sourcecode 5.9.0__tar.gz → 5.9.1__tar.gz

{sourcecode-5.9.0 → sourcecode-5.9.1}/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## [5.9.1] — 2026-08-26
+
+*Audit correction and stress-validation patch release. The `AUD-608` fixes
+from the `5.9.0` audit are shipped and documented; command contracts now
+disclose their limits and failure boundaries.*
+
+**Fixed**
+
+- `cve` publishes that its dependency inventory comes from static manifests and
+  supported lockfiles, without implying Maven or Gradle graph resolution.
+- `pr-risk --since` reports unreadable base refs as structured execution errors
+  instead of misleading `non_coverage`.
+- `posture --diff --limit` bounds `permit_all` and effective-access evidence
+  maps while preserving unrelated `evidence` payloads.
+- Seven new command helps state their command-level analysis and memory budget
+  applicability.
+
+**Documentation and validation**
+
+- README, roadmaps and defect ledger identify `5.9.1` as the current release;
+  the `5.9.0` audit remains historical evidence.
+- Focused regression batteries pass for all four corrections. A representative
+  stress smoke test passed on seven repositories under
+  `Documents/workspace/testing` with isolated caches and clean stderr.
+
 ## [5.9.0] — 2026-08-26
 
 *The `AUD-607` external round, closed: three defects fixed and the whole feature

{sourcecode-5.9.0 → sourcecode-5.9.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.0
+Version: 5.9.1
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.0-blue)
+![Version](https://img.shields.io/badge/version-5.9.1-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -188,13 +188,13 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.0 retains the shared Canonical IR
+**Current performance status.** Release 5.9.1 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
 and bounded-output regressions for this release; use `ask cache model <repo>` and
 `--progress stderr` for supervised runs, and consult the
-[latest external audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.31.md) before
+[latest external audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.9.0.md) before
 treating a historical timing or bounded flag as a current guarantee.
 
 **What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
@@ -222,7 +222,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.0 — and, on a build that has aged,
+ask version                    # ask 5.9.1 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.0 → sourcecode-5.9.1}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.0-blue)
+![Version](https://img.shields.io/badge/version-5.9.1-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -139,13 +139,13 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.0 retains the shared Canonical IR
+**Current performance status.** Release 5.9.1 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
 and bounded-output regressions for this release; use `ask cache model <repo>` and
 `--progress stderr` for supervised runs, and consult the
-[latest external audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.8.31.md) before
+[latest external audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.9.0.md) before
 treating a historical timing or bounded flag as a current guarantee.
 
 **What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
@@ -173,7 +173,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.0 — and, on a build that has aged,
+ask version                    # ask 5.9.1 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.0 → sourcecode-5.9.1}/docs/AUDIT-2026-08-26-EXTERNAL-5.8.32.md

@@ -10,6 +10,13 @@ This note separates reproduced defects from unreproduced claims, inconclusive
 measurements and feature intake, per the ledger's maintenance rule: no row is
 closed from a report alone, and no row is dismissed from a report alone.
 
+> **Historical snapshot.** The subsequent `5.9.0` reconciliation identified an
+> effective-access payload shape not covered by this note's posture test, so
+> its `AUD-607-O01` non-reproduction is superseded by `AUD-608-O01`. Its
+> `cache warm` exit-143 observation was rejected after controlled runs found an
+> external 120-second timeout. See
+> [`AUDIT-2026-08-26-EXTERNAL-5.9.0.md`](AUDIT-2026-08-26-EXTERNAL-5.9.0.md).
+
 ## Executive Result
 
 The reverification round confirms **five findings still closed on their third or

sourcecode-5.9.1/docs/AUDIT-2026-08-26-EXTERNAL-5.9.0.md

@@ -0,0 +1,98 @@
+# External Audit - 5.9.0
+
+**Received:** 2026-08-26  
+**Audited revision:** `b4c3691c4110d863fedcd54a61a08fd2997e400c` (`5.9.0`)  
+**Method:** external findings reconciled against the released source tree
+
+## Result
+
+This is `AUD-608`. The report is not adopted verbatim: each item below records
+the result of source-level reconciliation and the action justified by it.
+
+## Confirmed defects
+
+### AUD-608-C01 - `cve` does not disclose inventory coverage
+
+**Priority:** P1  
+**Status:** closed in `fe1f624`
+
+`ask cve` builds its inventory from static dependency analysis; it does not
+resolve a Maven or Gradle dependency graph. A vulnerable transitive component
+absent from that inventory can therefore be indistinguishable from no matching
+advisory. Individual match records may contain scope, but the top-level result
+and `--help` do not disclose the inventory coverage.
+
+**Required correction:** publish inventory scope and non-coverage in output and
+help; do not imply resolved transitive coverage without an explicitly declared
+resolved-graph mode; add manifest-versus-resolved fixtures.
+
+### AUD-608-P01 - `pr-risk --since` hides an execution error as non-coverage
+
+**Priority:** P1  
+**Status:** closed in `b479465`
+
+The `--since` path uses `ContextGraph` without importing it. A broad exception
+handler turns the resulting `NameError` into `non_coverage`, then states that
+the comparison was not requested. This is an execution failure, not an
+analytical limitation.
+
+**Required correction:** construct the base context correctly; return genuine
+base-materialisation failures as structured errors; keep
+`new_endpoints_basis` consistent with invocation and result; test both a valid
+`--since` comparison and an unreadable base.
+
+### AUD-608-O01 - effective-access branches bypass `posture --diff --limit`
+
+**Priority:** P2  
+**Status:** closed in `5f8a50b`
+
+`POSTURE_BOUNDED_LISTS` omits `permit_all`, while the shared helper bounds only
+list values. Effective-access `evidence` is a dictionary and also bypasses the
+cap. This is a real output-bounding gap in a diff shape absent from the earlier
+reproduction.
+
+**Required correction:** bound `permit_all` and bounded dictionaries, or
+normalise them before the shared pass; exercise every list and map branch from
+the public CLI; verify emitted bytes and estimated size fall under `--limit`.
+
+## Carried documentation item
+
+### AUD-607-U01 - new command help does not state budget-policy applicability
+
+**Priority:** P3  
+**Status:** closed in `19811ac`
+
+The helpers for `cve`, `drift`, `intent`, `pr-risk`, `remediate`,
+`self-audit`, and `watch` expose generic ceilings but do not say whether
+analysis or memory budgets apply. Help must state the applicable policy or
+explicit non-applicability from the command registry.
+
+## Rejected or follow-up observations
+
+### AUD-607-U02 - `cache warm` exit 143
+
+**Status:** not reproduced
+
+The apparent failure was an external 120-second wrapper timeout. Controlled
+runs with sufficient time completed successfully; no cache defect is tracked.
+
+### AUD-608-C02 - UTF-8 mojibake reported for `chunk-file`
+
+**Status:** external reproduction required
+
+The released reader explicitly uses UTF-8 and serialises Unicode text; the
+reported default-encoding cause is absent from source. Retain a platform/output
+transport follow-up only until raw UTF-8 input and raw CLI output prove a
+mismatch.
+
+The cache-warm timing and compact empty-output reports are also rejected as
+timeout artefacts after the audit's later controlled measurements.
+
+## Reconciliation
+
+- The audit revision is the current release revision, so these findings apply
+  to shipped `5.9.0` code.
+- `AUD-608-O01` supersedes the earlier `AUD-607-O01` non-reproduction: the new
+  evidence identifies a previously untested effective-access payload shape.
+- Previous closures remain closed unless a new public reproduction contradicts
+  them.

{sourcecode-5.9.0 → sourcecode-5.9.1}/docs/DEFECT-LEDGER.md

@@ -16,6 +16,23 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
+**External `5.9.0` audit received, 2026-08-26 - `AUD-608`; corrections shipped in `5.9.1`.** The audited
+revision is the released `5.9.0` commit. The three confirmed corrections are
+closed: `AUD-608-C01` (P1, `cve` now declares its static inventory scope,
+`fe1f624`), `AUD-608-P01` (P1, `pr-risk --since` returns structured base-ref
+errors, `b479465`), and `AUD-608-O01` (P2, `posture --diff --limit` bounds
+`permit_all` plus effective-access evidence maps, `5f8a50b`). `AUD-607-U01`
+is also closed (`19811ac`): the seven new command helps state budget-policy
+non-applicability. `AUD-607-U02` is
+withdrawn after controlled runs showed an external 120-second timeout;
+`AUD-608-C02` (reported UTF-8 mojibake in `chunk-file`) remains a platform
+reproduction follow-up because the released reader is explicitly UTF-8.
+
+The new effective-access evidence supersedes the prior `AUD-607-O01`
+non-reproduction: that check did not exercise the payload shape now identified.
+Historical records below remain snapshots. Full evidence is in
+[`AUDIT-2026-08-26-EXTERNAL-5.9.0.md`](AUDIT-2026-08-26-EXTERNAL-5.9.0.md).
+
 **External `5.8.32` audit received, 2026-08-26 — `AUD-607`.** Two independent
 reports ([`AUDIT-2026-08-26-EXTERNAL-5.8.32.md`](AUDIT-2026-08-26-EXTERNAL-5.8.32.md)):
 a reverification round (9.7/10) and a comparison round against `5.8.31` (8/10).

{sourcecode-5.9.0 → sourcecode-5.9.1}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,7 +3,21 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT QUEUE — release `5.9.0`, following two external audits of `5.8.32`, received 2026-08-26 (`AUD-607`).**
+> **CURRENT QUEUE — release `5.9.1`; external reconciliation `AUD-608` is implemented.**
+> `AUD-608-C01` is closed in `fe1f624`: `cve` declares static
+> dependency-inventory coverage and non-coverage. `AUD-608-P01` is closed in
+> `b479465`: `pr-risk --since` constructs its base context and surfaces failures
+> as structured errors. `AUD-608-O01` is closed in `5f8a50b`: all
+> effective-access branches in `posture --diff` are bounded and covered by
+> byte-size tests. `AUD-607-U01` is closed in `19811ac`: seven command helps
+> state analysis and memory budget non-applicability. `AUD-607-U02` is closed as a
+> 120-second external timeout artefact. The reported `chunk-file` mojibake is
+> follow-up only until a raw platform reproduction proves a Unicode mismatch.
+> The earlier `AUD-607-O01` non-reproduction did not cover the newly identified
+> effective-access shape and is superseded. Full evidence is in
+> [`AUDIT-2026-08-26-EXTERNAL-5.9.0.md`](AUDIT-2026-08-26-EXTERNAL-5.9.0.md).
+
+> **Historical queue — release `5.9.0`, following two external audits of `5.8.32`, received 2026-08-26 (`AUD-607`).**
 > A reverification round (9.7/10) and a comparison round against `5.8.31` (8/10). **No regression reported by either round**;
 > six previously closed findings hold on their third or fourth consecutive re-check.
 > `AUD-607-C01` (P1, `chunk-file` chunk content did not match its own declared `start_line`/`end_line`; reproduction found

{sourcecode-5.9.0 → sourcecode-5.9.1}/docs/EXECUTIVE-ROADMAP.md

@@ -5,7 +5,18 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
-> **CURRENT STATUS — release `5.9.0`, following two external audits of `5.8.32`, 2026-08-26.** Two
+> **CURRENT UPDATE — release `5.9.1`, following the external `5.9.0` reconciliation (`AUD-608`).**
+> Three defects confirmed in the shipped release are closed: `cve` now
+> discloses its static inventory (`fe1f624`), `pr-risk --since` returns a
+> structured error for unreadable base context (`b479465`), and
+> `posture --diff --limit` bounds effective-access lists and maps (`5f8a50b`).
+> The seven new command helps now state analysis and memory budget
+> non-applicability (`19811ac`). The reported `cache warm` exit-143 was an external
+> 120-second timeout, not a product regression. The prior posture
+> non-reproduction did not cover the payload shape now identified. Details are
+> in [`AUDIT-2026-08-26-EXTERNAL-5.9.0.md`](AUDIT-2026-08-26-EXTERNAL-5.9.0.md).
+
+> **HISTORICAL STATUS — release `5.9.0`, following two external audits of `5.8.32`, 2026-08-26.** Two
 > independent rounds scored the release **9.7/10** (reverification) and **8/10** (comparison against
 > `5.8.31`). **Neither round reported a regression**, and both maintained the same commercial
 > position: buy, at `$30-50` per developer per month. Six previously reported findings are confirmed

{sourcecode-5.9.0 → sourcecode-5.9.1}/docs/USER_GUIDE.md

@@ -46,13 +46,13 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.0, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.1, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.0, with release-artifact verification
+the two pack fixes are included in release 5.9.1, with release-artifact verification
 remaining for detached execution and pack evidence.
 
 ---
@@ -206,7 +206,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.0
+# ask 5.9.1
 ```
 
 Requires Python 3.9+.

{sourcecode-5.9.0 → sourcecode-5.9.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.0"
+version = "5.9.1"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.0 → sourcecode-5.9.1}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.0"
+__version__ = "5.9.1"

{sourcecode-5.9.0 → sourcecode-5.9.1}/src/sourcecode/cli.py

@@ -826,6 +826,31 @@ from sourcecode.analysis_budget import (  # noqa: E402
 )
 
 
+def _command_budget_help(command: str) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
+    """Append the command-level budget contract derived from the shared registry."""
+    from sourcecode.analysis_budget import budget_registry_name
+
+    if budget_registry_name(command) is not None:
+        policy = (
+            "\n\b\nBudget policy: this command is registered for "
+            "`ASK_MAX_ANALYSIS_SECONDS`; its result publishes the applicable "
+            "analysis-budget and memory contract."
+        )
+    else:
+        policy = (
+            "\n\b\nBudget policy: this command does not consume "
+            "`ASK_MAX_ANALYSIS_SECONDS` and does not create a command-level "
+            "`ASK_MAX_RSS_MB` enforcement scope. A delegated analysis, if any, "
+            "publishes its own budget contract."
+        )
+
+    def decorate(command_fn: Callable[..., Any]) -> Callable[..., Any]:
+        command_fn.__doc__ = (command_fn.__doc__ or "") + policy
+        return command_fn
+
+    return decorate
+
+
 def _build_help_text(scope: "Optional[Any]" = None) -> str:
     """Build --help text dynamically based on current license state."""
     try:
@@ -14508,7 +14533,12 @@ def posture_cmd(
     # answered in — a `--diff` carries a bean list per profile set and a
     # `--diff-ref` one per ref, so the bound has to reach every depth or the
     # caller believes they bounded something they did not.
-    from sourcecode.output_bounds import POSTURE_BOUNDED_LISTS, bound_lists, resolve_limit
+    from sourcecode.output_bounds import (
+        POSTURE_BOUNDED_LISTS,
+        POSTURE_BOUNDED_MAPS,
+        bound_lists,
+        resolve_limit,
+    )
 
     _posture_limit = resolve_limit(limit, compact)
     # B-8 / AUD-592-B01. A compact answer must retain one actionable unresolved
@@ -14518,6 +14548,7 @@ def posture_cmd(
         _posture_limit = 1 if data.get("summary", {}).get("unresolved", 0) else 0
     bound_lists(
         data, POSTURE_BOUNDED_LISTS, _posture_limit,
+        map_keys=POSTURE_BOUNDED_MAPS,
         # `--compact` is a size contract for agent output. The monotone
         # optimisation may keep a list whole when its disclosure costs more
         # than that individual cut, leaving a large diff above the ceiling.
@@ -16543,6 +16574,7 @@ def _audit_population_for(root: "Path", *, progress: "Any" = None):
 # ── self-audit (what this build can say about itself, and what it cannot) ────
 
 @app.command("self-audit")
+@_command_budget_help("self-audit")
 def self_audit_cmd(
     fail_on: Optional[str] = typer.Option(
         None, "--fail-on",
@@ -16619,6 +16651,7 @@ def self_audit_cmd(
 # ── drift (what changed in the effective access, and when) ───────────────────
 
 @app.command("drift")
+@_command_budget_help("drift")
 def drift_cmd(
     path: Path = typer.Argument(Path("."), help="Repository path (default: current directory)"),
     profile: Optional[str] = typer.Option(
@@ -16759,6 +16792,7 @@ def drift_cmd(
 # ── watch (re-answer only what changed, while you are still editing) ─────────
 
 @app.command("watch")
+@_command_budget_help("watch")
 def watch_cmd(
     path: Path = typer.Argument(Path("."), help="Repository path (default: current directory)"),
     once: bool = typer.Option(
@@ -16858,6 +16892,7 @@ def watch_cmd(
 # ── pr-risk (the risk of THIS change, not the state of the repository) ───────
 
 @app.command("pr-risk")
+@_command_budget_help("pr-risk")
 def pr_risk_cmd(
     path: Path = typer.Argument(Path("."), help="Repository path (default: current directory)"),
     files: Optional[str] = typer.Option(
@@ -16901,6 +16936,7 @@ def pr_risk_cmd(
       ask pr-risk . --files changed.txt --since origin/main --fail-on block
     """
     from sourcecode.pr_risk import assess, VERDICT_BLOCK, VERDICT_REVIEW, VERDICT_UNKNOWN
+    from sourcecode.context_graph import ContextGraph
     from sourcecode.repository_ir import find_java_files
     from sourcecode.spring_model import SpringSemanticModel
 
@@ -16939,7 +16975,7 @@ def pr_risk_cmd(
         base_routes = None
         if since:
             _prog.start(f"differencing routes against {since}")
-            from sourcecode.git_checkout import materialize_ref
+            from sourcecode.git_checkout import RefError, materialize_ref
             from sourcecode.pr_risk import _routes_of
 
             try:
@@ -16947,14 +16983,24 @@ def pr_risk_cmd(
                     base_files = find_java_files(base_tree)
                     base_cir = ContextGraph.build(base_files, base_tree).cir
                     base_routes = _routes_of(base_cir)
-            except Exception as _base_exc:
-                # A base that could not be read is not a base with no routes:
-                # differencing against an empty set would report every existing
-                # endpoint as newly added by this diff.
-                base_routes = None
-                _base_error = f"{type(_base_exc).__name__}: {_base_exc}"
-            else:
-                _base_error = ""
+            except RefError as exc:
+                _emit_error_json(
+                    exc.code,
+                    exc.message,
+                    ref=since,
+                    hint="Pass a commit available in this repository; no ref is fetched or substituted.",
+                )
+                raise typer.Exit(code=1)
+            except Exception as exc:
+                _emit_error_json(
+                    EXECUTION_FAILED_CODE,
+                    f"Could not build the base route inventory for {since!r}: "
+                    f"{type(exc).__name__}: {exc}",
+                    ref=since,
+                    stage="base_route_inventory",
+                    hint="Fix the base tree or retry with a readable local ref; no comparison was produced.",
+                )
+                raise typer.Exit(code=1)
 
         _prog.start("scoring the change")
         result = assess(
@@ -16968,12 +17014,6 @@ def pr_risk_cmd(
     finally:
         _prog.stop()
 
-    if since and base_routes is None:
-        result.non_coverage.append(
-            f"the base ref `{since}` could not be read, so no route was reported "
-            f"as newly added: {_base_error}"
-        )
-
     data = result.to_dict()
     _emit_command_output(
         _serialize_dict(data, format),
@@ -16998,6 +17038,7 @@ def pr_risk_cmd(
 # ── remediate (finding → recipe → apply → verify, as one loop) ───────────────
 
 @app.command("remediate")
+@_command_budget_help("remediate")
 def remediate_cmd(
     path: Path = typer.Argument(Path("."), help="Repository path (default: current directory)"),
     write: bool = typer.Option(
@@ -17101,6 +17142,7 @@ def remediate_cmd(
 # ── intent (natural language → a typed query this CLI already answers) ───────
 
 @app.command("intent")
+@_command_budget_help("intent")
 def intent_cmd(
     question: str = typer.Argument(..., help="The question, in plain language."),
     path: Path = typer.Argument(Path("."), help="Repository path (default: current directory)"),
@@ -17179,6 +17221,7 @@ def intent_cmd(
 # ── cve (dependency advisories, gated on reachability) ───────────────────────
 
 @app.command("cve")
+@_command_budget_help("cve")
 def cve_cmd(
     path: Path = typer.Argument(Path("."), help="Repository path (default: current directory)"),
     feed: Optional[Path] = typer.Option(
@@ -17231,6 +17274,12 @@ def cve_cmd(
     Nothing here answers "not reachable": reflection, SPI loading and container
     wiring reach code no import statement names.
 
+    \b
+    Dependency coverage is the static manifest and supported-lockfile inventory.
+    This command does not execute Maven or Gradle, so a transitive dependency
+    absent from that inventory is not assessed. The JSON result publishes this
+    coverage explicitly; it never treats an unobserved coordinate as safe.
+
     \b
       ask cve . --feed ./osv-maven.json
       ask cve . --feed ./feeds/ --reachable-only --fail-on reachable

{sourcecode-5.9.0 → sourcecode-5.9.1}/src/sourcecode/cve_reachability.py

@@ -371,6 +371,29 @@ def assess(
     }
     non_coverage: list[str] = []
 
+    # DependencyAnalyzer reads manifests and the lockfiles it understands. It
+    # deliberately does not execute Maven or Gradle, so a missing record cannot
+    # mean a dependency resolver proved the coordinate absent.
+    java_records = [
+        record for record in dependencies
+        if str(getattr(record, "ecosystem", "")).lower() == "java"
+    ]
+    scopes_observed: dict[str, int] = {}
+    for record in java_records:
+        scope = str(getattr(record, "scope", None) or "unknown")
+        scopes_observed[scope] = scopes_observed.get(scope, 0) + 1
+    dependency_inventory = {
+        "basis": "static_manifests_and_supported_lockfiles",
+        "dependency_resolution": "not_performed",
+        "java_records_observed": len(java_records),
+        "scopes_observed": dict(sorted(scopes_observed.items())),
+        "non_coverage": (
+            "Maven and Gradle are not executed. Dependencies absent from the "
+            "static manifest or supported lockfile inventory, including "
+            "tool-resolved transitive dependencies, are not assessed."
+        ),
+    }
+
     if not feed.loaded:
         # A refusal, not a clean scan. The caller turns this into an exit code.
         return {
@@ -378,6 +401,7 @@ def assess(
             "schema": SCHEMA_ID,
             "status": "no_feed",
             "feed": feed.to_dict(),
+            "dependency_inventory": dependency_inventory,
             "dependencies_examined": 0,
             "matches": [],
             "counts": counts,
@@ -490,8 +514,10 @@ def assess(
         "schema": SCHEMA_ID,
         "status": "ok",
         "feed": feed.to_dict(),
+        "dependency_inventory": dependency_inventory,
         "dependencies_examined": examined,
         "matches": matches,
         "counts": counts,
-        "non_coverage": non_coverage + list(feed.limitations),
+        "non_coverage": [dependency_inventory["non_coverage"]]
+        + non_coverage + list(feed.limitations),
     }