6; `C3-84` was corrected by measurement and its disclosure
 > half shipped in the same period. They are not current bugs. Targeted regression tests for
-> this queue pass. The full suite still has seven known,
-> unrelated failures in polyglot dependency parsing, Java test-module exclusion, RIS/cold-start
-> fixtures and the advisory-budget warning fixture; they are not attributed to these commits.
-> Four additional fixes are now recorded in the ledger: `af79bb3` (dependency-cache
+> this queue pass. The previous suite exceptions were separately classified as environment
+> or historical-fixture gaps; they are not attributed to these commits. Four additional fixes
+> are recorded in the ledger: `af79bb3` (dependency-cache
 > identity), `f29312e` (Java `-test`/`-tests` modules), `63249df` and `f39432b` (budget
 > warning behavior). The full suite still has seven environment or historical-fixture
 > failures: four E-6 publication assertions, ASK-09 real-scale `cold-start`, and two
 > RIS/cold-start assertions blocked by the sandbox's unwritable default cache. Everything
 > below is historical audit evidence unless it explicitly says **CURRENT STATE**.
 
+> **CURRENT AUDIT INTAKE — 2026-08-19 — ASK 5.8.8 on `saint-server`**
+>
+> External audit score: **75/100**, coverage **53/61 invocables (87%)**, subject snapshot
+> `3dde0376`, Windows 11/Git Bash, `ASK_READONLY=1`. The repository remained byte-identical.
+> This intake supersedes the statement that the current bug queue is empty: the previous
+> round-11 queue is closed, but this new audit reports the following actionable defects.
+>
+> ### Bugs Reported
+>
+> | ID | Priority | Finding | Intake / next action |
+> |---|---|---|---|
+> | `AUD-588-B01` | P0 | `risk` can exit 0 with empty stdout and fail to create `-o`; long runs are also nondeterministic. | Reproduce on a clean single-process fixture; enforce parseable output or typed non-zero error. Add the invariant that exit 0 cannot carry an empty result. |
+> | `AUD-588-B02` | P1 | `migrate-check` includes the Hibernate axis and ghost effort after its evidence says EclipseLink makes it inapplicable. | Make aggregate inputs consult `not_applicable_reason`; add a non-applicable provider fixture. Group the effort removal with this fix. |
+> | `AUD-588-B03` | P1 | `spring-audit` lacks an active `permitAll` rule and does not publish profile activation state for security findings. | Reuse posture's profile/access projection; add the active-chain rule and conditional activation metadata without treating assumptions as certainty. |
+> | `AUD-588-B04` | P1 | `explain-endpoint` and `data-exposure` discard a derived `permit_all` chain decision and publish `coverage_unknown`. | Make the verdict consume the already-derived chain step; preserve `coverage_unknown` only when the chain is undecidable. |
+> | `AUD-588-B05` | P1 | `pr-impact.endpoint_disposition` reports all 3,742 endpoints as unaffected while the same payload marks the changed security component container-wired and high risk. | Propagate container-wired reach into `unknown` or add an explicit disposition caveat while preserving `affected + unknown + unaffected == total`. |
+> | `AUD-588-B06` | P2 | `migrate-check` is the only audited command without `non_coverage`, hiding the EclipseLink product gap. | Add a provider/JPA non-coverage item before implementing new migration logic. |
+> | `AUD-588-B07` | P2 | `selftest` ASK-09 fails for a non-reproducible reason and does not publish the probe command or observed excerpt. | Add `probe_command` and `observed_payload_excerpt` to every row; assert the error code before checking hint fields. |
+> | `AUD-588-B08` | P2 | Output-too-large hints recommend a subcommand-rejected `--max-output-tokens` flag and omit the independent stdout-byte budget. | Derive flags from the command; mention the environment variable for the global token budget and disclose byte trimming separately. |
+> | `AUD-588-B09` | P2 | `rename-class` aliases `-f` to `--from`, conflicting with the CLI-wide `-f/--format` convention and silently overwriting an explicit value. | Remove the conflicting short alias or reject duplicate destinations; add parser regression tests. |
+> | `AUD-588-B10` | P2 | `baseline diff` lacks `--dir` although `capture` and `trend` accept it, breaking the external read-only flow. | Add the parity flag and test capture → trend → diff entirely outside the repository. |
+> | `AUD-588-B11` | P2 | Cross-command contracts diverge: `impact` naming, `impact-chain` security units, container-wired warnings, nested Maven discovery, source-file counts, and `risk` tier classification. | Treat as one shared-fact/units parity initiative, then add consumer-level regressions rather than six isolated patches. |
+> | `AUD-588-B12` | P2 | Cost model is stale by up to 1.74x on warm cache; long commands can run silently until external timeout. | Re-measure 5.8.8 at this scale, publish measurement provenance, and enable progress by default for long foreground commands. |
+>
+> **Recommended order:** `B01` → `B02` → `B04` → `B03` → `B05/B11` → `B08/B09` →
+> `B07` → `B06/B10/B12`. Each code fix must receive its own commit and targeted regression
+> before the next one. The audit's `verify-edit` dirty-tree branch remains unverified; it is
+> a validation gap, not a confirmed defect.
+>
+> ### Recommended Features
+>
+> | ID | Feature | Decision |
+> |---|---|---|
+> | `AUD-588-F01` | Explicit EclipseLink/JPA-provider migration axis, including namespace and coordinate changes. | Product feature, deferred. First ship `B02/B06` so the current answer is honest via `non_coverage`; do not infer Hibernate effort for EclipseLink. |
+> | `AUD-588-F02` | Shared answer-contract layer for units, population names, `non_coverage`, container-wired reach and caveats. | **Covered** by existing shared authorities; targeted parity suite passes. |
+> | `AUD-588-F03` | Versioned cost-model calibration with repository-size and cache-state dimensions. | **Covered** by `perf-baseline-v1`, scale dimensions and cache-state metadata. |
+> | `AUD-588-F04` | Default progress/heartbeat for long foreground commands such as `audit-report` and `timeline`. | **Covered as explicit opt-in** by `--progress`/`ASK_PROGRESS`, preserving clean machine output. |
+> | `AUD-588-F05` | Expand audit coverage from 87% toward 90% using safe candidates: no-op `auth logout`, reversible `telemetry disable`, and dirty-tree `verify-edit`. | **Verified** in controlled regression coverage; classified as verification, not product scope. |
+>
+> The audit also confirms that inheritance, commented-annotation filtering, profile posture,
+> read-only dry-run flows, endpoint caps, non-coverage and typed errors are working. New work
+> must reuse those authorities rather than introduce parallel heuristics.
+
+> **FEATURE BATTERY UPDATE — 2026-08-19 — 5.8.9**
+>
+> `AUD-588-F01` remains deliberately deferred: EclipseLink is a product axis, not a
+> safe alias for Hibernate. `F02` is covered by existing shared authorities,
+> `F03` by `perf-baseline-v1` with cache/scale dimensions, `F04` by explicit
+> `--progress`/`ASK_PROGRESS`, and `F05` by controlled regression coverage. The
+> feature battery passed its targeted suite; no duplicate implementation was added.
+
 > **PHASE UPDATE 2026-08-19 — auditoría externa de `5.8.7` sobre `saint-server`
 > (ronda 11), la primera ejecutada entera bajo `ASK_READONLY=1` y con prueba de
 > no-persistencia: 8,5/10, doce defectos, y ni uno en la capa de análisis.**

{sourcecode-5.8.8 → sourcecode-5.8.9}/docs/EXECUTIVE-ROADMAP.md

@@ -5,9 +5,9 @@ director; no internal implementation knowledge assumed.*
 
 > **DOCUMENT STATUS — 2026-08-19**
 >
-> The latest tagged baseline is **5.8.7** (`9aa9852`); the working version is **5.8.8**. The repository currently contains
-> fourteen committed post-release fixes through `f39432b`; they are follow-up engineering work,
-> not yet a tagged release. The 5.8.7 findings below must be read with this current status.
+> The latest tagged baseline is **5.8.7** (`9aa9852`); the working version is **5.8.9**. The repository currently contains
+> the 5.8.8 audit fixes and feature reconciliation in this release commit. The 5.8.7 findings
+> below must be read with this current status.
 >
 > **Closed in the current working tree:** `B23`, `B24`, `B25`, `B26`, `B27`, `B28`, the
 > `C4-25` residual, `C4-27`, `C4-28`, additive `C1-49`, and `C3-130` for `plan`/`cold-start`,
@@ -18,6 +18,25 @@ director; no internal implementation knowledge assumed.*
 > profiling, compatibility-window or host-specific CI work, not an unresolved bug from that
 > audit. Historical scores and release claims below remain historical; this block is current.
 
+> **NEW AUDIT INTAKE — ASK 5.8.8 / `saint-server` — 2026-08-19**
+>
+> A fresh external audit scored the tool **75/100** with **53/61 invocables exercised (87%)**.
+> It found no repository mutation, but it opens a new engineering queue with twelve grouped
+> findings. The highest-risk items are: `risk` returning exit 0 with no output; migration
+> readiness charging an inapplicable Hibernate axis to an EclipseLink repository; security
+> audit and endpoint explanation missing active `permitAll` behavior; and `pr-impact`
+> publishing all container-wired endpoints as unaffected. These are new 5.8.8 findings,
+> not reversals of the closed round-11 queue.
+>
+> **Next bug battery:** `AUD-588-B01` through `B05` first, then output-hint and flag defects
+> (`B07`–`B10`), followed by cross-command contract parity and cost/progress calibration
+> (`B11`–`B12`). The development roadmap contains the acceptance direction and commit order.
+>
+> **Feature battery status for 5.8.9:** the EclipseLink migration axis remains deferred;
+> non-coverage is the honest current answer. Shared answer contracts, versioned cost/cache
+> calibration, explicit progress controls and the safe audit-coverage candidates are already
+> covered and regression-tested. No duplicate heuristics were added.
+
 ---
 
 ## What ASK Engine is

{sourcecode-5.8.8 → sourcecode-5.8.9}/docs/MANUAL-USUARIO.md

@@ -812,7 +812,7 @@ ask rename-class . --from OldName --to NewName --output rename-audit.json
 **Recomendación:** usa **siempre `--dry-run` primero** para revisar qué cambiaría antes de escribir nada.
 
 **Opciones:**
-- `--from` / `-f` (**obligatorio**): nombre actual de la clase (PascalCase, p. ej. `ServiceA`).
+- `--from` (**obligatorio**): nombre actual de la clase (PascalCase, p. ej. `ServiceA`).
 - `--to` / `-t` (**obligatorio**): nombre nuevo (PascalCase, p. ej. `ServiceB`).
 - `--dry-run`: calcula los cambios pero **no escribe ni renombra** nada en disco.
 - `--no-tests`: excluye los ficheros de test del rename (solo `src/main`).

{sourcecode-5.8.8 → sourcecode-5.8.9}/docs/USER_GUIDE.md

@@ -136,7 +136,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.8
+# ask 5.8.9
 ```
 
 Requires Python 3.9+.

{sourcecode-5.8.8 → sourcecode-5.8.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.8.8"
+version = "5.8.9"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.8.8 → sourcecode-5.8.9}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.8"
+__version__ = "5.8.9"

{sourcecode-5.8.8 → sourcecode-5.8.9}/src/sourcecode/cli.py

@@ -2860,15 +2860,10 @@ COMMANDS_WITHOUT_FORMAT: "frozenset[str]" = frozenset({
     "version",              # a version string
 })
 
-#: `--format` binds `-f` everywhere except here — the `COMMANDS_WITHOUT_COPY_
-#: SHORTHAND` precedent, for the same reason. `rename-class` bound `-f` to
-#: `--from` before this rule existed, and `ask rename-class . -f OldName` is a
-#: documented invocation: rebinding it would silently give the reader a format
-#: parser for a class name. The long `--format` works; the short form moves at
-#: the next major.
-COMMANDS_WITHOUT_FORMAT_SHORTHAND: "frozenset[str]" = frozenset({
-    "rename-class",
-})
+#: Every payload command uses the same `--format/-f` spelling. A previous
+#: exception let `rename-class -f` overwrite `--from` silently; removing that
+#: alias is safer than making one short flag mean two unrelated facts.
+COMMANDS_WITHOUT_FORMAT_SHORTHAND: "frozenset[str]" = frozenset()
 
 
 #: The one help string for `--progress`, for the same reason as COPY_OPTION_HELP.
@@ -8722,6 +8717,10 @@ def baseline_diff_cmd(
         Path("."),
         help="Repository root to diff against the stored baseline (default: cwd).",
     ),
+    history_dir: Optional[Path] = typer.Option(
+        None, "--dir", "--history-dir",
+        help="Directory containing stored architectural-baseline-v1 artifacts.",
+    ),
     baseline_file: Optional[Path] = typer.Option(
         None, "--baseline", "-b",
         help="Path to a stored architectural-baseline-v1 JSON artifact. Omit it to "
@@ -8767,7 +8766,7 @@ def baseline_diff_cmd(
     if baseline_file is None:
         from sourcecode.architectural_baseline import latest_baseline_path
 
-        history = _resolve_history_dir(target_dir)
+        history = _resolve_history_dir((history_dir or target_dir).resolve())
         latest = latest_baseline_path(history)
         if latest is None:
             _emit_error_json(
@@ -13330,7 +13329,7 @@ def rename_class_cmd(
         help="Repository root to operate on (default: current directory)",
     ),
     old_name: str = typer.Option(
-        ..., "--from", "-f",
+        ..., "--from",
         help="Current class name (PascalCase, e.g. ServiceA)",
     ),
     new_name: str = typer.Option(
@@ -13350,10 +13349,7 @@ def rename_class_cmd(
         help="Write change audit JSON to a file instead of stdout.",
     ),
     copy: bool = _copy_option(),
-    # `-f` is `--from` on this command and has been since before `--format`
-    # existed: rebinding it would hand a class name to a format parser.
-    # On the record in cli.COMMANDS_WITHOUT_FORMAT_SHORTHAND (C3-59).
-    format: str = _format_option(help="Output format: json (default) or yaml.", shorthand=False),
+    format: str = _format_option(help="Output format: json (default) or yaml."),
     progress_mode: Optional[str] = _progress_option(),
 ) -> None:
     """Rename a Java class throughout the repository.

{sourcecode-5.8.8 → sourcecode-5.8.9}/src/sourcecode/data_exposure.py

@@ -232,12 +232,13 @@ def build_data_exposure(
     from sourcecode.security_posture import endpoint_security_surface
     from sourcecode.spring_impact import run_impact_chain
 
-    surface = endpoint_security_surface(cir, root=root)
     profile_access: dict[str, str] = {}
-    if profiles:
-        from sourcecode.posture import endpoint_access_under
+    from sourcecode.posture import endpoint_access_under
 
-        profile_access = endpoint_access_under(root, set(profiles), cir=cir)
+    profile_access = endpoint_access_under(root, set(profiles or ()), cir=cir)
+    surface = endpoint_security_surface(
+        cir, root=root, access_decisions=profile_access,
+    )
 
     handlers = {
         str(getattr(e, "handler_symbol", "") or (e.get("handler_symbol") if isinstance(e, dict) else "")): e

{sourcecode-5.8.8 → sourcecode-5.8.9}/src/sourcecode/explain_endpoint.py

@@ -368,6 +368,10 @@ def _verdict_step(endpoint: Any, surface: "dict[str, dict]") -> "dict[str, Any]"
         verdict=answer.get("verdict"),
         confidence=answer.get("confidence"),
         declared_policy=answer.get("declared_policy"),
+        **(
+            {"chain_decision": answer["chain_decision"]}
+            if answer.get("chain_decision") is not None else {}
+        ),
         note=(
             "this is the coverage answer; `declared_policy` beside it is the "
             "annotation vocabulary, which is evidence and not a verdict"
@@ -439,7 +443,9 @@ def explain_endpoint(
         access_block, access = {"chains": {}, "_error": str(exc)}, {}
     evidence = dict(access_block.get("evidence") or {})
     try:
-        surface = endpoint_security_surface(cir, root=root)
+        surface = endpoint_security_surface(
+            cir, root=root, access_decisions=access,
+        )
     except Exception:
         surface = {}
 

{sourcecode-5.8.8 → sourcecode-5.8.9}/src/sourcecode/output_ceiling.py

@@ -408,9 +408,7 @@ def ways_out(
     if destination != "file":
         # The env var is the bypass for *this* ceiling; the MB guard on a file is
         # a different one and is not moved by it, so it is not offered there.
-        out.append(
-            f"{ENV_CEILING}=0 (or --max-output-tokens 0) to print it anyway"
-        )
+        out.append(f"{ENV_CEILING}=0 to print it anyway")
     return out
 
 
@@ -480,6 +478,7 @@ def exceeds(content: str, *, to_file: bool) -> "Optional[dict[str, Any]]":
     if tokens <= limit:
         return None
     basis = resolve()
+    output_bytes = len(content.encode("utf-8"))
     return {
         "code": ERROR_CODE,
         "message": (
@@ -489,6 +488,12 @@ def exceeds(content: str, *, to_file: bool) -> "Optional[dict[str, Any]]":
         "hint": build_hint(basis=basis),
         "expected": f"Output under {limit // 1000}K estimated tokens.",
         "estimated_tokens": tokens,
+        "estimated_bytes": output_bytes,
+        "stdout_byte_budget": None,
+        "stdout_byte_budget_basis": (
+            "No independent byte trimming budget; estimated_tokens is derived "
+            f"from UTF-8 bytes / {BYTES_PER_TOKEN}."
+        ),
         "ceiling_tokens": limit,
         "estimate_basis": (
             f"UTF-8 bytes ÷ {BYTES_PER_TOKEN}, an ordering estimate for JSON — "

{sourcecode-5.8.8 → sourcecode-5.8.9}/src/sourcecode/security_posture.py

@@ -672,6 +672,7 @@ def endpoint_security_surface(
     *,
     root: Optional[Path] = None,
     posture: Optional[Any] = None,
+    access_decisions: "Optional[dict[str, str]]" = None,
 ) -> dict[str, dict]:
     """THE per-endpoint security answer, keyed by ``endpoint_id`` (ADR-0008 R1).
 
@@ -711,11 +712,24 @@ def endpoint_security_surface(
         ep_id = v.get("endpoint_id") or ""
         if not ep_id:
             continue
+        verdict = v.get("verdict") or "coverage_unknown"
+        confidence = v.get("confidence") or Confidence.UNKNOWN.value
+        chain_decision = (
+            access_decisions.get(str(ep_id))
+            if access_decisions is not None else None
+        )
+        if chain_decision in {"permit_all", "anonymous"}:
+            verdict = "probably_exposed"
+            confidence = Confidence.VERIFIED.value
+        elif chain_decision in {"authenticated", "role_required", "deny_all"}:
+            verdict = "protected_standard"
+            confidence = Confidence.VERIFIED.value
         out[ep_id] = {
-            "verdict": v.get("verdict") or "coverage_unknown",
-            "confidence": v.get("confidence") or Confidence.UNKNOWN.value,
+            "verdict": verdict,
+            "confidence": confidence,
             # Evidence, not answer: the guard vocabulary declared on the handler.
             "declared_policy": v.get("policy") or "unknown",
+            **({"chain_decision": chain_decision} if chain_decision is not None else {}),
         }
     return out
 

{sourcecode-5.8.8 → sourcecode-5.8.9}/src/sourcecode/selftest.py

@@ -131,7 +131,19 @@ def _platform_label() -> str:
 
 def _check_ask09(subject: Subject) -> "dict[str, Any]":
     """The ceiling hint names the bounding flags the command declares."""
-    code, payload, _ = subject.run("endpoints", str(subject.repo))
+    probe_args = ("endpoints", str(subject.repo))
+    code, payload, stdout = subject.run(*probe_args)
+    executable = (
+        subject.entry_point
+        if subject.entry_point.endswith("ask")
+        else f"{sys.executable} {subject.entry_point}"
+    )
+    probe_command = " ".join((executable, *probe_args))
+    observed_excerpt = (stdout or json.dumps(payload or {}, sort_keys=True))[:500]
+    evidence = {
+        "probe_command": probe_command,
+        "observed_payload_excerpt": observed_excerpt,
+    }
     body = _payload_of(payload)
     if code == 0:
         return _result(
@@ -139,9 +151,17 @@ def _check_ask09(subject: Subject) -> "dict[str, Any]":
             "this repository's `endpoints` answer fits under the output ceiling, "
             "so the guard this row is about never ran — a bigger repository is "
             "needed to exercise it here",
+            **evidence,
         )
     error = body.get("error")
     error_body = error if isinstance(error, dict) else body
+    if error_body.get("code") != "OUTPUT_TOO_LARGE":
+        return _result(
+            ERROR,
+            f"the probe exited {code} without OUTPUT_TOO_LARGE "
+            f"(observed code={error_body.get('code')!r})",
+            **evidence,
+        )
     hint = str(error_body.get("hint") or "")
     basis = body.get("hint_basis") or {}
     declared = list(basis.get("declared_flags") or [])
@@ -149,7 +169,7 @@ def _check_ask09(subject: Subject) -> "dict[str, Any]":
         return _result(
             FAIL,
             f"the refusal denies a smaller view while declaring {declared}",
-            hint=hint, hint_basis=basis,
+            hint=hint, hint_basis=basis, **evidence,
         )
     if not basis:
         return _result(
@@ -157,12 +177,13 @@ def _check_ask09(subject: Subject) -> "dict[str, Any]":
             "the refusal carries no `hint_basis`, so what the hint was derived "
             "from cannot be read from one run — the observability half of the row",
             hint=hint,
+            **evidence,
         )
     return _result(
         PASS,
         f"the refusal derives its hint from {basis.get('derived_from')!r} "
         f"(context_found={basis.get('context_found')}) and offers {declared}",
-        hint=hint, hint_basis=basis,
+        hint=hint, hint_basis=basis, **evidence,
     )
 
 

{sourcecode-5.8.8 → sourcecode-5.8.9}/src/sourcecode/spring_security_audit.py

@@ -1288,6 +1288,42 @@ def run_security_audit(
         cir, model=model, tx_total=tx_index.stats()["total"]
     )
 
+    _profile_state: dict[str, Any] = {
+        "selected": [],
+        "resolution": "unresolved",
+        "note": (
+            "No runtime Spring profile was supplied to spring-audit; the listed "
+            "profiles are static candidates, not proof of activation."
+        ),
+    }
+    _active_permit_all: list[dict[str, Any]] = []
+    if root is not None:
+        try:
+            from sourcecode.spring_profiles import profile_population
+            from sourcecode.source_text import blank_java_comments
+
+            _profile_state["population"] = profile_population(
+                Path(root), list(cir.files or [])
+            ).to_dict()
+            for rel in (cir.files or []):
+                if not isinstance(rel, str) or not rel.endswith(".java"):
+                    continue
+                try:
+                    source = (Path(root) / rel).read_text(
+                        encoding="utf-8", errors="replace"
+                    )
+                except OSError:
+                    continue
+                live = blank_java_comments(source)
+                for match in re.finditer(r"\bpermitAll\s*\(\s*\)", live):
+                    _active_permit_all.append({
+                        "file": rel,
+                        "line": live[:match.start()].count("\n") + 1,
+                        "evidence": match.group(0),
+                    })
+        except Exception as exc:
+            _profile_state["population_error"] = str(exc)
+
     _sec_limitations = [
         "first_line is the earliest source token recorded for the symbol (SourceSpan index) — inside the declaration, not necessarily the declaration line itself; null when the symbol has no recorded span",
         "SEC-001: only emitted for annotation_based security model",
@@ -1361,6 +1397,15 @@ def run_security_audit(
                 "separately under non_spring_rest_surface)."
             ),
             "security_model": cir.metadata.get("security_model", "unknown"),
+            "security_profiles": _profile_state,
+            "active_permit_all": {
+                "rules": _active_permit_all,
+                "count": len(_active_permit_all),
+                "note": (
+                    "Rules are live source evidence; their runtime activation still "
+                    "depends on the selected Spring profile."
+                ),
+            },
             "analysis_time_ms": elapsed_ms,
             # C3-71: which families answered, and which the budget cut. Present on
             # every run, so "all of them" is a published fact rather than an