sourcecode 5.9.1__tar.gz → 5.9.3__tar.gz

{sourcecode-5.9.1 → sourcecode-5.9.3}/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## [5.9.3] — 2026-08-27
+
+*Workspace entitlement correctness patch release.*
+
+**Fixed**
+
+- `auth workspace` collapses overlapping parent/child repository paths and
+  publishes `overlapping_paths`, preventing physical Java files from being
+  counted twice.
+- `auth workspace` rejects nonexistent or non-directory paths through the
+  standard structured `INVALID_INPUT` / `missing` contract instead of treating
+  them as empty repositories.
+
+**Validation**
+
+- Added regression coverage for duplicate, overlapping, invalid and mixed
+  workspace inputs.
+- Rechecked the contract against representative repositories under
+  `Documents/workspace/testing`.
+
+## [5.9.2] — 2026-08-27
+
+*Commercial positioning increment: bounded agent context, reproducible cost
+measurement, source-level SARIF delivery and workspace entitlement pilot.*
+
+**Added**
+
+- `repo-ir --budget-tokens N` composes with `--since` and declares graph
+  non-coverage instead of truncating an answer.
+- `scripts/context_cost_harness.py` compares two declared task commands without
+  a shell and publishes no delta unless both sides resolve comparably.
+- `migrate-check --format sarif` emits ASK-owned migration findings with source
+  locations, provenance and non-coverage.
+- `auth workspace --enforce` provides an opt-in named-buyer pilot using the
+  existing Pro gate; advisory mode remains the default.
+
+**Documentation and validation**
+
+- README, user guide, roadmap and CLI help describe the new commercial surfaces.
+- The changes were verified against the four repositories in
+  `Documents/workspace/testing` and the focused regression batteries.
+
 ## [5.9.1] — 2026-08-26
 
 *Audit correction and stress-validation patch release. The `AUD-608` fixes

{sourcecode-5.9.1 → sourcecode-5.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.1
+Version: 5.9.3
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.1-blue)
+![Version](https://img.shields.io/badge/version-5.9.3-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -122,6 +122,14 @@ the CI signal; `--allow-unverified` can change only that exit code, never the
 reported verdict. Every pack carries a manifest with component invocations,
 source evidence and content fingerprints.
 
+For agent integrations, `ask repo-ir --since <ref> --budget-tokens N` bounds the
+serialized inline answer. If the full graph does not fit, ASK returns its summary
+view and declares `token_budget.coverage: non_coverage`; it never silently truncates
+JSON. For a rerunnable cost comparison, use `scripts/context_cost_harness.py` with
+explicit `--with-ask` and `--without-ask` command templates. It executes without a
+shell and publishes a token delta only when both commands resolve and `--comparable`
+is declared.
+
 The [Product Route](docs/PRODUCT-ROUTE.md) is normative: ASK focuses on
 deterministic evidence for Java/Spring modernization and safe change. Packs
 compose existing commands; they do not hide or replace them.
@@ -188,7 +196,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.1 retains the shared Canonical IR
+**Current performance status.** Release 5.9.3 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
@@ -197,6 +205,19 @@ and bounded-output regressions for this release; use `ask cache model <repo>` an
 [latest external audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.9.0.md) before
 treating a historical timing or bounded flag as a current guarantee.
 
+**CI delivery and workspace licensing.** `migrate-check --format sarif` emits
+ASK-owned migration findings with source locations and provenance; it does not
+re-emit imported scanner findings. `ask auth workspace <repo>...` previews the
+aggregate Java entitlement. `--enforce` is an opt-in named-buyer pilot that reuses
+the existing Pro gate; advisory mode remains the default and no billing is
+performed by the CLI.
+
+`auth workspace` normalizes its repository arguments before counting. If one
+path contains another, the parent is counted once and the overlap is published
+in `overlapping_paths`; a missing or non-directory path is rejected as structured
+invalid input rather than treated as an empty repository. This prevents silent
+entitlement errors in CI and does not change per-repository gates or billing.
+
 **What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
 IR). Pass `--views compact` or `--views compact,agent` to warm only selected views; without
@@ -222,7 +243,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.1 — and, on a build that has aged,
+ask version                    # ask 5.9.3 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -506,27 +527,28 @@ from it.
 | `posture` | supported | which beans a profile set wires, and how effective endpoint access differs between two sets | the most differentiated capability here. `--resolve-environments` says which set the repository decides; `--profile-from <file>` reads the artefact that actually decides it (Kubernetes manifest, compose file, deployment plan, `Dockerfile`, dotenv) and answers under that set, with the `file:line` — deciding nothing leaves the verdict untouched |
 | `risk` | supported | what each defect actually costs, once reach, access, write effect and the shape of the input path are in it | `defect_severity × reachability × auth_verdict × write_effect × query_construction × input_constraints`; every factor names its authority; the `query_construction` factor covers MyBatis `${}` splicing with a three-state verdict (`reaches` / `does_not_reach` / `undecidable`) and publishes the census; `--table --rule SEC-008 --band high --top-n 20` gives audit triage without `jq` |
 | `enrich` | experimental | another scanner's SARIF findings, ranked by what this repository does with them | `--sarif <log>`; same composition as `risk`, with `--table --rule <id> --band high --top-n 20` for triage |
-| `audit-report` | supported | human audit bundle over existing `risk` + `posture` evidence, optionally signed | includes `evidence_manifest` claim provenance; `--format markdown`; `--sign-key <file>` signs canonical JSON with HMAC-SHA256 |
+| `audit-report` | supported | human audit bundle over existing `risk` + `posture` evidence, optionally signed | includes `evidence_manifest` claim provenance; `--format markdown`; `--sign-key <file>` signs canonical JSON with HMAC-SHA256; `--pack ens` adds a technical ENS control matrix |
+| `audit-verify` | supported | offline verification of a signed `audit-report` bundle | recomputes the canonical payload and HMAC-SHA256; returns `valid: true/false` and a CI-friendly exit code without re-running the audit |
 | `migrate-recipe` | supported | the migration report as the OpenRewrite recipe that applies it | only recipes a finding named; the manual remainder published beside them; writes nothing without `--write`, and never a runnable command for an empty recipe list |
 | `migrate-apply` | supported | apply a measured recipe without touching the main tree | Maven and Gradle executors; plan by default; `--write` requires clean Git, pinned version and isolated worktree; no automatic commit or merge |
 | `data-exposure` | supported | which routes can carry the data you labelled, and who reaches them | labels declared in `sourcecode.config.json` — never inferred from a name; `signature` and `call_reach` evidence published apart, field-level flow out of scope (NC-008). With nothing declared, `ask data-exposure /path/to/repo` answers `answered: false` and hands back the file, the key and an example to declare — it never reports zero exposed routes |
 | `data-exposure --init` | supported | generate review-only label candidates | writes only `.ask/data-label-candidates-v1.json` with `status: proposed_only`; it never activates labels |
 | `endpoints` | core | every REST endpoint, effective path, security policy, confidence | Spring MVC + JAX-RS (~65 % recall on JAX-RS sub-resource locators). `--compact` answers the exposure census without the rows; `--servlets` lists the servlet-mounted surface as its own population; `--client-usage` says which routes the TS/JS client in this repository actually calls; `--consumer <repo>` (repeatable) joins the routes against consumers in **other** repositories — TypeScript/JS and Java — and turns the census into a surface-reduction plan: open and called (fix now), open and called by nobody (delete rather than guard), and calls this server serves no route for |
 | `spring-audit` | core | transactional anomalies + security configuration/exposure + validation gaps | `--ci`, `-f github-comment`, or `-f github-actions` for native CI annotations; `--table --rule SEC-008 --top-n 20` for human-scale review. Every run inventories its own rules — `rules_run`, `rules_not_run`, `rules_partially_run`, `rules_run_count`/`rules_total` — so "all of them" is a fact, not an assumption |
-| `migrate-check` | core | Boot 2→3 readiness + Java LTS/licensing inventory: located blockers, per-dimension score, effort, detected Java 8/11/17/21/25 evidence and explicit licensing-review signals | `--target-jdk 25` sets the target LTS route; `--blast-radius` orders the re-test plan; `--format github-actions` emits a stable CI annotation; `--table --rule MIG-001 --band critical --top-n 20` for blocker triage |
+| `migrate-check` | core | Boot 2→3 readiness + Java LTS/licensing inventory: located blockers, per-dimension score, effort, detected Java 8/11/17/21/25 evidence and explicit licensing-review signals | `--target-jdk 25` sets the target LTS route; `--blast-radius` orders the re-test plan; `--format github-actions` emits a stable CI annotation; `--format sarif` emits located ASK-owned findings; `--table --rule MIG-001 --band critical --top-n 20` for blocker triage |
 | `impact` / `impact-chain` | core | blast radius of a change, to the endpoints it reaches | target the **interface**, not the `Impl` |
 | `pr-impact` | core | the same, scoped to a PR diff | local `git diff HEAD`, `--since REF`, explicit `--files`, or opt-in `--pr NUMBER`; `--format github-actions` emits CI annotations; `--fail-on` gates |
 | `verify` | core | does the repo satisfy its declared contracts, **relative to a baseline** | `.ask/contracts.yml`; `--format github-actions` emits a native CI annotation while preserving exit 0/1/2. `.ask/waivers.yml` adjudicates a finding as *not a defect here* (stable id + required reason, optional expiry) so a reviewed row stops holding the gate red — a baseline records accepted debt, a waiver says it was never a defect |
 | `verify-edit` | supported | did the working-tree edits change runtime behaviour | semantic diff gate for the edit loop |
 | `--compact` / `--agent` | — | bounded structural context for an agent | flags of the root command, not commands: not tiered |
 | `onboard` / `explain` / `cold-start` | supported | orientation in an unfamiliar repo; per-class summary; bootstrap snapshot | `onboard` publishes `population`, `population_unit` and `population_total` for its source-file universe |
-| `export` / `repo-ir` / `schema` | supported | tool-agnostic views (C4, module graph, integrations); symbol-level IR; published JSON Schemas | `export --c4 --render mermaid\|svg` **draws** the model instead of only emitting it — presentation over the same payload, with the node cap written on the canvas |
+| `export` / `repo-ir` / `schema` | supported | tool-agnostic views (C4, module graph, integrations); symbol-level IR; published JSON Schemas | `export --c4 --render mermaid\|svg` **draws** the model instead of only emitting it; `repo-ir --since REF --budget-tokens N` provides bounded, deterministic agent context |
 | `modernize` | supported | coupling hubs, cycles, dead zones, refactor candidates | |
 | `review-pr` / `fix-bug` / `prepare-context` | supported | diff review, symptom triage, task-shaped context | |
 | `plan` / `compare` / `delta` / `contract-diff` | supported | what to review for a change; candidates by measured cost; outcome of a change; public-contract break | no verdicts, measured cost only |
 | `validation` | supported | request-body validation coverage and gaps | |
-| `baseline capture\|diff` · `trend` | supported | versioned architectural metrics over time — and, with `--kind findings`, the **defect population** as a series, so "open since 5.8.28" is answerable without anybody keeping the tally (`first_seen` is the earliest STORED capture, and the payload says so); `ask trend .` reads the series (a repository path or a baselines directory), `ask baseline diff .` compares the tree against its newest point | trend reporting, not gating. Baselines land in `.ask/baselines` **inside the repository** — the history travels with the code, not with a vendor; an audit that must not write passes `--dir`. `capture --auto` is the unattended form (one baseline per commit, never rewrites one, never fails the build) — automate it: [baseline-ci.yml](docs/baseline-ci.yml) |
-| `cve` | supported | which dependency advisories a route can actually **reach** — not which are on the classpath | reads a **local** OSV feed (`--feed`); takes no network at analysis time, so a CI gate can never pass because a fetch timed out. Four verdicts: `reachable` (with the routes), `imported_not_exposed`, `not_observed` and `unknown`. Nothing answers *"not reachable"* — reflection, SPI loading and container wiring reach code no source edge names — and an unresolved Maven version is `unknown`, never `not_affected`. Feed staleness is read off the feed's own dates |
+| `baseline capture\|diff\|trend\|attest` | supported | versioned architectural metrics over time, findings history and a bounded read-only evidence attestation (`baseline-attestation-v1`) with explicit comparability and non-coverage | trend reporting and evidence continuity, not gating or legal compliance. Baselines land in `.ask/baselines` **inside the repository** or an external `--dir`; automate capture with [baseline-ci.yml](docs/baseline-ci.yml) |
+| `cve` | supported | which dependency advisories a route can actually **reach** — not which are on the classpath | reads a **local** OSV feed (`--feed`) and optional local VEX statements (`--vex`); VEX is matched exactly and annotates `accepted_by_vex` without changing reachability; takes no network at analysis time |
 | `intent` | supported | a plain-language question, resolved to the typed `retrieve` query that answers it | `ask intent "what breaks if I change OrderService?"`. A scored lexical match against a declared vocabulary — **no model, no generation** — so it resolves identically on every machine. It selects a query and prints it; `--run` executes it. A question fitting two intents too closely is refused with both named, because a well-formed answer to a question you did not ask is invisible once printed |
 | `remediate` | supported | the loop from a finding to a **verified** change | audit → recipe → apply in a dedicated worktree → `verify-edit`. Dry by default. Most findings are not mechanical and the plan says which and why; an apply that could not be verified reports `unverified`, never `applied` |
 | `pr-risk` | supported | one verdict for **this diff** — does the change make things worse? | `pack gate` answers about the repository; this answers about the change. Joins `pr-impact` reach, endpoint access, the shared risk model and CODEOWNERS. `--since` differences route inventories so `new_endpoints` is a fact rather than a guess. A changed file that maps to no class caps the verdict at `UNKNOWN`, which fails every gate — a partial blast radius is not a small one |

{sourcecode-5.9.1 → sourcecode-5.9.3}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.1-blue)
+![Version](https://img.shields.io/badge/version-5.9.3-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -73,6 +73,14 @@ the CI signal; `--allow-unverified` can change only that exit code, never the
 reported verdict. Every pack carries a manifest with component invocations,
 source evidence and content fingerprints.
 
+For agent integrations, `ask repo-ir --since <ref> --budget-tokens N` bounds the
+serialized inline answer. If the full graph does not fit, ASK returns its summary
+view and declares `token_budget.coverage: non_coverage`; it never silently truncates
+JSON. For a rerunnable cost comparison, use `scripts/context_cost_harness.py` with
+explicit `--with-ask` and `--without-ask` command templates. It executes without a
+shell and publishes a token delta only when both commands resolve and `--comparable`
+is declared.
+
 The [Product Route](docs/PRODUCT-ROUTE.md) is normative: ASK focuses on
 deterministic evidence for Java/Spring modernization and safe change. Packs
 compose existing commands; they do not hide or replace them.
@@ -139,7 +147,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.1 retains the shared Canonical IR
+**Current performance status.** Release 5.9.3 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
@@ -148,6 +156,19 @@ and bounded-output regressions for this release; use `ask cache model <repo>` an
 [latest external audit intake](docs/AUDIT-2026-08-26-EXTERNAL-5.9.0.md) before
 treating a historical timing or bounded flag as a current guarantee.
 
+**CI delivery and workspace licensing.** `migrate-check --format sarif` emits
+ASK-owned migration findings with source locations and provenance; it does not
+re-emit imported scanner findings. `ask auth workspace <repo>...` previews the
+aggregate Java entitlement. `--enforce` is an opt-in named-buyer pilot that reuses
+the existing Pro gate; advisory mode remains the default and no billing is
+performed by the CLI.
+
+`auth workspace` normalizes its repository arguments before counting. If one
+path contains another, the parent is counted once and the overlap is published
+in `overlapping_paths`; a missing or non-directory path is rejected as structured
+invalid input rather than treated as an empty repository. This prevents silent
+entitlement errors in CI and does not change per-repository gates or billing.
+
 **What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
 IR). Pass `--views compact` or `--views compact,agent` to warm only selected views; without
@@ -173,7 +194,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.1 — and, on a build that has aged,
+ask version                    # ask 5.9.3 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 
@@ -457,27 +478,28 @@ from it.
 | `posture` | supported | which beans a profile set wires, and how effective endpoint access differs between two sets | the most differentiated capability here. `--resolve-environments` says which set the repository decides; `--profile-from <file>` reads the artefact that actually decides it (Kubernetes manifest, compose file, deployment plan, `Dockerfile`, dotenv) and answers under that set, with the `file:line` — deciding nothing leaves the verdict untouched |
 | `risk` | supported | what each defect actually costs, once reach, access, write effect and the shape of the input path are in it | `defect_severity × reachability × auth_verdict × write_effect × query_construction × input_constraints`; every factor names its authority; the `query_construction` factor covers MyBatis `${}` splicing with a three-state verdict (`reaches` / `does_not_reach` / `undecidable`) and publishes the census; `--table --rule SEC-008 --band high --top-n 20` gives audit triage without `jq` |
 | `enrich` | experimental | another scanner's SARIF findings, ranked by what this repository does with them | `--sarif <log>`; same composition as `risk`, with `--table --rule <id> --band high --top-n 20` for triage |
-| `audit-report` | supported | human audit bundle over existing `risk` + `posture` evidence, optionally signed | includes `evidence_manifest` claim provenance; `--format markdown`; `--sign-key <file>` signs canonical JSON with HMAC-SHA256 |
+| `audit-report` | supported | human audit bundle over existing `risk` + `posture` evidence, optionally signed | includes `evidence_manifest` claim provenance; `--format markdown`; `--sign-key <file>` signs canonical JSON with HMAC-SHA256; `--pack ens` adds a technical ENS control matrix |
+| `audit-verify` | supported | offline verification of a signed `audit-report` bundle | recomputes the canonical payload and HMAC-SHA256; returns `valid: true/false` and a CI-friendly exit code without re-running the audit |
 | `migrate-recipe` | supported | the migration report as the OpenRewrite recipe that applies it | only recipes a finding named; the manual remainder published beside them; writes nothing without `--write`, and never a runnable command for an empty recipe list |
 | `migrate-apply` | supported | apply a measured recipe without touching the main tree | Maven and Gradle executors; plan by default; `--write` requires clean Git, pinned version and isolated worktree; no automatic commit or merge |
 | `data-exposure` | supported | which routes can carry the data you labelled, and who reaches them | labels declared in `sourcecode.config.json` — never inferred from a name; `signature` and `call_reach` evidence published apart, field-level flow out of scope (NC-008). With nothing declared, `ask data-exposure /path/to/repo` answers `answered: false` and hands back the file, the key and an example to declare — it never reports zero exposed routes |
 | `data-exposure --init` | supported | generate review-only label candidates | writes only `.ask/data-label-candidates-v1.json` with `status: proposed_only`; it never activates labels |
 | `endpoints` | core | every REST endpoint, effective path, security policy, confidence | Spring MVC + JAX-RS (~65 % recall on JAX-RS sub-resource locators). `--compact` answers the exposure census without the rows; `--servlets` lists the servlet-mounted surface as its own population; `--client-usage` says which routes the TS/JS client in this repository actually calls; `--consumer <repo>` (repeatable) joins the routes against consumers in **other** repositories — TypeScript/JS and Java — and turns the census into a surface-reduction plan: open and called (fix now), open and called by nobody (delete rather than guard), and calls this server serves no route for |
 | `spring-audit` | core | transactional anomalies + security configuration/exposure + validation gaps | `--ci`, `-f github-comment`, or `-f github-actions` for native CI annotations; `--table --rule SEC-008 --top-n 20` for human-scale review. Every run inventories its own rules — `rules_run`, `rules_not_run`, `rules_partially_run`, `rules_run_count`/`rules_total` — so "all of them" is a fact, not an assumption |
-| `migrate-check` | core | Boot 2→3 readiness + Java LTS/licensing inventory: located blockers, per-dimension score, effort, detected Java 8/11/17/21/25 evidence and explicit licensing-review signals | `--target-jdk 25` sets the target LTS route; `--blast-radius` orders the re-test plan; `--format github-actions` emits a stable CI annotation; `--table --rule MIG-001 --band critical --top-n 20` for blocker triage |
+| `migrate-check` | core | Boot 2→3 readiness + Java LTS/licensing inventory: located blockers, per-dimension score, effort, detected Java 8/11/17/21/25 evidence and explicit licensing-review signals | `--target-jdk 25` sets the target LTS route; `--blast-radius` orders the re-test plan; `--format github-actions` emits a stable CI annotation; `--format sarif` emits located ASK-owned findings; `--table --rule MIG-001 --band critical --top-n 20` for blocker triage |
 | `impact` / `impact-chain` | core | blast radius of a change, to the endpoints it reaches | target the **interface**, not the `Impl` |
 | `pr-impact` | core | the same, scoped to a PR diff | local `git diff HEAD`, `--since REF`, explicit `--files`, or opt-in `--pr NUMBER`; `--format github-actions` emits CI annotations; `--fail-on` gates |
 | `verify` | core | does the repo satisfy its declared contracts, **relative to a baseline** | `.ask/contracts.yml`; `--format github-actions` emits a native CI annotation while preserving exit 0/1/2. `.ask/waivers.yml` adjudicates a finding as *not a defect here* (stable id + required reason, optional expiry) so a reviewed row stops holding the gate red — a baseline records accepted debt, a waiver says it was never a defect |
 | `verify-edit` | supported | did the working-tree edits change runtime behaviour | semantic diff gate for the edit loop |
 | `--compact` / `--agent` | — | bounded structural context for an agent | flags of the root command, not commands: not tiered |
 | `onboard` / `explain` / `cold-start` | supported | orientation in an unfamiliar repo; per-class summary; bootstrap snapshot | `onboard` publishes `population`, `population_unit` and `population_total` for its source-file universe |
-| `export` / `repo-ir` / `schema` | supported | tool-agnostic views (C4, module graph, integrations); symbol-level IR; published JSON Schemas | `export --c4 --render mermaid\|svg` **draws** the model instead of only emitting it — presentation over the same payload, with the node cap written on the canvas |
+| `export` / `repo-ir` / `schema` | supported | tool-agnostic views (C4, module graph, integrations); symbol-level IR; published JSON Schemas | `export --c4 --render mermaid\|svg` **draws** the model instead of only emitting it; `repo-ir --since REF --budget-tokens N` provides bounded, deterministic agent context |
 | `modernize` | supported | coupling hubs, cycles, dead zones, refactor candidates | |
 | `review-pr` / `fix-bug` / `prepare-context` | supported | diff review, symptom triage, task-shaped context | |
 | `plan` / `compare` / `delta` / `contract-diff` | supported | what to review for a change; candidates by measured cost; outcome of a change; public-contract break | no verdicts, measured cost only |
 | `validation` | supported | request-body validation coverage and gaps | |
-| `baseline capture\|diff` · `trend` | supported | versioned architectural metrics over time — and, with `--kind findings`, the **defect population** as a series, so "open since 5.8.28" is answerable without anybody keeping the tally (`first_seen` is the earliest STORED capture, and the payload says so); `ask trend .` reads the series (a repository path or a baselines directory), `ask baseline diff .` compares the tree against its newest point | trend reporting, not gating. Baselines land in `.ask/baselines` **inside the repository** — the history travels with the code, not with a vendor; an audit that must not write passes `--dir`. `capture --auto` is the unattended form (one baseline per commit, never rewrites one, never fails the build) — automate it: [baseline-ci.yml](docs/baseline-ci.yml) |
-| `cve` | supported | which dependency advisories a route can actually **reach** — not which are on the classpath | reads a **local** OSV feed (`--feed`); takes no network at analysis time, so a CI gate can never pass because a fetch timed out. Four verdicts: `reachable` (with the routes), `imported_not_exposed`, `not_observed` and `unknown`. Nothing answers *"not reachable"* — reflection, SPI loading and container wiring reach code no source edge names — and an unresolved Maven version is `unknown`, never `not_affected`. Feed staleness is read off the feed's own dates |
+| `baseline capture\|diff\|trend\|attest` | supported | versioned architectural metrics over time, findings history and a bounded read-only evidence attestation (`baseline-attestation-v1`) with explicit comparability and non-coverage | trend reporting and evidence continuity, not gating or legal compliance. Baselines land in `.ask/baselines` **inside the repository** or an external `--dir`; automate capture with [baseline-ci.yml](docs/baseline-ci.yml) |
+| `cve` | supported | which dependency advisories a route can actually **reach** — not which are on the classpath | reads a **local** OSV feed (`--feed`) and optional local VEX statements (`--vex`); VEX is matched exactly and annotates `accepted_by_vex` without changing reachability; takes no network at analysis time |
 | `intent` | supported | a plain-language question, resolved to the typed `retrieve` query that answers it | `ask intent "what breaks if I change OrderService?"`. A scored lexical match against a declared vocabulary — **no model, no generation** — so it resolves identically on every machine. It selects a query and prints it; `--run` executes it. A question fitting two intents too closely is refused with both named, because a well-formed answer to a question you did not ask is invisible once printed |
 | `remediate` | supported | the loop from a finding to a **verified** change | audit → recipe → apply in a dedicated worktree → `verify-edit`. Dry by default. Most findings are not mechanical and the plan says which and why; an apply that could not be verified reports `unverified`, never `applied` |
 | `pr-risk` | supported | one verdict for **this diff** — does the change make things worse? | `pack gate` answers about the repository; this answers about the change. Joins `pr-impact` reach, endpoint access, the shared risk model and CODEOWNERS. `--since` differences route inventories so `new_endpoints` is a fact rather than a guess. A changed file that maps to no class caps the verdict at `UNKNOWN`, which fails every gate — a partial blast radius is not a small one |

sourcecode-5.9.3/docs/AUDIT-2026-08-27-EXTERNAL-5.9.2.md

@@ -0,0 +1,68 @@
+# External Audit Intake — ASK 5.9.2
+
+**Received:** 2026-08-27  
+**Scope:** regression battery and commercial-positioning review against 5.9.1  
+**Source:** external audit supplied in the Codex task attachment
+
+## Executive disposition
+
+The report uses two different scoring lenses: **9.8/10** for the regression and
+functional battery, and **9/10** for the strategic comparison against 5.9.1.
+They are retained as separate assessments, not averaged into a product KPI.
+
+The audit reports no critical defect and no regression in the previously closed
+surface. It confirms stable behaviour for `SEC-004` / `DEAD-001`, `boot3_readiness`,
+the `selftest` scope warning, pack-gate test-file poisoning, JAX-RS explainability,
+CVE inventory scope, `pr-risk` error handling, `posture --diff --limit`, cache,
+telemetry, baseline and pack flows.
+
+Two new `auth workspace` defects are accepted into the engineering queue:
+
+- **AUD-609-B01, medium:** overlapping repository arguments can double-count the
+  same physical Java files when a parent path and one of its descendants are both
+  supplied. This can make entitlement aggregation inaccurate and can produce a
+  false threshold crossing near the limit.
+- **AUD-609-B02, low-medium:** a nonexistent repository path is treated as a valid
+  empty repository. A typo can therefore produce a successful but misleading
+  entitlement result in automation.
+
+The audit's reproduction is accepted as a defect report, not as proof of the
+suspected implementation mechanism. The fix must establish the invariant through
+tests: overlapping inputs are explicit and deterministic, and invalid paths cannot
+silently become empty repositories.
+
+## Confirmed capabilities
+
+- `audit-report --sign-key` and `audit-verify` perform an offline HMAC-SHA256
+  roundtrip: correct key and untouched content validate; an incorrect key or one-byte
+  content mutation fails with the appropriate result and exit code.
+- `audit-report --pack ens` is evidence mapping only. It publishes `legal_claim: false`
+  and distinguishes present from missing control evidence; it is not ENS certification.
+- `baseline attest` is deterministic, read-only and explicit about non-coverage, but
+  it does **not** sign or hash the attestation for independent integrity verification.
+- `remediation-report` is a redacted JSON projection of ASK's own defect ledger, not
+  a remediation report for the user's analysed repository.
+- `auth workspace --enforce` remains an opt-in named-buyer pilot and was not exercised
+  in this round.
+- `schema` includes `ens-evidence-pack-v1`; `ask version` publishes closure coverage
+  and release cadence provenance.
+
+## Commercial reading
+
+The signed audit bundle materially strengthens the evidence-bundle thesis and is a
+credible compliance-workflow input. It must be described as **tamper-evident integrity
+evidence**, not a certificate: HMAC is symmetric, requires key sharing, and is not
+public PKI. ENS/CRA mappings remain evidence mapping, not legal or regulatory advice.
+
+The commercial route is therefore positive but not fully validated. The missing proof
+is a signed historical attestation, concrete ENS/CRA control translation and a real
+customer reference. The external price indication ($40-60 per developer/month) and
+the "strong buy" verdict are market hypotheses, not pricing evidence; no price change
+is authorized without buyer interviews, usage data or a paid reference.
+
+## Regression and non-regression record
+
+The reported cold-cache measurement (130.2 seconds) is within the supplied historical
+range and is not a regression claim. The seven commands not yet composed into the
+assessment/gate packs are a product opportunity, not a bug. All other re-checks in the
+report are recorded as stable unless contradicted by the two defects above.

{sourcecode-5.9.1 → sourcecode-5.9.3}/docs/CACHE.md

@@ -137,6 +137,7 @@ The second anchor is the field one, and it carries its own build for the same re
 | `chunk-file` | nothing | not timed | no | — | Reads one file; nothing to cache. |
 | `intent` | nothing | not timed | no | — | Resolving a question is a string operation over a declared vocabulary; only --run reaches the retrieval engine. |
 | `self-audit` | nothing | not timed | no | — | Reads this build's own registries and manifest; it never analyses a repository, so there is nothing to cache. |
+| `remediation-report` | nothing | not timed | no | — | Reads the bundled remediation ledger and build provenance; it analyses no repository and uses no cache layer. |
 | `drift` | the shared work | not timed | no | `parse`, `cir` | Resolves the posture through the shared CIR; --against resolves a second profile set over the same parse. |
 | `watch` | the shared work | not timed | yes | `parse`, `cir` | Warms once, then answers each save against the warm IR — the reason a per-save question is affordable at all. |
 | `pr-risk` | the shared work | not timed | no | `parse`, `cir` | Reuses the shared CIR for the blast radius; --since builds a second IR over the base tree, which is not cached. |
@@ -147,6 +148,7 @@ The second anchor is the field one, and it carries its own build for the same re
 | `explain-endpoint` | the shared work | not measured on the battery yet — bounded by `endpoints` on the same repository | yes | `cir`, `parse` | Builds the repository IR to answer about ONE route, so the warm it shares with `endpoints` and `posture` is the whole difference between a question you ask once and a question you ask twenty times. |
 | `selftest` | the shared work | not timed | no | `cir`, `parse` | Runs the ledger's acceptance criteria by invoking other commands against this repository, so it inherits their layers — a warm makes those runs warm. It holds no cache of its own and stores nothing. |
 | `regress` | nothing | not timed | no | — | Diffs two payload files this CLI already wrote; analyses no source, so no cache layer applies. What it reads about caching is the `cache_layers` field inside those payloads — to refuse a comparison taken under different cache states, not to use one. |
+| `audit-verify` | nothing | not timed | no | — | Verifies one local report and key; it does not inspect a repository or use ASK analysis caches. |
 | `trend` | nothing | not timed | no | — | Reads stored baseline artifacts from disk; analyses no source, so no cache layer applies. Same command as `baseline trend`. |
 | `baseline` | the shared work | capture 8.7 s → 3.6 s | no | `parse` | `capture`/`diff`/`trend` over architectural metrics. The field figure is `capture`, the subcommand that analyses; `trend` reads stored artifacts and has its own row. |
 | `retrieve` | the shared work | not timed | no | `cir`, `parse` | Every query builds or reuses the shared CIR a warm builds. |

{sourcecode-5.9.1 → sourcecode-5.9.3}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,7 +3,12 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT QUEUE — release `5.9.1`; external reconciliation `AUD-608` is implemented.**
+> **CURRENT QUEUE — release `5.9.3`; external reconciliation `AUD-608` is implemented.**
+> The 2026-08-27 external review adds `AUD-609-B01` (overlapping workspace paths
+> double-count Java files) and `AUD-609-B02` (missing workspace paths accepted as
+> empty repositories); both are fixed in `5.9.3`. It reports no regression in the
+> prior closure set. Evidence and the commercial interpretation are in
+> [`AUDIT-2026-08-27-EXTERNAL-5.9.2.md`](AUDIT-2026-08-27-EXTERNAL-5.9.2.md).
 > `AUD-608-C01` is closed in `fe1f624`: `cve` declares static
 > dependency-inventory coverage and non-coverage. `AUD-608-P01` is closed in
 > `b479465`: `pr-risk --since` constructs its base context and surfaces failures
@@ -98,6 +103,21 @@ aspirations: each is asserted by that row's tests.
 | `AUD-607-X07` | P3 | Stored finding baselines across releases. | `ask baseline capture/diff/trend --kind findings` (`findings-baseline-v1`) | **Implemented (`55b93c2`).** The same store as the architectural series, prefixed so neither reads the other's documents. `first_seen` is the earliest STORED capture and the payload says so. A rename is published as one resolved and one new. |
 | `AUD-607-X08` | P3 | Environment drift alerting. | `ask drift` (`access-drift-v1`) | **Implemented (`6463fdf`).** One arithmetic for both axes (time and environment), so the two answers cannot disagree. `newly_unmatched` and `newly_matched` are separate buckets; a `removed` route is never reported as having become safe. |
 | `AUD-607-X09` | P3 | `self-audit` — run ASK against its own build. | `ask self-audit` (`self-audit-v1`) | **Implemented (`f1fa913`), with its "not recommended" reason shipped inside the payload.** The semantic engine does not apply to Python source, so those figures are absent and declared rather than reported as zeros. What it does check — cache model, format contract, schema registry and output affordances over the INSTALLED build — found a real drift on its first run. |
+| `ASK-COM-01` | P1 | Continuous evidence attestation over persisted baseline history. | `ask baseline attest` (`baseline-attestation-v1`) | **Implemented.** Read-only projection of architecture or findings trend; publishes capture boundaries, latest commit, comparability and explicit non-coverage. It never claims legal compliance, improvement, or a clean zero without history. |
+
+### Feature Intake — external review of 5.9.2, 2026-08-27
+
+The supplied regression and market review reports no regression in the prior closure
+set. Its two reproducible `auth workspace` defects are opened below; the report's
+commercial recommendations are recorded as hypotheses, not product claims. Full
+triage is in [`AUDIT-2026-08-27-EXTERNAL-5.9.2.md`](AUDIT-2026-08-27-EXTERNAL-5.9.2.md).
+
+| ID | Priority | Feature / defect | Acceptance criteria | Status/order |
+|---|---:|---|---|---|
+| `AUD-609-B01` | P2 | `auth workspace` double-counts overlapping repository paths. | Normalize paths, detect parent/descendant overlap and prevent silent double-counting; publish an explicit overlap decision or reject the ambiguous input. Preserve deterministic per-repository evidence and add fixtures for parent-only, child-only and overlapping inputs. | **Fixed in `5.9.3`.** Parent/descendant inputs collapse to one counted tree and publish `overlapping_paths`. |
+| `AUD-609-B02` | P2 | `auth workspace` accepts a nonexistent path as an empty repository. | Validate every input path before counting; return the repository's standard structured path error, or an explicit invalid entry that cannot yield a successful entitlement decision. Add a regression fixture for typos and mixed valid/invalid inputs. | **Fixed in `5.9.3`.** Invalid paths fail with structured `INVALID_INPUT` / `missing`. |
+| `AUD-609-C01` | P2 | Signed evidence and historical attestation use different integrity contracts. | Decide whether `baseline attest` gains the existing signing mechanism or clearly publishes that it is unsigned; document the choice in help, schema and buyer-facing material. Do not call unsigned output a certificate or compliance proof. | **Queued, commercial validation.** No implementation claim until the signing boundary and key model are explicit. |
+| `AUD-609-C02` | P3 | Translate technical evidence into concrete ENS/CRA controls. | Define a named control mapping with source evidence, missing evidence and `legal_claim: false`; validate it with a named compliance buyer or auditor before presenting it as a market capability. | **Queued, buyer-gated.** `audit-report --pack ens` remains evidence mapping only. |
 
 ### Explicitly Rejected
 
@@ -677,12 +697,17 @@ Java file, ~500 MB per 24 000-file repository), which is a sizing document and a
 **What blocks `S-18` is `S-27`, and no memo saw it.** The row below is the reason `fleet`
 moves ahead of everything except `S-23`.
 
+**S-27 measurement increment shipped:** `ask auth workspace <repo>...` now publishes
+`workspace-entitlement-v1` with unique repository count, aggregate Java population and
+an explicit `advisory_only` policy status. It does not alter the existing per-repository
+gate; entitlement enforcement remains pending named-buyer validation.
+
 | # | Row | Mechanism | Done when |
 |---|---|---|---|
-| `S-27` | **The licence axis cannot charge the buyer the product is being built for** ⭐ — `P-13` | `is_large_repo()` counts Java files **per repository path** against `_FREE_REPO_JAVA_FILE_LIMIT = 500` (`license.py:121`, `:521`), and the only other axis is the `delta` automation quota (`:267`). An organisation of 40 microservices at 300 Java files each crosses no threshold on any repository and **pays nothing**. That is precisely the buyer the third memo identifies correctly — flota, defendibilidad, *"how many unauthenticated routes does my organisation have"* — so the product's own price model excludes it. This is not a pricing preference: it is a measured contradiction between the gate in `license.py` and the route in `PRODUCT-ROUTE.md` | An axis that can charge an organisation — repository count, or a fleet manifest, or seats over a workspace — declared in `license.entitlement()` with `when_it_changes` saying what it costs, exactly as `P-2` established for the existing axis. **Not** by lowering the per-repo threshold, which would start charging the users the current rule deliberately leaves free. Acceptance: a fixture workspace of N small repositories reaches the same entitlement decision as one large repository of the same total size, or the difference is published as a stated product decision rather than an accident of the counter |
-| `S-28` ◑ | **SARIF out — the findings reach the tab the developer already reads** — **first safe increment in `17fe1ca`**: `ask pack gate --format sarif` emits SARIF 2.1.0 decision diagnostics from the gate manifest only. A BLOCK/UNVERIFIED component becomes a locationless result with its component, status and exit code; a PASS emits nothing. This is deliberately narrower than an audit-finding export: no source location is invented and no component payload is re-emitted. | The schema was already in the house: `sarif.py` parses SARIF 2.1.0 for `enrich`, with severity mapping, location resolution and an `unresolved` list that names why a result could not be placed. The implemented gate channel reaches CI without presenting imported findings as ASK discoveries. **Remaining:** source-level exports for commands that own a finding population, with a round-trip assertion over their locations and non-coverage. A result that arrived through `enrich` stays attributed to the tool that found it and is never re-emitted as ASK's own: the enrichment is the reachability, not the detection (`NC-001`, `NC-002`). |
-| `S-29` | **The remediation record becomes a public, generated page** | Twenty rows closed and field-verified in twenty-four hours, a mechanism in source per row, two rejected with their measurement and their price. It lives in `docs/DEFECT-LEDGER.md`, which is shipped inside the wheel and nowhere else. The commercial argument is exact and is the memo's best: the first objection to a single-maintainer proprietary product is *"what if it disappears"*, and the hardest answer is not an SLA promise but the product's own numbers | A **generated projection**, never the raw file — `P-14`: rows open and closed per version, median days to closure, declined rows with their reason, derived from the ledger plus `build_commit` so it cannot drift from what shipped. Redaction is part of the acceptance criterion, not a follow-up: no absolute maintainer paths, no third-party evaluation subjects named as audited. Assertion over the generator, not over the output |
-| `S-30` | **The token bill becomes a measured number, and `--since` carries the budget** | Two halves of one thesis the memo states correctly: the customer's real cost is the agent's context bill, not the licence. The stateful half it proposes (a session that remembers what the agent was given) is **refused** — it makes the answer depend on what the agent claims it saw, which breaks the determinism this product sells. The stateless half is already almost built: `--since`, `delta`, `regress`, content-addressed answers and the declared `--compact` / `--agent` ceilings | (a) `--since <ref>` composed with a token budget on the existing bounded views, so an agent supplies the sha it holds and gets only what changed inside a stated ceiling, with `non_coverage` for what the budget cut. (b) A reproducible harness in the repository that runs one real agent task with and without ASK and publishes tokens per resolved task — under the honest-benchmark rule: what did **not** work is reported first, and no figure is published that a reader cannot re-run |
+| `S-27` ◑ | **The licence axis cannot charge the buyer the product is being built for** ⭐ — `P-13` | `is_large_repo()` counts Java files **per repository path** against `_FREE_REPO_JAVA_FILE_LIMIT = 500`, while `auth workspace` aggregates the fleet. The opt-in `--enforce` pilot now applies the existing Pro gate to that aggregate without changing per-repository behavior or billing code. | Measurement and pilot gate shipped. Full activation remains conditional on named-buyer validation; no default user is charged or blocked. |
+| `S-28` ✅ | **SARIF out — the findings reach the tab the developer already reads** — **closed with source-level migration export:** `pack gate`, `spring-audit`, `verify` and `migrate-check` emit SARIF 2.1.0 through dedicated ASK-owned renderers. Source findings carry their own locations; contract and gate decisions remain locationless where no source span exists. | The output channel is now available for the ASK-owned finding populations, with provenance and non-coverage preserved. Imported SARIF remains input to `enrich` and is never re-emitted as ASK discovery. |
+| `S-29` ✅ | **The remediation record becomes a public, generated page** — **closed:** `remediation-report` publishes the redacted projection of the shipped ledger with counts, distributions, provenance and closure coverage. Private narrative and paths stay excluded; the output is explicitly a trust artifact, not an SLA or security verdict. | `ask remediation-report` is the generated public projection; its tests assert redaction, provenance and consistency with the ledger. |
+| `S-30` ✅ | **The token bill becomes a measured number, and `--since` carries the budget** | **Shipped:** `repo-ir --budget-tokens N` composes with `--since`, and `scripts/context_cost_harness.py` measures a declared task with and without ASK. It publishes bytes/tokens, build and tree state, output hashes and a delta only when both commands resolve and the operator declares `--comparable`; otherwise it records `not_comparable` without a commercial figure. The stateful session proposal remains refused because it would make answers depend on what the agent claims to have seen, breaking determinism. | Closed for the stateless scope: budgeted bounded view plus reproducible two-command harness. No agent quality claim is published by default; comparable task definitions and their rerunnable artifacts remain the operator's evidence. |
 
 **One anti-goal recorded here so it is refused once.** No rule DSL and no third-party rule
 plugins for the architecture contracts of `S-23`'s neighbourhood. The memo cites *"grep grew

{sourcecode-5.9.1 → sourcecode-5.9.3}/docs/EXECUTIVE-ROADMAP.md

@@ -5,7 +5,10 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
-> **CURRENT UPDATE — release `5.9.1`, following the external `5.9.0` reconciliation (`AUD-608`).**
+> **CURRENT UPDATE — release `5.9.3`, following the external `5.9.0` reconciliation (`AUD-608`).**
+> The commercial increment adds stateless context budgets, a reproducible context-cost harness,
+> source-level migration SARIF and an opt-in workspace entitlement pilot. Advisory behaviour remains
+> the default; named-buyer validation is still required before broad enforcement.
 > Three defects confirmed in the shipped release are closed: `cve` now
 > discloses its static inventory (`fe1f624`), `pr-risk --since` returns a
 > structured error for unreadable base context (`b479465`), and
@@ -16,6 +19,21 @@
 > non-reproduction did not cover the payload shape now identified. Details are
 > in [`AUDIT-2026-08-26-EXTERNAL-5.9.0.md`](AUDIT-2026-08-26-EXTERNAL-5.9.0.md).
 
+> **EXTERNAL REVIEW — 5.9.2, received 2026-08-27.** No regression was reported in the
+> previously closed surface. Two `auth workspace` defects are now open: overlapping
+> parent/child paths can double-count Java files, and nonexistent paths are accepted as
+> empty repositories. Both affect entitlement accuracy and must close before pricing or
+> enforcement decisions rely on workspace aggregation. `audit-report --sign-key` plus
+> `audit-verify` is confirmed as working offline HMAC-SHA256 integrity evidence.
+> `baseline attest` remains unsigned and must not be sold as a tamper-verifiable
+> certificate. ENS output is evidence mapping only (`legal_claim: false`); no customer
+> reference or buyer validation exists yet. Full triage: [`AUDIT-2026-08-27-EXTERNAL-5.9.2.md`](AUDIT-2026-08-27-EXTERNAL-5.9.2.md).
+
+> **5.9.3 correction.** `auth workspace` now counts overlapping parent/child paths once
+> and rejects missing or non-directory paths with the standard structured input error.
+> Workspace entitlement is therefore safer to measure, but remains advisory by default;
+> no pricing or enforcement decision is authorized by this fix alone.
+
 > **HISTORICAL STATUS — release `5.9.0`, following two external audits of `5.8.32`, 2026-08-26.** Two
 > independent rounds scored the release **9.7/10** (reverification) and **8/10** (comparison against
 > `5.8.31`). **Neither round reported a regression**, and both maintained the same commercial

{sourcecode-5.9.1 → sourcecode-5.9.3}/docs/PRODUCT-ROUTE.md

@@ -33,6 +33,22 @@ The public trust layer, if activated, must be a generated and redacted
 projection, never the raw defect ledger. Its acceptance rules must exclude
 maintainer paths, third-party evaluation subjects and unsupported claims.
 
+### Evidence and commercial validation boundary
+
+The 5.9.2 external review confirms that `audit-report --sign-key` and
+`audit-verify` provide offline HMAC-SHA256 integrity verification for an evidence
+bundle. The route may describe this as tamper-evident bundle integrity, not as a
+certificate or public-PKI trust: HMAC is symmetric and requires controlled key
+sharing. `audit-report --pack ens` remains an evidence mapping with
+`legal_claim: false`, not ENS/CRA certification or legal advice.
+
+`baseline attest` is a deterministic, read-only continuity projection, but it is
+currently unsigned. Until its integrity contract is decided and validated, it
+must not be positioned as independently verifiable historical evidence. A real
+customer reference, concrete control translation and buyer evidence are still
+required before changing the price, activating workspace enforcement or claiming
+compliance-market fit. External price opinions are hypotheses, not pricing data.
+
 ## Individual commands and packs
 
 Every existing command remains supported for users who want a precise answer:
@@ -180,6 +196,11 @@ vulnerability is exploitable; and `not_observed` is explicitly not a statement
 of safety, because reflection, SPI loading and container wiring reach code no
 source edge names.
 
+An operator may also pass `--vex` with local, exact advisory/package decisions.
+ASK publishes those decisions as `accepted_by_vex` while preserving its own
+reachability verdict; an expired or absent VEX statement is not treated as a
+negative.
+
 ## Implementation order
 
 The implementation route is shipped through five bounded steps. The status is