sourcecode 5.9.24__tar.gz → 5.9.25__tar.gz

{sourcecode-5.9.24 → sourcecode-5.9.25}/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## [5.9.25] — 2026-09-01
+
+*Reliability remediation from the alternative 5.9.23 audit.*
+
+### Fixed
+
+- Hardened audit-family answer delivery: a successful exit now requires stdout
+  or a verified requested output artifact.
+- Propagated deadline cuts through security posture, with omitted stages and
+  partial coverage disclosed in the result.
+- Removed nested execution clocks from deterministic content identity.
+- Reconciled compact migration findings with their full detected population.
+- Made failed, unrun, unknown and task-gap self-checks invalidate envelope
+  completeness instead of reporting `complete: true`.
+- Published the effective `prepare-context` stdout budget and full-artifact
+  path in every task response.
+
+### Known Limitations
+
+- The security-rules/remediation performance regression (`ALT-03`, `ALT-07`)
+  still requires reproduction and bisection on the affected large Windows tree.
+- Native-Windows repetition remains required to close the original silent
+  success report conclusively.
+
 ## [5.9.24] — 2026-09-01
 
 *Follow-up correction batch after the external 5.9.23 audit.*
@@ -17,9 +41,15 @@
 
 ### Known Limitations
 
-- The external 5.9.23 audit measured rare zero-byte successful answers from
-  `risk` and Markdown `audit-report`. This remains a P0 CI blocker: validate
-  output bytes until `EMPTY_ANSWER` is enforced globally.
+- An alternative Windows audit of the 5.9.23 build measured a systemic silent
+  success regression across `spring-audit`, `verify`, `risk`, Markdown
+  `audit-report`, `migrate-check`, and `migrate-apply`: 55 of 84 observed runs
+  exited `0` with zero output, plus eight timeouts. This supersedes the earlier
+  characterization as rare. Do not use the audit-command family for unattended
+  CI until the global non-empty-answer and output-promise invariants are proven.
+- `ASK_MAX_ANALYSIS_SECONDS` did not produce a partial result on the affected
+  paths, and could be ignored by `spring-audit`; it is not a safe recovery path
+  for this release.
 - `--agent` can reject large repositories after expensive post-hoc RSS sampling,
   and nested workspaces can make root help unacceptably slow. The prioritized
   remediation queue is maintained in the defect ledger.

{sourcecode-5.9.24 → sourcecode-5.9.25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.24
+Version: 5.9.25
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.24-blue)
+![Version](https://img.shields.io/badge/version-5.9.25-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -212,15 +212,19 @@ exit 75 (`--allow-partial` accepts one deliberately). The long-run progress
 message names the phase it is in and whether that phase has changed, so a slow run
 is distinguishable from a blocked one.
 
-**External audit boundary (2026-09-01).** The latest Windows audit rates the
-large-repository experience at **6.9/10** and reports open P0/P1 issues: empty
-successful Markdown `audit-report`, silent `risk` termination, multi-gigabyte
-deep-agent RSS, incomplete parse/coverage disclosure and oversized compact
-surfaces. The 5.9.23 audit found a CI-blocking empty-output regression that
-remains open in 5.9.24; do not use `risk` or Markdown `audit-report` as
-unattended gates until it is fixed. Findings are tracked in the [external audit](docs/AUDIT-2026-09-01-EXTERNAL-5.9.23.md)
-and [defect ledger](docs/DEFECT-LEDGER.md); they are not closed by the existing
-engineering-host measurements.
+**External audit boundary (2026-09-01).** An alternative native-Windows audit
+rates the 5.9.23 audit-command family **4.9/10**, versus 6.6 for 5.9.22. It
+measured 55 zero-byte `exit 0` answers and eight timeouts in 84 runs across
+`spring-audit`, `verify`, `risk`, Markdown `audit-report`, `migrate-check`, and
+`migrate-apply`. The release must not be used to gate unattended CI through
+those commands, nor should `ASK_MAX_ANALYSIS_SECONDS` be relied on as a recovery
+path, until native repetition proves the global output and partial-result
+invariants. The unaffected lightweight CI commands are useful evidence, but do
+not close this release-wide reliability failure. Findings are tracked in the
+[alternative audit](docs/AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md), the earlier
+[external audit](docs/AUDIT-2026-09-01-EXTERNAL-5.9.23.md), and the
+[defect ledger](docs/DEFECT-LEDGER.md); engineering-host measurements cannot
+close native-Windows observations.
 
 The current external audit still records two open availability limits, and they
 are held open deliberately: `audit-report --format markdown` under contention, and
@@ -286,7 +290,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.22 — and, on a build that has aged,
+ask version                    # ask 5.9.25 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.24 → sourcecode-5.9.25}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.24-blue)
+![Version](https://img.shields.io/badge/version-5.9.25-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -163,15 +163,19 @@ exit 75 (`--allow-partial` accepts one deliberately). The long-run progress
 message names the phase it is in and whether that phase has changed, so a slow run
 is distinguishable from a blocked one.
 
-**External audit boundary (2026-09-01).** The latest Windows audit rates the
-large-repository experience at **6.9/10** and reports open P0/P1 issues: empty
-successful Markdown `audit-report`, silent `risk` termination, multi-gigabyte
-deep-agent RSS, incomplete parse/coverage disclosure and oversized compact
-surfaces. The 5.9.23 audit found a CI-blocking empty-output regression that
-remains open in 5.9.24; do not use `risk` or Markdown `audit-report` as
-unattended gates until it is fixed. Findings are tracked in the [external audit](docs/AUDIT-2026-09-01-EXTERNAL-5.9.23.md)
-and [defect ledger](docs/DEFECT-LEDGER.md); they are not closed by the existing
-engineering-host measurements.
+**External audit boundary (2026-09-01).** An alternative native-Windows audit
+rates the 5.9.23 audit-command family **4.9/10**, versus 6.6 for 5.9.22. It
+measured 55 zero-byte `exit 0` answers and eight timeouts in 84 runs across
+`spring-audit`, `verify`, `risk`, Markdown `audit-report`, `migrate-check`, and
+`migrate-apply`. The release must not be used to gate unattended CI through
+those commands, nor should `ASK_MAX_ANALYSIS_SECONDS` be relied on as a recovery
+path, until native repetition proves the global output and partial-result
+invariants. The unaffected lightweight CI commands are useful evidence, but do
+not close this release-wide reliability failure. Findings are tracked in the
+[alternative audit](docs/AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md), the earlier
+[external audit](docs/AUDIT-2026-09-01-EXTERNAL-5.9.23.md), and the
+[defect ledger](docs/DEFECT-LEDGER.md); engineering-host measurements cannot
+close native-Windows observations.
 
 The current external audit still records two open availability limits, and they
 are held open deliberately: `audit-report --format markdown` under contention, and
@@ -237,7 +241,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.22 — and, on a build that has aged,
+ask version                    # ask 5.9.25 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

sourcecode-5.9.25/docs/AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md

@@ -0,0 +1,72 @@
+# Alternative External Audit - 5.9.23
+
+## Scope And Verdict
+
+This native-Windows audit evaluated the 5.9.23 build on a dirty 3,342-Java-file
+repository under Python 3.10. It rates the release **4.9/10**, down from 6.6 for
+5.9.22. Analysis precision remains strong and several context paths are faster,
+but the audit-command family is not reliable enough for unattended CI.
+
+This is an external measurement. It is evidence of a release-blocking failure,
+not proof of a single root cause. Engineering-host results do not close it.
+
+## Execution Matrix
+
+| Invocation | Runs | Answers | Empty `exit 0` | Timeouts |
+|---|---:|---:|---:|---:|
+| `spring-audit . --compact` | 17 | 0 | 14 | 3 |
+| `verify .` | 17 | 0 | 16 | 1 |
+| `risk . --limit 20` | 13 | 0 | 11 | 2 |
+| `audit-report . --format markdown` | 7 | 0 | 5 | 2 |
+| `migrate-check . --compact` | 12 | 7 | 5 | 0 |
+| `migrate-apply .` | 17 | 14 | 3 | 0 |
+| `verify . --init --dry-run` | 1 | 0 | 1 | 0 |
+| **Total** | **84** | **21** | **55** | **8** |
+
+The observed failures were serialized, foreground runs. Clearing cache, varying
+`ASK_JOBS` and `--jobs`, changing output format, using `--no-cache`, and using
+`--output` did not make the main audit failure reliable. `endpoints --output`
+did create its artifact, showing that the output invariant exists on a separate
+path but does not cover the affected family.
+
+## Release Blockers
+
+1. `ALT-01`: No command may return `exit 0` with zero stdout unless a requested
+   output artifact was created and verified. A failed worker or absent phase
+   result is not an empty finding set and must return structured non-zero failure.
+2. `ALT-02`: Applicable `ASK_MAX_ANALYSIS_SECONDS` deadlines must publish a
+   partial answer with `complete:false`; `risk` and `audit-report` returned empty
+   success, while `spring-audit` exceeded the external 200-second kill.
+3. `ALT-03`: The security-rules phase is the primary investigation target.
+   Security retrieve queries timed out, `remediate` stalled in auditing, and the
+   known small subtree completed while the 3,342-file root did not. This is a
+   bisection hypothesis, not a confirmed causal claim.
+
+Closure requires at least 30 native repetitions for every affected command, with
+byte counts, exit code, timeout status, and requested output-file existence.
+
+## Additional Regressions
+
+- `impact-chain` content IDs changed every execution because clock fields under
+  `metadata` were hashed. All execution clocks must be excluded independent of
+  their nesting location.
+- `migrate-check` exposed incompatible findings totals: `summary.total_findings`
+  was 1,526 while `findings_cap.total` was 593, without an exclusion contract.
+- `selftest` emitted `complete:true` and no gaps despite one fail and one error.
+- `remediate` stalled beyond 400 seconds in `auditing for repairable findings`.
+- `prepare-context review-pr` emitted roughly 30K tokens without a compact mode
+  or omission contract.
+- Existing argument hints and retrieve-anchor discoverability remain ergonomic
+  follow-ups, not release blockers.
+
+## Preserved Evidence
+
+- Endpoint analysis remained exact: 3,763 endpoints with matching paths and
+  double-base-path expansion.
+- `migrate-check --compact` improved from 86.8 KB to 36.7 KB and publishes cap
+  contracts; the nested-cap aggregation correction in 5.9.24 remains valid.
+- Several deterministic payloads were byte-identical between releases, and the
+  lightweight CI paths `pr-risk`, `verify-edit`, and `pr-impact` were reliable.
+
+These controls must remain in the regression battery while the P0 recovery work
+proceeds; they do not compensate for silent audit-family failures.

{sourcecode-5.9.24 → sourcecode-5.9.25}/docs/DEFECT-LEDGER.md

@@ -14,23 +14,36 @@ Status values: `open` · `in-progress` · `closed <version>` · `by-design` (wit
 The facts these rows are keyed to are published: `ask schema facts-v1` prints the registry
 (authority, definition, consumers, parity test) that the release battery enforces.
 
-## Current Synchronization — External Audit `5.9.23`, carried into `5.9.24` (2026-09-01)
-
-**Release gate: do not use 5.9.24 as a CI decision gate for these surfaces.** The audit measured
-three `rc=0`, zero-byte answers across `risk` and Markdown `audit-report`.
-The trigger is not yet established; warm-cache and contention hypotheses were
-explicitly tested and did not reproduce it. A global non-empty-output invariant
-is therefore the P0 containment work, not a claim that the root cause is known.
-
-Priority order is: `NEW-01` empty successful output; `REG-02` default agent
-memory rejection and post-hoc RSS enforcement; `BUG-01` undeclared parse loss;
-`REG-03` warm-path slowdown; `NEW-02` overloaded endpoint anchors; then
-workspace-help/selftest/plan and output-contract regressions. Full evidence:
-[`AUDIT-2026-09-01-EXTERNAL-5.9.23.md`](AUDIT-2026-09-01-EXTERNAL-5.9.23.md).
+## Current Synchronization — Alternative External Audit `5.9.23`, carried into `5.9.25` (2026-09-01)
+
+**Release gate: do not use 5.9.25 to gate unattended CI through the audit-command
+family.** A native-Windows alternative audit of the 5.9.23 build measured 55
+`rc=0`, zero-byte answers and eight timeouts in 84 runs. The failures include
+`spring-audit`, `verify`, `risk`, Markdown `audit-report`, `migrate-check`, and
+`migrate-apply`; the prior 3/47 observation was materially incomplete. The
+cause remains unproven. A security-rules phase is a supported hypothesis, not a
+closure claim. `exit 0` is valid only for a non-empty stdout answer or a verified
+`--output` artifact; a missing phase result must be structured failure, never an
+empty finding set.
+
+Priority order is: `ALT-01` silent success and unkept output promises;
+`ALT-02` budget/partial-result failure; `ALT-03` security-rules phase bisection;
+`ALT-04` content-id instability; `ALT-05` contradictory migration totals;
+`ALT-06` false-complete selftest; then remediation, context bounds and CLI
+ergonomics. Full evidence: [`AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md`](AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md)
+and [`AUDIT-2026-09-01-EXTERNAL-5.9.23.md`](AUDIT-2026-09-01-EXTERNAL-5.9.23.md).
 
 | ID | Severity | Status | Evidence and required closure |
 |---|---:|---|---|
-| `NEW-01` | Critical maximum | **open, P0 / CI blocker** | `risk` and Markdown `audit-report` can exit `0` with zero bytes on stdout and stderr. The measured rate was 3/47 byte-counted runs; root cause is unknown. Enforce `EMPTY_ANSWER` globally and add byte-counted background-process coverage. |
+| `ALT-01` | Critical maximum | **fixed, pending native-Windows repetition** | `a7ad44b` hardens the required-answer and output-artifact guards: `exit 0` now requires delivered stdout or a verified requested artifact. Native 30-run repetition remains the release closure evidence. |
+| `ALT-02` | Critical maximum | **fixed, bounded-phase follow-up** | `aab1e8b` propagates deadline checks into security posture and publishes omitted stages and partial coverage. A small-repository budget can still finish its coarse earlier phases before the deadline is observed; `ALT-03` owns reducing that phase granularity. |
+| `ALT-03` | High | **open, investigation** | The security-rules phase is the common evidence-backed suspect: all affected audit flows consume security findings, security `retrieve` queries timed out, and `remediate` stalled in the same phase. Bisect the known working small subtree against the 3,342-file root; do not assert causality before reproducing it. |
+| `ALT-04` | High | **fixed** | `36e3893` excludes every nested `*_time_ms` execution clock from `content_id`; parametric tests retain semantic-field sensitivity. |
+| `ALT-05` | High | **fixed** | `b12c8f1` publishes `population_total` and `excluded_before_cap` beside the compact findings cap, reconciling it with the summary population. |
+| `ALT-06` | High | **fixed** | `6d0889e` publishes structured limitations for failed, unrun and unknown ledger rows; `5620864` also makes generic task `gaps` invalidate envelope completeness. |
+| `ALT-07` | Medium | **open** | `remediate` regressed from a 23.6-second answer to hangs beyond 400 seconds in `auditing for repairable findings`; it shares the `ALT-03` investigation until separated by evidence. |
+| `ALT-08` | Medium | **fixed** | `15d77d2` publishes the effective per-task stdout budget and the full-artifact path; bounded output remains skipped only for explicit `--output` artifacts. |
+| `NEW-01` | Critical maximum | **superseded by ALT-01** | The earlier 3/47 `risk` and Markdown `audit-report` observation undercounted the native-Windows audit-family failure. |
 | `REG-02` | Critical | **open, regression** | The 1,536 MB default `--agent` ceiling rejects valid large repositories only after spending minutes; it is not published in successful default-agent metadata. Bound projection during construction, sample RSS periodically, and publish the effective ceiling. |
 | `REG-03` | High | **open, regression** | Warm `spring-audit` was measured 2.1–3.8x slower despite a fully reused CIR. Attribute the warm pass before claiming cache benefit. |
 | `REG-01` | High | **open, regression** | Root `ask --help` took 83–86 seconds in a workspace with nested repositories. Help must not perform unbounded repository/profile analysis. |

{sourcecode-5.9.24 → sourcecode-5.9.25}/docs/DEVELOPMENT-ROADMAP.md

@@ -1,5 +1,25 @@
 # ASK — Development Roadmap
 
+### Alternative Audit Intake — release 5.9.23 reliability regression
+
+An alternative native-Windows audit found the audit-command family unreliable:
+55 zero-byte `exit 0` answers and eight timeouts in 84 executions. `spring-audit`
+and `verify` answered 0/34; `risk`, Markdown `audit-report`, `migrate-check`, and
+`migrate-apply` also failed silently. This overrides the earlier characterization
+as a rare output anomaly. No feature work should be treated as release-ready
+until the following recovery sequence has native evidence.
+
+| Priority | Required work and closure boundary |
+|---|---|
+| P0 | Enforce `exit 0 => non-empty stdout OR verified --output artifact` across the command registry. A missing auditing-phase result or worker failure must emit structured non-zero failure. Run at least 30 native repetitions per affected command. |
+| P0 | Restore the budget contract: applicable `ASK_MAX_ANALYSIS_SECONDS` deadlines publish `partial:true` and `complete:false`; non-applicable commands disclose that fact. Verify `risk`, `audit-report`, and `spring-audit` natively. |
+| P1 | Bisect the security-rules phase using the working small subtree and the 3,342-file failing root. It is a hypothesis supported by affected command overlap, not an established root cause. |
+| P1 | Restore `content_id` stability by excluding `metadata.*_time_ms` execution clocks, and make selftest completion/gaps derive from failures and errors. |
+| P1 | Reconcile `migrate-check` findings populations and bound `prepare-context review-pr`; then address remediation hangs and remaining CLI ergonomics. |
+
+The full measurement matrix and non-regression controls are in
+[`AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md`](AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md).
+
 ### Release 5.9.20 — JVM evidence inventory
 
 The accepted JVM R&D scope is implemented in `migrate-check`: local framework,

{sourcecode-5.9.24 → sourcecode-5.9.25}/docs/USER_GUIDE.md

@@ -279,7 +279,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.19
+# ask 5.9.25
 ```
 
 Requires Python 3.9+.

{sourcecode-5.9.24 → sourcecode-5.9.25}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.24"
+version = "5.9.25"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.24 → sourcecode-5.9.25}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.24"
+__version__ = "5.9.25"

{sourcecode-5.9.24 → sourcecode-5.9.25}/src/sourcecode/answer_bounds.py

@@ -88,6 +88,12 @@ def _summarise(value: Any) -> Any:
 
 def _gaps(payload: "dict[str, Any]") -> "list[dict[str, Any]]":
     found: "list[dict[str, Any]]" = []
+    # `prepare-context` and related task answers publish their unanswered
+    # analysis as a top-level list, rather than under the route-specific
+    # `coverage` block. It is still a declared gap in the answer.
+    for gap in _as_list(payload.get("gaps")):
+        if gap:
+            found.append({"field": "gaps", "what": _summarise(gap)})
     coverage = payload.get("coverage")
     if isinstance(coverage, dict):
         for gap in _as_list(coverage.get("gaps")):

{sourcecode-5.9.24 → sourcecode-5.9.25}/src/sourcecode/cli.py

@@ -3000,6 +3000,19 @@ _OUTPUT_PROMISED: "Optional[str]" = None
 _OUTPUT_DELIVERED: bool = False
 _ANSWER_REQUIRED_BY: "Optional[str]" = None
 
+# ALT-01. These commands publish repository-analysis answers. A successful
+# process with neither stdout nor a verified output artifact is never valid.
+# Kept as one authority so the entry point can arm the guard before Click enters
+# a callback; a callback that returns early is the failure this protects.
+REQUIRED_ANSWER_COMMANDS: "frozenset[str]" = frozenset({
+    "audit-report",
+    "migrate-apply",
+    "migrate-check",
+    "risk",
+    "spring-audit",
+    "verify",
+})
+
 
 def _record_output_promise(argv: "list[str]") -> None:
     """Note that this invocation asked for a file, before anything is parsed.
@@ -3047,6 +3060,16 @@ def _require_answer_delivery(command: str) -> None:
     _ANSWER_REQUIRED_BY = command
 
 
+def _require_answer_from_argv(argv: "list[str]") -> None:
+    """Arm the process guard before an affected command callback can return."""
+    if any(token in ("--help", "-h", "--version") for token in argv):
+        return
+    for token in argv:
+        if token in REQUIRED_ANSWER_COMMANDS:
+            _require_answer_delivery(token)
+            return
+
+
 def _analysis_failed(command: str, phase: str, exc: Exception) -> NoReturn:
     """Fail a costly command with evidence instead of an empty successful exit.
 
@@ -3134,7 +3157,7 @@ def _unkept_output_promise() -> "Optional[str]":
     the run wrote it by some route this module does not know about, and a
     discard sink was never a promise of a file.
     """
-    if _OUTPUT_DELIVERED or not _OUTPUT_PROMISED:
+    if not _OUTPUT_PROMISED:
         return None
     try:
         from sourcecode.output_sink import is_null_device
@@ -3143,7 +3166,9 @@ def _unkept_output_promise() -> "Optional[str]":
         if is_null_device(path) or (path.is_file() and path.stat().st_size > 0):
             return None
     except Exception:
-        return None
+        # A destination that cannot be inspected cannot prove delivery. This is
+        # a release gate, so uncertainty fails closed with the promised path.
+        return _OUTPUT_PROMISED
     return _OUTPUT_PROMISED
 
 
@@ -8377,6 +8402,11 @@ def prepare_context_cmd(
 
     # P0-1: Apply output budget per task — safety net for large repos.
     _pc_budget = _prepare_context_budget(task)
+    out["output_budget"] = {
+        "stdout_max_bytes": _pc_budget,
+        "applies_to": "stdout only",
+        "full_output": "Use --output <file> to retain the complete artifact.",
+    }
 
     # Size-gated preview: on enterprise-scale monoliths free users get a capped
     # preview (top-5 / lightweight) + upgrade note. Small/mid repos get the full
@@ -12718,6 +12748,7 @@ def spring_audit_cmd(
             _phases_cut: list[str] = []
             # C3-79: families the budget stopped *inside*, with how far each got.
             _rules_partial: list[dict] = []
+            _projection_stages_cut: list[str] = []
             if scope in ("all", "tx"):
                 if _run.exhausted():
                     _stopped_early = _WHY_BUDGET
@@ -12762,7 +12793,11 @@ def spring_audit_cmd(
                         getattr(_sec_watch, "partially_run", []) or []
                     )
                     _rules_partial.extend(_partial_families)
-                    if _cut or _partial_families:
+                    _stage_cut = list(
+                        getattr(_sec_watch, "stages_not_run", []) or []
+                    )
+                    _projection_stages_cut.extend(_stage_cut)
+                    if _cut or _partial_families or _stage_cut:
                         _stopped_early = _WHY_BUDGET
                         _phases_cut.append("security_audit")
                     else:
@@ -12952,6 +12987,7 @@ def spring_audit_cmd(
                     rules_partially_run=_rules_partial,
                     rules_not_run=_rules_cut,
                     phases_stopped_inside=_phases_cut,
+                    composition_walks_not_run=_projection_stages_cut,
                 )
                 # AUD-595-A03: the declaration said what did not run and never
                 # what the process would do about it. Same rule as the exits
@@ -14729,6 +14765,7 @@ def migrate_apply_cmd(
     and worktree. The resulting worktree is retained for review; ASK never commits
     or merges the generated changes.
     """
+    _require_answer_delivery("migrate-apply")
     from sourcecode.migrate_check import run_migrate_check
     from sourcecode.openrewrite_recipe import build_plan
     from sourcecode.repository_ir import find_java_files
@@ -21572,6 +21609,7 @@ def main_entry() -> None:
     # parser is about to read, so the guard at the end covers every command —
     # including one that returns before it reaches its emit seam.
     _record_output_promise(sys.argv[1:])
+    _require_answer_from_argv(sys.argv[1:])
     # ASK-09: give the output ceiling a way to resolve the running command that
     # does not go through Click's thread-local context. Registered as a provider,
     # so the Typer→Click conversion is only paid by a run that is actually over

{sourcecode-5.9.24 → sourcecode-5.9.25}/src/sourcecode/envelope.py

@@ -295,7 +295,10 @@ def _stable_projection(value: "Any", volatile: "frozenset[str]") -> "Any":
         return {
             key: _stable_projection(value[key], volatile)
             for key in sorted(value)
-            if key not in volatile
+            # Execution producers consistently publish elapsed clocks as
+            # `*_time_ms`, including command-specific names that cannot be
+            # exhaustively catalogued. Match the convention at every depth.
+            if key not in volatile and not key.endswith("_time_ms")
         }
     if isinstance(value, (list, tuple)):
         return [_stable_projection(item, volatile) for item in value]

{sourcecode-5.9.24 → sourcecode-5.9.25}/src/sourcecode/migrate_check.py

@@ -2618,6 +2618,15 @@ class MigrationReport:
             compact, "findings", top_n,
             key=lambda f: SEVERITY_ORDER.get(f.get("severity"), 3),
         )
+        findings_cap = compact.get("findings_cap")
+        if isinstance(findings_cap, dict):
+            # `summary.total_findings` covers all detected findings, whereas the
+            # display population may exclude advisory hygiene by default.
+            # Publish both counts at the cap boundary so consumers need not
+            # infer the relationship from a separate floor block.
+            population_total = int(full.get("summary", {}).get("total_findings", 0))
+            findings_cap["population_total"] = population_total
+            findings_cap["excluded_before_cap"] = population_total - findings_cap["total"]
         # Keep invariant rule prose once; each finding carries only location and
         # rule identity. Full prose remains available in the non-compact report.
         _rule_catalog: dict[str, dict] = {}

{sourcecode-5.9.24 → sourcecode-5.9.25}/src/sourcecode/rule_pass.py

@@ -104,6 +104,9 @@ class RulePassProgress:
     #: Families the budget cut *in flight*, with how far each one reached (C3-79).
     #: A family in here is in neither of the two lists above, and deliberately so.
     partially_run: "list[dict]" = field(default_factory=list)
+    #: Non-rule projection stages omitted after the deadline. Separate from rule
+    #: ids so coverage arithmetic never treats a projection as a rule family.
+    stages_not_run: "list[str]" = field(default_factory=list)
     #: How often `tick` reads the clock: once per this many units. A budget is a
     #: wall-clock bound, not a per-file one, and reading the clock 3 342 times to
     #: honour a 420-second deadline is cost with no resolution to show for it.
@@ -124,6 +127,12 @@ class RulePassProgress:
             if rule_id not in self.not_run:
                 self.not_run.append(rule_id)
 
+    def record_stages_not_run(self, stages: "list[str]") -> None:
+        """Publish post-rule work skipped after the same deadline."""
+        for stage in stages:
+            if stage not in self.stages_not_run:
+                self.stages_not_run.append(stage)
+
     def step(self, label: str) -> None:
         """Announce an uncounted stage inside the pass.
 

{sourcecode-5.9.24 → sourcecode-5.9.25}/src/sourcecode/security_posture.py

@@ -819,6 +819,7 @@ def infer_security_posture(
     root: Optional[Path] = None,
     coverage_threshold: float = _DEFAULT_COVERAGE,
     filter_surface: Optional[Any] = None,
+    stop_when: Optional[Any] = None,
 ) -> SecurityPostureResult:
     """Infer the repo's endpoint security posture (P1-A).
 
@@ -849,7 +850,9 @@ def infer_security_posture(
         str(root) if root is not None else None,
         coverage_threshold,
     )
-    _memoizable = filter_surface is None and _memo_key[0]
+    # A deadline-bound projection can be partial and is run-specific. It must
+    # never be served or retained as a complete posture in a later invocation.
+    _memoizable = filter_surface is None and _memo_key[0] and stop_when is None
     if _memoizable and _memo_key in _POSTURE_MEMO:
         return _POSTURE_MEMO[_memo_key]
 
@@ -919,6 +922,14 @@ def infer_security_posture(
         except Exception:
             degraded_identity = []
 
+    def _budget_spent() -> bool:
+        if stop_when is None:
+            return False
+        try:
+            return bool(stop_when())
+        except Exception:
+            return False
+
     # (4) per-endpoint classification
     handler_ann = _handler_annotation_index(cir)
     verdicts: list[dict] = []
@@ -934,7 +945,13 @@ def infer_security_posture(
     n_gated = 0            # carries the detected custom gate
     n_standard_only = 0    # no custom gate, but a standard guard of its own
 
-    for ep in cir.endpoints:
+    _budget_cut = _budget_spent()
+    for _endpoint_index, ep in enumerate(cir.endpoints, start=1):
+        if _budget_cut or (
+            _endpoint_index % 64 == 0 and _budget_spent()
+        ):
+            _budget_cut = True
+            break
         policy = ep.security.policy if ep.security is not None else "none_detected"
         anns = handler_ann.get(ep.handler_symbol, set())
         carries_gate = bool(anns & admitted_gate_names)
@@ -1021,11 +1038,20 @@ def infer_security_posture(
         "This surface assumes the profile set it was run under — "
         + _profile_remedy.sentence(),
     ]
+    if _budget_cut:
+        population = dict(population)
+        population["endpoints_evaluated"] = len(verdicts)
+        population["analysis_complete"] = False
+        limitations.append(
+            "PARTIAL: the analysis budget stopped endpoint security-posture "
+            f"classification after {len(verdicts)} of {len(cir.endpoints)} "
+            "endpoints. Unlisted endpoints are unmeasured, never unprotected."
+        )
     operational_hints: list[str] = []
     _how_to_run = _profile_remedy.to_dict(root).get("how_to_run_here")
     if isinstance(_how_to_run, str) and _how_to_run:
         operational_hints.append(_how_to_run)
-    if has_custom_gate:
+    if has_custom_gate and not _budget_cut:
         limitations.append(
             "A custom authorization mechanism was inferred — endpoints not carrying "
             "it are reported 'coverage_unknown', never 'unsecured'."
@@ -1046,7 +1072,7 @@ def infer_security_posture(
     # a centralized filter (if present) MAY still cover them — its per-URL patterns are
     # not reconstructed in this increment, so the verdict is review, never "unsecured".
     gate_coverage: Optional[dict] = None
-    if has_custom_gate:
+    if has_custom_gate and not _budget_cut:
         # Reconstruct declarative servlet filter patterns (extractor; best-effort) and
         # cross each escaping handler against them. A match => the handler MAY be filter-
         # covered (still review — pattern presence is not proof of enforcement); no match

{sourcecode-5.9.24 → sourcecode-5.9.25}/src/sourcecode/selftest.py

@@ -954,6 +954,25 @@ def run_selftest(
     counts = {status: 0 for status in (PASS, FAIL, NOT_APPLICABLE, ERROR)}
     for result in results:
         counts[result["status"]] = counts.get(result["status"], 0) + 1
+    limitations: list[dict[str, Any]] = []
+    if counts[ERROR]:
+        limitations.append({
+            "id": "selftest_rows_not_run",
+            "reason": f"{counts[ERROR]} ledger row(s) could not run",
+            "count": counts[ERROR],
+        })
+    if counts[FAIL]:
+        limitations.append({
+            "id": "selftest_rows_failed",
+            "reason": f"{counts[FAIL]} ledger assertion(s) did not hold",
+            "count": counts[FAIL],
+        })
+    if unknown:
+        limitations.append({
+            "id": "selftest_unknown_rows",
+            "reason": "requested ledger rows do not exist",
+            "rows": unknown,
+        })
     return {
         "schema_version": SCHEMA_VERSION,
         "subject": subject.as_payload(),
@@ -963,6 +982,7 @@ def run_selftest(
             **counts,
             "unknown_rows": unknown,
         },
+        **({"limitations": limitations} if limitations else {}),
         "basis": (
             "Each row is the acceptance criterion its ledger entry publishes, run "
             "against this repository through the entry point named above. A row "