sourcecode 5.8.9__tar.gz → 5.8.11__tar.gz

{sourcecode-5.8.9 → sourcecode-5.8.11}/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## [5.8.11] — 2026-08-19
+
+*Packaging re-release after the failed PyPI upload of 5.8.10. No functional or
+schema changes relative to 5.8.10.*
+
+## [5.8.10] — 2026-08-19
+
+*Audit-remediation release: the 5.8.9 re-audit defects that were reproducible in
+the repository now have one authority, a regression test and an atomic fix.*
+
+### Fixed
+- A failed `--output` write can no longer be marked delivered by the common
+  progress seam; the global promise guard now returns `EXECUTION_FAILED` rather
+  than allowing exit 0 without the requested artifact.
+- `selftest` ASK-09 reads `error.code`, `error.hint` and `hint_basis` from both
+  supported output-envelope shapes, so a valid ceiling refusal passes its own
+  gate.
+- `spring-audit` emits `SEC-009` for active request-chain `permitAll()` rules,
+  including static `@Profile` evidence; `permit_all_rules` replaces the ambiguous
+  aggregate metadata name.
+- `data-exposure`, `pr-impact`, `plan` and `compare` retain their relevant chain
+  decision or container-wiring floor instead of presenting the uncovered surface
+  as unaffected.
+- `impact` discloses its independent 50,000-byte stdout budget, and
+  `impact-chain` names the population counted by `security_surfaces`.
+
+### Remaining audit work
+- Provider-specific migration disclosure, the residual answer-contract parity
+  items, and cost/progress calibration remain tracked in the roadmaps; EclipseLink
+  support itself remains a deferred product feature.
+
 ## [5.8.9] — 2026-08-19
 
 *Feature reconciliation release: the ASK 5.8.8 audit recommendations were

{sourcecode-5.8.9 → sourcecode-5.8.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.8.9
+Version: 5.8.11
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -49,7 +49,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.8.9-blue)
+![Version](https://img.shields.io/badge/version-5.8.11-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -139,7 +139,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.9 — and, on a build that has aged,
+ask version                    # ask 5.8.11 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.9 → sourcecode-5.8.11}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.8.9-blue)
+![Version](https://img.shields.io/badge/version-5.8.11-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -94,7 +94,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.8.9 — and, on a build that has aged,
+ask version                    # ask 5.8.11 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.8.9 → sourcecode-5.8.11}/docs/DEFECT-LEDGER.md

@@ -16,6 +16,21 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
+**As of 2026-08-19, the `5.8.11` release commit:** this is the current status of
+the 5.8.9 re-audit queue. The audit observations below remain historical evidence;
+only the table here declares present state.
+
+| Rows | Current status | Evidence |
+|---|---|---|
+| `AUD-588-B01`, `AUD-589-B01`, `C3-122` | **closed** | `20596c8`; failed writes cannot suppress the global output-promise guard, covering both `risk` and `audit-report` emit paths. |
+| `AUD-588-B03` | **closed** | `16a52cc`; `SEC-009`, static `@Profile` evidence and `permit_all_rules` are emitted with regressions. |
+| `AUD-588-B04` | **closed** | `fd34eb1`; `data-exposure` preserves the chain decision for every route. |
+| `AUD-588-B05` | **closed** | `c15f5b6`; changed container-wired components block a false `unaffected` disposition. |
+| `AUD-588-B07` | **closed** | `5cc6ba7`; ASK-09 reads the envelope error contract and covers the wrapped shape. |
+| `AUD-588-B08` | **closed** | `c084555`; `impact` publishes its independent stdout-byte budget. |
+| `AUD-588-B11` (container/units subset) | **closed** | `ca72b61`, `a49cf6a`; plan/compare publish container wiring and impact-chain names security-surface units. |
+| `AUD-588-B02`, `B06`, B11 residuals, `B12` | **open** | Require provider non-coverage verification, remaining contract parity and controlled cost calibration; no closure is inferred from the release. |
+
 **As of 2026-08-19, the `5.8.9` release commit:** the latest audit queue was implemented in
 committed post-5.8.7 fixes. This table is
 the authoritative status for round 11; detailed rows retain their original findings and
@@ -60,15 +75,36 @@ to the closed round-11 queue and are not marked closed until reproduced and cove
 | `AUD-588-B11` | Medium | Seven cross-command contract inconsistencies mix naming, units, container-wired warnings, build discovery, populations and tier claims. | **open — solve through shared fact/units authorities** |
 | `AUD-588-B12` | Low/Medium | Cost model is stale by up to 1.74x at warm cache and long commands can be silent until timeout. | **open — remeasure 5.8.8 and add default foreground progress** |
 
+### Re-audit Intake: 5.8.9
+
+The same external auditor re-ran the same `saint-server` snapshot under the same
+read-only protocol against 5.8.9. Score: **80/100** (75 previously), still **53/61
+invocables (87%)**. The CIR remained byte-identical. This reopens false closures and
+adds one newly observable zero-output path; it does not duplicate the rows above.
+
+| ID / lineage | Status | Evidence and next action |
+|---|---|---|
+| `AUD-588-B01` / `C3-122` | **reopened, critical** | `risk` exits 0 with empty stdout and can omit a promised `-o` file. Fix early/partial composition and enforce a typed failure or parseable answer through the real entry point. |
+| `AUD-588-B02` + `B06` | **open, critical** | EclipseLink still receives a Hibernate axis and `non_coverage` is null. Make `not_applicable_reason` authoritative for applicability, effort and aggregate; publish provider non-coverage. |
+| `AUD-588-B03` | **partial** | `permitAll` evidence and profiles are present, but no rule or per-finding activation state exists; rename `active_permit_all` to an honest per-entry contract. |
+| `AUD-588-B04` | **partial** | `explain-endpoint` is fixed; `data-exposure` still reports `coverage_unknown` for chain-permitted routes. |
+| `AUD-588-B05` | **regression** | `unaffected_basis` claims no blocker while container-wired changes are present. Demote routes or publish a blocker/caveat; preserve `affected + unknown + unaffected = total`. |
+| `AUD-588-B07` | **partial** | Selftest publishes provenance but reads `error.code` at the wrong envelope level, producing a false `error` instead of `pass`. |
+| `AUD-588-B08` | **partial** | `impact` still trims stdout at 50,000 bytes after the token ceiling is raised without naming that second budget. |
+| `AUD-588-B11` | **open, six residuals** | `plan`/`compare` miss container reach; units, build discovery, populations and risk tier still diverge. |
+| `AUD-588-B12` | **partial** | Timeline completes, but cost anchors are stale and long foreground commands remain silent by default. |
+| `AUD-589-B01` | **new, high** | `audit-report` can exit 0 with empty stdout; its `-o` path diverges and leaves partial evidence when killed. Reuse the working `_partial` and output-promise contracts. |
+| `AUD-589-B02` | **unconfirmed performance suspicion** | `data-exposure --config` was measured 2.76x slower with identical output; require convergent controlled measurements before code changes. |
+
 ### Recommended Features From This Audit
 
 | ID | Recommendation | Classification |
 |---|---|---|
-| `AUD-588-F01` | Explicit EclipseLink/JPA-provider migration axis, including namespace and coordinate changes. | **Deferred**; `non_coverage` is the honest current contract. |
-| `AUD-588-F02` | Shared answer-contract layer for units, populations, caveats and container-wired reach. | **Covered** by existing authorities and parity tests. |
-| `AUD-588-F03` | Versioned cost-model calibration by repository size and cache state. | **Covered** by `perf-baseline-v1` and cache/scale metadata. |
-| `AUD-588-F04` | Default progress/heartbeat for long foreground commands without contaminating machine-readable stdout. | **Covered as explicit opt-in** through `--progress`/`ASK_PROGRESS`. |
-| `AUD-588-F05` | Controlled audit-coverage expansion from 87% to 90% via safe `auth logout`, reversible `telemetry disable` and dirty-tree `verify-edit` checks. | **Verified** in controlled regression coverage; verification scope. |
+| `AUD-588-F01` | Explicit EclipseLink/JPA-provider migration axis, including namespace and coordinate changes. | **Deferred**; its prerequisite provider `non_coverage` disclosure is still open. |
+| `AUD-588-F02` | Shared answer-contract layer for units, populations, caveats and container-wired reach. | **Partially covered**; six consumers remain disconnected according to the re-audit. |
+| `AUD-588-F03` | Versioned cost-model calibration by repository size and cache state. | **Partially covered**; schema and dimensions exist, but 5.1.0-era anchors are stale. |
+| `AUD-588-F04` | Default progress/heartbeat for long foreground commands without contaminating machine-readable stdout. | **Explicit opt-in by decision**, not default coverage; update cost advice accordingly. |
+| `AUD-588-F05` | Controlled audit-coverage expansion from 87% to 90% via safe `auth logout`, reversible `telemetry disable` and dirty-tree `verify-edit` checks. | **Locally verified only**; external audit remains at 87% with eight blocked invocables. |
 
 **Recommended fix order:** `B01`, `B02`, `B04`, `B03`, `B05/B11`, `B08/B09`, `B07`,
 then `B06/B10/B12`. The dirty-tree `verify-edit` path remains unverified, not confirmed

{sourcecode-5.8.9 → sourcecode-5.8.11}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,6 +3,20 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
+> **CURRENT STATE — 2026-08-19 — 5.8.11 release**
+>
+> The 5.8.9 re-audit battery closed the reproducible output, envelope, security-chain
+> and container-reach defects in atomic commits. `20596c8` fixes the output-promise
+> seam; `16a52cc` adds `SEC-009` and profile evidence; `fd34eb1`, `c15f5b6`,
+> `5cc6ba7`, `c084555`, `ca72b61` and `a49cf6a` close the independent consumer
+> regressions. Targeted cross-command regression suites pass.
+>
+> Remaining work is explicit: provider-specific migration non-coverage (`B02/B06`),
+> the unresolved portions of answer-contract parity (`B11`), controlled cost-model
+> recalibration and the opt-in progress decision (`B12`). EclipseLink migration support
+> remains a deferred feature, not a bug fix. Historical 5.8.9 intake tables below are
+> superseded by this block where their statuses differ.
+
 > **CURRENT STATE — 2026-08-19 — 5.8.9 working tree**
 >
 > The tagged baseline is `5.8.7` (`9aa9852`); the working version is `5.8.9`. The
@@ -67,10 +81,39 @@ customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 > | ID | Feature | Decision |
 > |---|---|---|
 > | `AUD-588-F01` | Explicit EclipseLink/JPA-provider migration axis, including namespace and coordinate changes. | Product feature, deferred. First ship `B02/B06` so the current answer is honest via `non_coverage`; do not infer Hibernate effort for EclipseLink. |
-> | `AUD-588-F02` | Shared answer-contract layer for units, population names, `non_coverage`, container-wired reach and caveats. | **Covered** by existing shared authorities; targeted parity suite passes. |
-> | `AUD-588-F03` | Versioned cost-model calibration with repository-size and cache-state dimensions. | **Covered** by `perf-baseline-v1`, scale dimensions and cache-state metadata. |
-> | `AUD-588-F04` | Default progress/heartbeat for long foreground commands such as `audit-report` and `timeline`. | **Covered as explicit opt-in** by `--progress`/`ASK_PROGRESS`, preserving clean machine output. |
-> | `AUD-588-F05` | Expand audit coverage from 87% toward 90% using safe candidates: no-op `auth logout`, reversible `telemetry disable`, and dirty-tree `verify-edit`. | **Verified** in controlled regression coverage; classified as verification, not product scope. |
+> | `AUD-588-F02` | Shared answer-contract layer for units, population names, `non_coverage`, container-wired reach and caveats. | **Partial**; six consumers remain disconnected according to the re-audit. |
+> | `AUD-588-F03` | Versioned cost-model calibration with repository-size and cache-state dimensions. | **Partial**; schema/dimensions exist but anchors are stale. |
+> | `AUD-588-F04` | Default progress/heartbeat for long foreground commands such as `audit-report` and `timeline`. | **Explicit opt-in by decision**, not default coverage. |
+> | `AUD-588-F05` | Expand audit coverage from 87% toward 90% using safe candidates: no-op `auth logout`, reversible `telemetry disable`, and dirty-tree `verify-edit`. | **Locally verified only**; the external audit remains at 87%. |
+
+> **RE-AUDIT INTAKE — 2026-08-19 — ASK 5.8.9 on the same `saint-server` snapshot**
+>
+> The external re-audit scored **80/100** (up from 75), with the same 53/61 invocables
+> and the same read-only protocol. It confirms the cheap CLI fixes, but reopens the
+> two priority defects that were incorrectly treated as closed and identifies one
+> correction regression. The CIR is byte-identical across 5.8.8/5.8.9, so these are
+> emission, contract or consumer issues rather than parser drift.
+>
+> | ID / lineage | Status after re-audit | Required action |
+> |---|---|---|
+> | `AUD-588-B01` / `C3-122` | **REOPENED, critical** — `risk` exits 0 with empty stdout and can miss a promised `-o` file. | Fix the early/partial composition path; enforce parseable output or typed non-zero failure through the real entry point. |
+> | `AUD-588-B02` + `B06` | **OPEN, critical** — EclipseLink still receives a Hibernate axis and `non_coverage: null`. | Make `not_applicable_reason` authoritative for applicability, effort and aggregate; publish provider non-coverage. |
+> | `AUD-588-B03` | **PARTIAL** — profile/permit evidence exists, but no security rule or activation state reaches findings. | Add the active-chain rule, per-finding profile condition and honest `permit_all_rules` naming. |
+> | `AUD-588-B04` | **PARTIAL** — `explain-endpoint` is fixed; `data-exposure` still emits `coverage_unknown`. | Bind the independent data-exposure consumer to the chain authority. |
+> | `AUD-588-B05` | **REGRESSION** — `unaffected_basis` says exclusions are safe while container-wired changes are present. | Demote routes or publish a non-empty blocker/caveat; preserve the partition invariant. |
+> | `AUD-588-B07` | **PARTIAL** — provenance is present, but `selftest` reads `error.code` at the wrong envelope level. | Read the nested error contract and gate the four ASK-09 branches. |
+> | `AUD-588-B08` | **PARTIAL** — token hint is fixed; `impact` still has a 50,000-byte stdout trim not named alongside the token budget. | Publish both budgets and make the hint disclose token vs byte behavior. |
+> | `AUD-588-B11` | **OPEN, six residuals** — `plan`/`compare` miss container reach; units, build discovery, populations and risk tier still diverge. | Connect all consumers to shared authorities and add parity tests. |
+> | `AUD-588-B12` | **PARTIAL** — timeline completes, but cost anchors are stale and long commands remain silent by default. | Recalibrate from 5.8.9 measurements; decide default heartbeat and foreground classification. |
+> | `AUD-589-B01` | **NEW, high** — `audit-report` can exit 0 with empty stdout; `-o` follows a different/long partial path. | Reuse the working `_partial` contract and shared output-promise guard with `risk`. |
+> | `AUD-589-B02` | **UNCONFIRMED performance suspicion** — `data-exposure --config` measured 2.76x slower with identical output. | Reproduce with a convergent, controlled multi-run measurement before changing code. |
+
+> **Feature status correction:** `F02` is not fully covered while six cross-command
+> consumers remain disconnected; `F03` is not covered by schema versioning alone while
+> its anchors are stale; `F04` remains an explicit opt-in decision and must be reflected
+> in foreground cost advice; `F05` is verified only in controlled local tests, not on the
+> auditor's 8 blocked invocables. `F01` remains deferred, but its `non_coverage` prerequisite
+> is now a confirmed open defect rather than a completed contract.
 >
 > The audit also confirms that inheritance, commented-annotation filtering, profile posture,
 > read-only dry-run flows, endpoint caps, non-coverage and typed errors are working. New work
@@ -79,10 +122,9 @@ customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 > **FEATURE BATTERY UPDATE — 2026-08-19 — 5.8.9**
 >
 > `AUD-588-F01` remains deliberately deferred: EclipseLink is a product axis, not a
-> safe alias for Hibernate. `F02` is covered by existing shared authorities,
-> `F03` by `perf-baseline-v1` with cache/scale dimensions, `F04` by explicit
-> `--progress`/`ASK_PROGRESS`, and `F05` by controlled regression coverage. The
-> feature battery passed its targeted suite; no duplicate implementation was added.
+> safe alias for Hibernate. `F02` and `F03` are partial, `F04` remains opt-in, and
+> `F05` is locally verified but not externally complete. The feature battery passed
+> its targeted suite; no duplicate implementation was added.
 
 > **PHASE UPDATE 2026-08-19 — auditoría externa de `5.8.7` sobre `saint-server`
 > (ronda 11), la primera ejecutada entera bajo `ASK_READONLY=1` y con prueba de

{sourcecode-5.8.9 → sourcecode-5.8.11}/docs/EXECUTIVE-ROADMAP.md

@@ -5,9 +5,10 @@ director; no internal implementation knowledge assumed.*
 
 > **DOCUMENT STATUS — 2026-08-19**
 >
-> The latest tagged baseline is **5.8.7** (`9aa9852`); the working version is **5.8.9**. The repository currently contains
-> the 5.8.8 audit fixes and feature reconciliation in this release commit. The 5.8.7 findings
-> below must be read with this current status.
+> The current release is **5.8.11**. It closes the reproducible output-delivery,
+> security-chain, selftest-envelope and container-reach defects from the 5.8.9
+> re-audit. The 5.8.7 and 5.8.9 findings below are historical evidence and must be
+> read with this status block.
 >
 > **Closed in the current working tree:** `B23`, `B24`, `B25`, `B26`, `B27`, `B28`, the
 > `C4-25` residual, `C4-27`, `C4-28`, additive `C1-49`, and `C3-130` for `plan`/`cold-start`,
@@ -18,6 +19,18 @@ director; no internal implementation knowledge assumed.*
 > profiling, compatibility-window or host-specific CI work, not an unresolved bug from that
 > audit. Historical scores and release claims below remain historical; this block is current.
 
+> **5.8.11 AUDIT REMEDIATION**
+>
+> A requested output file now either exists or the command returns a typed failure;
+> `selftest` can validate a genuine output-ceiling refusal; security exceptions and
+> their static profile conditions are visible as findings; and change-planning views
+> retain container-driven reach instead of treating it as an empty call cone. The
+> release also distinguishes the token ceiling from `impact`'s independent byte cap.
+>
+> The open roadmap is narrower: provider-specific EclipseLink migration disclosure,
+> residual cross-command parity and controlled cost calibration. EclipseLink migration
+> automation remains a future product capability rather than a claim of this release.
+
 > **NEW AUDIT INTAKE — ASK 5.8.8 / `saint-server` — 2026-08-19**
 >
 > A fresh external audit scored the tool **75/100** with **53/61 invocables exercised (87%)**.
@@ -37,6 +50,23 @@ director; no internal implementation knowledge assumed.*
 > calibration, explicit progress controls and the safe audit-coverage candidates are already
 > covered and regression-tested. No duplicate heuristics were added.
 
+> **RE-AUDIT UPDATE — ASK 5.8.9 / `saint-server` — 2026-08-19**
+>
+> The same external audit scored **80/100**, up from 75, with unchanged coverage at
+> **53/61 invocables (87%)** and a byte-identical CIR. The release improved CLI ergonomics
+> and timeline completion, but the two highest-priority issues remain open: `risk` can
+> exit 0 with no answer or promised file, and `migrate-check` still bills Hibernate work
+> to an EclipseLink repository. A new high-priority sibling is `audit-report` returning
+> exit 0 with empty stdout. `pr-impact` also introduced a correction regression by saying
+> exclusions are safe while container-wired changes are present.
+>
+> **Roadmap correction:** `B01`/`C3-122` is reopened first, followed by the shared silent-
+> composition path (`risk` and `audit-report`), `B02` plus provider non-coverage, the
+> `pr-impact` regression, `data-exposure` chain binding, Spring security activation
+> findings, then the remaining cross-command parity and cost calibration. `F02` and `F03`
+> are partial rather than complete; `F04` is an explicit opt-in product decision; `F05`
+> is locally verified but not externally covered. EclipseLink remains deferred.
+
 ---
 
 ## What ASK Engine is

{sourcecode-5.8.9 → sourcecode-5.8.11}/docs/USER_GUIDE.md

@@ -136,7 +136,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.8.9
+# ask 5.8.11
 ```
 
 Requires Python 3.9+.

{sourcecode-5.8.9 → sourcecode-5.8.11}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.8.9"
+version = "5.8.11"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.8.9 → sourcecode-5.8.11}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.8.9"
+__version__ = "5.8.11"

{sourcecode-5.8.9 → sourcecode-5.8.11}/src/sourcecode/change_plan.py

@@ -28,6 +28,7 @@ from typing import TYPE_CHECKING
 
 from sourcecode import non_coverage as _non_coverage
 from sourcecode.canonical_ir import project_blast_radius
+from sourcecode.container_wiring import detect_classes
 from sourcecode.repository_ir import _all_callers_from_rg
 from sourcecode.security_posture import _graph_nodes
 from sourcecode.path_filters import is_test_path
@@ -139,6 +140,7 @@ def build_change_plan(
         }
 
     seeds = list(blast["matched_fqns"])
+    container_wired = [w.to_dict() for w in detect_classes(cir, seeds)]
     meta = _node_meta(cir)
     affected = _dependents_closure(cir.reverse_graph or {}, seeds, max_depth, _NODE_CAP)
 
@@ -221,6 +223,7 @@ def build_change_plan(
             "count": len(prod),
             "components": prod[:_LIST_CAP],
         },
+        "container_wired": container_wired,
         "covering_tests": (
             {
                 "count": len(tests),

{sourcecode-5.8.9 → sourcecode-5.8.11}/src/sourcecode/cli.py

@@ -2112,12 +2112,14 @@ def _emit_command_output(
             raise typer.Exit(1)
     if output_path is not None:
         _receipt = _safe_write_file(output_path, content)
-        _mark_output_delivered()
         if not _receipt.get("written"):
             # B15: the answer was produced and thrown away, on request. Saying
             # "written to nul" would be the one thing worse than the error this
             # used to raise.
             typer.echo(_receipt.get("note") or f"Discarded to {output_path}")
+            # A failed write is never delivery. The guard separately exempts
+            # discard sinks and existing files by path, so no state flag is
+            # needed here.
         elif success_msg:
             # C3-26/C3-18: the payload went to the file, so stdout is free and
             # this confirmation is the run's whole answer — `cache warm` and
@@ -2126,12 +2128,14 @@ def _emit_command_output(
             # stderr battery listed its commands by hand. Measured before the
             # fix on spring-petclinic: stdout 0 bytes, stderr 155.
             typer.echo(success_msg)
+            _mark_output_delivered()
         else:
             # C3-122: a command whose emit seam carries no sentence of its own
             # confirmed a 444-second run with total silence. The receipt is a
             # notice, so a pipeline and a PowerShell capture stay exactly as
             # they were (C3-26) and a person at a terminal is told.
             _notice(f"✓ {_receipt.get('bytes', 0)} bytes written to {output_path}")
+            _mark_output_delivered()
     else:
         try:
             sys.stdout.buffer.write(content.encode("utf-8"))
@@ -2154,7 +2158,8 @@ def _emit_command_output(
             _notice("✓ copied to clipboard")
     # The answer has been handed over. Any `done (Xs)` a command deferred is now
     # a true claim and prints here — never before this line (C3-54).
-    _progress_output_emitted()
+    if _OUTPUT_DELIVERED:
+        _progress_output_emitted()
 
 
 def _emit_text_output(
@@ -6983,6 +6988,16 @@ def impact_cmd(
         cir._raw_ir, target, max_depth=depth, list_limit=0 if _to_file else None,
         root=root, covered_types=_covered_types,
     )
+    # Token ceilings and this command's byte budget are independent controls.
+    # Publish both at the point where the impact answer is shaped so raising
+    # ASK_MAX_OUTPUT_TOKENS cannot be mistaken for disabling stdout trimming.
+    result["stdout_byte_budget"] = BUDGET_IMPACT if not _to_file else None
+    result["stdout_byte_budget_basis"] = (
+        "impact stdout rendering is capped independently at 50,000 UTF-8 bytes; "
+        "ASK_MAX_OUTPUT_TOKENS does not disable this byte budget"
+        if not _to_file else
+        "No stdout byte budget applies when --output writes the complete answer."
+    )
     result = _apply_budget(result, BUDGET_IMPACT, label="impact", output_path=output_path)
     if _misread and result.get("resolution") == "not_found":
         result["analysis_warnings"] = [*(result.get("analysis_warnings") or []), _misread]

{sourcecode-5.8.9 → sourcecode-5.8.11}/src/sourcecode/compare.py

@@ -262,6 +262,7 @@ def build_comparison(
             "resolution": resolution,
             "resolved": resolved,
             "cost": cost,
+            "container_wired": plan.get("container_wired") if resolved else None,
             "why": _evidence_trail(cost, blast, resolved, plan),
         }
         # C1-13/C2-1: when the walk was capped, some magnitudes are floors. The

{sourcecode-5.8.9 → sourcecode-5.8.11}/src/sourcecode/data_exposure.py

@@ -83,6 +83,7 @@ class ExposedRoute:
     verdict: str
     access: Optional[str] = None
     access_decision: Optional[str] = None
+    chain_decision: Optional[str] = None
 
     def to_dict(self) -> dict:
         out = {
@@ -100,6 +101,8 @@ class ExposedRoute:
         if self.access is not None:
             out["access_under_profile"] = self.access
             out["access_decision"] = self.access_decision
+        if self.chain_decision is not None:
+            out["chain_decision"] = self.chain_decision
         return out
 
 
@@ -375,6 +378,10 @@ def _finish_route(
         verdict=verdict,
         access=access,
         access_decision=decision,
+        chain_decision=(
+            str(bound["chain_decision"])
+            if bound.get("chain_decision") is not None else None
+        ),
     )
 
 

{sourcecode-5.8.9 → sourcecode-5.8.11}/src/sourcecode/pr_impact.py

@@ -786,6 +786,23 @@ def _run_pr_impact_internal(
     # `ProductHandlerMapping → blCatalogService → ProductDaoImpl` chain, caught
     # structurally rather than by recognising a name.
     disposition_blockers: list[_disposition.Blocker] = []
+    changed_wired = [
+        item for item in wired
+        if set(getattr(item, "kinds", ()) or ())
+        & {"container_configuration", "interception_point"}
+    ]
+    if changed_wired:
+        _named = ", ".join(item.symbol for item in changed_wired[:3])
+        disposition_blockers.append(_disposition.Blocker(
+            reason=_disposition.REASON_CONTAINER_DISPATCH,
+            detail=(
+                f"{len(changed_wired)} changed container-wired component(s) "
+                f"({_named}{', …' if len(changed_wired) > 3 else ''}) are framework "
+                "dispatch points. Their route reach is not represented by the call "
+                "cone, so routes with no modeled path are unknown rather than "
+                "unaffected (NC-010)."
+            ),
+        ))
     wired_in_cone = detect_container_wired_classes(
         cir, sorted(cone_classes - class_fqns_set)
     )

{sourcecode-5.8.9 → sourcecode-5.8.11}/src/sourcecode/rule_catalog.py

@@ -56,6 +56,7 @@ RULES: tuple[Rule, ...] = (
     Rule("SEC-006", "SEC", "Cookie created without the Secure attribute"),
     Rule("SEC-007", "SEC", "Credential stored in a deployment descriptor"),
     Rule("SEC-008", "SEC", "SQL built by MyBatis string interpolation"),
+    Rule("SEC-009", "SEC", "Anonymous request-chain exception"),
     Rule("DEAD-001", "DEAD", "Security control present but disabled"),
     Rule("GATE-001", "GATE", "Custom AOP/security gate can be bypassed by proxy limits"),
     Rule("GATE-002", "GATE", "Custom gate advice appears to fail open"),

{sourcecode-5.8.9 → sourcecode-5.8.11}/src/sourcecode/security_config_scan.py

@@ -258,6 +258,28 @@ def _enclosing_type(source: str, offset: int, fallback: str) -> str:
 def _scan_java(source: str, rel: str) -> "list[SecurityConfigObservation]":
     out: "list[SecurityConfigObservation]" = []
 
+    # SEC-009 — an anonymous request-chain exception is a finding in its own
+    # right. Keep the matcher context requirement narrow so unrelated method
+    # names containing `permitAll()` do not become security findings.
+    permit = re.search(r"\bpermitAll\s*\(\s*\)", source)
+    if permit and re.search(
+        r"SecurityFilterChain|authorizeHttpRequests|authorizeRequests|"
+        r"requestMatchers|anyRequest",
+        source,
+    ):
+        out.append(SecurityConfigObservation(
+            rule="SEC-009",
+            file=rel,
+            line=_line_of(source, permit.start()),
+            symbol=_enclosing_type(source, permit.start(), Path(rel).stem),
+            evidence=permit.group(0),
+            detail=(
+                "The active source contains a request-chain rule that permits "
+                "anonymous access. Verify its matcher and profile condition; this "
+                "exception does not prove that the whole chain is public."
+            ),
+        ))
+
     # SEC-004 — a password stored under a fast unsalted digest.
     if any(tok in source for tok in _ENCODER_CONTEXT):
         for token in _WEAK_DIGESTS:

{sourcecode-5.8.9 → sourcecode-5.8.11}/src/sourcecode/selftest.py

@@ -144,7 +144,8 @@ def _check_ask09(subject: Subject) -> "dict[str, Any]":
         "probe_command": probe_command,
         "observed_payload_excerpt": observed_excerpt,
     }
-    body = _payload_of(payload)
+    document = payload if isinstance(payload, dict) else {}
+    body = _payload_of(document)
     if code == 0:
         return _result(
             NOT_APPLICABLE,
@@ -153,7 +154,10 @@ def _check_ask09(subject: Subject) -> "dict[str, Any]":
             "needed to exercise it here",
             **evidence,
         )
-    error = body.get("error")
+    # The output seam may wrap the command payload and keep the envelope error
+    # beside it. Read both shapes; dropping the envelope first turns a real
+    # OUTPUT_TOO_LARGE refusal into a false ERROR with code=None.
+    error = document.get("error") or body.get("error")
     error_body = error if isinstance(error, dict) else body
     if error_body.get("code") != "OUTPUT_TOO_LARGE":
         return _result(
@@ -163,7 +167,7 @@ def _check_ask09(subject: Subject) -> "dict[str, Any]":
             **evidence,
         )
     hint = str(error_body.get("hint") or "")
-    basis = body.get("hint_basis") or {}
+    basis = document.get("hint_basis") or body.get("hint_basis") or {}
     declared = list(basis.get("declared_flags") or [])
     if "No smaller inline variant is available" in hint and declared:
         return _result(

{sourcecode-5.8.9 → sourcecode-5.8.11}/src/sourcecode/spring_impact.py

@@ -1588,6 +1588,10 @@ class ImpactOrchestrator:
                 "indirect_caller_symbol_count_unit": "indirect caller list entries",
                 "caller_metric_note": CALLER_METRIC_RECONCILIATION,
                 "endpoints_total": len(endpoints_affected),
+                "security_surfaces_unit": (
+                    "endpoint rows in the impact chain; each row is one affected "
+                    "endpoint and carries its security posture verdict"
+                ),
                 "findings_in_chain": len(impact_findings),
                 "findings_status": findings_status,
                 "findings_status_note": (