sourcecode 5.9.22__py3-none-any.whl → 5.9.23__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.22"
+__version__ = "5.9.23"

sourcecode/_build_commit.py

@@ -1,5 +1,5 @@
 """Generated at build time by hatch_build.py. Do not edit (AUD-592-D04)."""
 
-BUILD_COMMIT = '64c8b3e429eadd7a12d34eb1e5eefa0c08e430e4'
+BUILD_COMMIT = '75c2f78dd8e2c7945e8a034f4f3c4fc8f9c40fc8'
 CLOSURE_PROVENANCE = {'AUD-611-B05': {'commit': '', 'status': 'uncited'}, 'AUD-611-B06': {'commit': '', 'status': 'uncited'}, 'AUD-611-B07': {'commit': '', 'status': 'uncited'}, 'AUD-611-B08': {'commit': '', 'status': 'uncited'}, 'AUD-611-B09': {'commit': '', 'status': 'uncited'}, 'AUD-611-B10': {'commit': '', 'status': 'uncited'}, 'AUD-611-B11': {'commit': '', 'status': 'uncited'}, 'AUD-612-07': {'commit': '', 'status': 'uncited'}, 'AUD-612-09': {'commit': '', 'status': 'uncited'}, 'AUD-612-14': {'commit': '', 'status': 'uncited'}, 'AUD-612-B03': {'commit': '', 'status': 'uncited'}, 'AUD-612-B07': {'commit': '', 'status': 'uncited'}, 'AUD-612-B13': {'commit': '', 'status': 'uncited'}, 'AUD-612-E': {'commit': '', 'status': 'uncited'}, 'AUD-612-G': {'commit': '', 'status': 'uncited'}, 'AUD-612-I': {'commit': '', 'status': 'uncited'}, 'AUD-612-K': {'commit': '', 'status': 'uncited'}, 'AUD-612-M': {'commit': '', 'status': 'uncited'}, 'AUD-612-R': {'commit': '', 'status': 'uncited'}, 'AUD-613-ROOT': {'commit': '', 'status': 'uncited'}, 'AUD-614-07': {'commit': '', 'status': 'uncited'}, 'AUD-614-E': {'commit': '', 'status': 'uncited'}, 'AUD-614-F': {'commit': '', 'status': 'uncited'}, 'AUD-614-G': {'commit': '', 'status': 'uncited'}, 'AUD-614-I': {'commit': '', 'status': 'uncited'}, 'AUD-614-INTENT-TIE': {'commit': '', 'status': 'uncited'}, 'AUD-614-JUNIT4': {'commit': '', 'status': 'uncited'}, 'AUD-614-RISK-L0': {'commit': '', 'status': 'uncited'}, 'AUD-614-SELFTEST-TIMEOUT': {'commit': '', 'status': 'uncited'}, 'AUD-615-07': {'commit': '', 'status': 'uncited'}, 'AUD-615-COLD-COMPACT': {'commit': '', 'status': 'uncited'}, 'AUD-615-DRIFT': {'commit': '', 'status': 'uncited'}, 'AUD-615-E': {'commit': '', 'status': 'uncited'}, 'AUD-615-F': {'commit': '', 'status': 'uncited'}, 'AUD-615-INTENT-TIE': {'commit': '', 'status': 'uncited'}, 'AUD-615-JUNIT4': {'commit': '', 'status': 'uncited'}, 'AUD-615-RISK-L0': {'commit': '', 'status': 'uncited'}, 'AUD-615-SELFTEST-TIMEOUT': {'commit': '', 'status': 'uncited'}, 'AUD-616-E-PROV': {'commit': '', 'status': 'uncited'}, 'AUD-616-F, -RISK-L0, -SELFTEST-TIMEOUT, -INTENT-TIE, -DRIFT, -COLD-COMPACT, -E, -07': {'commit': '', 'status': 'uncited'}, 'AUD-616-INTENT-TIE-COV': {'commit': '', 'status': 'uncited'}, 'AUD-616-JUNIT4-SELF': {'commit': '', 'status': 'uncited'}, 'AUD-616-KOTLIN': {'commit': '', 'status': 'uncited'}, 'AUD-616-O': {'commit': '', 'status': 'uncited'}, 'AUD-616-P': {'commit': '', 'status': 'uncited'}, 'Window': {'commit': '', 'status': 'uncited'}, '`ASK-FIELD-01`': {'commit': '829f9fa', 'status': 'present'}, '`ASK-FIELD-02`': {'commit': '6a659fa', 'status': 'present'}, '`ASK-FIELD-03`': {'commit': '55b0d51', 'status': 'present'}, '`AUD-588-F05`': {'commit': '470e4a4', 'status': 'present'}, '`AUD-590-B01` / `B-01`, `F-01`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B02` / `B-02`, `F-02`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B03` / `B-03`, `F-03`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B04` / `B-04`, `F-04`': {'commit': '', 'status': 'uncited'}, '`AUD-590-R01` / `R-01`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A01` / `A-1`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A02` / `A-2`, `A-4`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A03` / `A-3`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A05` / `A-5`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A06` / `A-6`, `A-7`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A08` / `A-8`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A09` / `A-9`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A10` / `A-10`': {'commit': '', 'status': 'uncited'}, '`AUD-592-A02` / `A-1` second half, `§12.5`': {'commit': '63f3d61', 'status': 'present'}, '`AUD-592-B01` / `B-8`': {'commit': '8329614', 'status': 'present'}, '`AUD-592-D01` / `D-1`': {'commit': '0f8e03f', 'status': 'present'}, '`AUD-592-D02` / `D-2`': {'commit': '1d3db4d', 'status': 'present'}, '`AUD-592-D03` / `D-3`': {'commit': 'f28fe40', 'status': 'present'}, '`AUD-592-R01` / `A-1`': {'commit': '216025f', 'status': 'present'}, '`AUD-592-R02` / `N-4`, reopens `AUD-513-N04`': {'commit': 'ec3050d', 'status': 'present'}, '`AUD-593-N01` / `N-01`': {'commit': 'dd6a706', 'status': 'present'}, '`AUD-593-N02` / `N-02`': {'commit': 'f539787', 'status': 'present'}, '`AUD-593-N03` / `N-03`': {'commit': '1dd0b1c', 'status': 'present'}, '`AUD-593-N05` / `N-05`': {'commit': 'aa89388', 'status': 'present'}, '`AUD-593-N06` / `N-06`': {'commit': 'aa584a6', 'status': 'present'}, '`AUD-594-N04` / `D-5`, disclosure half of `B-3`': {'commit': 'a0060b7', 'status': 'present'}, '`AUD-594-X01` / `A-1`, residual of `AUD-593-N03`': {'commit': 'dd222b9', 'status': 'present'}, '`AUD-594-X02` / `A-1` second half': {'commit': '1193937', 'status': 'present'}, '`AUD-594-X03` / `X-03`, residual of `AUD-593-N01`': {'commit': 'e89e8f0', 'status': 'present'}, '`AUD-594-X04`': {'commit': '05b8cc9', 'status': 'present'}, '`AUD-595-A02` / `N-5`, advisory half of `AUD-588-B11`': {'commit': '3e15227', 'status': 'present'}, '`AUD-595-A03` / `B-6` exit-code half': {'commit': 'ab7285f', 'status': 'present'}, '`AUD-595-A05`': {'commit': 'e0b3d10', 'status': 'present'}, '`AUD-595-A07`, narrow half of `AUD-592-A02`': {'commit': 'cc15177', 'status': 'present'}, '`AUD-595-B01` / §B': {'commit': 'b77a1ad', 'status': 'present'}, '`AUD-595-Q01`': {'commit': '91a6566', 'status': 'present'}, '`AUD-596-A01` / `ASK-DET-001`': {'commit': 'fa508b4', 'status': 'present'}, '`AUD-596-A02` / `ASK-SELF-001`': {'commit': '4dfadc8', 'status': 'present'}, '`AUD-596-A03` / `ASK-C1-001`': {'commit': 'bffa3a6', 'status': 'present'}, '`AUD-596-A04` / `ASK-UX-003` + `ASK-UX-004`': {'commit': 'f0aac3c', 'status': 'present'}, '`AUD-596-B01` / `B-01`, harder witness for `BUG-6`': {'commit': '567d09d', 'status': 'present'}, '`AUD-596-B02` / `B-02`, class residual of `R2`': {'commit': '', 'status': 'uncited'}, '`AUD-596-B03` / `B-03`': {'commit': 'a8cb814', 'status': 'present'}, '`AUD-596-B06` / `B-06`': {'commit': '8107927', 'status': 'present'}, '`AUD-596-B07` / `B-07`, class residual of `AUD-592-R02`': {'commit': 'e060485', 'status': 'present'}, '`AUD-596-B09` / `B-09`': {'commit': '5b8146c', 'status': 'present'}, '`AUD-596-B10` / `B-10`': {'commit': '5cb994d', 'status': 'present'}, '`AUD-596-B16` / `B-16`': {'commit': '1507f69', 'status': 'present'}, '`AUD-596-D01` / `B-13` + `B-14`': {'commit': '0b1bdf0', 'status': 'present'}, '`AUD-596-D02` / `B-08`, residual of `AUD-594-N04`': {'commit': 'e7f73c3', 'status': 'present'}, '`AUD-596-D03` / `ASK-AGT-001`': {'commit': '8c46967', 'status': 'present'}, '`AUD-596-D04` / `B-18`': {'commit': '040f027', 'status': 'present'}, '`AUD-596-D05` / `B-19`': {'commit': 'fd2bf68', 'status': 'present'}, '`AUD-596-D06` / `B-20`': {'commit': '784cd83', 'status': 'present'}, '`AUD-596-D07` / `B-17`, half refuted': {'commit': 'c3ff822', 'status': 'present'}, '`AUD-596-D08` / `B-22`, class residual of `AUD-591-A06`': {'commit': 'b396c6a', 'status': 'present'}, '`AUD-596-D09` / `B-23`, surviving half of `B26`': {'commit': 'fd3d63f', 'status': 'present'}, '`AUD-596-D10` / `B-29`': {'commit': '', 'status': 'uncited'}, '`AUD-596-D11` / `ASK-UX-005`': {'commit': 'f4b4f77', 'status': 'present'}, '`AUD-596-D12` — six hints that send the reader back to the error': {'commit': '498df44', 'status': 'present'}, '`AUD-596-D13` / `B-28`': {'commit': '1014c72', 'status': 'present'}, '`AUD-596-D14` / `B-15`, narrow half of `B20`': {'commit': '10f2827', 'status': 'present'}, '`AUD-596-R01` / `B-05`': {'commit': '', 'status': 'uncited'}, '`AUD-596-X01` / `ASK-GATE-001`, gating half of `B24`': {'commit': 'e59c655', 'status': 'present'}, '`AUD-596-X02` / `ASK-UX-001` + `ASK-UX-002` + `B-21`': {'commit': 'f6ebf50', 'status': 'present'}, '`AUD-597-A01` / `ASK-UX-001` + `N-01`': {'commit': 'f8cf061', 'status': 'present'}, '`AUD-597-A02` / `ASK-UX-008` + `ASK-DOC-002`': {'commit': '9d47a4c', 'status': 'present'}, '`AUD-597-A03` / `ASK-DET-001`': {'commit': '4c7622a', 'status': 'present'}, '`AUD-597-A04` / `ASK-LEDGER-001`': {'commit': '46fb870', 'status': 'present'}, '`AUD-597-D01` / `B-04`': {'commit': '1094e6a', 'status': 'present'}, '`AUD-597-D02` / `ASK-DOC-001`': {'commit': 'ecb1bb7', 'status': 'present'}, '`AUD-597-D03` / `N-06`': {'commit': '9784333', 'status': 'present'}, '`AUD-597-D04` / `N-05`': {'commit': 'e51c087', 'status': 'present'}, '`AUD-597-D05` / `N-04`, fourth appearance of `C4-27`': {'commit': '9cccc15', 'status': 'present'}, '`AUD-597-D06` / `ASK-CLI-001`': {'commit': '178aa6d', 'status': 'present'}, '`AUD-597-D07` / `N-03`': {'commit': '9245e35', 'status': 'present'}, '`AUD-597-R01` / `ASK-PERF-001`': {'commit': '6910054', 'status': 'present'}, '`AUD-597-R02` / `ASK-ENC-001`': {'commit': 'ce6dac1', 'status': 'present'}, '`AUD-597-R03` / `ASK-UX-002`': {'commit': 'c57e50b', 'status': 'present'}, '`AUD-597-X01` / `ASK-BUILD-001` + `ASK-META-001` / `B-12`': {'commit': '354338b', 'status': 'present'}, '`AUD-598-B01` / `ASK-META-001`': {'commit': 'b2f7c65', 'status': 'present'}, '`AUD-598-B02` / `ASK-UX-002`': {'commit': '56a4bf7', 'status': 'present'}, '`AUD-598-B03` / `B-11`': {'commit': 'c63cb24', 'status': 'present'}, '`AUD-598-B04` / `N-02`': {'commit': '187937f', 'status': 'present'}, '`AUD-598-R01` / `ASK-PERF-002`': {'commit': '', 'status': 'uncited'}, '`AUD-598-X01` / `N-01` + `B-13` + `B-14` + `B-29` + `N-06`': {'commit': '6f2f5a4', 'status': 'present'}, '`AUD-600-B01` / `P-01`': {'commit': '366ffed', 'status': 'present'}, '`AUD-600-B02` / `P-02` + `ASK-PACK-002`': {'commit': '2a814c3', 'status': 'present'}, '`AUD-600-B03` / `ASK-PACK-001`': {'commit': '452f2a0', 'status': 'present'}, '`AUD-600-D01`': {'commit': '1224e1b', 'status': 'present'}, '`AUD-600-D02`': {'commit': 'eab8172', 'status': 'present'}, '`AUD-600-R01` / `R-01`': {'commit': '88add64', 'status': 'present'}, '`AUD-601-B01` / `N-02`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-B02` / `ASK-PACK-004`': {'commit': '', 'status': 'uncited'}, '`AUD-601-D01` / `N-01`, `ASK-UX-001`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-D02` / `B-13`, `B-14`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-M01` / `B-26`, `B-27` retracted': {'commit': '', 'status': 'uncited'}, '`AUD-601-R01` / `R-02`': {'commit': '', 'status': 'uncited'}, '`AUD-619-WATCH`': {'commit': '', 'status': 'uncited'}, '`AUD-620-COMMAND-SURFACE`': {'commit': '', 'status': 'uncited'}, '`AUD-620-REVIEW-PR`': {'commit': '', 'status': 'uncited'}, '`AUD-621-REVIEW-PR`': {'commit': '', 'status': 'uncited'}, '`B-3`': {'commit': '773268d', 'status': 'present'}, '`B-6`': {'commit': '17c6e06', 'status': 'present'}, '`B-8`': {'commit': '8329614', 'status': 'present'}, '`BUG-3` / `443b345`': {'commit': '', 'status': 'uncited'}, '`BUG-4a` / `AUD-588-B11` residual': {'commit': '24b4185', 'status': 'present'}, '`BUG-4b` / `AUD-588-B11` residual': {'commit': '0376350', 'status': 'present'}, '`E-39`, class residual of `AUD-593-N06`': {'commit': '25fc11f', 'status': 'present'}, '`N-5`': {'commit': 'c68083f', 'status': 'present'}, '`N-7`': {'commit': '082e9de', 'status': 'present'}, '`R-1`': {'commit': '424fb1c', 'status': 'present'}, '`R-2`': {'commit': '5158b92', 'status': 'present'}, '`R-3`': {'commit': '88aec04', 'status': 'present'}, '`R-4`': {'commit': '04fd04f', 'status': 'present'}}
 CLOSURE_COVERAGE = {'closed_rows': 165, 'present': 91, 'absent': 0, 'unresolved': 0, 'uncited': 74, 'unknown': 0}

sourcecode/_docs/DEFECT-LEDGER.md

@@ -14,6 +14,32 @@ Status values: `open` · `in-progress` · `closed <version>` · `by-design` (wit
 The facts these rows are keyed to are published: `ask schema facts-v1` prints the registry
 (authority, definition, consumers, parity test) that the release battery enforces.
 
+## Current Synchronization — External Audit `5.9.22` (2026-09-01)
+
+The external audit confirms strong precision, determinism and uncertainty
+disclosure, but opens a P0/P1 cluster around silent success, incomplete
+population disclosure, large-run memory and compact-output contracts. Full
+evidence: [`AUDIT-2026-09-01-EXTERNAL-5.9.22.md`](AUDIT-2026-09-01-EXTERNAL-5.9.22.md).
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `BUG-01` | Critical maximum | **open, P0** | Full Markdown `audit-report` reproduced with `rc=0` and empty stdout. Add a global non-empty-answer invariant and renderer coverage. |
+| `BUG-02` | Critical maximum | **open, P0** | Large `risk` ended `rc=127` with no output or structured failure. Add fail-fast resource/process handling and durable partial checkpoints. |
+| `BUG-12` | Critical maximum | **open, P0** | Deep `--agent` output construction reaches multi-gigabyte RSS before a small answer. Bound projection while building. |
+| `BUG-03` | High | **open, P1** | `content_id` changes between cold and warm because cache state is hashed into identity. Separate execution metadata from answer identity. |
+| `BUG-04` | High | **open, P1** | `selftest` publishes `complete=true` with five error rows. Derive bounds from actual results. |
+| `BUG-05` | High | **open, P1** | Overloaded endpoint handlers can receive the wrong declaration line. Resolve by mapping annotation or publish ambiguity. |
+| `BUG-07` | High | **open, P1** | `--compact` remains oversized on `migrate-check` and `spring-audit`. Apply bounded projections with omission metadata. |
+| `BUG-10` | High | **open, P1** | Unsupported routing styles can produce empty coverage gaps. Publish detected-but-unmodeled routing gaps. |
+| `BUG-11` | High | **open, P1** | Default `pack assessment` can fail on a small Spring repository. Use a bounded default or explicit full mode. |
+| `BUG-13` | High | **open, P1** | Unscoped `selftest` starts over nested repositories after warning. Refuse and require an explicit path. |
+| `BUG-16` | High | **open, P1** | Context-cache growth has no published budget or eviction contract; about 1.5 GB was measured. |
+| `BUG-22` | High | **open, P1** | RSS ceilings are checked post-hoc. Add periodic sampling and orderly abort. |
+
+The remaining `BUG-04b`, `BUG-06`, `BUG-08`, `BUG-09`, `BUG-15`, `BUG-19`,
+`BUG-20`, `BUG-21` and `BUG-23` findings are open P2/coverage follow-ups in
+the audit document. None is closed by documentation alone.
+
 ## Current Synchronization — External Audit `AUD-621`
 
 **Release `5.9.19` remediation.** The stderr-decoding fix for `AUD-621-PACK-STDERR` remains in code, and the distinct `pack gate --since` crash found by the post-remediation re-audit is corrected with a Python 3.9–3.11-compatible tar extraction path. `AUD-621-R` has a second Windows barrier at process-pool construction, complementing the sequential fallback. The broader findings remain open until their required native Windows evidence is recorded; `AUD-621-CONTEXT` and `AUD-621-WIN-PROC` are unchanged.

sourcecode/_docs/USER_GUIDE.md

@@ -382,6 +382,9 @@ Output: detected stacks, entry points, dependencies, transactional boundaries (S
 ### `ask --agent`
 
 More structured version of `--compact`. Designed for AI agent system prompt injection.
+It is bounded to 40 KB on stdout and admits repositories up to 10,000 Java files;
+larger repositories return `AGENT_SCOPE_TOO_LARGE` before expensive analysis. Use
+`--compact` or narrow the path in that case.
 
 ```bash
 ask /repo --agent --output context.json
@@ -528,7 +531,7 @@ disabled changes runtime behaviour nobody measured; a diff is how a person makes
 call with the evidence in front of them.
 
 **TX patterns (TX-001..TX-006):** proxy bypass, nested transactions, readOnly propagation, NOT_SUPPORTED in active TX, exception swallowing, self-invocation of a `@Transactional` sibling.
-**SEC patterns (SEC-001..SEC-009):** unsecured endpoints, CVE-2025-41248 `@PreAuthorize` inheritance bypass, `@Transactional` on controllers, passwords stored under a fast unsalted digest, CSRF disabled under session-bearing authentication, cookies created without the Secure attribute, credentials stored in a deployment descriptor, SQL built by MyBatis string interpolation, and anonymous request-chain exceptions. **DEAD-001** reports a security control that is present only in comments and therefore disabled.
+**SEC patterns (SEC-001..SEC-010):** unsecured endpoints, CVE-2025-41248 `@PreAuthorize` inheritance bypass, `@Transactional` on controllers, passwords stored under a fast unsalted digest, CSRF disabled under session-bearing authentication, cookies created without the Secure attribute, credentials stored in a deployment descriptor, SQL built by MyBatis string interpolation, anonymous request-chain exceptions, and HTTP input reaching a concatenated known query sink through bounded positional in-repository calls. **DEAD-001** reports a security control that is present only in comments and therefore disabled.
 **GATE patterns (GATE-001..GATE-004):** custom AOP/security-gate risks over the same custom-gate authority published in `security_posture`: proxy bypass (`private`/`final`/self-invocation), advice that appears to fail open, disabled or tautological annotation attributes, and fragile `args[0]`/reflection binding.
 
 Each finding includes `severity`, `confidence`, `symbol`, `source_file`, `evidence`, `explanation`, and `fix_hint`. JAVA/SPRING ONLY.
@@ -1812,10 +1815,10 @@ stops at 1 408 files inside the `SEC-004` group and ends at 5.1s.
 **Memory budget.** Repository-scoped JSON answers include `_meta.memory` with
 `unit: "MB"`, the observed `peak_rss_mb`, the `peak_rss_basis` it was sampled
 from, `configured_max_rss_mb`, and `ceiling_enforceable`. To bound long analyses
-on a CI or supervised runner, set `ASK_MAX_RSS_MB=<megabytes>`. Exceeding the
-ceiling produces exit code `1` and a structured `MEMORY_TOO_LARGE` error with the
-peak and configured limit; no partial answer is published. Unset the variable, or
-set it to `0`, to disable this ceiling.
+on a CI or supervised runner, set `ASK_MAX_RSS_MB=<megabytes>`. `--agent` uses
+1,536 MB when the variable is unset. Exceeding the ceiling produces exit code `1`
+and a structured `MEMORY_TOO_LARGE` error with the peak and configured limit; no
+partial answer is published. Set the variable to `0` to disable this ceiling.
 
 Where the platform exposes no footprint sample, `peak_rss_mb` is `null` and
 `peak_rss_basis` says why — never `0`, which would read as a measured floor. A

sourcecode/answer_bounds.py

@@ -99,6 +99,16 @@ def _gaps(payload: "dict[str, Any]") -> "list[dict[str, Any]]":
             found.append({"field": "non_coverage", "what": _summarise(entry)})
     elif non_coverage:
         found.append({"field": "non_coverage", "what": _summarise(non_coverage)})
+    populations = [payload.get("population")]
+    metadata = payload.get("metadata")
+    if isinstance(metadata, dict):
+        populations.append(metadata.get("population"))
+    for population in populations:
+        if not isinstance(population, dict):
+            continue
+        for failure in _as_list(population.get("parse_failures")):
+            if failure:
+                found.append({"field": "population.parse_failures", "what": _summarise(failure)})
     for prefix, block in _blocks(payload):
         for field in _GAP_FIELDS:
             value = block.get(field)

sourcecode/canonical_ir.py

@@ -594,6 +594,7 @@ def ir_dict_to_canonical(
         "edge_count": len(call_graph),
         "subsystems": ir.get("subsystems") or [],
         "analysis_gaps": ir.get("analysis_gaps") or [],
+        "population": ir.get("population") or {},
         "spring_events": ir.get("spring_events") or {},
         "score_basis": (ir.get("impact") or {}).get("score_basis", "none"),
         "reverse_graph_size": len(ir.get("reverse_graph") or {}),

sourcecode/cli.py

@@ -513,6 +513,28 @@ _START_HERE: "tuple[tuple[str, str], ...]" = (
 )
 
 
+def _start_here_entries(root: "Optional[Path]") -> "tuple[tuple[str, str], ...]":
+    """Return pasteable first steps that the measured repository can accept."""
+    if root is None:
+        return _START_HERE
+    try:
+        from sourcecode.spring_profiles import profile_population
+
+        profiles = profile_population(root).names
+    except Exception:
+        # Help must remain available if a repository cannot be read.
+        return _START_HERE
+    if len(profiles) < 2:
+        # `posture --diff` rejects undeclared profile names. Do not publish an
+        # example that cannot run on this repository.
+        return tuple(entry for entry in _START_HERE if not entry[0].startswith("posture "))
+    diff = f"posture . --diff {profiles[0]}:{profiles[1]}"
+    return tuple(
+        (diff, answers) if invocation.startswith("posture ") else (invocation, answers)
+        for invocation, answers in _START_HERE
+    )
+
+
 #: Resolved bounding flags, by invocation. Deliberately **not** an `lru_cache`:
 #: only a resolution that found the command is stored. AUD-601-D01 — the front
 #: page is composed while this module is still being imported, so the first
@@ -637,6 +659,8 @@ def _start_here_block(scope: "Optional[Any]" = None) -> str:
         BUCKET_ORDER, BUCKET_TITLE, BUDGETED, DETACH, RUNS_NOW, UNKNOWN, plan,
     )
 
+    root = getattr(scope, "root", None) if scope is not None else None
+    entries = _start_here_entries(root)
     if scope is None or not scope.measured:
         # AUD-601-D01. The ceiling is a property of the **command**, not of the
         # repository, so the bounding flag must not depend on measuring one.
@@ -647,13 +671,13 @@ def _start_here_block(scope: "Optional[Any]" = None) -> str:
         # the generator covers them, and this rendering never called it.
         static = [
             (_bounded_invocation(invocation), answers)
-            for invocation, answers in _START_HERE
+            for invocation, answers in entries
         ]
         width = max([29] + [len(invocation) + 1 for invocation, _ in static])
         lines = ["[bold]Start here — Java/Spring analysis:[/bold]"]
         for invocation, answers in static:
             lines.append(f"  {invocation:<{width}}[dim]# {answers}[/dim]")
-        if any(bounded != raw for (bounded, _), (raw, _) in zip(static, _START_HERE)):
+        if any(bounded != raw for (bounded, _), (raw, _) in zip(static, entries)):
             lines.append(
                 "  [dim]Bounded for a first look: each line above carries the "
                 "flag its command declares against the output ceiling. Drop it, "
@@ -661,7 +685,7 @@ def _start_here_block(scope: "Optional[Any]" = None) -> str:
             )
         return "\n".join(lines)
 
-    answers = dict(_START_HERE)
+    answers = dict(entries)
     # AUD-596-X02: this block sold three commands under "Runs now" and two of
     # them exited 1 here, both with `OUTPUT_TOO_LARGE` — `posture . --diff
     # dev:prod` at ~71K estimated tokens over a 50K ceiling, and `endpoints .`
@@ -672,12 +696,12 @@ def _start_here_block(scope: "Optional[Any]" = None) -> str:
     # it from an error.
     bounded = {
         invocation: _bounded_invocation(invocation)
-        for invocation, _ in _START_HERE
+        for invocation, _ in entries
     }
     for invocation, bounded_form in bounded.items():
         if bounded_form != invocation:
             answers[bounded_form] = answers[invocation]
-    grouped = plan([bounded[invocation] for invocation, _ in _START_HERE], scope)
+    grouped = plan([bounded[invocation] for invocation, _ in entries], scope)
 
     # AUD-597-A01. The plan orders by *time* and the ceiling refuses by *size*,
     # so a command that is seconds away from an answer it cannot print is not a
@@ -729,7 +753,7 @@ def _start_here_block(scope: "Optional[Any]" = None) -> str:
                 "    [dim]…each of these answers into a file and survives the shell:"
                 " add --output <file> --detach[/dim]"
             )
-    if any(bounded[invocation] != invocation for invocation, _ in _START_HERE):
+    if any(bounded[invocation] != invocation for invocation, _ in entries):
         lines.append(
             "  [dim]Bounded for a first look: each line above carries the flag "
             "its command declares against the output ceiling. Drop it, or add "
@@ -888,12 +912,12 @@ scope matches; `ask cache model` says exactly what a warm buys per command.
   data-exposure .              [dim]# one semantic model is shared across declared label seeds[/dim]
   repo-ir . --since main --budget-tokens 12000 [dim]# bounded agent context[/dim]
   migrate-check . --format sarif -o migration.sarif [dim]# located migration findings[/dim]
-  [dim]The repository is a positional argument everywhere; --path, --repo and --dir
-  are accepted as aliases for it on any command that does not already declare them.[/dim]
+  [dim]Repository paths are normally positional. Commands that publish --path, --repo
+  or --dir accept that documented spelling; use each command's --help for its grammar.[/dim]
 
   ASK_MAX_ANALYSIS_SECONDS=N   [dim]# deadline for {_budget_tiers_phrase()}[/dim]
   [dim]Other commands do not consume this budget; use `--progress` or `--detach` where offered.[/dim]
-  ASK_MAX_RSS_MB=N             [dim]# peak resident-memory ceiling for costly analyses; 0 disables[/dim]
+  ASK_MAX_RSS_MB=N             [dim]# peak resident-memory ceiling; --agent defaults to 1536 MB, 0 disables[/dim]
   [dim]Repository JSON answers publish `_meta.memory.peak_rss_mb` with its basis; exceeding the ceiling
   returns MEMORY_TOO_LARGE, and a platform that exposes no sample returns MEMORY_CEILING_UNAVAILABLE
   rather than passing a ceiling nothing measured.[/dim]
@@ -1796,7 +1820,12 @@ def _apply_budget(
 
     to_file = output_path is not None
     return _trim(
-        data, budget_bytes, label=label, skip=to_file, warn_stderr=not to_file
+        data,
+        budget_bytes,
+        label=label,
+        skip=to_file,
+        warn_stderr=not to_file,
+        strict=(label in {"agent", "compact"}),
     )
 
 
@@ -3140,6 +3169,18 @@ def _emit_command_output(
     not about the encoding. A command that already serialized its own YAML passes
     the default and is untouched: the conversion only fires on a JSON object.
     """
+    # A completed analysis with no payload is never a successful answer.  The
+    # process-level guard also catches this for the production entry point, but
+    # rejecting it here protects every direct Typer invocation and prevents an
+    # empty file from being published as an artefact.
+    if not content.strip():
+        _emit_error_json(
+            EXECUTION_FAILED_CODE,
+            "The command finished without publishing an answer.",
+            command=_ANSWER_REQUIRED_BY or "unknown",
+            expected="a non-empty parseable answer or report",
+        )
+        raise typer.Exit(code=1)
     if stamp_envelope:
         content = _stamp_envelope(content)
     if fmt == "yaml":
@@ -4906,6 +4947,24 @@ DOCS_DEPTH_CHOICES = ["module", "symbols", "full"]
 _FREE_TIER_NODE_CAP: int = 50  # graph/semantic node cap — applies only to large repos on free tier
 _JAVA_MIN_SCAN_DEPTH: int = 12  # Maven src/main/java/<pkg>/<module>/File depth floor
 _LARGE_REPO_ADVISORY_FILES: int = 3000  # cold-scan advisory threshold (files); honest expectation-setting, not a speed claim
+_AGENT_JAVA_FILE_CAP: int = 10_000
+
+
+def _agent_scope_error(root: Path) -> "Optional[dict[str, Any]]":
+    """Refuse an agent run that cannot stay inside its memory contract."""
+    try:
+        java_files = sum(1 for _ in root.rglob("*.java"))
+    except OSError:
+        return None
+    if java_files <= _AGENT_JAVA_FILE_CAP:
+        return None
+    return {
+        "code": "AGENT_SCOPE_TOO_LARGE",
+        "message": f"--agent is limited to {_AGENT_JAVA_FILE_CAP:,} Java files by default; this repository has {java_files:,}.",
+        "hint": "Use --compact for the bounded summary, or narrow the repository path.",
+        "java_files": java_files,
+        "max_java_files": _AGENT_JAVA_FILE_CAP,
+    }
 
 #: What one Java file costs in serialized `repo-ir` output, measured across five
 #: repositories (C3-18): spring-petclinic 30 files/318 KB (10.8 KB/file),
@@ -5769,7 +5828,14 @@ def main(
         code_notes = True
         no_tree = True  # agents never need the raw file tree
         architecture = True  # agents need full architectural signal (M4)
-        graph_modules = True  # IC-003: import graph needed for architecture confidence
+        # Module graphs are quadratic on large import populations and are not
+        # required by agent_view. Keep them opt-in via --graph-modules.
+        _agent_error = _agent_scope_error(target)
+        if _agent_error is not None:
+            _emit_error_json(
+                _agent_error.pop("code"), _agent_error.pop("message"), **_agent_error
+            )
+            raise typer.Exit(code=2)
 
     # --compact implicitly enables lightweight analysis passes so that
     # dependency_summary, env_summary and code_notes_summary are never null.
@@ -6351,6 +6417,7 @@ def main(
         """Close a phase and stop the run if the operator's budget is spent."""
         _root_run.completed.append(phase)
         if not _root_run.exhausted():
+            _root_memory_seam()
             return
         _progress.stop()
         _block = _root_run.status(_WHY_BUDGET)
@@ -6362,6 +6429,26 @@ def main(
         _emit_command_output(_serialize_dict(_block, format), output, copy)
         raise typer.Exit(code=_exit)
 
+    def _root_memory_seam() -> None:
+        """Enforce the agent's protective RSS ceiling at every root boundary."""
+        if not agent:
+            return
+        from sourcecode import resource_budget
+
+        memory_error = resource_budget.exceeded(
+            "ask --agent",
+            default_ceiling_mb=resource_budget.DEFAULT_AGENT_RSS_CEILING_MB,
+        )
+        if memory_error is None:
+            return
+        _progress.stop()
+        _emit_error_json(
+            memory_error.pop("code"),
+            memory_error.pop("message"),
+            **memory_error,
+        )
+        raise typer.Exit(code=1)
+
     _perf_discovery = perf.start()
     scanner = AdaptiveScanner(target, topology=_topology, base_depth=effective_depth,
                                extra_excludes=_extra_excludes)
@@ -7099,7 +7186,7 @@ def main(
     _root_timing.setdefault("ris_ms", 0.0)
     _root_timing.setdefault("snapshot_ms", 0.0)
     # 4. Serialize
-    _progress.update("serializing output")
+    _progress.update("building bounded agent context" if agent else "serializing output")
     _perf_serialize = perf.start()
     if _is_contract_mode and not agent:
         from sourcecode.serializer import contract_view as _contract_view
@@ -7156,6 +7243,7 @@ def main(
         content = _serialize_dict(data, format)
 
     perf.stop("serialize", _perf_serialize)
+    _root_seam("serialize")
     perf.flush_recorder()
 
     # 5. Write output (CLI-04)

sourcecode/migrate_check.py

@@ -2673,6 +2673,20 @@ class MigrationReport:
             for _col in ("evidence", "target_lts_blockers"):
                 _cap_into(_l, _col, top_n)
             compact["java_lts_inventory"] = _l
+        inventory = full.get("jvm_inventory")
+        if isinstance(inventory, dict) and isinstance(inventory.get("frameworks"), dict):
+            _inventory = dict(inventory)
+            _frameworks: dict[str, dict] = {}
+            for _name, _framework in inventory["frameworks"].items():
+                if not isinstance(_framework, dict):
+                    _frameworks[_name] = _framework
+                    continue
+                _bounded = dict(_framework)
+                for _collection in ("declared", "observed"):
+                    _cap_into(_bounded, _collection, top_n)
+                _frameworks[_name] = _bounded
+            _inventory["frameworks"] = _frameworks
+            compact["jvm_inventory"] = _inventory
         return compact
 
     def to_text(self, min_severity: str = "low") -> str:

sourcecode/non_coverage.py

@@ -487,6 +487,7 @@ _STACK_INDEPENDENT_AXES: "tuple[str, ...]" = (
 def stack_fit(
     spring_detected: bool,
     security_frameworks: "tuple[str, ...] | list[str]" = (),
+    spring_footprint: "Optional[dict[str, int]]" = None,
 ) -> dict:
     """Whether this product's Spring-shaped axes model the repository. (CL-19)
 
@@ -553,6 +554,22 @@ def stack_fit(
                 "Spring Security result must not be read as public access."
             ),
         }
+    footprint = spring_footprint or {}
+    beans = int(footprint.get("spring_beans") or 0)
+    java_files = int(footprint.get("java_files") or 0)
+    if spring_detected and java_files and beans / java_files < 0.1:
+        return {
+            "schema_version": STACK_FIT_SCHEMA,
+            "spring_detected": True,
+            "fit": "partial",
+            "spring_footprint": {"spring_beans": beans, "java_files": java_files},
+            "statement": (
+                "Spring is present but marginal in this scope, so Spring-shaped axes "
+                "model only the detected Spring population. Do not read their absence "
+                "of findings as coverage of the remaining repository."
+            ),
+            "how_to_read": "Use Spring results for the detected Spring population only.",
+        }
     if spring_detected:
         return {
             "schema_version": STACK_FIT_SCHEMA,

sourcecode/output_budget.py

@@ -74,6 +74,11 @@ _TRIM_SCHEDULE: list[tuple[str, str | None, int]] = [
 ]
 
 
+# The root CLI adds cache, timing and envelope records after view trimming.
+# This is the measured upper bound needed to keep its published ceilings true.
+_STRICT_POSTPROCESSING_RESERVE = 12_288
+
+
 def _serialized_size(data: Any) -> int:
     """Byte size of JSON-serialized data (UTF-8)."""
     return len(json.dumps(data, ensure_ascii=False).encode("utf-8"))
@@ -86,6 +91,7 @@ def trim_to_budget(
     label: str = "",
     skip: bool = False,
     warn_stderr: bool = False,
+    strict: bool = False,
 ) -> dict:
     """Progressively trim *data* to fit within *budget_bytes*.
 
@@ -101,17 +107,26 @@ def trim_to_budget(
 
     Returns data unchanged if already within budget or ``skip=True``.
     """
-    if skip or _serialized_size(data) <= budget_bytes:
+    # The strict caller needs space for metadata added after this return.
+    target_budget = (
+        max(0, budget_bytes - _STRICT_POSTPROCESSING_RESERVE)
+        if strict else budget_bytes
+    )
+    if skip or _serialized_size(data) <= target_budget:
         return data
 
     result: dict = dict(data)
     original_size = _serialized_size(result)
+    # Truncation metadata is added after content is reduced. Agent output
+    # publishes a hard byte ceiling, so reserve room for that metadata first.
+    # The CLI appends envelope, timing and cache metadata after this function.
+    # Reserve their worst observed footprint for every published hard ceiling.
     trimmed_sections: list[str] = []
     # Track original counts for total_omitted_items calculation.
     _original_counts: dict[str, int] = {}
 
     for top_key, inner_key, max_items in _TRIM_SCHEDULE:
-        if _serialized_size(result) <= budget_bytes:
+        if _serialized_size(result) <= target_budget:
             break
 
         if top_key not in result or result[top_key] is None:
@@ -163,7 +178,7 @@ def trim_to_budget(
     # again — so when the schedule is exhausted and the payload is still over,
     # the remaining cut is chosen by *measuring* what is actually large.
     _MEASURED_FLOOR = 5  # never cut a list below this: a sample of 0 is not a sample
-    while _serialized_size(result) > budget_bytes:
+    while _serialized_size(result) > target_budget:
         _candidates = [
             (_serialized_size(v), k, len(v))
             for k, v in result.items()
@@ -337,4 +352,3 @@ def compact_budget_phrase() -> str:
     context window needs.
     """
     return _budget_phrase(BUDGET_COMPACT)
-

sourcecode/repository_ir.py

@@ -5151,6 +5151,7 @@ def _compute_analysis_gaps(
     relations: list[RelationEdge],
     unparsed_type_files: Optional[list[str]] = None,
     unbalanced_files: Optional[list[str]] = None,
+    parse_failures: Optional[list[dict]] = None,
 ) -> list[dict]:
     """Compute structural analysis gaps — real system failures, not cosmetic issues."""
     gaps: list[dict] = []
@@ -5199,6 +5200,20 @@ def _compute_analysis_gaps(
                 "files": list(rf.symbols),
             })
 
+    if parse_failures:
+        failed_files = [row["path"] for row in parse_failures if row.get("status") == "failed"]
+        recovered_files = [row["path"] for row in parse_failures if row.get("status") == "recovered"]
+        gaps.append({
+            "area": "parse_failures",
+            "reason": (
+                f"{len(failed_files)} Java file(s) could not be parsed and "
+                f"{len(recovered_files)} were only partially recovered. Their "
+                "absence or recovered symbols must not be read as complete coverage."
+            ),
+            "impact": "high" if failed_files else "medium",
+            "files": [row["path"] for row in parse_failures],
+        })
+
     controllers = spring_summary.get("controllers", [])
     if controllers and not route_surface:
         gaps.append({
@@ -5251,6 +5266,7 @@ def _assemble(
     custom_security: "tuple[CustomSecuritySpec, ...]" = (),
     unparsed_type_files: Optional[list[str]] = None,
     unbalanced_files: Optional[list[str]] = None,
+    parse_failures: Optional[list[dict]] = None,
     constants: "Optional[dict[str, str]]" = None,
     root: "Optional[Path]" = None,
 ) -> dict:
@@ -5548,6 +5564,7 @@ def _assemble(
         sorted_syms, spring_summary, _route_surface, sorted_rels,
         unparsed_type_files=unparsed_type_files,
         unbalanced_files=unbalanced_files,
+        parse_failures=parse_failures,
     )
 
     # Detect filter-based security model for the assembled IR.
@@ -6717,6 +6734,9 @@ def build_repo_ir(
     # for the rare file that already looks unbalanced, exactly as the
     # zero-symbol probe below does.
     _unbalanced_files: list[str] = []
+    # BUG-01: a tolerant extractor may recover useful symbols, but it must never
+    # make a malformed or non-text Java file disappear from the population.
+    _parse_failures: dict[str, dict[str, str]] = {}
     _total_files = len(file_paths)
 
     # F-AQ. Before the loop below runs, hand the same files to a pool of worker
@@ -6746,9 +6766,19 @@ def build_repo_ir(
             progress(_file_index, _total_files, "parsing")
         abs_path = root / rel_path
         try:
-            source = abs_path.read_text(encoding="utf-8", errors="replace")
+            raw_source = abs_path.read_bytes()
         except OSError:
+            _parse_failures[rel_path] = {
+                "path": rel_path, "status": "failed", "reason": "unreadable_file",
+            }
             continue
+        try:
+            source = raw_source.decode("utf-8")
+        except UnicodeDecodeError:
+            source = raw_source.decode("utf-8", errors="replace")
+            _parse_failures[rel_path] = {
+                "path": rel_path, "status": "failed", "reason": "invalid_utf8",
+            }
         _meta_files_read += 1
         _meta_lines_read += source.count("\n") + (1 if source and not source.endswith("\n") else 0)
         _meta_chars_read += len(source)
@@ -6787,12 +6817,22 @@ def build_repo_ir(
             from sourcecode.reconciliation import declares_java_type
             if declares_java_type(_mask_java(source)):
                 _unparsed_type_files.append(rel_path)
+                _parse_failures.setdefault(rel_path, {
+                    "path": rel_path,
+                    "status": "failed",
+                    "reason": "type_declaration_produced_no_symbols",
+                })
         # E-10: a brace that never closes is not a style question — it means the
         # symbols recovered from this file stop somewhere the reader cannot see.
         elif symbols and source.count("{") != source.count("}"):
             _masked_src = _mask_java(source)
             if _masked_src.count("{") != _masked_src.count("}"):
                 _unbalanced_files.append(rel_path)
+                _parse_failures.setdefault(rel_path, {
+                    "path": rel_path,
+                    "status": "recovered",
+                    "reason": "unbalanced_braces",
+                })
         _per_file.append((rel_path, package, raw_imports, symbols))
         if "@" in source:
             _parsed_refs = _extract_annotation_type_refs(source, package)
@@ -7014,6 +7054,7 @@ def build_repo_ir(
         custom_security=_custom_sec_tuple,
         unparsed_type_files=_unparsed_type_files,
         unbalanced_files=_unbalanced_files,
+        parse_failures=[_parse_failures[path] for path in sorted(_parse_failures)],
         # Cross-file constant folding for annotation paths: per-file folding only
         # sees constants declared in the same file (see _collect_repo_constants).
         constants=_repo_constants,
@@ -7117,6 +7158,10 @@ def build_repo_ir(
         "methods": sum(_kind_counts.get(k, 0) for k in _METHOD_KINDS),
         "symbols_excluded": symbols_excluded_disclosure(_meta_symbols_excluded),
     }
+    ir["population"] = {
+        "java_files": len(file_paths),
+        "parse_failures": [_parse_failures[path] for path in sorted(_parse_failures)],
+    }
     if emit_body_facts:
         # Additive, in-memory only: not a cir_hash input, not serialized by the
         # repo-ir command (which builds without this flag). Sorted for determinism.

sourcecode/resource_budget.py

@@ -12,6 +12,7 @@ except ImportError:  # pragma: no cover - exercised on Windows
     _resource = None
 
 ENV_RSS_CEILING = "ASK_MAX_RSS_MB"
+DEFAULT_AGENT_RSS_CEILING_MB = 1_536.0
 ERROR_CODE = "MEMORY_TOO_LARGE"
 UNAVAILABLE_CODE = "MEMORY_CEILING_UNAVAILABLE"
 
@@ -121,11 +122,11 @@ def peak_rss_mb() -> Optional[float]:
     return peak_rss_sample()[0]
 
 
-def configured_ceiling_mb() -> Optional[float]:
-    """Read the positive RSS ceiling; zero or unset means no ceiling."""
+def configured_ceiling_mb(*, default: Optional[float] = None) -> Optional[float]:
+    """Read the positive RSS ceiling; an explicit zero disables any default."""
     raw = os.environ.get(ENV_RSS_CEILING)
     if raw is None or not raw.strip():
-        return None
+        return default
     try:
         value = float(raw.strip())
     except ValueError:
@@ -173,7 +174,11 @@ def _unavailable(command: str, ceiling: float, basis: str) -> dict[str, Any]:
     }
 
 
-def exceeded(command: str) -> Optional[dict[str, Any]]:
+def exceeded(
+    command: str,
+    *,
+    default_ceiling_mb: Optional[float] = None,
+) -> Optional[dict[str, Any]]:
     """Build the refusal payload when the ceiling was exceeded — or unusable.
 
     Three outcomes, and the middle one is `AUD-601-R01`'s: no ceiling asked for
@@ -182,7 +187,7 @@ def exceeded(command: str) -> Optional[dict[str, Any]]:
     A gate that was requested and cannot be run must say so; passing it in
     silence is the failure mode the row was filed for.
     """
-    ceiling = configured_ceiling_mb()
+    ceiling = configured_ceiling_mb(default=default_ceiling_mb)
     if ceiling is None:
         return None
     peak, basis = peak_rss_sample()

sourcecode/rule_catalog.py

@@ -57,6 +57,7 @@ RULES: tuple[Rule, ...] = (
     Rule("SEC-007", "SEC", "Credential stored in a deployment descriptor"),
     Rule("SEC-008", "SEC", "SQL built by MyBatis string interpolation"),
     Rule("SEC-009", "SEC", "Anonymous request-chain exception"),
+    Rule("SEC-010", "SEC", "HTTP input reaches a concatenated SQL query sink"),
     Rule("DEAD-001", "DEAD", "Security control present but disabled"),
     Rule("GATE-001", "GATE", "Custom AOP/security gate can be bypassed by proxy limits"),
     Rule("GATE-002", "GATE", "Custom gate advice appears to fail open"),

sourcecode/spring_findings.py

@@ -143,11 +143,11 @@ def _non_coverage_block() -> dict:
     return block("security_surface")
 
 
-def _stack_fit_block(spring_detected: bool) -> dict:
+def _stack_fit_block(spring_detected: bool, spring_footprint: Optional[dict] = None) -> dict:
     """Whether this report's Spring-shaped axes model the repository (CL-19)."""
     from sourcecode.non_coverage import stack_fit
 
-    return stack_fit(spring_detected)
+    return stack_fit(spring_detected, spring_footprint=spring_footprint)
 
 
 @dataclass
@@ -168,6 +168,7 @@ class SpringAuditResult:
     git_head: str = ""
     generated_at: str = ""
     spring_detected: bool = False
+    spring_footprint: dict = field(default_factory=dict)
     scope: str = "all"              # "all" | "tx" | "security"
     findings: list[SpringFinding] = field(default_factory=list)
     limitations: list[str] = field(default_factory=list)
@@ -469,7 +470,7 @@ class SpringAuditResult:
             # consumer reading a missing key on every repository the case was
             # written for, unable to tell "this build does not publish it" from
             # "your stack is modelled".
-            "stack_fit": _stack_fit_block(self.spring_detected),
+            "stack_fit": _stack_fit_block(self.spring_detected, self.spring_footprint),
         }
 
     def to_compact_dict(self, top_n: int = COMPACT_TOP_N) -> dict:

sourcecode/spring_security_audit.py

@@ -480,6 +480,55 @@ def _controller_source_file(cir: "CanonicalRepositoryIR", controller_fqn: str) -
     return ""
 
 
+class _SEC010HttpInputConcatenatedQuery:
+    """Bounded HTTP-input flow into a known concatenated SQL sink."""
+
+    pattern_id = "SEC-010"
+    severity = "high"
+
+    def analyze(
+        self,
+        cir: "CanonicalRepositoryIR",
+        tx_index: Optional[TransactionBoundaryIndex],
+        root: Optional[Path],
+        *,
+        model: Optional[SpringSemanticModel] = None,
+    ) -> list[SpringFinding]:
+        if root is None:
+            return []
+        # Reuse risk's bounded propagation rather than inventing a second taint
+        # analysis. It follows annotated HTTP parameters through positional
+        # in-repository calls to the published query-sink vocabulary only.
+        from sourcecode.risk import _http_input_query_sinks
+
+        sinks = _http_input_query_sinks(root, cir)
+        findings: list[SpringFinding] = []
+        for symbol, trace in sorted(sinks.items()):
+            owner = symbol.split("#", 1)[0]
+            findings.append(SpringFinding(
+                id=SpringFinding.make_id(self.pattern_id, symbol),
+                pattern_id=self.pattern_id,
+                category="security",
+                severity=self.severity,
+                confidence="medium",
+                title="HTTP input reaches a concatenated SQL query sink",
+                symbol=symbol,
+                source_file=_controller_source_file(cir, owner),
+                evidence={"flow": trace, "scope": "bounded_http_input_to_known_query_sink"},
+                explanation=(
+                    "An annotated HTTP input reaches a query argument constructed by "
+                    "concatenation. The observed flow is limited to positional calls "
+                    "inside this repository and the documented query-sink vocabulary."
+                ),
+                fix_hint="Use a parameterized query and bind the request value instead of concatenating SQL.",
+                limitations=[
+                    "This is not general taint analysis; see the published query-sink vocabulary.",
+                ],
+                related_symbols=[owner],
+            ))
+        return findings
+
+
 # ---------------------------------------------------------------------------
 # Default pattern registry
 # ---------------------------------------------------------------------------
@@ -1130,6 +1179,7 @@ _DEFAULT_SECURITY_PATTERNS: list[SecurityPattern] = [
     _SEC002PreAuthorizeGenericInheritance(),  # type: ignore[list-item]
     _SEC003TransactionalOnController(),      # type: ignore[list-item]
     _SEC00XConfigurationWeaknesses(),        # type: ignore[list-item]
+    _SEC010HttpInputConcatenatedQuery(),     # type: ignore[list-item]
     _GATE00XCustomGateAudit(),               # type: ignore[list-item]
 ]
 
@@ -1321,6 +1371,12 @@ def run_security_audit(
     _spring_detected = _detect_spring(
         cir, model=model, tx_total=tx_index.stats()["total"]
     )
+    from sourcecode.spring_model import BeanGraph
+    _beans = (model.bean_graph if model is not None else BeanGraph.build(cir)).beans
+    _spring_footprint = {
+        "spring_beans": sum(1 for bean in _beans.values() if bean.spring),
+        "java_files": len(cir.files),
+    }
 
     _profile_state: dict[str, Any] = {
         "selected": [],
@@ -1421,6 +1477,7 @@ def run_security_audit(
         repo_id=_cache_repo_id(Path(root)) if root is not None else "",
         content_id=getattr(cir, "cir_hash", "")[:16],
         spring_detected=_spring_detected,
+        spring_footprint=_spring_footprint,
         scope="security",
         findings=findings,
         limitations=_sec_limitations,

{sourcecode-5.9.22.dist-info → sourcecode-5.9.23.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.22
+Version: 5.9.23
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.22-blue)
+![Version](https://img.shields.io/badge/version-5.9.23-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -191,10 +191,10 @@ must not be gated on this variable; their budget applicability remains visible i
 the [defect ledger](docs/DEFECT-LEDGER.md).
 
 **Memory is measurable and bounded.** Repository-scoped JSON answers publish
-`_meta.memory.peak_rss_mb` and the configured ceiling. For a supervised deep run,
-set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
-answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
-unset, or set it to `0`, to disable the ceiling explicitly.
+`_meta.memory.peak_rss_mb` and the configured ceiling. `--agent` applies a
+1,536 MB ceiling by default; set `ASK_MAX_RSS_MB=<megabytes>` to override it or
+`ASK_MAX_RSS_MB=0` to disable it explicitly. If the process exceeds the ceiling,
+ASK refuses the answer with `MEMORY_TOO_LARGE`, including the observed peak and limit.
 
 **Current performance status.** Release 5.9.22 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
@@ -212,6 +212,14 @@ exit 75 (`--allow-partial` accepts one deliberately). The long-run progress
 message names the phase it is in and whether that phase has changed, so a slow run
 is distinguishable from a blocked one.
 
+**External audit boundary (2026-09-01).** The latest Windows audit rates the
+large-repository experience at **6.6/10** and reports open P0/P1 issues: empty
+successful Markdown `audit-report`, silent `risk` termination, multi-gigabyte
+deep-agent RSS, incomplete parse/coverage disclosure and oversized compact
+surfaces. These findings are tracked in the [external audit](docs/AUDIT-2026-09-01-EXTERNAL-5.9.22.md)
+and [defect ledger](docs/DEFECT-LEDGER.md); they are not closed by the existing
+engineering-host measurements.
+
 The current external audit still records two open availability limits, and they
 are held open deliberately: `audit-report --format markdown` under contention, and
 the root compact flow under strict timeouts on very large monorepos. Neither

{sourcecode-5.9.22.dist-info → sourcecode-5.9.23.dist-info}/RECORD

@@ -1,10 +1,10 @@
-sourcecode/__init__.py,sha256=rlhdFHgHxU-_wnswNtAc3jkUHnsGhX1taqMHDQJ5P6c,309
+sourcecode/__init__.py,sha256=bD90W3elmTu9mgmtBKJcMr19al2pGKjdSzwGGF7ucJM,309
 sourcecode/__main__.py,sha256=qDFVkobwsdZrX0B3stiRqsUNivVpybKO-egzAwCW4xw,165
-sourcecode/_build_commit.py,sha256=h33fClasWi1xoqBmi7TKbd8bGOaY-_NiL3paWe84zFg,11638
+sourcecode/_build_commit.py,sha256=HCCDrmPAO_ebM9AhlL3dNAbyYlwq8cgPLNTGTObEGHY,11638
 sourcecode/access_drift.py,sha256=uYD8ipiEAaTnkz0IhG6ujU_KI3LghdY-6ycurs-BZnc,9355
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/analysis_budget.py,sha256=ZuNEboPF8A6GK-_V7WNt92ezgriga7_Rbr-vvSN4UEE,4183
-sourcecode/answer_bounds.py,sha256=GKYAQix01_a760YhvWMa-cXu1yT-y7vFgpofkjEwviU,10424
+sourcecode/answer_bounds.py,sha256=Y7yDvgvb9oSRHFx3SUZVDeXMG1ritxxC8gkB7rycpA8,10889
 sourcecode/archetype.py,sha256=V_s5grgpbanrXb8qGEQb73W5Cg5iKW9FQHWKgg5KM8Y,41201
 sourcecode/architectural_baseline.py,sha256=9ds-ZYw4dEJUKWZSdq_ufHq7d2AXnMbEHteSQlT7iu8,26468
 sourcecode/architectural_delta.py,sha256=JhZVmA0gYUryt4x4ieVuxPbcvoBygHgADZaYJ_o4gdk,15142
@@ -29,13 +29,13 @@ sourcecode/cache_observation.py,sha256=5E2BeqiYE5wBCbvDglkc5A9fTNhXkT_OhcDuuCqRu
 sourcecode/call_surface.py,sha256=fiqYfHooxN1fX9oQoysq1LS3LoZcobhyUNjAGEZKpwk,4148
 sourcecode/caller_metrics.py,sha256=zGc3sHRRwEJgAGmyfqEiH69mD9w5rOqMUhzby8Vmm_w,12599
 sourcecode/caller_reach.py,sha256=M7Ffs5CtlimihfdSy3HtC4WpDP97bRFX15QYOlOfMJw,16626
-sourcecode/canonical_ir.py,sha256=KcbR6Vnmo8UbwSbIn6RDAGdNtfPoxz1c_0IVCaoIuss,38779
+sourcecode/canonical_ir.py,sha256=H28TJOG75IMHEkY_YkbJ9LBz2YzgTcNipp2LnYbTYOc,38829
 sourcecode/chain_rules.py,sha256=Bi6UHfgd-GxWswmnHRcPz5jdbAuqka3Zkz_P-MTvqhw,12767
 sourcecode/change_plan.py,sha256=drAoDsqFplutCLc6Y0xue7sYkTls0SpYh7aOXvttv3I,12934
 sourcecode/ci_output.py,sha256=X4NRokWWMRF9Ex8OQrEO2g04GzJ00GDP5zYIoqI9YCc,4625
 sourcecode/cir_graphs.py,sha256=RytqSv1WF8kdlfXj2fPQz16LY4akS2kyThbdWL8beCQ,14835
 sourcecode/classifier.py,sha256=ft1RGPIChvO84q2QMrEH93x1J15AXNWMh26lnxvoRao,26476
-sourcecode/cli.py,sha256=2d-S0OQQnoF8bHll_MfIuFUSyAVtRl_Nopb1WEBd8Vo,956694
+sourcecode/cli.py,sha256=KvL0q2lG5AaYMVfb2B23OEqKK3M2uH1eaQpkIJxqSH0,960162
 sourcecode/click_runtime.py,sha256=K2cUdzFhbd6uEUpucWptXE89_z-ZNZGsqgd-34usUXk,1890
 sourcecode/client_calls.py,sha256=YOPnfRZzRyqmdHvXSVeiunW8cuiuCuWXacNIQRgKMCw,22640
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
@@ -102,14 +102,14 @@ sourcecode/license.py,sha256=eIEuIVQXywl_S9LOIACOEpJ4M5RyaPvWrqg_jSNOrXA,31088
 sourcecode/manifest_cache.py,sha256=qoBn7hPeaMjLHi3higfxsjo7oS7noommRqDnpKP0Ya8,4124
 sourcecode/mcp_nudge.py,sha256=beNjfyb7z09T1rnS4t6Q4qfbLzZQNaP6ddCA4XpmV0s,3256
 sourcecode/metrics_analyzer.py,sha256=gLoRWKygF18jLgwsqmGXSWopw-f5iO1VbM7Jjdif6ag,22809
-sourcecode/migrate_check.py,sha256=tUfTpsMUv06JaKpHAbW_TX3ejO_L4iugYCb__lidq4U,171476
+sourcecode/migrate_check.py,sha256=OvJ51zcnxYTnPoCAPk63ua4En8qdGpvbU8HHDeQT4H4,172215
 sourcecode/migration_apply.py,sha256=36E9IUq7RbpGVt6RZ8PlSZKgDoEMHorZrXw6UVWPnpw,8692
 sourcecode/migration_blast.py,sha256=OPryWkM6-PbvcG3eJFdcWUnlpXBje41nu2BkrZnE2hg,9359
-sourcecode/non_coverage.py,sha256=Tl04OemPnxnOuWISMF6gAhDYx-P0LP6_l-PbpyvBJb4,30634
+sourcecode/non_coverage.py,sha256=0voxV7GdEZBaDHKDaw9RjHeb2qH-8ZdAUAOiu71vd8I,31508
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
 sourcecode/openrewrite_recipe.py,sha256=0pS-61falE6rSfkos2MPnmoDamvoeTT-8Kmj7smj_DI,12987
 sourcecode/output_bounds.py,sha256=BvaRQY5nuytgfNUJHyO7JDLOHuSy0vdjqasISxmxLxI,15516
-sourcecode/output_budget.py,sha256=AHwxnfToUk9a3MJdcq0WDUiFbyNla9VWxdE0pC7UWfY,15617
+sourcecode/output_budget.py,sha256=aiIsX7sefUB1CHiBTt-SskCcdxcbczYC8LdD6ppvSPA,16352
 sourcecode/output_ceiling.py,sha256=dY007vP4V3T9AI09EIz_W36A3FWARQiege_BZ72uMs0,34757
 sourcecode/output_encoding.py,sha256=OxiZQtr7uWBDUtblNQviNHsTH1Xo9AZEpsegPlQWKFk,2139
 sourcecode/output_sink.py,sha256=Eya-PnXxqc3RGulJoLhuC9LUF73SZD0aO5O2B0xAMXU,8762
@@ -148,12 +148,12 @@ sourcecode/remediation_report.py,sha256=z28x-u618feU2d7ol_FW7IfhUOq6iETCfdpl7zJC
 sourcecode/remedies.py,sha256=V2_cD4pLq8bKRkzF-3RGFoiu1xWYZS384WDVp1MrlZw,10225
 sourcecode/rename_refactor.py,sha256=oASZIf7TxcOBy3RQ0FuOe-4HlNW_JOu9RW9JqCxGNBE,17225
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=GLYSuPuFqwWdIUtZsUNFctl5DgUaOsDKEK_rwnS-F9g,526567
-sourcecode/resource_budget.py,sha256=Bo-XMvVK9XyHY_S06fVirZrhXgwmnr3XI38-Li55NWY,7767
+sourcecode/repository_ir.py,sha256=O6d1IWp0-RlJyx4OHBGcflvNA0CgsTS7td7UlI9t7S8,528687
+sourcecode/resource_budget.py,sha256=wqe6WuXlEfxAgBGLj0QX47HmV8WldaYWQjLe-TMR6hk,7938
 sourcecode/ris.py,sha256=HsLVHZfseEHNqMyxrj8SvrzUK7jE_85lsWjHtsEw9ik,29196
 sourcecode/risk.py,sha256=rG7fqDIjyhtvB0Qje0d2ZEUl5kemMBwbuOJG8ZJxqrQ,102552
 sourcecode/risk_model.py,sha256=RoC-G15qZP5BLEwwmcr4eJ0APgvIbh1WTqhTVT-5YFE,10895
-sourcecode/rule_catalog.py,sha256=QCx6ToFTMCtDt5uuX1uBMLuw3b9Cd92gGRsX34kud4U,5328
+sourcecode/rule_catalog.py,sha256=7lwyNe_sA7M9KtoKXVf9qQYBlo7VEPQ3IK1KiGSqTts,5408
 sourcecode/rule_pass.py,sha256=DTNxD-nAecMJhIzI1LCd9FyRumInQSZjitacNh4Zoc8,14671
 sourcecode/runs.py,sha256=o4oXkB3WFJGScbK_C10OAWzsE18B9Zc55u_IE8_yl4M,6291
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
@@ -178,12 +178,12 @@ sourcecode/serializer.py,sha256=zcwsbkC84XKhoDEMv5YR4pP_CnH9iSB1_GlUUvfF8es,1598
 sourcecode/servlet_surface.py,sha256=CeiebkxLXKojUQxIf7HV7tdQAwLM32ggDUwBnVQIjdo,13499
 sourcecode/source_text.py,sha256=R52gmSljz7L6YVPbixv5W-LOZ5eKUVvSUP3S-QH_IWc,9047
 sourcecode/spring_event_topology.py,sha256=gm_1J7Dj9JQ1tXnkOzIfjPNFxPLmSN56Vcj8RisqB5I,18093
-sourcecode/spring_findings.py,sha256=U5gMDdSdhpJLstt3ghG4y5CCS9nzIU9NuRMHpNu7FpY,27766
+sourcecode/spring_findings.py,sha256=pvH7Qg7MHv_6m1QyxoVBppCceK_U4P_MKbU6YdQivUM,27922
 sourcecode/spring_impact.py,sha256=7gcP4MJcRl8SF5UjYnZXsvtwvIollUtYXlUn08q-JMM,98677
 sourcecode/spring_model.py,sha256=MBUKR1tes5UVGxtYiv4J2WrydgOp_zReek7P7hO50hA,28962
 sourcecode/spring_profiles.py,sha256=jDNBVhEZQAZXrpqt85FkP2URsMw4YWhQo3W3SLHuwpM,19617
 sourcecode/spring_properties.py,sha256=kPTk5qAJxdbHc1hclhHAP0O-hCIzBn8PTh3lzl-I4a4,8400
-sourcecode/spring_security_audit.py,sha256=mJxrB-uKvMh2aF3Q8cFVOC8yOYb2JW8P-yK-paMTQBQ,71218
+sourcecode/spring_security_audit.py,sha256=uEAuHGcPYbmhHeL4k5sDqBvUs5RaN6j-zM6oJqv1yrk,73734
 sourcecode/spring_semantic.py,sha256=zrUYWF7Gnz6hpP_3hRveHmGEntT95WpgXt6u7PzLSGg,16835
 sourcecode/spring_tx_analyzer.py,sha256=cFK9M3madb7dKbJ_d97cO-1fGMUPDOwB8KoJ-oocMeY,50951
 sourcecode/sql_taint.py,sha256=As1DbEdjXMBFjCTXU5ojksOzuKkP6LmnuMVnzzmckzc,26998
@@ -275,13 +275,13 @@ sourcecode/telemetry/consent.py,sha256=-Wb8BFGXEexOs8M0Eja7F-T6ZtLNPeRoZnHcHvlP7
 sourcecode/telemetry/events.py,sha256=l3Z2SQUO4_C2D2ItXOOdVNimAmHedUHnUxqYFTxnsAE,2900
 sourcecode/telemetry/filters.py,sha256=-lqT2oorECuqEIdeHb--7AZ6BCaUx0bya720a-Z5x6w,7335
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode/_docs/DEFECT-LEDGER.md,sha256=27Td56IIsaXPz9udDpLMiMDP4RMeaQTh5-FUqucpee4,1167577
+sourcecode/_docs/DEFECT-LEDGER.md,sha256=OpDD8MD9feF0s8sLstG9UtLjXFijaakvnEO1zQqsliI,1170077
 sourcecode/_docs/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
 sourcecode/_docs/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode/_docs/USER_GUIDE.md,sha256=A__FLktxJ8S-VMUAQ5OxPRfUkKQ7yKy6FQbWxiZvc6c,108275
-sourcecode-5.9.22.dist-info/METADATA,sha256=Plv_fedlIoI6bKsHB5Q5zFlOlC_nK-KN7gLa34KVsb8,66673
-sourcecode-5.9.22.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-5.9.22.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-5.9.22.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
-sourcecode-5.9.22.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode-5.9.22.dist-info/RECORD,,
+sourcecode/_docs/USER_GUIDE.md,sha256=5gVJnyzQHCNyJ3DgIU6VOJZCrjs9l7CQCrd9NLKcm2Y,108622
+sourcecode-5.9.23.dist-info/METADATA,sha256=U5g82Fb-Tg9MxLP6x66-jEXfh5_EZCu6TkNLKwLEgfo,67221
+sourcecode-5.9.23.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-5.9.23.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-5.9.23.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
+sourcecode-5.9.23.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
+sourcecode-5.9.23.dist-info/RECORD,,