sourcecode 5.9.19__tar.gz → 5.9.22__tar.gz

{sourcecode-5.9.19 → sourcecode-5.9.22}/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+## [5.9.22] — 2026-08-31
+
+*Large-repository route projection performance.*
+
+### Fixed
+
+- Inherited route projection now resolves parent candidates through a module/name
+  index instead of scanning every class for every child. The ambiguity rule and
+  emitted routes remain unchanged, while cold `--agent --full` improved from about
+  20.5 to 19.6 seconds on openmrs-core and from 32.0 to 30.8 seconds on Jenkins.
+
+### Verification Boundary
+
+- Endpoint, inheritance, canonical IR and migration regression tests pass. Large
+  cold runs remain memory-heavy; reducing the duplicated canonical/raw model is
+  still required before claiming the 8/10 performance target.
+
+## [5.9.21] — 2026-08-31
+
+*Cold-path memory and JVM inventory performance follow-up.*
+
+### Fixed
+
+- Full CIR builds no longer retain every Java source body in the per-file linking
+  queue; the linking pass rereads source only when needed and keeps repository
+  constants and annotation references as compact metadata.
+- Completed linking drops pass-local containers before canonical projection, reducing
+  overlap between raw IR assembly and the canonical model.
+- `migrate-check` JVM inventory reuses the already discovered Java file list instead
+  of walking and rescanning the source tree a second time.
+
+### Verification Boundary
+
+- Focused JVM, CIR cache-equivalence, canonical IR, source-span and migration tests
+  pass. Cold `--agent --full` remains memory-heavy on large repositories: the latest
+  controlled run measured about 710 MB on openmrs-core and 1.24 GB on Jenkins; this
+  release does not claim that the 8/10 performance target is fully reached.
+
+## [5.9.20] — 2026-08-31
+
+*JVM ecosystem evidence and local SBOM inventory.*
+
+### Added
+
+- `migrate-check` now publishes bounded `jvm_inventory` evidence for JVM frameworks, Java runtime declarations in CI/containers, modern JVM patterns and local CycloneDX/SPDX JSON documents.
+- Added deterministic, negative-control and schema-registry coverage for the new inventory.
+- Documented the accepted JVM R&D scope and its explicit no-network/non-coverage boundaries.
+
 ## [5.9.19] — 2026-08-31
 
 *Critical `pack gate --since` compatibility correction.*

{sourcecode-5.9.19 → sourcecode-5.9.22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.19
+Version: 5.9.22
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.19-blue)
+![Version](https://img.shields.io/badge/version-5.9.22-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -196,7 +196,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.17 retains the shared Canonical IR
+**Current performance status.** Release 5.9.22 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. It also removes two repeated walks of the same file tree in
@@ -276,7 +276,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.19 — and, on a build that has aged,
+ask version                    # ask 5.9.22 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.19 → sourcecode-5.9.22}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.19-blue)
+![Version](https://img.shields.io/badge/version-5.9.22-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -147,7 +147,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.17 retains the shared Canonical IR
+**Current performance status.** Release 5.9.22 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. It also removes two repeated walks of the same file tree in
@@ -227,7 +227,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.19 — and, on a build that has aged,
+ask version                    # ask 5.9.22 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.19 → sourcecode-5.9.22}/docs/DEVELOPMENT-ROADMAP.md

@@ -1,11 +1,46 @@
 # ASK — Development Roadmap
 
+### Release 5.9.20 — JVM evidence inventory
+
+The accepted JVM R&D scope is implemented in `migrate-check`: local framework,
+toolchain, runtime-pattern and Docker/CI evidence plus bounded CycloneDX/SPDX JSON
+reading. The output is advisory and additive; no network, dependency resolution,
+CVE lookup, signature verification or runtime recommendation is performed.
+
+### Performance pass — 2026-08-31
+
+The JVM inventory no longer rediscovers the Java tree inside `migrate-check`: the
+command reuses its already-resolved source population and only discovers local
+configuration, CI, container and SBOM candidates. On the current testing corpus,
+fresh measurements were approximately 4.8 s for `openmrs-core` and 7.6 s for
+`jenkins` using `migrate-check --compact`; no output or readiness semantics changed.
+
+This is a bounded improvement, not closure of the performance target. The remaining
+8/10 work is the cold/full-graph path and high-cost `--agent`, `posture`, `risk` and
+`impact-chain` cases. Those require separate profiling and memory measurements before
+claiming a broad speedup.
+
 ### Release 5.9.19 — `AUD-621` remediation
 
 Release `5.9.19` carries the `5.9.18` Windows safeguards and fixes the separate `pack gate --since` crash caused by calling the Python 3.12-only tarfile filter API on Python 3.10. The compatibility path is covered by regression tests; native Windows repetition remains required for the broader reliability findings.
 
 These code changes do not replace the required native evidence. `AUD-621-R` and `AUD-621-WIN-PROC` remain open until the repetition matrix and process-tree cases pass on native Windows; `AUD-621-CONTEXT` remains profiling work.
 
+### JVM I+D triage — accepted scope from 2026-08-31
+
+The external JVM report has been depurated against primary sources and the current
+ASK route. It receives a limited green light: extend `migrate-check` with a
+source-backed JDK/build/framework inventory (P0), then add small detectors for
+virtual threads, `ScopedValue`, modules, native-image/jlink/jpackage and Java
+versions declared by CI or containers (P1). The decision record, accepted facts,
+rejected scope and sources are in
+[`RD-JVM-ASK-TRIAGE-2026-08-31.md`](RD-JVM-ASK-TRIAGE-2026-08-31.md).
+
+This does not authorize embeddings, hosted vector search, APM/repository
+integrations, Sigstore verification, CVE database work or prescriptive runtime
+tuning. A local CycloneDX/SPDX reader remains a conditional P2 experiment and
+must preserve ASK's no-network, source-evidence and non-coverage contracts.
+
 ### External Audit Intake — `AUD-621` re-audit, release 5.9.17
 
 The 2026-08-31 re-audit corrects the optimistic interpretation of the previous

sourcecode-5.9.22/docs/RD-JVM-ASK-TRIAGE-2026-08-31.md

@@ -0,0 +1,78 @@
+# Depuracion I+D JVM para ASK
+
+**Fecha:** 2026-08-31  
+**Entrada:** informe externo sobre novedades del ecosistema JVM 2025-2026  
+**Decision:** luz verde parcial para inventario y deteccion estructural; no para ampliar ASK a busqueda vectorial, APM o integraciones externas.
+
+## Criterio
+
+Una propuesta entra en el roadmap solo si cumple las cuatro condiciones siguientes:
+
+- aporta un hecho que ASK pueda verificar localmente;
+- puede publicarse con ruta y linea de evidencia;
+- no requiere red, credenciales ni una base externa durante el analisis;
+- mejora una pregunta que ASK ya responde sobre modernizacion, arquitectura o seguridad del cambio.
+
+El informe original es util como lista de hipotesis, pero no como inventario de actualidad: mezcla releases confirmadas, roadmaps, previsiones y afirmaciones de proveedor sin enlaces reproducibles. Las versiones concretas no se convierten en reglas hasta que exista una fuente primaria y una prueba sobre un repositorio fixture.
+
+## Hechos aceptados
+
+| Area | Hecho verificable | Uso en ASK |
+|---|---|---|
+| JDK 25 | `import module` esta finalizado en JEP 511; los archivos fuente compactos y los `main` de instancia pertenecen a JEP 512. | Detectar sintaxis y declarar el nivel de lenguaje observado, sin recomendar una migracion automaticamente. |
+| Spring | Spring Framework 7 y Spring Boot 4.0 mantienen Java 17 como baseline y adoptan Java 25 como foco. | Extender la evidencia de version/framework de `migrate-check` y separar Boot 3/4. |
+| Quarkus | Quarkus 3.31 declara soporte para Java 25, incluyendo runtime images y native builds con Mandrel. | Reconocer toolchain y empaquetado, sin inferir que Java 25 sea una recomendacion para todos los proyectos. |
+| Jakarta EE | Jakarta EE 11 requiere Java 17 o superior e incorpora Jakarta Data 1.0, soporte para records y recursos basados en virtual threads. | Mejorar la lectura de stack y de requisitos de plataforma. |
+| Gradle | Gradle 9 requiere JVM 17 o superior para ejecutar el daemon; toolchains permiten compilar para niveles diferentes. | Separar JVM del build y nivel de compilacion en el inventario. |
+| SBOM | CycloneDX 1.7 y SPDX 3.0 son formatos publicos con esquemas y serializaciones verificables. | Posible entrada local futura; no implica una base CVE ni una integracion de repositorio. |
+
+Fuentes primarias: [JEP 511](https://openjdk.org/jeps/8344700), [Spring Framework 7](https://spring.io/blog/2025/11/13/spring-framework-7-0-general-availability), [Spring Boot 4.0](https://spring.io/blog/2025/11/20/spring-boot-4-0-0-available-now), [Quarkus 3.31](https://quarkus.io/blog/quarkus-3-31-released/), [Jakarta EE 11](https://jakarta.ee/specifications/platform/11/), [Gradle 9](https://docs.gradle.org/current/userguide/upgrading_major_version_9.html), [CycloneDX](https://cyclonedx.org/specification/overview/) y [SPDX](https://spdx.dev/use/specifications/).
+
+## Propuestas aceptadas
+
+### P0 — Inventario de toolchain y framework
+
+Ampliar el inventario existente de `migrate-check` para publicar, cuando haya evidencia:
+
+- version de lenguaje/JDK objetivo y version de runtime declarada;
+- proveedor o distribucion JDK solo cuando aparece de forma explicita;
+- Maven/Gradle, wrapper, plugin y toolchain;
+- Spring Boot, Spring Framework, Hibernate, Jakarta EE, Quarkus y Micronaut;
+- separacion entre "declarado por build", "detectado en codigo" y "no observado".
+
+No se debe resolver una version consultando Maven Central ni inferir el proveedor a partir de una imagen generica. La salida debe conservar el modelo actual de ASK: hecho, fuente, confianza y no cobertura.
+
+### P1 — Patrones JVM con evidencia
+
+Añadir detecciones pequenas y especificas para:
+
+- `Thread.ofVirtual`, `Executors.newVirtualThreadPerTaskExecutor` y APIs equivalentes;
+- `ScopedValue`;
+- `module-info.java` e instrucciones de empaquetado `jlink`, `jpackage` y `native-image`;
+- version de Java en Dockerfiles y pipelines CI cuando el fichero esta en el repositorio.
+
+Cada detector debe producir una observacion `archivo:linea`, evitar recomendaciones normativas y no alterar las poblaciones actuales de endpoints, riesgo o impacto. Si un patron no puede confirmarse, debe quedar como `unknown` o no observado, nunca como ausencia.
+
+### P2 — Entrada local de SBOM, incorporada
+
+Se incorpora el parseo local de SBOM CycloneDX/SPDX en JSON ya presentes en el repositorio. El alcance se limita a formato, version y coordenadas de componentes. Quedan fuera la consulta de CVEs, la validacion de licencias, la verificacion Sigstore, la conexion con Artifactory/Nexus y el almacenamiento de claves.
+
+La implementacion se ejecuta sin red y con limites de tamano. No confunde "componente declarado" con "vulnerabilidad explotable"; XML y documentos no reconocidos permanecen fuera del alcance explicito.
+
+## No aprobado
+
+- Embeddings, Qdrant/Pinecone y busqueda semantica como camino principal: coste, deriva y falta de evidencia de que la busqueda estructural actual sea el cuello de botella.
+- Subida o correlacion de perfiles JFR/async-profiler: superficie de privacidad y operacion fuera del producto actual.
+- Plugins directos para APM, Artifactory, Nexus, Sigstore o proveedores JDK: dependencia externa y coste de mantenimiento desproporcionado.
+- Recomendaciones automaticas de GC, Java 25 o framework: el repositorio no prueba por si solo la carga de produccion ni la compatibilidad operacional.
+- Extender ASK a Docker/Kubernetes/Go como analizador general: no es una consecuencia de detectar un fichero de pipeline o una imagen base.
+
+## Criterios de cierre
+
+La iniciativa no se considera hecha por reconocer una cadena. Debe aportar fixtures de Maven y Gradle, al menos un proyecto Spring Boot, uno Quarkus o Jakarta, un Dockerfile/CI con version Java y controles negativos. La bateria debe comprobar:
+
+- evidencia de archivo y linea;
+- determinismo frio/caliente y ausencia de red;
+- distincion entre declarado, observado y desconocido;
+- no regresion byte a byte de los payloads existentes cuando los nuevos campos no aplican;
+- limites de salida y no mutacion del repositorio.

{sourcecode-5.9.19 → sourcecode-5.9.22}/docs/USER_GUIDE.md

@@ -332,7 +332,7 @@ value in field use, and they are the ones to learn first:
 | `ask posture . --diff dev:prod` | The only command that answers *"what changes about effective access between two profile sets, across every endpoint at once"*. Experimental, and the most differentiated capability in the product. |
 | `ask endpoints .` | Every REST endpoint with its **effective path** (context-path + `spring.mvc.servlet.path` resolved), inferred security policy and per-endpoint confidence. Turns "audit the API" into a list. |
 | `ask spring-audit .` | Transactional anomalies that a compiler cannot see — `@Transactional` on a private method is a silent CGLIB no-op — plus the security surface. |
-| `ask migrate-check . --compact` | Boot 2→3 readiness plus Java LTS/licensing inventory: blockers, effort, target JDK evidence and explicit licensing-review signals. |
+| `ask migrate-check . --compact` | Boot 2→3 readiness plus Java LTS/licensing and local JVM ecosystem inventory: blockers, effort, target JDK evidence, framework/runtime signals and explicit licensing-review signals. |
 
 Everything else is either a projection of the same model (`impact`, `export`, `explain`) or an
 agent-facing packaging of it (`--compact`, `--agent`, `prepare-context`). The full surface is

{sourcecode-5.9.19 → sourcecode-5.9.22}/docs/migrate-check.md

@@ -97,6 +97,30 @@ resolved for this field, and ASK does not make a legal entitlement claim. If the
 not declare a Java version, the inventory reports `java_version_unknown`; it never treats missing
 evidence as ready for the target LTS.
 
+## JVM ecosystem inventory (`jvm_inventory`)
+
+The report also includes `jvm_inventory` (`jvm-inventory-v1`), a bounded and
+advisory evidence block for modernization planning. It records local build
+coordinates and source imports for Spring Boot/Framework, Hibernate, Jakarta EE,
+Quarkus and Micronaut, plus evidence for virtual threads, `ScopedValue`, Java
+modules, `native-image`, `jlink`, `jpackage`, and Java versions declared in Docker
+or CI files. Source/build evidence includes a POSIX path and line number; SBOM
+documents include their local path and format/version.
+
+Frameworks are classified as `declared_only`, `observed_only`,
+`declared_and_observed`, or `unobserved`; missing evidence is not a positive claim.
+The scanner reads local text only, caps its file/evidence population, does not
+execute Maven/Gradle, resolve dependencies, access the network, inspect a CVE
+database, or make runtime recommendations. It is additive and does not affect
+readiness, findings, effort, or existing endpoint populations.
+
+The conditional P2 SBOM reader is available under `jvm_inventory.sbom` for
+local CycloneDX JSON (`bomFormat`) and SPDX JSON (`spdxVersion`) documents. It
+reports document format/version and bounded component coordinates only. It does
+not query CVE or license databases, verify signatures, contact artifact
+repositories, or make a supply-chain verdict. XML SBOMs and unrecognized JSON
+remain outside this reader and are not interpreted.
+
 ## Claim provenance (`evidence_manifest`)
 
 Every JSON report also includes `evidence_manifest`: a compact index of the claims already

sourcecode-5.9.22/docs/perf/baselines/5.9.22/petclinic__ask__cold.json

@@ -0,0 +1,59 @@
+{
+  "schema_version": "perf-baseline-v1",
+  "tool_version": "5.9.22",
+  "captured_at": "2026-09-01T08:51:30Z",
+  "command": "ask",
+  "repo": {
+    "name": "spring-petclinic",
+    "commit": "45649e0",
+    "files": 47,
+    "bytes": 123264,
+    "classes": 25,
+    "methods": 72
+  },
+  "scale_dimensions": {
+    "files": 47,
+    "classes": 25,
+    "methods": 72
+  },
+  "scale_dimensions_basis": "The repository axes this timing is expected to scale over. A performance claim without these dimensions is not comparable across repositories.",
+  "mode": "cold",
+  "runs": 2,
+  "wall_ms": {
+    "p50": 742.306,
+    "p95": 753.485,
+    "min": 729.885,
+    "max": 754.727
+  },
+  "phase_ms": {
+    "discovery": {
+      "p50": 6.152,
+      "p95": 6.238
+    },
+    "detection": {
+      "p50": 19.386,
+      "p95": 19.954
+    },
+    "analysis": {
+      "p50": 126.555,
+      "p95": 127.517
+    },
+    "serialize": {
+      "p50": 0.898,
+      "p95": 0.906
+    },
+    "unattributed_p50": 589.315
+  },
+  "rss_peak_bytes": {
+    "p50": 75284480.0,
+    "p95": 75284480.0
+  },
+  "env": {
+    "python": "3.14.6",
+    "os": "darwin",
+    "cpu": "arm",
+    "cores": 8,
+    "hostname_hash": "3972fec0",
+    "host_id_declared": false
+  }
+}

sourcecode-5.9.22/docs/perf/baselines/5.9.22/petclinic__ask__warm.json

@@ -0,0 +1,47 @@
+{
+  "schema_version": "perf-baseline-v1",
+  "tool_version": "5.9.22",
+  "captured_at": "2026-09-01T08:51:32Z",
+  "command": "ask",
+  "repo": {
+    "name": "spring-petclinic",
+    "commit": "45649e0",
+    "files": 47,
+    "bytes": 123264,
+    "classes": 25,
+    "methods": 72
+  },
+  "scale_dimensions": {
+    "files": 47,
+    "classes": 25,
+    "methods": 72
+  },
+  "scale_dimensions_basis": "The repository axes this timing is expected to scale over. A performance claim without these dimensions is not comparable across repositories.",
+  "mode": "warm",
+  "runs": 2,
+  "wall_ms": {
+    "p50": 352.405,
+    "p95": 356.578,
+    "min": 347.768,
+    "max": 357.042
+  },
+  "phase_ms": {
+    "discovery": null,
+    "detection": null,
+    "analysis": null,
+    "serialize": null,
+    "instrumentation": "absent"
+  },
+  "rss_peak_bytes": {
+    "p50": 75284480.0,
+    "p95": 75284480.0
+  },
+  "env": {
+    "python": "3.14.6",
+    "os": "darwin",
+    "cpu": "arm",
+    "cores": 8,
+    "hostname_hash": "3972fec0",
+    "host_id_declared": false
+  }
+}

{sourcecode-5.9.19 → sourcecode-5.9.22}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.19"
+version = "5.9.22"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.19 → sourcecode-5.9.22}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.19"
+__version__ = "5.9.22"

{sourcecode-5.9.19 → sourcecode-5.9.22}/src/sourcecode/canonical_ir.py

@@ -528,10 +528,17 @@ def ir_dict_to_canonical(
         files = sorted(file_set)
 
     # Sorted call graph edges — stable ordering: from, type, to
-    call_graph = sorted(
-        edges,
-        key=lambda e: (e.get("from", ""), e.get("type", ""), e.get("to", "")),
-    )
+    # The raw graph is owned by this CIR conversion and its edge order is not
+    # observable until after conversion. Sort in place instead of creating a
+    # second repository-sized list during the raw/CIR overlap peak.
+    if isinstance(edges, list):
+        edges.sort(key=lambda e: (e.get("from", ""), e.get("type", ""), e.get("to", "")))
+        call_graph = edges
+    else:
+        call_graph = sorted(
+            edges,
+            key=lambda e: (e.get("from", ""), e.get("type", ""), e.get("to", "")),
+        )
 
     # Dependency edges (structural subset of call_graph)
     _dep_types = frozenset({"imports", "extends", "implements", "injects"})

{sourcecode-5.9.19 → sourcecode-5.9.22}/src/sourcecode/cli.py

@@ -4404,7 +4404,9 @@ app = typer.Typer(
     name="ask",
     help=_HELP,
     add_completion=False,
-    rich_markup_mode="rich",
+    # Rich's Windows help renderer can drop options from long command panels;
+    # plain Click help keeps the complete option contract visible there.
+    rich_markup_mode=None if os.name == "nt" else "rich",
     no_args_is_help=False,
 )
 
@@ -7531,6 +7533,7 @@ def prepare_context_cmd(
         Path("."),
         help="Repository path to analyze (default: current directory)",
     ),
+    jobs: Optional[int] = _jobs_option(),
     since: Optional[str] = typer.Option(
         None,
         "--since",
@@ -7605,7 +7608,6 @@ def prepare_context_cmd(
         ),
     ),
     progress_mode: Optional[str] = _progress_option(),
-    jobs: Optional[int] = _jobs_option(),
 ) -> None:
     """Task-specific context for AI coding agents.
 
@@ -8426,6 +8428,7 @@ def repo_ir_cmd(
         Path("."),
         help="Repository root to analyze (default: current directory)",
     ),
+    jobs: Optional[int] = _jobs_option(),
     since: Optional[str] = typer.Option(
         None,
         "--since",
@@ -8491,7 +8494,6 @@ def repo_ir_cmd(
         help="Compress output with gzip. Requires --output. Reduces large IR files by ~70-80%.",
     ),
     progress_mode: Optional[str] = _progress_option(),
-    jobs: Optional[int] = _jobs_option(),
 ) -> None:
     """Deterministic symbol-level IR for Java repositories.
 
@@ -9185,6 +9187,7 @@ def endpoints_cmd(
         Path("."),
         help="Repository path to scan for REST endpoints (default: current directory)",
     ),
+    jobs: Optional[int] = _jobs_option(),
     output_path: Optional[Path] = typer.Option(
         None, "--output", "-o",
         help="Write output to a file instead of stdout.",
@@ -9251,7 +9254,6 @@ def endpoints_cmd(
              "than protect).",
     ),
     progress_mode: Optional[str] = _progress_option(),
-    jobs: Optional[int] = _jobs_option(),
 ) -> None:
     """Extract REST API endpoint surface from Java source files.
 
@@ -9806,6 +9808,7 @@ def export_cmd(
         Path("."),
         help="Repository path to export (default: current directory)",
     ),
+    jobs: Optional[int] = _jobs_option(),
     output_path: Optional[Path] = typer.Option(
         None, "--output", "-o",
         help="Write output to a file instead of stdout.",
@@ -9848,7 +9851,6 @@ def export_cmd(
              "written on the diagram whenever it bites.",
     ),
     progress_mode: Optional[str] = _progress_option(),
-    jobs: Optional[int] = _jobs_option(),
 ) -> None:
     """Export structured, tool-agnostic codebase views for downstream tooling.
 
@@ -10015,6 +10017,7 @@ def validation_cmd(
         Path("."),
         help="Repository path to scan for request-body validation (default: current directory)",
     ),
+    jobs: Optional[int] = _jobs_option(),
     output_path: Optional[Path] = typer.Option(
         None, "--output", "-o",
         help="Write output to a file instead of stdout.",
@@ -10045,7 +10048,6 @@ def validation_cmd(
         help=_NO_CACHE_SUBCOMMAND_HELP,
     ),
     progress_mode: Optional[str] = _progress_option(),
-    jobs: Optional[int] = _jobs_option(),
 ) -> None:
     """Map request-body validation per endpoint (constraints + custom validators).
 
@@ -12173,6 +12175,7 @@ def spring_audit_cmd(
         Path("."),
         help="Repository path to audit (default: current directory)",
     ),
+    jobs: Optional[int] = _jobs_option(),
     output_path: Optional[Path] = typer.Option(
         None, "--output", "-o",
         help="Write output to a file instead of stdout.",
@@ -12304,7 +12307,6 @@ def spring_audit_cmd(
     ),
     detach: bool = _detach_option(),
     progress_mode: Optional[str] = _progress_option(),
-    jobs: Optional[int] = _jobs_option(),
 ) -> None:
     """Spring semantic audit: {{RULE_SUMMARY}}.
 
@@ -13483,6 +13485,7 @@ def risk_cmd(
         Path("."),
         help="Repository path (default: current directory).",
     ),
+    jobs: Optional[int] = _jobs_option(),
     limit: int = typer.Option(
         50, "--limit", help="How many composed risks to publish (highest first).", min=0,
     ),
@@ -13542,7 +13545,6 @@ def risk_cmd(
     allow_partial: bool = _allow_partial_option(),
     detach: bool = _detach_option(),
     progress_mode: Optional[str] = _progress_option(),
-    jobs: Optional[int] = _jobs_option(),
 ) -> None:
     """What each defect actually costs, once reach and access are in it.
 
@@ -14796,6 +14798,7 @@ def posture_cmd(
         Path("."),
         help="Repository path (default: current directory).",
     ),
+    jobs: Optional[int] = _jobs_option(),
     profile: Optional[str] = typer.Option(
         None,
         "--profile",
@@ -14877,7 +14880,6 @@ def posture_cmd(
     format: str = _format_option(help="Output format: json or yaml."),
     copy: bool = _copy_option(),
     progress_mode: Optional[str] = _progress_option(),
-    jobs: Optional[int] = _jobs_option(),
 ) -> None:
     """Which beans are wired under a profile set — and which cannot be decided.
 
@@ -15300,6 +15302,7 @@ def migrate_check_cmd(
         Path("."),
         help="Repository path to scan (default: current directory)",
     ),
+    jobs: Optional[int] = _jobs_option(),
     output_path: Optional[Path] = typer.Option(
         None, "--output", "-o",
         help="Write output to a file instead of stdout.",
@@ -15441,7 +15444,6 @@ def migrate_check_cmd(
     ),
     detach: bool = _detach_option(),
     progress_mode: Optional[str] = _progress_option(),
-    jobs: Optional[int] = _jobs_option(),
 ) -> None:
     """Spring Boot 2→3 migration readiness + Java LTS/licensing inventory.
 
@@ -15847,6 +15849,7 @@ def impact_chain_cmd(
         Path("."),
         help="Repository root (default: current directory)",
     ),
+    jobs: Optional[int] = _jobs_option(),
     depth: int = typer.Option(
         4,
         "--depth",
@@ -15886,7 +15889,6 @@ def impact_chain_cmd(
         ),
     ),
     progress_mode: Optional[str] = _progress_option(),
-    jobs: Optional[int] = _jobs_option(),
 ) -> None:
     """Spring impact-chain: systemic blast radius of a symbol; TX/SEC findings are opt-in.