sourcecode 5.9.23__py3-none-any.whl → 5.9.25__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of sourcecode might be problematic. Click here for more details.
- sourcecode/__init__.py +1 -1
- sourcecode/_build_commit.py +3 -3
- sourcecode/_docs/DEFECT-LEDGER.md +35 -9
- sourcecode/_docs/USER_GUIDE.md +1 -1
- sourcecode/answer_bounds.py +23 -10
- sourcecode/cli.py +57 -4
- sourcecode/envelope.py +4 -1
- sourcecode/migrate_check.py +9 -0
- sourcecode/release_info.py +1 -1
- sourcecode/rule_pass.py +9 -0
- sourcecode/security_posture.py +30 -4
- sourcecode/selftest.py +20 -0
- sourcecode/spring_security_audit.py +31 -5
- {sourcecode-5.9.23.dist-info → sourcecode-5.9.25.dist-info}/METADATA +16 -10
- {sourcecode-5.9.23.dist-info → sourcecode-5.9.25.dist-info}/RECORD +19 -19
- {sourcecode-5.9.23.dist-info → sourcecode-5.9.25.dist-info}/WHEEL +0 -0
- {sourcecode-5.9.23.dist-info → sourcecode-5.9.25.dist-info}/entry_points.txt +0 -0
- {sourcecode-5.9.23.dist-info → sourcecode-5.9.25.dist-info}/licenses/LICENSE +0 -0
- {sourcecode-5.9.23.dist-info → sourcecode-5.9.25.dist-info}/licenses/NOTICE +0 -0
sourcecode/__init__.py
CHANGED
sourcecode/_build_commit.py
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
"""Generated at build time by hatch_build.py. Do not edit (AUD-592-D04)."""
|
|
2
2
|
|
|
3
|
-
BUILD_COMMIT = '
|
|
4
|
-
CLOSURE_PROVENANCE = {'AUD-611-B05': {'commit': '', 'status': 'uncited'}, 'AUD-611-B06': {'commit': '', 'status': 'uncited'}, 'AUD-611-B07': {'commit': '', 'status': 'uncited'}, 'AUD-611-B08': {'commit': '', 'status': 'uncited'}, 'AUD-611-B09': {'commit': '', 'status': 'uncited'}, 'AUD-611-B10': {'commit': '', 'status': 'uncited'}, 'AUD-611-B11': {'commit': '', 'status': 'uncited'}, 'AUD-612-07': {'commit': '', 'status': 'uncited'}, 'AUD-612-09': {'commit': '', 'status': 'uncited'}, 'AUD-612-14': {'commit': '', 'status': 'uncited'}, 'AUD-612-B03': {'commit': '', 'status': 'uncited'}, 'AUD-612-B07': {'commit': '', 'status': 'uncited'}, 'AUD-612-B13': {'commit': '', 'status': 'uncited'}, 'AUD-612-E': {'commit': '', 'status': 'uncited'}, 'AUD-612-G': {'commit': '', 'status': 'uncited'}, 'AUD-612-I': {'commit': '', 'status': 'uncited'}, 'AUD-612-K': {'commit': '', 'status': 'uncited'}, 'AUD-612-M': {'commit': '', 'status': 'uncited'}, 'AUD-612-R': {'commit': '', 'status': 'uncited'}, 'AUD-613-ROOT': {'commit': '', 'status': 'uncited'}, 'AUD-614-07': {'commit': '', 'status': 'uncited'}, 'AUD-614-E': {'commit': '', 'status': 'uncited'}, 'AUD-614-F': {'commit': '', 'status': 'uncited'}, 'AUD-614-G': {'commit': '', 'status': 'uncited'}, 'AUD-614-I': {'commit': '', 'status': 'uncited'}, 'AUD-614-INTENT-TIE': {'commit': '', 'status': 'uncited'}, 'AUD-614-JUNIT4': {'commit': '', 'status': 'uncited'}, 'AUD-614-RISK-L0': {'commit': '', 'status': 'uncited'}, 'AUD-614-SELFTEST-TIMEOUT': {'commit': '', 'status': 'uncited'}, 'AUD-615-07': {'commit': '', 'status': 'uncited'}, 'AUD-615-COLD-COMPACT': {'commit': '', 'status': 'uncited'}, 'AUD-615-DRIFT': {'commit': '', 'status': 'uncited'}, 'AUD-615-E': {'commit': '', 'status': 'uncited'}, 'AUD-615-F': {'commit': '', 'status': 'uncited'}, 'AUD-615-INTENT-TIE': {'commit': '', 'status': 'uncited'}, 'AUD-615-JUNIT4': {'commit': '', 'status': 'uncited'}, 'AUD-615-RISK-L0': {'commit': '', 'status': 'uncited'}, 'AUD-615-SELFTEST-TIMEOUT': {'commit': '', 'status': 'uncited'}, 'AUD-616-E-PROV': {'commit': '', 'status': 'uncited'}, 'AUD-616-F, -RISK-L0, -SELFTEST-TIMEOUT, -INTENT-TIE, -DRIFT, -COLD-COMPACT, -E, -07': {'commit': '', 'status': 'uncited'}, 'AUD-616-INTENT-TIE-COV': {'commit': '', 'status': 'uncited'}, 'AUD-616-JUNIT4-SELF': {'commit': '', 'status': 'uncited'}, 'AUD-616-KOTLIN': {'commit': '', 'status': 'uncited'}, 'AUD-616-O': {'commit': '', 'status': 'uncited'}, 'AUD-616-P': {'commit': '', 'status': 'uncited'}, 'Window': {'commit': '', 'status': 'uncited'}, '`ASK-FIELD-01`': {'commit': '829f9fa', 'status': 'present'}, '`ASK-FIELD-02`': {'commit': '6a659fa', 'status': 'present'}, '`ASK-FIELD-03`': {'commit': '55b0d51', 'status': 'present'}, '`AUD-588-F05`': {'commit': '470e4a4', 'status': 'present'}, '`AUD-590-B01` / `B-01`, `F-01`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B02` / `B-02`, `F-02`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B03` / `B-03`, `F-03`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B04` / `B-04`, `F-04`': {'commit': '', 'status': 'uncited'}, '`AUD-590-R01` / `R-01`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A01` / `A-1`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A02` / `A-2`, `A-4`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A03` / `A-3`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A05` / `A-5`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A06` / `A-6`, `A-7`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A08` / `A-8`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A09` / `A-9`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A10` / `A-10`': {'commit': '', 'status': 'uncited'}, '`AUD-592-A02` / `A-1` second half, `§12.5`': {'commit': '63f3d61', 'status': 'present'}, '`AUD-592-B01` / `B-8`': {'commit': '8329614', 'status': 'present'}, '`AUD-592-D01` / `D-1`': {'commit': '0f8e03f', 'status': 'present'}, '`AUD-592-D02` / `D-2`': {'commit': '1d3db4d', 'status': 'present'}, '`AUD-592-D03` / `D-3`': {'commit': 'f28fe40', 'status': 'present'}, '`AUD-592-R01` / `A-1`': {'commit': '216025f', 'status': 'present'}, '`AUD-592-R02` / `N-4`, reopens `AUD-513-N04`': {'commit': 'ec3050d', 'status': 'present'}, '`AUD-593-N01` / `N-01`': {'commit': 'dd6a706', 'status': 'present'}, '`AUD-593-N02` / `N-02`': {'commit': 'f539787', 'status': 'present'}, '`AUD-593-N03` / `N-03`': {'commit': '1dd0b1c', 'status': 'present'}, '`AUD-593-N05` / `N-05`': {'commit': 'aa89388', 'status': 'present'}, '`AUD-593-N06` / `N-06`': {'commit': 'aa584a6', 'status': 'present'}, '`AUD-594-N04` / `D-5`, disclosure half of `B-3`': {'commit': 'a0060b7', 'status': 'present'}, '`AUD-594-X01` / `A-1`, residual of `AUD-593-N03`': {'commit': 'dd222b9', 'status': 'present'}, '`AUD-594-X02` / `A-1` second half': {'commit': '1193937', 'status': 'present'}, '`AUD-594-X03` / `X-03`, residual of `AUD-593-N01`': {'commit': 'e89e8f0', 'status': 'present'}, '`AUD-594-X04`': {'commit': '05b8cc9', 'status': 'present'}, '`AUD-595-A02` / `N-5`, advisory half of `AUD-588-B11`': {'commit': '3e15227', 'status': 'present'}, '`AUD-595-A03` / `B-6` exit-code half': {'commit': 'ab7285f', 'status': 'present'}, '`AUD-595-A05`': {'commit': 'e0b3d10', 'status': 'present'}, '`AUD-595-A07`, narrow half of `AUD-592-A02`': {'commit': 'cc15177', 'status': 'present'}, '`AUD-595-B01` / §B': {'commit': 'b77a1ad', 'status': 'present'}, '`AUD-595-Q01`': {'commit': '91a6566', 'status': 'present'}, '`AUD-596-A01` / `ASK-DET-001`': {'commit': 'fa508b4', 'status': 'present'}, '`AUD-596-A02` / `ASK-SELF-001`': {'commit': '4dfadc8', 'status': 'present'}, '`AUD-596-A03` / `ASK-C1-001`': {'commit': 'bffa3a6', 'status': 'present'}, '`AUD-596-A04` / `ASK-UX-003` + `ASK-UX-004`': {'commit': 'f0aac3c', 'status': 'present'}, '`AUD-596-B01` / `B-01`, harder witness for `BUG-6`': {'commit': '567d09d', 'status': 'present'}, '`AUD-596-B02` / `B-02`, class residual of `R2`': {'commit': '', 'status': 'uncited'}, '`AUD-596-B03` / `B-03`': {'commit': 'a8cb814', 'status': 'present'}, '`AUD-596-B06` / `B-06`': {'commit': '8107927', 'status': 'present'}, '`AUD-596-B07` / `B-07`, class residual of `AUD-592-R02`': {'commit': 'e060485', 'status': 'present'}, '`AUD-596-B09` / `B-09`': {'commit': '5b8146c', 'status': 'present'}, '`AUD-596-B10` / `B-10`': {'commit': '5cb994d', 'status': 'present'}, '`AUD-596-B16` / `B-16`': {'commit': '1507f69', 'status': 'present'}, '`AUD-596-D01` / `B-13` + `B-14`': {'commit': '0b1bdf0', 'status': 'present'}, '`AUD-596-D02` / `B-08`, residual of `AUD-594-N04`': {'commit': 'e7f73c3', 'status': 'present'}, '`AUD-596-D03` / `ASK-AGT-001`': {'commit': '8c46967', 'status': 'present'}, '`AUD-596-D04` / `B-18`': {'commit': '040f027', 'status': 'present'}, '`AUD-596-D05` / `B-19`': {'commit': 'fd2bf68', 'status': 'present'}, '`AUD-596-D06` / `B-20`': {'commit': '784cd83', 'status': 'present'}, '`AUD-596-D07` / `B-17`, half refuted': {'commit': 'c3ff822', 'status': 'present'}, '`AUD-596-D08` / `B-22`, class residual of `AUD-591-A06`': {'commit': 'b396c6a', 'status': 'present'}, '`AUD-596-D09` / `B-23`, surviving half of `B26`': {'commit': 'fd3d63f', 'status': 'present'}, '`AUD-596-D10` / `B-29`': {'commit': '', 'status': 'uncited'}, '`AUD-596-D11` / `ASK-UX-005`': {'commit': 'f4b4f77', 'status': 'present'}, '`AUD-596-D12` — six hints that send the reader back to the error': {'commit': '498df44', 'status': 'present'}, '`AUD-596-D13` / `B-28`': {'commit': '1014c72', 'status': 'present'}, '`AUD-596-D14` / `B-15`, narrow half of `B20`': {'commit': '10f2827', 'status': 'present'}, '`AUD-596-R01` / `B-05`': {'commit': '', 'status': 'uncited'}, '`AUD-596-X01` / `ASK-GATE-001`, gating half of `B24`': {'commit': 'e59c655', 'status': 'present'}, '`AUD-596-X02` / `ASK-UX-001` + `ASK-UX-002` + `B-21`': {'commit': 'f6ebf50', 'status': 'present'}, '`AUD-597-A01` / `ASK-UX-001` + `N-01`': {'commit': 'f8cf061', 'status': 'present'}, '`AUD-597-A02` / `ASK-UX-008` + `ASK-DOC-002`': {'commit': '9d47a4c', 'status': 'present'}, '`AUD-597-A03` / `ASK-DET-001`': {'commit': '4c7622a', 'status': 'present'}, '`AUD-597-A04` / `ASK-LEDGER-001`': {'commit': '46fb870', 'status': 'present'}, '`AUD-597-D01` / `B-04`': {'commit': '1094e6a', 'status': 'present'}, '`AUD-597-D02` / `ASK-DOC-001`': {'commit': 'ecb1bb7', 'status': 'present'}, '`AUD-597-D03` / `N-06`': {'commit': '9784333', 'status': 'present'}, '`AUD-597-D04` / `N-05`': {'commit': 'e51c087', 'status': 'present'}, '`AUD-597-D05` / `N-04`, fourth appearance of `C4-27`': {'commit': '9cccc15', 'status': 'present'}, '`AUD-597-D06` / `ASK-CLI-001`': {'commit': '178aa6d', 'status': 'present'}, '`AUD-597-D07` / `N-03`': {'commit': '9245e35', 'status': 'present'}, '`AUD-597-R01` / `ASK-PERF-001`': {'commit': '6910054', 'status': 'present'}, '`AUD-597-R02` / `ASK-ENC-001`': {'commit': 'ce6dac1', 'status': 'present'}, '`AUD-597-R03` / `ASK-UX-002`': {'commit': 'c57e50b', 'status': 'present'}, '`AUD-597-X01` / `ASK-BUILD-001` + `ASK-META-001` / `B-12`': {'commit': '354338b', 'status': 'present'}, '`AUD-598-B01` / `ASK-META-001`': {'commit': 'b2f7c65', 'status': 'present'}, '`AUD-598-B02` / `ASK-UX-002`': {'commit': '56a4bf7', 'status': 'present'}, '`AUD-598-B03` / `B-11`': {'commit': 'c63cb24', 'status': 'present'}, '`AUD-598-B04` / `N-02`': {'commit': '187937f', 'status': 'present'}, '`AUD-598-R01` / `ASK-PERF-002`': {'commit': '', 'status': 'uncited'}, '`AUD-598-X01` / `N-01` + `B-13` + `B-14` + `B-29` + `N-06`': {'commit': '6f2f5a4', 'status': 'present'}, '`AUD-600-B01` / `P-01`': {'commit': '366ffed', 'status': 'present'}, '`AUD-600-B02` / `P-02` + `ASK-PACK-002`': {'commit': '2a814c3', 'status': 'present'}, '`AUD-600-B03` / `ASK-PACK-001`': {'commit': '452f2a0', 'status': 'present'}, '`AUD-600-D01`': {'commit': '1224e1b', 'status': 'present'}, '`AUD-600-D02`': {'commit': 'eab8172', 'status': 'present'}, '`AUD-600-R01` / `R-01`': {'commit': '88add64', 'status': 'present'}, '`AUD-601-B01` / `N-02`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-B02` / `ASK-PACK-004`': {'commit': '', 'status': 'uncited'}, '`AUD-601-D01` / `N-01`, `ASK-UX-001`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-D02` / `B-13`, `B-14`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-M01` / `B-26`, `B-27` retracted': {'commit': '', 'status': 'uncited'}, '`AUD-601-R01` / `R-02`': {'commit': '', 'status': 'uncited'}, '`AUD-619-WATCH`': {'commit': '', 'status': 'uncited'}, '`AUD-620-COMMAND-SURFACE`': {'commit': '', 'status': 'uncited'}, '`AUD-620-REVIEW-PR`': {'commit': '', 'status': 'uncited'}, '`AUD-621-REVIEW-PR`': {'commit': '', 'status': 'uncited'}, '`B-3`': {'commit': '773268d', 'status': 'present'}, '`B-6`': {'commit': '17c6e06', 'status': 'present'}, '`B-8`': {'commit': '8329614', 'status': 'present'}, '`BUG-3` / `443b345`': {'commit': '', 'status': 'uncited'}, '`BUG-4a` / `AUD-588-B11` residual': {'commit': '24b4185', 'status': 'present'}, '`BUG-4b` / `AUD-588-B11` residual': {'commit': '0376350', 'status': 'present'}, '`E-39`, class residual of `AUD-593-N06`': {'commit': '25fc11f', 'status': 'present'}, '`N-5`': {'commit': 'c68083f', 'status': 'present'}, '`N-7`': {'commit': '082e9de', 'status': 'present'}, '`R-1`': {'commit': '424fb1c', 'status': 'present'}, '`R-2`': {'commit': '5158b92', 'status': 'present'}, '`R-3`': {'commit': '88aec04', 'status': 'present'}, '`R-4`': {'commit': '04fd04f', 'status': 'present'}}
|
|
5
|
-
CLOSURE_COVERAGE = {'closed_rows':
|
|
3
|
+
BUILD_COMMIT = 'd28b0cc19426b100d47381ab842d291860c6c3a2'
|
|
4
|
+
CLOSURE_PROVENANCE = {'AUD-611-B05': {'commit': '', 'status': 'uncited'}, 'AUD-611-B06': {'commit': '', 'status': 'uncited'}, 'AUD-611-B07': {'commit': '', 'status': 'uncited'}, 'AUD-611-B08': {'commit': '', 'status': 'uncited'}, 'AUD-611-B09': {'commit': '', 'status': 'uncited'}, 'AUD-611-B10': {'commit': '', 'status': 'uncited'}, 'AUD-611-B11': {'commit': '', 'status': 'uncited'}, 'AUD-612-07': {'commit': '', 'status': 'uncited'}, 'AUD-612-09': {'commit': '', 'status': 'uncited'}, 'AUD-612-14': {'commit': '', 'status': 'uncited'}, 'AUD-612-B03': {'commit': '', 'status': 'uncited'}, 'AUD-612-B07': {'commit': '', 'status': 'uncited'}, 'AUD-612-B13': {'commit': '', 'status': 'uncited'}, 'AUD-612-E': {'commit': '', 'status': 'uncited'}, 'AUD-612-G': {'commit': '', 'status': 'uncited'}, 'AUD-612-I': {'commit': '', 'status': 'uncited'}, 'AUD-612-K': {'commit': '', 'status': 'uncited'}, 'AUD-612-M': {'commit': '', 'status': 'uncited'}, 'AUD-612-R': {'commit': '', 'status': 'uncited'}, 'AUD-613-ROOT': {'commit': '', 'status': 'uncited'}, 'AUD-614-07': {'commit': '', 'status': 'uncited'}, 'AUD-614-E': {'commit': '', 'status': 'uncited'}, 'AUD-614-F': {'commit': '', 'status': 'uncited'}, 'AUD-614-G': {'commit': '', 'status': 'uncited'}, 'AUD-614-I': {'commit': '', 'status': 'uncited'}, 'AUD-614-INTENT-TIE': {'commit': '', 'status': 'uncited'}, 'AUD-614-JUNIT4': {'commit': '', 'status': 'uncited'}, 'AUD-614-RISK-L0': {'commit': '', 'status': 'uncited'}, 'AUD-614-SELFTEST-TIMEOUT': {'commit': '', 'status': 'uncited'}, 'AUD-615-07': {'commit': '', 'status': 'uncited'}, 'AUD-615-COLD-COMPACT': {'commit': '', 'status': 'uncited'}, 'AUD-615-DRIFT': {'commit': '', 'status': 'uncited'}, 'AUD-615-E': {'commit': '', 'status': 'uncited'}, 'AUD-615-F': {'commit': '', 'status': 'uncited'}, 'AUD-615-INTENT-TIE': {'commit': '', 'status': 'uncited'}, 'AUD-615-JUNIT4': {'commit': '', 'status': 'uncited'}, 'AUD-615-RISK-L0': {'commit': '', 'status': 'uncited'}, 'AUD-615-SELFTEST-TIMEOUT': {'commit': '', 'status': 'uncited'}, 'AUD-616-E-PROV': {'commit': '', 'status': 'uncited'}, 'AUD-616-F, -RISK-L0, -SELFTEST-TIMEOUT, -INTENT-TIE, -DRIFT, -COLD-COMPACT, -E, -07': {'commit': '', 'status': 'uncited'}, 'AUD-616-INTENT-TIE-COV': {'commit': '', 'status': 'uncited'}, 'AUD-616-JUNIT4-SELF': {'commit': '', 'status': 'uncited'}, 'AUD-616-KOTLIN': {'commit': '', 'status': 'uncited'}, 'AUD-616-O': {'commit': '', 'status': 'uncited'}, 'AUD-616-P': {'commit': '', 'status': 'uncited'}, 'Window': {'commit': '', 'status': 'uncited'}, '`ASK-FIELD-01`': {'commit': '829f9fa', 'status': 'present'}, '`ASK-FIELD-02`': {'commit': '6a659fa', 'status': 'present'}, '`ASK-FIELD-03`': {'commit': '55b0d51', 'status': 'present'}, '`AUD-588-F05`': {'commit': '470e4a4', 'status': 'present'}, '`AUD-590-B01` / `B-01`, `F-01`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B02` / `B-02`, `F-02`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B03` / `B-03`, `F-03`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B04` / `B-04`, `F-04`': {'commit': '', 'status': 'uncited'}, '`AUD-590-R01` / `R-01`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A01` / `A-1`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A02` / `A-2`, `A-4`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A03` / `A-3`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A05` / `A-5`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A06` / `A-6`, `A-7`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A08` / `A-8`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A09` / `A-9`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A10` / `A-10`': {'commit': '', 'status': 'uncited'}, '`AUD-592-A02` / `A-1` second half, `§12.5`': {'commit': '63f3d61', 'status': 'present'}, '`AUD-592-B01` / `B-8`': {'commit': '8329614', 'status': 'present'}, '`AUD-592-D01` / `D-1`': {'commit': '0f8e03f', 'status': 'present'}, '`AUD-592-D02` / `D-2`': {'commit': '1d3db4d', 'status': 'present'}, '`AUD-592-D03` / `D-3`': {'commit': 'f28fe40', 'status': 'present'}, '`AUD-592-R01` / `A-1`': {'commit': '216025f', 'status': 'present'}, '`AUD-592-R02` / `N-4`, reopens `AUD-513-N04`': {'commit': 'ec3050d', 'status': 'present'}, '`AUD-593-N01` / `N-01`': {'commit': 'dd6a706', 'status': 'present'}, '`AUD-593-N02` / `N-02`': {'commit': 'f539787', 'status': 'present'}, '`AUD-593-N03` / `N-03`': {'commit': '1dd0b1c', 'status': 'present'}, '`AUD-593-N05` / `N-05`': {'commit': 'aa89388', 'status': 'present'}, '`AUD-593-N06` / `N-06`': {'commit': 'aa584a6', 'status': 'present'}, '`AUD-594-N04` / `D-5`, disclosure half of `B-3`': {'commit': 'a0060b7', 'status': 'present'}, '`AUD-594-X01` / `A-1`, residual of `AUD-593-N03`': {'commit': 'dd222b9', 'status': 'present'}, '`AUD-594-X02` / `A-1` second half': {'commit': '1193937', 'status': 'present'}, '`AUD-594-X03` / `X-03`, residual of `AUD-593-N01`': {'commit': 'e89e8f0', 'status': 'present'}, '`AUD-594-X04`': {'commit': '05b8cc9', 'status': 'present'}, '`AUD-595-A02` / `N-5`, advisory half of `AUD-588-B11`': {'commit': '3e15227', 'status': 'present'}, '`AUD-595-A03` / `B-6` exit-code half': {'commit': 'ab7285f', 'status': 'present'}, '`AUD-595-A05`': {'commit': 'e0b3d10', 'status': 'present'}, '`AUD-595-A07`, narrow half of `AUD-592-A02`': {'commit': 'cc15177', 'status': 'present'}, '`AUD-595-B01` / §B': {'commit': 'b77a1ad', 'status': 'present'}, '`AUD-595-Q01`': {'commit': '91a6566', 'status': 'present'}, '`AUD-596-A01` / `ASK-DET-001`': {'commit': 'fa508b4', 'status': 'present'}, '`AUD-596-A02` / `ASK-SELF-001`': {'commit': '4dfadc8', 'status': 'present'}, '`AUD-596-A03` / `ASK-C1-001`': {'commit': 'bffa3a6', 'status': 'present'}, '`AUD-596-A04` / `ASK-UX-003` + `ASK-UX-004`': {'commit': 'f0aac3c', 'status': 'present'}, '`AUD-596-B01` / `B-01`, harder witness for `BUG-6`': {'commit': '567d09d', 'status': 'present'}, '`AUD-596-B02` / `B-02`, class residual of `R2`': {'commit': '', 'status': 'uncited'}, '`AUD-596-B03` / `B-03`': {'commit': 'a8cb814', 'status': 'present'}, '`AUD-596-B06` / `B-06`': {'commit': '8107927', 'status': 'present'}, '`AUD-596-B07` / `B-07`, class residual of `AUD-592-R02`': {'commit': 'e060485', 'status': 'present'}, '`AUD-596-B09` / `B-09`': {'commit': '5b8146c', 'status': 'present'}, '`AUD-596-B10` / `B-10`': {'commit': '5cb994d', 'status': 'present'}, '`AUD-596-B16` / `B-16`': {'commit': '1507f69', 'status': 'present'}, '`AUD-596-D01` / `B-13` + `B-14`': {'commit': '0b1bdf0', 'status': 'present'}, '`AUD-596-D02` / `B-08`, residual of `AUD-594-N04`': {'commit': 'e7f73c3', 'status': 'present'}, '`AUD-596-D03` / `ASK-AGT-001`': {'commit': '8c46967', 'status': 'present'}, '`AUD-596-D04` / `B-18`': {'commit': '040f027', 'status': 'present'}, '`AUD-596-D05` / `B-19`': {'commit': 'fd2bf68', 'status': 'present'}, '`AUD-596-D06` / `B-20`': {'commit': '784cd83', 'status': 'present'}, '`AUD-596-D07` / `B-17`, half refuted': {'commit': 'c3ff822', 'status': 'present'}, '`AUD-596-D08` / `B-22`, class residual of `AUD-591-A06`': {'commit': 'b396c6a', 'status': 'present'}, '`AUD-596-D09` / `B-23`, surviving half of `B26`': {'commit': 'fd3d63f', 'status': 'present'}, '`AUD-596-D10` / `B-29`': {'commit': '', 'status': 'uncited'}, '`AUD-596-D11` / `ASK-UX-005`': {'commit': 'f4b4f77', 'status': 'present'}, '`AUD-596-D12` — six hints that send the reader back to the error': {'commit': '498df44', 'status': 'present'}, '`AUD-596-D13` / `B-28`': {'commit': '1014c72', 'status': 'present'}, '`AUD-596-D14` / `B-15`, narrow half of `B20`': {'commit': '10f2827', 'status': 'present'}, '`AUD-596-R01` / `B-05`': {'commit': '', 'status': 'uncited'}, '`AUD-596-X01` / `ASK-GATE-001`, gating half of `B24`': {'commit': 'e59c655', 'status': 'present'}, '`AUD-596-X02` / `ASK-UX-001` + `ASK-UX-002` + `B-21`': {'commit': 'f6ebf50', 'status': 'present'}, '`AUD-597-A01` / `ASK-UX-001` + `N-01`': {'commit': 'f8cf061', 'status': 'present'}, '`AUD-597-A02` / `ASK-UX-008` + `ASK-DOC-002`': {'commit': '9d47a4c', 'status': 'present'}, '`AUD-597-A03` / `ASK-DET-001`': {'commit': '4c7622a', 'status': 'present'}, '`AUD-597-A04` / `ASK-LEDGER-001`': {'commit': '46fb870', 'status': 'present'}, '`AUD-597-D01` / `B-04`': {'commit': '1094e6a', 'status': 'present'}, '`AUD-597-D02` / `ASK-DOC-001`': {'commit': 'ecb1bb7', 'status': 'present'}, '`AUD-597-D03` / `N-06`': {'commit': '9784333', 'status': 'present'}, '`AUD-597-D04` / `N-05`': {'commit': 'e51c087', 'status': 'present'}, '`AUD-597-D05` / `N-04`, fourth appearance of `C4-27`': {'commit': '9cccc15', 'status': 'present'}, '`AUD-597-D06` / `ASK-CLI-001`': {'commit': '178aa6d', 'status': 'present'}, '`AUD-597-D07` / `N-03`': {'commit': '9245e35', 'status': 'present'}, '`AUD-597-R01` / `ASK-PERF-001`': {'commit': '6910054', 'status': 'present'}, '`AUD-597-R02` / `ASK-ENC-001`': {'commit': 'ce6dac1', 'status': 'present'}, '`AUD-597-R03` / `ASK-UX-002`': {'commit': 'c57e50b', 'status': 'present'}, '`AUD-597-X01` / `ASK-BUILD-001` + `ASK-META-001` / `B-12`': {'commit': '354338b', 'status': 'present'}, '`AUD-598-B01` / `ASK-META-001`': {'commit': 'b2f7c65', 'status': 'present'}, '`AUD-598-B02` / `ASK-UX-002`': {'commit': '56a4bf7', 'status': 'present'}, '`AUD-598-B03` / `B-11`': {'commit': 'c63cb24', 'status': 'present'}, '`AUD-598-B04` / `N-02`': {'commit': '187937f', 'status': 'present'}, '`AUD-598-R01` / `ASK-PERF-002`': {'commit': '', 'status': 'uncited'}, '`AUD-598-X01` / `N-01` + `B-13` + `B-14` + `B-29` + `N-06`': {'commit': '6f2f5a4', 'status': 'present'}, '`AUD-600-B01` / `P-01`': {'commit': '366ffed', 'status': 'present'}, '`AUD-600-B02` / `P-02` + `ASK-PACK-002`': {'commit': '2a814c3', 'status': 'present'}, '`AUD-600-B03` / `ASK-PACK-001`': {'commit': '452f2a0', 'status': 'present'}, '`AUD-600-D01`': {'commit': '1224e1b', 'status': 'present'}, '`AUD-600-D02`': {'commit': 'eab8172', 'status': 'present'}, '`AUD-600-R01` / `R-01`': {'commit': '88add64', 'status': 'present'}, '`AUD-601-B01` / `N-02`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-B02` / `ASK-PACK-004`': {'commit': '', 'status': 'uncited'}, '`AUD-601-D01` / `N-01`, `ASK-UX-001`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-D02` / `B-13`, `B-14`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-M01` / `B-26`, `B-27` retracted': {'commit': '', 'status': 'uncited'}, '`AUD-601-R01` / `R-02`': {'commit': '', 'status': 'uncited'}, '`AUD-619-WATCH`': {'commit': '', 'status': 'uncited'}, '`AUD-620-COMMAND-SURFACE`': {'commit': '', 'status': 'uncited'}, '`AUD-620-REVIEW-PR`': {'commit': '', 'status': 'uncited'}, '`AUD-621-REVIEW-PR`': {'commit': '', 'status': 'uncited'}, '`B-3`': {'commit': '773268d', 'status': 'present'}, '`B-6`': {'commit': '17c6e06', 'status': 'present'}, '`B-8`': {'commit': '8329614', 'status': 'present'}, '`BUG-3` / `443b345`': {'commit': '', 'status': 'uncited'}, '`BUG-4a` / `AUD-588-B11` residual': {'commit': '24b4185', 'status': 'present'}, '`BUG-4b` / `AUD-588-B11` residual': {'commit': '0376350', 'status': 'present'}, '`E-39`, class residual of `AUD-593-N06`': {'commit': '25fc11f', 'status': 'present'}, '`N-5`': {'commit': 'c68083f', 'status': 'present'}, '`N-7`': {'commit': '082e9de', 'status': 'present'}, '`R-1`': {'commit': '424fb1c', 'status': 'present'}, '`R-2`': {'commit': '5158b92', 'status': 'present'}, '`R-3`': {'commit': '88aec04', 'status': 'present'}, '`R-4`': {'commit': '04fd04f', 'status': 'present'}, '`REG-04`': {'commit': '', 'status': 'uncited'}}
|
|
5
|
+
CLOSURE_COVERAGE = {'closed_rows': 166, 'present': 91, 'absent': 0, 'unresolved': 0, 'uncited': 75, 'unknown': 0}
|
|
@@ -14,22 +14,48 @@ Status values: `open` · `in-progress` · `closed <version>` · `by-design` (wit
|
|
|
14
14
|
The facts these rows are keyed to are published: `ask schema facts-v1` prints the registry
|
|
15
15
|
(authority, definition, consumers, parity test) that the release battery enforces.
|
|
16
16
|
|
|
17
|
-
## Current Synchronization — External Audit `5.9.
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
17
|
+
## Current Synchronization — Alternative External Audit `5.9.23`, carried into `5.9.25` (2026-09-01)
|
|
18
|
+
|
|
19
|
+
**Release gate: do not use 5.9.25 to gate unattended CI through the audit-command
|
|
20
|
+
family.** A native-Windows alternative audit of the 5.9.23 build measured 55
|
|
21
|
+
`rc=0`, zero-byte answers and eight timeouts in 84 runs. The failures include
|
|
22
|
+
`spring-audit`, `verify`, `risk`, Markdown `audit-report`, `migrate-check`, and
|
|
23
|
+
`migrate-apply`; the prior 3/47 observation was materially incomplete. The
|
|
24
|
+
cause remains unproven. A security-rules phase is a supported hypothesis, not a
|
|
25
|
+
closure claim. `exit 0` is valid only for a non-empty stdout answer or a verified
|
|
26
|
+
`--output` artifact; a missing phase result must be structured failure, never an
|
|
27
|
+
empty finding set.
|
|
28
|
+
|
|
29
|
+
Priority order is: `ALT-01` silent success and unkept output promises;
|
|
30
|
+
`ALT-02` budget/partial-result failure; `ALT-03` security-rules phase bisection;
|
|
31
|
+
`ALT-04` content-id instability; `ALT-05` contradictory migration totals;
|
|
32
|
+
`ALT-06` false-complete selftest; then remediation, context bounds and CLI
|
|
33
|
+
ergonomics. Full evidence: [`AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md`](AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md)
|
|
34
|
+
and [`AUDIT-2026-09-01-EXTERNAL-5.9.23.md`](AUDIT-2026-09-01-EXTERNAL-5.9.23.md).
|
|
23
35
|
|
|
24
36
|
| ID | Severity | Status | Evidence and required closure |
|
|
25
37
|
|---|---:|---|---|
|
|
26
|
-
| `
|
|
38
|
+
| `ALT-01` | Critical maximum | **fixed, pending native-Windows repetition** | `a7ad44b` hardens the required-answer and output-artifact guards: `exit 0` now requires delivered stdout or a verified requested artifact. Native 30-run repetition remains the release closure evidence. |
|
|
39
|
+
| `ALT-02` | Critical maximum | **fixed, bounded-phase follow-up** | `aab1e8b` propagates deadline checks into security posture and publishes omitted stages and partial coverage. A small-repository budget can still finish its coarse earlier phases before the deadline is observed; `ALT-03` owns reducing that phase granularity. |
|
|
40
|
+
| `ALT-03` | High | **open, investigation** | The security-rules phase is the common evidence-backed suspect: all affected audit flows consume security findings, security `retrieve` queries timed out, and `remediate` stalled in the same phase. Bisect the known working small subtree against the 3,342-file root; do not assert causality before reproducing it. |
|
|
41
|
+
| `ALT-04` | High | **fixed** | `36e3893` excludes every nested `*_time_ms` execution clock from `content_id`; parametric tests retain semantic-field sensitivity. |
|
|
42
|
+
| `ALT-05` | High | **fixed** | `b12c8f1` publishes `population_total` and `excluded_before_cap` beside the compact findings cap, reconciling it with the summary population. |
|
|
43
|
+
| `ALT-06` | High | **fixed** | `6d0889e` publishes structured limitations for failed, unrun and unknown ledger rows; `5620864` also makes generic task `gaps` invalidate envelope completeness. |
|
|
44
|
+
| `ALT-07` | Medium | **open** | `remediate` regressed from a 23.6-second answer to hangs beyond 400 seconds in `auditing for repairable findings`; it shares the `ALT-03` investigation until separated by evidence. |
|
|
45
|
+
| `ALT-08` | Medium | **fixed** | `15d77d2` publishes the effective per-task stdout budget and the full-artifact path; bounded output remains skipped only for explicit `--output` artifacts. |
|
|
46
|
+
| `NEW-01` | Critical maximum | **superseded by ALT-01** | The earlier 3/47 `risk` and Markdown `audit-report` observation undercounted the native-Windows audit-family failure. |
|
|
47
|
+
| `REG-02` | Critical | **open, regression** | The 1,536 MB default `--agent` ceiling rejects valid large repositories only after spending minutes; it is not published in successful default-agent metadata. Bound projection during construction, sample RSS periodically, and publish the effective ceiling. |
|
|
48
|
+
| `REG-03` | High | **open, regression** | Warm `spring-audit` was measured 2.1–3.8x slower despite a fully reused CIR. Attribute the warm pass before claiming cache benefit. |
|
|
49
|
+
| `REG-01` | High | **open, regression** | Root `ask --help` took 83–86 seconds in a workspace with nested repositories. Help must not perform unbounded repository/profile analysis. |
|
|
50
|
+
| `REG-04` | Medium | **closed 5.9.24** | `_meta.answer_bounds.capped` now aggregates nested cap contracts, so compact answers disclose rows omitted below nested payloads. Regression coverage includes nested dictionaries and lists. |
|
|
51
|
+
| `NEW-02` | High | **open** | Overloaded endpoint handlers can all inherit the final overload's `declaration_line`. Resolve by mapping annotation/signature or publish ambiguity. |
|
|
52
|
+
| `BUG-01` | Critical maximum | **open, P0** | A malformed Java file can disappear without a file-specific declaration. Publish parse failure/recovery in the answer bounds and preserve any affected endpoint gap. |
|
|
27
53
|
| `BUG-02` | Critical maximum | **open, P0** | Large `risk` ended `rc=127` with no output or structured failure. Add fail-fast resource/process handling and durable partial checkpoints. |
|
|
28
54
|
| `BUG-12` | Critical maximum | **open, P0** | Deep `--agent` output construction reaches multi-gigabyte RSS before a small answer. Bound projection while building. |
|
|
29
|
-
| `BUG-03` | High | **open, P1** |
|
|
55
|
+
| `BUG-03` | High | **open, P1** | Marginal Spring detection can overstate what a zero-finding result covers. Publish Spring footprint/coverage with the stack-fit claim. |
|
|
30
56
|
| `BUG-04` | High | **open, P1** | `selftest` publishes `complete=true` with five error rows. Derive bounds from actual results. |
|
|
31
57
|
| `BUG-05` | High | **open, P1** | Overloaded endpoint handlers can receive the wrong declaration line. Resolve by mapping annotation or publish ambiguity. |
|
|
32
|
-
| `BUG-07` |
|
|
58
|
+
| `BUG-07` | Closed 5.9.23, verification gap | Compact JVM inventory is bounded, but the audit notes no selftest row protects the correction. Add release-battery coverage before treating it as durable closure. |
|
|
33
59
|
| `BUG-10` | High | **open, P1** | Unsupported routing styles can produce empty coverage gaps. Publish detected-but-unmodeled routing gaps. |
|
|
34
60
|
| `BUG-11` | High | **open, P1** | Default `pack assessment` can fail on a small Spring repository. Use a bounded default or explicit full mode. |
|
|
35
61
|
| `BUG-13` | High | **open, P1** | Unscoped `selftest` starts over nested repositories after warning. Refuse and require an explicit path. |
|
sourcecode/_docs/USER_GUIDE.md
CHANGED
sourcecode/answer_bounds.py
CHANGED
|
@@ -88,6 +88,12 @@ def _summarise(value: Any) -> Any:
|
|
|
88
88
|
|
|
89
89
|
def _gaps(payload: "dict[str, Any]") -> "list[dict[str, Any]]":
|
|
90
90
|
found: "list[dict[str, Any]]" = []
|
|
91
|
+
# `prepare-context` and related task answers publish their unanswered
|
|
92
|
+
# analysis as a top-level list, rather than under the route-specific
|
|
93
|
+
# `coverage` block. It is still a declared gap in the answer.
|
|
94
|
+
for gap in _as_list(payload.get("gaps")):
|
|
95
|
+
if gap:
|
|
96
|
+
found.append({"field": "gaps", "what": _summarise(gap)})
|
|
91
97
|
coverage = payload.get("coverage")
|
|
92
98
|
if isinstance(coverage, dict):
|
|
93
99
|
for gap in _as_list(coverage.get("gaps")):
|
|
@@ -170,17 +176,24 @@ def _exclusions(payload: "dict[str, Any]") -> "list[dict[str, Any]]":
|
|
|
170
176
|
|
|
171
177
|
def _caps(payload: "dict[str, Any]") -> "list[dict[str, Any]]":
|
|
172
178
|
found: "list[dict[str, Any]]" = []
|
|
179
|
+
def walk(value: Any, prefix: str) -> None:
|
|
180
|
+
if isinstance(value, dict):
|
|
181
|
+
for key, child in value.items():
|
|
182
|
+
path = f"{prefix}{key}"
|
|
183
|
+
if key.endswith(_CAP_SUFFIX) and isinstance(child, dict):
|
|
184
|
+
omitted = child.get("omitted")
|
|
185
|
+
if omitted not in (None, 0):
|
|
186
|
+
found.append({"field": path, **{
|
|
187
|
+
axis: child[axis] for axis in ("total", "shown", "omitted")
|
|
188
|
+
if axis in child
|
|
189
|
+
}})
|
|
190
|
+
walk(child, f"{path}.")
|
|
191
|
+
elif isinstance(value, list):
|
|
192
|
+
for index, child in enumerate(value):
|
|
193
|
+
walk(child, f"{prefix}{index}.")
|
|
194
|
+
|
|
173
195
|
for prefix, block in _blocks(payload):
|
|
174
|
-
|
|
175
|
-
if not key.endswith(_CAP_SUFFIX) or not isinstance(value, dict):
|
|
176
|
-
continue
|
|
177
|
-
omitted = value.get("omitted")
|
|
178
|
-
if omitted in (None, 0):
|
|
179
|
-
continue
|
|
180
|
-
found.append({"field": f"{prefix}{key}", **{
|
|
181
|
-
axis: value[axis] for axis in ("total", "shown", "omitted")
|
|
182
|
-
if axis in value
|
|
183
|
-
}})
|
|
196
|
+
walk(block, prefix)
|
|
184
197
|
return found
|
|
185
198
|
|
|
186
199
|
|
sourcecode/cli.py
CHANGED
|
@@ -993,6 +993,9 @@ scope matches; `ask cache model` says exactly what a warm buys per command.
|
|
|
993
993
|
[dim cyan]→ ask activate <key>[/dim cyan]
|
|
994
994
|
"""
|
|
995
995
|
|
|
996
|
+
if not getattr(sys.stdout, "isatty", lambda: False)():
|
|
997
|
+
# Rich markup is useful interactively but corrupts piped help output.
|
|
998
|
+
return re.sub(r"\[/?(?:bold(?: green)?|dim(?: bold)?|yellow|cyan)\]", "", text)
|
|
996
999
|
return text
|
|
997
1000
|
|
|
998
1001
|
|
|
@@ -2997,6 +3000,19 @@ _OUTPUT_PROMISED: "Optional[str]" = None
|
|
|
2997
3000
|
_OUTPUT_DELIVERED: bool = False
|
|
2998
3001
|
_ANSWER_REQUIRED_BY: "Optional[str]" = None
|
|
2999
3002
|
|
|
3003
|
+
# ALT-01. These commands publish repository-analysis answers. A successful
|
|
3004
|
+
# process with neither stdout nor a verified output artifact is never valid.
|
|
3005
|
+
# Kept as one authority so the entry point can arm the guard before Click enters
|
|
3006
|
+
# a callback; a callback that returns early is the failure this protects.
|
|
3007
|
+
REQUIRED_ANSWER_COMMANDS: "frozenset[str]" = frozenset({
|
|
3008
|
+
"audit-report",
|
|
3009
|
+
"migrate-apply",
|
|
3010
|
+
"migrate-check",
|
|
3011
|
+
"risk",
|
|
3012
|
+
"spring-audit",
|
|
3013
|
+
"verify",
|
|
3014
|
+
})
|
|
3015
|
+
|
|
3000
3016
|
|
|
3001
3017
|
def _record_output_promise(argv: "list[str]") -> None:
|
|
3002
3018
|
"""Note that this invocation asked for a file, before anything is parsed.
|
|
@@ -3044,6 +3060,16 @@ def _require_answer_delivery(command: str) -> None:
|
|
|
3044
3060
|
_ANSWER_REQUIRED_BY = command
|
|
3045
3061
|
|
|
3046
3062
|
|
|
3063
|
+
def _require_answer_from_argv(argv: "list[str]") -> None:
|
|
3064
|
+
"""Arm the process guard before an affected command callback can return."""
|
|
3065
|
+
if any(token in ("--help", "-h", "--version") for token in argv):
|
|
3066
|
+
return
|
|
3067
|
+
for token in argv:
|
|
3068
|
+
if token in REQUIRED_ANSWER_COMMANDS:
|
|
3069
|
+
_require_answer_delivery(token)
|
|
3070
|
+
return
|
|
3071
|
+
|
|
3072
|
+
|
|
3047
3073
|
def _analysis_failed(command: str, phase: str, exc: Exception) -> NoReturn:
|
|
3048
3074
|
"""Fail a costly command with evidence instead of an empty successful exit.
|
|
3049
3075
|
|
|
@@ -3131,7 +3157,7 @@ def _unkept_output_promise() -> "Optional[str]":
|
|
|
3131
3157
|
the run wrote it by some route this module does not know about, and a
|
|
3132
3158
|
discard sink was never a promise of a file.
|
|
3133
3159
|
"""
|
|
3134
|
-
if
|
|
3160
|
+
if not _OUTPUT_PROMISED:
|
|
3135
3161
|
return None
|
|
3136
3162
|
try:
|
|
3137
3163
|
from sourcecode.output_sink import is_null_device
|
|
@@ -3140,7 +3166,9 @@ def _unkept_output_promise() -> "Optional[str]":
|
|
|
3140
3166
|
if is_null_device(path) or (path.is_file() and path.stat().st_size > 0):
|
|
3141
3167
|
return None
|
|
3142
3168
|
except Exception:
|
|
3143
|
-
|
|
3169
|
+
# A destination that cannot be inspected cannot prove delivery. This is
|
|
3170
|
+
# a release gate, so uncertainty fails closed with the promised path.
|
|
3171
|
+
return _OUTPUT_PROMISED
|
|
3144
3172
|
return _OUTPUT_PROMISED
|
|
3145
3173
|
|
|
3146
3174
|
|
|
@@ -4136,7 +4164,14 @@ def _jobs_option() -> Any:
|
|
|
4136
4164
|
capability that makes the rule pass parallel is F-AT, and no help text is a
|
|
4137
4165
|
substitute for it.
|
|
4138
4166
|
"""
|
|
4139
|
-
return typer.Option(
|
|
4167
|
+
return typer.Option(
|
|
4168
|
+
None,
|
|
4169
|
+
"--jobs",
|
|
4170
|
+
"-j",
|
|
4171
|
+
min=1,
|
|
4172
|
+
max=128,
|
|
4173
|
+
help=JOBS_OPTION_HELP + " Maximum accepted value: 128.",
|
|
4174
|
+
)
|
|
4140
4175
|
|
|
4141
4176
|
|
|
4142
4177
|
def _invoke_command(ctx: typer.Context, command: Any, **named: Any) -> Any:
|
|
@@ -8367,6 +8402,11 @@ def prepare_context_cmd(
|
|
|
8367
8402
|
|
|
8368
8403
|
# P0-1: Apply output budget per task — safety net for large repos.
|
|
8369
8404
|
_pc_budget = _prepare_context_budget(task)
|
|
8405
|
+
out["output_budget"] = {
|
|
8406
|
+
"stdout_max_bytes": _pc_budget,
|
|
8407
|
+
"applies_to": "stdout only",
|
|
8408
|
+
"full_output": "Use --output <file> to retain the complete artifact.",
|
|
8409
|
+
}
|
|
8370
8410
|
|
|
8371
8411
|
# Size-gated preview: on enterprise-scale monoliths free users get a capped
|
|
8372
8412
|
# preview (top-5 / lightweight) + upgrade note. Small/mid repos get the full
|
|
@@ -12708,6 +12748,7 @@ def spring_audit_cmd(
|
|
|
12708
12748
|
_phases_cut: list[str] = []
|
|
12709
12749
|
# C3-79: families the budget stopped *inside*, with how far each got.
|
|
12710
12750
|
_rules_partial: list[dict] = []
|
|
12751
|
+
_projection_stages_cut: list[str] = []
|
|
12711
12752
|
if scope in ("all", "tx"):
|
|
12712
12753
|
if _run.exhausted():
|
|
12713
12754
|
_stopped_early = _WHY_BUDGET
|
|
@@ -12752,7 +12793,11 @@ def spring_audit_cmd(
|
|
|
12752
12793
|
getattr(_sec_watch, "partially_run", []) or []
|
|
12753
12794
|
)
|
|
12754
12795
|
_rules_partial.extend(_partial_families)
|
|
12755
|
-
|
|
12796
|
+
_stage_cut = list(
|
|
12797
|
+
getattr(_sec_watch, "stages_not_run", []) or []
|
|
12798
|
+
)
|
|
12799
|
+
_projection_stages_cut.extend(_stage_cut)
|
|
12800
|
+
if _cut or _partial_families or _stage_cut:
|
|
12756
12801
|
_stopped_early = _WHY_BUDGET
|
|
12757
12802
|
_phases_cut.append("security_audit")
|
|
12758
12803
|
else:
|
|
@@ -12942,6 +12987,7 @@ def spring_audit_cmd(
|
|
|
12942
12987
|
rules_partially_run=_rules_partial,
|
|
12943
12988
|
rules_not_run=_rules_cut,
|
|
12944
12989
|
phases_stopped_inside=_phases_cut,
|
|
12990
|
+
composition_walks_not_run=_projection_stages_cut,
|
|
12945
12991
|
)
|
|
12946
12992
|
# AUD-595-A03: the declaration said what did not run and never
|
|
12947
12993
|
# what the process would do about it. Same rule as the exits
|
|
@@ -14719,6 +14765,7 @@ def migrate_apply_cmd(
|
|
|
14719
14765
|
and worktree. The resulting worktree is retained for review; ASK never commits
|
|
14720
14766
|
or merges the generated changes.
|
|
14721
14767
|
"""
|
|
14768
|
+
_require_answer_delivery("migrate-apply")
|
|
14722
14769
|
from sourcecode.migrate_check import run_migrate_check
|
|
14723
14770
|
from sourcecode.openrewrite_recipe import build_plan
|
|
14724
14771
|
from sourcecode.repository_ir import find_java_files
|
|
@@ -17325,6 +17372,10 @@ def _audit_population_for(root: "Path", *, progress: "Any" = None):
|
|
|
17325
17372
|
|
|
17326
17373
|
@app.command("remediation-report")
|
|
17327
17374
|
def remediation_report_cmd(
|
|
17375
|
+
path: Optional[Path] = typer.Argument(
|
|
17376
|
+
None,
|
|
17377
|
+
help="Optional repository path accepted for CLI consistency; the bundled ledger is used.",
|
|
17378
|
+
),
|
|
17328
17379
|
output_path: Optional[Path] = typer.Option(
|
|
17329
17380
|
None, "--output", "-o", help="Write output to a file instead of stdout.",
|
|
17330
17381
|
),
|
|
@@ -17332,6 +17383,7 @@ def remediation_report_cmd(
|
|
|
17332
17383
|
copy: bool = _copy_option(),
|
|
17333
17384
|
) -> None:
|
|
17334
17385
|
"""Publish a redacted remediation record for this ASK build."""
|
|
17386
|
+
del path
|
|
17335
17387
|
_enforce_format("remediation-report", format)
|
|
17336
17388
|
from sourcecode import bundled_docs
|
|
17337
17389
|
|
|
@@ -21557,6 +21609,7 @@ def main_entry() -> None:
|
|
|
21557
21609
|
# parser is about to read, so the guard at the end covers every command —
|
|
21558
21610
|
# including one that returns before it reaches its emit seam.
|
|
21559
21611
|
_record_output_promise(sys.argv[1:])
|
|
21612
|
+
_require_answer_from_argv(sys.argv[1:])
|
|
21560
21613
|
# ASK-09: give the output ceiling a way to resolve the running command that
|
|
21561
21614
|
# does not go through Click's thread-local context. Registered as a provider,
|
|
21562
21615
|
# so the Typer→Click conversion is only paid by a run that is actually over
|
sourcecode/envelope.py
CHANGED
|
@@ -295,7 +295,10 @@ def _stable_projection(value: "Any", volatile: "frozenset[str]") -> "Any":
|
|
|
295
295
|
return {
|
|
296
296
|
key: _stable_projection(value[key], volatile)
|
|
297
297
|
for key in sorted(value)
|
|
298
|
-
|
|
298
|
+
# Execution producers consistently publish elapsed clocks as
|
|
299
|
+
# `*_time_ms`, including command-specific names that cannot be
|
|
300
|
+
# exhaustively catalogued. Match the convention at every depth.
|
|
301
|
+
if key not in volatile and not key.endswith("_time_ms")
|
|
299
302
|
}
|
|
300
303
|
if isinstance(value, (list, tuple)):
|
|
301
304
|
return [_stable_projection(item, volatile) for item in value]
|
sourcecode/migrate_check.py
CHANGED
|
@@ -2618,6 +2618,15 @@ class MigrationReport:
|
|
|
2618
2618
|
compact, "findings", top_n,
|
|
2619
2619
|
key=lambda f: SEVERITY_ORDER.get(f.get("severity"), 3),
|
|
2620
2620
|
)
|
|
2621
|
+
findings_cap = compact.get("findings_cap")
|
|
2622
|
+
if isinstance(findings_cap, dict):
|
|
2623
|
+
# `summary.total_findings` covers all detected findings, whereas the
|
|
2624
|
+
# display population may exclude advisory hygiene by default.
|
|
2625
|
+
# Publish both counts at the cap boundary so consumers need not
|
|
2626
|
+
# infer the relationship from a separate floor block.
|
|
2627
|
+
population_total = int(full.get("summary", {}).get("total_findings", 0))
|
|
2628
|
+
findings_cap["population_total"] = population_total
|
|
2629
|
+
findings_cap["excluded_before_cap"] = population_total - findings_cap["total"]
|
|
2621
2630
|
# Keep invariant rule prose once; each finding carries only location and
|
|
2622
2631
|
# rule identity. Full prose remains available in the non-compact report.
|
|
2623
2632
|
_rule_catalog: dict[str, dict] = {}
|
sourcecode/release_info.py
CHANGED
|
@@ -27,7 +27,7 @@ from typing import Any, Optional
|
|
|
27
27
|
#: The date `__version__` was released, from that version's CHANGELOG entry.
|
|
28
28
|
#: `tests/test_release_info.py` fails the build if the two disagree, so this is
|
|
29
29
|
#: a copy of a fact rather than a second authority for it.
|
|
30
|
-
RELEASE_DATE = "2026-
|
|
30
|
+
RELEASE_DATE = "2026-09-01"
|
|
31
31
|
|
|
32
32
|
#: Releases per day, measured over the latest 30 CHANGELOG releases (the same
|
|
33
33
|
#: computation the test re-runs). The nine-day interval before 5.9.0 lowers
|
sourcecode/rule_pass.py
CHANGED
|
@@ -104,6 +104,9 @@ class RulePassProgress:
|
|
|
104
104
|
#: Families the budget cut *in flight*, with how far each one reached (C3-79).
|
|
105
105
|
#: A family in here is in neither of the two lists above, and deliberately so.
|
|
106
106
|
partially_run: "list[dict]" = field(default_factory=list)
|
|
107
|
+
#: Non-rule projection stages omitted after the deadline. Separate from rule
|
|
108
|
+
#: ids so coverage arithmetic never treats a projection as a rule family.
|
|
109
|
+
stages_not_run: "list[str]" = field(default_factory=list)
|
|
107
110
|
#: How often `tick` reads the clock: once per this many units. A budget is a
|
|
108
111
|
#: wall-clock bound, not a per-file one, and reading the clock 3 342 times to
|
|
109
112
|
#: honour a 420-second deadline is cost with no resolution to show for it.
|
|
@@ -124,6 +127,12 @@ class RulePassProgress:
|
|
|
124
127
|
if rule_id not in self.not_run:
|
|
125
128
|
self.not_run.append(rule_id)
|
|
126
129
|
|
|
130
|
+
def record_stages_not_run(self, stages: "list[str]") -> None:
|
|
131
|
+
"""Publish post-rule work skipped after the same deadline."""
|
|
132
|
+
for stage in stages:
|
|
133
|
+
if stage not in self.stages_not_run:
|
|
134
|
+
self.stages_not_run.append(stage)
|
|
135
|
+
|
|
127
136
|
def step(self, label: str) -> None:
|
|
128
137
|
"""Announce an uncounted stage inside the pass.
|
|
129
138
|
|
sourcecode/security_posture.py
CHANGED
|
@@ -819,6 +819,7 @@ def infer_security_posture(
|
|
|
819
819
|
root: Optional[Path] = None,
|
|
820
820
|
coverage_threshold: float = _DEFAULT_COVERAGE,
|
|
821
821
|
filter_surface: Optional[Any] = None,
|
|
822
|
+
stop_when: Optional[Any] = None,
|
|
822
823
|
) -> SecurityPostureResult:
|
|
823
824
|
"""Infer the repo's endpoint security posture (P1-A).
|
|
824
825
|
|
|
@@ -849,7 +850,9 @@ def infer_security_posture(
|
|
|
849
850
|
str(root) if root is not None else None,
|
|
850
851
|
coverage_threshold,
|
|
851
852
|
)
|
|
852
|
-
|
|
853
|
+
# A deadline-bound projection can be partial and is run-specific. It must
|
|
854
|
+
# never be served or retained as a complete posture in a later invocation.
|
|
855
|
+
_memoizable = filter_surface is None and _memo_key[0] and stop_when is None
|
|
853
856
|
if _memoizable and _memo_key in _POSTURE_MEMO:
|
|
854
857
|
return _POSTURE_MEMO[_memo_key]
|
|
855
858
|
|
|
@@ -919,6 +922,14 @@ def infer_security_posture(
|
|
|
919
922
|
except Exception:
|
|
920
923
|
degraded_identity = []
|
|
921
924
|
|
|
925
|
+
def _budget_spent() -> bool:
|
|
926
|
+
if stop_when is None:
|
|
927
|
+
return False
|
|
928
|
+
try:
|
|
929
|
+
return bool(stop_when())
|
|
930
|
+
except Exception:
|
|
931
|
+
return False
|
|
932
|
+
|
|
922
933
|
# (4) per-endpoint classification
|
|
923
934
|
handler_ann = _handler_annotation_index(cir)
|
|
924
935
|
verdicts: list[dict] = []
|
|
@@ -934,7 +945,13 @@ def infer_security_posture(
|
|
|
934
945
|
n_gated = 0 # carries the detected custom gate
|
|
935
946
|
n_standard_only = 0 # no custom gate, but a standard guard of its own
|
|
936
947
|
|
|
937
|
-
|
|
948
|
+
_budget_cut = _budget_spent()
|
|
949
|
+
for _endpoint_index, ep in enumerate(cir.endpoints, start=1):
|
|
950
|
+
if _budget_cut or (
|
|
951
|
+
_endpoint_index % 64 == 0 and _budget_spent()
|
|
952
|
+
):
|
|
953
|
+
_budget_cut = True
|
|
954
|
+
break
|
|
938
955
|
policy = ep.security.policy if ep.security is not None else "none_detected"
|
|
939
956
|
anns = handler_ann.get(ep.handler_symbol, set())
|
|
940
957
|
carries_gate = bool(anns & admitted_gate_names)
|
|
@@ -1021,11 +1038,20 @@ def infer_security_posture(
|
|
|
1021
1038
|
"This surface assumes the profile set it was run under — "
|
|
1022
1039
|
+ _profile_remedy.sentence(),
|
|
1023
1040
|
]
|
|
1041
|
+
if _budget_cut:
|
|
1042
|
+
population = dict(population)
|
|
1043
|
+
population["endpoints_evaluated"] = len(verdicts)
|
|
1044
|
+
population["analysis_complete"] = False
|
|
1045
|
+
limitations.append(
|
|
1046
|
+
"PARTIAL: the analysis budget stopped endpoint security-posture "
|
|
1047
|
+
f"classification after {len(verdicts)} of {len(cir.endpoints)} "
|
|
1048
|
+
"endpoints. Unlisted endpoints are unmeasured, never unprotected."
|
|
1049
|
+
)
|
|
1024
1050
|
operational_hints: list[str] = []
|
|
1025
1051
|
_how_to_run = _profile_remedy.to_dict(root).get("how_to_run_here")
|
|
1026
1052
|
if isinstance(_how_to_run, str) and _how_to_run:
|
|
1027
1053
|
operational_hints.append(_how_to_run)
|
|
1028
|
-
if has_custom_gate:
|
|
1054
|
+
if has_custom_gate and not _budget_cut:
|
|
1029
1055
|
limitations.append(
|
|
1030
1056
|
"A custom authorization mechanism was inferred — endpoints not carrying "
|
|
1031
1057
|
"it are reported 'coverage_unknown', never 'unsecured'."
|
|
@@ -1046,7 +1072,7 @@ def infer_security_posture(
|
|
|
1046
1072
|
# a centralized filter (if present) MAY still cover them — its per-URL patterns are
|
|
1047
1073
|
# not reconstructed in this increment, so the verdict is review, never "unsecured".
|
|
1048
1074
|
gate_coverage: Optional[dict] = None
|
|
1049
|
-
if has_custom_gate:
|
|
1075
|
+
if has_custom_gate and not _budget_cut:
|
|
1050
1076
|
# Reconstruct declarative servlet filter patterns (extractor; best-effort) and
|
|
1051
1077
|
# cross each escaping handler against them. A match => the handler MAY be filter-
|
|
1052
1078
|
# covered (still review — pattern presence is not proof of enforcement); no match
|
sourcecode/selftest.py
CHANGED
|
@@ -954,6 +954,25 @@ def run_selftest(
|
|
|
954
954
|
counts = {status: 0 for status in (PASS, FAIL, NOT_APPLICABLE, ERROR)}
|
|
955
955
|
for result in results:
|
|
956
956
|
counts[result["status"]] = counts.get(result["status"], 0) + 1
|
|
957
|
+
limitations: list[dict[str, Any]] = []
|
|
958
|
+
if counts[ERROR]:
|
|
959
|
+
limitations.append({
|
|
960
|
+
"id": "selftest_rows_not_run",
|
|
961
|
+
"reason": f"{counts[ERROR]} ledger row(s) could not run",
|
|
962
|
+
"count": counts[ERROR],
|
|
963
|
+
})
|
|
964
|
+
if counts[FAIL]:
|
|
965
|
+
limitations.append({
|
|
966
|
+
"id": "selftest_rows_failed",
|
|
967
|
+
"reason": f"{counts[FAIL]} ledger assertion(s) did not hold",
|
|
968
|
+
"count": counts[FAIL],
|
|
969
|
+
})
|
|
970
|
+
if unknown:
|
|
971
|
+
limitations.append({
|
|
972
|
+
"id": "selftest_unknown_rows",
|
|
973
|
+
"reason": "requested ledger rows do not exist",
|
|
974
|
+
"rows": unknown,
|
|
975
|
+
})
|
|
957
976
|
return {
|
|
958
977
|
"schema_version": SCHEMA_VERSION,
|
|
959
978
|
"subject": subject.as_payload(),
|
|
@@ -963,6 +982,7 @@ def run_selftest(
|
|
|
963
982
|
**counts,
|
|
964
983
|
"unknown_rows": unknown,
|
|
965
984
|
},
|
|
985
|
+
**({"limitations": limitations} if limitations else {}),
|
|
966
986
|
"basis": (
|
|
967
987
|
"Each row is the acceptance criterion its ledger entry publishes, run "
|
|
968
988
|
"against this repository through the entry point named above. A row "
|
|
@@ -1336,8 +1336,21 @@ def run_security_audit(
|
|
|
1336
1336
|
try:
|
|
1337
1337
|
from sourcecode.security_posture import infer_security_posture
|
|
1338
1338
|
|
|
1339
|
-
_posture = infer_security_posture(
|
|
1339
|
+
_posture = infer_security_posture(
|
|
1340
|
+
cir,
|
|
1341
|
+
root=root,
|
|
1342
|
+
stop_when=(progress.should_stop if progress is not None else None),
|
|
1343
|
+
)
|
|
1340
1344
|
security_posture = _posture.to_dict()
|
|
1345
|
+
if (
|
|
1346
|
+
progress is not None
|
|
1347
|
+
and _posture.population.get("analysis_complete") is False
|
|
1348
|
+
):
|
|
1349
|
+
progress.record_stages_not_run([
|
|
1350
|
+
"security_posture_remaining_endpoints",
|
|
1351
|
+
"security_profile_evidence",
|
|
1352
|
+
"security_source_spans",
|
|
1353
|
+
])
|
|
1341
1354
|
_gate_bearers = getattr(_posture, "_gate_bearing_handlers", set()) or set()
|
|
1342
1355
|
if _gate_bearers:
|
|
1343
1356
|
_before = len(findings)
|
|
@@ -1387,7 +1400,9 @@ def run_security_audit(
|
|
|
1387
1400
|
),
|
|
1388
1401
|
}
|
|
1389
1402
|
_permit_all_rules: list[dict[str, Any]] = []
|
|
1390
|
-
if root is not None
|
|
1403
|
+
if root is not None and not (
|
|
1404
|
+
progress is not None and progress.should_stop()
|
|
1405
|
+
):
|
|
1391
1406
|
try:
|
|
1392
1407
|
from sourcecode.spring_profiles import profile_population
|
|
1393
1408
|
from sourcecode.source_text import blank_java_comments
|
|
@@ -1437,6 +1452,7 @@ def run_security_audit(
|
|
|
1437
1452
|
# C3-79: a family the budget cut in flight is in neither list. Its findings are
|
|
1438
1453
|
# published (they were measured), and how far it got is published with them.
|
|
1439
1454
|
_rules_partial = list(getattr(progress, "partially_run", []) or [])
|
|
1455
|
+
_stages_not_run = list(getattr(progress, "stages_not_run", []) or [])
|
|
1440
1456
|
if _rules_partial:
|
|
1441
1457
|
_cut = ", ".join(
|
|
1442
1458
|
f"{'/'.join(entry['rule_ids'])} while {entry['stage_stopped_in']}, "
|
|
@@ -1460,13 +1476,22 @@ def run_security_audit(
|
|
|
1460
1476
|
"reported categorically (P1-A); raise ASK_MAX_ANALYSIS_SECONDS or "
|
|
1461
1477
|
"narrow the scope to complete the pass."
|
|
1462
1478
|
)
|
|
1463
|
-
|
|
1464
1479
|
# C2-4: same seam as the TX side — the line comes from the IR's SourceSpan
|
|
1465
1480
|
# index, so a finding says where to look without a second Read.
|
|
1466
1481
|
from sourcecode.spring_findings import resolve_first_lines
|
|
1467
1482
|
if progress is not None:
|
|
1468
1483
|
progress.step("resolving source spans")
|
|
1469
|
-
|
|
1484
|
+
if progress is None or not progress.should_stop():
|
|
1485
|
+
resolve_first_lines(findings, cir)
|
|
1486
|
+
else:
|
|
1487
|
+
progress.record_stages_not_run(["security_source_spans"])
|
|
1488
|
+
_stages_not_run = list(getattr(progress, "stages_not_run", []) or [])
|
|
1489
|
+
if _stages_not_run:
|
|
1490
|
+
_sec_limitations.append(
|
|
1491
|
+
"PARTIAL: the analysis budget omitted post-rule stages: "
|
|
1492
|
+
+ ", ".join(_stages_not_run)
|
|
1493
|
+
+ ". Their absence is a coverage gap, not a negative finding."
|
|
1494
|
+
)
|
|
1470
1495
|
|
|
1471
1496
|
from sourcecode.cache import repo_id as _cache_repo_id
|
|
1472
1497
|
|
|
@@ -1528,6 +1553,7 @@ def run_security_audit(
|
|
|
1528
1553
|
# and the mismatch took arithmetic across two releases to find. The
|
|
1529
1554
|
# counts make it visible in one glance.
|
|
1530
1555
|
"rules_partially_run": _rules_partial,
|
|
1556
|
+
"stages_not_run": _stages_not_run,
|
|
1531
1557
|
"rules_run_count": len(_rules_run),
|
|
1532
1558
|
"rules_total": (
|
|
1533
1559
|
len(_rules_run)
|
|
@@ -1538,6 +1564,6 @@ def run_security_audit(
|
|
|
1538
1564
|
security_posture=security_posture,
|
|
1539
1565
|
# C2-31: the scope knows it was cut; `finalize()` decides what a cut scope
|
|
1540
1566
|
# may claim (the confidence ceiling, the floor marks on the counts).
|
|
1541
|
-
partial=bool(_rules_not_run or _rules_partial),
|
|
1567
|
+
partial=bool(_rules_not_run or _rules_partial or _stages_not_run),
|
|
1542
1568
|
)
|
|
1543
1569
|
return result.finalize()
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.4
|
|
2
2
|
Name: sourcecode
|
|
3
|
-
Version: 5.9.
|
|
3
|
+
Version: 5.9.25
|
|
4
4
|
Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
|
|
5
5
|
Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
|
|
6
6
|
Project-URL: Repository, https://github.com/HarounDominique/sourcecode
|
|
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
|
|
|
59
59
|
> question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
|
|
60
60
|
> before inspecting a repository whose telemetry policy you need to control.
|
|
61
61
|
|
|
62
|
-

|
|
63
63
|

|
|
64
64
|
|
|
65
65
|
Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
|
|
@@ -212,13 +212,19 @@ exit 75 (`--allow-partial` accepts one deliberately). The long-run progress
|
|
|
212
212
|
message names the phase it is in and whether that phase has changed, so a slow run
|
|
213
213
|
is distinguishable from a blocked one.
|
|
214
214
|
|
|
215
|
-
**External audit boundary (2026-09-01).**
|
|
216
|
-
|
|
217
|
-
|
|
218
|
-
|
|
219
|
-
|
|
220
|
-
|
|
221
|
-
|
|
215
|
+
**External audit boundary (2026-09-01).** An alternative native-Windows audit
|
|
216
|
+
rates the 5.9.23 audit-command family **4.9/10**, versus 6.6 for 5.9.22. It
|
|
217
|
+
measured 55 zero-byte `exit 0` answers and eight timeouts in 84 runs across
|
|
218
|
+
`spring-audit`, `verify`, `risk`, Markdown `audit-report`, `migrate-check`, and
|
|
219
|
+
`migrate-apply`. The release must not be used to gate unattended CI through
|
|
220
|
+
those commands, nor should `ASK_MAX_ANALYSIS_SECONDS` be relied on as a recovery
|
|
221
|
+
path, until native repetition proves the global output and partial-result
|
|
222
|
+
invariants. The unaffected lightweight CI commands are useful evidence, but do
|
|
223
|
+
not close this release-wide reliability failure. Findings are tracked in the
|
|
224
|
+
[alternative audit](docs/AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md), the earlier
|
|
225
|
+
[external audit](docs/AUDIT-2026-09-01-EXTERNAL-5.9.23.md), and the
|
|
226
|
+
[defect ledger](docs/DEFECT-LEDGER.md); engineering-host measurements cannot
|
|
227
|
+
close native-Windows observations.
|
|
222
228
|
|
|
223
229
|
The current external audit still records two open availability limits, and they
|
|
224
230
|
are held open deliberately: `audit-report --format markdown` under contention, and
|
|
@@ -284,7 +290,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
|
|
|
284
290
|
# pip / pipx
|
|
285
291
|
pipx install sourcecode # or: pip install sourcecode
|
|
286
292
|
|
|
287
|
-
ask version # ask 5.9.
|
|
293
|
+
ask version # ask 5.9.25 — and, on a build that has aged,
|
|
288
294
|
# how many releases have probably shipped since
|
|
289
295
|
```
|
|
290
296
|
|
|
@@ -1,10 +1,10 @@
|
|
|
1
|
-
sourcecode/__init__.py,sha256=
|
|
1
|
+
sourcecode/__init__.py,sha256=MtlfIgDZzDrOnmDuTETquhbQ9yFiHFleLZ9oUJXeyhc,309
|
|
2
2
|
sourcecode/__main__.py,sha256=qDFVkobwsdZrX0B3stiRqsUNivVpybKO-egzAwCW4xw,165
|
|
3
|
-
sourcecode/_build_commit.py,sha256=
|
|
3
|
+
sourcecode/_build_commit.py,sha256=lOLiVZBzoZPQ5WEGzYe1auvTEGaaZpO4xh_-E6axm2s,11687
|
|
4
4
|
sourcecode/access_drift.py,sha256=uYD8ipiEAaTnkz0IhG6ujU_KI3LghdY-6ycurs-BZnc,9355
|
|
5
5
|
sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
|
|
6
6
|
sourcecode/analysis_budget.py,sha256=ZuNEboPF8A6GK-_V7WNt92ezgriga7_Rbr-vvSN4UEE,4183
|
|
7
|
-
sourcecode/answer_bounds.py,sha256=
|
|
7
|
+
sourcecode/answer_bounds.py,sha256=mZHTO41wgzq4o6jk1X4QuqOv788rE208AFDvcE0JUz4,11569
|
|
8
8
|
sourcecode/archetype.py,sha256=V_s5grgpbanrXb8qGEQb73W5Cg5iKW9FQHWKgg5KM8Y,41201
|
|
9
9
|
sourcecode/architectural_baseline.py,sha256=9ds-ZYw4dEJUKWZSdq_ufHq7d2AXnMbEHteSQlT7iu8,26468
|
|
10
10
|
sourcecode/architectural_delta.py,sha256=JhZVmA0gYUryt4x4ieVuxPbcvoBygHgADZaYJ_o4gdk,15142
|
|
@@ -35,7 +35,7 @@ sourcecode/change_plan.py,sha256=drAoDsqFplutCLc6Y0xue7sYkTls0SpYh7aOXvttv3I,129
|
|
|
35
35
|
sourcecode/ci_output.py,sha256=X4NRokWWMRF9Ex8OQrEO2g04GzJ00GDP5zYIoqI9YCc,4625
|
|
36
36
|
sourcecode/cir_graphs.py,sha256=RytqSv1WF8kdlfXj2fPQz16LY4akS2kyThbdWL8beCQ,14835
|
|
37
37
|
sourcecode/classifier.py,sha256=ft1RGPIChvO84q2QMrEH93x1J15AXNWMh26lnxvoRao,26476
|
|
38
|
-
sourcecode/cli.py,sha256=
|
|
38
|
+
sourcecode/cli.py,sha256=NVh5xaPvG4woswb_pM-O7EmpN6tmiQQyV7kscgARZYA,962254
|
|
39
39
|
sourcecode/click_runtime.py,sha256=K2cUdzFhbd6uEUpucWptXE89_z-ZNZGsqgd-34usUXk,1890
|
|
40
40
|
sourcecode/client_calls.py,sha256=YOPnfRZzRyqmdHvXSVeiunW8cuiuCuWXacNIQRgKMCw,22640
|
|
41
41
|
sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
|
|
@@ -71,7 +71,7 @@ sourcecode/endpoint_literals.py,sha256=Qf4gTZzvNSFDGDuOvF0YRL9NvaYKKj24klhR5LIOa
|
|
|
71
71
|
sourcecode/endpoint_metrics.py,sha256=sLSLUIgiIyvNdOynaxVgHd9SjRF_DbN3QxevaquykaU,2840
|
|
72
72
|
sourcecode/entrypoint_classifier.py,sha256=jhTYlyqDJH2AtdEcLVaRU3lYRTJuF8DkxVzl4-W3zWE,5322
|
|
73
73
|
sourcecode/env_analyzer.py,sha256=tU2CcW-Lkl__60DMd4ibYnXnxfmPbV5Z9GrToSWLdSA,22029
|
|
74
|
-
sourcecode/envelope.py,sha256=
|
|
74
|
+
sourcecode/envelope.py,sha256=ON1YoLpMPcr0rIvJVebUDCuFrb2SkPDPc1qL0lzdB_s,17683
|
|
75
75
|
sourcecode/environment_resolution.py,sha256=e86HT3RNbIIUIRChvz1Pu9Um81UvYu22BkpHNnwbUQI,30650
|
|
76
76
|
sourcecode/error_schema.py,sha256=DhxsIvpzAbEzluWFE4IWXYRyccECcJkq2mT2KJB5Tew,3485
|
|
77
77
|
sourcecode/evidence_provider.py,sha256=GSSL44JEaouO5AHks2sB3d1YvC9xIKIld1yBYxZpXxo,4277
|
|
@@ -102,7 +102,7 @@ sourcecode/license.py,sha256=eIEuIVQXywl_S9LOIACOEpJ4M5RyaPvWrqg_jSNOrXA,31088
|
|
|
102
102
|
sourcecode/manifest_cache.py,sha256=qoBn7hPeaMjLHi3higfxsjo7oS7noommRqDnpKP0Ya8,4124
|
|
103
103
|
sourcecode/mcp_nudge.py,sha256=beNjfyb7z09T1rnS4t6Q4qfbLzZQNaP6ddCA4XpmV0s,3256
|
|
104
104
|
sourcecode/metrics_analyzer.py,sha256=gLoRWKygF18jLgwsqmGXSWopw-f5iO1VbM7Jjdif6ag,22809
|
|
105
|
-
sourcecode/migrate_check.py,sha256=
|
|
105
|
+
sourcecode/migrate_check.py,sha256=jpxjQVruHkxGFIfTD4pnNZmBXKrJcZ6Q5nBtgkfRNmE,172846
|
|
106
106
|
sourcecode/migration_apply.py,sha256=36E9IUq7RbpGVt6RZ8PlSZKgDoEMHorZrXw6UVWPnpw,8692
|
|
107
107
|
sourcecode/migration_blast.py,sha256=OPryWkM6-PbvcG3eJFdcWUnlpXBje41nu2BkrZnE2hg,9359
|
|
108
108
|
sourcecode/non_coverage.py,sha256=0voxV7GdEZBaDHKDaw9RjHeb2qH-8ZdAUAOiu71vd8I,31508
|
|
@@ -140,7 +140,7 @@ sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
|
|
|
140
140
|
sourcecode/reference_facts.py,sha256=mx7H-Ax5y8sKAQHrnJCXlgjkUzqZtQTByv9Zy2lxKQQ,15500
|
|
141
141
|
sourcecode/regress.py,sha256=6rlFP2rsIzVKAA0spJ66To528GyBtnRI2Zg9vAGq8kQ,13264
|
|
142
142
|
sourcecode/regulatory_pack.py,sha256=xVWd8hYg6MjGfkFP8UWcYeLmNMxEk8k2uSbTcnGMbhg,3421
|
|
143
|
-
sourcecode/release_info.py,sha256=
|
|
143
|
+
sourcecode/release_info.py,sha256=deK17VdMaSvMYhwjpfotdnNyorDbhfRU0pZKks1NRgk,5918
|
|
144
144
|
sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
|
|
145
145
|
sourcecode/remediation_diff.py,sha256=fGYqPmQF7bO54L8ivztX5PgmW4fVu54gNcG6OEQ192U,9730
|
|
146
146
|
sourcecode/remediation_flow.py,sha256=OFlrNCD2dKw1WlX5cHqVl1yrQZHi2TjCThH8Q3X1PwI,10294
|
|
@@ -154,7 +154,7 @@ sourcecode/ris.py,sha256=HsLVHZfseEHNqMyxrj8SvrzUK7jE_85lsWjHtsEw9ik,29196
|
|
|
154
154
|
sourcecode/risk.py,sha256=rG7fqDIjyhtvB0Qje0d2ZEUl5kemMBwbuOJG8ZJxqrQ,102552
|
|
155
155
|
sourcecode/risk_model.py,sha256=RoC-G15qZP5BLEwwmcr4eJ0APgvIbh1WTqhTVT-5YFE,10895
|
|
156
156
|
sourcecode/rule_catalog.py,sha256=7lwyNe_sA7M9KtoKXVf9qQYBlo7VEPQ3IK1KiGSqTts,5408
|
|
157
|
-
sourcecode/rule_pass.py,sha256=
|
|
157
|
+
sourcecode/rule_pass.py,sha256=Z1UBe0y4WOokGVeOfn325jlphdEdarM_oGNQ9sHzcrY,15157
|
|
158
158
|
sourcecode/runs.py,sha256=o4oXkB3WFJGScbK_C10OAWzsE18B9Zc55u_IE8_yl4M,6291
|
|
159
159
|
sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
|
|
160
160
|
sourcecode/sarif.py,sha256=ceNHEy_VBd6s-5nzTQPzqOZOX8erilUZM4adc9FoIEk,26255
|
|
@@ -166,10 +166,10 @@ sourcecode/schema_registry.py,sha256=UYyHwtruOk6TThyf-SXw36n_qFZAOJF-IyuMulWrT6I
|
|
|
166
166
|
sourcecode/security_chain.py,sha256=1YZVeFLwy65kntMBhMNvz1cUpOoKCmvEqYICgxs66Gw,6823
|
|
167
167
|
sourcecode/security_config.py,sha256=LUppRDYQK0oKM4qdEOLObaeU3frFTS-paEZo7dMgtY8,5467
|
|
168
168
|
sourcecode/security_config_scan.py,sha256=LU8gfNUBB6wjKR8jkK-qRKtUrbkHZ301_Xsk6hSp4XU,35916
|
|
169
|
-
sourcecode/security_posture.py,sha256=
|
|
169
|
+
sourcecode/security_posture.py,sha256=FS3WYU9C2_KP4aO0SdkFZ808CMWIvKYyTMcCE9UaSWw,57984
|
|
170
170
|
sourcecode/selection_contract.py,sha256=O3q_zHBgUsp1SDukqmH9nOUO6HxLFH_7fAqVL7JMV_A,1974
|
|
171
171
|
sourcecode/self_audit.py,sha256=ZK6VZwbkTL66f4Q4U_JD6sdl6KjQ4DvtPcn5XqGcZDY,11541
|
|
172
|
-
sourcecode/selftest.py,sha256=
|
|
172
|
+
sourcecode/selftest.py,sha256=Ci7hF2khCxcw0pSVKMh7DlrYuutU9ojt31IWAsMzdlg,42461
|
|
173
173
|
sourcecode/semantic_analyzer.py,sha256=xGwQvhU9xeOlZ4N-TPXFZT8HBHx4Rg0nPwu8nDFl00Y,95621
|
|
174
174
|
sourcecode/semantic_impact_engine.py,sha256=t09IirGC3JjQDy33JZd1_WKzQVKXkoNl3-XEUr5kjis,20563
|
|
175
175
|
sourcecode/semantic_integration_engine.py,sha256=ZjyKJKOj-adScWlYBuWx8Ee_P0F4_OImUJVnCYgopuU,20952
|
|
@@ -183,7 +183,7 @@ sourcecode/spring_impact.py,sha256=7gcP4MJcRl8SF5UjYnZXsvtwvIollUtYXlUn08q-JMM,9
|
|
|
183
183
|
sourcecode/spring_model.py,sha256=MBUKR1tes5UVGxtYiv4J2WrydgOp_zReek7P7hO50hA,28962
|
|
184
184
|
sourcecode/spring_profiles.py,sha256=jDNBVhEZQAZXrpqt85FkP2URsMw4YWhQo3W3SLHuwpM,19617
|
|
185
185
|
sourcecode/spring_properties.py,sha256=kPTk5qAJxdbHc1hclhHAP0O-hCIzBn8PTh3lzl-I4a4,8400
|
|
186
|
-
sourcecode/spring_security_audit.py,sha256=
|
|
186
|
+
sourcecode/spring_security_audit.py,sha256=vRZ42fEWiCryOd-qRJKolYEFZnarlF5LCaUte-viYZo,74855
|
|
187
187
|
sourcecode/spring_semantic.py,sha256=zrUYWF7Gnz6hpP_3hRveHmGEntT95WpgXt6u7PzLSGg,16835
|
|
188
188
|
sourcecode/spring_tx_analyzer.py,sha256=cFK9M3madb7dKbJ_d97cO-1fGMUPDOwB8KoJ-oocMeY,50951
|
|
189
189
|
sourcecode/sql_taint.py,sha256=As1DbEdjXMBFjCTXU5ojksOzuKkP6LmnuMVnzzmckzc,26998
|
|
@@ -275,13 +275,13 @@ sourcecode/telemetry/consent.py,sha256=-Wb8BFGXEexOs8M0Eja7F-T6ZtLNPeRoZnHcHvlP7
|
|
|
275
275
|
sourcecode/telemetry/events.py,sha256=l3Z2SQUO4_C2D2ItXOOdVNimAmHedUHnUxqYFTxnsAE,2900
|
|
276
276
|
sourcecode/telemetry/filters.py,sha256=-lqT2oorECuqEIdeHb--7AZ6BCaUx0bya720a-Z5x6w,7335
|
|
277
277
|
sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
|
|
278
|
-
sourcecode/_docs/DEFECT-LEDGER.md,sha256=
|
|
278
|
+
sourcecode/_docs/DEFECT-LEDGER.md,sha256=JyRLeRBjV5luaHrh2w1U2TdK6l3erTRwrCS9kB8wxco,1174219
|
|
279
279
|
sourcecode/_docs/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
|
|
280
280
|
sourcecode/_docs/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
|
|
281
|
-
sourcecode/_docs/USER_GUIDE.md,sha256=
|
|
282
|
-
sourcecode-5.9.
|
|
283
|
-
sourcecode-5.9.
|
|
284
|
-
sourcecode-5.9.
|
|
285
|
-
sourcecode-5.9.
|
|
286
|
-
sourcecode-5.9.
|
|
287
|
-
sourcecode-5.9.
|
|
281
|
+
sourcecode/_docs/USER_GUIDE.md,sha256=s4H1q5ADDn0IYDzTyXFFQSojOH7ko8clwhNU0CKfcTk,108622
|
|
282
|
+
sourcecode-5.9.25.dist-info/METADATA,sha256=UtJhhuSIbv7yKfhmeQvvy1-kq6gMqjoCMEVAlPLr8W0,67653
|
|
283
|
+
sourcecode-5.9.25.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
|
|
284
|
+
sourcecode-5.9.25.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
|
|
285
|
+
sourcecode-5.9.25.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
|
|
286
|
+
sourcecode-5.9.25.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
|
|
287
|
+
sourcecode-5.9.25.dist-info/RECORD,,
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|