sourcecode 5.9.18__py3-none-any.whl → 5.9.22__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.18"
+__version__ = "5.9.22"

sourcecode/_build_commit.py

@@ -1,5 +1,5 @@
 """Generated at build time by hatch_build.py. Do not edit (AUD-592-D04)."""
 
-BUILD_COMMIT = 'e60fde756124d84699d9c2112b653f3e832e3717'
+BUILD_COMMIT = '64c8b3e429eadd7a12d34eb1e5eefa0c08e430e4'
 CLOSURE_PROVENANCE = {'AUD-611-B05': {'commit': '', 'status': 'uncited'}, 'AUD-611-B06': {'commit': '', 'status': 'uncited'}, 'AUD-611-B07': {'commit': '', 'status': 'uncited'}, 'AUD-611-B08': {'commit': '', 'status': 'uncited'}, 'AUD-611-B09': {'commit': '', 'status': 'uncited'}, 'AUD-611-B10': {'commit': '', 'status': 'uncited'}, 'AUD-611-B11': {'commit': '', 'status': 'uncited'}, 'AUD-612-07': {'commit': '', 'status': 'uncited'}, 'AUD-612-09': {'commit': '', 'status': 'uncited'}, 'AUD-612-14': {'commit': '', 'status': 'uncited'}, 'AUD-612-B03': {'commit': '', 'status': 'uncited'}, 'AUD-612-B07': {'commit': '', 'status': 'uncited'}, 'AUD-612-B13': {'commit': '', 'status': 'uncited'}, 'AUD-612-E': {'commit': '', 'status': 'uncited'}, 'AUD-612-G': {'commit': '', 'status': 'uncited'}, 'AUD-612-I': {'commit': '', 'status': 'uncited'}, 'AUD-612-K': {'commit': '', 'status': 'uncited'}, 'AUD-612-M': {'commit': '', 'status': 'uncited'}, 'AUD-612-R': {'commit': '', 'status': 'uncited'}, 'AUD-613-ROOT': {'commit': '', 'status': 'uncited'}, 'AUD-614-07': {'commit': '', 'status': 'uncited'}, 'AUD-614-E': {'commit': '', 'status': 'uncited'}, 'AUD-614-F': {'commit': '', 'status': 'uncited'}, 'AUD-614-G': {'commit': '', 'status': 'uncited'}, 'AUD-614-I': {'commit': '', 'status': 'uncited'}, 'AUD-614-INTENT-TIE': {'commit': '', 'status': 'uncited'}, 'AUD-614-JUNIT4': {'commit': '', 'status': 'uncited'}, 'AUD-614-RISK-L0': {'commit': '', 'status': 'uncited'}, 'AUD-614-SELFTEST-TIMEOUT': {'commit': '', 'status': 'uncited'}, 'AUD-615-07': {'commit': '', 'status': 'uncited'}, 'AUD-615-COLD-COMPACT': {'commit': '', 'status': 'uncited'}, 'AUD-615-DRIFT': {'commit': '', 'status': 'uncited'}, 'AUD-615-E': {'commit': '', 'status': 'uncited'}, 'AUD-615-F': {'commit': '', 'status': 'uncited'}, 'AUD-615-INTENT-TIE': {'commit': '', 'status': 'uncited'}, 'AUD-615-JUNIT4': {'commit': '', 'status': 'uncited'}, 'AUD-615-RISK-L0': {'commit': '', 'status': 'uncited'}, 'AUD-615-SELFTEST-TIMEOUT': {'commit': '', 'status': 'uncited'}, 'AUD-616-E-PROV': {'commit': '', 'status': 'uncited'}, 'AUD-616-F, -RISK-L0, -SELFTEST-TIMEOUT, -INTENT-TIE, -DRIFT, -COLD-COMPACT, -E, -07': {'commit': '', 'status': 'uncited'}, 'AUD-616-INTENT-TIE-COV': {'commit': '', 'status': 'uncited'}, 'AUD-616-JUNIT4-SELF': {'commit': '', 'status': 'uncited'}, 'AUD-616-KOTLIN': {'commit': '', 'status': 'uncited'}, 'AUD-616-O': {'commit': '', 'status': 'uncited'}, 'AUD-616-P': {'commit': '', 'status': 'uncited'}, 'Window': {'commit': '', 'status': 'uncited'}, '`ASK-FIELD-01`': {'commit': '829f9fa', 'status': 'present'}, '`ASK-FIELD-02`': {'commit': '6a659fa', 'status': 'present'}, '`ASK-FIELD-03`': {'commit': '55b0d51', 'status': 'present'}, '`AUD-588-F05`': {'commit': '470e4a4', 'status': 'present'}, '`AUD-590-B01` / `B-01`, `F-01`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B02` / `B-02`, `F-02`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B03` / `B-03`, `F-03`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B04` / `B-04`, `F-04`': {'commit': '', 'status': 'uncited'}, '`AUD-590-R01` / `R-01`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A01` / `A-1`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A02` / `A-2`, `A-4`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A03` / `A-3`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A05` / `A-5`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A06` / `A-6`, `A-7`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A08` / `A-8`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A09` / `A-9`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A10` / `A-10`': {'commit': '', 'status': 'uncited'}, '`AUD-592-A02` / `A-1` second half, `§12.5`': {'commit': '63f3d61', 'status': 'present'}, '`AUD-592-B01` / `B-8`': {'commit': '8329614', 'status': 'present'}, '`AUD-592-D01` / `D-1`': {'commit': '0f8e03f', 'status': 'present'}, '`AUD-592-D02` / `D-2`': {'commit': '1d3db4d', 'status': 'present'}, '`AUD-592-D03` / `D-3`': {'commit': 'f28fe40', 'status': 'present'}, '`AUD-592-R01` / `A-1`': {'commit': '216025f', 'status': 'present'}, '`AUD-592-R02` / `N-4`, reopens `AUD-513-N04`': {'commit': 'ec3050d', 'status': 'present'}, '`AUD-593-N01` / `N-01`': {'commit': 'dd6a706', 'status': 'present'}, '`AUD-593-N02` / `N-02`': {'commit': 'f539787', 'status': 'present'}, '`AUD-593-N03` / `N-03`': {'commit': '1dd0b1c', 'status': 'present'}, '`AUD-593-N05` / `N-05`': {'commit': 'aa89388', 'status': 'present'}, '`AUD-593-N06` / `N-06`': {'commit': 'aa584a6', 'status': 'present'}, '`AUD-594-N04` / `D-5`, disclosure half of `B-3`': {'commit': 'a0060b7', 'status': 'present'}, '`AUD-594-X01` / `A-1`, residual of `AUD-593-N03`': {'commit': 'dd222b9', 'status': 'present'}, '`AUD-594-X02` / `A-1` second half': {'commit': '1193937', 'status': 'present'}, '`AUD-594-X03` / `X-03`, residual of `AUD-593-N01`': {'commit': 'e89e8f0', 'status': 'present'}, '`AUD-594-X04`': {'commit': '05b8cc9', 'status': 'present'}, '`AUD-595-A02` / `N-5`, advisory half of `AUD-588-B11`': {'commit': '3e15227', 'status': 'present'}, '`AUD-595-A03` / `B-6` exit-code half': {'commit': 'ab7285f', 'status': 'present'}, '`AUD-595-A05`': {'commit': 'e0b3d10', 'status': 'present'}, '`AUD-595-A07`, narrow half of `AUD-592-A02`': {'commit': 'cc15177', 'status': 'present'}, '`AUD-595-B01` / §B': {'commit': 'b77a1ad', 'status': 'present'}, '`AUD-595-Q01`': {'commit': '91a6566', 'status': 'present'}, '`AUD-596-A01` / `ASK-DET-001`': {'commit': 'fa508b4', 'status': 'present'}, '`AUD-596-A02` / `ASK-SELF-001`': {'commit': '4dfadc8', 'status': 'present'}, '`AUD-596-A03` / `ASK-C1-001`': {'commit': 'bffa3a6', 'status': 'present'}, '`AUD-596-A04` / `ASK-UX-003` + `ASK-UX-004`': {'commit': 'f0aac3c', 'status': 'present'}, '`AUD-596-B01` / `B-01`, harder witness for `BUG-6`': {'commit': '567d09d', 'status': 'present'}, '`AUD-596-B02` / `B-02`, class residual of `R2`': {'commit': '', 'status': 'uncited'}, '`AUD-596-B03` / `B-03`': {'commit': 'a8cb814', 'status': 'present'}, '`AUD-596-B06` / `B-06`': {'commit': '8107927', 'status': 'present'}, '`AUD-596-B07` / `B-07`, class residual of `AUD-592-R02`': {'commit': 'e060485', 'status': 'present'}, '`AUD-596-B09` / `B-09`': {'commit': '5b8146c', 'status': 'present'}, '`AUD-596-B10` / `B-10`': {'commit': '5cb994d', 'status': 'present'}, '`AUD-596-B16` / `B-16`': {'commit': '1507f69', 'status': 'present'}, '`AUD-596-D01` / `B-13` + `B-14`': {'commit': '0b1bdf0', 'status': 'present'}, '`AUD-596-D02` / `B-08`, residual of `AUD-594-N04`': {'commit': 'e7f73c3', 'status': 'present'}, '`AUD-596-D03` / `ASK-AGT-001`': {'commit': '8c46967', 'status': 'present'}, '`AUD-596-D04` / `B-18`': {'commit': '040f027', 'status': 'present'}, '`AUD-596-D05` / `B-19`': {'commit': 'fd2bf68', 'status': 'present'}, '`AUD-596-D06` / `B-20`': {'commit': '784cd83', 'status': 'present'}, '`AUD-596-D07` / `B-17`, half refuted': {'commit': 'c3ff822', 'status': 'present'}, '`AUD-596-D08` / `B-22`, class residual of `AUD-591-A06`': {'commit': 'b396c6a', 'status': 'present'}, '`AUD-596-D09` / `B-23`, surviving half of `B26`': {'commit': 'fd3d63f', 'status': 'present'}, '`AUD-596-D10` / `B-29`': {'commit': '', 'status': 'uncited'}, '`AUD-596-D11` / `ASK-UX-005`': {'commit': 'f4b4f77', 'status': 'present'}, '`AUD-596-D12` — six hints that send the reader back to the error': {'commit': '498df44', 'status': 'present'}, '`AUD-596-D13` / `B-28`': {'commit': '1014c72', 'status': 'present'}, '`AUD-596-D14` / `B-15`, narrow half of `B20`': {'commit': '10f2827', 'status': 'present'}, '`AUD-596-R01` / `B-05`': {'commit': '', 'status': 'uncited'}, '`AUD-596-X01` / `ASK-GATE-001`, gating half of `B24`': {'commit': 'e59c655', 'status': 'present'}, '`AUD-596-X02` / `ASK-UX-001` + `ASK-UX-002` + `B-21`': {'commit': 'f6ebf50', 'status': 'present'}, '`AUD-597-A01` / `ASK-UX-001` + `N-01`': {'commit': 'f8cf061', 'status': 'present'}, '`AUD-597-A02` / `ASK-UX-008` + `ASK-DOC-002`': {'commit': '9d47a4c', 'status': 'present'}, '`AUD-597-A03` / `ASK-DET-001`': {'commit': '4c7622a', 'status': 'present'}, '`AUD-597-A04` / `ASK-LEDGER-001`': {'commit': '46fb870', 'status': 'present'}, '`AUD-597-D01` / `B-04`': {'commit': '1094e6a', 'status': 'present'}, '`AUD-597-D02` / `ASK-DOC-001`': {'commit': 'ecb1bb7', 'status': 'present'}, '`AUD-597-D03` / `N-06`': {'commit': '9784333', 'status': 'present'}, '`AUD-597-D04` / `N-05`': {'commit': 'e51c087', 'status': 'present'}, '`AUD-597-D05` / `N-04`, fourth appearance of `C4-27`': {'commit': '9cccc15', 'status': 'present'}, '`AUD-597-D06` / `ASK-CLI-001`': {'commit': '178aa6d', 'status': 'present'}, '`AUD-597-D07` / `N-03`': {'commit': '9245e35', 'status': 'present'}, '`AUD-597-R01` / `ASK-PERF-001`': {'commit': '6910054', 'status': 'present'}, '`AUD-597-R02` / `ASK-ENC-001`': {'commit': 'ce6dac1', 'status': 'present'}, '`AUD-597-R03` / `ASK-UX-002`': {'commit': 'c57e50b', 'status': 'present'}, '`AUD-597-X01` / `ASK-BUILD-001` + `ASK-META-001` / `B-12`': {'commit': '354338b', 'status': 'present'}, '`AUD-598-B01` / `ASK-META-001`': {'commit': 'b2f7c65', 'status': 'present'}, '`AUD-598-B02` / `ASK-UX-002`': {'commit': '56a4bf7', 'status': 'present'}, '`AUD-598-B03` / `B-11`': {'commit': 'c63cb24', 'status': 'present'}, '`AUD-598-B04` / `N-02`': {'commit': '187937f', 'status': 'present'}, '`AUD-598-R01` / `ASK-PERF-002`': {'commit': '', 'status': 'uncited'}, '`AUD-598-X01` / `N-01` + `B-13` + `B-14` + `B-29` + `N-06`': {'commit': '6f2f5a4', 'status': 'present'}, '`AUD-600-B01` / `P-01`': {'commit': '366ffed', 'status': 'present'}, '`AUD-600-B02` / `P-02` + `ASK-PACK-002`': {'commit': '2a814c3', 'status': 'present'}, '`AUD-600-B03` / `ASK-PACK-001`': {'commit': '452f2a0', 'status': 'present'}, '`AUD-600-D01`': {'commit': '1224e1b', 'status': 'present'}, '`AUD-600-D02`': {'commit': 'eab8172', 'status': 'present'}, '`AUD-600-R01` / `R-01`': {'commit': '88add64', 'status': 'present'}, '`AUD-601-B01` / `N-02`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-B02` / `ASK-PACK-004`': {'commit': '', 'status': 'uncited'}, '`AUD-601-D01` / `N-01`, `ASK-UX-001`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-D02` / `B-13`, `B-14`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-M01` / `B-26`, `B-27` retracted': {'commit': '', 'status': 'uncited'}, '`AUD-601-R01` / `R-02`': {'commit': '', 'status': 'uncited'}, '`AUD-619-WATCH`': {'commit': '', 'status': 'uncited'}, '`AUD-620-COMMAND-SURFACE`': {'commit': '', 'status': 'uncited'}, '`AUD-620-REVIEW-PR`': {'commit': '', 'status': 'uncited'}, '`AUD-621-REVIEW-PR`': {'commit': '', 'status': 'uncited'}, '`B-3`': {'commit': '773268d', 'status': 'present'}, '`B-6`': {'commit': '17c6e06', 'status': 'present'}, '`B-8`': {'commit': '8329614', 'status': 'present'}, '`BUG-3` / `443b345`': {'commit': '', 'status': 'uncited'}, '`BUG-4a` / `AUD-588-B11` residual': {'commit': '24b4185', 'status': 'present'}, '`BUG-4b` / `AUD-588-B11` residual': {'commit': '0376350', 'status': 'present'}, '`E-39`, class residual of `AUD-593-N06`': {'commit': '25fc11f', 'status': 'present'}, '`N-5`': {'commit': 'c68083f', 'status': 'present'}, '`N-7`': {'commit': '082e9de', 'status': 'present'}, '`R-1`': {'commit': '424fb1c', 'status': 'present'}, '`R-2`': {'commit': '5158b92', 'status': 'present'}, '`R-3`': {'commit': '88aec04', 'status': 'present'}, '`R-4`': {'commit': '04fd04f', 'status': 'present'}}
 CLOSURE_COVERAGE = {'closed_rows': 165, 'present': 91, 'absent': 0, 'unresolved': 0, 'uncited': 74, 'unknown': 0}

sourcecode/_docs/DEFECT-LEDGER.md

@@ -16,7 +16,7 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization — External Audit `AUD-621`
 
-**Release `5.9.18` remediation.** `AUD-621-PACK-STDERR` is corrected in code: the child pipe is read as UTF-8 with replacement and the forwarding loop retains a decode-failure guard. `AUD-621-R` has a second Windows barrier at process-pool construction, complementing the sequential fallback. Both findings remain open until their required native Windows evidence is recorded; `AUD-621-CONTEXT` and `AUD-621-WIN-PROC` are unchanged.
+**Release `5.9.19` remediation.** The stderr-decoding fix for `AUD-621-PACK-STDERR` remains in code, and the distinct `pack gate --since` crash found by the post-remediation re-audit is corrected with a Python 3.9–3.11-compatible tar extraction path. `AUD-621-R` has a second Windows barrier at process-pool construction, complementing the sequential fallback. The broader findings remain open until their required native Windows evidence is recorded; `AUD-621-CONTEXT` and `AUD-621-WIN-PROC` are unchanged.
 
 **Re-audit of release `5.9.17`, received 2026-08-31.** Four independent
 Windows measurements overturn the apparent partial recovery of the shared
@@ -31,7 +31,9 @@ The audit also isolates a new, high-confidence Windows defect in `pack gate`:
 the `_forward_stderr` thread decodes child output using the active codepage,
 raises `UnicodeDecodeError` on UTF-8 bytes, then stops draining the pipe. The
 child can block once that pipe fills. Two independent forks captured the same
-traceback. The full evidence is
+traceback. A separate re-audit then found that `pack gate --since` can still
+fail earlier in `git_checkout.py` under Python 3.10, so the stderr fix is
+necessary but not sufficient. The full evidence is
 [`AUDIT-2026-08-31-EXTERNAL-5.9.17.md`](AUDIT-2026-08-31-EXTERNAL-5.9.17.md).
 
 | ID | Severity | Status | Evidence and required closure |

sourcecode/_docs/USER_GUIDE.md

@@ -46,16 +46,18 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.18, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.19, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.18, with release-artifact verification
-remaining for detached execution and pack evidence.
+the two pack fixes were tracked in release 5.9.18 as intended changes, and
+release 5.9.19 adds the tarfile compatibility correction found by the later
+re-audit. Release-artifact verification remains for detached execution and pack
+evidence, and native Windows reliability evidence is still required.
 
-### Reliability contracts in 5.9.18
+### Reliability contracts in 5.9.19
 
 **Failures must be visible.** `risk`, `verify`, `audit-report` and
 `migrate-check` turn unexpected analysis failures into structured
@@ -67,8 +69,11 @@ closing platform-specific findings.
 **Current Windows limitation.** The `5.9.17` external audit reproduced the
 shared worker-start failure in `risk`, `verify`, `audit-report`, `spring-audit`,
 `migrate-check` and `migrate-apply`. Do not use these commands as a production
-CI gate on Windows until the native matrix closes them. `pack gate --since` now
-uses safe UTF-8 stderr forwarding, but still requires native repeat evidence. See the
+CI gate on Windows until the native matrix closes them. A 2026-08-31 re-audit
+also found a separate `pack gate --since` crash in the git-ref materialization
+path when the subprocess resolves to Python 3.10 and hits the Python 3.12-only
+`TarFile.extract(..., filter="data")` API. Release 5.9.19 adds a compatible
+fallback; the command still requires native repeat evidence. See the
 [development roadmap](DEVELOPMENT-ROADMAP.md#external-audit-intake--aud-621-re-audit-release-5917).
 
 **A deadline the root analysis honours.** `ASK_MAX_ANALYSIS_SECONDS=<seconds>` now
@@ -274,7 +279,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.17
+# ask 5.9.19
 ```
 
 Requires Python 3.9+.
@@ -327,7 +332,7 @@ value in field use, and they are the ones to learn first:
 | `ask posture . --diff dev:prod` | The only command that answers *"what changes about effective access between two profile sets, across every endpoint at once"*. Experimental, and the most differentiated capability in the product. |
 | `ask endpoints .` | Every REST endpoint with its **effective path** (context-path + `spring.mvc.servlet.path` resolved), inferred security policy and per-endpoint confidence. Turns "audit the API" into a list. |
 | `ask spring-audit .` | Transactional anomalies that a compiler cannot see — `@Transactional` on a private method is a silent CGLIB no-op — plus the security surface. |
-| `ask migrate-check . --compact` | Boot 2→3 readiness plus Java LTS/licensing inventory: blockers, effort, target JDK evidence and explicit licensing-review signals. |
+| `ask migrate-check . --compact` | Boot 2→3 readiness plus Java LTS/licensing and local JVM ecosystem inventory: blockers, effort, target JDK evidence, framework/runtime signals and explicit licensing-review signals. |
 
 Everything else is either a projection of the same model (`impact`, `export`, `explain`) or an
 agent-facing packaging of it (`--compact`, `--agent`, `prepare-context`). The full surface is

sourcecode/canonical_ir.py

@@ -528,10 +528,17 @@ def ir_dict_to_canonical(
         files = sorted(file_set)
 
     # Sorted call graph edges — stable ordering: from, type, to
-    call_graph = sorted(
-        edges,
-        key=lambda e: (e.get("from", ""), e.get("type", ""), e.get("to", "")),
-    )
+    # The raw graph is owned by this CIR conversion and its edge order is not
+    # observable until after conversion. Sort in place instead of creating a
+    # second repository-sized list during the raw/CIR overlap peak.
+    if isinstance(edges, list):
+        edges.sort(key=lambda e: (e.get("from", ""), e.get("type", ""), e.get("to", "")))
+        call_graph = edges
+    else:
+        call_graph = sorted(
+            edges,
+            key=lambda e: (e.get("from", ""), e.get("type", ""), e.get("to", "")),
+        )
 
     # Dependency edges (structural subset of call_graph)
     _dep_types = frozenset({"imports", "extends", "implements", "injects"})

sourcecode/cli.py

@@ -4404,7 +4404,9 @@ app = typer.Typer(
     name="ask",
     help=_HELP,
     add_completion=False,
-    rich_markup_mode="rich",
+    # Rich's Windows help renderer can drop options from long command panels;
+    # plain Click help keeps the complete option contract visible there.
+    rich_markup_mode=None if os.name == "nt" else "rich",
     no_args_is_help=False,
 )
 
@@ -7531,6 +7533,7 @@ def prepare_context_cmd(
         Path("."),
         help="Repository path to analyze (default: current directory)",
     ),
+    jobs: Optional[int] = _jobs_option(),
     since: Optional[str] = typer.Option(
         None,
         "--since",
@@ -7605,7 +7608,6 @@ def prepare_context_cmd(
         ),
     ),
     progress_mode: Optional[str] = _progress_option(),
-    jobs: Optional[int] = _jobs_option(),
 ) -> None:
     """Task-specific context for AI coding agents.
 
@@ -8426,6 +8428,7 @@ def repo_ir_cmd(
         Path("."),
         help="Repository root to analyze (default: current directory)",
     ),
+    jobs: Optional[int] = _jobs_option(),
     since: Optional[str] = typer.Option(
         None,
         "--since",
@@ -8491,7 +8494,6 @@ def repo_ir_cmd(
         help="Compress output with gzip. Requires --output. Reduces large IR files by ~70-80%.",
     ),
     progress_mode: Optional[str] = _progress_option(),
-    jobs: Optional[int] = _jobs_option(),
 ) -> None:
     """Deterministic symbol-level IR for Java repositories.
 
@@ -9185,6 +9187,7 @@ def endpoints_cmd(
         Path("."),
         help="Repository path to scan for REST endpoints (default: current directory)",
     ),
+    jobs: Optional[int] = _jobs_option(),
     output_path: Optional[Path] = typer.Option(
         None, "--output", "-o",
         help="Write output to a file instead of stdout.",
@@ -9251,7 +9254,6 @@ def endpoints_cmd(
              "than protect).",
     ),
     progress_mode: Optional[str] = _progress_option(),
-    jobs: Optional[int] = _jobs_option(),
 ) -> None:
     """Extract REST API endpoint surface from Java source files.
 
@@ -9806,6 +9808,7 @@ def export_cmd(
         Path("."),
         help="Repository path to export (default: current directory)",
     ),
+    jobs: Optional[int] = _jobs_option(),
     output_path: Optional[Path] = typer.Option(
         None, "--output", "-o",
         help="Write output to a file instead of stdout.",
@@ -9848,7 +9851,6 @@ def export_cmd(
              "written on the diagram whenever it bites.",
     ),
     progress_mode: Optional[str] = _progress_option(),
-    jobs: Optional[int] = _jobs_option(),
 ) -> None:
     """Export structured, tool-agnostic codebase views for downstream tooling.
 
@@ -10015,6 +10017,7 @@ def validation_cmd(
         Path("."),
         help="Repository path to scan for request-body validation (default: current directory)",
     ),
+    jobs: Optional[int] = _jobs_option(),
     output_path: Optional[Path] = typer.Option(
         None, "--output", "-o",
         help="Write output to a file instead of stdout.",
@@ -10045,7 +10048,6 @@ def validation_cmd(
         help=_NO_CACHE_SUBCOMMAND_HELP,
     ),
     progress_mode: Optional[str] = _progress_option(),
-    jobs: Optional[int] = _jobs_option(),
 ) -> None:
     """Map request-body validation per endpoint (constraints + custom validators).
 
@@ -12173,6 +12175,7 @@ def spring_audit_cmd(
         Path("."),
         help="Repository path to audit (default: current directory)",
     ),
+    jobs: Optional[int] = _jobs_option(),
     output_path: Optional[Path] = typer.Option(
         None, "--output", "-o",
         help="Write output to a file instead of stdout.",
@@ -12304,7 +12307,6 @@ def spring_audit_cmd(
     ),
     detach: bool = _detach_option(),
     progress_mode: Optional[str] = _progress_option(),
-    jobs: Optional[int] = _jobs_option(),
 ) -> None:
     """Spring semantic audit: {{RULE_SUMMARY}}.
 
@@ -13483,6 +13485,7 @@ def risk_cmd(
         Path("."),
         help="Repository path (default: current directory).",
     ),
+    jobs: Optional[int] = _jobs_option(),
     limit: int = typer.Option(
         50, "--limit", help="How many composed risks to publish (highest first).", min=0,
     ),
@@ -13542,7 +13545,6 @@ def risk_cmd(
     allow_partial: bool = _allow_partial_option(),
     detach: bool = _detach_option(),
     progress_mode: Optional[str] = _progress_option(),
-    jobs: Optional[int] = _jobs_option(),
 ) -> None:
     """What each defect actually costs, once reach and access are in it.
 
@@ -14796,6 +14798,7 @@ def posture_cmd(
         Path("."),
         help="Repository path (default: current directory).",
     ),
+    jobs: Optional[int] = _jobs_option(),
     profile: Optional[str] = typer.Option(
         None,
         "--profile",
@@ -14877,7 +14880,6 @@ def posture_cmd(
     format: str = _format_option(help="Output format: json or yaml."),
     copy: bool = _copy_option(),
     progress_mode: Optional[str] = _progress_option(),
-    jobs: Optional[int] = _jobs_option(),
 ) -> None:
     """Which beans are wired under a profile set — and which cannot be decided.
 
@@ -15300,6 +15302,7 @@ def migrate_check_cmd(
         Path("."),
         help="Repository path to scan (default: current directory)",
     ),
+    jobs: Optional[int] = _jobs_option(),
     output_path: Optional[Path] = typer.Option(
         None, "--output", "-o",
         help="Write output to a file instead of stdout.",
@@ -15441,7 +15444,6 @@ def migrate_check_cmd(
     ),
     detach: bool = _detach_option(),
     progress_mode: Optional[str] = _progress_option(),
-    jobs: Optional[int] = _jobs_option(),
 ) -> None:
     """Spring Boot 2→3 migration readiness + Java LTS/licensing inventory.
 
@@ -15847,6 +15849,7 @@ def impact_chain_cmd(
         Path("."),
         help="Repository root (default: current directory)",
     ),
+    jobs: Optional[int] = _jobs_option(),
     depth: int = typer.Option(
         4,
         "--depth",
@@ -15886,7 +15889,6 @@ def impact_chain_cmd(
         ),
     ),
     progress_mode: Optional[str] = _progress_option(),
-    jobs: Optional[int] = _jobs_option(),
 ) -> None:
     """Spring impact-chain: systemic blast radius of a symbol; TX/SEC findings are opt-in.
 

sourcecode/context_graph.py

@@ -405,7 +405,7 @@ class ContextGraph:
     """
 
     __slots__ = (
-        "_cir", "_nodes_by_fqn", "_nodes", "_build_ms",
+        "_cir", "_raw_nodes", "_nodes_by_fqn", "_nodes", "_build_ms",
         "_body_index", "_literal_index", "_guard_index", "_span_index",
         "_class_type_index", "_relations_all", "_symbols_sorted",
         "_symbols_by_file", "_relations_by_source",
@@ -427,11 +427,9 @@ class ContextGraph:
         self._class_type_index: Optional[_ClassTypeIndex] = None
         # Index the rich node dicts once (the IR already produced them). This is
         # a lookup index over existing data, not a second copy of the model.
-        raw_nodes = ((cir._raw_ir.get("graph") or {}).get("nodes")) or []
-        self._nodes: tuple[Symbol, ...] = tuple(
-            _node_to_symbol(n) for n in raw_nodes
-        )
-        self._nodes_by_fqn: dict[str, Symbol] = {s.fqn: s for s in self._nodes}
+        self._raw_nodes = ((cir._raw_ir.get("graph") or {}).get("nodes")) or []
+        self._nodes: Optional[tuple[Symbol, ...]] = None
+        self._nodes_by_fqn: Optional[dict[str, Symbol]] = None
         # Memoized full projections (the CIR is immutable for this graph's lifetime).
         # `relations()`/`symbols()` are called once PER FILE by per-file consumers such as
         # `_java_contract_from_graph`; without these caches each call re-converted every
@@ -447,6 +445,13 @@ class ContextGraph:
         self._symbols_by_file: Optional[dict[str, list[Symbol]]] = None
         self._relations_by_source: Optional[dict[str, list[Relation]]] = None
 
+    def _ensure_nodes(self) -> tuple[Symbol, ...]:
+        """Materialize the typed node view only for symbol-oriented queries."""
+        if self._nodes is None:
+            self._nodes = tuple(_node_to_symbol(n) for n in self._raw_nodes)
+            self._nodes_by_fqn = {s.fqn: s for s in self._nodes}
+        return self._nodes
+
     # -- construction -------------------------------------------------------
 
     @classmethod
@@ -501,7 +506,8 @@ class ContextGraph:
 
     def symbol(self, fqn: str) -> Optional[Symbol]:
         """Look up a single symbol by fully-qualified name. O(1)."""
-        return self._nodes_by_fqn.get(fqn)
+        self._ensure_nodes()
+        return self._nodes_by_fqn.get(fqn)  # type: ignore[union-attr]
 
     def symbols(
         self,
@@ -517,8 +523,9 @@ class ContextGraph:
         set. Results are sorted by FQN for determinism. This is the primitive
         the role-convenience methods below are thin sugar over.
         """
+        nodes = self._ensure_nodes()
         if self._symbols_sorted is None:
-            self._symbols_sorted = tuple(sorted(self._nodes, key=lambda s: s.fqn))
+            self._symbols_sorted = tuple(sorted(nodes, key=lambda s: s.fqn))
         # Filter over the memoized fqn-sorted set (filtering preserves that order, so the
         # result is identical to sorting after filtering — but the sort happens once).
         return [
@@ -537,7 +544,7 @@ class ContextGraph:
         """
         if self._symbols_by_file is None:
             if self._symbols_sorted is None:
-                self._symbols_sorted = tuple(sorted(self._nodes, key=lambda s: s.fqn))
+                self._symbols_sorted = tuple(sorted(self._ensure_nodes(), key=lambda s: s.fqn))
             idx: dict[str, list[Symbol]] = {}
             for s in self._symbols_sorted:
                 idx.setdefault(s.source_file, []).append(s)
@@ -560,9 +567,7 @@ class ContextGraph:
 
     def types(self) -> list[Symbol]:
         """All class/interface/enum/annotation symbols, sorted by FQN."""
-        return sorted(
-            (s for s in self._nodes if s.is_type), key=lambda s: s.fqn
-        )
+        return sorted((s for s in self._ensure_nodes() if s.is_type), key=lambda s: s.fqn)
 
     def fields_of(self, type_fqn: str) -> list[Symbol]:
         """Annotated field symbols declared directly on a type (the IR emits a
@@ -572,7 +577,7 @@ class ContextGraph:
         prefix = type_fqn + "."
         out = [
             s
-            for s in self._nodes
+            for s in self._ensure_nodes()
             if s.kind == "field"
             and s.fqn.startswith(prefix)
             and "." not in s.fqn[len(prefix):]
@@ -1010,17 +1015,18 @@ class ContextGraph:
     def metrics(self) -> dict:
         """Structural size + composition of the graph. For Phase 1 measurement;
         derived entirely from already-built data."""
-        role_hist = Counter(s.role for s in self._nodes)
-        kind_hist = Counter(s.kind for s in self._nodes)
+        nodes = self._ensure_nodes()
+        role_hist = Counter(s.role for s in nodes)
+        kind_hist = Counter(s.kind for s in nodes)
         edge_hist = Counter(e.get("type", "") for e in self._cir.call_graph)
         grounded = sum(
             1
-            for s in self._nodes
+            for s in nodes
             if s.in_degree or s.out_degree
         )
         return {
             "cir_hash": self._cir.cir_hash,
-            "node_count": len(self._nodes),
+            "node_count": len(nodes),
             "relation_count": len(self._cir.call_graph),
             "endpoint_count": len(self._cir.endpoints),
             "grounded_node_count": grounded,
@@ -1033,7 +1039,7 @@ class ContextGraph:
 
     def __repr__(self) -> str:  # pragma: no cover - debug aid
         return (
-            f"ContextGraph(nodes={len(self._nodes)}, "
+            f"ContextGraph(nodes={len(self._ensure_nodes())}, "
             f"relations={len(self._cir.call_graph)}, "
             f"endpoints={len(self._cir.endpoints)}, "
             f"hash={self._cir.cir_hash[:12]})"

sourcecode/git_checkout.py

@@ -27,6 +27,7 @@ after it borrowed a parent's ref once (C3-27).
 from __future__ import annotations
 
 import subprocess
+import sys
 import tarfile
 import tempfile
 from contextlib import contextmanager
@@ -149,4 +150,10 @@ def _extract_safely(tar: tarfile.TarFile, dest: Path) -> None:
         resolved = (root / member.name).resolve()
         if not str(resolved).startswith(str(root)):
             continue
-        tar.extract(member, dest, filter="data")
+        # `filter` was added in Python 3.12 (PEP 706). The explicit path and
+        # link checks above provide the compatibility-safe extraction policy
+        # for the Python versions still supported by this project.
+        if sys.version_info >= (3, 12):
+            tar.extract(member, dest, filter="data")
+        else:
+            tar.extract(member, dest)

sourcecode/jvm_inventory.py

@@ -0,0 +1,294 @@
+"""Deterministic, local JVM ecosystem evidence for ``migrate-check``.
+
+This module deliberately reports observations, not recommendations. It never
+executes a build, resolves dependencies, or accesses a network service.
+"""
+from __future__ import annotations
+
+import os
+import json
+import re
+from pathlib import Path
+from typing import Iterable, Optional
+
+_SKIP_DIRS = {
+    ".git", ".gradle", ".mvn", ".idea", ".vscode", "build", "target",
+    "out", "dist", "bin", "node_modules", "__pycache__", "generated-sources",
+}
+_MAX_FILES = 800
+_MAX_BYTES = 256 * 1024
+_MAX_EVIDENCE = 160
+_MAX_SBOM_COMPONENTS = 400
+_TEXT_NAMES = {
+    "pom.xml", "build.gradle", "build.gradle.kts", "gradle.properties",
+    "settings.gradle", "settings.gradle.kts", "Dockerfile", "docker-compose.yml",
+    "docker-compose.yaml", "Jenkinsfile", ".gitlab-ci.yml", "config.yml",
+    ".java-version", ".sdkmanrc", "jvm.config",
+}
+_TEXT_SUFFIXES = {
+    ".java", ".xml", ".gradle", ".kts", ".properties", ".yml", ".yaml",
+    ".sh", ".bat", ".cmd", ".ps1",
+}
+_SBOM_NAMES = {"bom.json", "bom.cdx.json", "bom.cyclonedx.json", "sbom.json", "sbom.spdx.json"}
+
+_FRAMEWORK_COORDINATES = {
+    "spring-boot": ("org.springframework.boot", re.compile(r"spring-boot(?:-[\w-]+)?")),
+    "spring-framework": ("org.springframework", re.compile(r"spring-(?:core|context|web|beans)")),
+    "hibernate": ("org.hibernate", re.compile(r"hibernate-[\w-]+")),
+    "jakarta-ee": ("jakarta.platform", re.compile(r"jakarta(?:\.\w+)?")),
+    "quarkus": ("io.quarkus", re.compile(r"quarkus(?:-[\w-]+)?")),
+    "micronaut": ("io.micronaut", re.compile(r"micronaut(?:-[\w-]+)?")),
+}
+_COORD_RE = re.compile(
+    r"(?P<group>org\.springframework(?:\.boot)?|org\.hibernate|jakarta\.platform|"
+    r"io\.quarkus(?:\.platform)?|io\.micronaut)[:\"'](?P<artifact>[\w.-]+)"
+    r"(?:[:\"'](?P<version>[\w.${}+-]+))?"
+)
+_MAVEN_COORD_RE = re.compile(
+    r"<groupId>\s*(?P<group>[^<]+)\s*</groupId>\s*"
+    r"<artifactId>\s*(?P<artifact>[^<]+)\s*</artifactId>"
+    r"(?:\s*<version>\s*(?P<version>[^<]+)\s*</version>)?",
+    re.DOTALL,
+)
+_IMPORT_RE = re.compile(r"^\s*import\s+(?P<package>org\.springframework(?:\.boot)?|org\.hibernate|jakarta\.|io\.quarkus|io\.micronaut)")
+_PATTERNS = {
+    "module_info": re.compile(r"\bmodule\s+[\w.]+\s*\{"),
+    "virtual_threads": re.compile(r"\b(?:Thread\.ofVirtual|Executors\.newVirtualThreadPerTaskExecutor)\b"),
+    "scoped_value": re.compile(r"\bScopedValue\b"),
+    "native_image": re.compile(r"\bnative-image\b"),
+    "jlink": re.compile(r"\bjlink\b"),
+    "jpackage": re.compile(r"\bjpackage\b"),
+}
+_JAVA_VERSION_RE = re.compile(
+    r"(?:java-version|JAVA_VERSION|jdk|JDK|temurin|corretto|zulu|openjdk)[^\n\r:=-]*[:= -]+(?:['\"]?)(?:Java[- ]?)?(?P<version>\d{1,2})(?:['\"]|\b)",
+    re.IGNORECASE,
+)
+
+
+def _line_evidence(path: str, line: int, text: str, *, kind: str, detail: str) -> dict:
+    return {"kind": kind, "path": path, "line": line, "detail": detail, "text": text.strip()[:240]}
+
+
+def _sbom_inventory(files: list[tuple[Path, str]], limitations: list[str]) -> dict:
+    """Read local CycloneDX/SPDX JSON without treating it as a security verdict."""
+    documents: list[dict] = []
+    for path, rel in files:
+        if path.suffix.lower() != ".json":
+            continue
+        try:
+            if path.stat().st_size > _MAX_BYTES:
+                continue
+            raw = path.read_text(encoding="utf-8", errors="replace")
+            data = json.loads(raw)
+        except (OSError, ValueError):
+            continue
+        if not isinstance(data, dict):
+            continue
+        if data.get("bomFormat") == "CycloneDX":
+            fmt, version, entries = "cyclonedx", data.get("specVersion"), data.get("components", [])
+        elif isinstance(data.get("spdxVersion"), str) and data["spdxVersion"].startswith("SPDX-"):
+            fmt, version, entries = "spdx", data.get("spdxVersion"), data.get("packages", [])
+        else:
+            continue
+        if not isinstance(entries, list):
+            limitations.append(f"{rel}: SBOM component list is not an array")
+            continue
+        components: list[dict] = []
+        for entry in entries[:_MAX_SBOM_COMPONENTS]:
+            if not isinstance(entry, dict):
+                continue
+            if fmt == "cyclonedx":
+                name = entry.get("name")
+                version_value = entry.get("version")
+                group = entry.get("group")
+                purl = entry.get("purl")
+            else:
+                name = entry.get("name")
+                version_value = entry.get("versionInfo")
+                group = None
+                purl = next((ref.get("referenceLocator") for ref in entry.get("externalRefs", [])
+                             if isinstance(ref, dict) and ref.get("referenceType") == "purl"), None)
+            if not isinstance(name, str):
+                continue
+            components.append({
+                "name": name,
+                "group": group if isinstance(group, str) else None,
+                "version": version_value if isinstance(version_value, str) else None,
+                "purl": purl if isinstance(purl, str) else None,
+            })
+        if len(entries) > _MAX_SBOM_COMPONENTS:
+            limitations.append(f"{rel}: SBOM components capped at {_MAX_SBOM_COMPONENTS}")
+        documents.append({
+            "format": fmt,
+            "spec_version": version if isinstance(version, str) else None,
+            "path": rel,
+            "component_count": len(components),
+            "components": components,
+        })
+    return {
+        "status": "observed" if documents else "unobserved",
+        "documents": sorted(documents, key=lambda item: item["path"]),
+        "policy": "local CycloneDX/SPDX JSON parsing only; no CVE, license, signature, or network validation",
+    }
+
+
+def _files(root: Path, source_paths: Optional[Iterable[str]] = None) -> tuple[list[tuple[Path, str]], list[str]]:
+    found: list[tuple[Path, str]] = []
+    limitations: list[str] = []
+    explicit: set[str] = set()
+    for rel in source_paths or ():
+        normalized = Path(rel).as_posix()
+        path = root / normalized
+        if path.is_file():
+            found.append((path, normalized))
+            explicit.add(normalized)
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = sorted(d for d in dirnames if d not in _SKIP_DIRS)
+        for name in sorted(filenames):
+            path = Path(dirpath) / name
+            rel = path.relative_to(root).as_posix()
+            if rel in explicit:
+                continue
+            if (name in _TEXT_NAMES or path.suffix.lower() in _TEXT_SUFFIXES or
+                    name in _SBOM_NAMES or "cyclonedx" in name.lower() or
+                    "spdx" in name.lower() or ".github/workflows/" in f"/{rel}" or
+                    rel.startswith(".circleci/")):
+                found.append((path, rel))
+    priority = []
+    regular = []
+    for item in found:
+        rel = item[1]
+        if (Path(rel).parent == Path(".") or rel.startswith((".github/", ".circleci/", ".gitlab/")) or
+                Path(rel).name in _TEXT_NAMES or Path(rel).name in _SBOM_NAMES):
+            priority.append(item)
+        else:
+            regular.append(item)
+    ordered = sorted(priority, key=lambda item: item[1]) + sorted(regular, key=lambda item: item[1])
+    if source_paths is None and len(ordered) > _MAX_FILES:
+        limitations.append(f"file scan capped at {_MAX_FILES} text files")
+        ordered = ordered[:_MAX_FILES]
+    return ordered, limitations
+
+
+def scan_jvm_inventory(
+    root: Path,
+    build_sources: Iterable[tuple[str, str]] = (),
+    *,
+    source_paths: Optional[Iterable[str]] = None,
+) -> dict:
+    """Return bounded JVM facts with local file/line provenance."""
+    files, limitations = _files(root, source_paths)
+    sbom = _sbom_inventory(files, limitations)
+    declared: dict[str, list[dict]] = {name: [] for name in _FRAMEWORK_COORDINATES}
+    observed: dict[str, list[dict]] = {name: [] for name in _FRAMEWORK_COORDINATES}
+    patterns: dict[str, list[dict]] = {name: [] for name in _PATTERNS}
+    java_runtime: list[dict] = []
+    build_text_map = {path: text for path, text in build_sources}
+
+    texts: list[tuple[str, str]] = []
+    for path, rel in files:
+        text = build_text_map.get(rel)
+        if text is None:
+            try:
+                if path.stat().st_size > _MAX_BYTES:
+                    limitations.append(f"{rel}: file exceeds {_MAX_BYTES} byte read limit")
+                    continue
+                text = path.read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                limitations.append(f"{rel}: could not be read")
+                continue
+        texts.append((rel, text))
+
+    for rel, text in texts:
+        is_build = rel.endswith(("pom.xml", "build.gradle", "build.gradle.kts", "gradle.properties"))
+        java_block_comment = False
+        if rel.endswith("pom.xml"):
+            for match in _MAVEN_COORD_RE.finditer(text):
+                group, artifact = match.group("group").strip(), match.group("artifact").strip()
+                for name, (prefix, artifact_re) in _FRAMEWORK_COORDINATES.items():
+                    if group.startswith(prefix) and artifact_re.fullmatch(artifact):
+                        line_no = text[:match.start()].count("\n") + 1
+                        declared[name].append(_line_evidence(
+                            rel, line_no, match.group(0), kind="declared_coordinate",
+                            detail=f"{group}:{artifact}" + (f":{match.group('version').strip()}" if match.group("version") else ""),
+                        ))
+        for line_no, line in enumerate(text.splitlines(), 1):
+            detection_line = line
+            if rel.endswith(".java"):
+                pieces: list[str] = []
+                rest = line
+                while rest:
+                    if java_block_comment:
+                        end = rest.find("*/")
+                        if end < 0:
+                            rest = ""
+                            break
+                        java_block_comment = False
+                        rest = rest[end + 2:]
+                    else:
+                        start = rest.find("/*")
+                        if start < 0:
+                            pieces.append(rest)
+                            break
+                        pieces.append(rest[:start])
+                        java_block_comment = True
+                        rest = rest[start + 2:]
+                detection_line = "".join(pieces).split("//", 1)[0]
+            if Path(rel).name == "module-info.java" and detection_line.strip().startswith("module "):
+                patterns["module_info"].append(_line_evidence(
+                    rel, line_no, line, kind="observed_pattern", detail="module-info.java"
+                ))
+            if is_build:
+                for match in _COORD_RE.finditer(line):
+                    group, artifact = match.group("group"), match.group("artifact")
+                    for name, (prefix, artifact_re) in _FRAMEWORK_COORDINATES.items():
+                        if group.startswith(prefix) and artifact_re.fullmatch(artifact):
+                            declared[name].append(_line_evidence(
+                                rel, line_no, line, kind="declared_coordinate",
+                                detail=f"{group}:{artifact}" + (f":{match.group('version')}" if match.group("version") else ""),
+                            ))
+            import_match = _IMPORT_RE.match(detection_line)
+            if import_match:
+                package = import_match.group("package")
+                name = (
+                    "spring-boot" if package == "org.springframework.boot" else
+                    "spring-framework" if package == "org.springframework" else
+                    "hibernate" if package == "org.hibernate" else
+                    "jakarta-ee" if package == "jakarta." else
+                    "quarkus" if package == "io.quarkus" else "micronaut"
+                )
+                observed[name].append(_line_evidence(rel, line_no, line, kind="observed_import", detail=package))
+            for name, pattern in _PATTERNS.items():
+                if name != "module_info" or Path(rel).name != "module-info.java":
+                    if pattern.search(detection_line):
+                        patterns[name].append(_line_evidence(rel, line_no, line, kind="observed_pattern", detail=name))
+            if (".github/workflows/" in f"/{rel}" or rel.startswith((".circleci/", ".gitlab/")) or
+                    Path(rel).name in {"Jenkinsfile", ".gitlab-ci.yml"} or rel.startswith("Dockerfile")):
+                match = _JAVA_VERSION_RE.search(line)
+                if match:
+                    java_runtime.append(_line_evidence(
+                        rel, line_no, line, kind="declared_java_runtime", detail=f"java:{match.group('version')}"
+                    ))
+
+    def capped(items: list[dict]) -> list[dict]:
+        if len(items) > _MAX_EVIDENCE:
+            limitations.append(f"evidence capped at {_MAX_EVIDENCE} items per category")
+        return items[:_MAX_EVIDENCE]
+
+    frameworks = {}
+    for name in _FRAMEWORK_COORDINATES:
+        frameworks[name] = {
+            "declared": capped(sorted(declared[name], key=lambda x: (x["path"], x["line"]))),
+            "observed": capped(sorted(observed[name], key=lambda x: (x["path"], x["line"]))),
+            "status": "declared_and_observed" if declared[name] and observed[name]
+            else "declared_only" if declared[name] else "observed_only" if observed[name] else "unobserved",
+        }
+    return {
+        "schema_version": "jvm-inventory-v1",
+        "frameworks": frameworks,
+        "patterns": {name: capped(sorted(items, key=lambda x: (x["path"], x["line"]))) for name, items in patterns.items()},
+        "java_runtime": capped(sorted(java_runtime, key=lambda x: (x["path"], x["line"]))),
+        "sbom": sbom,
+        "limitations": sorted(set(limitations)),
+        "analysis_policy": "local text evidence only; no build, dependency resolution, network, or recommendations",
+    }

sourcecode/migrate_check.py

@@ -26,6 +26,7 @@ from typing import Any, Iterable, Iterator, Optional, TYPE_CHECKING
 from sourcecode.degradation import cap_effect
 from sourcecode.path_filters import is_test_or_fixture_path
 from sourcecode.jdk_exports import JDK_UNCONDITIONAL_EXPORTS
+from sourcecode.jvm_inventory import scan_jvm_inventory
 
 if TYPE_CHECKING:
     from sourcecode.hibernate_strat import HibernateStratification
@@ -1905,6 +1906,8 @@ class MigrationReport:
     # F-P: Java LTS/licensing inventory, derived from build/runtime hints. Additive
     # field: it informs migration planning but does not participate in readiness_score.
     java_lts_inventory: dict = field(default_factory=dict)
+    # JVM ecosystem evidence. Additive and advisory: it never changes readiness.
+    jvm_inventory: dict = field(default_factory=dict)
     evidence_manifest: dict = field(default_factory=dict)
 
     def finalize(self) -> "MigrationReport":
@@ -2572,6 +2575,7 @@ class MigrationReport:
             "spring_boot_version_detected": self.spring_boot_version_detected,
             "boot3_axis_completed": self.boot3_axis_completed,
             "java_lts_inventory": self.java_lts_inventory,
+            "jvm_inventory": self.jvm_inventory,
             **({"evidence_manifest": self.evidence_manifest} if self.evidence_manifest else {}),
             "summary": self.summary,
             "findings": [f.to_dict() for f in _listed],
@@ -3328,6 +3332,8 @@ def run_migrate_check(
             spring_boot_version=spring_boot_version,
             target_jdk=target_jdk,
         )
+    with _phase("jvm_inventory"):
+        jvm_inventory = scan_jvm_inventory(root, _build_sources, source_paths=file_paths)
 
     # BUG #8: classify each finding's code context (main / test / generated) so the
     # report can keep test fixtures and autogenerated sources out of blocking_count.
@@ -3381,6 +3387,7 @@ def run_migrate_check(
         findings=all_findings,
         hibernate=hibernate_strat,
         java_lts_inventory=java_lts_inventory,
+        jvm_inventory=jvm_inventory,
         limitations=limitations,
         metadata={
             "java_files_scanned": len(file_paths),

sourcecode/parallel.py

@@ -266,16 +266,6 @@ def prefill_parse_cache(
         # a build that forks itself on every analysis.
         receipt["reason"] = "frozen build — worker processes would re-enter the CLI"
         return receipt
-    if os.name == "nt":
-        # Windows workers use ``spawn`` and must duplicate the parent's IPC
-        # handles. A denied DuplicateHandle leaves a ProcessPoolExecutor with no
-        # usable workers; depending on which consumer waits for its cache entry,
-        # that used to become either silent success or an unbounded wait. The
-        # sequential loop below is the designed fallback and produces the same
-        # IR, so prefer a reliable answer to speculative parse parallelism.
-        receipt["reason"] = "Windows — parsing sequentially to avoid spawn worker-handle failures"
-        return receipt
-
     # Retire dead generations once, here, rather than letting N workers race to
     # do it (C3-70's purge is idempotent, but doing it once is cheaper).
     with suppress(Exception):
@@ -308,7 +298,9 @@ def prefill_parse_cache(
         # the caller's unchanged sequential loop produces the same IR.
         if pool is not None:
             _abort_executor(pool)
-        receipt["reason"] = f"pool unavailable ({type(exc).__name__}) — parsing sequentially"
+        receipt["reason"] = (
+            f"pool unavailable ({type(exc).__name__}: {exc}) — parsing sequentially"
+        )
         return receipt
     if not receipt["reason"]:
         receipt["reason"] = f"{receipt['parsed']} parsed and {receipt['hit']} already cached"

sourcecode/release_info.py

@@ -33,7 +33,7 @@ RELEASE_DATE = "2026-08-31"
 #: computation the test re-runs). The nine-day interval before 5.9.0 lowers
 #: that window to 29 releases over 18 days, so the constant follows the current
 #: measurement rather than preserving the former short-burst cadence.
-RELEASE_RATE_PER_DAY = 1.61
+RELEASE_RATE_PER_DAY = 3.22
 
 #: How many releases behind is worth telling the operator about. Four, which on
 #: the measured cadence is about three days: one release is under a day and warning

sourcecode/repository_ir.py

@@ -6114,23 +6114,29 @@ def _build_route_surface(
     # Phase 3: inheritance projection — subclasses with a class-level @RequestMapping
     # prefix inherit parent methods that they do not override (same HTTP verb + path suffix).
     if extends_map:
+        # Candidate resolution used to scan every class for every child. On large
+        # repositories this made route projection quadratic in the number of types.
+        # The module prefix is the same discriminator used by the old predicate,
+        # so indexing it preserves its ambiguity rule exactly.
+        def _route_module_key(data: dict) -> tuple[str, str]:
+            source_file = data["source_file"]
+            module = source_file.split("src/", 1)[0] if "src/" in source_file else ""
+            return module, data["fqn"].split(".")[-1]
+
+        _classes_by_module_name: dict[tuple[str, str], list[str]] = {}
+        for _unit, _data in class_info.items():
+            _classes_by_module_name.setdefault(
+                _route_module_key(_data), []
+            ).append(_unit)
         simple_extends: dict[str, str] = {}
         for child_unit, child_data in class_info.items():
             parent_simple = extends_map.get(child_data["fqn"])
             if not parent_simple:
                 continue
-            child_module = (
-                child_data["source_file"].split("src/", 1)[0]
-                if "src/" in child_data["source_file"] else ""
+            child_module = _route_module_key(child_data)[0]
+            candidates = _classes_by_module_name.get(
+                (child_module, parent_simple), []
             )
-            candidates = [
-                unit for unit, data in class_info.items()
-                if data["fqn"].split(".")[-1] == parent_simple
-                and (
-                    data["source_file"].split("src/", 1)[0]
-                    if "src/" in data["source_file"] else ""
-                ) == child_module
-            ]
             if len(candidates) == 1:
                 simple_extends[child_unit] = candidates[0]
 
@@ -6694,7 +6700,12 @@ def build_repo_ir(
     # shared store publishes per repository. Collected in the loop that computes
     # the keys anyway, so it costs a dictionary.
     _repo_keys: "dict[str, str]" = {}
-    _per_file: list[tuple[str, str, str, list[str], list[SymbolRecord]]] = []
+    # Keep parse metadata, not source text. Retaining every file body here made
+    # full CIR builds hold a second copy of large repositories until assembly.
+    # Pass 2 rereads the source only for relation/body extraction.
+    _per_file: list[tuple[str, str, list[str], list[SymbolRecord]]] = []
+    _repo_constants: dict[str, str] = {}
+    _ambiguous_constants: set[str] = set()
     # (package, imports, annotation-ref-pairs) for the reference-graph post-pass,
     # collected from BOTH fully-parsed and pre-scan-skipped files (BUG #2).
     _ann_ref_sources: list[tuple[str, list[str], list[tuple[str, str]]]] = []
@@ -6758,6 +6769,15 @@ def build_repo_ir(
             _pc.put(_pkey, package, raw_imports, symbols, _excluded)
         _meta_symbols_excluded += _excluded
         all_symbols.extend(symbols)
+        for _name, _value in _collect_file_constants(source).items():
+            if _name in _ambiguous_constants:
+                continue
+            _previous = _repo_constants.get(_name)
+            if _previous is None:
+                _repo_constants[_name] = _value
+            elif _previous != _value:
+                del _repo_constants[_name]
+                _ambiguous_constants.add(_name)
         # P1-E (parse-coverage reconciliation): a file that declares a type but
         # yielded zero symbols is silently invisible to the graph. Record the
         # candidate here (source is already in memory; masking only runs for the
@@ -6773,7 +6793,7 @@ def build_repo_ir(
             _masked_src = _mask_java(source)
             if _masked_src.count("{") != _masked_src.count("}"):
                 _unbalanced_files.append(rel_path)
-        _per_file.append((rel_path, source, package, raw_imports, symbols))
+        _per_file.append((rel_path, package, raw_imports, symbols))
         if "@" in source:
             _parsed_refs = _extract_annotation_type_refs(source, package)
             if _parsed_refs:
@@ -6786,19 +6806,62 @@ def build_repo_ir(
 
     # Build {package: {simple_name: FQN}} from every class/interface found.
     _same_pkg_map: dict[str, dict[str, str]] = _build_same_package_map(all_symbols)
+    _type_map_material = repr(
+        sorted(
+            (pkg, name, fqn)
+            for pkg, names in _same_pkg_map.items()
+            for name, fqn in names.items()
+        )
+    ).encode("utf-8", "replace")
+    _relation_resolution_sig = hashlib.sha256(_type_map_material).hexdigest()[:16]
 
     # Pass 2: build relations with same-package type resolution available.
-    for _file_index, (rel_path, source, package, raw_imports, symbols) in enumerate(
+    for _file_index, (rel_path, package, raw_imports, symbols) in enumerate(
         _per_file, start=1
     ):
         if progress is not None:
             progress(_file_index, _total_files, "linking")
         same_pkg_types = _same_pkg_map.get(package, {})
-        relations = _build_relations(
-            symbols, raw_imports, source, package, rel_path,
-            same_pkg_types=same_pkg_types,
-            pkg_type_map=_same_pkg_map,
-        )
+        try:
+            source = (root / rel_path).read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        _relation_key = hashlib.sha256(
+            f"relations:{_pc.file_key(rel_path, source, _capture_sig)}:"
+            f"{_relation_resolution_sig}".encode("utf-8", "replace")
+        ).hexdigest()
+        _relation_blob = _pc.get_blob(_relation_key)
+        relations: list[RelationEdge]
+        _relation_cache_valid = False
+        if isinstance(_relation_blob, dict) and isinstance(
+            _relation_blob.get("relations"), list
+        ):
+            try:
+                relations = [
+                    RelationEdge(
+                        from_symbol=str(edge["from"]),
+                        to_symbol=str(edge["to"]),
+                        type=str(edge["type"]),
+                        confidence=str(edge.get("confidence", "high")),
+                        evidence=dict(edge.get("evidence") or {}),
+                    )
+                    for edge in _relation_blob["relations"]
+                ]
+                _relation_cache_valid = True
+            except (AttributeError, KeyError, TypeError, ValueError):
+                relations = []
+        else:
+            relations = []
+        if not _relation_cache_valid:
+            relations = _build_relations(
+                symbols, raw_imports, source, package, rel_path,
+                same_pkg_types=same_pkg_types,
+                pkg_type_map=_same_pkg_map,
+            )
+            _pc.put_blob(
+                _relation_key,
+                {"relations": [_edge_to_dict(edge) for edge in relations]},
+            )
         if emit_body_facts:
             # V4b: the per-file body-fact extractors are pure functions of the file's
             # bytes, so their combined output is memoised under the same content key.
@@ -6912,6 +6975,11 @@ def build_repo_ir(
             )
         )
 
+    # These pass-local containers are no longer needed after linking. Drop their
+    # references before _assemble creates the canonical projections, reducing the
+    # overlap between the raw-build and canonical-build working sets.
+    del _per_file, _repo_keys, _ann_ref_sources, _ambiguous_constants
+
     # C3-85: from here to the end of the build there is no per-file loop, so the
     # heartbeat kept `linking n/n` on screen — a counter that finished, reading as
     # a stage still running. Measured on keycloak (5 486 files, warm), the stretch
@@ -6931,6 +6999,11 @@ def build_repo_ir(
             seen.add(key)
             unique_relations.append(e)
 
+    # Linking and the cross-file resolution passes are complete. Keep only the
+    # deduplicated relation set for assembly; the pre-dedup list and type closure
+    # otherwise overlap with the canonical projection at the memory peak.
+    del all_relations, _same_pkg_map, _supertypes
+
     # When since is given, route_surface is a diff view (empty [] or list of changes).
     # When since is None, pass None so _build_route_surface builds the full route surface.
     route_diffs_arg: Optional[list[dict]] = (
@@ -6943,7 +7016,7 @@ def build_repo_ir(
         unbalanced_files=_unbalanced_files,
         # Cross-file constant folding for annotation paths: per-file folding only
         # sees constants declared in the same file (see _collect_repo_constants).
-        constants=_collect_repo_constants(_per_file),
+        constants=_repo_constants,
         root=root,
     )
 

sourcecode/risk.py

@@ -1244,7 +1244,8 @@ class RiskComposer:
         progress: "Optional[Callable[..., Any]]" = None,
     ) -> None:
         from sourcecode.context_cache import shared_cir
-        from sourcecode.repository_ir import extract_java_endpoints, find_java_files
+        from sourcecode.repository_ir import find_java_files
+        from sourcecode.canonical_ir import project_endpoint_surface
         from sourcecode.security_posture import (
             endpoint_security_surface,
             infer_security_posture,
@@ -1420,7 +1421,7 @@ class RiskComposer:
             _inside(
                 "indexing the validation surface",
                 lambda: _constraint_index(
-                    self.root, self.cir, extract_java_endpoints(self.root)
+                    self.root, self.cir, project_endpoint_surface(self.cir)
                 ),
             )
             if _named("indexing the validation surface") else None

sourcecode/schema_registry.py

@@ -294,6 +294,8 @@ SCHEMAS: "tuple[SchemaEntry, ...]" = (
     SchemaEntry("ask-run-v1", "one recorded run", "runs.py"),
     SchemaEntry("java-lts-inventory-v1", "the Java LTS inventory in a migration report",
                 "migrate_check.py", emitted_by=("migrate-check",)),
+    SchemaEntry("jvm-inventory-v1", "local JVM ecosystem evidence in a migration report",
+                "jvm_inventory.py", emitted_by=("migrate-check",)),
     SchemaEntry("facts-v1", "the fact registry: one fact, one authority (ADR-0008 R11)",
                 "registry.json", note="a registry rather than a payload shape; the "
                                       "document itself, under `facts/`"),

{sourcecode-5.9.18.dist-info → sourcecode-5.9.22.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.18
+Version: 5.9.22
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.18-blue)
+![Version](https://img.shields.io/badge/version-5.9.22-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -196,7 +196,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.17 retains the shared Canonical IR
+**Current performance status.** Release 5.9.22 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. It also removes two repeated walks of the same file tree in
@@ -221,6 +221,12 @@ there. Use `ask cache model <repo>`, `--progress stderr`, `audit-report
 [current reliability queue](docs/DEVELOPMENT-ROADMAP.md#external-audit-intake--aud-616-re-audit-release-5910)
 before treating a historical timing or bounded flag as a current guarantee.
 
+A post-remediation re-audit of `5.9.18` also found a separate `pack gate --since`
+regression on Windows: the git-ref materialization path could resolve to Python
+3.10 and fail in `tarfile` before the stderr-forwarding fix mattered. Release
+`5.9.19` adds the version-compatible extraction path; native Windows repetition
+is still required before treating `pack gate` as production CI evidence.
+
 **CI delivery and workspace licensing.** `migrate-check --format sarif` emits
 ASK-owned migration findings with source locations and provenance; it does not
 re-emit imported scanner findings. `ask auth workspace <repo>...` previews the
@@ -236,11 +242,14 @@ entitlement errors in CI and does not change per-repository gates or billing.
 
 Release 5.9.17 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
-input errors; duplicate same-commit baselines are never overwritten. `posture
---diff` validates unknown profiles when the repository declares profiles. In
-`endpoints --compact`, an empty `endpoints` list is explicitly marked as an
-intentional omission, not an empty API; unresolved `impact` and `impact-chain`
-queries exit non-zero, including on repositories without Java sources.
+input errors; duplicate same-commit baselines are never overwritten. That
+contract is still not enough to make `pack gate` CI-safe on Windows, because the
+materialization path can still hit a Python 3.10 tarfile mismatch in mixed
+environments. `posture --diff` validates unknown profiles when the repository
+declares profiles. In `endpoints --compact`, an empty `endpoints` list is
+explicitly marked as an intentional omission, not an empty API; unresolved
+`impact` and `impact-chain` queries exit non-zero, including on repositories
+without Java sources.
 
 **What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
@@ -267,11 +276,11 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.18 — and, on a build that has aged,
+ask version                    # ask 5.9.22 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
-> **Package vs. command.** The install package is named `sourcecode` this release
+> **Package vs. command.** The install package is named `sourcecode` in this release
 > (renaming the distribution is a separate, breaking change). Installing it gives you the
 > canonical **`ask`** command plus the deprecated **`sourcecode`** alias.
 

{sourcecode-5.9.18.dist-info → sourcecode-5.9.22.dist-info}/RECORD

@@ -1,6 +1,6 @@
-sourcecode/__init__.py,sha256=S8oxgYH-Q4cv0cFrN88Z1pyCthtwbhP0i_nWVVBKMdo,309
+sourcecode/__init__.py,sha256=rlhdFHgHxU-_wnswNtAc3jkUHnsGhX1taqMHDQJ5P6c,309
 sourcecode/__main__.py,sha256=qDFVkobwsdZrX0B3stiRqsUNivVpybKO-egzAwCW4xw,165
-sourcecode/_build_commit.py,sha256=vnTeW0cnEL6s4BeFQFFObMw4rIAwHS5kiQCKUC8bxcE,11638
+sourcecode/_build_commit.py,sha256=h33fClasWi1xoqBmi7TKbd8bGOaY-_NiL3paWe84zFg,11638
 sourcecode/access_drift.py,sha256=uYD8ipiEAaTnkz0IhG6ujU_KI3LghdY-6ycurs-BZnc,9355
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/analysis_budget.py,sha256=ZuNEboPF8A6GK-_V7WNt92ezgriga7_Rbr-vvSN4UEE,4183
@@ -29,13 +29,13 @@ sourcecode/cache_observation.py,sha256=5E2BeqiYE5wBCbvDglkc5A9fTNhXkT_OhcDuuCqRu
 sourcecode/call_surface.py,sha256=fiqYfHooxN1fX9oQoysq1LS3LoZcobhyUNjAGEZKpwk,4148
 sourcecode/caller_metrics.py,sha256=zGc3sHRRwEJgAGmyfqEiH69mD9w5rOqMUhzby8Vmm_w,12599
 sourcecode/caller_reach.py,sha256=M7Ffs5CtlimihfdSy3HtC4WpDP97bRFX15QYOlOfMJw,16626
-sourcecode/canonical_ir.py,sha256=nvOWn916bSEfqd7qbztLXzyyhTXR6l8HRbghhOBLrKI,38381
+sourcecode/canonical_ir.py,sha256=KcbR6Vnmo8UbwSbIn6RDAGdNtfPoxz1c_0IVCaoIuss,38779
 sourcecode/chain_rules.py,sha256=Bi6UHfgd-GxWswmnHRcPz5jdbAuqka3Zkz_P-MTvqhw,12767
 sourcecode/change_plan.py,sha256=drAoDsqFplutCLc6Y0xue7sYkTls0SpYh7aOXvttv3I,12934
 sourcecode/ci_output.py,sha256=X4NRokWWMRF9Ex8OQrEO2g04GzJ00GDP5zYIoqI9YCc,4625
 sourcecode/cir_graphs.py,sha256=RytqSv1WF8kdlfXj2fPQz16LY4akS2kyThbdWL8beCQ,14835
 sourcecode/classifier.py,sha256=ft1RGPIChvO84q2QMrEH93x1J15AXNWMh26lnxvoRao,26476
-sourcecode/cli.py,sha256=9PJjZid-sozU1bsnP12569hdIWouB4u5VE0kZJBWYhw,956514
+sourcecode/cli.py,sha256=2d-S0OQQnoF8bHll_MfIuFUSyAVtRl_Nopb1WEBd8Vo,956694
 sourcecode/click_runtime.py,sha256=K2cUdzFhbd6uEUpucWptXE89_z-ZNZGsqgd-34usUXk,1890
 sourcecode/client_calls.py,sha256=YOPnfRZzRyqmdHvXSVeiunW8cuiuCuWXacNIQRgKMCw,22640
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
@@ -45,7 +45,7 @@ sourcecode/constraint_diff.py,sha256=hWIO5vsxvHjsgQx23K3r_JMy1W6wQ2Ca4DqB9R_iMnY
 sourcecode/consumer_join.py,sha256=ERwx9SOu0ZE3NgCBYvB0l67iDLnWMdMpVhlCmbA_3Sw,19618
 sourcecode/container_wiring.py,sha256=207Oh4ugGiF0JN-toOCfqTEY2S-30zzZE2r1o0K0Cpo,27511
 sourcecode/context_cache.py,sha256=lIjEGtoZy2eFDvYUVGbG3yhzlIlpdQd-Q5MldXwi0dA,36787
-sourcecode/context_graph.py,sha256=a6v2lgl2DxDnPAWE59K3yg6L5YFDak0LIUff3pi9p0c,47327
+sourcecode/context_graph.py,sha256=-l7XHL7m3GRPXLUps5Be7lSCAQWsQMyA8lR__ejJbr8,47726
 sourcecode/context_scorer.py,sha256=QpChSpsmaAYz91rXA4Ue5xzQmNz_ZboZN09YOHScq1U,14679
 sourcecode/context_summarizer.py,sha256=8a2chqDFvosLrfB2RnK96cnyDMOiuOpi4oK9Rm8Nsfc,6878
 sourcecode/contract_diff.py,sha256=pOvjLm-2YQ4KWD8G9HsPCs6Lkofkk2e2wve_y_QXjtU,10990
@@ -88,7 +88,7 @@ sourcecode/fqn_utils.py,sha256=XLU7zDkNBXz_RZkIUNfpPmp1nekWtqP-fxV92tDV1vg,2158
 sourcecode/functional_routes.py,sha256=KXMrDoBwj_GC80w10FvgA3zddIGE1iW9KjpDtCllSSs,16813
 sourcecode/gate_anchors.py,sha256=26v8wUtzOk1K1Un5uXdUxAu20mqSPX3jo82zuM05ByE,2066
 sourcecode/git_analyzer.py,sha256=irvEwddbd5_tbA_eYUZebf4mH7_nFhpjwaWAV1f7jUY,15755
-sourcecode/git_checkout.py,sha256=pYLQBMKHh43crR_XNRXux86pJ_kqS_mgnXlIsz7ItcI,6024
+sourcecode/git_checkout.py,sha256=aY2lxHfKb5cWcyXGoOrg1dXSH47LGlFBkTcrQgkUPgk,6352
 sourcecode/github_diff.py,sha256=H1woYKuCjb6S9sofBPpMlOpn0L4LoVxuVP7ddnhsNaA,3848
 sourcecode/graph_analyzer.py,sha256=Gw2MzLp0P990TGx6D6Ie-WIPnjWVE6X6dNBQnoM9xPU,65857
 sourcecode/graph_evidence.py,sha256=rENNsYRZeNstX_ExNCLlbHJAruFQwxo5d00x6wO3xwI,15030
@@ -97,11 +97,12 @@ sourcecode/identity_fallback.py,sha256=uRC_j_80uaI4Ue4tf-OhKX4h472dmufYcjEFGSxY2
 sourcecode/integration_coordinates.py,sha256=rvuApnS7WdRUbeQLg_oKj-Gi0koO2RKdw6HenXNgrDo,12443
 sourcecode/intent_router.py,sha256=hC_o0VYfSjzSXecFkpiD7vzFgvt44YAw6E_jrMeGiZ4,15555
 sourcecode/jdk_exports.py,sha256=fCrlwNAXUT9gge_joq6kMnY3zJxYB2pxqy-0w3o3MJI,874
+sourcecode/jvm_inventory.py,sha256=06mlOWSwfs9jBk4lGkCSZHRbapOG41dQ5gopvOVf7dE,14182
 sourcecode/license.py,sha256=eIEuIVQXywl_S9LOIACOEpJ4M5RyaPvWrqg_jSNOrXA,31088
 sourcecode/manifest_cache.py,sha256=qoBn7hPeaMjLHi3higfxsjo7oS7noommRqDnpKP0Ya8,4124
 sourcecode/mcp_nudge.py,sha256=beNjfyb7z09T1rnS4t6Q4qfbLzZQNaP6ddCA4XpmV0s,3256
 sourcecode/metrics_analyzer.py,sha256=gLoRWKygF18jLgwsqmGXSWopw-f5iO1VbM7Jjdif6ag,22809
-sourcecode/migrate_check.py,sha256=BJj_nTnZ0fAIh5X_buL9SR2i5YdilQR3a2mkTgJFwJc,171075
+sourcecode/migrate_check.py,sha256=tUfTpsMUv06JaKpHAbW_TX3ejO_L4iugYCb__lidq4U,171476
 sourcecode/migration_apply.py,sha256=36E9IUq7RbpGVt6RZ8PlSZKgDoEMHorZrXw6UVWPnpw,8692
 sourcecode/migration_blast.py,sha256=OPryWkM6-PbvcG3eJFdcWUnlpXBje41nu2BkrZnE2hg,9359
 sourcecode/non_coverage.py,sha256=Tl04OemPnxnOuWISMF6gAhDYx-P0LP6_l-PbpyvBJb4,30634
@@ -114,7 +115,7 @@ sourcecode/output_encoding.py,sha256=OxiZQtr7uWBDUtblNQviNHsTH1Xo9AZEpsegPlQWKFk
 sourcecode/output_sink.py,sha256=Eya-PnXxqc3RGulJoLhuC9LUF73SZD0aO5O2B0xAMXU,8762
 sourcecode/pack_manifest.py,sha256=Qm6et6SQsFCLc-HJ-Uhz1XlcOa77ZDHgks4JVDEENss,20820
 sourcecode/packs.py,sha256=Oewt8fOkxvr1wwZJc_SOjc6sP_9cmKUzi-WOyVLmb7k,51344
-sourcecode/parallel.py,sha256=xzaOOBmqKjbVNwdV2VHXXrWK57wd5sLYhhYRAnKVcdE,13762
+sourcecode/parallel.py,sha256=tXh5TYJMDD7FDwx1uS4kMB1jTWTvHgCC-HCYJllnwls,13173
 sourcecode/parse_cache.py,sha256=BaPzh-KygmY4OpJQm2YGh6PWztYsj58vHWTu2eSF4s8,38769
 sourcecode/partial_contract.py,sha256=FZUBACkClvRAmPeYVjxNWeQmP6Y22KW4fPeeTfmT80A,5951
 sourcecode/path_admission.py,sha256=5IBfmHvOrSwrVLlXXwj9KAEg-ciVaHYHjcpAS8mriPg,5898
@@ -139,7 +140,7 @@ sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/reference_facts.py,sha256=mx7H-Ax5y8sKAQHrnJCXlgjkUzqZtQTByv9Zy2lxKQQ,15500
 sourcecode/regress.py,sha256=6rlFP2rsIzVKAA0spJ66To528GyBtnRI2Zg9vAGq8kQ,13264
 sourcecode/regulatory_pack.py,sha256=xVWd8hYg6MjGfkFP8UWcYeLmNMxEk8k2uSbTcnGMbhg,3421
-sourcecode/release_info.py,sha256=YKKYdufxyP8x0b4RvmWmnR-Rcm_8lCHn0D-x_BI1irA,5918
+sourcecode/release_info.py,sha256=Z6QP0_dEiEOHdrThbQQqFisSjBj_tku0pjjUyKXXsjM,5918
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/remediation_diff.py,sha256=fGYqPmQF7bO54L8ivztX5PgmW4fVu54gNcG6OEQ192U,9730
 sourcecode/remediation_flow.py,sha256=OFlrNCD2dKw1WlX5cHqVl1yrQZHi2TjCThH8Q3X1PwI,10294
@@ -147,10 +148,10 @@ sourcecode/remediation_report.py,sha256=z28x-u618feU2d7ol_FW7IfhUOq6iETCfdpl7zJC
 sourcecode/remedies.py,sha256=V2_cD4pLq8bKRkzF-3RGFoiu1xWYZS384WDVp1MrlZw,10225
 sourcecode/rename_refactor.py,sha256=oASZIf7TxcOBy3RQ0FuOe-4HlNW_JOu9RW9JqCxGNBE,17225
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=xW3ahhhejolAaQL-EMEjOPYmrxhEx5S_3BNGxTEX56U,523074
+sourcecode/repository_ir.py,sha256=GLYSuPuFqwWdIUtZsUNFctl5DgUaOsDKEK_rwnS-F9g,526567
 sourcecode/resource_budget.py,sha256=Bo-XMvVK9XyHY_S06fVirZrhXgwmnr3XI38-Li55NWY,7767
 sourcecode/ris.py,sha256=HsLVHZfseEHNqMyxrj8SvrzUK7jE_85lsWjHtsEw9ik,29196
-sourcecode/risk.py,sha256=98MhXPM4unAJZFTKKEeAbEjLq4NZ0Wy-66AHQfA3x7c,102506
+sourcecode/risk.py,sha256=rG7fqDIjyhtvB0Qje0d2ZEUl5kemMBwbuOJG8ZJxqrQ,102552
 sourcecode/risk_model.py,sha256=RoC-G15qZP5BLEwwmcr4eJ0APgvIbh1WTqhTVT-5YFE,10895
 sourcecode/rule_catalog.py,sha256=QCx6ToFTMCtDt5uuX1uBMLuw3b9Cd92gGRsX34kud4U,5328
 sourcecode/rule_pass.py,sha256=DTNxD-nAecMJhIzI1LCd9FyRumInQSZjitacNh4Zoc8,14671
@@ -161,7 +162,7 @@ sourcecode/sarif_emit.py,sha256=miFi_DiN58UZyId7DlYzcv-eYLFAA8xdX1AGpoiF4XQ,9353
 sourcecode/scanner.py,sha256=z3CV0rcGunu0Y8mpNgp07wI7nxT0pxw1BkXRRtI0Rpo,9609
 sourcecode/schema.py,sha256=61Ux_qRITs_orcrZM20ctV2k1ZfzauqqMgJlZJYAEbE,25087
 sourcecode/schema_producers.py,sha256=4XzW4wZXnFHOaJT7XenirXGCo0pPZhkdhb7zcDtqFnM,10390
-sourcecode/schema_registry.py,sha256=4PkGSP5PK9AxN_s8fy5zpVNINa4BG-RjJqKrCsr19r4,28871
+sourcecode/schema_registry.py,sha256=UYyHwtruOk6TThyf-SXw36n_qFZAOJF-IyuMulWrT6I,29029
 sourcecode/security_chain.py,sha256=1YZVeFLwy65kntMBhMNvz1cUpOoKCmvEqYICgxs66Gw,6823
 sourcecode/security_config.py,sha256=LUppRDYQK0oKM4qdEOLObaeU3frFTS-paEZo7dMgtY8,5467
 sourcecode/security_config_scan.py,sha256=LU8gfNUBB6wjKR8jkK-qRKtUrbkHZ301_Xsk6hSp4XU,35916
@@ -274,13 +275,13 @@ sourcecode/telemetry/consent.py,sha256=-Wb8BFGXEexOs8M0Eja7F-T6ZtLNPeRoZnHcHvlP7
 sourcecode/telemetry/events.py,sha256=l3Z2SQUO4_C2D2ItXOOdVNimAmHedUHnUxqYFTxnsAE,2900
 sourcecode/telemetry/filters.py,sha256=-lqT2oorECuqEIdeHb--7AZ6BCaUx0bya720a-Z5x6w,7335
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode/_docs/DEFECT-LEDGER.md,sha256=X4PwvNFYNDxjSIiHPP0si8b3YnE6bX_0MM3DMTKA8PE,1167330
+sourcecode/_docs/DEFECT-LEDGER.md,sha256=27Td56IIsaXPz9udDpLMiMDP4RMeaQTh5-FUqucpee4,1167577
 sourcecode/_docs/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
 sourcecode/_docs/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode/_docs/USER_GUIDE.md,sha256=0pScky3oj00MBUgXFA21hZ-TRDVFhATbL3itSIs4-Ro,107847
-sourcecode-5.9.18.dist-info/METADATA,sha256=eSKyx6_6LTKfEgaxVj_mV4UBVS0FI2_hJv4rTE1110g,66101
-sourcecode-5.9.18.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-5.9.18.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-5.9.18.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
-sourcecode-5.9.18.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode-5.9.18.dist-info/RECORD,,
+sourcecode/_docs/USER_GUIDE.md,sha256=A__FLktxJ8S-VMUAQ5OxPRfUkKQ7yKy6FQbWxiZvc6c,108275
+sourcecode-5.9.22.dist-info/METADATA,sha256=Plv_fedlIoI6bKsHB5Q5zFlOlC_nK-KN7gLa34KVsb8,66673
+sourcecode-5.9.22.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-5.9.22.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-5.9.22.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
+sourcecode-5.9.22.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
+sourcecode-5.9.22.dist-info/RECORD,,