sourcecode 5.9.18__tar.gz → 5.9.22__tar.gz

{sourcecode-5.9.18 → sourcecode-5.9.22}/CHANGELOG.md

@@ -1,5 +1,66 @@
 # Changelog
 
+## [5.9.22] — 2026-08-31
+
+*Large-repository route projection performance.*
+
+### Fixed
+
+- Inherited route projection now resolves parent candidates through a module/name
+  index instead of scanning every class for every child. The ambiguity rule and
+  emitted routes remain unchanged, while cold `--agent --full` improved from about
+  20.5 to 19.6 seconds on openmrs-core and from 32.0 to 30.8 seconds on Jenkins.
+
+### Verification Boundary
+
+- Endpoint, inheritance, canonical IR and migration regression tests pass. Large
+  cold runs remain memory-heavy; reducing the duplicated canonical/raw model is
+  still required before claiming the 8/10 performance target.
+
+## [5.9.21] — 2026-08-31
+
+*Cold-path memory and JVM inventory performance follow-up.*
+
+### Fixed
+
+- Full CIR builds no longer retain every Java source body in the per-file linking
+  queue; the linking pass rereads source only when needed and keeps repository
+  constants and annotation references as compact metadata.
+- Completed linking drops pass-local containers before canonical projection, reducing
+  overlap between raw IR assembly and the canonical model.
+- `migrate-check` JVM inventory reuses the already discovered Java file list instead
+  of walking and rescanning the source tree a second time.
+
+### Verification Boundary
+
+- Focused JVM, CIR cache-equivalence, canonical IR, source-span and migration tests
+  pass. Cold `--agent --full` remains memory-heavy on large repositories: the latest
+  controlled run measured about 710 MB on openmrs-core and 1.24 GB on Jenkins; this
+  release does not claim that the 8/10 performance target is fully reached.
+
+## [5.9.20] — 2026-08-31
+
+*JVM ecosystem evidence and local SBOM inventory.*
+
+### Added
+
+- `migrate-check` now publishes bounded `jvm_inventory` evidence for JVM frameworks, Java runtime declarations in CI/containers, modern JVM patterns and local CycloneDX/SPDX JSON documents.
+- Added deterministic, negative-control and schema-registry coverage for the new inventory.
+- Documented the accepted JVM R&D scope and its explicit no-network/non-coverage boundaries.
+
+## [5.9.19] — 2026-08-31
+
+*Critical `pack gate --since` compatibility correction.*
+
+### Fixed
+
+- Git-ref materialization now extracts tar members compatibly on Python 3.9–3.11 while retaining `filter="data"` on Python 3.12+.
+- Added regression coverage for the legacy and current tarfile APIs and strengthened the pack stderr forwarding assertion.
+
+### Verification Boundary
+
+- Focused pack, ref-materialization and output-contract tests pass. Native Windows repetition remains required for the broader `AUD-621` reliability findings.
+
 ## [5.9.18] — 2026-08-31
 
 *Windows reliability remediation follow-up.*

{sourcecode-5.9.18 → sourcecode-5.9.22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.18
+Version: 5.9.22
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.18-blue)
+![Version](https://img.shields.io/badge/version-5.9.22-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -196,7 +196,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.17 retains the shared Canonical IR
+**Current performance status.** Release 5.9.22 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. It also removes two repeated walks of the same file tree in
@@ -221,6 +221,12 @@ there. Use `ask cache model <repo>`, `--progress stderr`, `audit-report
 [current reliability queue](docs/DEVELOPMENT-ROADMAP.md#external-audit-intake--aud-616-re-audit-release-5910)
 before treating a historical timing or bounded flag as a current guarantee.
 
+A post-remediation re-audit of `5.9.18` also found a separate `pack gate --since`
+regression on Windows: the git-ref materialization path could resolve to Python
+3.10 and fail in `tarfile` before the stderr-forwarding fix mattered. Release
+`5.9.19` adds the version-compatible extraction path; native Windows repetition
+is still required before treating `pack gate` as production CI evidence.
+
 **CI delivery and workspace licensing.** `migrate-check --format sarif` emits
 ASK-owned migration findings with source locations and provenance; it does not
 re-emit imported scanner findings. `ask auth workspace <repo>...` previews the
@@ -236,11 +242,14 @@ entitlement errors in CI and does not change per-repository gates or billing.
 
 Release 5.9.17 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
-input errors; duplicate same-commit baselines are never overwritten. `posture
---diff` validates unknown profiles when the repository declares profiles. In
-`endpoints --compact`, an empty `endpoints` list is explicitly marked as an
-intentional omission, not an empty API; unresolved `impact` and `impact-chain`
-queries exit non-zero, including on repositories without Java sources.
+input errors; duplicate same-commit baselines are never overwritten. That
+contract is still not enough to make `pack gate` CI-safe on Windows, because the
+materialization path can still hit a Python 3.10 tarfile mismatch in mixed
+environments. `posture --diff` validates unknown profiles when the repository
+declares profiles. In `endpoints --compact`, an empty `endpoints` list is
+explicitly marked as an intentional omission, not an empty API; unresolved
+`impact` and `impact-chain` queries exit non-zero, including on repositories
+without Java sources.
 
 **What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
@@ -267,11 +276,11 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.18 — and, on a build that has aged,
+ask version                    # ask 5.9.22 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
-> **Package vs. command.** The install package is named `sourcecode` this release
+> **Package vs. command.** The install package is named `sourcecode` in this release
 > (renaming the distribution is a separate, breaking change). Installing it gives you the
 > canonical **`ask`** command plus the deprecated **`sourcecode`** alias.
 

{sourcecode-5.9.18 → sourcecode-5.9.22}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.18-blue)
+![Version](https://img.shields.io/badge/version-5.9.22-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -147,7 +147,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.17 retains the shared Canonical IR
+**Current performance status.** Release 5.9.22 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. It also removes two repeated walks of the same file tree in
@@ -172,6 +172,12 @@ there. Use `ask cache model <repo>`, `--progress stderr`, `audit-report
 [current reliability queue](docs/DEVELOPMENT-ROADMAP.md#external-audit-intake--aud-616-re-audit-release-5910)
 before treating a historical timing or bounded flag as a current guarantee.
 
+A post-remediation re-audit of `5.9.18` also found a separate `pack gate --since`
+regression on Windows: the git-ref materialization path could resolve to Python
+3.10 and fail in `tarfile` before the stderr-forwarding fix mattered. Release
+`5.9.19` adds the version-compatible extraction path; native Windows repetition
+is still required before treating `pack gate` as production CI evidence.
+
 **CI delivery and workspace licensing.** `migrate-check --format sarif` emits
 ASK-owned migration findings with source locations and provenance; it does not
 re-emit imported scanner findings. `ask auth workspace <repo>...` previews the
@@ -187,11 +193,14 @@ entitlement errors in CI and does not change per-repository gates or billing.
 
 Release 5.9.17 also carries the boundary-contract hardening: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
-input errors; duplicate same-commit baselines are never overwritten. `posture
---diff` validates unknown profiles when the repository declares profiles. In
-`endpoints --compact`, an empty `endpoints` list is explicitly marked as an
-intentional omission, not an empty API; unresolved `impact` and `impact-chain`
-queries exit non-zero, including on repositories without Java sources.
+input errors; duplicate same-commit baselines are never overwritten. That
+contract is still not enough to make `pack gate` CI-safe on Windows, because the
+materialization path can still hit a Python 3.10 tarfile mismatch in mixed
+environments. `posture --diff` validates unknown profiles when the repository
+declares profiles. In `endpoints --compact`, an empty `endpoints` list is
+explicitly marked as an intentional omission, not an empty API; unresolved
+`impact` and `impact-chain` queries exit non-zero, including on repositories
+without Java sources.
 
 **What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
@@ -218,11 +227,11 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.18 — and, on a build that has aged,
+ask version                    # ask 5.9.22 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
-> **Package vs. command.** The install package is named `sourcecode` this release
+> **Package vs. command.** The install package is named `sourcecode` in this release
 > (renaming the distribution is a separate, breaking change). Installing it gives you the
 > canonical **`ask`** command plus the deprecated **`sourcecode`** alias.
 

{sourcecode-5.9.18 → sourcecode-5.9.22}/docs/AUDIT-2026-08-31-REMEDIATION-5.9.18.md

@@ -7,7 +7,7 @@
 
 | Finding | Change | Evidence in this checkout |
 |---|---|---|
-| `AUD-621-PACK-STDERR` | Pack child stderr uses UTF-8 with replacement; the forwarding loop cannot terminate on a decode exception. | Pack progress and manifest tests pass; a regression test asserts the subprocess decoding contract. |
+| `AUD-621-PACK-STDERR` | Pack child stderr uses UTF-8 with replacement; the forwarding loop cannot terminate on a decode exception. | Pack progress and manifest tests pass; a regression test asserts the subprocess decoding contract. This fixes one failure mode only. |
 | `AUD-621-R` | Windows parse-worker construction is forbidden, backing up the existing sequential fallback. | Parallel Windows-contract tests pass; the six-command reliability matrix completes on the engineering host. |
 | Validation regression found during verification | Expected `typer.Exit` validation exits bypass the analysis-failure wrapper. | `risk` and `audit-report` invalid-profile regressions pass with `INVALID_INPUT` and exit 2. |
 
@@ -18,3 +18,12 @@
 - `AUD-621-CONTEXT`: phase profile and intermediate-size benchmark before a performance claim for the 24,073-file corpus.
 
 Release `5.9.18` is therefore suitable only for bounded, supervised use until those gates are met.
+
+## Post-remediation regression
+
+A 2026-08-31 re-audit found a separate `pack gate --since` failure that is not the
+stderr-forwarding bug above: the git-ref materialization path can execute under
+Python 3.10 and raise `TypeError: TarFile.extract() got an unexpected keyword
+argument 'filter'` when `tarfile` is called with `filter="data"`. That makes the
+pack path unsafe in mixed-Python Windows environments until the interpreter is
+pinned and the tar extraction call is version-guarded.

{sourcecode-5.9.18 → sourcecode-5.9.22}/docs/DEFECT-LEDGER.md

@@ -16,7 +16,7 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization — External Audit `AUD-621`
 
-**Release `5.9.18` remediation.** `AUD-621-PACK-STDERR` is corrected in code: the child pipe is read as UTF-8 with replacement and the forwarding loop retains a decode-failure guard. `AUD-621-R` has a second Windows barrier at process-pool construction, complementing the sequential fallback. Both findings remain open until their required native Windows evidence is recorded; `AUD-621-CONTEXT` and `AUD-621-WIN-PROC` are unchanged.
+**Release `5.9.19` remediation.** The stderr-decoding fix for `AUD-621-PACK-STDERR` remains in code, and the distinct `pack gate --since` crash found by the post-remediation re-audit is corrected with a Python 3.9–3.11-compatible tar extraction path. `AUD-621-R` has a second Windows barrier at process-pool construction, complementing the sequential fallback. The broader findings remain open until their required native Windows evidence is recorded; `AUD-621-CONTEXT` and `AUD-621-WIN-PROC` are unchanged.
 
 **Re-audit of release `5.9.17`, received 2026-08-31.** Four independent
 Windows measurements overturn the apparent partial recovery of the shared
@@ -31,7 +31,9 @@ The audit also isolates a new, high-confidence Windows defect in `pack gate`:
 the `_forward_stderr` thread decodes child output using the active codepage,
 raises `UnicodeDecodeError` on UTF-8 bytes, then stops draining the pipe. The
 child can block once that pipe fills. Two independent forks captured the same
-traceback. The full evidence is
+traceback. A separate re-audit then found that `pack gate --since` can still
+fail earlier in `git_checkout.py` under Python 3.10, so the stderr fix is
+necessary but not sufficient. The full evidence is
 [`AUDIT-2026-08-31-EXTERNAL-5.9.17.md`](AUDIT-2026-08-31-EXTERNAL-5.9.17.md).
 
 | ID | Severity | Status | Evidence and required closure |

{sourcecode-5.9.18 → sourcecode-5.9.22}/docs/DEVELOPMENT-ROADMAP.md

@@ -1,11 +1,46 @@
 # ASK — Development Roadmap
 
-### Release 5.9.18 — `AUD-621` remediation
+### Release 5.9.20 — JVM evidence inventory
 
-Release `5.9.18` adds two deterministic Windows safeguards: no shared parse worker can be constructed on Windows, and pack-child stderr is decoded as UTF-8 with replacement so the forwarding pipe remains drained. It also preserves expected validation exits through the structured analysis-error boundary.
+The accepted JVM R&D scope is implemented in `migrate-check`: local framework,
+toolchain, runtime-pattern and Docker/CI evidence plus bounded CycloneDX/SPDX JSON
+reading. The output is advisory and additive; no network, dependency resolution,
+CVE lookup, signature verification or runtime recommendation is performed.
+
+### Performance pass — 2026-08-31
+
+The JVM inventory no longer rediscovers the Java tree inside `migrate-check`: the
+command reuses its already-resolved source population and only discovers local
+configuration, CI, container and SBOM candidates. On the current testing corpus,
+fresh measurements were approximately 4.8 s for `openmrs-core` and 7.6 s for
+`jenkins` using `migrate-check --compact`; no output or readiness semantics changed.
+
+This is a bounded improvement, not closure of the performance target. The remaining
+8/10 work is the cold/full-graph path and high-cost `--agent`, `posture`, `risk` and
+`impact-chain` cases. Those require separate profiling and memory measurements before
+claiming a broad speedup.
+
+### Release 5.9.19 — `AUD-621` remediation
+
+Release `5.9.19` carries the `5.9.18` Windows safeguards and fixes the separate `pack gate --since` crash caused by calling the Python 3.12-only tarfile filter API on Python 3.10. The compatibility path is covered by regression tests; native Windows repetition remains required for the broader reliability findings.
 
 These code changes do not replace the required native evidence. `AUD-621-R` and `AUD-621-WIN-PROC` remain open until the repetition matrix and process-tree cases pass on native Windows; `AUD-621-CONTEXT` remains profiling work.
 
+### JVM I+D triage — accepted scope from 2026-08-31
+
+The external JVM report has been depurated against primary sources and the current
+ASK route. It receives a limited green light: extend `migrate-check` with a
+source-backed JDK/build/framework inventory (P0), then add small detectors for
+virtual threads, `ScopedValue`, modules, native-image/jlink/jpackage and Java
+versions declared by CI or containers (P1). The decision record, accepted facts,
+rejected scope and sources are in
+[`RD-JVM-ASK-TRIAGE-2026-08-31.md`](RD-JVM-ASK-TRIAGE-2026-08-31.md).
+
+This does not authorize embeddings, hosted vector search, APM/repository
+integrations, Sigstore verification, CVE database work or prescriptive runtime
+tuning. A local CycloneDX/SPDX reader remains a conditional P2 experiment and
+must preserve ASK's no-network, source-evidence and non-coverage contracts.
+
 ### External Audit Intake — `AUD-621` re-audit, release 5.9.17
 
 The 2026-08-31 re-audit corrects the optimistic interpretation of the previous

{sourcecode-5.9.18 → sourcecode-5.9.22}/docs/EXECUTIVE-ROADMAP.md

@@ -5,7 +5,7 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
-> **CURRENT UPDATE — release `5.9.18`, remediation.** Windows parse workers are now forbidden at their construction point and `pack gate` drains UTF-8 child stderr safely. Expected validation exits remain typed input errors. These are code fixes, not native-Windows closure evidence: keep bounded pilots until the required repetition and process-lifecycle measurements complete.
+> **CURRENT UPDATE — release `5.9.19`, remediation.** Windows parse workers are now forbidden at their construction point, `pack gate` drains UTF-8 child stderr safely, and `pack gate --since` extracts git refs compatibly on Python 3.9–3.14. Expected validation exits remain typed input errors. These are code fixes, not native-Windows closure evidence: keep bounded pilots until the required repetition and process-lifecycle measurements complete.
 
 > **CURRENT UPDATE — release `5.9.17`, external re-audit.** The restored command
 > surface and prior validation fixes remain stable, but the shared Windows worker

sourcecode-5.9.22/docs/RD-JVM-ASK-TRIAGE-2026-08-31.md

@@ -0,0 +1,78 @@
+# Depuracion I+D JVM para ASK
+
+**Fecha:** 2026-08-31  
+**Entrada:** informe externo sobre novedades del ecosistema JVM 2025-2026  
+**Decision:** luz verde parcial para inventario y deteccion estructural; no para ampliar ASK a busqueda vectorial, APM o integraciones externas.
+
+## Criterio
+
+Una propuesta entra en el roadmap solo si cumple las cuatro condiciones siguientes:
+
+- aporta un hecho que ASK pueda verificar localmente;
+- puede publicarse con ruta y linea de evidencia;
+- no requiere red, credenciales ni una base externa durante el analisis;
+- mejora una pregunta que ASK ya responde sobre modernizacion, arquitectura o seguridad del cambio.
+
+El informe original es util como lista de hipotesis, pero no como inventario de actualidad: mezcla releases confirmadas, roadmaps, previsiones y afirmaciones de proveedor sin enlaces reproducibles. Las versiones concretas no se convierten en reglas hasta que exista una fuente primaria y una prueba sobre un repositorio fixture.
+
+## Hechos aceptados
+
+| Area | Hecho verificable | Uso en ASK |
+|---|---|---|
+| JDK 25 | `import module` esta finalizado en JEP 511; los archivos fuente compactos y los `main` de instancia pertenecen a JEP 512. | Detectar sintaxis y declarar el nivel de lenguaje observado, sin recomendar una migracion automaticamente. |
+| Spring | Spring Framework 7 y Spring Boot 4.0 mantienen Java 17 como baseline y adoptan Java 25 como foco. | Extender la evidencia de version/framework de `migrate-check` y separar Boot 3/4. |
+| Quarkus | Quarkus 3.31 declara soporte para Java 25, incluyendo runtime images y native builds con Mandrel. | Reconocer toolchain y empaquetado, sin inferir que Java 25 sea una recomendacion para todos los proyectos. |
+| Jakarta EE | Jakarta EE 11 requiere Java 17 o superior e incorpora Jakarta Data 1.0, soporte para records y recursos basados en virtual threads. | Mejorar la lectura de stack y de requisitos de plataforma. |
+| Gradle | Gradle 9 requiere JVM 17 o superior para ejecutar el daemon; toolchains permiten compilar para niveles diferentes. | Separar JVM del build y nivel de compilacion en el inventario. |
+| SBOM | CycloneDX 1.7 y SPDX 3.0 son formatos publicos con esquemas y serializaciones verificables. | Posible entrada local futura; no implica una base CVE ni una integracion de repositorio. |
+
+Fuentes primarias: [JEP 511](https://openjdk.org/jeps/8344700), [Spring Framework 7](https://spring.io/blog/2025/11/13/spring-framework-7-0-general-availability), [Spring Boot 4.0](https://spring.io/blog/2025/11/20/spring-boot-4-0-0-available-now), [Quarkus 3.31](https://quarkus.io/blog/quarkus-3-31-released/), [Jakarta EE 11](https://jakarta.ee/specifications/platform/11/), [Gradle 9](https://docs.gradle.org/current/userguide/upgrading_major_version_9.html), [CycloneDX](https://cyclonedx.org/specification/overview/) y [SPDX](https://spdx.dev/use/specifications/).
+
+## Propuestas aceptadas
+
+### P0 — Inventario de toolchain y framework
+
+Ampliar el inventario existente de `migrate-check` para publicar, cuando haya evidencia:
+
+- version de lenguaje/JDK objetivo y version de runtime declarada;
+- proveedor o distribucion JDK solo cuando aparece de forma explicita;
+- Maven/Gradle, wrapper, plugin y toolchain;
+- Spring Boot, Spring Framework, Hibernate, Jakarta EE, Quarkus y Micronaut;
+- separacion entre "declarado por build", "detectado en codigo" y "no observado".
+
+No se debe resolver una version consultando Maven Central ni inferir el proveedor a partir de una imagen generica. La salida debe conservar el modelo actual de ASK: hecho, fuente, confianza y no cobertura.
+
+### P1 — Patrones JVM con evidencia
+
+Añadir detecciones pequenas y especificas para:
+
+- `Thread.ofVirtual`, `Executors.newVirtualThreadPerTaskExecutor` y APIs equivalentes;
+- `ScopedValue`;
+- `module-info.java` e instrucciones de empaquetado `jlink`, `jpackage` y `native-image`;
+- version de Java en Dockerfiles y pipelines CI cuando el fichero esta en el repositorio.
+
+Cada detector debe producir una observacion `archivo:linea`, evitar recomendaciones normativas y no alterar las poblaciones actuales de endpoints, riesgo o impacto. Si un patron no puede confirmarse, debe quedar como `unknown` o no observado, nunca como ausencia.
+
+### P2 — Entrada local de SBOM, incorporada
+
+Se incorpora el parseo local de SBOM CycloneDX/SPDX en JSON ya presentes en el repositorio. El alcance se limita a formato, version y coordenadas de componentes. Quedan fuera la consulta de CVEs, la validacion de licencias, la verificacion Sigstore, la conexion con Artifactory/Nexus y el almacenamiento de claves.
+
+La implementacion se ejecuta sin red y con limites de tamano. No confunde "componente declarado" con "vulnerabilidad explotable"; XML y documentos no reconocidos permanecen fuera del alcance explicito.
+
+## No aprobado
+
+- Embeddings, Qdrant/Pinecone y busqueda semantica como camino principal: coste, deriva y falta de evidencia de que la busqueda estructural actual sea el cuello de botella.
+- Subida o correlacion de perfiles JFR/async-profiler: superficie de privacidad y operacion fuera del producto actual.
+- Plugins directos para APM, Artifactory, Nexus, Sigstore o proveedores JDK: dependencia externa y coste de mantenimiento desproporcionado.
+- Recomendaciones automaticas de GC, Java 25 o framework: el repositorio no prueba por si solo la carga de produccion ni la compatibilidad operacional.
+- Extender ASK a Docker/Kubernetes/Go como analizador general: no es una consecuencia de detectar un fichero de pipeline o una imagen base.
+
+## Criterios de cierre
+
+La iniciativa no se considera hecha por reconocer una cadena. Debe aportar fixtures de Maven y Gradle, al menos un proyecto Spring Boot, uno Quarkus o Jakarta, un Dockerfile/CI con version Java y controles negativos. La bateria debe comprobar:
+
+- evidencia de archivo y linea;
+- determinismo frio/caliente y ausencia de red;
+- distincion entre declarado, observado y desconocido;
+- no regresion byte a byte de los payloads existentes cuando los nuevos campos no aplican;
+- limites de salida y no mutacion del repositorio.

{sourcecode-5.9.18 → sourcecode-5.9.22}/docs/USER_GUIDE.md

@@ -46,16 +46,18 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.18, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.19, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.18, with release-artifact verification
-remaining for detached execution and pack evidence.
+the two pack fixes were tracked in release 5.9.18 as intended changes, and
+release 5.9.19 adds the tarfile compatibility correction found by the later
+re-audit. Release-artifact verification remains for detached execution and pack
+evidence, and native Windows reliability evidence is still required.
 
-### Reliability contracts in 5.9.18
+### Reliability contracts in 5.9.19
 
 **Failures must be visible.** `risk`, `verify`, `audit-report` and
 `migrate-check` turn unexpected analysis failures into structured
@@ -67,8 +69,11 @@ closing platform-specific findings.
 **Current Windows limitation.** The `5.9.17` external audit reproduced the
 shared worker-start failure in `risk`, `verify`, `audit-report`, `spring-audit`,
 `migrate-check` and `migrate-apply`. Do not use these commands as a production
-CI gate on Windows until the native matrix closes them. `pack gate --since` now
-uses safe UTF-8 stderr forwarding, but still requires native repeat evidence. See the
+CI gate on Windows until the native matrix closes them. A 2026-08-31 re-audit
+also found a separate `pack gate --since` crash in the git-ref materialization
+path when the subprocess resolves to Python 3.10 and hits the Python 3.12-only
+`TarFile.extract(..., filter="data")` API. Release 5.9.19 adds a compatible
+fallback; the command still requires native repeat evidence. See the
 [development roadmap](DEVELOPMENT-ROADMAP.md#external-audit-intake--aud-621-re-audit-release-5917).
 
 **A deadline the root analysis honours.** `ASK_MAX_ANALYSIS_SECONDS=<seconds>` now
@@ -274,7 +279,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.17
+# ask 5.9.19
 ```
 
 Requires Python 3.9+.
@@ -327,7 +332,7 @@ value in field use, and they are the ones to learn first:
 | `ask posture . --diff dev:prod` | The only command that answers *"what changes about effective access between two profile sets, across every endpoint at once"*. Experimental, and the most differentiated capability in the product. |
 | `ask endpoints .` | Every REST endpoint with its **effective path** (context-path + `spring.mvc.servlet.path` resolved), inferred security policy and per-endpoint confidence. Turns "audit the API" into a list. |
 | `ask spring-audit .` | Transactional anomalies that a compiler cannot see — `@Transactional` on a private method is a silent CGLIB no-op — plus the security surface. |
-| `ask migrate-check . --compact` | Boot 2→3 readiness plus Java LTS/licensing inventory: blockers, effort, target JDK evidence and explicit licensing-review signals. |
+| `ask migrate-check . --compact` | Boot 2→3 readiness plus Java LTS/licensing and local JVM ecosystem inventory: blockers, effort, target JDK evidence, framework/runtime signals and explicit licensing-review signals. |
 
 Everything else is either a projection of the same model (`impact`, `export`, `explain`) or an
 agent-facing packaging of it (`--compact`, `--agent`, `prepare-context`). The full surface is

{sourcecode-5.9.18 → sourcecode-5.9.22}/docs/migrate-check.md

@@ -97,6 +97,30 @@ resolved for this field, and ASK does not make a legal entitlement claim. If the
 not declare a Java version, the inventory reports `java_version_unknown`; it never treats missing
 evidence as ready for the target LTS.
 
+## JVM ecosystem inventory (`jvm_inventory`)
+
+The report also includes `jvm_inventory` (`jvm-inventory-v1`), a bounded and
+advisory evidence block for modernization planning. It records local build
+coordinates and source imports for Spring Boot/Framework, Hibernate, Jakarta EE,
+Quarkus and Micronaut, plus evidence for virtual threads, `ScopedValue`, Java
+modules, `native-image`, `jlink`, `jpackage`, and Java versions declared in Docker
+or CI files. Source/build evidence includes a POSIX path and line number; SBOM
+documents include their local path and format/version.
+
+Frameworks are classified as `declared_only`, `observed_only`,
+`declared_and_observed`, or `unobserved`; missing evidence is not a positive claim.
+The scanner reads local text only, caps its file/evidence population, does not
+execute Maven/Gradle, resolve dependencies, access the network, inspect a CVE
+database, or make runtime recommendations. It is additive and does not affect
+readiness, findings, effort, or existing endpoint populations.
+
+The conditional P2 SBOM reader is available under `jvm_inventory.sbom` for
+local CycloneDX JSON (`bomFormat`) and SPDX JSON (`spdxVersion`) documents. It
+reports document format/version and bounded component coordinates only. It does
+not query CVE or license databases, verify signatures, contact artifact
+repositories, or make a supply-chain verdict. XML SBOMs and unrecognized JSON
+remain outside this reader and are not interpreted.
+
 ## Claim provenance (`evidence_manifest`)
 
 Every JSON report also includes `evidence_manifest`: a compact index of the claims already

sourcecode-5.9.22/docs/perf/baselines/5.9.22/petclinic__ask__cold.json

@@ -0,0 +1,59 @@
+{
+  "schema_version": "perf-baseline-v1",
+  "tool_version": "5.9.22",
+  "captured_at": "2026-09-01T08:51:30Z",
+  "command": "ask",
+  "repo": {
+    "name": "spring-petclinic",
+    "commit": "45649e0",
+    "files": 47,
+    "bytes": 123264,
+    "classes": 25,
+    "methods": 72
+  },
+  "scale_dimensions": {
+    "files": 47,
+    "classes": 25,
+    "methods": 72
+  },
+  "scale_dimensions_basis": "The repository axes this timing is expected to scale over. A performance claim without these dimensions is not comparable across repositories.",
+  "mode": "cold",
+  "runs": 2,
+  "wall_ms": {
+    "p50": 742.306,
+    "p95": 753.485,
+    "min": 729.885,
+    "max": 754.727
+  },
+  "phase_ms": {
+    "discovery": {
+      "p50": 6.152,
+      "p95": 6.238
+    },
+    "detection": {
+      "p50": 19.386,
+      "p95": 19.954
+    },
+    "analysis": {
+      "p50": 126.555,
+      "p95": 127.517
+    },
+    "serialize": {
+      "p50": 0.898,
+      "p95": 0.906
+    },
+    "unattributed_p50": 589.315
+  },
+  "rss_peak_bytes": {
+    "p50": 75284480.0,
+    "p95": 75284480.0
+  },
+  "env": {
+    "python": "3.14.6",
+    "os": "darwin",
+    "cpu": "arm",
+    "cores": 8,
+    "hostname_hash": "3972fec0",
+    "host_id_declared": false
+  }
+}

sourcecode-5.9.22/docs/perf/baselines/5.9.22/petclinic__ask__warm.json

@@ -0,0 +1,47 @@
+{
+  "schema_version": "perf-baseline-v1",
+  "tool_version": "5.9.22",
+  "captured_at": "2026-09-01T08:51:32Z",
+  "command": "ask",
+  "repo": {
+    "name": "spring-petclinic",
+    "commit": "45649e0",
+    "files": 47,
+    "bytes": 123264,
+    "classes": 25,
+    "methods": 72
+  },
+  "scale_dimensions": {
+    "files": 47,
+    "classes": 25,
+    "methods": 72
+  },
+  "scale_dimensions_basis": "The repository axes this timing is expected to scale over. A performance claim without these dimensions is not comparable across repositories.",
+  "mode": "warm",
+  "runs": 2,
+  "wall_ms": {
+    "p50": 352.405,
+    "p95": 356.578,
+    "min": 347.768,
+    "max": 357.042
+  },
+  "phase_ms": {
+    "discovery": null,
+    "detection": null,
+    "analysis": null,
+    "serialize": null,
+    "instrumentation": "absent"
+  },
+  "rss_peak_bytes": {
+    "p50": 75284480.0,
+    "p95": 75284480.0
+  },
+  "env": {
+    "python": "3.14.6",
+    "os": "darwin",
+    "cpu": "arm",
+    "cores": 8,
+    "hostname_hash": "3972fec0",
+    "host_id_declared": false
+  }
+}

{sourcecode-5.9.18 → sourcecode-5.9.22}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.18"
+version = "5.9.22"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.18 → sourcecode-5.9.22}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.18"
+__version__ = "5.9.22"

{sourcecode-5.9.18 → sourcecode-5.9.22}/src/sourcecode/canonical_ir.py

@@ -528,10 +528,17 @@ def ir_dict_to_canonical(
         files = sorted(file_set)
 
     # Sorted call graph edges — stable ordering: from, type, to
-    call_graph = sorted(
-        edges,
-        key=lambda e: (e.get("from", ""), e.get("type", ""), e.get("to", "")),
-    )
+    # The raw graph is owned by this CIR conversion and its edge order is not
+    # observable until after conversion. Sort in place instead of creating a
+    # second repository-sized list during the raw/CIR overlap peak.
+    if isinstance(edges, list):
+        edges.sort(key=lambda e: (e.get("from", ""), e.get("type", ""), e.get("to", "")))
+        call_graph = edges
+    else:
+        call_graph = sorted(
+            edges,
+            key=lambda e: (e.get("from", ""), e.get("type", ""), e.get("to", "")),
+        )
 
     # Dependency edges (structural subset of call_graph)
     _dep_types = frozenset({"imports", "extends", "implements", "injects"})