sourcecode 5.9.16__tar.gz → 5.9.18__tar.gz

{sourcecode-5.9.16 → sourcecode-5.9.18}/.github/workflows/windows-battery.yml

@@ -44,3 +44,24 @@ jobs:
         env:
           SOURCECODE_CACHE_DIR: ${{ runner.temp }}/ask-cache
           SOURCECODE_CONTEXT_CACHE_DIR: ${{ runner.temp }}/ask-context-cache
+
+      - name: Record critical command reliability matrix
+        shell: pwsh
+        run: |
+          $root = Join-Path $env:RUNNER_TEMP "ask-reliability-repo"
+          $evidence = Join-Path $env:RUNNER_TEMP "ask-windows-reliability.json"
+          New-Item -ItemType Directory -Force (Join-Path $root "src/main/java/com/acme") | Out-Null
+          Set-Content -Path (Join-Path $root "pom.xml") -Value '<project><modelVersion>4.0.0</modelVersion><groupId>com.acme</groupId><artifactId>app</artifactId><version>1</version></project>'
+          Set-Content -Path (Join-Path $root "src/main/java/com/acme/App.java") -Value 'package com.acme; public class App {}'
+          git -C $root init --quiet
+          git -C $root config user.email ci@example.invalid
+          git -C $root config user.name ASK-CI
+          git -C $root add .
+          git -C $root commit --quiet -m baseline
+          python scripts/windows_reliability_matrix.py $root --output $evidence
+
+      - name: Upload Windows reliability evidence
+        uses: actions/upload-artifact@v4
+        with:
+          name: ask-windows-reliability-matrix
+          path: ${{ runner.temp }}/ask-windows-reliability.json

{sourcecode-5.9.16 → sourcecode-5.9.18}/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## [5.9.18] — 2026-08-31
+
+*Windows reliability remediation follow-up.*
+
+### Fixed
+
+- `pack gate` opens child stderr as UTF-8 with replacement behavior, so a Windows code-page mismatch cannot terminate its forwarding thread and block a child on an undrained pipe.
+- The shared parse-worker factory rejects Windows process pools as a second deterministic barrier; repository parsing uses the existing sequential path there instead of risking `DuplicateHandle` during worker startup.
+- Expected CLI validation exits, including invalid `--profile` input, now pass through the analysis-error boundary unchanged as `INVALID_INPUT` / exit 2.
+
+### Verification Boundary
+
+- Focused pack, parallel, validation and six-command reliability-matrix tests pass on the engineering host. Native Windows repetition and process-tree evidence remain required before closing `AUD-621-R` and `AUD-621-WIN-PROC`.
+- The 24,073-file context-analysis threshold remains open pending profiling and an intermediate-size benchmark.
+
+## [5.9.17] — 2026-08-31
+
+*Reliability and monorepo performance follow-up after the 5.9.16 external audit.*
+
+### Fixed
+
+- `risk`, `verify`, `audit-report` and `migrate-check` now emit structured
+  `EXECUTION_FAILED` evidence with a non-zero exit when unexpected analysis
+  failures occur; they cannot report an empty successful result through that path.
+- Semantic workspace analysis reuses the already scanned workspace tree, and
+  root graph, documentation and metrics analysis share one pruned monorepo tree.
+
+### Verification
+
+- Added a Windows reliability-matrix tool and manual workflow artifact covering
+  `risk`, `verify`, Markdown `audit-report`, `spring-audit`, `migrate-check` and
+  `migrate-apply`. It records each exit code and output size across 30 repetitions.
+- Native Windows process cleanup and the remaining contradictory reliability
+  observations remain open until that evidence is collected.
+
 ## [5.9.16] — 2026-08-31
 
 *Audit candidate following the 5.9.15 release recovery.*

{sourcecode-5.9.16 → sourcecode-5.9.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.16
+Version: 5.9.18
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.16-blue)
+![Version](https://img.shields.io/badge/version-5.9.18-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -196,13 +196,14 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.16 retains the shared Canonical IR
+**Current performance status.** Release 5.9.17 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. It also removes two repeated walks of the same file tree in
 the detection phase, measured at **1.69× on a 24,073-file monorepo** — 54.9 s to
 32.5 s cold, with a byte-identical answer. A measurement on one repository and one
-machine is not a duration promise either.
+machine is not a duration promise either. It also avoids repeated monorepo tree
+walks when optional context and semantic analysis share the same scan.
 
 The root analysis now stops at `ASK_MAX_ANALYSIS_SECONDS` instead of running past
 it: a spent budget returns a structured partial result naming the phases that
@@ -233,7 +234,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.16 also carries the boundary-contract hardening: missing consumer repositories,
+Release 5.9.17 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -266,7 +267,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.16 — and, on a build that has aged,
+ask version                    # ask 5.9.18 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.16 → sourcecode-5.9.18}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.16-blue)
+![Version](https://img.shields.io/badge/version-5.9.18-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -147,13 +147,14 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.16 retains the shared Canonical IR
+**Current performance status.** Release 5.9.17 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. It also removes two repeated walks of the same file tree in
 the detection phase, measured at **1.69× on a 24,073-file monorepo** — 54.9 s to
 32.5 s cold, with a byte-identical answer. A measurement on one repository and one
-machine is not a duration promise either.
+machine is not a duration promise either. It also avoids repeated monorepo tree
+walks when optional context and semantic analysis share the same scan.
 
 The root analysis now stops at `ASK_MAX_ANALYSIS_SECONDS` instead of running past
 it: a spent budget returns a structured partial result naming the phases that
@@ -184,7 +185,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.16 also carries the boundary-contract hardening: missing consumer repositories,
+Release 5.9.17 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -217,7 +218,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.16 — and, on a build that has aged,
+ask version                    # ask 5.9.18 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

sourcecode-5.9.18/docs/AUDIT-2026-08-31-EXTERNAL-5.9.16.md

@@ -0,0 +1,54 @@
+# External Audit — 5.9.16 Re-audit
+
+**Received:** 2026-08-31  
+**Scope:** repositories under `testing/`  
+**Evidence status:** external observations; contradictory fork results are kept
+open rather than converted into closure claims.
+
+## Summary
+
+Release `5.9.16` substantially recovers from the defective `5.9.15` artefact.
+The nine missing commands are restored: `ask --help` lists 57 top-level commands,
+`self-audit` reports 104 registered CLI commands, and independent forks invoked
+the recovered commands rather than only checking help text.
+
+The audit also re-confirms recovery of `/dev/null` error handling, the space form
+of `--max-output-tokens`, endpoint/posture validation, `risk --limit 0`, missing
+`explain` error output, and baseline attest/diff/trend behavior.
+
+This is not a full reliability clearance. Independent forks still observed silent
+failures for `risk` with a non-zero limit, `verify`, and Markdown `audit-report`.
+The measurements for `spring-audit`, `migrate-check`, and `migrate-apply` conflict
+between forks and therefore cannot close the historical shared-worker defect.
+
+## Measured Improvements
+
+| Area | External result | Status |
+|---|---|---|
+| Command surface | Nine commands restored and exercised; `self-audit` passes with 104 CLI commands. | Closed for this incident. |
+| Error handling | `/dev/null` and `--max-output-tokens 10` regressions no longer reproduced. | Closed, retain release tests. |
+| `tutorials` manifest parsing | More than four minutes became 21.5 seconds. | Confirmed improvement. |
+| `tutorials` total root analysis | Completed in 4m52.6s with JSON output. | Improved, not yet bounded at a seconds-scale target. |
+| `review-pr` | No reproduction in 38 accumulated repetitions. | Closed/no-repro, retain regression test. |
+
+## Open Risks
+
+| ID | Finding | Required closure |
+|---|---|---|
+| `AUD-620-R` | `risk` with `--limit != 0`, `verify`, and Markdown `audit-report` still silently fail in independent forks. `spring-audit`, `migrate-check`, and `migrate-apply` have conflicting results. | A controlled native Windows/pipx matrix with at least 30 repetitions per command and complete result evidence. |
+| `AUD-620-TUTORIALS` | The improved manifest stage exposed `analyzing repository context` as the new dominant delay, up to roughly 2.3 minutes without progress change. | Profile and optimize that phase; repeat whole-command timing on the same Windows corpus. |
+| `AUD-620-I` | `cold-start --compact` size is state-dependent; observed values across rounds differ. `cache warm` may return agent-view exit 143. | Publish a reproducible priming sequence and investigate agent-view warm failure separately. |
+| `AUD-620-WIN-PROC` | Two to four `ask.exe` descendants were observed after runs. | Native Windows/Git Bash process-tree tests for successful, timed-out and interrupted commands. |
+
+## Audit Procedure Requirement
+
+Before every measured command, capture the target repository's `pwd`, `git status
+--short`, and `git rev-parse HEAD`, plus the installed `ask version`. Record command,
+timeout, exit code and bytes written to stdout, stderr and any output file. This avoids
+counting an empty scratch directory as a successful run against the intended corpus.
+
+## Release Position
+
+`5.9.16` is a verified recovery of the lost command surface and several concrete
+regressions. It remains suitable for bounded use, but not for production CI-gating
+or enterprise-scale reliability claims until the open native-Windows evidence closes.

sourcecode-5.9.18/docs/AUDIT-2026-08-31-EXTERNAL-5.9.17.md

@@ -0,0 +1,42 @@
+# External Audit — 5.9.17 Re-audit
+
+**Received:** 2026-08-31  
+**Scope:** repositories under `testing/`  
+**Evidence status:** four independent Windows samples; conflicting earlier
+success samples are superseded by the multi-session result below.
+
+## Summary
+
+The command-surface recovery from `5.9.16` remains confirmed: all nine restored
+commands, Bug F, Bug Q, baseline behavior and endpoint/posture validation are
+healthy in this second independent round. The root compact command is also
+healthy when its target directory is verified before execution.
+
+The shared Windows worker defect is not closed. The report records low or zero
+success rates across all affected commands, with substantial variation between
+sessions. This makes single-session success evidence insufficient for closure.
+
+## Governing Findings
+
+| ID | Finding | Required closure |
+|---|---|---|
+| `AUD-621-R` | `risk --limit != 0` and Markdown `audit-report` were 0% successful; `verify`, `spring-audit`, `migrate-check` and `migrate-apply` were 0-27% successful across independent samples. The observed mechanism remains Windows `DuplicateHandle` failure during worker spawn. | Fail closed or fall back deterministically to sequential work; validate >=25 repetitions per command in >=2 native Windows sessions, with target identity, exit status and byte counts recorded. |
+| `AUD-621-PACK-STDERR` | `pack gate --since` can deadlock because `_forward_stderr` decodes child UTF-8 output as CP1252, raises `UnicodeDecodeError`, and stops draining stderr. | Use UTF-8 with replacement behavior, keep the forwarding loop alive after decode failures, and cover CP1252 and UTF-8 child output. |
+| `AUD-621-CONTEXT` | `analyzing repository context` completed in seconds through roughly 4,772 Java files but stopped advancing beyond 190 seconds on the 24,073-file corpus. The same phase precedes `cache warm` agent-view exit 143. | Profile the phase and add an intermediate-size fixture or subset benchmark to locate the threshold before optimizing. |
+| `AUD-621-WIN-PROC` | Four descendant `ask.exe` processes remained. | Native Windows/Git Bash process-tree tests for normal completion, timeout and interruption. |
+
+## Confirmed Improvements
+
+| Area | External result |
+|---|---|
+| Command surface | All nine commands restored in `5.9.16` remain present and functional. |
+| Manifest parsing | `tutorials` manifest parsing remained improved at 18.8 seconds. |
+| `review-pr` | No recurrence in five further runs. |
+| Kotlin detection | A second real Kotlin repository was classified correctly. |
+
+## Operating Position
+
+Use ASK in bounded, supervised workflows only. Do not represent `5.9.17` as
+reliable for production CI-gating or enterprise-scale Windows analysis until the
+worker, stderr-forwarding and process-lifecycle findings close with repeatable
+native evidence.

sourcecode-5.9.18/docs/AUDIT-2026-08-31-REMEDIATION-5.9.18.md

@@ -0,0 +1,20 @@
+# Release 5.9.18 — AUD-621 Remediation
+
+**Date:** 2026-08-31  
+**Scope:** fixes applied after the external `5.9.17` audit.
+
+## Implemented Fixes
+
+| Finding | Change | Evidence in this checkout |
+|---|---|---|
+| `AUD-621-PACK-STDERR` | Pack child stderr uses UTF-8 with replacement; the forwarding loop cannot terminate on a decode exception. | Pack progress and manifest tests pass; a regression test asserts the subprocess decoding contract. |
+| `AUD-621-R` | Windows parse-worker construction is forbidden, backing up the existing sequential fallback. | Parallel Windows-contract tests pass; the six-command reliability matrix completes on the engineering host. |
+| Validation regression found during verification | Expected `typer.Exit` validation exits bypass the analysis-failure wrapper. | `risk` and `audit-report` invalid-profile regressions pass with `INVALID_INPUT` and exit 2. |
+
+## Unchanged Closure Gates
+
+- `AUD-621-R`: at least 25 repetitions per affected command in at least two native Windows sessions.
+- `AUD-621-WIN-PROC`: native Windows/Git Bash process-tree tests for successful, timed-out and interrupted commands.
+- `AUD-621-CONTEXT`: phase profile and intermediate-size benchmark before a performance claim for the 24,073-file corpus.
+
+Release `5.9.18` is therefore suitable only for bounded, supervised use until those gates are met.

{sourcecode-5.9.16 → sourcecode-5.9.18}/docs/DEFECT-LEDGER.md

@@ -14,6 +14,69 @@ Status values: `open` · `in-progress` · `closed <version>` · `by-design` (wit
 The facts these rows are keyed to are published: `ask schema facts-v1` prints the registry
 (authority, definition, consumers, parity test) that the release battery enforces.
 
+## Current Synchronization — External Audit `AUD-621`
+
+**Release `5.9.18` remediation.** `AUD-621-PACK-STDERR` is corrected in code: the child pipe is read as UTF-8 with replacement and the forwarding loop retains a decode-failure guard. `AUD-621-R` has a second Windows barrier at process-pool construction, complementing the sequential fallback. Both findings remain open until their required native Windows evidence is recorded; `AUD-621-CONTEXT` and `AUD-621-WIN-PROC` are unchanged.
+
+**Re-audit of release `5.9.17`, received 2026-08-31.** Four independent
+Windows measurements overturn the apparent partial recovery of the shared
+worker failure: `risk` with a non-zero limit and Markdown `audit-report` had
+zero successful runs; `verify`, `spring-audit`, `migrate-check` and
+`migrate-apply` succeeded only intermittently (roughly 0-27% by command and
+session). The known `PermissionError: [WinError 5]` in `DuplicateHandle` remains
+the governing mechanism. A successful run from one session is not closure
+evidence for this race.
+
+The audit also isolates a new, high-confidence Windows defect in `pack gate`:
+the `_forward_stderr` thread decodes child output using the active codepage,
+raises `UnicodeDecodeError` on UTF-8 bytes, then stops draining the pipe. The
+child can block once that pipe fills. Two independent forks captured the same
+traceback. The full evidence is
+[`AUDIT-2026-08-31-EXTERNAL-5.9.17.md`](AUDIT-2026-08-31-EXTERNAL-5.9.17.md).
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `AUD-621-R` | Critical maximum | **open, P0** | All direct shared-worker commands remain unreliable on Windows: `risk --limit != 0` and Markdown `audit-report` were 0% successful; `verify`, `spring-audit`, `migrate-check` and plan-mode `migrate-apply` were 0-27%. Detect pool startup failure, fall back to one process or emit structured non-zero failure, and validate >=25 repetitions in >=2 native Windows sessions per command. |
+| `AUD-621-PACK-STDERR` | Critical | **open, P0** | `packs.py:_forward_stderr` uses the Windows default codepage and crashes on UTF-8 progress bytes; the unread stderr pipe then deadlocks `pack gate`. Open the child stream with UTF-8 and `errors="replace"`, keep draining on decode errors, and test CP1252 plus UTF-8 output. |
+| `AUD-621-CONTEXT` | High | **open, P1** | `analyzing repository context` is stable below about 5,000 Java files but ceases to advance on the 24,073-file corpus for more than 190 seconds. It also explains the `cache warm` agent-view exit 143. Profile this one phase and locate its threshold with 8,000-12,000-file subsets or a synthetic fixture. |
+| `AUD-621-WIN-PROC` | Medium | **open, platform-blocked** | Four `ask.exe` descendants remained after the audit run. Native Windows process-tree evidence is still required. |
+| `AUD-621-REVIEW-PR` | Medium | **closed/no-repro** | No recurrence in five further runs; retain the regression test. |
+
+The restored command surface, Bug F, Bug Q, baseline behavior and endpoint/posture
+validation are now independently stable across multiple rounds. They remain
+closed. Production CI-gating and enterprise-scale claims remain blocked by
+`AUD-621-R`, `AUD-621-PACK-STDERR` and the Windows lifecycle evidence.
+
+## Current Synchronization — External Audit `AUD-620`
+
+**Re-audit of release `5.9.16`, received 2026-08-31.** This audit confirms that
+the defective `5.9.15` command surface was restored: all nine missing commands
+are again registered and independently invoked. It also confirms the `/dev/null`,
+space-form `--max-output-tokens`, input-validation, baseline and `risk --limit 0`
+repairs. On the same Windows corpus, `tutorials` manifest parsing fell from more
+than four minutes to 21.5 seconds; total root analysis was 4m52.6s.
+
+The recovery does **not** close the shared reliability defect. Independent forks
+agree that `risk` with a non-zero limit, `verify`, and Markdown `audit-report`
+can still fail silently. Results for `spring-audit`, `migrate-check`, and
+`migrate-apply` conflict between forks, so they remain open pending a single
+controlled Windows matrix of at least 30 repetitions per command. The authoritative
+record is [`AUDIT-2026-08-31-EXTERNAL-5.9.16.md`](AUDIT-2026-08-31-EXTERNAL-5.9.16.md).
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `AUD-620-COMMAND-SURFACE` | Critical | **closed 5.9.16** | The nine commands absent from `5.9.15` are present in `ask --help`, `self-audit` reports 104 registered CLI commands, and three forks invoked them. Keep the installed-wheel command-surface gate. |
+| `AUD-620-R` | Critical maximum | **open, P0** | `risk` with `--limit != 0`, `verify`, and Markdown `audit-report` still have independently observed silent failures. `spring-audit`, `migrate-check`, and `migrate-apply` gave conflicting results. Capture target identity and run >=30 native-Windows/pipx repetitions per command, recording exit code, stdout/stderr bytes, output file and timeout. |
+| `AUD-620-TUTORIALS` | High | **partially fixed, P1** | Manifest parsing improved to 21.5s, but `analyzing repository context` now dominates and total time remains 4m52.6s. Profile that phase on the auditor platform and publish a sustained size/time envelope. |
+| `AUD-620-I` | High | **open, P1** | `cold-start --compact` remains state-dependent (3,496, 31,260, 19,781 and 15,034 bytes across rounds); `cache warm` can fail its agent view with exit 143. Define the priming sequence and investigate the agent-view failure separately. |
+| `AUD-620-WIN-PROC` | Medium | **open, platform-blocked** | Two to four `ask.exe` descendants were still observed. Establish native Windows/Git Bash process-tree evidence before shipping platform-specific teardown. |
+| `AUD-620-REVIEW-PR` | Medium | **closed/no-repro** | The historical lowercase `no_git_repo` path did not reproduce in 38 accumulated repetitions. Retain its regression test. |
+
+The release remains suitable for bounded use, but production CI-gating and
+enterprise-scale reliability claims stay blocked until `AUD-620-R`, the Windows
+process lifecycle and the remaining `tutorials` scale work close with repeatable
+native evidence.
+
 ## Current Synchronization — External Audit `AUD-619`
 
 **Re-audit of release `5.9.13`, received 2026-08-28.** The previous apparent

{sourcecode-5.9.16 → sourcecode-5.9.18}/docs/DEVELOPMENT-ROADMAP.md

@@ -1,5 +1,68 @@
 # ASK — Development Roadmap
 
+### Release 5.9.18 — `AUD-621` remediation
+
+Release `5.9.18` adds two deterministic Windows safeguards: no shared parse worker can be constructed on Windows, and pack-child stderr is decoded as UTF-8 with replacement so the forwarding pipe remains drained. It also preserves expected validation exits through the structured analysis-error boundary.
+
+These code changes do not replace the required native evidence. `AUD-621-R` and `AUD-621-WIN-PROC` remain open until the repetition matrix and process-tree cases pass on native Windows; `AUD-621-CONTEXT` remains profiling work.
+
+### External Audit Intake — `AUD-621` re-audit, release 5.9.17
+
+The 2026-08-31 re-audit corrects the optimistic interpretation of the previous
+round. Four independent Windows samples show that the shared `DuplicateHandle`
+worker-start failure is still active: `risk --limit != 0` and Markdown
+`audit-report` had no successful runs, while `verify`, `spring-audit`,
+`migrate-check` and `migrate-apply` were only intermittently successful. The
+current structured-error boundary is useful, but it does not make a failed or
+blocked worker pool reliable.
+
+**Engineering decision: fix the pool path before further feature work.** Make
+worker startup fail closed or fall back deterministically to a single process;
+instrument pool creation with process/handle context; then validate each affected
+command in at least 25 repetitions across two or more native Windows sessions.
+One clean session, however large, cannot close this defect.
+
+| ID | Priority | Next action and closure boundary |
+|---|---:|---|
+| `AUD-621-R` | P0 | Implement deterministic sequential fallback at every shared-worker entry, with bounded waits and structured failure evidence. Compare direct risk computation with `audit-report --from-risk`, then collect the multi-session Windows matrix. |
+| `AUD-621-PACK-STDERR` | P0 | Open child stderr as UTF-8 with replacement behavior and ensure `_forward_stderr` cannot die without draining the pipe. Add a CP1252/UTF-8 subprocess regression for `pack gate`. |
+| `AUD-621-CONTEXT` | P1 | Profile `analyzing repository context`; it is a threshold failure, not a uniform slowdown, and also causes the agent-view warm timeout. Add an intermediate-size fixture or subset benchmark before optimizing. |
+| `AUD-621-WIN-PROC` | P1 | Measure descendant cleanup around successful, timed-out and interrupted commands on native Windows/Git Bash. |
+
+The root compact command itself, the recovered command surface, redirection and
+validation fixes remain healthy. Commercially, limit use to bounded pilots and
+do not claim production CI gating or enterprise-scale reliability. Full evidence
+is in [`AUDIT-2026-08-31-EXTERNAL-5.9.17.md`](AUDIT-2026-08-31-EXTERNAL-5.9.17.md).
+
+### External Audit Intake — `AUD-620` re-audit, release 5.9.16
+
+The external re-audit received 2026-08-31 confirms a major recovery from the
+defective `5.9.15` artefact. The nine missing commands are restored and invoked
+in three independent forks; Bug F, Bug Q, validation and baseline regressions are
+also independently healthy. On the Windows `tutorials` corpus, manifest parsing
+improved from more than four minutes to 21.5 seconds and total root analysis
+completed in 4m52.6s.
+
+**Engineering decision: retain the recovery, but keep the reliability gate active.**
+Two independent forks still observed silent failures in `risk` with a non-zero
+limit, `verify`, and Markdown `audit-report`. Results for `spring-audit`,
+`migrate-check`, and `migrate-apply` disagree between forks, so no success sample
+closes them. The next work is a controlled native Windows matrix, not another
+uncontrolled retry: record `pwd`, target Git revision/status, installed wheel
+commit, command, timeout, exit status and output sizes for at least 30 repetitions
+per affected command.
+
+| ID | Priority | Next action and closure boundary |
+|---|---:|---|
+| `AUD-620-R` | P0 | Instrument and reproduce the silent paths for `risk`, `verify` and Markdown `audit-report`; run the controlled 30-run native Windows matrix for all six historically affected commands. A command closes only with non-empty success evidence or structured, non-zero failure evidence in every recorded run. |
+| `AUD-620-TUTORIALS` | P1 | Apply phase profiling to `analyzing repository context`, now the dominant Windows delay. Preserve the measured manifest improvement, but do not claim seconds-scale root analysis until the whole command is repeatedly bounded. |
+| `AUD-620-I` | P1 | Specify a cold-start/cache-warm priming procedure and diagnose agent-view exit 143; output size is state-dependent until then. |
+| `AUD-620-WIN-PROC` | P1 | Add native Windows/Git Bash process-tree measurements for success, timeout and interruption. Do not ship untested Job Object changes from Darwin. |
+
+The commercial position is bounded pilots only. Do not claim production CI gating
+or enterprise-scale reliability above roughly 3,000 files while these rows remain
+open. Full evidence is in [`AUDIT-2026-08-31-EXTERNAL-5.9.16.md`](AUDIT-2026-08-31-EXTERNAL-5.9.16.md).
+
 ### External Audit Intake — `AUD-619` re-audit, release 5.9.13
 
 The follow-up received 2026-08-28 materially revises the apparent closure of

{sourcecode-5.9.16 → sourcecode-5.9.18}/docs/EXECUTIVE-ROADMAP.md

@@ -5,6 +5,33 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
+> **CURRENT UPDATE — release `5.9.18`, remediation.** Windows parse workers are now forbidden at their construction point and `pack gate` drains UTF-8 child stderr safely. Expected validation exits remain typed input errors. These are code fixes, not native-Windows closure evidence: keep bounded pilots until the required repetition and process-lifecycle measurements complete.
+
+> **CURRENT UPDATE — release `5.9.17`, external re-audit.** The restored command
+> surface and prior validation fixes remain stable, but the shared Windows worker
+> failure is confirmed active, not partially closed. `risk --limit != 0` and
+> Markdown `audit-report` failed throughout the independent samples; `verify`,
+> `spring-audit`, `migrate-check` and `migrate-apply` remain highly intermittent.
+> A new `pack gate` deadlock is also traced to CP1252 decoding in its stderr
+> forwarding thread. The immediate engineering focus is deterministic worker
+> fallback, safe stderr decoding, and native Windows evidence. Keep bounded
+> pilots only; the working commercial hypothesis is `$20-28/developer/month` and
+> no production CI-gating or enterprise-scale reliability promise is authorized.
+> See [`AUDIT-2026-08-31-EXTERNAL-5.9.17.md`](AUDIT-2026-08-31-EXTERNAL-5.9.17.md).
+
+> **CURRENT UPDATE — release `5.9.16`, external re-audit.** The defective
+> `5.9.15` command surface has been recovered: all nine missing commands are
+> restored and independently invoked, and the prior `/dev/null`, option-parser,
+> validation and baseline regressions are again healthy. Windows `tutorials`
+> manifest parsing fell from more than four minutes to 21.5 seconds, although
+> root analysis still took 4m52.6s because the bottleneck moved to repository
+> context analysis. The reliability gate remains active: independent forks still
+> see silent failures in `risk` with a non-zero limit, `verify`, and Markdown
+> `audit-report`; results for `spring-audit`, `migrate-check`, and `migrate-apply`
+> conflict and are not closed. Keep bounded pilots only until a controlled native
+> Windows 30-run matrix closes the affected commands and process cleanup. The
+> authoritative evidence is in [`AUDIT-2026-08-31-EXTERNAL-5.9.16.md`](AUDIT-2026-08-31-EXTERNAL-5.9.16.md).
+
 > **CURRENT UPDATE — release `5.9.14`, following the external `5.9.3` reconciliation.**
 > The commercial increment adds stateless context budgets, a reproducible context-cost harness,
 > source-level migration SARIF and an opt-in workspace entitlement pilot. Advisory behaviour remains

{sourcecode-5.9.16 → sourcecode-5.9.18}/docs/RELEASE-VERIFICATION.md

@@ -36,6 +36,20 @@ Run every command from a clean checkout at the intended release commit.
    The worktree must be clean. Record the commit and branch in the release
    issue; do not infer either from the version string.
 
+   For every external-audit command, also record the **target** identity before
+   running it:
+
+   ```sh
+   pwd
+   git status --short
+   git rev-parse HEAD
+   ```
+
+   Save the canonical target path, Git state, installed `ask version`, command,
+   timeout, exit code and stdout/stderr/output-file byte counts with the result.
+   A run from an empty scratch directory is not evidence for the intended
+   repository and must be discarded rather than counted as a pass.
+
 2. Build a fresh, isolated artefact.
 
    ```sh

{sourcecode-5.9.16 → sourcecode-5.9.18}/docs/USER_GUIDE.md

@@ -46,16 +46,30 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.16, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.18, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.16, with release-artifact verification
+the two pack fixes are included in release 5.9.18, with release-artifact verification
 remaining for detached execution and pack evidence.
 
-### Reliability contracts in 5.9.16
+### Reliability contracts in 5.9.18
+
+**Failures must be visible.** `risk`, `verify`, `audit-report` and
+`migrate-check` turn unexpected analysis failures into structured
+`EXECUTION_FAILED` output and a non-zero exit, rather than an empty success.
+The release battery includes a repeatable six-command Windows matrix; it records
+exit codes and output sizes, but native Windows evidence remains required before
+closing platform-specific findings.
+
+**Current Windows limitation.** The `5.9.17` external audit reproduced the
+shared worker-start failure in `risk`, `verify`, `audit-report`, `spring-audit`,
+`migrate-check` and `migrate-apply`. Do not use these commands as a production
+CI gate on Windows until the native matrix closes them. `pack gate --since` now
+uses safe UTF-8 stderr forwarding, but still requires native repeat evidence. See the
+[development roadmap](DEVELOPMENT-ROADMAP.md#external-audit-intake--aud-621-re-audit-release-5917).
 
 **A deadline the root analysis honours.** `ASK_MAX_ANALYSIS_SECONDS=<seconds>` now
 stops `ask <repo>` at a measured phase boundary. A run that spends its budget
@@ -260,7 +274,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.16
+# ask 5.9.17
 ```
 
 Requires Python 3.9+.

{sourcecode-5.9.16 → sourcecode-5.9.18}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.16"
+version = "5.9.18"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

sourcecode-5.9.18/scripts/windows_reliability_matrix.py

@@ -0,0 +1,97 @@
+"""Record a repeatable Windows answer-delivery matrix for critical commands."""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+
+COMMANDS: tuple[tuple[str, tuple[str, ...], frozenset[int]], ...] = (
+    ("risk", ("risk", "--limit", "20"), frozenset({0})),
+    # A repository with no declared contracts is deliberately unverified.
+    ("verify", ("verify",), frozenset({2})),
+    ("audit-report-markdown", ("audit-report", "--format", "markdown"), frozenset({0})),
+    ("spring-audit", ("spring-audit", "--compact"), frozenset({0})),
+    ("migrate-check", ("migrate-check", "--compact"), frozenset({0})),
+    ("migrate-apply", ("migrate-apply",), frozenset({0})),
+)
+
+
+def _run(target: Path, repetitions: int, timeout: float) -> list[dict[str, object]]:
+    records: list[dict[str, object]] = []
+    for name, args, expected_codes in COMMANDS:
+        for attempt in range(1, repetitions + 1):
+            started = time.monotonic()
+            try:
+                completed = subprocess.run(
+                    [sys.executable, "-m", "sourcecode", *args, str(target)],
+                    capture_output=True,
+                    text=False,
+                    timeout=timeout,
+                    check=False,
+                )
+                record: dict[str, object] = {
+                    "command": name,
+                    "attempt": attempt,
+                    "exit_code": completed.returncode,
+                    "stdout_bytes": len(completed.stdout),
+                    "stderr_bytes": len(completed.stderr),
+                    "elapsed_seconds": round(time.monotonic() - started, 3),
+                    "timed_out": False,
+                }
+                if completed.returncode not in expected_codes:
+                    record["failure"] = f"expected exit code {sorted(expected_codes)}"
+                elif not completed.stdout:
+                    record["failure"] = "command completed without stdout evidence"
+            except subprocess.TimeoutExpired as exc:
+                record = {
+                    "command": name,
+                    "attempt": attempt,
+                    "exit_code": None,
+                    "stdout_bytes": len(exc.stdout or b""),
+                    "stderr_bytes": len(exc.stderr or b""),
+                    "elapsed_seconds": round(time.monotonic() - started, 3),
+                    "timed_out": True,
+                    "failure": f"timed out after {timeout:g}s",
+                }
+            records.append(record)
+    return records
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("target", type=Path)
+    parser.add_argument("--repetitions", type=int, default=30)
+    parser.add_argument("--timeout", type=float, default=120.0)
+    parser.add_argument("--output", type=Path, required=True)
+    args = parser.parse_args()
+    if args.repetitions < 1 or args.timeout <= 0:
+        parser.error("--repetitions and --timeout must be positive")
+
+    target = args.target.resolve()
+    payload: dict[str, object] = {
+        "schema_version": "ask-windows-reliability-matrix-v1",
+        "target": str(target),
+        "cwd": os.getcwd(),
+        "python": sys.version.split()[0],
+        "repetitions": args.repetitions,
+        "timeout_seconds": args.timeout,
+        "records": _run(target, args.repetitions, args.timeout),
+    }
+    failures = [record for record in payload["records"] if "failure" in record]
+    payload["passed"] = not failures
+    args.output.parent.mkdir(parents=True, exist_ok=True)
+    args.output.write_text(json.dumps(payload, indent=2, sort_keys=True), encoding="utf-8")
+    if failures:
+        print(f"{len(failures)} reliability-matrix run(s) failed; see {args.output}", file=sys.stderr)
+        return 1
+    print(f"{len(payload['records'])} reliability-matrix runs passed; evidence: {args.output}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{sourcecode-5.9.16 → sourcecode-5.9.18}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.16"
+__version__ = "5.9.18"