sourcecode 5.9.0__py3-none-any.whl → 5.9.1__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.0"
+__version__ = "5.9.1"

sourcecode/_build_commit.py

@@ -1,5 +1,5 @@
 """Generated at build time by hatch_build.py. Do not edit (AUD-592-D04)."""
 
-BUILD_COMMIT = 'b4c3691c4110d863fedcd54a61a08fd2997e400c'
+BUILD_COMMIT = '48f4057a9c265d73e61f76f00b41cd011a2e0031'
 CLOSURE_PROVENANCE = {'Window': {'commit': '', 'status': 'uncited'}, '`AUD-588-F05`': {'commit': '470e4a4', 'status': 'present'}, '`AUD-590-B01` / `B-01`, `F-01`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B02` / `B-02`, `F-02`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B03` / `B-03`, `F-03`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B04` / `B-04`, `F-04`': {'commit': '', 'status': 'uncited'}, '`AUD-590-R01` / `R-01`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A01` / `A-1`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A02` / `A-2`, `A-4`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A03` / `A-3`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A05` / `A-5`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A06` / `A-6`, `A-7`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A08` / `A-8`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A09` / `A-9`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A10` / `A-10`': {'commit': '', 'status': 'uncited'}, '`AUD-592-A02` / `A-1` second half, `§12.5`': {'commit': '63f3d61', 'status': 'present'}, '`AUD-592-B01` / `B-8`': {'commit': '8329614', 'status': 'present'}, '`AUD-592-D01` / `D-1`': {'commit': '0f8e03f', 'status': 'present'}, '`AUD-592-D02` / `D-2`': {'commit': '1d3db4d', 'status': 'present'}, '`AUD-592-D03` / `D-3`': {'commit': 'f28fe40', 'status': 'present'}, '`AUD-592-R01` / `A-1`': {'commit': '216025f', 'status': 'present'}, '`AUD-592-R02` / `N-4`, reopens `AUD-513-N04`': {'commit': 'ec3050d', 'status': 'present'}, '`AUD-593-N01` / `N-01`': {'commit': 'dd6a706', 'status': 'present'}, '`AUD-593-N02` / `N-02`': {'commit': 'f539787', 'status': 'present'}, '`AUD-593-N03` / `N-03`': {'commit': '1dd0b1c', 'status': 'present'}, '`AUD-593-N05` / `N-05`': {'commit': 'aa89388', 'status': 'present'}, '`AUD-593-N06` / `N-06`': {'commit': 'aa584a6', 'status': 'present'}, '`AUD-594-N04` / `D-5`, disclosure half of `B-3`': {'commit': 'a0060b7', 'status': 'present'}, '`AUD-594-X01` / `A-1`, residual of `AUD-593-N03`': {'commit': 'dd222b9', 'status': 'present'}, '`AUD-594-X02` / `A-1` second half': {'commit': '1193937', 'status': 'present'}, '`AUD-594-X03` / `X-03`, residual of `AUD-593-N01`': {'commit': 'e89e8f0', 'status': 'present'}, '`AUD-594-X04`': {'commit': '05b8cc9', 'status': 'present'}, '`AUD-595-A02` / `N-5`, advisory half of `AUD-588-B11`': {'commit': '3e15227', 'status': 'present'}, '`AUD-595-A03` / `B-6` exit-code half': {'commit': 'ab7285f', 'status': 'present'}, '`AUD-595-A05`': {'commit': 'e0b3d10', 'status': 'present'}, '`AUD-595-A07`, narrow half of `AUD-592-A02`': {'commit': 'cc15177', 'status': 'present'}, '`AUD-595-B01` / §B': {'commit': 'b77a1ad', 'status': 'present'}, '`AUD-595-Q01`': {'commit': '91a6566', 'status': 'present'}, '`AUD-596-A01` / `ASK-DET-001`': {'commit': 'fa508b4', 'status': 'present'}, '`AUD-596-A02` / `ASK-SELF-001`': {'commit': '4dfadc8', 'status': 'present'}, '`AUD-596-A03` / `ASK-C1-001`': {'commit': 'bffa3a6', 'status': 'present'}, '`AUD-596-A04` / `ASK-UX-003` + `ASK-UX-004`': {'commit': 'f0aac3c', 'status': 'present'}, '`AUD-596-B01` / `B-01`, harder witness for `BUG-6`': {'commit': '567d09d', 'status': 'present'}, '`AUD-596-B02` / `B-02`, class residual of `R2`': {'commit': '', 'status': 'uncited'}, '`AUD-596-B03` / `B-03`': {'commit': 'a8cb814', 'status': 'present'}, '`AUD-596-B06` / `B-06`': {'commit': '8107927', 'status': 'present'}, '`AUD-596-B07` / `B-07`, class residual of `AUD-592-R02`': {'commit': 'e060485', 'status': 'present'}, '`AUD-596-B09` / `B-09`': {'commit': '5b8146c', 'status': 'present'}, '`AUD-596-B10` / `B-10`': {'commit': '5cb994d', 'status': 'present'}, '`AUD-596-B16` / `B-16`': {'commit': '1507f69', 'status': 'present'}, '`AUD-596-D01` / `B-13` + `B-14`': {'commit': '0b1bdf0', 'status': 'present'}, '`AUD-596-D02` / `B-08`, residual of `AUD-594-N04`': {'commit': 'e7f73c3', 'status': 'present'}, '`AUD-596-D03` / `ASK-AGT-001`': {'commit': '8c46967', 'status': 'present'}, '`AUD-596-D04` / `B-18`': {'commit': '040f027', 'status': 'present'}, '`AUD-596-D05` / `B-19`': {'commit': 'fd2bf68', 'status': 'present'}, '`AUD-596-D06` / `B-20`': {'commit': '784cd83', 'status': 'present'}, '`AUD-596-D07` / `B-17`, half refuted': {'commit': 'c3ff822', 'status': 'present'}, '`AUD-596-D08` / `B-22`, class residual of `AUD-591-A06`': {'commit': 'b396c6a', 'status': 'present'}, '`AUD-596-D09` / `B-23`, surviving half of `B26`': {'commit': 'fd3d63f', 'status': 'present'}, '`AUD-596-D10` / `B-29`': {'commit': '', 'status': 'uncited'}, '`AUD-596-D11` / `ASK-UX-005`': {'commit': 'f4b4f77', 'status': 'present'}, '`AUD-596-D12` — six hints that send the reader back to the error': {'commit': '498df44', 'status': 'present'}, '`AUD-596-D13` / `B-28`': {'commit': '1014c72', 'status': 'present'}, '`AUD-596-D14` / `B-15`, narrow half of `B20`': {'commit': '10f2827', 'status': 'present'}, '`AUD-596-R01` / `B-05`': {'commit': '', 'status': 'uncited'}, '`AUD-596-X01` / `ASK-GATE-001`, gating half of `B24`': {'commit': 'e59c655', 'status': 'present'}, '`AUD-596-X02` / `ASK-UX-001` + `ASK-UX-002` + `B-21`': {'commit': 'f6ebf50', 'status': 'present'}, '`AUD-597-A01` / `ASK-UX-001` + `N-01`': {'commit': 'f8cf061', 'status': 'present'}, '`AUD-597-A02` / `ASK-UX-008` + `ASK-DOC-002`': {'commit': '9d47a4c', 'status': 'present'}, '`AUD-597-A03` / `ASK-DET-001`': {'commit': '4c7622a', 'status': 'present'}, '`AUD-597-A04` / `ASK-LEDGER-001`': {'commit': '46fb870', 'status': 'present'}, '`AUD-597-D01` / `B-04`': {'commit': '1094e6a', 'status': 'present'}, '`AUD-597-D02` / `ASK-DOC-001`': {'commit': 'ecb1bb7', 'status': 'present'}, '`AUD-597-D03` / `N-06`': {'commit': '9784333', 'status': 'present'}, '`AUD-597-D04` / `N-05`': {'commit': 'e51c087', 'status': 'present'}, '`AUD-597-D05` / `N-04`, fourth appearance of `C4-27`': {'commit': '9cccc15', 'status': 'present'}, '`AUD-597-D06` / `ASK-CLI-001`': {'commit': '178aa6d', 'status': 'present'}, '`AUD-597-D07` / `N-03`': {'commit': '9245e35', 'status': 'present'}, '`AUD-597-R01` / `ASK-PERF-001`': {'commit': '6910054', 'status': 'present'}, '`AUD-597-R02` / `ASK-ENC-001`': {'commit': 'ce6dac1', 'status': 'present'}, '`AUD-597-R03` / `ASK-UX-002`': {'commit': 'c57e50b', 'status': 'present'}, '`AUD-597-X01` / `ASK-BUILD-001` + `ASK-META-001` / `B-12`': {'commit': '354338b', 'status': 'present'}, '`AUD-598-B01` / `ASK-META-001`': {'commit': 'b2f7c65', 'status': 'present'}, '`AUD-598-B02` / `ASK-UX-002`': {'commit': '56a4bf7', 'status': 'present'}, '`AUD-598-B03` / `B-11`': {'commit': 'c63cb24', 'status': 'present'}, '`AUD-598-B04` / `N-02`': {'commit': '187937f', 'status': 'present'}, '`AUD-598-R01` / `ASK-PERF-002`': {'commit': '', 'status': 'uncited'}, '`AUD-598-X01` / `N-01` + `B-13` + `B-14` + `B-29` + `N-06`': {'commit': '6f2f5a4', 'status': 'present'}, '`AUD-600-B01` / `P-01`': {'commit': '366ffed', 'status': 'present'}, '`AUD-600-B02` / `P-02` + `ASK-PACK-002`': {'commit': '2a814c3', 'status': 'present'}, '`AUD-600-B03` / `ASK-PACK-001`': {'commit': '452f2a0', 'status': 'present'}, '`AUD-600-D01`': {'commit': '1224e1b', 'status': 'present'}, '`AUD-600-D02`': {'commit': 'eab8172', 'status': 'present'}, '`AUD-600-R01` / `R-01`': {'commit': '88add64', 'status': 'present'}, '`AUD-601-B01` / `N-02`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-B02` / `ASK-PACK-004`': {'commit': '', 'status': 'uncited'}, '`AUD-601-D01` / `N-01`, `ASK-UX-001`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-D02` / `B-13`, `B-14`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-M01` / `B-26`, `B-27` retracted': {'commit': '', 'status': 'uncited'}, '`AUD-601-R01` / `R-02`': {'commit': '', 'status': 'uncited'}, '`B-3`': {'commit': '773268d', 'status': 'present'}, '`B-6`': {'commit': '17c6e06', 'status': 'present'}, '`B-8`': {'commit': '8329614', 'status': 'present'}, '`BUG-3` / `443b345`': {'commit': '', 'status': 'uncited'}, '`BUG-4a` / `AUD-588-B11` residual': {'commit': '24b4185', 'status': 'present'}, '`BUG-4b` / `AUD-588-B11` residual': {'commit': '0376350', 'status': 'present'}, '`E-39`, class residual of `AUD-593-N06`': {'commit': '25fc11f', 'status': 'present'}, '`N-5`': {'commit': 'c68083f', 'status': 'present'}, '`N-7`': {'commit': '082e9de', 'status': 'present'}, '`R-1`': {'commit': '424fb1c', 'status': 'present'}, '`R-2`': {'commit': '5158b92', 'status': 'present'}, '`R-3`': {'commit': '88aec04', 'status': 'present'}, '`R-4`': {'commit': '04fd04f', 'status': 'present'}}
 CLOSURE_COVERAGE = {'closed_rows': 113, 'present': 88, 'absent': 0, 'unresolved': 0, 'uncited': 25, 'unknown': 0}

sourcecode/_docs/DEFECT-LEDGER.md

@@ -16,6 +16,23 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
+**External `5.9.0` audit received, 2026-08-26 - `AUD-608`; corrections shipped in `5.9.1`.** The audited
+revision is the released `5.9.0` commit. The three confirmed corrections are
+closed: `AUD-608-C01` (P1, `cve` now declares its static inventory scope,
+`fe1f624`), `AUD-608-P01` (P1, `pr-risk --since` returns structured base-ref
+errors, `b479465`), and `AUD-608-O01` (P2, `posture --diff --limit` bounds
+`permit_all` plus effective-access evidence maps, `5f8a50b`). `AUD-607-U01`
+is also closed (`19811ac`): the seven new command helps state budget-policy
+non-applicability. `AUD-607-U02` is
+withdrawn after controlled runs showed an external 120-second timeout;
+`AUD-608-C02` (reported UTF-8 mojibake in `chunk-file`) remains a platform
+reproduction follow-up because the released reader is explicitly UTF-8.
+
+The new effective-access evidence supersedes the prior `AUD-607-O01`
+non-reproduction: that check did not exercise the payload shape now identified.
+Historical records below remain snapshots. Full evidence is in
+[`AUDIT-2026-08-26-EXTERNAL-5.9.0.md`](AUDIT-2026-08-26-EXTERNAL-5.9.0.md).
+
 **External `5.8.32` audit received, 2026-08-26 — `AUD-607`.** Two independent
 reports ([`AUDIT-2026-08-26-EXTERNAL-5.8.32.md`](AUDIT-2026-08-26-EXTERNAL-5.8.32.md)):
 a reverification round (9.7/10) and a comparison round against `5.8.31` (8/10).

sourcecode/_docs/USER_GUIDE.md

@@ -46,13 +46,13 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.0, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.1, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.0, with release-artifact verification
+the two pack fixes are included in release 5.9.1, with release-artifact verification
 remaining for detached execution and pack evidence.
 
 ---
@@ -206,7 +206,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.0
+# ask 5.9.1
 ```
 
 Requires Python 3.9+.

sourcecode/cli.py

@@ -826,6 +826,31 @@ from sourcecode.analysis_budget import (  # noqa: E402
 )
 
 
+def _command_budget_help(command: str) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
+    """Append the command-level budget contract derived from the shared registry."""
+    from sourcecode.analysis_budget import budget_registry_name
+
+    if budget_registry_name(command) is not None:
+        policy = (
+            "\n\b\nBudget policy: this command is registered for "
+            "`ASK_MAX_ANALYSIS_SECONDS`; its result publishes the applicable "
+            "analysis-budget and memory contract."
+        )
+    else:
+        policy = (
+            "\n\b\nBudget policy: this command does not consume "
+            "`ASK_MAX_ANALYSIS_SECONDS` and does not create a command-level "
+            "`ASK_MAX_RSS_MB` enforcement scope. A delegated analysis, if any, "
+            "publishes its own budget contract."
+        )
+
+    def decorate(command_fn: Callable[..., Any]) -> Callable[..., Any]:
+        command_fn.__doc__ = (command_fn.__doc__ or "") + policy
+        return command_fn
+
+    return decorate
+
+
 def _build_help_text(scope: "Optional[Any]" = None) -> str:
     """Build --help text dynamically based on current license state."""
     try:
@@ -14508,7 +14533,12 @@ def posture_cmd(
     # answered in — a `--diff` carries a bean list per profile set and a
     # `--diff-ref` one per ref, so the bound has to reach every depth or the
     # caller believes they bounded something they did not.
-    from sourcecode.output_bounds import POSTURE_BOUNDED_LISTS, bound_lists, resolve_limit
+    from sourcecode.output_bounds import (
+        POSTURE_BOUNDED_LISTS,
+        POSTURE_BOUNDED_MAPS,
+        bound_lists,
+        resolve_limit,
+    )
 
     _posture_limit = resolve_limit(limit, compact)
     # B-8 / AUD-592-B01. A compact answer must retain one actionable unresolved
@@ -14518,6 +14548,7 @@ def posture_cmd(
         _posture_limit = 1 if data.get("summary", {}).get("unresolved", 0) else 0
     bound_lists(
         data, POSTURE_BOUNDED_LISTS, _posture_limit,
+        map_keys=POSTURE_BOUNDED_MAPS,
         # `--compact` is a size contract for agent output. The monotone
         # optimisation may keep a list whole when its disclosure costs more
         # than that individual cut, leaving a large diff above the ceiling.
@@ -16543,6 +16574,7 @@ def _audit_population_for(root: "Path", *, progress: "Any" = None):
 # ── self-audit (what this build can say about itself, and what it cannot) ────
 
 @app.command("self-audit")
+@_command_budget_help("self-audit")
 def self_audit_cmd(
     fail_on: Optional[str] = typer.Option(
         None, "--fail-on",
@@ -16619,6 +16651,7 @@ def self_audit_cmd(
 # ── drift (what changed in the effective access, and when) ───────────────────
 
 @app.command("drift")
+@_command_budget_help("drift")
 def drift_cmd(
     path: Path = typer.Argument(Path("."), help="Repository path (default: current directory)"),
     profile: Optional[str] = typer.Option(
@@ -16759,6 +16792,7 @@ def drift_cmd(
 # ── watch (re-answer only what changed, while you are still editing) ─────────
 
 @app.command("watch")
+@_command_budget_help("watch")
 def watch_cmd(
     path: Path = typer.Argument(Path("."), help="Repository path (default: current directory)"),
     once: bool = typer.Option(
@@ -16858,6 +16892,7 @@ def watch_cmd(
 # ── pr-risk (the risk of THIS change, not the state of the repository) ───────
 
 @app.command("pr-risk")
+@_command_budget_help("pr-risk")
 def pr_risk_cmd(
     path: Path = typer.Argument(Path("."), help="Repository path (default: current directory)"),
     files: Optional[str] = typer.Option(
@@ -16901,6 +16936,7 @@ def pr_risk_cmd(
       ask pr-risk . --files changed.txt --since origin/main --fail-on block
     """
     from sourcecode.pr_risk import assess, VERDICT_BLOCK, VERDICT_REVIEW, VERDICT_UNKNOWN
+    from sourcecode.context_graph import ContextGraph
     from sourcecode.repository_ir import find_java_files
     from sourcecode.spring_model import SpringSemanticModel
 
@@ -16939,7 +16975,7 @@ def pr_risk_cmd(
         base_routes = None
         if since:
             _prog.start(f"differencing routes against {since}")
-            from sourcecode.git_checkout import materialize_ref
+            from sourcecode.git_checkout import RefError, materialize_ref
             from sourcecode.pr_risk import _routes_of
 
             try:
@@ -16947,14 +16983,24 @@ def pr_risk_cmd(
                     base_files = find_java_files(base_tree)
                     base_cir = ContextGraph.build(base_files, base_tree).cir
                     base_routes = _routes_of(base_cir)
-            except Exception as _base_exc:
-                # A base that could not be read is not a base with no routes:
-                # differencing against an empty set would report every existing
-                # endpoint as newly added by this diff.
-                base_routes = None
-                _base_error = f"{type(_base_exc).__name__}: {_base_exc}"
-            else:
-                _base_error = ""
+            except RefError as exc:
+                _emit_error_json(
+                    exc.code,
+                    exc.message,
+                    ref=since,
+                    hint="Pass a commit available in this repository; no ref is fetched or substituted.",
+                )
+                raise typer.Exit(code=1)
+            except Exception as exc:
+                _emit_error_json(
+                    EXECUTION_FAILED_CODE,
+                    f"Could not build the base route inventory for {since!r}: "
+                    f"{type(exc).__name__}: {exc}",
+                    ref=since,
+                    stage="base_route_inventory",
+                    hint="Fix the base tree or retry with a readable local ref; no comparison was produced.",
+                )
+                raise typer.Exit(code=1)
 
         _prog.start("scoring the change")
         result = assess(
@@ -16968,12 +17014,6 @@ def pr_risk_cmd(
     finally:
         _prog.stop()
 
-    if since and base_routes is None:
-        result.non_coverage.append(
-            f"the base ref `{since}` could not be read, so no route was reported "
-            f"as newly added: {_base_error}"
-        )
-
     data = result.to_dict()
     _emit_command_output(
         _serialize_dict(data, format),
@@ -16998,6 +17038,7 @@ def pr_risk_cmd(
 # ── remediate (finding → recipe → apply → verify, as one loop) ───────────────
 
 @app.command("remediate")
+@_command_budget_help("remediate")
 def remediate_cmd(
     path: Path = typer.Argument(Path("."), help="Repository path (default: current directory)"),
     write: bool = typer.Option(
@@ -17101,6 +17142,7 @@ def remediate_cmd(
 # ── intent (natural language → a typed query this CLI already answers) ───────
 
 @app.command("intent")
+@_command_budget_help("intent")
 def intent_cmd(
     question: str = typer.Argument(..., help="The question, in plain language."),
     path: Path = typer.Argument(Path("."), help="Repository path (default: current directory)"),
@@ -17179,6 +17221,7 @@ def intent_cmd(
 # ── cve (dependency advisories, gated on reachability) ───────────────────────
 
 @app.command("cve")
+@_command_budget_help("cve")
 def cve_cmd(
     path: Path = typer.Argument(Path("."), help="Repository path (default: current directory)"),
     feed: Optional[Path] = typer.Option(
@@ -17231,6 +17274,12 @@ def cve_cmd(
     Nothing here answers "not reachable": reflection, SPI loading and container
     wiring reach code no import statement names.
 
+    \b
+    Dependency coverage is the static manifest and supported-lockfile inventory.
+    This command does not execute Maven or Gradle, so a transitive dependency
+    absent from that inventory is not assessed. The JSON result publishes this
+    coverage explicitly; it never treats an unobserved coordinate as safe.
+
     \b
       ask cve . --feed ./osv-maven.json
       ask cve . --feed ./feeds/ --reachable-only --fail-on reachable

sourcecode/cve_reachability.py

@@ -371,6 +371,29 @@ def assess(
     }
     non_coverage: list[str] = []
 
+    # DependencyAnalyzer reads manifests and the lockfiles it understands. It
+    # deliberately does not execute Maven or Gradle, so a missing record cannot
+    # mean a dependency resolver proved the coordinate absent.
+    java_records = [
+        record for record in dependencies
+        if str(getattr(record, "ecosystem", "")).lower() == "java"
+    ]
+    scopes_observed: dict[str, int] = {}
+    for record in java_records:
+        scope = str(getattr(record, "scope", None) or "unknown")
+        scopes_observed[scope] = scopes_observed.get(scope, 0) + 1
+    dependency_inventory = {
+        "basis": "static_manifests_and_supported_lockfiles",
+        "dependency_resolution": "not_performed",
+        "java_records_observed": len(java_records),
+        "scopes_observed": dict(sorted(scopes_observed.items())),
+        "non_coverage": (
+            "Maven and Gradle are not executed. Dependencies absent from the "
+            "static manifest or supported lockfile inventory, including "
+            "tool-resolved transitive dependencies, are not assessed."
+        ),
+    }
+
     if not feed.loaded:
         # A refusal, not a clean scan. The caller turns this into an exit code.
         return {
@@ -378,6 +401,7 @@ def assess(
             "schema": SCHEMA_ID,
             "status": "no_feed",
             "feed": feed.to_dict(),
+            "dependency_inventory": dependency_inventory,
             "dependencies_examined": 0,
             "matches": [],
             "counts": counts,
@@ -490,8 +514,10 @@ def assess(
         "schema": SCHEMA_ID,
         "status": "ok",
         "feed": feed.to_dict(),
+        "dependency_inventory": dependency_inventory,
         "dependencies_examined": examined,
         "matches": matches,
         "counts": counts,
-        "non_coverage": non_coverage + list(feed.limitations),
+        "non_coverage": [dependency_inventory["non_coverage"]]
+        + non_coverage + list(feed.limitations),
     }

sourcecode/output_bounds.py

@@ -72,6 +72,9 @@ POSTURE_BOUNDED_LISTS: "tuple[str, ...]" = (
     # `endpoint_access.endpoints`; registering only the synthetic `changed`
     # shape left the largest nested list untouched by `--limit`.
     "endpoints",
+    # AUD-608-O01. Effective access publishes this as one endpoint id per open
+    # decision. Omitting it made `posture --diff --limit` leave a full branch.
+    "permit_all",
     # AUD-602-R02. `posture --diff` caps the per-profile bean and security
     # lists, but the actionable delta is `endpoint_access.changed`: one row per
     # request whose decision moves between the two profile sets. Omitting it
@@ -79,6 +82,11 @@ POSTURE_BOUNDED_LISTS: "tuple[str, ...]" = (
     "changed",
 )
 
+#: AUD-608-O01. `effective_access.evidence` is an endpoint-id map rather than a
+#: list. It has a separate registry because `evidence` is deliberately a common
+#: name in unrelated payloads and must not become a global truncation rule.
+POSTURE_BOUNDED_MAPS: "tuple[str, ...]" = ("evidence",)
+
 #: The same for `validation`: one row per endpoint and one per gap, both of which
 #: scale with the repository rather than with the question.
 VALIDATION_BOUNDED_LISTS: "tuple[str, ...]" = (
@@ -141,6 +149,7 @@ def bound_lists(
     keys: "Iterable[str]",
     limit: "int | None",
     *,
+    map_keys: "Iterable[str]" = (),
     monotone: bool = False,
 ) -> Any:
     """Cap every list named in *keys*, anywhere in *payload*, and declare the cut.
@@ -151,8 +160,12 @@ def bound_lists(
     level and misses one level down is worse than no flag, because the caller
     believes they bounded it.
 
-    Only *list* values are touched. `summary.unresolved` is an int under the same
-    name, and a count is not a body.
+    Named list values are touched. Named maps are touched only when their
+    parent is `effective_access`: `evidence` is a deliberately generic key in
+    other answer shapes. `summary.unresolved` is an int under the same name,
+    and a count is not a body. Maps retain their published insertion order:
+    their keys are endpoint identifiers, so sorting again here would make the
+    limit a second, inconsistent ranking policy.
 
     **A bounded payload is never larger than the unbounded one it replaces.**
     AUD-597-R03: `posture . --diff dev:prod` estimated 284 464 B and the same
@@ -182,6 +195,7 @@ def bound_lists(
     if limit is None:
         return payload
     bounded = set(keys)
+    bounded_maps = set(map_keys)
     limit = max(0, int(limit))
     #: Bytes the accepted cuts freed, net of what they had to say about
     #: themselves. The declaration below is paid for out of this and nothing
@@ -189,16 +203,25 @@ def bound_lists(
     saved = 0
     declined: "set[str]" = set()
 
-    def walk(node: Any) -> Any:
+    def walk(node: Any, parent_key: "str | None" = None) -> Any:
         nonlocal saved
         if isinstance(node, dict):
             for key in list(node):
                 value = node[key]
-                if key in bounded and isinstance(value, list):
+                is_bounded_list = key in bounded and isinstance(value, list)
+                is_bounded_map = (
+                    key in bounded_maps
+                    and parent_key == "effective_access"
+                    and isinstance(value, dict)
+                )
+                if is_bounded_list or is_bounded_map:
                     total = len(value)
                     if total <= limit:
                         continue  # nothing cut, and `declare_cap` says nothing
-                    node[key] = value[:limit]
+                    if isinstance(value, list):
+                        node[key] = value[:limit]
+                    else:
+                        node[key] = dict(list(value.items())[:limit])
                     declare_cap(node, key, total, limit)
                     if not monotone:
                         continue
@@ -206,7 +229,10 @@ def bound_lists(
                     # `[limit:]` weighed as a list is the separators the removed
                     # rows carried with them, which is what the emit actually
                     # stops writing.
-                    freed = payload_bytes(value[limit:])
+                    removed = value[limit:] if isinstance(value, list) else dict(
+                        list(value.items())[limit:]
+                    )
+                    freed = payload_bytes(removed)
                     spent = payload_bytes({cap_key: node.get(cap_key)})
                     if freed > spent:
                         saved += freed - spent
@@ -215,10 +241,10 @@ def bound_lists(
                     node.pop(cap_key, None)
                     declined.add(key)
                 else:
-                    walk(value)
+                    walk(value, key)
         elif isinstance(node, list):
             for item in node:
-                walk(item)
+                walk(item, parent_key)
         return node
 
     result = walk(payload)

{sourcecode-5.9.0.dist-info → sourcecode-5.9.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.0
+Version: 5.9.1
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.0-blue)
+![Version](https://img.shields.io/badge/version-5.9.1-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -188,13 +188,13 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.0 retains the shared Canonical IR
+**Current performance status.** Release 5.9.1 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
 and bounded-output regressions for this release; use `ask cache model <repo>` and
 `--progress stderr` for supervised runs, and consult the
-[latest external audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.31.md) before
+[latest external audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.9.0.md) before
 treating a historical timing or bounded flag as a current guarantee.
 
 **What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
@@ -222,7 +222,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.0 — and, on a build that has aged,
+ask version                    # ask 5.9.1 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.0.dist-info → sourcecode-5.9.1.dist-info}/RECORD

@@ -1,6 +1,6 @@
-sourcecode/__init__.py,sha256=GBTy1dCabhQynn4AwYQJl5tRJ69byD9x_aAV5seQMsE,308
+sourcecode/__init__.py,sha256=_2HX1Q37i7qsrKVEti8GzYH5VTQN_ceb00JMLUsgPq0,308
 sourcecode/__main__.py,sha256=qDFVkobwsdZrX0B3stiRqsUNivVpybKO-egzAwCW4xw,165
-sourcecode/_build_commit.py,sha256=8-nD4m0EtLUBgon25gM8ZcMeUyffZGEm7sRdXtNNMfo,8740
+sourcecode/_build_commit.py,sha256=fE28IwhQeKoWSX5Qk5TSlP6pkTSAKn0o7s1E1NiL5N0,8740
 sourcecode/access_drift.py,sha256=1R7_fiAPvKNOnxc9uxkH3JH-k8MiAuyE7FwWUX1r4Fg,8995
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/analysis_budget.py,sha256=ZuNEboPF8A6GK-_V7WNt92ezgriga7_Rbr-vvSN4UEE,4183
@@ -33,7 +33,7 @@ sourcecode/change_plan.py,sha256=drAoDsqFplutCLc6Y0xue7sYkTls0SpYh7aOXvttv3I,129
 sourcecode/ci_output.py,sha256=X4NRokWWMRF9Ex8OQrEO2g04GzJ00GDP5zYIoqI9YCc,4625
 sourcecode/cir_graphs.py,sha256=RytqSv1WF8kdlfXj2fPQz16LY4akS2kyThbdWL8beCQ,14835
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=v3tXTToKjIi6iVphkD34fMbFqLtU1J5PdoNYQu8Z6fU,916592
+sourcecode/cli.py,sha256=kdXkygV9OTy5lAHLx730GkUuAzYvYfMZxeqmbd6Q0iI,918522
 sourcecode/client_calls.py,sha256=YOPnfRZzRyqmdHvXSVeiunW8cuiuCuWXacNIQRgKMCw,22640
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=Lnfmm9I3k0H1jP1tV6ZJ-R7znjQPLPLCe5TzV1Jb_PM,15323
@@ -51,7 +51,7 @@ sourcecode/contract_model.py,sha256=nRxJKPMs1VHwFTa8AVXhGmaLjti3Lr2sjHDpWgv1bfE,
 sourcecode/contract_pipeline.py,sha256=4XE-xhab7ysdExXyUOBl2hAH4MABo7moKnT9V4XcEwQ,30243
 sourcecode/coverage_parser.py,sha256=X9scuUWxacahYTrTBGea2Ku-sf-WCVcnc9OEB35_3IU,19340
 sourcecode/cve_feed.py,sha256=t93Ofu0uxB3zyI8W9nUKmH4Ljbt4qZpGIg68IP_aTrY,10749
-sourcecode/cve_reachability.py,sha256=omXEuCeW3DmjOf6KEnsXFDF2c_9-HIYmAt6Q09YHiow,19160
+sourcecode/cve_reachability.py,sha256=aEHkG3IaeLxgekK79cz07QTcv9LZHEqEYqyLGjwjzSE,20409
 sourcecode/data_exposure.py,sha256=73EcuHsN3ESKdSvSj1B2FzD1myGJqzlNJpYO1NpI5WM,19963
 sourcecode/data_labels.py,sha256=9v0JaICRH7jIZ015T1_DuT5E0MFfeL-Wcq1WOPE0Fe0,10965
 sourcecode/declarations.py,sha256=Jr7oJDg004sFw0TvJySNVggXFT2jB6hQgbeQK2qreVo,7000
@@ -104,7 +104,7 @@ sourcecode/migration_blast.py,sha256=OPryWkM6-PbvcG3eJFdcWUnlpXBje41nu2BkrZnE2hg
 sourcecode/non_coverage.py,sha256=Tl04OemPnxnOuWISMF6gAhDYx-P0LP6_l-PbpyvBJb4,30634
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
 sourcecode/openrewrite_recipe.py,sha256=0pS-61falE6rSfkos2MPnmoDamvoeTT-8Kmj7smj_DI,12987
-sourcecode/output_bounds.py,sha256=909Wu4qlLqHGa4fgQAsDhSBBi0lL8MQnrXv0gxZM2u8,14051
+sourcecode/output_bounds.py,sha256=BvaRQY5nuytgfNUJHyO7JDLOHuSy0vdjqasISxmxLxI,15516
 sourcecode/output_budget.py,sha256=AHwxnfToUk9a3MJdcq0WDUiFbyNla9VWxdE0pC7UWfY,15617
 sourcecode/output_ceiling.py,sha256=rMLDHbXeC6C_uP8iQSVbbCGiJ_n0gMr2YI9zt5nltFA,33201
 sourcecode/output_encoding.py,sha256=OxiZQtr7uWBDUtblNQviNHsTH1Xo9AZEpsegPlQWKFk,2139
@@ -268,13 +268,13 @@ sourcecode/telemetry/consent.py,sha256=-Wb8BFGXEexOs8M0Eja7F-T6ZtLNPeRoZnHcHvlP7
 sourcecode/telemetry/events.py,sha256=l3Z2SQUO4_C2D2ItXOOdVNimAmHedUHnUxqYFTxnsAE,2900
 sourcecode/telemetry/filters.py,sha256=-lqT2oorECuqEIdeHb--7AZ6BCaUx0bya720a-Z5x6w,7335
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode/_docs/DEFECT-LEDGER.md,sha256=UYvIdd7Guh5gebKhfV1q-jseaA4uN-dEX5USa-LHh_Y,1114060
+sourcecode/_docs/DEFECT-LEDGER.md,sha256=EkYSJieDrazfADCZ8tsCsybyW9U0nAzWDQ8rS4KmGTU,1115164
 sourcecode/_docs/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
 sourcecode/_docs/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode/_docs/USER_GUIDE.md,sha256=Zs2_T4Lw6_lK0JBPqwaTxyVLuOCrGe6PP3cxH_-t4Rs,99674
-sourcecode-5.9.0.dist-info/METADATA,sha256=UvX-x8HWbWZA_8Q7A89UA6lemfGIr1gqslK8ch1vYFc,63168
-sourcecode-5.9.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-5.9.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-5.9.0.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
-sourcecode-5.9.0.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode-5.9.0.dist-info/RECORD,,
+sourcecode/_docs/USER_GUIDE.md,sha256=VtJs2r3hnqZ93vLpP92tFKgoPZ2VScoiBse1y01a0s4,99674
+sourcecode-5.9.1.dist-info/METADATA,sha256=0K__BP-Li6SKHaPzMyNvNbz3EuqckTJsNp6R7j-xMUo,63167
+sourcecode-5.9.1.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-5.9.1.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-5.9.1.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
+sourcecode-5.9.1.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
+sourcecode-5.9.1.dist-info/RECORD,,