sourcecode 5.9.22__tar.gz → 5.9.24__tar.gz

{sourcecode-5.9.22 → sourcecode-5.9.24}/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## [5.9.24] — 2026-09-01
+
+*Follow-up correction batch after the external 5.9.23 audit.*
+
+### Fixed
+
+- Aggregated nested answer-cap contracts so compact output reports rows hidden
+  below nested payloads instead of publishing a misleading zero count.
+- Bound `--jobs` to 128 workers, preventing accidental unbounded process-pool
+  requests while retaining automatic and explicit parallelism.
+- Removed Rich markup from help output written to a pipe, so scripts and CI logs
+  receive plain, parseable text.
+- Accepted an optional repository path on `remediation-report` for consistency
+  with repository-oriented command invocation.
+
+### Known Limitations
+
+- The external 5.9.23 audit measured rare zero-byte successful answers from
+  `risk` and Markdown `audit-report`. This remains a P0 CI blocker: validate
+  output bytes until `EMPTY_ANSWER` is enforced globally.
+- `--agent` can reject large repositories after expensive post-hoc RSS sampling,
+  and nested workspaces can make root help unacceptably slow. The prioritized
+  remediation queue is maintained in the defect ledger.
+
+## [5.9.23] — 2026-09-01
+
+*Regression hardening after the 5.9.22 audit and testing-repository battery.*
+
+### Fixed
+
+- `--compact` and `--agent` reserve envelope metadata before trimming, so their
+  published 30 KB and 40 KB stdout ceilings remain true after final rendering.
+- `--agent` now has a 1,536 MB default RSS ceiling, reports context construction
+  accurately in progress output, and rejects Java repositories above 10,000 files
+  with `AGENT_SCOPE_TOO_LARGE` before an unbounded deep analysis can be killed.
+- Agent mode no longer builds a module graph implicitly; callers can still request
+  it explicitly with `--graph-modules`.
+
+### Documentation
+
+- Added the Windows large-repository audit with measured P0/P1 regressions,
+  performance boundaries and explicit closure requirements.
+- Synchronized the defect ledger and README so silent-success, incomplete
+  coverage, compact-output, cache-growth and deep-agent memory risks are visible
+  rather than implied closed by smaller-repository measurements.
+
 ## [5.9.22] — 2026-08-31
 
 *Large-repository route projection performance.*

{sourcecode-5.9.22 → sourcecode-5.9.24}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.22
+Version: 5.9.24
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.22-blue)
+![Version](https://img.shields.io/badge/version-5.9.24-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -191,10 +191,10 @@ must not be gated on this variable; their budget applicability remains visible i
 the [defect ledger](docs/DEFECT-LEDGER.md).
 
 **Memory is measurable and bounded.** Repository-scoped JSON answers publish
-`_meta.memory.peak_rss_mb` and the configured ceiling. For a supervised deep run,
-set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
-answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
-unset, or set it to `0`, to disable the ceiling explicitly.
+`_meta.memory.peak_rss_mb` and the configured ceiling. `--agent` applies a
+1,536 MB ceiling by default; set `ASK_MAX_RSS_MB=<megabytes>` to override it or
+`ASK_MAX_RSS_MB=0` to disable it explicitly. If the process exceeds the ceiling,
+ASK refuses the answer with `MEMORY_TOO_LARGE`, including the observed peak and limit.
 
 **Current performance status.** Release 5.9.22 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
@@ -212,6 +212,16 @@ exit 75 (`--allow-partial` accepts one deliberately). The long-run progress
 message names the phase it is in and whether that phase has changed, so a slow run
 is distinguishable from a blocked one.
 
+**External audit boundary (2026-09-01).** The latest Windows audit rates the
+large-repository experience at **6.9/10** and reports open P0/P1 issues: empty
+successful Markdown `audit-report`, silent `risk` termination, multi-gigabyte
+deep-agent RSS, incomplete parse/coverage disclosure and oversized compact
+surfaces. The 5.9.23 audit found a CI-blocking empty-output regression that
+remains open in 5.9.24; do not use `risk` or Markdown `audit-report` as
+unattended gates until it is fixed. Findings are tracked in the [external audit](docs/AUDIT-2026-09-01-EXTERNAL-5.9.23.md)
+and [defect ledger](docs/DEFECT-LEDGER.md); they are not closed by the existing
+engineering-host measurements.
+
 The current external audit still records two open availability limits, and they
 are held open deliberately: `audit-report --format markdown` under contention, and
 the root compact flow under strict timeouts on very large monorepos. Neither

{sourcecode-5.9.22 → sourcecode-5.9.24}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.22-blue)
+![Version](https://img.shields.io/badge/version-5.9.24-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -142,10 +142,10 @@ must not be gated on this variable; their budget applicability remains visible i
 the [defect ledger](docs/DEFECT-LEDGER.md).
 
 **Memory is measurable and bounded.** Repository-scoped JSON answers publish
-`_meta.memory.peak_rss_mb` and the configured ceiling. For a supervised deep run,
-set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
-answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
-unset, or set it to `0`, to disable the ceiling explicitly.
+`_meta.memory.peak_rss_mb` and the configured ceiling. `--agent` applies a
+1,536 MB ceiling by default; set `ASK_MAX_RSS_MB=<megabytes>` to override it or
+`ASK_MAX_RSS_MB=0` to disable it explicitly. If the process exceeds the ceiling,
+ASK refuses the answer with `MEMORY_TOO_LARGE`, including the observed peak and limit.
 
 **Current performance status.** Release 5.9.22 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
@@ -163,6 +163,16 @@ exit 75 (`--allow-partial` accepts one deliberately). The long-run progress
 message names the phase it is in and whether that phase has changed, so a slow run
 is distinguishable from a blocked one.
 
+**External audit boundary (2026-09-01).** The latest Windows audit rates the
+large-repository experience at **6.9/10** and reports open P0/P1 issues: empty
+successful Markdown `audit-report`, silent `risk` termination, multi-gigabyte
+deep-agent RSS, incomplete parse/coverage disclosure and oversized compact
+surfaces. The 5.9.23 audit found a CI-blocking empty-output regression that
+remains open in 5.9.24; do not use `risk` or Markdown `audit-report` as
+unattended gates until it is fixed. Findings are tracked in the [external audit](docs/AUDIT-2026-09-01-EXTERNAL-5.9.23.md)
+and [defect ledger](docs/DEFECT-LEDGER.md); they are not closed by the existing
+engineering-host measurements.
+
 The current external audit still records two open availability limits, and they
 are held open deliberately: `audit-report --format markdown` under contention, and
 the root compact flow under strict timeouts on very large monorepos. Neither

sourcecode-5.9.24/docs/AUDIT-2026-09-01-EXTERNAL-5.9.22.md

@@ -0,0 +1,71 @@
+# External Audit — ASK Engine 5.9.22
+
+**Received:** 2026-09-01  
+**Audited build:** `5.9.22` (`64c8b3e429eadd7a12d34eb1e5eefa0c08e430e4`)  
+**Platform:** Windows 11, Python 3.10, Git Bash  
+**Corpus:** repositories under `laboratorioDePruebas/testing/`; the largest
+reported target contains 3,342 Java files.
+
+This document records external observations. An observation is not a closure:
+the defect ledger remains authoritative until a fix, all affected consumers and
+a regression assertion exist.
+
+## Executive Result
+
+The audit rates ASK Engine **6.6/10** on the large MSAS corpus and **7.5/10** on
+the smaller nine-axis assessment. The measurements agree on the main risk:
+source analysis is accurate and unusually explicit about uncertainty, but large
+repository execution and several output contracts are not yet reliable enough
+for interactive or unattended security use.
+
+Strengths confirmed: endpoint extraction, effective access resolution,
+determinism, structured input errors, cache warm-up and bounded CI-oriented
+flows. The principal gaps are silent success, incomplete parse disclosure,
+SQL-injection recall, memory, and inconsistent CLI contracts.
+
+## Priority Findings
+
+| ID | Priority | Status | Finding and closure requirement |
+|---|---|---|---|
+| `BUG-01` | P0 | Open | `audit-report --format markdown` reproduced with `rc=0` and empty stdout. Add a non-empty-answer invariant and full/partial renderer coverage. |
+| `BUG-02` | P0 | Open | Large `risk` ended `rc=127` with no output or structured error. Add fail-fast resource/process handling and durable partial checkpoints. |
+| `BUG-12` | P0 | Open | Deep `--agent` output construction reaches multi-gigabyte RSS before producing a small answer. Bound projection while building, not after materialization. |
+| `BUG-03` | P1 | Open | `content_id` changes between cold and warm because cache state is hashed into the answer. Separate execution metadata from answer identity. |
+| `BUG-04` | P1 | Open | `selftest` publishes `complete=true` with five error rows. Derive bounds from its actual result population. |
+| `BUG-04b` | P1 | Open | `selftest` uses a fixed 120-second deadline not covered by the documented analysis budget. Make it configurable or refuse unscoped large runs. |
+| `BUG-05` | P1 | Open | Overloaded endpoint handlers can receive the wrong declaration line. Resolve by mapping annotation or publish ambiguity. |
+| `BUG-06` | P1 | Open | The `repo-ir --budget-tokens 12000` help example is below the measured minimum view (~20,367 tokens) on the audited corpus. |
+| `BUG-07` | P1 | Open | `--compact` exceeds the published size expectation on `migrate-check` and `spring-audit`. Apply bounded projections with omission metadata. |
+| `BUG-08` | P1 | Open | Root help claims universal `--path`, `--repo` and `--dir` aliases, but sampled commands reject them. Align implementation and help. |
+| `BUG-09` | P2 | Open | Related diff commands disagree on `--base`, `--base-ref`, `--since`, `--repo` and `--path`. Accept compatible aliases or publish one vocabulary. |
+| `BUG-10` | P1 | Open | Unsupported routing styles can produce `coverage.gaps=[]`. Publish detected-but-unmodeled routing gaps. |
+| `BUG-11` | P1 | Open | Default `pack assessment` can fail on a small Spring repository. Use a bounded default or explicit full mode. |
+| `BUG-13` | P1 | Open | Unscoped `selftest` starts over nested repositories after warning. Refuse and require an explicit repository path. |
+| `BUG-15` | P2 | Open | Non-terminal help output contains visible markup/control text. Strip markup when stdout is not a TTY. |
+| `BUG-16` | P1 | Open | Context-cache growth is not bounded or documented; about 1.5 GB was measured. Add a published budget, eviction policy and status. |
+| `BUG-19` | P2 | Open | Unknown-command errors use plain text instead of the JSON error envelope. Normalize command admission errors. |
+| `BUG-20` | P2 | Open | `--detach` can report the unresolved user path while writing to a resolved Windows path. Publish the actual absolute output path. |
+| `BUG-21` | P2 | Open | `--jobs 999` is silently clipped. Publish the effective limit or reject out-of-range values. |
+| `BUG-22` | P1 | Open | RSS ceilings are checked post-hoc; a 50 MB ceiling was reported only after ~768 MB. Add periodic in-flight sampling and orderly abort. |
+| `BUG-23` | P2 / coverage | Open | Micronaut is detected but unsupported and its controllers are not modeled as endpoints. Add a scoped coverage contract. |
+
+## Performance Evidence
+
+The audit measured `--agent` on ThingsBoard at **182.6 s / 2,088 MB RSS** and
+`spring-audit` at **164.2 s cold**. On the larger MSAS corpus it reports
+`ask . --agent` at **447 s**, `contract-diff` at **329 s**, `delta` at **187 s**,
+and `validation --compact` at **91 s**. Warm root compact analysis can be below
+one second; these are cold/deep-path costs.
+
+Until the P0/P1 rows close, do not market `risk`, full `audit-report` or full
+`--agent` as interactive guarantees for 3,000+ Java-file repositories. The
+target remains bounded interactive views below 20 s and peak RSS below 400 MB
+on the reference large-repository tier.
+
+## Required Closure Bar
+
+Each P0/P1 row requires a focused regression test, output/exit-code assertions,
+cold/warm/concurrent runs on the affected platform, and a ledger entry naming
+the fix commit and remaining verification boundary. Documentation alone never
+closes a defect.
+

sourcecode-5.9.24/docs/AUDIT-2026-09-01-EXTERNAL-5.9.23.md

@@ -0,0 +1,40 @@
+# External Audit - 5.9.23
+
+## Release Status
+
+The 5.9.23 re-audit rates ASK Engine at **6.9/10**, down from 7.5. Precision
+remains strong and SEC-010 closes the previously reported concatenated-SQLi
+coverage gap. The release is **not recommended for unattended CI gating** until
+the empty-success invariant is implemented.
+
+## Priority Regressions
+
+1. `NEW-01` P0: `risk` and Markdown `audit-report` were observed exiting 0 with
+   zero stdout and stderr. The audit measured 3 occurrences in 47 runs with
+   byte counting. Its later controls did not reproduce warm-cache or contention
+   causality, so those are not asserted as the root cause.
+2. `REG-02` Critical: the default 1,536 MB agent ceiling rejects valid large
+   repositories only after expensive work; the effective default ceiling is not
+   visible in successful-agent metadata.
+3. `BUG-01` P0: malformed Java can disappear without file-specific disclosure.
+4. `REG-03` High: warm Spring audit runs were 2.1-3.8x slower despite full CIR
+   reuse.
+5. `NEW-02` High: overloaded endpoint handlers can publish the wrong declaration
+   line while claiming a handler-declaration anchor.
+
+## Verified Improvements
+
+- SEC-010 emits a dedicated high-severity finding for HTTP input reaching a
+  concatenated SQL query sink, with no observed false positives on three clean
+  repositories.
+- Compact migration inventory is materially bounded and publishes per-framework
+  omission contracts.
+- Help recommendations use repository profile evidence and route aliases were
+  restored across the sampled command surface.
+
+## Verification Boundary
+
+The audit was performed on Windows 11 / Python 3.10 across 21 repositories and
+about 180 invocations. Reported timings are platform-specific evidence, not
+portable performance guarantees. Its zero-output finding is operationally
+critical even though its precise trigger remains unproven.

{sourcecode-5.9.22 → sourcecode-5.9.24}/docs/DEFECT-LEDGER.md

@@ -14,6 +14,45 @@ Status values: `open` · `in-progress` · `closed <version>` · `by-design` (wit
 The facts these rows are keyed to are published: `ask schema facts-v1` prints the registry
 (authority, definition, consumers, parity test) that the release battery enforces.
 
+## Current Synchronization — External Audit `5.9.23`, carried into `5.9.24` (2026-09-01)
+
+**Release gate: do not use 5.9.24 as a CI decision gate for these surfaces.** The audit measured
+three `rc=0`, zero-byte answers across `risk` and Markdown `audit-report`.
+The trigger is not yet established; warm-cache and contention hypotheses were
+explicitly tested and did not reproduce it. A global non-empty-output invariant
+is therefore the P0 containment work, not a claim that the root cause is known.
+
+Priority order is: `NEW-01` empty successful output; `REG-02` default agent
+memory rejection and post-hoc RSS enforcement; `BUG-01` undeclared parse loss;
+`REG-03` warm-path slowdown; `NEW-02` overloaded endpoint anchors; then
+workspace-help/selftest/plan and output-contract regressions. Full evidence:
+[`AUDIT-2026-09-01-EXTERNAL-5.9.23.md`](AUDIT-2026-09-01-EXTERNAL-5.9.23.md).
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `NEW-01` | Critical maximum | **open, P0 / CI blocker** | `risk` and Markdown `audit-report` can exit `0` with zero bytes on stdout and stderr. The measured rate was 3/47 byte-counted runs; root cause is unknown. Enforce `EMPTY_ANSWER` globally and add byte-counted background-process coverage. |
+| `REG-02` | Critical | **open, regression** | The 1,536 MB default `--agent` ceiling rejects valid large repositories only after spending minutes; it is not published in successful default-agent metadata. Bound projection during construction, sample RSS periodically, and publish the effective ceiling. |
+| `REG-03` | High | **open, regression** | Warm `spring-audit` was measured 2.1–3.8x slower despite a fully reused CIR. Attribute the warm pass before claiming cache benefit. |
+| `REG-01` | High | **open, regression** | Root `ask --help` took 83–86 seconds in a workspace with nested repositories. Help must not perform unbounded repository/profile analysis. |
+| `REG-04` | Medium | **closed 5.9.24** | `_meta.answer_bounds.capped` now aggregates nested cap contracts, so compact answers disclose rows omitted below nested payloads. Regression coverage includes nested dictionaries and lists. |
+| `NEW-02` | High | **open** | Overloaded endpoint handlers can all inherit the final overload's `declaration_line`. Resolve by mapping annotation/signature or publish ambiguity. |
+| `BUG-01` | Critical maximum | **open, P0** | A malformed Java file can disappear without a file-specific declaration. Publish parse failure/recovery in the answer bounds and preserve any affected endpoint gap. |
+| `BUG-02` | Critical maximum | **open, P0** | Large `risk` ended `rc=127` with no output or structured failure. Add fail-fast resource/process handling and durable partial checkpoints. |
+| `BUG-12` | Critical maximum | **open, P0** | Deep `--agent` output construction reaches multi-gigabyte RSS before a small answer. Bound projection while building. |
+| `BUG-03` | High | **open, P1** | Marginal Spring detection can overstate what a zero-finding result covers. Publish Spring footprint/coverage with the stack-fit claim. |
+| `BUG-04` | High | **open, P1** | `selftest` publishes `complete=true` with five error rows. Derive bounds from actual results. |
+| `BUG-05` | High | **open, P1** | Overloaded endpoint handlers can receive the wrong declaration line. Resolve by mapping annotation or publish ambiguity. |
+| `BUG-07` | Closed 5.9.23, verification gap | Compact JVM inventory is bounded, but the audit notes no selftest row protects the correction. Add release-battery coverage before treating it as durable closure. |
+| `BUG-10` | High | **open, P1** | Unsupported routing styles can produce empty coverage gaps. Publish detected-but-unmodeled routing gaps. |
+| `BUG-11` | High | **open, P1** | Default `pack assessment` can fail on a small Spring repository. Use a bounded default or explicit full mode. |
+| `BUG-13` | High | **open, P1** | Unscoped `selftest` starts over nested repositories after warning. Refuse and require an explicit path. |
+| `BUG-16` | High | **open, P1** | Context-cache growth has no published budget or eviction contract; about 1.5 GB was measured. |
+| `BUG-22` | High | **open, P1** | RSS ceilings are checked post-hoc. Add periodic sampling and orderly abort. |
+
+The remaining `BUG-04b`, `BUG-06`, `BUG-08`, `BUG-09`, `BUG-15`, `BUG-19`,
+`BUG-20`, `BUG-21` and `BUG-23` findings are open P2/coverage follow-ups in
+the audit document. None is closed by documentation alone.
+
 ## Current Synchronization — External Audit `AUD-621`
 
 **Release `5.9.19` remediation.** The stderr-decoding fix for `AUD-621-PACK-STDERR` remains in code, and the distinct `pack gate --since` crash found by the post-remediation re-audit is corrected with a Python 3.9–3.11-compatible tar extraction path. `AUD-621-R` has a second Windows barrier at process-pool construction, complementing the sequential fallback. The broader findings remain open until their required native Windows evidence is recorded; `AUD-621-CONTEXT` and `AUD-621-WIN-PROC` are unchanged.

{sourcecode-5.9.22 → sourcecode-5.9.24}/docs/PRODUCT_TIERS.md

@@ -59,7 +59,7 @@ single-repo, offline.**
 | **Modernization planning** | `ask modernize .` | Hotspots, callerless types (with `unknown` where a framework may dispatch), coupling tangles, refactor roadmap |
 | **Git-churn ranking** | `--rank-by git-churn` | File volatility via git history |
 | **No truncation limits** | `--full` | Full transactional boundaries, DTO mappers, large result sets |
-| **Spring semantic audit** | `ask spring-audit .` | TX-001..006 anomalies + SEC-001..009 security surface; JAVA/SPRING only |
+| **Spring semantic audit** | `ask spring-audit .` | TX-001..006 anomalies + SEC-001..010 security surface; JAVA/SPRING only |
 | **Impact chain + opt-in TX/SEC findings** | `ask impact-chain <symbol>` (`--with-findings` for audit findings) | Systemic blast radius with transaction boundary and security surfaces per hop |
 | **Event topology** | `ask impact-chain <event> --type events` | Publisher → event → consumer graph; AFTER_COMMIT/BEFORE_COMMIT TX phase |
 | RIS bootstrap context | `ask cold-start .` | Repository Intelligence Snapshot; instant return from persisted cache |

{sourcecode-5.9.22 → sourcecode-5.9.24}/docs/USER_GUIDE.md

@@ -382,6 +382,9 @@ Output: detected stacks, entry points, dependencies, transactional boundaries (S
 ### `ask --agent`
 
 More structured version of `--compact`. Designed for AI agent system prompt injection.
+It is bounded to 40 KB on stdout and admits repositories up to 10,000 Java files;
+larger repositories return `AGENT_SCOPE_TOO_LARGE` before expensive analysis. Use
+`--compact` or narrow the path in that case.
 
 ```bash
 ask /repo --agent --output context.json
@@ -528,7 +531,7 @@ disabled changes runtime behaviour nobody measured; a diff is how a person makes
 call with the evidence in front of them.
 
 **TX patterns (TX-001..TX-006):** proxy bypass, nested transactions, readOnly propagation, NOT_SUPPORTED in active TX, exception swallowing, self-invocation of a `@Transactional` sibling.
-**SEC patterns (SEC-001..SEC-009):** unsecured endpoints, CVE-2025-41248 `@PreAuthorize` inheritance bypass, `@Transactional` on controllers, passwords stored under a fast unsalted digest, CSRF disabled under session-bearing authentication, cookies created without the Secure attribute, credentials stored in a deployment descriptor, SQL built by MyBatis string interpolation, and anonymous request-chain exceptions. **DEAD-001** reports a security control that is present only in comments and therefore disabled.
+**SEC patterns (SEC-001..SEC-010):** unsecured endpoints, CVE-2025-41248 `@PreAuthorize` inheritance bypass, `@Transactional` on controllers, passwords stored under a fast unsalted digest, CSRF disabled under session-bearing authentication, cookies created without the Secure attribute, credentials stored in a deployment descriptor, SQL built by MyBatis string interpolation, anonymous request-chain exceptions, and HTTP input reaching a concatenated known query sink through bounded positional in-repository calls. **DEAD-001** reports a security control that is present only in comments and therefore disabled.
 **GATE patterns (GATE-001..GATE-004):** custom AOP/security-gate risks over the same custom-gate authority published in `security_posture`: proxy bypass (`private`/`final`/self-invocation), advice that appears to fail open, disabled or tautological annotation attributes, and fragile `args[0]`/reflection binding.
 
 Each finding includes `severity`, `confidence`, `symbol`, `source_file`, `evidence`, `explanation`, and `fix_hint`. JAVA/SPRING ONLY.
@@ -1812,10 +1815,10 @@ stops at 1 408 files inside the `SEC-004` group and ends at 5.1s.
 **Memory budget.** Repository-scoped JSON answers include `_meta.memory` with
 `unit: "MB"`, the observed `peak_rss_mb`, the `peak_rss_basis` it was sampled
 from, `configured_max_rss_mb`, and `ceiling_enforceable`. To bound long analyses
-on a CI or supervised runner, set `ASK_MAX_RSS_MB=<megabytes>`. Exceeding the
-ceiling produces exit code `1` and a structured `MEMORY_TOO_LARGE` error with the
-peak and configured limit; no partial answer is published. Unset the variable, or
-set it to `0`, to disable this ceiling.
+on a CI or supervised runner, set `ASK_MAX_RSS_MB=<megabytes>`. `--agent` uses
+1,536 MB when the variable is unset. Exceeding the ceiling produces exit code `1`
+and a structured `MEMORY_TOO_LARGE` error with the peak and configured limit; no
+partial answer is published. Set the variable to `0` to disable this ceiling.
 
 Where the platform exposes no footprint sample, `peak_rss_mb` is `null` and
 `peak_rss_basis` says why — never `0`, which would read as a measured floor. A

{sourcecode-5.9.22 → sourcecode-5.9.24}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.22"
+version = "5.9.24"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.22 → sourcecode-5.9.24}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.22"
+__version__ = "5.9.24"

{sourcecode-5.9.22 → sourcecode-5.9.24}/src/sourcecode/answer_bounds.py

@@ -99,6 +99,16 @@ def _gaps(payload: "dict[str, Any]") -> "list[dict[str, Any]]":
             found.append({"field": "non_coverage", "what": _summarise(entry)})
     elif non_coverage:
         found.append({"field": "non_coverage", "what": _summarise(non_coverage)})
+    populations = [payload.get("population")]
+    metadata = payload.get("metadata")
+    if isinstance(metadata, dict):
+        populations.append(metadata.get("population"))
+    for population in populations:
+        if not isinstance(population, dict):
+            continue
+        for failure in _as_list(population.get("parse_failures")):
+            if failure:
+                found.append({"field": "population.parse_failures", "what": _summarise(failure)})
     for prefix, block in _blocks(payload):
         for field in _GAP_FIELDS:
             value = block.get(field)
@@ -160,17 +170,24 @@ def _exclusions(payload: "dict[str, Any]") -> "list[dict[str, Any]]":
 
 def _caps(payload: "dict[str, Any]") -> "list[dict[str, Any]]":
     found: "list[dict[str, Any]]" = []
+    def walk(value: Any, prefix: str) -> None:
+        if isinstance(value, dict):
+            for key, child in value.items():
+                path = f"{prefix}{key}"
+                if key.endswith(_CAP_SUFFIX) and isinstance(child, dict):
+                    omitted = child.get("omitted")
+                    if omitted not in (None, 0):
+                        found.append({"field": path, **{
+                            axis: child[axis] for axis in ("total", "shown", "omitted")
+                            if axis in child
+                        }})
+                walk(child, f"{path}.")
+        elif isinstance(value, list):
+            for index, child in enumerate(value):
+                walk(child, f"{prefix}{index}.")
+
     for prefix, block in _blocks(payload):
-        for key, value in block.items():
-            if not key.endswith(_CAP_SUFFIX) or not isinstance(value, dict):
-                continue
-            omitted = value.get("omitted")
-            if omitted in (None, 0):
-                continue
-            found.append({"field": f"{prefix}{key}", **{
-                axis: value[axis] for axis in ("total", "shown", "omitted")
-                if axis in value
-            }})
+        walk(block, prefix)
     return found
 
 

{sourcecode-5.9.22 → sourcecode-5.9.24}/src/sourcecode/canonical_ir.py

@@ -594,6 +594,7 @@ def ir_dict_to_canonical(
         "edge_count": len(call_graph),
         "subsystems": ir.get("subsystems") or [],
         "analysis_gaps": ir.get("analysis_gaps") or [],
+        "population": ir.get("population") or {},
         "spring_events": ir.get("spring_events") or {},
         "score_basis": (ir.get("impact") or {}).get("score_basis", "none"),
         "reverse_graph_size": len(ir.get("reverse_graph") or {}),