sourcecode 5.8.9__py3-none-any.whl → 5.8.10__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.9"
+__version__ = "5.8.10"

sourcecode/_docs/DEFECT-LEDGER.md

@@ -16,6 +16,21 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
+**As of 2026-08-19, the `5.8.10` release commit:** this is the current status of
+the 5.8.9 re-audit queue. The audit observations below remain historical evidence;
+only the table here declares present state.
+
+| Rows | Current status | Evidence |
+|---|---|---|
+| `AUD-588-B01`, `AUD-589-B01`, `C3-122` | **closed** | `20596c8`; failed writes cannot suppress the global output-promise guard, covering both `risk` and `audit-report` emit paths. |
+| `AUD-588-B03` | **closed** | `16a52cc`; `SEC-009`, static `@Profile` evidence and `permit_all_rules` are emitted with regressions. |
+| `AUD-588-B04` | **closed** | `fd34eb1`; `data-exposure` preserves the chain decision for every route. |
+| `AUD-588-B05` | **closed** | `c15f5b6`; changed container-wired components block a false `unaffected` disposition. |
+| `AUD-588-B07` | **closed** | `5cc6ba7`; ASK-09 reads the envelope error contract and covers the wrapped shape. |
+| `AUD-588-B08` | **closed** | `c084555`; `impact` publishes its independent stdout-byte budget. |
+| `AUD-588-B11` (container/units subset) | **closed** | `ca72b61`, `a49cf6a`; plan/compare publish container wiring and impact-chain names security-surface units. |
+| `AUD-588-B02`, `B06`, B11 residuals, `B12` | **open** | Require provider non-coverage verification, remaining contract parity and controlled cost calibration; no closure is inferred from the release. |
+
 **As of 2026-08-19, the `5.8.9` release commit:** the latest audit queue was implemented in
 committed post-5.8.7 fixes. This table is
 the authoritative status for round 11; detailed rows retain their original findings and
@@ -60,15 +75,36 @@ to the closed round-11 queue and are not marked closed until reproduced and cove
 | `AUD-588-B11` | Medium | Seven cross-command contract inconsistencies mix naming, units, container-wired warnings, build discovery, populations and tier claims. | **open — solve through shared fact/units authorities** |
 | `AUD-588-B12` | Low/Medium | Cost model is stale by up to 1.74x at warm cache and long commands can be silent until timeout. | **open — remeasure 5.8.8 and add default foreground progress** |
 
+### Re-audit Intake: 5.8.9
+
+The same external auditor re-ran the same `saint-server` snapshot under the same
+read-only protocol against 5.8.9. Score: **80/100** (75 previously), still **53/61
+invocables (87%)**. The CIR remained byte-identical. This reopens false closures and
+adds one newly observable zero-output path; it does not duplicate the rows above.
+
+| ID / lineage | Status | Evidence and next action |
+|---|---|---|
+| `AUD-588-B01` / `C3-122` | **reopened, critical** | `risk` exits 0 with empty stdout and can omit a promised `-o` file. Fix early/partial composition and enforce a typed failure or parseable answer through the real entry point. |
+| `AUD-588-B02` + `B06` | **open, critical** | EclipseLink still receives a Hibernate axis and `non_coverage` is null. Make `not_applicable_reason` authoritative for applicability, effort and aggregate; publish provider non-coverage. |
+| `AUD-588-B03` | **partial** | `permitAll` evidence and profiles are present, but no rule or per-finding activation state exists; rename `active_permit_all` to an honest per-entry contract. |
+| `AUD-588-B04` | **partial** | `explain-endpoint` is fixed; `data-exposure` still reports `coverage_unknown` for chain-permitted routes. |
+| `AUD-588-B05` | **regression** | `unaffected_basis` claims no blocker while container-wired changes are present. Demote routes or publish a blocker/caveat; preserve `affected + unknown + unaffected = total`. |
+| `AUD-588-B07` | **partial** | Selftest publishes provenance but reads `error.code` at the wrong envelope level, producing a false `error` instead of `pass`. |
+| `AUD-588-B08` | **partial** | `impact` still trims stdout at 50,000 bytes after the token ceiling is raised without naming that second budget. |
+| `AUD-588-B11` | **open, six residuals** | `plan`/`compare` miss container reach; units, build discovery, populations and risk tier still diverge. |
+| `AUD-588-B12` | **partial** | Timeline completes, but cost anchors are stale and long foreground commands remain silent by default. |
+| `AUD-589-B01` | **new, high** | `audit-report` can exit 0 with empty stdout; its `-o` path diverges and leaves partial evidence when killed. Reuse the working `_partial` and output-promise contracts. |
+| `AUD-589-B02` | **unconfirmed performance suspicion** | `data-exposure --config` was measured 2.76x slower with identical output; require convergent controlled measurements before code changes. |
+
 ### Recommended Features From This Audit
 
 | ID | Recommendation | Classification |
 |---|---|---|
-| `AUD-588-F01` | Explicit EclipseLink/JPA-provider migration axis, including namespace and coordinate changes. | **Deferred**; `non_coverage` is the honest current contract. |
-| `AUD-588-F02` | Shared answer-contract layer for units, populations, caveats and container-wired reach. | **Covered** by existing authorities and parity tests. |
-| `AUD-588-F03` | Versioned cost-model calibration by repository size and cache state. | **Covered** by `perf-baseline-v1` and cache/scale metadata. |
-| `AUD-588-F04` | Default progress/heartbeat for long foreground commands without contaminating machine-readable stdout. | **Covered as explicit opt-in** through `--progress`/`ASK_PROGRESS`. |
-| `AUD-588-F05` | Controlled audit-coverage expansion from 87% to 90% via safe `auth logout`, reversible `telemetry disable` and dirty-tree `verify-edit` checks. | **Verified** in controlled regression coverage; verification scope. |
+| `AUD-588-F01` | Explicit EclipseLink/JPA-provider migration axis, including namespace and coordinate changes. | **Deferred**; its prerequisite provider `non_coverage` disclosure is still open. |
+| `AUD-588-F02` | Shared answer-contract layer for units, populations, caveats and container-wired reach. | **Partially covered**; six consumers remain disconnected according to the re-audit. |
+| `AUD-588-F03` | Versioned cost-model calibration by repository size and cache state. | **Partially covered**; schema and dimensions exist, but 5.1.0-era anchors are stale. |
+| `AUD-588-F04` | Default progress/heartbeat for long foreground commands without contaminating machine-readable stdout. | **Explicit opt-in by decision**, not default coverage; update cost advice accordingly. |
+| `AUD-588-F05` | Controlled audit-coverage expansion from 87% to 90% via safe `auth logout`, reversible `telemetry disable` and dirty-tree `verify-edit` checks. | **Locally verified only**; external audit remains at 87% with eight blocked invocables. |
 
 **Recommended fix order:** `B01`, `B02`, `B04`, `B03`, `B05/B11`, `B08/B09`, `B07`,
 then `B06/B10/B12`. The dirty-tree `verify-edit` path remains unverified, not confirmed

sourcecode/_docs/USER_GUIDE.md

@@ -136,7 +136,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.9
+# ask 5.8.10
 ```
 
 Requires Python 3.9+.

sourcecode/change_plan.py

@@ -28,6 +28,7 @@ from typing import TYPE_CHECKING
 
 from sourcecode import non_coverage as _non_coverage
 from sourcecode.canonical_ir import project_blast_radius
+from sourcecode.container_wiring import detect_classes
 from sourcecode.repository_ir import _all_callers_from_rg
 from sourcecode.security_posture import _graph_nodes
 from sourcecode.path_filters import is_test_path
@@ -139,6 +140,7 @@ def build_change_plan(
         }
 
     seeds = list(blast["matched_fqns"])
+    container_wired = [w.to_dict() for w in detect_classes(cir, seeds)]
     meta = _node_meta(cir)
     affected = _dependents_closure(cir.reverse_graph or {}, seeds, max_depth, _NODE_CAP)
 
@@ -221,6 +223,7 @@ def build_change_plan(
             "count": len(prod),
             "components": prod[:_LIST_CAP],
         },
+        "container_wired": container_wired,
         "covering_tests": (
             {
                 "count": len(tests),

sourcecode/cli.py

@@ -2112,12 +2112,14 @@ def _emit_command_output(
             raise typer.Exit(1)
     if output_path is not None:
         _receipt = _safe_write_file(output_path, content)
-        _mark_output_delivered()
         if not _receipt.get("written"):
             # B15: the answer was produced and thrown away, on request. Saying
             # "written to nul" would be the one thing worse than the error this
             # used to raise.
             typer.echo(_receipt.get("note") or f"Discarded to {output_path}")
+            # A failed write is never delivery. The guard separately exempts
+            # discard sinks and existing files by path, so no state flag is
+            # needed here.
         elif success_msg:
             # C3-26/C3-18: the payload went to the file, so stdout is free and
             # this confirmation is the run's whole answer — `cache warm` and
@@ -2126,12 +2128,14 @@ def _emit_command_output(
             # stderr battery listed its commands by hand. Measured before the
             # fix on spring-petclinic: stdout 0 bytes, stderr 155.
             typer.echo(success_msg)
+            _mark_output_delivered()
         else:
             # C3-122: a command whose emit seam carries no sentence of its own
             # confirmed a 444-second run with total silence. The receipt is a
             # notice, so a pipeline and a PowerShell capture stay exactly as
             # they were (C3-26) and a person at a terminal is told.
             _notice(f"✓ {_receipt.get('bytes', 0)} bytes written to {output_path}")
+            _mark_output_delivered()
     else:
         try:
             sys.stdout.buffer.write(content.encode("utf-8"))
@@ -2154,7 +2158,8 @@ def _emit_command_output(
             _notice("✓ copied to clipboard")
     # The answer has been handed over. Any `done (Xs)` a command deferred is now
     # a true claim and prints here — never before this line (C3-54).
-    _progress_output_emitted()
+    if _OUTPUT_DELIVERED:
+        _progress_output_emitted()
 
 
 def _emit_text_output(
@@ -6983,6 +6988,16 @@ def impact_cmd(
         cir._raw_ir, target, max_depth=depth, list_limit=0 if _to_file else None,
         root=root, covered_types=_covered_types,
     )
+    # Token ceilings and this command's byte budget are independent controls.
+    # Publish both at the point where the impact answer is shaped so raising
+    # ASK_MAX_OUTPUT_TOKENS cannot be mistaken for disabling stdout trimming.
+    result["stdout_byte_budget"] = BUDGET_IMPACT if not _to_file else None
+    result["stdout_byte_budget_basis"] = (
+        "impact stdout rendering is capped independently at 50,000 UTF-8 bytes; "
+        "ASK_MAX_OUTPUT_TOKENS does not disable this byte budget"
+        if not _to_file else
+        "No stdout byte budget applies when --output writes the complete answer."
+    )
     result = _apply_budget(result, BUDGET_IMPACT, label="impact", output_path=output_path)
     if _misread and result.get("resolution") == "not_found":
         result["analysis_warnings"] = [*(result.get("analysis_warnings") or []), _misread]

sourcecode/compare.py

@@ -262,6 +262,7 @@ def build_comparison(
             "resolution": resolution,
             "resolved": resolved,
             "cost": cost,
+            "container_wired": plan.get("container_wired") if resolved else None,
             "why": _evidence_trail(cost, blast, resolved, plan),
         }
         # C1-13/C2-1: when the walk was capped, some magnitudes are floors. The

sourcecode/data_exposure.py

@@ -83,6 +83,7 @@ class ExposedRoute:
     verdict: str
     access: Optional[str] = None
     access_decision: Optional[str] = None
+    chain_decision: Optional[str] = None
 
     def to_dict(self) -> dict:
         out = {
@@ -100,6 +101,8 @@ class ExposedRoute:
         if self.access is not None:
             out["access_under_profile"] = self.access
             out["access_decision"] = self.access_decision
+        if self.chain_decision is not None:
+            out["chain_decision"] = self.chain_decision
         return out
 
 
@@ -375,6 +378,10 @@ def _finish_route(
         verdict=verdict,
         access=access,
         access_decision=decision,
+        chain_decision=(
+            str(bound["chain_decision"])
+            if bound.get("chain_decision") is not None else None
+        ),
     )
 
 

sourcecode/pr_impact.py

@@ -786,6 +786,23 @@ def _run_pr_impact_internal(
     # `ProductHandlerMapping → blCatalogService → ProductDaoImpl` chain, caught
     # structurally rather than by recognising a name.
     disposition_blockers: list[_disposition.Blocker] = []
+    changed_wired = [
+        item for item in wired
+        if set(getattr(item, "kinds", ()) or ())
+        & {"container_configuration", "interception_point"}
+    ]
+    if changed_wired:
+        _named = ", ".join(item.symbol for item in changed_wired[:3])
+        disposition_blockers.append(_disposition.Blocker(
+            reason=_disposition.REASON_CONTAINER_DISPATCH,
+            detail=(
+                f"{len(changed_wired)} changed container-wired component(s) "
+                f"({_named}{', …' if len(changed_wired) > 3 else ''}) are framework "
+                "dispatch points. Their route reach is not represented by the call "
+                "cone, so routes with no modeled path are unknown rather than "
+                "unaffected (NC-010)."
+            ),
+        ))
     wired_in_cone = detect_container_wired_classes(
         cir, sorted(cone_classes - class_fqns_set)
     )

sourcecode/rule_catalog.py

@@ -56,6 +56,7 @@ RULES: tuple[Rule, ...] = (
     Rule("SEC-006", "SEC", "Cookie created without the Secure attribute"),
     Rule("SEC-007", "SEC", "Credential stored in a deployment descriptor"),
     Rule("SEC-008", "SEC", "SQL built by MyBatis string interpolation"),
+    Rule("SEC-009", "SEC", "Anonymous request-chain exception"),
     Rule("DEAD-001", "DEAD", "Security control present but disabled"),
     Rule("GATE-001", "GATE", "Custom AOP/security gate can be bypassed by proxy limits"),
     Rule("GATE-002", "GATE", "Custom gate advice appears to fail open"),

sourcecode/security_config_scan.py

@@ -258,6 +258,28 @@ def _enclosing_type(source: str, offset: int, fallback: str) -> str:
 def _scan_java(source: str, rel: str) -> "list[SecurityConfigObservation]":
     out: "list[SecurityConfigObservation]" = []
 
+    # SEC-009 — an anonymous request-chain exception is a finding in its own
+    # right. Keep the matcher context requirement narrow so unrelated method
+    # names containing `permitAll()` do not become security findings.
+    permit = re.search(r"\bpermitAll\s*\(\s*\)", source)
+    if permit and re.search(
+        r"SecurityFilterChain|authorizeHttpRequests|authorizeRequests|"
+        r"requestMatchers|anyRequest",
+        source,
+    ):
+        out.append(SecurityConfigObservation(
+            rule="SEC-009",
+            file=rel,
+            line=_line_of(source, permit.start()),
+            symbol=_enclosing_type(source, permit.start(), Path(rel).stem),
+            evidence=permit.group(0),
+            detail=(
+                "The active source contains a request-chain rule that permits "
+                "anonymous access. Verify its matcher and profile condition; this "
+                "exception does not prove that the whole chain is public."
+            ),
+        ))
+
     # SEC-004 — a password stored under a fast unsalted digest.
     if any(tok in source for tok in _ENCODER_CONTEXT):
         for token in _WEAK_DIGESTS:

sourcecode/selftest.py

@@ -144,7 +144,8 @@ def _check_ask09(subject: Subject) -> "dict[str, Any]":
         "probe_command": probe_command,
         "observed_payload_excerpt": observed_excerpt,
     }
-    body = _payload_of(payload)
+    document = payload if isinstance(payload, dict) else {}
+    body = _payload_of(document)
     if code == 0:
         return _result(
             NOT_APPLICABLE,
@@ -153,7 +154,10 @@ def _check_ask09(subject: Subject) -> "dict[str, Any]":
             "needed to exercise it here",
             **evidence,
         )
-    error = body.get("error")
+    # The output seam may wrap the command payload and keep the envelope error
+    # beside it. Read both shapes; dropping the envelope first turns a real
+    # OUTPUT_TOO_LARGE refusal into a false ERROR with code=None.
+    error = document.get("error") or body.get("error")
     error_body = error if isinstance(error, dict) else body
     if error_body.get("code") != "OUTPUT_TOO_LARGE":
         return _result(
@@ -163,7 +167,7 @@ def _check_ask09(subject: Subject) -> "dict[str, Any]":
             **evidence,
         )
     hint = str(error_body.get("hint") or "")
-    basis = body.get("hint_basis") or {}
+    basis = document.get("hint_basis") or body.get("hint_basis") or {}
     declared = list(basis.get("declared_flags") or [])
     if "No smaller inline variant is available" in hint and declared:
         return _result(

sourcecode/spring_impact.py

@@ -1588,6 +1588,10 @@ class ImpactOrchestrator:
                 "indirect_caller_symbol_count_unit": "indirect caller list entries",
                 "caller_metric_note": CALLER_METRIC_RECONCILIATION,
                 "endpoints_total": len(endpoints_affected),
+                "security_surfaces_unit": (
+                    "endpoint rows in the impact chain; each row is one affected "
+                    "endpoint and carries its security posture verdict"
+                ),
                 "findings_in_chain": len(impact_findings),
                 "findings_status": findings_status,
                 "findings_status_note": (

sourcecode/spring_security_audit.py

@@ -508,6 +508,7 @@ class _SEC00XConfigurationWeaknesses:
         # A credential every reader of the repository already holds.
         "SEC-007": "high",
         "SEC-008": "high",
+        "SEC-009": "medium",
         # C3-101 (c), decided in 5.8.7 and recorded here rather than absorbed.
         # The row left this open on purpose after (a) and (b) shipped: 8 `high`
         # findings and 0 true positives is a reason to ask whether the severity
@@ -527,6 +528,7 @@ class _SEC00XConfigurationWeaknesses:
         "SEC-006": "Cookie created without the Secure attribute",
         "SEC-007": "Credential stored in a deployment descriptor",
         "SEC-008": "SQL built by MyBatis string interpolation",
+        "SEC-009": "Anonymous request-chain exception",
         "DEAD-001": "Security control present but disabled",
     }
     #: A pattern that emits more than one rule id declares them all, so a catalogue
@@ -560,6 +562,11 @@ class _SEC00XConfigurationWeaknesses:
             "an identifier such as an ORDER BY column, map it through a closed "
             "allowlist before it reaches the mapper."
         ),
+        "SEC-009": (
+            "Confirm the matcher is intentionally public under the applicable "
+            "profile, keep it as narrow as possible, and do not treat it as "
+            "evidence that unrelated routes are protected or public."
+        ),
         "DEAD-001": (
             "Decide explicitly: either restore the commented control and verify it in "
             "the active profile, or delete the dead block with a note explaining the "
@@ -590,6 +597,11 @@ class _SEC00XConfigurationWeaknesses:
 
         findings: list[SpringFinding] = []
         for obs in observations:
+            profile_condition, active_by_default = _profile_evidence(root, obs.file)
+            evidence = {"matched": obs.evidence, "line": obs.line, "rule": obs.rule}
+            if profile_condition is not None:
+                evidence["profile_condition"] = profile_condition
+                evidence["active_under_default_profiles"] = active_by_default
             findings.append(SpringFinding(
                 id=SpringFinding.make_id(obs.rule, f"{obs.file}:{obs.line}"),
                 pattern_id=obs.rule,
@@ -602,7 +614,7 @@ class _SEC00XConfigurationWeaknesses:
                 symbol=obs.symbol,
                 source_file=obs.file,
                 first_line=obs.line,
-                evidence={"matched": obs.evidence, "line": obs.line, "rule": obs.rule},
+                evidence=evidence,
                 explanation=obs.detail,
                 fix_hint=self._FIX.get(obs.rule, ""),
                 limitations=[
@@ -618,6 +630,23 @@ def _line_of(source: str, offset: int) -> int:
     return source.count("\n", 0, max(0, offset)) + 1
 
 
+def _profile_evidence(root: Optional[Path], rel: str) -> tuple[Optional[str], Optional[bool]]:
+    """Return static @Profile evidence without claiming runtime activation."""
+    if root is None:
+        return None, None
+    try:
+        source = (Path(root) / rel).read_text(encoding="utf-8", errors="replace")
+    except OSError:
+        return None, None
+    match = re.search(r"@Profile\s*\((?P<expr>[^)]*)\)", source)
+    if match is None:
+        return None, True
+    expr = match.group("expr").strip()
+    names = re.findall(r'"([^"]+)"', expr)
+    active_by_default = bool(names) and all(name.startswith("!") for name in names)
+    return expr, active_by_default
+
+
 _JAVA_METHOD_RE = re.compile(
     r"(?P<mods>(?:(?:public|protected|private|static|final|synchronized|abstract|native)\s+)*)"
     r"(?P<ret>[\w.$<>\[\], ?]+)\s+"
@@ -1296,7 +1325,7 @@ def run_security_audit(
             "profiles are static candidates, not proof of activation."
         ),
     }
-    _active_permit_all: list[dict[str, Any]] = []
+    _permit_all_rules: list[dict[str, Any]] = []
     if root is not None:
         try:
             from sourcecode.spring_profiles import profile_population
@@ -1316,10 +1345,13 @@ def run_security_audit(
                     continue
                 live = blank_java_comments(source)
                 for match in re.finditer(r"\bpermitAll\s*\(\s*\)", live):
-                    _active_permit_all.append({
+                    profile_condition, active_by_default = _profile_evidence(root, rel)
+                    _permit_all_rules.append({
                         "file": rel,
                         "line": live[:match.start()].count("\n") + 1,
                         "evidence": match.group(0),
+                        "profile_condition": profile_condition,
+                        "active_under_default_profiles": active_by_default,
                     })
         except Exception as exc:
             _profile_state["population_error"] = str(exc)
@@ -1398,12 +1430,12 @@ def run_security_audit(
             ),
             "security_model": cir.metadata.get("security_model", "unknown"),
             "security_profiles": _profile_state,
-            "active_permit_all": {
-                "rules": _active_permit_all,
-                "count": len(_active_permit_all),
+            "permit_all_rules": {
+                "rules": _permit_all_rules,
+                "count": len(_permit_all_rules),
                 "note": (
-                    "Rules are live source evidence; their runtime activation still "
-                    "depends on the selected Spring profile."
+                    "Rules are live source evidence. Profile fields are static hints; "
+                    "runtime activation still depends on the selected Spring profile."
                 ),
             },
             "analysis_time_ms": elapsed_ms,

{sourcecode-5.8.9.dist-info → sourcecode-5.8.10.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.9
+Version: 5.8.10
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -49,7 +49,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.8.9-blue)
+![Version](https://img.shields.io/badge/version-5.8.10-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -139,7 +139,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.9 — and, on a build that has aged,
+ask version                    # ask 5.8.10 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.9.dist-info → sourcecode-5.8.10.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=SEXDKNw2zepQYde4aTeTqJMfLe9te9ysvUaPtO8es-8,308
+sourcecode/__init__.py,sha256=N6jOxr62_YHW3o1udlxIduDuvRxhmGvpOs9L3F4lv28,309
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/answer_bounds.py,sha256=_51_DCuYEUmI_xwUFxDMiprSavkNakkLiIBbPjevQ3M,9793
 sourcecode/archetype.py,sha256=uubguXP5ltQt25ACNVm9kX4KRTe7JCqkFfg4H9zckCo,40971
@@ -22,13 +22,13 @@ sourcecode/caller_metrics.py,sha256=--sFGDnIog_YGu9xZHMcB91F5xZakfaAKvy15xU54hg,
 sourcecode/caller_reach.py,sha256=M7Ffs5CtlimihfdSy3HtC4WpDP97bRFX15QYOlOfMJw,16626
 sourcecode/canonical_ir.py,sha256=UmCvjGIz7kyjcKdZFYZuxa9y02EfsmDGZj3kUEKzCvo,36200
 sourcecode/chain_rules.py,sha256=Bi6UHfgd-GxWswmnHRcPz5jdbAuqka3Zkz_P-MTvqhw,12767
-sourcecode/change_plan.py,sha256=FAbLtexNThXp51STU-F2a_3AQd1LWd3NsKWMnMNJrPo,12333
+sourcecode/change_plan.py,sha256=wJ896V27a3qb-2vcZhrcOSOqFAwCmEyzbhdbdxM2LlQ,12504
 sourcecode/cir_graphs.py,sha256=RytqSv1WF8kdlfXj2fPQz16LY4akS2kyThbdWL8beCQ,14835
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=p5ZvOcCyuV-9YftPfyKAL2whUR2zPwWVAQ9k3-Eel0c,723455
+sourcecode/cli.py,sha256=BV6v8OKXO6mW-lFuc7NX5Z2yPToTZnSRptxr7Qekmic,724322
 sourcecode/client_calls.py,sha256=YOPnfRZzRyqmdHvXSVeiunW8cuiuCuWXacNIQRgKMCw,22640
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
-sourcecode/compare.py,sha256=2GdDy0qkDSgmkkpgvoCHitoLj3mt30EeFgJ8PGEXJng,14712
+sourcecode/compare.py,sha256=Lj8epBqrHLWBhiccE2X0ZbaP2H3hNb7qecoN9Jvsj7c,14794
 sourcecode/confidence_analyzer.py,sha256=5li0NyOdS3Ie-f2ZY1gBmnjtkuRvI50l4OnGaKkXAOU,22358
 sourcecode/constraint_diff.py,sha256=hWIO5vsxvHjsgQx23K3r_JMy1W6wQ2Ca4DqB9R_iMnY,5831
 sourcecode/consumer_join.py,sha256=ERwx9SOu0ZE3NgCBYvB0l67iDLnWMdMpVhlCmbA_3Sw,19618
@@ -42,7 +42,7 @@ sourcecode/contract_init.py,sha256=bXRCqWM9tvrDLeT8j7ea6IWf87jB4VJxnlSzGBsRRXo,1
 sourcecode/contract_model.py,sha256=nRxJKPMs1VHwFTa8AVXhGmaLjti3Lr2sjHDpWgv1bfE,3917
 sourcecode/contract_pipeline.py,sha256=4XE-xhab7ysdExXyUOBl2hAH4MABo7moKnT9V4XcEwQ,30243
 sourcecode/coverage_parser.py,sha256=X9scuUWxacahYTrTBGea2Ku-sf-WCVcnc9OEB35_3IU,19340
-sourcecode/data_exposure.py,sha256=geJCZ_DRgv-sZlyZiRQoCDbOXP9ByZdQ_MvSE3yBYFQ,17735
+sourcecode/data_exposure.py,sha256=PR-kX1UdG4_9A7ZDsKQVrPtos5GNTEMEIkpk9Aveoo0,18018
 sourcecode/data_labels.py,sha256=c_hmgudTE68cVRdywfbfonr7nUWIL-JH2HOXB8Pplv0,8453
 sourcecode/declarations.py,sha256=Jr7oJDg004sFw0TvJySNVggXFT2jB6hQgbeQK2qreVo,7000
 sourcecode/defect_identity.py,sha256=XS2VFDImg9NLaRImybKTeyk-CoDSsXmchldg0dwvM7c,7028
@@ -105,7 +105,7 @@ sourcecode/phased_run.py,sha256=fZxxiCX-CykagFVR_Fp2Tin3H6FDSV8YRpYGtsRAXj8,1835
 sourcecode/pipe_contract.py,sha256=PML0Er5d8uDyec4OrdUXuyqHbGPUYndjeaKUjkFz2u4,8369
 sourcecode/posture.py,sha256=m1sYDLtGvVkvDEVqMxuDvAKz4-KPj0z5Q6x3V_5U-FM,83276
 sourcecode/pr_comment_renderer.py,sha256=239PmJdf95av_ZW236C7_tvq_ahECeuF9AZxrheJ4OQ,15573
-sourcecode/pr_impact.py,sha256=JRVKV0LiVpE0aTy_Wcy-o0EhWdd1OChxHRIcS0pZHl4,36216
+sourcecode/pr_impact.py,sha256=taHp0X57tLHyKQ5Qvx7UM1HhX4_csw5t0bgLdN7jYm8,37010
 sourcecode/prepare_context.py,sha256=-FFvr8NgCAHckTp93ZjWEdI3fFURaLkTZiwt3_0eqgg,239532
 sourcecode/product_info.py,sha256=0zjZEutL7iDdp9aVyIumIrNyNn9VWYFc2lIytSbjBP4,727
 sourcecode/progress.py,sha256=naKbWFqf-eTE3vtLsi-eHYILz0p3pxCASAzMmvxUIAI,21643
@@ -127,7 +127,7 @@ sourcecode/repository_ir.py,sha256=-tV6QuCu56kUaosz4-SgkPdL46DuOlvlRAYxMOhtvXU,4
 sourcecode/ris.py,sha256=zlns4esv1tK8VDIYzOzRmw5yM6VLx7oxaPNB_kN3it4,28617
 sourcecode/risk.py,sha256=hXddUjiI-SS_yQ0gZyhufs4lzKwWySOKY4Lj96gL9_A,89733
 sourcecode/risk_model.py,sha256=RoC-G15qZP5BLEwwmcr4eJ0APgvIbh1WTqhTVT-5YFE,10895
-sourcecode/rule_catalog.py,sha256=pTkgkQZ1u7atB3fkQJ9BPWo8lNiamvEuRN7MtRgle0c,5263
+sourcecode/rule_catalog.py,sha256=QCx6ToFTMCtDt5uuX1uBMLuw3b9Cd92gGRsX34kud4U,5328
 sourcecode/rule_pass.py,sha256=DTNxD-nAecMJhIzI1LCd9FyRumInQSZjitacNh4Zoc8,14671
 sourcecode/runs.py,sha256=o4oXkB3WFJGScbK_C10OAWzsE18B9Zc55u_IE8_yl4M,6291
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
@@ -138,9 +138,9 @@ sourcecode/schema_producers.py,sha256=4XzW4wZXnFHOaJT7XenirXGCo0pPZhkdhb7zcDtqFn
 sourcecode/schema_registry.py,sha256=ny9yqt_Mwt92TwRRviEXA8jfpeld-xB9KUTOaTiyhZs,20996
 sourcecode/security_chain.py,sha256=1YZVeFLwy65kntMBhMNvz1cUpOoKCmvEqYICgxs66Gw,6823
 sourcecode/security_config.py,sha256=LUppRDYQK0oKM4qdEOLObaeU3frFTS-paEZo7dMgtY8,5467
-sourcecode/security_config_scan.py,sha256=iXDeulgdbAwUFR01p9PgrJED2vd4HE2FCZgqrxX5D0E,32824
+sourcecode/security_config_scan.py,sha256=Wv7QqEx_KbgmhbOGuX7RQfotzkkif43PFU1LohKNWCM,33818
 sourcecode/security_posture.py,sha256=wj6WwvasIh6r-minwBz3oz1T9Zl8SPsPhn7zxDD-yng,55861
-sourcecode/selftest.py,sha256=3z9pMvK4ujMDqrTKskAQbXwfpRu4lJU_yx4mbftFDVg,18772
+sourcecode/selftest.py,sha256=a-6B-0k8tdVapGlXy0oC4FBxqgHgb0m4kb8oxDknnvI,19109
 sourcecode/semantic_analyzer.py,sha256=xGwQvhU9xeOlZ4N-TPXFZT8HBHx4Rg0nPwu8nDFl00Y,95621
 sourcecode/semantic_impact_engine.py,sha256=t09IirGC3JjQDy33JZd1_WKzQVKXkoNl3-XEUr5kjis,20563
 sourcecode/semantic_integration_engine.py,sha256=ZjyKJKOj-adScWlYBuWx8Ee_P0F4_OImUJVnCYgopuU,20952
@@ -150,11 +150,11 @@ sourcecode/servlet_surface.py,sha256=CeiebkxLXKojUQxIf7HV7tdQAwLM32ggDUwBnVQIjdo
 sourcecode/source_text.py,sha256=R52gmSljz7L6YVPbixv5W-LOZ5eKUVvSUP3S-QH_IWc,9047
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=cW6NiQAFUM9mDYPitJr6MrQg--YBI41LxrSEMI9aeIQ,25272
-sourcecode/spring_impact.py,sha256=NaAZbY8N8gmtf9NHBh5o550yvuiewtmBE7PfAEkCIk8,88321
+sourcecode/spring_impact.py,sha256=yngLmb3ABL9_6b59xSuU6sn2bAJj1MVCGy9dsjgNaic,88539
 sourcecode/spring_model.py,sha256=7GqgcWnHC96ixusRJmD-9tDV93qTdkMh-8e7CBNK0pc,24126
 sourcecode/spring_profiles.py,sha256=-kwrCK0O-MRjrCp6SA1d31t--o4Tg87iqPVrTwxoIUs,19605
 sourcecode/spring_properties.py,sha256=kPTk5qAJxdbHc1hclhHAP0O-hCIzBn8PTh3lzl-I4a4,8400
-sourcecode/spring_security_audit.py,sha256=6_zbZaDFZiXe7fMMpAuVjbbbk1oz_wTZI3JfBmHwpqQ,68097
+sourcecode/spring_security_audit.py,sha256=TJHQG_Qen_Fr3rLjDbvfZ08rp7LK-nYVBPIx3eG-qq8,69673
 sourcecode/spring_semantic.py,sha256=UrmLg_4gmBVmMqvSnUMgSReVEERVGv3X7LYDBEs6k_o,16598
 sourcecode/spring_tx_analyzer.py,sha256=WBibPgkjQm33kFgERx6zLtp87FpJNE5V_4JI3xZ5zD4,50094
 sourcecode/sql_taint.py,sha256=As1DbEdjXMBFjCTXU5ojksOzuKkP6LmnuMVnzzmckzc,26998
@@ -240,13 +240,13 @@ sourcecode/telemetry/consent.py,sha256=pQdl-QeLl6Gcibn0eWHSKZrm-HYSsjpVqOnjrgFp8
 sourcecode/telemetry/events.py,sha256=4_yeO58U-Cwc1Qb27VB0_EjhmroY0k91n3_VGxeALB8,2776
 sourcecode/telemetry/filters.py,sha256=RzxauTz8HliO4BllQnXEXc7zTeqdCZi5MgqGEDuW7OQ,6570
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode/_docs/DEFECT-LEDGER.md,sha256=cJPUezkF4LbU_8ZSOgeh_m2gUvhoidBCHIrW77AkqIk,732817
+sourcecode/_docs/DEFECT-LEDGER.md,sha256=l9rGV6X-RmLgpWuYBqMcvjjjBx2NHcmdlDH8epSd33A,736756
 sourcecode/_docs/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
 sourcecode/_docs/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode/_docs/USER_GUIDE.md,sha256=okCMd6CxD3_Nz9qrXA1EGf8D3jHNjK8zAcTClNcm0gE,86739
-sourcecode-5.8.9.dist-info/METADATA,sha256=4RMPxZ4FCoQZASGy12Azs46i-7udfu2B5HseWc2OCpM,50807
-sourcecode-5.8.9.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-5.8.9.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-5.8.9.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
-sourcecode-5.8.9.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode-5.8.9.dist-info/RECORD,,
+sourcecode/_docs/USER_GUIDE.md,sha256=PTMJ0zh_RAXmctfwsNA9-xBNudO62y1Io5rSYlI-Oqs,86740
+sourcecode-5.8.10.dist-info/METADATA,sha256=WEFjTsf2cYQHfik7y8eS6Jy3Pp7JfLyMc2HjbVc-DE8,50810
+sourcecode-5.8.10.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-5.8.10.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-5.8.10.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
+sourcecode-5.8.10.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
+sourcecode-5.8.10.dist-info/RECORD,,