sourcecode 5.9.19__tar.gz → 5.9.23__tar.gz

{sourcecode-5.9.19 → sourcecode-5.9.23}/CHANGELOG.md

@@ -1,5 +1,75 @@
 # Changelog
 
+## [5.9.23] — 2026-09-01
+
+*Regression hardening after the 5.9.22 audit and testing-repository battery.*
+
+### Fixed
+
+- `--compact` and `--agent` reserve envelope metadata before trimming, so their
+  published 30 KB and 40 KB stdout ceilings remain true after final rendering.
+- `--agent` now has a 1,536 MB default RSS ceiling, reports context construction
+  accurately in progress output, and rejects Java repositories above 10,000 files
+  with `AGENT_SCOPE_TOO_LARGE` before an unbounded deep analysis can be killed.
+- Agent mode no longer builds a module graph implicitly; callers can still request
+  it explicitly with `--graph-modules`.
+
+### Documentation
+
+- Added the Windows large-repository audit with measured P0/P1 regressions,
+  performance boundaries and explicit closure requirements.
+- Synchronized the defect ledger and README so silent-success, incomplete
+  coverage, compact-output, cache-growth and deep-agent memory risks are visible
+  rather than implied closed by smaller-repository measurements.
+
+## [5.9.22] — 2026-08-31
+
+*Large-repository route projection performance.*
+
+### Fixed
+
+- Inherited route projection now resolves parent candidates through a module/name
+  index instead of scanning every class for every child. The ambiguity rule and
+  emitted routes remain unchanged, while cold `--agent --full` improved from about
+  20.5 to 19.6 seconds on openmrs-core and from 32.0 to 30.8 seconds on Jenkins.
+
+### Verification Boundary
+
+- Endpoint, inheritance, canonical IR and migration regression tests pass. Large
+  cold runs remain memory-heavy; reducing the duplicated canonical/raw model is
+  still required before claiming the 8/10 performance target.
+
+## [5.9.21] — 2026-08-31
+
+*Cold-path memory and JVM inventory performance follow-up.*
+
+### Fixed
+
+- Full CIR builds no longer retain every Java source body in the per-file linking
+  queue; the linking pass rereads source only when needed and keeps repository
+  constants and annotation references as compact metadata.
+- Completed linking drops pass-local containers before canonical projection, reducing
+  overlap between raw IR assembly and the canonical model.
+- `migrate-check` JVM inventory reuses the already discovered Java file list instead
+  of walking and rescanning the source tree a second time.
+
+### Verification Boundary
+
+- Focused JVM, CIR cache-equivalence, canonical IR, source-span and migration tests
+  pass. Cold `--agent --full` remains memory-heavy on large repositories: the latest
+  controlled run measured about 710 MB on openmrs-core and 1.24 GB on Jenkins; this
+  release does not claim that the 8/10 performance target is fully reached.
+
+## [5.9.20] — 2026-08-31
+
+*JVM ecosystem evidence and local SBOM inventory.*
+
+### Added
+
+- `migrate-check` now publishes bounded `jvm_inventory` evidence for JVM frameworks, Java runtime declarations in CI/containers, modern JVM patterns and local CycloneDX/SPDX JSON documents.
+- Added deterministic, negative-control and schema-registry coverage for the new inventory.
+- Documented the accepted JVM R&D scope and its explicit no-network/non-coverage boundaries.
+
 ## [5.9.19] — 2026-08-31
 
 *Critical `pack gate --since` compatibility correction.*

{sourcecode-5.9.19 → sourcecode-5.9.23}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.19
+Version: 5.9.23
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.19-blue)
+![Version](https://img.shields.io/badge/version-5.9.23-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -191,12 +191,12 @@ must not be gated on this variable; their budget applicability remains visible i
 the [defect ledger](docs/DEFECT-LEDGER.md).
 
 **Memory is measurable and bounded.** Repository-scoped JSON answers publish
-`_meta.memory.peak_rss_mb` and the configured ceiling. For a supervised deep run,
-set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
-answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
-unset, or set it to `0`, to disable the ceiling explicitly.
+`_meta.memory.peak_rss_mb` and the configured ceiling. `--agent` applies a
+1,536 MB ceiling by default; set `ASK_MAX_RSS_MB=<megabytes>` to override it or
+`ASK_MAX_RSS_MB=0` to disable it explicitly. If the process exceeds the ceiling,
+ASK refuses the answer with `MEMORY_TOO_LARGE`, including the observed peak and limit.
 
-**Current performance status.** Release 5.9.17 retains the shared Canonical IR
+**Current performance status.** Release 5.9.22 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. It also removes two repeated walks of the same file tree in
@@ -212,6 +212,14 @@ exit 75 (`--allow-partial` accepts one deliberately). The long-run progress
 message names the phase it is in and whether that phase has changed, so a slow run
 is distinguishable from a blocked one.
 
+**External audit boundary (2026-09-01).** The latest Windows audit rates the
+large-repository experience at **6.6/10** and reports open P0/P1 issues: empty
+successful Markdown `audit-report`, silent `risk` termination, multi-gigabyte
+deep-agent RSS, incomplete parse/coverage disclosure and oversized compact
+surfaces. These findings are tracked in the [external audit](docs/AUDIT-2026-09-01-EXTERNAL-5.9.22.md)
+and [defect ledger](docs/DEFECT-LEDGER.md); they are not closed by the existing
+engineering-host measurements.
+
 The current external audit still records two open availability limits, and they
 are held open deliberately: `audit-report --format markdown` under contention, and
 the root compact flow under strict timeouts on very large monorepos. Neither
@@ -276,7 +284,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.19 — and, on a build that has aged,
+ask version                    # ask 5.9.22 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.19 → sourcecode-5.9.23}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.19-blue)
+![Version](https://img.shields.io/badge/version-5.9.23-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -142,12 +142,12 @@ must not be gated on this variable; their budget applicability remains visible i
 the [defect ledger](docs/DEFECT-LEDGER.md).
 
 **Memory is measurable and bounded.** Repository-scoped JSON answers publish
-`_meta.memory.peak_rss_mb` and the configured ceiling. For a supervised deep run,
-set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
-answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
-unset, or set it to `0`, to disable the ceiling explicitly.
+`_meta.memory.peak_rss_mb` and the configured ceiling. `--agent` applies a
+1,536 MB ceiling by default; set `ASK_MAX_RSS_MB=<megabytes>` to override it or
+`ASK_MAX_RSS_MB=0` to disable it explicitly. If the process exceeds the ceiling,
+ASK refuses the answer with `MEMORY_TOO_LARGE`, including the observed peak and limit.
 
-**Current performance status.** Release 5.9.17 retains the shared Canonical IR
+**Current performance status.** Release 5.9.22 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. It also removes two repeated walks of the same file tree in
@@ -163,6 +163,14 @@ exit 75 (`--allow-partial` accepts one deliberately). The long-run progress
 message names the phase it is in and whether that phase has changed, so a slow run
 is distinguishable from a blocked one.
 
+**External audit boundary (2026-09-01).** The latest Windows audit rates the
+large-repository experience at **6.6/10** and reports open P0/P1 issues: empty
+successful Markdown `audit-report`, silent `risk` termination, multi-gigabyte
+deep-agent RSS, incomplete parse/coverage disclosure and oversized compact
+surfaces. These findings are tracked in the [external audit](docs/AUDIT-2026-09-01-EXTERNAL-5.9.22.md)
+and [defect ledger](docs/DEFECT-LEDGER.md); they are not closed by the existing
+engineering-host measurements.
+
 The current external audit still records two open availability limits, and they
 are held open deliberately: `audit-report --format markdown` under contention, and
 the root compact flow under strict timeouts on very large monorepos. Neither
@@ -227,7 +235,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.19 — and, on a build that has aged,
+ask version                    # ask 5.9.22 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

sourcecode-5.9.23/docs/AUDIT-2026-09-01-EXTERNAL-5.9.22.md

@@ -0,0 +1,71 @@
+# External Audit — ASK Engine 5.9.22
+
+**Received:** 2026-09-01  
+**Audited build:** `5.9.22` (`64c8b3e429eadd7a12d34eb1e5eefa0c08e430e4`)  
+**Platform:** Windows 11, Python 3.10, Git Bash  
+**Corpus:** repositories under `laboratorioDePruebas/testing/`; the largest
+reported target contains 3,342 Java files.
+
+This document records external observations. An observation is not a closure:
+the defect ledger remains authoritative until a fix, all affected consumers and
+a regression assertion exist.
+
+## Executive Result
+
+The audit rates ASK Engine **6.6/10** on the large MSAS corpus and **7.5/10** on
+the smaller nine-axis assessment. The measurements agree on the main risk:
+source analysis is accurate and unusually explicit about uncertainty, but large
+repository execution and several output contracts are not yet reliable enough
+for interactive or unattended security use.
+
+Strengths confirmed: endpoint extraction, effective access resolution,
+determinism, structured input errors, cache warm-up and bounded CI-oriented
+flows. The principal gaps are silent success, incomplete parse disclosure,
+SQL-injection recall, memory, and inconsistent CLI contracts.
+
+## Priority Findings
+
+| ID | Priority | Status | Finding and closure requirement |
+|---|---|---|---|
+| `BUG-01` | P0 | Open | `audit-report --format markdown` reproduced with `rc=0` and empty stdout. Add a non-empty-answer invariant and full/partial renderer coverage. |
+| `BUG-02` | P0 | Open | Large `risk` ended `rc=127` with no output or structured error. Add fail-fast resource/process handling and durable partial checkpoints. |
+| `BUG-12` | P0 | Open | Deep `--agent` output construction reaches multi-gigabyte RSS before producing a small answer. Bound projection while building, not after materialization. |
+| `BUG-03` | P1 | Open | `content_id` changes between cold and warm because cache state is hashed into the answer. Separate execution metadata from answer identity. |
+| `BUG-04` | P1 | Open | `selftest` publishes `complete=true` with five error rows. Derive bounds from its actual result population. |
+| `BUG-04b` | P1 | Open | `selftest` uses a fixed 120-second deadline not covered by the documented analysis budget. Make it configurable or refuse unscoped large runs. |
+| `BUG-05` | P1 | Open | Overloaded endpoint handlers can receive the wrong declaration line. Resolve by mapping annotation or publish ambiguity. |
+| `BUG-06` | P1 | Open | The `repo-ir --budget-tokens 12000` help example is below the measured minimum view (~20,367 tokens) on the audited corpus. |
+| `BUG-07` | P1 | Open | `--compact` exceeds the published size expectation on `migrate-check` and `spring-audit`. Apply bounded projections with omission metadata. |
+| `BUG-08` | P1 | Open | Root help claims universal `--path`, `--repo` and `--dir` aliases, but sampled commands reject them. Align implementation and help. |
+| `BUG-09` | P2 | Open | Related diff commands disagree on `--base`, `--base-ref`, `--since`, `--repo` and `--path`. Accept compatible aliases or publish one vocabulary. |
+| `BUG-10` | P1 | Open | Unsupported routing styles can produce `coverage.gaps=[]`. Publish detected-but-unmodeled routing gaps. |
+| `BUG-11` | P1 | Open | Default `pack assessment` can fail on a small Spring repository. Use a bounded default or explicit full mode. |
+| `BUG-13` | P1 | Open | Unscoped `selftest` starts over nested repositories after warning. Refuse and require an explicit repository path. |
+| `BUG-15` | P2 | Open | Non-terminal help output contains visible markup/control text. Strip markup when stdout is not a TTY. |
+| `BUG-16` | P1 | Open | Context-cache growth is not bounded or documented; about 1.5 GB was measured. Add a published budget, eviction policy and status. |
+| `BUG-19` | P2 | Open | Unknown-command errors use plain text instead of the JSON error envelope. Normalize command admission errors. |
+| `BUG-20` | P2 | Open | `--detach` can report the unresolved user path while writing to a resolved Windows path. Publish the actual absolute output path. |
+| `BUG-21` | P2 | Open | `--jobs 999` is silently clipped. Publish the effective limit or reject out-of-range values. |
+| `BUG-22` | P1 | Open | RSS ceilings are checked post-hoc; a 50 MB ceiling was reported only after ~768 MB. Add periodic in-flight sampling and orderly abort. |
+| `BUG-23` | P2 / coverage | Open | Micronaut is detected but unsupported and its controllers are not modeled as endpoints. Add a scoped coverage contract. |
+
+## Performance Evidence
+
+The audit measured `--agent` on ThingsBoard at **182.6 s / 2,088 MB RSS** and
+`spring-audit` at **164.2 s cold**. On the larger MSAS corpus it reports
+`ask . --agent` at **447 s**, `contract-diff` at **329 s**, `delta` at **187 s**,
+and `validation --compact` at **91 s**. Warm root compact analysis can be below
+one second; these are cold/deep-path costs.
+
+Until the P0/P1 rows close, do not market `risk`, full `audit-report` or full
+`--agent` as interactive guarantees for 3,000+ Java-file repositories. The
+target remains bounded interactive views below 20 s and peak RSS below 400 MB
+on the reference large-repository tier.
+
+## Required Closure Bar
+
+Each P0/P1 row requires a focused regression test, output/exit-code assertions,
+cold/warm/concurrent runs on the affected platform, and a ledger entry naming
+the fix commit and remaining verification boundary. Documentation alone never
+closes a defect.
+

{sourcecode-5.9.19 → sourcecode-5.9.23}/docs/DEFECT-LEDGER.md

@@ -14,6 +14,32 @@ Status values: `open` · `in-progress` · `closed <version>` · `by-design` (wit
 The facts these rows are keyed to are published: `ask schema facts-v1` prints the registry
 (authority, definition, consumers, parity test) that the release battery enforces.
 
+## Current Synchronization — External Audit `5.9.22` (2026-09-01)
+
+The external audit confirms strong precision, determinism and uncertainty
+disclosure, but opens a P0/P1 cluster around silent success, incomplete
+population disclosure, large-run memory and compact-output contracts. Full
+evidence: [`AUDIT-2026-09-01-EXTERNAL-5.9.22.md`](AUDIT-2026-09-01-EXTERNAL-5.9.22.md).
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `BUG-01` | Critical maximum | **open, P0** | Full Markdown `audit-report` reproduced with `rc=0` and empty stdout. Add a global non-empty-answer invariant and renderer coverage. |
+| `BUG-02` | Critical maximum | **open, P0** | Large `risk` ended `rc=127` with no output or structured failure. Add fail-fast resource/process handling and durable partial checkpoints. |
+| `BUG-12` | Critical maximum | **open, P0** | Deep `--agent` output construction reaches multi-gigabyte RSS before a small answer. Bound projection while building. |
+| `BUG-03` | High | **open, P1** | `content_id` changes between cold and warm because cache state is hashed into identity. Separate execution metadata from answer identity. |
+| `BUG-04` | High | **open, P1** | `selftest` publishes `complete=true` with five error rows. Derive bounds from actual results. |
+| `BUG-05` | High | **open, P1** | Overloaded endpoint handlers can receive the wrong declaration line. Resolve by mapping annotation or publish ambiguity. |
+| `BUG-07` | High | **open, P1** | `--compact` remains oversized on `migrate-check` and `spring-audit`. Apply bounded projections with omission metadata. |
+| `BUG-10` | High | **open, P1** | Unsupported routing styles can produce empty coverage gaps. Publish detected-but-unmodeled routing gaps. |
+| `BUG-11` | High | **open, P1** | Default `pack assessment` can fail on a small Spring repository. Use a bounded default or explicit full mode. |
+| `BUG-13` | High | **open, P1** | Unscoped `selftest` starts over nested repositories after warning. Refuse and require an explicit path. |
+| `BUG-16` | High | **open, P1** | Context-cache growth has no published budget or eviction contract; about 1.5 GB was measured. |
+| `BUG-22` | High | **open, P1** | RSS ceilings are checked post-hoc. Add periodic sampling and orderly abort. |
+
+The remaining `BUG-04b`, `BUG-06`, `BUG-08`, `BUG-09`, `BUG-15`, `BUG-19`,
+`BUG-20`, `BUG-21` and `BUG-23` findings are open P2/coverage follow-ups in
+the audit document. None is closed by documentation alone.
+
 ## Current Synchronization — External Audit `AUD-621`
 
 **Release `5.9.19` remediation.** The stderr-decoding fix for `AUD-621-PACK-STDERR` remains in code, and the distinct `pack gate --since` crash found by the post-remediation re-audit is corrected with a Python 3.9–3.11-compatible tar extraction path. `AUD-621-R` has a second Windows barrier at process-pool construction, complementing the sequential fallback. The broader findings remain open until their required native Windows evidence is recorded; `AUD-621-CONTEXT` and `AUD-621-WIN-PROC` are unchanged.

{sourcecode-5.9.19 → sourcecode-5.9.23}/docs/DEVELOPMENT-ROADMAP.md

@@ -1,11 +1,46 @@
 # ASK — Development Roadmap
 
+### Release 5.9.20 — JVM evidence inventory
+
+The accepted JVM R&D scope is implemented in `migrate-check`: local framework,
+toolchain, runtime-pattern and Docker/CI evidence plus bounded CycloneDX/SPDX JSON
+reading. The output is advisory and additive; no network, dependency resolution,
+CVE lookup, signature verification or runtime recommendation is performed.
+
+### Performance pass — 2026-08-31
+
+The JVM inventory no longer rediscovers the Java tree inside `migrate-check`: the
+command reuses its already-resolved source population and only discovers local
+configuration, CI, container and SBOM candidates. On the current testing corpus,
+fresh measurements were approximately 4.8 s for `openmrs-core` and 7.6 s for
+`jenkins` using `migrate-check --compact`; no output or readiness semantics changed.
+
+This is a bounded improvement, not closure of the performance target. The remaining
+8/10 work is the cold/full-graph path and high-cost `--agent`, `posture`, `risk` and
+`impact-chain` cases. Those require separate profiling and memory measurements before
+claiming a broad speedup.
+
 ### Release 5.9.19 — `AUD-621` remediation
 
 Release `5.9.19` carries the `5.9.18` Windows safeguards and fixes the separate `pack gate --since` crash caused by calling the Python 3.12-only tarfile filter API on Python 3.10. The compatibility path is covered by regression tests; native Windows repetition remains required for the broader reliability findings.
 
 These code changes do not replace the required native evidence. `AUD-621-R` and `AUD-621-WIN-PROC` remain open until the repetition matrix and process-tree cases pass on native Windows; `AUD-621-CONTEXT` remains profiling work.
 
+### JVM I+D triage — accepted scope from 2026-08-31
+
+The external JVM report has been depurated against primary sources and the current
+ASK route. It receives a limited green light: extend `migrate-check` with a
+source-backed JDK/build/framework inventory (P0), then add small detectors for
+virtual threads, `ScopedValue`, modules, native-image/jlink/jpackage and Java
+versions declared by CI or containers (P1). The decision record, accepted facts,
+rejected scope and sources are in
+[`RD-JVM-ASK-TRIAGE-2026-08-31.md`](RD-JVM-ASK-TRIAGE-2026-08-31.md).
+
+This does not authorize embeddings, hosted vector search, APM/repository
+integrations, Sigstore verification, CVE database work or prescriptive runtime
+tuning. A local CycloneDX/SPDX reader remains a conditional P2 experiment and
+must preserve ASK's no-network, source-evidence and non-coverage contracts.
+
 ### External Audit Intake — `AUD-621` re-audit, release 5.9.17
 
 The 2026-08-31 re-audit corrects the optimistic interpretation of the previous

{sourcecode-5.9.19 → sourcecode-5.9.23}/docs/PRODUCT_TIERS.md

@@ -59,7 +59,7 @@ single-repo, offline.**
 | **Modernization planning** | `ask modernize .` | Hotspots, callerless types (with `unknown` where a framework may dispatch), coupling tangles, refactor roadmap |
 | **Git-churn ranking** | `--rank-by git-churn` | File volatility via git history |
 | **No truncation limits** | `--full` | Full transactional boundaries, DTO mappers, large result sets |
-| **Spring semantic audit** | `ask spring-audit .` | TX-001..006 anomalies + SEC-001..009 security surface; JAVA/SPRING only |
+| **Spring semantic audit** | `ask spring-audit .` | TX-001..006 anomalies + SEC-001..010 security surface; JAVA/SPRING only |
 | **Impact chain + opt-in TX/SEC findings** | `ask impact-chain <symbol>` (`--with-findings` for audit findings) | Systemic blast radius with transaction boundary and security surfaces per hop |
 | **Event topology** | `ask impact-chain <event> --type events` | Publisher → event → consumer graph; AFTER_COMMIT/BEFORE_COMMIT TX phase |
 | RIS bootstrap context | `ask cold-start .` | Repository Intelligence Snapshot; instant return from persisted cache |

sourcecode-5.9.23/docs/RD-JVM-ASK-TRIAGE-2026-08-31.md

@@ -0,0 +1,78 @@
+# Depuracion I+D JVM para ASK
+
+**Fecha:** 2026-08-31  
+**Entrada:** informe externo sobre novedades del ecosistema JVM 2025-2026  
+**Decision:** luz verde parcial para inventario y deteccion estructural; no para ampliar ASK a busqueda vectorial, APM o integraciones externas.
+
+## Criterio
+
+Una propuesta entra en el roadmap solo si cumple las cuatro condiciones siguientes:
+
+- aporta un hecho que ASK pueda verificar localmente;
+- puede publicarse con ruta y linea de evidencia;
+- no requiere red, credenciales ni una base externa durante el analisis;
+- mejora una pregunta que ASK ya responde sobre modernizacion, arquitectura o seguridad del cambio.
+
+El informe original es util como lista de hipotesis, pero no como inventario de actualidad: mezcla releases confirmadas, roadmaps, previsiones y afirmaciones de proveedor sin enlaces reproducibles. Las versiones concretas no se convierten en reglas hasta que exista una fuente primaria y una prueba sobre un repositorio fixture.
+
+## Hechos aceptados
+
+| Area | Hecho verificable | Uso en ASK |
+|---|---|---|
+| JDK 25 | `import module` esta finalizado en JEP 511; los archivos fuente compactos y los `main` de instancia pertenecen a JEP 512. | Detectar sintaxis y declarar el nivel de lenguaje observado, sin recomendar una migracion automaticamente. |
+| Spring | Spring Framework 7 y Spring Boot 4.0 mantienen Java 17 como baseline y adoptan Java 25 como foco. | Extender la evidencia de version/framework de `migrate-check` y separar Boot 3/4. |
+| Quarkus | Quarkus 3.31 declara soporte para Java 25, incluyendo runtime images y native builds con Mandrel. | Reconocer toolchain y empaquetado, sin inferir que Java 25 sea una recomendacion para todos los proyectos. |
+| Jakarta EE | Jakarta EE 11 requiere Java 17 o superior e incorpora Jakarta Data 1.0, soporte para records y recursos basados en virtual threads. | Mejorar la lectura de stack y de requisitos de plataforma. |
+| Gradle | Gradle 9 requiere JVM 17 o superior para ejecutar el daemon; toolchains permiten compilar para niveles diferentes. | Separar JVM del build y nivel de compilacion en el inventario. |
+| SBOM | CycloneDX 1.7 y SPDX 3.0 son formatos publicos con esquemas y serializaciones verificables. | Posible entrada local futura; no implica una base CVE ni una integracion de repositorio. |
+
+Fuentes primarias: [JEP 511](https://openjdk.org/jeps/8344700), [Spring Framework 7](https://spring.io/blog/2025/11/13/spring-framework-7-0-general-availability), [Spring Boot 4.0](https://spring.io/blog/2025/11/20/spring-boot-4-0-0-available-now), [Quarkus 3.31](https://quarkus.io/blog/quarkus-3-31-released/), [Jakarta EE 11](https://jakarta.ee/specifications/platform/11/), [Gradle 9](https://docs.gradle.org/current/userguide/upgrading_major_version_9.html), [CycloneDX](https://cyclonedx.org/specification/overview/) y [SPDX](https://spdx.dev/use/specifications/).
+
+## Propuestas aceptadas
+
+### P0 — Inventario de toolchain y framework
+
+Ampliar el inventario existente de `migrate-check` para publicar, cuando haya evidencia:
+
+- version de lenguaje/JDK objetivo y version de runtime declarada;
+- proveedor o distribucion JDK solo cuando aparece de forma explicita;
+- Maven/Gradle, wrapper, plugin y toolchain;
+- Spring Boot, Spring Framework, Hibernate, Jakarta EE, Quarkus y Micronaut;
+- separacion entre "declarado por build", "detectado en codigo" y "no observado".
+
+No se debe resolver una version consultando Maven Central ni inferir el proveedor a partir de una imagen generica. La salida debe conservar el modelo actual de ASK: hecho, fuente, confianza y no cobertura.
+
+### P1 — Patrones JVM con evidencia
+
+Añadir detecciones pequenas y especificas para:
+
+- `Thread.ofVirtual`, `Executors.newVirtualThreadPerTaskExecutor` y APIs equivalentes;
+- `ScopedValue`;
+- `module-info.java` e instrucciones de empaquetado `jlink`, `jpackage` y `native-image`;
+- version de Java en Dockerfiles y pipelines CI cuando el fichero esta en el repositorio.
+
+Cada detector debe producir una observacion `archivo:linea`, evitar recomendaciones normativas y no alterar las poblaciones actuales de endpoints, riesgo o impacto. Si un patron no puede confirmarse, debe quedar como `unknown` o no observado, nunca como ausencia.
+
+### P2 — Entrada local de SBOM, incorporada
+
+Se incorpora el parseo local de SBOM CycloneDX/SPDX en JSON ya presentes en el repositorio. El alcance se limita a formato, version y coordenadas de componentes. Quedan fuera la consulta de CVEs, la validacion de licencias, la verificacion Sigstore, la conexion con Artifactory/Nexus y el almacenamiento de claves.
+
+La implementacion se ejecuta sin red y con limites de tamano. No confunde "componente declarado" con "vulnerabilidad explotable"; XML y documentos no reconocidos permanecen fuera del alcance explicito.
+
+## No aprobado
+
+- Embeddings, Qdrant/Pinecone y busqueda semantica como camino principal: coste, deriva y falta de evidencia de que la busqueda estructural actual sea el cuello de botella.
+- Subida o correlacion de perfiles JFR/async-profiler: superficie de privacidad y operacion fuera del producto actual.
+- Plugins directos para APM, Artifactory, Nexus, Sigstore o proveedores JDK: dependencia externa y coste de mantenimiento desproporcionado.
+- Recomendaciones automaticas de GC, Java 25 o framework: el repositorio no prueba por si solo la carga de produccion ni la compatibilidad operacional.
+- Extender ASK a Docker/Kubernetes/Go como analizador general: no es una consecuencia de detectar un fichero de pipeline o una imagen base.
+
+## Criterios de cierre
+
+La iniciativa no se considera hecha por reconocer una cadena. Debe aportar fixtures de Maven y Gradle, al menos un proyecto Spring Boot, uno Quarkus o Jakarta, un Dockerfile/CI con version Java y controles negativos. La bateria debe comprobar:
+
+- evidencia de archivo y linea;
+- determinismo frio/caliente y ausencia de red;
+- distincion entre declarado, observado y desconocido;
+- no regresion byte a byte de los payloads existentes cuando los nuevos campos no aplican;
+- limites de salida y no mutacion del repositorio.

{sourcecode-5.9.19 → sourcecode-5.9.23}/docs/USER_GUIDE.md

@@ -332,7 +332,7 @@ value in field use, and they are the ones to learn first:
 | `ask posture . --diff dev:prod` | The only command that answers *"what changes about effective access between two profile sets, across every endpoint at once"*. Experimental, and the most differentiated capability in the product. |
 | `ask endpoints .` | Every REST endpoint with its **effective path** (context-path + `spring.mvc.servlet.path` resolved), inferred security policy and per-endpoint confidence. Turns "audit the API" into a list. |
 | `ask spring-audit .` | Transactional anomalies that a compiler cannot see — `@Transactional` on a private method is a silent CGLIB no-op — plus the security surface. |
-| `ask migrate-check . --compact` | Boot 2→3 readiness plus Java LTS/licensing inventory: blockers, effort, target JDK evidence and explicit licensing-review signals. |
+| `ask migrate-check . --compact` | Boot 2→3 readiness plus Java LTS/licensing and local JVM ecosystem inventory: blockers, effort, target JDK evidence, framework/runtime signals and explicit licensing-review signals. |
 
 Everything else is either a projection of the same model (`impact`, `export`, `explain`) or an
 agent-facing packaging of it (`--compact`, `--agent`, `prepare-context`). The full surface is
@@ -382,6 +382,9 @@ Output: detected stacks, entry points, dependencies, transactional boundaries (S
 ### `ask --agent`
 
 More structured version of `--compact`. Designed for AI agent system prompt injection.
+It is bounded to 40 KB on stdout and admits repositories up to 10,000 Java files;
+larger repositories return `AGENT_SCOPE_TOO_LARGE` before expensive analysis. Use
+`--compact` or narrow the path in that case.
 
 ```bash
 ask /repo --agent --output context.json
@@ -528,7 +531,7 @@ disabled changes runtime behaviour nobody measured; a diff is how a person makes
 call with the evidence in front of them.
 
 **TX patterns (TX-001..TX-006):** proxy bypass, nested transactions, readOnly propagation, NOT_SUPPORTED in active TX, exception swallowing, self-invocation of a `@Transactional` sibling.
-**SEC patterns (SEC-001..SEC-009):** unsecured endpoints, CVE-2025-41248 `@PreAuthorize` inheritance bypass, `@Transactional` on controllers, passwords stored under a fast unsalted digest, CSRF disabled under session-bearing authentication, cookies created without the Secure attribute, credentials stored in a deployment descriptor, SQL built by MyBatis string interpolation, and anonymous request-chain exceptions. **DEAD-001** reports a security control that is present only in comments and therefore disabled.
+**SEC patterns (SEC-001..SEC-010):** unsecured endpoints, CVE-2025-41248 `@PreAuthorize` inheritance bypass, `@Transactional` on controllers, passwords stored under a fast unsalted digest, CSRF disabled under session-bearing authentication, cookies created without the Secure attribute, credentials stored in a deployment descriptor, SQL built by MyBatis string interpolation, anonymous request-chain exceptions, and HTTP input reaching a concatenated known query sink through bounded positional in-repository calls. **DEAD-001** reports a security control that is present only in comments and therefore disabled.
 **GATE patterns (GATE-001..GATE-004):** custom AOP/security-gate risks over the same custom-gate authority published in `security_posture`: proxy bypass (`private`/`final`/self-invocation), advice that appears to fail open, disabled or tautological annotation attributes, and fragile `args[0]`/reflection binding.
 
 Each finding includes `severity`, `confidence`, `symbol`, `source_file`, `evidence`, `explanation`, and `fix_hint`. JAVA/SPRING ONLY.
@@ -1812,10 +1815,10 @@ stops at 1 408 files inside the `SEC-004` group and ends at 5.1s.
 **Memory budget.** Repository-scoped JSON answers include `_meta.memory` with
 `unit: "MB"`, the observed `peak_rss_mb`, the `peak_rss_basis` it was sampled
 from, `configured_max_rss_mb`, and `ceiling_enforceable`. To bound long analyses
-on a CI or supervised runner, set `ASK_MAX_RSS_MB=<megabytes>`. Exceeding the
-ceiling produces exit code `1` and a structured `MEMORY_TOO_LARGE` error with the
-peak and configured limit; no partial answer is published. Unset the variable, or
-set it to `0`, to disable this ceiling.
+on a CI or supervised runner, set `ASK_MAX_RSS_MB=<megabytes>`. `--agent` uses
+1,536 MB when the variable is unset. Exceeding the ceiling produces exit code `1`
+and a structured `MEMORY_TOO_LARGE` error with the peak and configured limit; no
+partial answer is published. Set the variable to `0` to disable this ceiling.
 
 Where the platform exposes no footprint sample, `peak_rss_mb` is `null` and
 `peak_rss_basis` says why — never `0`, which would read as a measured floor. A

{sourcecode-5.9.19 → sourcecode-5.9.23}/docs/migrate-check.md

@@ -97,6 +97,30 @@ resolved for this field, and ASK does not make a legal entitlement claim. If the
 not declare a Java version, the inventory reports `java_version_unknown`; it never treats missing
 evidence as ready for the target LTS.
 
+## JVM ecosystem inventory (`jvm_inventory`)
+
+The report also includes `jvm_inventory` (`jvm-inventory-v1`), a bounded and
+advisory evidence block for modernization planning. It records local build
+coordinates and source imports for Spring Boot/Framework, Hibernate, Jakarta EE,
+Quarkus and Micronaut, plus evidence for virtual threads, `ScopedValue`, Java
+modules, `native-image`, `jlink`, `jpackage`, and Java versions declared in Docker
+or CI files. Source/build evidence includes a POSIX path and line number; SBOM
+documents include their local path and format/version.
+
+Frameworks are classified as `declared_only`, `observed_only`,
+`declared_and_observed`, or `unobserved`; missing evidence is not a positive claim.
+The scanner reads local text only, caps its file/evidence population, does not
+execute Maven/Gradle, resolve dependencies, access the network, inspect a CVE
+database, or make runtime recommendations. It is additive and does not affect
+readiness, findings, effort, or existing endpoint populations.
+
+The conditional P2 SBOM reader is available under `jvm_inventory.sbom` for
+local CycloneDX JSON (`bomFormat`) and SPDX JSON (`spdxVersion`) documents. It
+reports document format/version and bounded component coordinates only. It does
+not query CVE or license databases, verify signatures, contact artifact
+repositories, or make a supply-chain verdict. XML SBOMs and unrecognized JSON
+remain outside this reader and are not interpreted.
+
 ## Claim provenance (`evidence_manifest`)
 
 Every JSON report also includes `evidence_manifest`: a compact index of the claims already

sourcecode-5.9.23/docs/perf/baselines/5.9.22/petclinic__ask__cold.json

@@ -0,0 +1,59 @@
+{
+  "schema_version": "perf-baseline-v1",
+  "tool_version": "5.9.22",
+  "captured_at": "2026-09-01T08:51:30Z",
+  "command": "ask",
+  "repo": {
+    "name": "spring-petclinic",
+    "commit": "45649e0",
+    "files": 47,
+    "bytes": 123264,
+    "classes": 25,
+    "methods": 72
+  },
+  "scale_dimensions": {
+    "files": 47,
+    "classes": 25,
+    "methods": 72
+  },
+  "scale_dimensions_basis": "The repository axes this timing is expected to scale over. A performance claim without these dimensions is not comparable across repositories.",
+  "mode": "cold",
+  "runs": 2,
+  "wall_ms": {
+    "p50": 742.306,
+    "p95": 753.485,
+    "min": 729.885,
+    "max": 754.727
+  },
+  "phase_ms": {
+    "discovery": {
+      "p50": 6.152,
+      "p95": 6.238
+    },
+    "detection": {
+      "p50": 19.386,
+      "p95": 19.954
+    },
+    "analysis": {
+      "p50": 126.555,
+      "p95": 127.517
+    },
+    "serialize": {
+      "p50": 0.898,
+      "p95": 0.906
+    },
+    "unattributed_p50": 589.315
+  },
+  "rss_peak_bytes": {
+    "p50": 75284480.0,
+    "p95": 75284480.0
+  },
+  "env": {
+    "python": "3.14.6",
+    "os": "darwin",
+    "cpu": "arm",
+    "cores": 8,
+    "hostname_hash": "3972fec0",
+    "host_id_declared": false
+  }
+}

sourcecode-5.9.23/docs/perf/baselines/5.9.22/petclinic__ask__warm.json

@@ -0,0 +1,47 @@
+{
+  "schema_version": "perf-baseline-v1",
+  "tool_version": "5.9.22",
+  "captured_at": "2026-09-01T08:51:32Z",
+  "command": "ask",
+  "repo": {
+    "name": "spring-petclinic",
+    "commit": "45649e0",
+    "files": 47,
+    "bytes": 123264,
+    "classes": 25,
+    "methods": 72
+  },
+  "scale_dimensions": {
+    "files": 47,
+    "classes": 25,
+    "methods": 72
+  },
+  "scale_dimensions_basis": "The repository axes this timing is expected to scale over. A performance claim without these dimensions is not comparable across repositories.",
+  "mode": "warm",
+  "runs": 2,
+  "wall_ms": {
+    "p50": 352.405,
+    "p95": 356.578,
+    "min": 347.768,
+    "max": 357.042
+  },
+  "phase_ms": {
+    "discovery": null,
+    "detection": null,
+    "analysis": null,
+    "serialize": null,
+    "instrumentation": "absent"
+  },
+  "rss_peak_bytes": {
+    "p50": 75284480.0,
+    "p95": 75284480.0
+  },
+  "env": {
+    "python": "3.14.6",
+    "os": "darwin",
+    "cpu": "arm",
+    "cores": 8,
+    "hostname_hash": "3972fec0",
+    "host_id_declared": false
+  }
+}

{sourcecode-5.9.19 → sourcecode-5.9.23}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.19"
+version = "5.9.23"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.19 → sourcecode-5.9.23}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.19"
+__version__ = "5.9.23"