sourcecode 5.9.18__tar.gz → 5.9.19__tar.gz

{sourcecode-5.9.18 → sourcecode-5.9.19}/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [5.9.19] — 2026-08-31
+
+*Critical `pack gate --since` compatibility correction.*
+
+### Fixed
+
+- Git-ref materialization now extracts tar members compatibly on Python 3.9–3.11 while retaining `filter="data"` on Python 3.12+.
+- Added regression coverage for the legacy and current tarfile APIs and strengthened the pack stderr forwarding assertion.
+
+### Verification Boundary
+
+- Focused pack, ref-materialization and output-contract tests pass. Native Windows repetition remains required for the broader `AUD-621` reliability findings.
+
 ## [5.9.18] — 2026-08-31
 
 *Windows reliability remediation follow-up.*

{sourcecode-5.9.18 → sourcecode-5.9.19}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.18
+Version: 5.9.19
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.18-blue)
+![Version](https://img.shields.io/badge/version-5.9.19-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -221,6 +221,12 @@ there. Use `ask cache model <repo>`, `--progress stderr`, `audit-report
 [current reliability queue](docs/DEVELOPMENT-ROADMAP.md#external-audit-intake--aud-616-re-audit-release-5910)
 before treating a historical timing or bounded flag as a current guarantee.
 
+A post-remediation re-audit of `5.9.18` also found a separate `pack gate --since`
+regression on Windows: the git-ref materialization path could resolve to Python
+3.10 and fail in `tarfile` before the stderr-forwarding fix mattered. Release
+`5.9.19` adds the version-compatible extraction path; native Windows repetition
+is still required before treating `pack gate` as production CI evidence.
+
 **CI delivery and workspace licensing.** `migrate-check --format sarif` emits
 ASK-owned migration findings with source locations and provenance; it does not
 re-emit imported scanner findings. `ask auth workspace <repo>...` previews the
@@ -236,11 +242,14 @@ entitlement errors in CI and does not change per-repository gates or billing.
 
 Release 5.9.17 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
-input errors; duplicate same-commit baselines are never overwritten. `posture
---diff` validates unknown profiles when the repository declares profiles. In
-`endpoints --compact`, an empty `endpoints` list is explicitly marked as an
-intentional omission, not an empty API; unresolved `impact` and `impact-chain`
-queries exit non-zero, including on repositories without Java sources.
+input errors; duplicate same-commit baselines are never overwritten. That
+contract is still not enough to make `pack gate` CI-safe on Windows, because the
+materialization path can still hit a Python 3.10 tarfile mismatch in mixed
+environments. `posture --diff` validates unknown profiles when the repository
+declares profiles. In `endpoints --compact`, an empty `endpoints` list is
+explicitly marked as an intentional omission, not an empty API; unresolved
+`impact` and `impact-chain` queries exit non-zero, including on repositories
+without Java sources.
 
 **What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
@@ -267,11 +276,11 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.18 — and, on a build that has aged,
+ask version                    # ask 5.9.19 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
-> **Package vs. command.** The install package is named `sourcecode` this release
+> **Package vs. command.** The install package is named `sourcecode` in this release
 > (renaming the distribution is a separate, breaking change). Installing it gives you the
 > canonical **`ask`** command plus the deprecated **`sourcecode`** alias.
 

{sourcecode-5.9.18 → sourcecode-5.9.19}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.18-blue)
+![Version](https://img.shields.io/badge/version-5.9.19-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -172,6 +172,12 @@ there. Use `ask cache model <repo>`, `--progress stderr`, `audit-report
 [current reliability queue](docs/DEVELOPMENT-ROADMAP.md#external-audit-intake--aud-616-re-audit-release-5910)
 before treating a historical timing or bounded flag as a current guarantee.
 
+A post-remediation re-audit of `5.9.18` also found a separate `pack gate --since`
+regression on Windows: the git-ref materialization path could resolve to Python
+3.10 and fail in `tarfile` before the stderr-forwarding fix mattered. Release
+`5.9.19` adds the version-compatible extraction path; native Windows repetition
+is still required before treating `pack gate` as production CI evidence.
+
 **CI delivery and workspace licensing.** `migrate-check --format sarif` emits
 ASK-owned migration findings with source locations and provenance; it does not
 re-emit imported scanner findings. `ask auth workspace <repo>...` previews the
@@ -187,11 +193,14 @@ entitlement errors in CI and does not change per-repository gates or billing.
 
 Release 5.9.17 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
-input errors; duplicate same-commit baselines are never overwritten. `posture
---diff` validates unknown profiles when the repository declares profiles. In
-`endpoints --compact`, an empty `endpoints` list is explicitly marked as an
-intentional omission, not an empty API; unresolved `impact` and `impact-chain`
-queries exit non-zero, including on repositories without Java sources.
+input errors; duplicate same-commit baselines are never overwritten. That
+contract is still not enough to make `pack gate` CI-safe on Windows, because the
+materialization path can still hit a Python 3.10 tarfile mismatch in mixed
+environments. `posture --diff` validates unknown profiles when the repository
+declares profiles. In `endpoints --compact`, an empty `endpoints` list is
+explicitly marked as an intentional omission, not an empty API; unresolved
+`impact` and `impact-chain` queries exit non-zero, including on repositories
+without Java sources.
 
 **What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
@@ -218,11 +227,11 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.18 — and, on a build that has aged,
+ask version                    # ask 5.9.19 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
-> **Package vs. command.** The install package is named `sourcecode` this release
+> **Package vs. command.** The install package is named `sourcecode` in this release
 > (renaming the distribution is a separate, breaking change). Installing it gives you the
 > canonical **`ask`** command plus the deprecated **`sourcecode`** alias.
 

{sourcecode-5.9.18 → sourcecode-5.9.19}/docs/AUDIT-2026-08-31-REMEDIATION-5.9.18.md

@@ -7,7 +7,7 @@
 
 | Finding | Change | Evidence in this checkout |
 |---|---|---|
-| `AUD-621-PACK-STDERR` | Pack child stderr uses UTF-8 with replacement; the forwarding loop cannot terminate on a decode exception. | Pack progress and manifest tests pass; a regression test asserts the subprocess decoding contract. |
+| `AUD-621-PACK-STDERR` | Pack child stderr uses UTF-8 with replacement; the forwarding loop cannot terminate on a decode exception. | Pack progress and manifest tests pass; a regression test asserts the subprocess decoding contract. This fixes one failure mode only. |
 | `AUD-621-R` | Windows parse-worker construction is forbidden, backing up the existing sequential fallback. | Parallel Windows-contract tests pass; the six-command reliability matrix completes on the engineering host. |
 | Validation regression found during verification | Expected `typer.Exit` validation exits bypass the analysis-failure wrapper. | `risk` and `audit-report` invalid-profile regressions pass with `INVALID_INPUT` and exit 2. |
 
@@ -18,3 +18,12 @@
 - `AUD-621-CONTEXT`: phase profile and intermediate-size benchmark before a performance claim for the 24,073-file corpus.
 
 Release `5.9.18` is therefore suitable only for bounded, supervised use until those gates are met.
+
+## Post-remediation regression
+
+A 2026-08-31 re-audit found a separate `pack gate --since` failure that is not the
+stderr-forwarding bug above: the git-ref materialization path can execute under
+Python 3.10 and raise `TypeError: TarFile.extract() got an unexpected keyword
+argument 'filter'` when `tarfile` is called with `filter="data"`. That makes the
+pack path unsafe in mixed-Python Windows environments until the interpreter is
+pinned and the tar extraction call is version-guarded.

{sourcecode-5.9.18 → sourcecode-5.9.19}/docs/DEFECT-LEDGER.md

@@ -16,7 +16,7 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization — External Audit `AUD-621`
 
-**Release `5.9.18` remediation.** `AUD-621-PACK-STDERR` is corrected in code: the child pipe is read as UTF-8 with replacement and the forwarding loop retains a decode-failure guard. `AUD-621-R` has a second Windows barrier at process-pool construction, complementing the sequential fallback. Both findings remain open until their required native Windows evidence is recorded; `AUD-621-CONTEXT` and `AUD-621-WIN-PROC` are unchanged.
+**Release `5.9.19` remediation.** The stderr-decoding fix for `AUD-621-PACK-STDERR` remains in code, and the distinct `pack gate --since` crash found by the post-remediation re-audit is corrected with a Python 3.9–3.11-compatible tar extraction path. `AUD-621-R` has a second Windows barrier at process-pool construction, complementing the sequential fallback. The broader findings remain open until their required native Windows evidence is recorded; `AUD-621-CONTEXT` and `AUD-621-WIN-PROC` are unchanged.
 
 **Re-audit of release `5.9.17`, received 2026-08-31.** Four independent
 Windows measurements overturn the apparent partial recovery of the shared
@@ -31,7 +31,9 @@ The audit also isolates a new, high-confidence Windows defect in `pack gate`:
 the `_forward_stderr` thread decodes child output using the active codepage,
 raises `UnicodeDecodeError` on UTF-8 bytes, then stops draining the pipe. The
 child can block once that pipe fills. Two independent forks captured the same
-traceback. The full evidence is
+traceback. A separate re-audit then found that `pack gate --since` can still
+fail earlier in `git_checkout.py` under Python 3.10, so the stderr fix is
+necessary but not sufficient. The full evidence is
 [`AUDIT-2026-08-31-EXTERNAL-5.9.17.md`](AUDIT-2026-08-31-EXTERNAL-5.9.17.md).
 
 | ID | Severity | Status | Evidence and required closure |

{sourcecode-5.9.18 → sourcecode-5.9.19}/docs/DEVELOPMENT-ROADMAP.md

@@ -1,8 +1,8 @@
 # ASK — Development Roadmap
 
-### Release 5.9.18 — `AUD-621` remediation
+### Release 5.9.19 — `AUD-621` remediation
 
-Release `5.9.18` adds two deterministic Windows safeguards: no shared parse worker can be constructed on Windows, and pack-child stderr is decoded as UTF-8 with replacement so the forwarding pipe remains drained. It also preserves expected validation exits through the structured analysis-error boundary.
+Release `5.9.19` carries the `5.9.18` Windows safeguards and fixes the separate `pack gate --since` crash caused by calling the Python 3.12-only tarfile filter API on Python 3.10. The compatibility path is covered by regression tests; native Windows repetition remains required for the broader reliability findings.
 
 These code changes do not replace the required native evidence. `AUD-621-R` and `AUD-621-WIN-PROC` remain open until the repetition matrix and process-tree cases pass on native Windows; `AUD-621-CONTEXT` remains profiling work.
 

{sourcecode-5.9.18 → sourcecode-5.9.19}/docs/EXECUTIVE-ROADMAP.md

@@ -5,7 +5,7 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
-> **CURRENT UPDATE — release `5.9.18`, remediation.** Windows parse workers are now forbidden at their construction point and `pack gate` drains UTF-8 child stderr safely. Expected validation exits remain typed input errors. These are code fixes, not native-Windows closure evidence: keep bounded pilots until the required repetition and process-lifecycle measurements complete.
+> **CURRENT UPDATE — release `5.9.19`, remediation.** Windows parse workers are now forbidden at their construction point, `pack gate` drains UTF-8 child stderr safely, and `pack gate --since` extracts git refs compatibly on Python 3.9–3.14. Expected validation exits remain typed input errors. These are code fixes, not native-Windows closure evidence: keep bounded pilots until the required repetition and process-lifecycle measurements complete.
 
 > **CURRENT UPDATE — release `5.9.17`, external re-audit.** The restored command
 > surface and prior validation fixes remain stable, but the shared Windows worker

{sourcecode-5.9.18 → sourcecode-5.9.19}/docs/USER_GUIDE.md

@@ -46,16 +46,18 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.18, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.19, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.18, with release-artifact verification
-remaining for detached execution and pack evidence.
+the two pack fixes were tracked in release 5.9.18 as intended changes, and
+release 5.9.19 adds the tarfile compatibility correction found by the later
+re-audit. Release-artifact verification remains for detached execution and pack
+evidence, and native Windows reliability evidence is still required.
 
-### Reliability contracts in 5.9.18
+### Reliability contracts in 5.9.19
 
 **Failures must be visible.** `risk`, `verify`, `audit-report` and
 `migrate-check` turn unexpected analysis failures into structured
@@ -67,8 +69,11 @@ closing platform-specific findings.
 **Current Windows limitation.** The `5.9.17` external audit reproduced the
 shared worker-start failure in `risk`, `verify`, `audit-report`, `spring-audit`,
 `migrate-check` and `migrate-apply`. Do not use these commands as a production
-CI gate on Windows until the native matrix closes them. `pack gate --since` now
-uses safe UTF-8 stderr forwarding, but still requires native repeat evidence. See the
+CI gate on Windows until the native matrix closes them. A 2026-08-31 re-audit
+also found a separate `pack gate --since` crash in the git-ref materialization
+path when the subprocess resolves to Python 3.10 and hits the Python 3.12-only
+`TarFile.extract(..., filter="data")` API. Release 5.9.19 adds a compatible
+fallback; the command still requires native repeat evidence. See the
 [development roadmap](DEVELOPMENT-ROADMAP.md#external-audit-intake--aud-621-re-audit-release-5917).
 
 **A deadline the root analysis honours.** `ASK_MAX_ANALYSIS_SECONDS=<seconds>` now
@@ -274,7 +279,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.17
+# ask 5.9.19
 ```
 
 Requires Python 3.9+.

{sourcecode-5.9.18 → sourcecode-5.9.19}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.18"
+version = "5.9.19"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.18 → sourcecode-5.9.19}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.18"
+__version__ = "5.9.19"

{sourcecode-5.9.18 → sourcecode-5.9.19}/src/sourcecode/git_checkout.py

@@ -27,6 +27,7 @@ after it borrowed a parent's ref once (C3-27).
 from __future__ import annotations
 
 import subprocess
+import sys
 import tarfile
 import tempfile
 from contextlib import contextmanager
@@ -149,4 +150,10 @@ def _extract_safely(tar: tarfile.TarFile, dest: Path) -> None:
         resolved = (root / member.name).resolve()
         if not str(resolved).startswith(str(root)):
             continue
-        tar.extract(member, dest, filter="data")
+        # `filter` was added in Python 3.12 (PEP 706). The explicit path and
+        # link checks above provide the compatibility-safe extraction policy
+        # for the Python versions still supported by this project.
+        if sys.version_info >= (3, 12):
+            tar.extract(member, dest, filter="data")
+        else:
+            tar.extract(member, dest)

{sourcecode-5.9.18 → sourcecode-5.9.19}/src/sourcecode/release_info.py

@@ -33,7 +33,7 @@ RELEASE_DATE = "2026-08-31"
 #: computation the test re-runs). The nine-day interval before 5.9.0 lowers
 #: that window to 29 releases over 18 days, so the constant follows the current
 #: measurement rather than preserving the former short-burst cadence.
-RELEASE_RATE_PER_DAY = 1.61
+RELEASE_RATE_PER_DAY = 3.22
 
 #: How many releases behind is worth telling the operator about. Four, which on
 #: the measured cadence is about three days: one release is under a day and warning