sourcecode 5.9.23__tar.gz → 5.9.24__tar.gz

{sourcecode-5.9.23 → sourcecode-5.9.24}/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## [5.9.24] — 2026-09-01
+
+*Follow-up correction batch after the external 5.9.23 audit.*
+
+### Fixed
+
+- Aggregated nested answer-cap contracts so compact output reports rows hidden
+  below nested payloads instead of publishing a misleading zero count.
+- Bound `--jobs` to 128 workers, preventing accidental unbounded process-pool
+  requests while retaining automatic and explicit parallelism.
+- Removed Rich markup from help output written to a pipe, so scripts and CI logs
+  receive plain, parseable text.
+- Accepted an optional repository path on `remediation-report` for consistency
+  with repository-oriented command invocation.
+
+### Known Limitations
+
+- The external 5.9.23 audit measured rare zero-byte successful answers from
+  `risk` and Markdown `audit-report`. This remains a P0 CI blocker: validate
+  output bytes until `EMPTY_ANSWER` is enforced globally.
+- `--agent` can reject large repositories after expensive post-hoc RSS sampling,
+  and nested workspaces can make root help unacceptably slow. The prioritized
+  remediation queue is maintained in the defect ledger.
+
 ## [5.9.23] — 2026-09-01
 
 *Regression hardening after the 5.9.22 audit and testing-repository battery.*

{sourcecode-5.9.23 → sourcecode-5.9.24}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.23
+Version: 5.9.24
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.23-blue)
+![Version](https://img.shields.io/badge/version-5.9.24-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -213,10 +213,12 @@ message names the phase it is in and whether that phase has changed, so a slow r
 is distinguishable from a blocked one.
 
 **External audit boundary (2026-09-01).** The latest Windows audit rates the
-large-repository experience at **6.6/10** and reports open P0/P1 issues: empty
+large-repository experience at **6.9/10** and reports open P0/P1 issues: empty
 successful Markdown `audit-report`, silent `risk` termination, multi-gigabyte
 deep-agent RSS, incomplete parse/coverage disclosure and oversized compact
-surfaces. These findings are tracked in the [external audit](docs/AUDIT-2026-09-01-EXTERNAL-5.9.22.md)
+surfaces. The 5.9.23 audit found a CI-blocking empty-output regression that
+remains open in 5.9.24; do not use `risk` or Markdown `audit-report` as
+unattended gates until it is fixed. Findings are tracked in the [external audit](docs/AUDIT-2026-09-01-EXTERNAL-5.9.23.md)
 and [defect ledger](docs/DEFECT-LEDGER.md); they are not closed by the existing
 engineering-host measurements.
 

{sourcecode-5.9.23 → sourcecode-5.9.24}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.23-blue)
+![Version](https://img.shields.io/badge/version-5.9.24-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -164,10 +164,12 @@ message names the phase it is in and whether that phase has changed, so a slow r
 is distinguishable from a blocked one.
 
 **External audit boundary (2026-09-01).** The latest Windows audit rates the
-large-repository experience at **6.6/10** and reports open P0/P1 issues: empty
+large-repository experience at **6.9/10** and reports open P0/P1 issues: empty
 successful Markdown `audit-report`, silent `risk` termination, multi-gigabyte
 deep-agent RSS, incomplete parse/coverage disclosure and oversized compact
-surfaces. These findings are tracked in the [external audit](docs/AUDIT-2026-09-01-EXTERNAL-5.9.22.md)
+surfaces. The 5.9.23 audit found a CI-blocking empty-output regression that
+remains open in 5.9.24; do not use `risk` or Markdown `audit-report` as
+unattended gates until it is fixed. Findings are tracked in the [external audit](docs/AUDIT-2026-09-01-EXTERNAL-5.9.23.md)
 and [defect ledger](docs/DEFECT-LEDGER.md); they are not closed by the existing
 engineering-host measurements.
 

sourcecode-5.9.24/docs/AUDIT-2026-09-01-EXTERNAL-5.9.23.md

@@ -0,0 +1,40 @@
+# External Audit - 5.9.23
+
+## Release Status
+
+The 5.9.23 re-audit rates ASK Engine at **6.9/10**, down from 7.5. Precision
+remains strong and SEC-010 closes the previously reported concatenated-SQLi
+coverage gap. The release is **not recommended for unattended CI gating** until
+the empty-success invariant is implemented.
+
+## Priority Regressions
+
+1. `NEW-01` P0: `risk` and Markdown `audit-report` were observed exiting 0 with
+   zero stdout and stderr. The audit measured 3 occurrences in 47 runs with
+   byte counting. Its later controls did not reproduce warm-cache or contention
+   causality, so those are not asserted as the root cause.
+2. `REG-02` Critical: the default 1,536 MB agent ceiling rejects valid large
+   repositories only after expensive work; the effective default ceiling is not
+   visible in successful-agent metadata.
+3. `BUG-01` P0: malformed Java can disappear without file-specific disclosure.
+4. `REG-03` High: warm Spring audit runs were 2.1-3.8x slower despite full CIR
+   reuse.
+5. `NEW-02` High: overloaded endpoint handlers can publish the wrong declaration
+   line while claiming a handler-declaration anchor.
+
+## Verified Improvements
+
+- SEC-010 emits a dedicated high-severity finding for HTTP input reaching a
+  concatenated SQL query sink, with no observed false positives on three clean
+  repositories.
+- Compact migration inventory is materially bounded and publishes per-framework
+  omission contracts.
+- Help recommendations use repository profile evidence and route aliases were
+  restored across the sampled command surface.
+
+## Verification Boundary
+
+The audit was performed on Windows 11 / Python 3.10 across 21 repositories and
+about 180 invocations. Reported timings are platform-specific evidence, not
+portable performance guarantees. Its zero-output finding is operationally
+critical even though its precise trigger remains unproven.

{sourcecode-5.9.23 → sourcecode-5.9.24}/docs/DEFECT-LEDGER.md

@@ -14,22 +14,35 @@ Status values: `open` · `in-progress` · `closed <version>` · `by-design` (wit
 The facts these rows are keyed to are published: `ask schema facts-v1` prints the registry
 (authority, definition, consumers, parity test) that the release battery enforces.
 
-## Current Synchronization — External Audit `5.9.22` (2026-09-01)
+## Current Synchronization — External Audit `5.9.23`, carried into `5.9.24` (2026-09-01)
 
-The external audit confirms strong precision, determinism and uncertainty
-disclosure, but opens a P0/P1 cluster around silent success, incomplete
-population disclosure, large-run memory and compact-output contracts. Full
-evidence: [`AUDIT-2026-09-01-EXTERNAL-5.9.22.md`](AUDIT-2026-09-01-EXTERNAL-5.9.22.md).
+**Release gate: do not use 5.9.24 as a CI decision gate for these surfaces.** The audit measured
+three `rc=0`, zero-byte answers across `risk` and Markdown `audit-report`.
+The trigger is not yet established; warm-cache and contention hypotheses were
+explicitly tested and did not reproduce it. A global non-empty-output invariant
+is therefore the P0 containment work, not a claim that the root cause is known.
+
+Priority order is: `NEW-01` empty successful output; `REG-02` default agent
+memory rejection and post-hoc RSS enforcement; `BUG-01` undeclared parse loss;
+`REG-03` warm-path slowdown; `NEW-02` overloaded endpoint anchors; then
+workspace-help/selftest/plan and output-contract regressions. Full evidence:
+[`AUDIT-2026-09-01-EXTERNAL-5.9.23.md`](AUDIT-2026-09-01-EXTERNAL-5.9.23.md).
 
 | ID | Severity | Status | Evidence and required closure |
 |---|---:|---|---|
-| `BUG-01` | Critical maximum | **open, P0** | Full Markdown `audit-report` reproduced with `rc=0` and empty stdout. Add a global non-empty-answer invariant and renderer coverage. |
+| `NEW-01` | Critical maximum | **open, P0 / CI blocker** | `risk` and Markdown `audit-report` can exit `0` with zero bytes on stdout and stderr. The measured rate was 3/47 byte-counted runs; root cause is unknown. Enforce `EMPTY_ANSWER` globally and add byte-counted background-process coverage. |
+| `REG-02` | Critical | **open, regression** | The 1,536 MB default `--agent` ceiling rejects valid large repositories only after spending minutes; it is not published in successful default-agent metadata. Bound projection during construction, sample RSS periodically, and publish the effective ceiling. |
+| `REG-03` | High | **open, regression** | Warm `spring-audit` was measured 2.1–3.8x slower despite a fully reused CIR. Attribute the warm pass before claiming cache benefit. |
+| `REG-01` | High | **open, regression** | Root `ask --help` took 83–86 seconds in a workspace with nested repositories. Help must not perform unbounded repository/profile analysis. |
+| `REG-04` | Medium | **closed 5.9.24** | `_meta.answer_bounds.capped` now aggregates nested cap contracts, so compact answers disclose rows omitted below nested payloads. Regression coverage includes nested dictionaries and lists. |
+| `NEW-02` | High | **open** | Overloaded endpoint handlers can all inherit the final overload's `declaration_line`. Resolve by mapping annotation/signature or publish ambiguity. |
+| `BUG-01` | Critical maximum | **open, P0** | A malformed Java file can disappear without a file-specific declaration. Publish parse failure/recovery in the answer bounds and preserve any affected endpoint gap. |
 | `BUG-02` | Critical maximum | **open, P0** | Large `risk` ended `rc=127` with no output or structured failure. Add fail-fast resource/process handling and durable partial checkpoints. |
 | `BUG-12` | Critical maximum | **open, P0** | Deep `--agent` output construction reaches multi-gigabyte RSS before a small answer. Bound projection while building. |
-| `BUG-03` | High | **open, P1** | `content_id` changes between cold and warm because cache state is hashed into identity. Separate execution metadata from answer identity. |
+| `BUG-03` | High | **open, P1** | Marginal Spring detection can overstate what a zero-finding result covers. Publish Spring footprint/coverage with the stack-fit claim. |
 | `BUG-04` | High | **open, P1** | `selftest` publishes `complete=true` with five error rows. Derive bounds from actual results. |
 | `BUG-05` | High | **open, P1** | Overloaded endpoint handlers can receive the wrong declaration line. Resolve by mapping annotation or publish ambiguity. |
-| `BUG-07` | High | **open, P1** | `--compact` remains oversized on `migrate-check` and `spring-audit`. Apply bounded projections with omission metadata. |
+| `BUG-07` | Closed 5.9.23, verification gap | Compact JVM inventory is bounded, but the audit notes no selftest row protects the correction. Add release-battery coverage before treating it as durable closure. |
 | `BUG-10` | High | **open, P1** | Unsupported routing styles can produce empty coverage gaps. Publish detected-but-unmodeled routing gaps. |
 | `BUG-11` | High | **open, P1** | Default `pack assessment` can fail on a small Spring repository. Use a bounded default or explicit full mode. |
 | `BUG-13` | High | **open, P1** | Unscoped `selftest` starts over nested repositories after warning. Refuse and require an explicit path. |

{sourcecode-5.9.23 → sourcecode-5.9.24}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.23"
+version = "5.9.24"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.23 → sourcecode-5.9.24}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.23"
+__version__ = "5.9.24"

{sourcecode-5.9.23 → sourcecode-5.9.24}/src/sourcecode/answer_bounds.py

@@ -170,17 +170,24 @@ def _exclusions(payload: "dict[str, Any]") -> "list[dict[str, Any]]":
 
 def _caps(payload: "dict[str, Any]") -> "list[dict[str, Any]]":
     found: "list[dict[str, Any]]" = []
+    def walk(value: Any, prefix: str) -> None:
+        if isinstance(value, dict):
+            for key, child in value.items():
+                path = f"{prefix}{key}"
+                if key.endswith(_CAP_SUFFIX) and isinstance(child, dict):
+                    omitted = child.get("omitted")
+                    if omitted not in (None, 0):
+                        found.append({"field": path, **{
+                            axis: child[axis] for axis in ("total", "shown", "omitted")
+                            if axis in child
+                        }})
+                walk(child, f"{path}.")
+        elif isinstance(value, list):
+            for index, child in enumerate(value):
+                walk(child, f"{prefix}{index}.")
+
     for prefix, block in _blocks(payload):
-        for key, value in block.items():
-            if not key.endswith(_CAP_SUFFIX) or not isinstance(value, dict):
-                continue
-            omitted = value.get("omitted")
-            if omitted in (None, 0):
-                continue
-            found.append({"field": f"{prefix}{key}", **{
-                axis: value[axis] for axis in ("total", "shown", "omitted")
-                if axis in value
-            }})
+        walk(block, prefix)
     return found
 
 

{sourcecode-5.9.23 → sourcecode-5.9.24}/src/sourcecode/cli.py

@@ -993,6 +993,9 @@ scope matches; `ask cache model` says exactly what a warm buys per command.
   [dim cyan]→ ask activate <key>[/dim cyan]
 """
 
+    if not getattr(sys.stdout, "isatty", lambda: False)():
+        # Rich markup is useful interactively but corrupts piped help output.
+        return re.sub(r"\[/?(?:bold(?: green)?|dim(?: bold)?|yellow|cyan)\]", "", text)
     return text
 
 
@@ -4136,7 +4139,14 @@ def _jobs_option() -> Any:
     capability that makes the rule pass parallel is F-AT, and no help text is a
     substitute for it.
     """
-    return typer.Option(None, "--jobs", "-j", min=1, help=JOBS_OPTION_HELP)
+    return typer.Option(
+        None,
+        "--jobs",
+        "-j",
+        min=1,
+        max=128,
+        help=JOBS_OPTION_HELP + " Maximum accepted value: 128.",
+    )
 
 
 def _invoke_command(ctx: typer.Context, command: Any, **named: Any) -> Any:
@@ -17325,6 +17335,10 @@ def _audit_population_for(root: "Path", *, progress: "Any" = None):
 
 @app.command("remediation-report")
 def remediation_report_cmd(
+    path: Optional[Path] = typer.Argument(
+        None,
+        help="Optional repository path accepted for CLI consistency; the bundled ledger is used.",
+    ),
     output_path: Optional[Path] = typer.Option(
         None, "--output", "-o", help="Write output to a file instead of stdout.",
     ),
@@ -17332,6 +17346,7 @@ def remediation_report_cmd(
     copy: bool = _copy_option(),
 ) -> None:
     """Publish a redacted remediation record for this ASK build."""
+    del path
     _enforce_format("remediation-report", format)
     from sourcecode import bundled_docs
 

{sourcecode-5.9.23 → sourcecode-5.9.24}/src/sourcecode/release_info.py

@@ -27,7 +27,7 @@ from typing import Any, Optional
 #: The date `__version__` was released, from that version's CHANGELOG entry.
 #: `tests/test_release_info.py` fails the build if the two disagree, so this is
 #: a copy of a fact rather than a second authority for it.
-RELEASE_DATE = "2026-08-31"
+RELEASE_DATE = "2026-09-01"
 
 #: Releases per day, measured over the latest 30 CHANGELOG releases (the same
 #: computation the test re-runs). The nine-day interval before 5.9.0 lowers