sourcecode 5.9.11__tar.gz → 5.9.12__tar.gz

{sourcecode-5.9.11 → sourcecode-5.9.12}/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## [5.9.12] — 2026-08-28
+
+*Release-alignment patch release after the `AUD-617` regression battery.*
+
+**Fixed and verified**
+
+- Core answer-producing commands now fail closed with structured evidence instead
+  of silently returning success when composition fails (`AUD-617-R`).
+- Root option preprocessing preserves the value of `--max-output-tokens` in both
+  space-separated and equals forms (`AUD-617-Q`).
+- `migrate-apply` plan-only output is covered as a non-silent, non-mutating path
+  (`AUD-617-MIGRATE-APPLY`).
+
+The native Windows scale and process-cleanup findings remain open because they
+require evidence from that platform. The commercial gate and conservative scale
+positioning are unchanged.
+
 ## [5.9.11] — 2026-08-28
 
 *`AUD-616` remediation: seven of nine rows closed, two partially, one carried forward.*

{sourcecode-5.9.11 → sourcecode-5.9.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.11
+Version: 5.9.12
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.11-blue)
+![Version](https://img.shields.io/badge/version-5.9.12-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -196,7 +196,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.11 retains the shared Canonical IR
+**Current performance status.** Release 5.9.12 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. It also removes two repeated walks of the same file tree in
@@ -233,7 +233,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.11 also carries the boundary-contract hardening: missing consumer repositories,
+Release 5.9.12 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -266,7 +266,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.11 — and, on a build that has aged,
+ask version                    # ask 5.9.12 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.11 → sourcecode-5.9.12}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.11-blue)
+![Version](https://img.shields.io/badge/version-5.9.12-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -147,7 +147,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.11 retains the shared Canonical IR
+**Current performance status.** Release 5.9.12 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. It also removes two repeated walks of the same file tree in
@@ -184,7 +184,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.11 also carries the boundary-contract hardening: missing consumer repositories,
+Release 5.9.12 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -217,7 +217,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.11 — and, on a build that has aged,
+ask version                    # ask 5.9.12 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.11 → sourcecode-5.9.12}/docs/DEFECT-LEDGER.md

@@ -14,6 +14,42 @@ Status values: `open` · `in-progress` · `closed <version>` · `by-design` (wit
 The facts these rows are keyed to are published: `ask schema facts-v1` prints the registry
 (authority, definition, consumers, parity test) that the release battery enforces.
 
+## Current Synchronization — External Audit `AUD-617`
+
+**Re-audit of release `5.9.11`, received 2026-08-28.** The external battery covered only
+`Documents/workspace/testing/`, used five forks and reported a clean target tree. Its score
+fell from 8.1/10 to 6.0/10 because the release introduced a critical false-success path:
+several core commands can exit 0 without an answer. The decision is to **patch forward**, not
+roll back: 5.9.11 contains valid independent fixes and the regression is localised to a
+shared composer/error boundary. Promotion and reliability-led CI claims remain blocked until
+the critical row is independently closed.
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `AUD-617-R` | Critical maximum | **open, P0** | `risk`, `audit-report`, `verify`, `spring-audit` and intermittent `migrate-check` return exit 0 with empty stdout, stderr and output files, including `--detach`. Force logging of every caught exception at `composing risk factors`, return structured stderr and non-zero exit, and test every affected command, format, destination and detached path. |
+| `AUD-617-TUTORIALS` | Critical | **open, P1** | Native Windows/Git Bash still takes 6m20.1s on root `--compact`, exits 124 and emits nothing; `parsing manifests` is frozen for about 4.3 minutes. Profile Windows cache-key hits/syscalls, publish the size envelope and remeasure on the auditor's platform. |
+| `AUD-617-L` | Critical | **open, P1** | Markdown `audit-report` passed two Windows runs but remains historically contention-sensitive and shares the silent-failure risk. Retest deliberate contention and prove all failures emit bounded evidence. |
+| `AUD-617-Q` | Medium-high | **open, P2** | `--max-output-tokens 10` is parsed as a command; `--max-output-tokens=10` and the environment variable work. Fix the option parser and cover positions before/after the path. |
+| `AUD-617-MIGRATE-APPLY` | High | **open, P1** | `migrate-apply .` without `--write` exits 0 with no output and no file, unlike other plan-only commands. Emit an explicit plan or `nothing_to_do`; test stdout, pipes, `--output` and non-mutation. |
+| `AUD-617-WIN-PROC` | Medium | **open, platform-blocked** | One or two processes remain after successful Windows runs. Requires native Windows/Git Bash process-tree tests and must not receive a blind Darwin-only fix. |
+
+`AUD-617-P` is closed by the deterministic cache-GC fix; `KOTLIN`, `JUNIT4-SELF`, `E-PROV`
+and `INTENT-TIE-COV` are closed and independently confirmed. The report also confirms the
+previous `/dev/null`, cache, drift, impact, intent and timeout closures. Historical `L` and
+`O` must not be called genuinely fixed merely because the new silent path prevents their
+normal output or hint from being reached. Commercially, retain the conservative
+`$20-30/developer/month` working hypothesis and do not market enterprise-scale or production
+CI gating above roughly 3,000 files until `R`, the Windows scale case and `migrate-apply`
+close with cross-platform evidence.
+
+**Execution update.** `AUD-617-R` is **in progress**: the shared answer-delivery guard
+covers all five reported commands and the focused plus TeaVM normal-run matrix is green,
+but forced-exception and installed-artifact evidence remain. `AUD-617-Q` is **closed in
+the current fix** after correcting the space-form parser. `AUD-617-MIGRATE-APPLY` is
+**closed as not reproducible and test-covered**: plan mode emits a non-empty
+`migrate-apply-v1` answer and remains non-mutating. Windows and deliberate-contention rows
+remain open because they cannot be validated honestly from Darwin.
+
 ## Current Synchronization
 
 **Field simulation on TeaVM, 2026-08-27 — `ASK-FIELD`.** A deep, non-destructive

{sourcecode-5.9.11 → sourcecode-5.9.12}/docs/DEVELOPMENT-ROADMAP.md

@@ -1,5 +1,57 @@
 # ASK — Development Roadmap
 
+### External Audit Intake — `AUD-617` re-audit, release 5.9.11
+
+The 2026-08-28 external re-audit is the first report to identify a release-level
+regression in the core answer contract. It exercised only `Documents/workspace/testing/`
+and reported no target-repository mutation, commits or Java-file changes. The score fell
+from 8.1/10 for 5.9.10 to 6.0/10 for 5.9.11. The fall is justified: `risk`,
+`audit-report`, `verify`, `spring-audit` and intermittently `migrate-check` can terminate
+with exit 0 and zero bytes on stdout, stderr and `--output`.
+
+**Engineering decision: patch forward from 5.9.11; do not roll back.** The release also
+contains four independently confirmed corrections (Kotlin stack admission, JUnit4 library
+classification, output-format ordering and event-topology parity), the cache fix and useful
+phase-level observability. A rollback would restore the prior cache and classification
+defects and would not provide a safe long-term baseline. However, 5.9.11 is **blocked for
+promotion, CI-gating claims and reliability-led commercial commitments** until `AUD-617-R`
+is fixed and independently re-tested. The release branch must retain a fail-closed contract:
+an internal exception must produce structured stderr and a non-zero exit, never success with
+an empty answer.
+
+| ID | Severity | Status | Finding and required closure |
+|---|---:|---|---|
+| AUD-617-R | Critical maximum / release regression | **Open, P0** | Shared `composing risk factors` failure makes `risk`, `audit-report`, `verify`, `spring-audit` and sometimes `migrate-check` return exit 0 with no output, including `--output` and `--detach`. `risk --limit 0` and `pr-risk`, `impact`, `impact-chain`, `drift` and `remediate` remain healthy, localising the defect to the shared composer/error boundary. Instrument the exact phase, force logging of every caught exception, return a structured error and non-zero exit, and add a matrix over all affected commands, formats, output destinations and detached execution. |
+| AUD-617-TUTORIALS | Critical / platform regression | **Open, P1** | On native Windows/Git Bash, root `--compact` still takes 6m20.1s, exits 124 and emits zero bytes, with `parsing manifests` frozen for about 4.3 minutes. The 5.9.11 optimisation measured 54.9s on another platform, so it does not generalise. Profile `manifest_cache` and cache-key hit rates on Windows; publish a repository-size envelope and repeat the same test on the auditor's platform. |
+| AUD-617-L | Critical / historical regression | **Open, P1** | `audit-report --format markdown` was 2/2 successful on the auditor's Windows run, but remains non-deterministic across the historical series and shares the silent-failure risk. Keep the bounded `PhasedRun`/partial contract, then test deliberate contention and verify that all failure paths emit evidence. |
+| AUD-617-Q | Medium-high / CLI contract | **Open, P2** | `--max-output-tokens 10` fails as if `10` were a command; `--max-output-tokens=10` and the environment variable work. The defect is specific to this option. Fix the option declaration/parser and add positional tests before and after the repository path. |
+| AUD-617-MIGRATE-APPLY | High / silent-success contract | **Open, P1** | `migrate-apply .` without `--write` returns exit 0 with zero stdout/stderr and does not create a file, unlike other dry-run commands. It must emit an explicit plan or `nothing_to_do`, and return structured errors if planning fails. Add tests for stdout, pipe, `--output` and no-write non-mutation. |
+| AUD-617-WIN-PROC | Medium / platform-specific | **Open, not actionable on Darwin** | One or two processes remain after successful Windows runs, improved from six or seven but not zero. The issue requires native Windows/Git Bash process-tree tests and Job Objects or equivalent teardown; no blind platform-specific fix should ship from Darwin. |
+| AUD-617-P | Low-medium / investigation | **Closed in 5.9.11** | The serialized race did not reproduce; the deterministic cache-GC mechanism with the same symptom was fixed. Keep the concurrency test because independent processes share the repository cache. |
+| AUD-617-KOTLIN, JUNIT4-SELF, E-PROV, INTENT-TIE-COV | Medium to low | **Closed in 5.9.11** | The auditor independently confirmed Kotlin classification, JUnit4 library classification, three-command event parity and honest same-class intent ties. Preserve their dedicated regressions while fixing the shared core. |
+
+**Regression interpretation.** The 5.9.11 change is worse than the earlier visible timeout:
+exit 124 exposed an availability problem, whereas exit 0 with no bytes creates a false green
+for unattended agents and CI. `--detach` is not a mitigation because the child dies after
+the phase heartbeat without recording its exception. Historical `L` and `O` must not be
+marked genuinely fixed merely because the new failure prevents their normal output or hint
+from being reached.
+
+**Commercial decision.** Pause reliability-led sales and production CI-gating claims for
+repositories above roughly 3,000 files. Retain the conservative `$20-30/developer/month`
+working band from the audit, without presenting it as validated pricing. Normal-repository
+pilots may continue only with bounded timeouts, output capture and explicit verification of
+non-empty evidence. The gate can be lifted only after `AUD-617-R`, the Windows scale case and
+the `migrate-apply` silent-success path have independent, cross-platform evidence.
+
+**AUD-617 execution update.** `AUD-617-R` is **in progress**: the shared answer-delivery
+guard covers all five reported commands and the focused plus TeaVM normal-run matrix is
+green, but forced-exception and installed-artifact evidence remain before closure.
+`AUD-617-Q` is **closed in the current fix** after the space-form parser correction.
+`AUD-617-MIGRATE-APPLY` is **closed as not reproducible and test-covered**: plan mode emits
+a non-empty `migrate-apply-v1` answer and does not mutate the repository. The remaining
+Windows/contended P1 rows stay open because this Darwin checkout cannot validate them.
+
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 

{sourcecode-5.9.11 → sourcecode-5.9.12}/docs/EXECUTIVE-ROADMAP.md

@@ -5,7 +5,7 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
-> **CURRENT UPDATE — release `5.9.11`, following the external `5.9.3` reconciliation.**
+> **CURRENT UPDATE — release `5.9.12`, following the external `5.9.3` reconciliation.**
 > The commercial increment adds stateless context budgets, a reproducible context-cost harness,
 > source-level migration SARIF and an opt-in workspace entitlement pilot. Advisory behaviour remains
 > the default; named-buyer validation is still required before broad enforcement.
@@ -19,6 +19,26 @@
 > non-reproduction did not cover the payload shape now identified. Details are
 > in [`AUDIT-2026-08-26-EXTERNAL-5.9.0.md`](AUDIT-2026-08-26-EXTERNAL-5.9.0.md).
 
+> **CRITICAL REGRESSION — re-audit of `5.9.11`, received 2026-08-28.** The external
+> battery lowered the score to **6.0/10**: `risk`, `audit-report`, `verify`,
+> `spring-audit` and intermittently `migrate-check` can exit `0` with no stdout,
+> stderr or output file. This is more dangerous than a timeout because CI and an
+> agent can interpret false success as a valid answer. The release is therefore
+> blocked for reliability-led commitments and production CI-gating claims.
+>
+> The engineering decision is to **patch forward**, not roll back. The release
+> retains several independently confirmed fixes and the regression is localised
+> to the shared `composing risk factors`/error boundary. The immediate gate is
+> `AUD-617-R`: every caught exception must produce structured evidence and a
+> non-zero exit. Two additional blockers are the native Windows `tutorials`
+> scale regression (`6m20.1s`, exit `124`, zero bytes) and silent-success
+> `migrate-apply` without `--write`. `--max-output-tokens 10` is also open as a
+> CLI parser defect; Windows process cleanup remains unverified from Darwin.
+> Normal bounded pilots may continue, but retain the conservative `$20-30`
+> working hypothesis and do not market enterprise-scale reliability above about
+> 3,000 files. Full triage is recorded in `AUD-617` in the development roadmap
+> and defect ledger.
+
 > **REMEDIATION — `AUD-616` worked through, released as `5.9.11`.** Seven of the nine findings are
 > closed and two are partially closed. Closed: the Kotlin repository now reports Kotlin as
 > its primary stack and demotes the unsupported Java claim to low confidence; the

{sourcecode-5.9.11 → sourcecode-5.9.12}/docs/MANUAL-USUARIO.md

@@ -1,6 +1,6 @@
 # Manual de usuario — ASK Engine
 
-> Versión de la herramienta: **5.9.11**  ·  El comando que se ejecuta es `ask`.
+> Versión de la herramienta: **5.9.12**  ·  El comando que se ejecuta es `ask`.
 > (`sourcecode` sigue funcionando como alias en desactivación y reenvía a `ask`.)
 > Público: personas que van a usar `ask` por primera vez, sin conocimiento previo.
 
@@ -8,7 +8,7 @@
 
 ## 1. ¿Qué es ASK Engine?
 
-### Contratos de fiabilidad de la versión 5.9.11
+### Contratos de fiabilidad de la versión 5.9.12
 
 **Un plazo que el análisis raíz sí respeta.** `ASK_MAX_ANALYSIS_SECONDS=<segundos>`
 ahora detiene `ask <repo>` en una frontera de fase medida. Una ejecución que agota

{sourcecode-5.9.11 → sourcecode-5.9.12}/docs/PRODUCT-ROUTE.md

@@ -33,6 +33,17 @@ The public trust layer, if activated, must be a generated and redacted
 projection, never the raw defect ledger. Its acceptance rules must exclude
 maintainer paths, third-party evaluation subjects and unsupported claims.
 
+**5.9.11 commercial gate.** The 2026-08-28 re-audit found a critical regression:
+several core commands can return exit `0` with no evidence. This invalidates a
+reliability-led annual commitment and production CI-gating positioning until the
+shared error boundary is fixed and independently tested. The route therefore
+continues with bounded pilots only, retains a provisional `$20-30/developer/month`
+working hypothesis, and does not claim enterprise-scale support above roughly
+3,000 files. The correct engineering response is a forward patch, not a rollback,
+because 5.9.11 also contains valid fixes that must be preserved. See the detailed
+`AUD-617` intake in [`DEVELOPMENT-ROADMAP.md`](DEVELOPMENT-ROADMAP.md) and
+[`DEFECT-LEDGER.md`](DEFECT-LEDGER.md).
+
 ### Evidence and commercial validation boundary
 
 The 5.9.2 external review confirms that `audit-report --sign-key` and

{sourcecode-5.9.11 → sourcecode-5.9.12}/docs/USER_GUIDE.md

@@ -46,16 +46,16 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.11, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.12, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.11, with release-artifact verification
+the two pack fixes are included in release 5.9.12, with release-artifact verification
 remaining for detached execution and pack evidence.
 
-### Reliability contracts in 5.9.11
+### Reliability contracts in 5.9.12
 
 **A deadline the root analysis honours.** `ASK_MAX_ANALYSIS_SECONDS=<seconds>` now
 stops `ask <repo>` at a measured phase boundary. A run that spends its budget
@@ -260,7 +260,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.11
+# ask 5.9.12
 ```
 
 Requires Python 3.9+.

{sourcecode-5.9.11 → sourcecode-5.9.12}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.11"
+version = "5.9.12"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.11 → sourcecode-5.9.12}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.11"
+__version__ = "5.9.12"

{sourcecode-5.9.11 → sourcecode-5.9.12}/src/sourcecode/cli.py

@@ -1043,6 +1043,7 @@ _OPTIONS_WITH_VALUE: frozenset[str] = frozenset({
     "--max-nodes",
     "--docs-depth",
     "--depth",
+    "--max-output-tokens",
     "--git-depth",
     "--git-days",
     "--since", "--base",
@@ -12248,6 +12249,7 @@ def spring_audit_cmd(
 {{NON_COVERAGE}}
     Silence about those is not evidence that there is nothing to find.
 """
+    _require_answer_delivery("spring-audit")
     _apply_jobs(jobs)
     import json as _json
 
@@ -13128,6 +13130,7 @@ def verify_cmd(
       ask verify --fail-on any              # gate on every violation
       ask verify --fail-on never            # report without gating
     """
+    _require_answer_delivery("verify")
     from sourcecode import verify_repo as _vr
     from sourcecode import readonly as _readonly
 
@@ -15368,6 +15371,7 @@ def migrate_check_cmd(
       blockers; and explicit Oracle JDK/licensing-review signals. This is
       inventory evidence, not legal advice, and it never changes readiness_score.
     """
+    _require_answer_delivery("migrate-check")
     _apply_jobs(jobs)
     from sourcecode.repository_ir import find_java_files
     from sourcecode.migrate_check import run_migrate_check