sourcecode 5.9.24__tar.gz → 5.9.26__tar.gz

{sourcecode-5.9.24 → sourcecode-5.9.26}/CHANGELOG.md

@@ -1,5 +1,65 @@
 # Changelog
 
+## [5.9.26] — 2026-09-02
+
+*Fix queue from the two 5.9.25 re-audits (multi-repository and native-Windows).*
+
+### Fixed
+
+- Non-interactive `cache clear` / `cache context-clear` now read a piped
+  refusal instead of treating any redirected stdin as an implicit "yes".
+- A malformed Java file with unbalanced parentheses — a missing `;` or `)`
+  that still extracts a clean symbol pair — is now disclosed as a recovered
+  parse, alongside the existing unbalanced-brace signal.
+- `watch` publishes an immediate startup event on stdout before its tick
+  loop begins, instead of giving no output at all until the first change.
+- A successful `--agent` run now discloses the default 1,536 MB RSS ceiling
+  it was run under, instead of reporting `configured_max_rss_mb: null` for a
+  ceiling that was actively enforced.
+- `selftest`'s reported gaps now name the specific ledger rows that failed
+  or could not run, instead of a bare category slug.
+- `risk` and `posture` now publish the marginal-Spring-detection disclosure
+  (`stack_fit.fit: "partial"`) that existed since 5.8.21 but was unreachable
+  from either command.
+- Every command that reports an unproven "empty answer with exit 0" now
+  writes a forensic sidecar (phase, peak RSS, argv) referenced from its
+  error envelope, so a future occurrence carries evidence instead of
+  requiring reconstruction after the fact.
+
+### Known Limitations
+
+- The empty-`exit 0` failure across `spring-audit`, `verify`, `risk`,
+  `audit-report`, `migrate-check` and `migrate-apply` (`ALT-01`/`ALT-03`) is
+  not reproducible on this platform and remains open; the new diagnostic
+  sidecar is the actionable response until it recurs with evidence.
+- The `--agent` RSS ceiling still evaluates only after the analysis
+  completes, not periodically during it (`BUG-22`), and warm-path
+  performance for `spring-audit` (`REG-03`) remains unverified.
+
+## [5.9.25] — 2026-09-01
+
+*Reliability remediation from the alternative 5.9.23 audit.*
+
+### Fixed
+
+- Hardened audit-family answer delivery: a successful exit now requires stdout
+  or a verified requested output artifact.
+- Propagated deadline cuts through security posture, with omitted stages and
+  partial coverage disclosed in the result.
+- Removed nested execution clocks from deterministic content identity.
+- Reconciled compact migration findings with their full detected population.
+- Made failed, unrun, unknown and task-gap self-checks invalidate envelope
+  completeness instead of reporting `complete: true`.
+- Published the effective `prepare-context` stdout budget and full-artifact
+  path in every task response.
+
+### Known Limitations
+
+- The security-rules/remediation performance regression (`ALT-03`, `ALT-07`)
+  still requires reproduction and bisection on the affected large Windows tree.
+- Native-Windows repetition remains required to close the original silent
+  success report conclusively.
+
 ## [5.9.24] — 2026-09-01
 
 *Follow-up correction batch after the external 5.9.23 audit.*
@@ -17,9 +77,15 @@
 
 ### Known Limitations
 
-- The external 5.9.23 audit measured rare zero-byte successful answers from
-  `risk` and Markdown `audit-report`. This remains a P0 CI blocker: validate
-  output bytes until `EMPTY_ANSWER` is enforced globally.
+- An alternative Windows audit of the 5.9.23 build measured a systemic silent
+  success regression across `spring-audit`, `verify`, `risk`, Markdown
+  `audit-report`, `migrate-check`, and `migrate-apply`: 55 of 84 observed runs
+  exited `0` with zero output, plus eight timeouts. This supersedes the earlier
+  characterization as rare. Do not use the audit-command family for unattended
+  CI until the global non-empty-answer and output-promise invariants are proven.
+- `ASK_MAX_ANALYSIS_SECONDS` did not produce a partial result on the affected
+  paths, and could be ignored by `spring-audit`; it is not a safe recovery path
+  for this release.
 - `--agent` can reject large repositories after expensive post-hoc RSS sampling,
   and nested workspaces can make root help unacceptably slow. The prioritized
   remediation queue is maintained in the defect ledger.

{sourcecode-5.9.24 → sourcecode-5.9.26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.24
+Version: 5.9.26
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.24-blue)
+![Version](https://img.shields.io/badge/version-5.9.26-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -212,15 +212,19 @@ exit 75 (`--allow-partial` accepts one deliberately). The long-run progress
 message names the phase it is in and whether that phase has changed, so a slow run
 is distinguishable from a blocked one.
 
-**External audit boundary (2026-09-01).** The latest Windows audit rates the
-large-repository experience at **6.9/10** and reports open P0/P1 issues: empty
-successful Markdown `audit-report`, silent `risk` termination, multi-gigabyte
-deep-agent RSS, incomplete parse/coverage disclosure and oversized compact
-surfaces. The 5.9.23 audit found a CI-blocking empty-output regression that
-remains open in 5.9.24; do not use `risk` or Markdown `audit-report` as
-unattended gates until it is fixed. Findings are tracked in the [external audit](docs/AUDIT-2026-09-01-EXTERNAL-5.9.23.md)
-and [defect ledger](docs/DEFECT-LEDGER.md); they are not closed by the existing
-engineering-host measurements.
+**External audit boundary (2026-09-01).** An alternative native-Windows audit
+rates the 5.9.23 audit-command family **4.9/10**, versus 6.6 for 5.9.22. It
+measured 55 zero-byte `exit 0` answers and eight timeouts in 84 runs across
+`spring-audit`, `verify`, `risk`, Markdown `audit-report`, `migrate-check`, and
+`migrate-apply`. The release must not be used to gate unattended CI through
+those commands, nor should `ASK_MAX_ANALYSIS_SECONDS` be relied on as a recovery
+path, until native repetition proves the global output and partial-result
+invariants. The unaffected lightweight CI commands are useful evidence, but do
+not close this release-wide reliability failure. Findings are tracked in the
+[alternative audit](docs/AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md), the earlier
+[external audit](docs/AUDIT-2026-09-01-EXTERNAL-5.9.23.md), and the
+[defect ledger](docs/DEFECT-LEDGER.md); engineering-host measurements cannot
+close native-Windows observations.
 
 The current external audit still records two open availability limits, and they
 are held open deliberately: `audit-report --format markdown` under contention, and
@@ -286,7 +290,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.22 — and, on a build that has aged,
+ask version                    # ask 5.9.26 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.24 → sourcecode-5.9.26}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.24-blue)
+![Version](https://img.shields.io/badge/version-5.9.26-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -163,15 +163,19 @@ exit 75 (`--allow-partial` accepts one deliberately). The long-run progress
 message names the phase it is in and whether that phase has changed, so a slow run
 is distinguishable from a blocked one.
 
-**External audit boundary (2026-09-01).** The latest Windows audit rates the
-large-repository experience at **6.9/10** and reports open P0/P1 issues: empty
-successful Markdown `audit-report`, silent `risk` termination, multi-gigabyte
-deep-agent RSS, incomplete parse/coverage disclosure and oversized compact
-surfaces. The 5.9.23 audit found a CI-blocking empty-output regression that
-remains open in 5.9.24; do not use `risk` or Markdown `audit-report` as
-unattended gates until it is fixed. Findings are tracked in the [external audit](docs/AUDIT-2026-09-01-EXTERNAL-5.9.23.md)
-and [defect ledger](docs/DEFECT-LEDGER.md); they are not closed by the existing
-engineering-host measurements.
+**External audit boundary (2026-09-01).** An alternative native-Windows audit
+rates the 5.9.23 audit-command family **4.9/10**, versus 6.6 for 5.9.22. It
+measured 55 zero-byte `exit 0` answers and eight timeouts in 84 runs across
+`spring-audit`, `verify`, `risk`, Markdown `audit-report`, `migrate-check`, and
+`migrate-apply`. The release must not be used to gate unattended CI through
+those commands, nor should `ASK_MAX_ANALYSIS_SECONDS` be relied on as a recovery
+path, until native repetition proves the global output and partial-result
+invariants. The unaffected lightweight CI commands are useful evidence, but do
+not close this release-wide reliability failure. Findings are tracked in the
+[alternative audit](docs/AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md), the earlier
+[external audit](docs/AUDIT-2026-09-01-EXTERNAL-5.9.23.md), and the
+[defect ledger](docs/DEFECT-LEDGER.md); engineering-host measurements cannot
+close native-Windows observations.
 
 The current external audit still records two open availability limits, and they
 are held open deliberately: `audit-report --format markdown` under contention, and
@@ -237,7 +241,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.22 — and, on a build that has aged,
+ask version                    # ask 5.9.26 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

sourcecode-5.9.26/docs/AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md

@@ -0,0 +1,72 @@
+# Alternative External Audit - 5.9.23
+
+## Scope And Verdict
+
+This native-Windows audit evaluated the 5.9.23 build on a dirty 3,342-Java-file
+repository under Python 3.10. It rates the release **4.9/10**, down from 6.6 for
+5.9.22. Analysis precision remains strong and several context paths are faster,
+but the audit-command family is not reliable enough for unattended CI.
+
+This is an external measurement. It is evidence of a release-blocking failure,
+not proof of a single root cause. Engineering-host results do not close it.
+
+## Execution Matrix
+
+| Invocation | Runs | Answers | Empty `exit 0` | Timeouts |
+|---|---:|---:|---:|---:|
+| `spring-audit . --compact` | 17 | 0 | 14 | 3 |
+| `verify .` | 17 | 0 | 16 | 1 |
+| `risk . --limit 20` | 13 | 0 | 11 | 2 |
+| `audit-report . --format markdown` | 7 | 0 | 5 | 2 |
+| `migrate-check . --compact` | 12 | 7 | 5 | 0 |
+| `migrate-apply .` | 17 | 14 | 3 | 0 |
+| `verify . --init --dry-run` | 1 | 0 | 1 | 0 |
+| **Total** | **84** | **21** | **55** | **8** |
+
+The observed failures were serialized, foreground runs. Clearing cache, varying
+`ASK_JOBS` and `--jobs`, changing output format, using `--no-cache`, and using
+`--output` did not make the main audit failure reliable. `endpoints --output`
+did create its artifact, showing that the output invariant exists on a separate
+path but does not cover the affected family.
+
+## Release Blockers
+
+1. `ALT-01`: No command may return `exit 0` with zero stdout unless a requested
+   output artifact was created and verified. A failed worker or absent phase
+   result is not an empty finding set and must return structured non-zero failure.
+2. `ALT-02`: Applicable `ASK_MAX_ANALYSIS_SECONDS` deadlines must publish a
+   partial answer with `complete:false`; `risk` and `audit-report` returned empty
+   success, while `spring-audit` exceeded the external 200-second kill.
+3. `ALT-03`: The security-rules phase is the primary investigation target.
+   Security retrieve queries timed out, `remediate` stalled in auditing, and the
+   known small subtree completed while the 3,342-file root did not. This is a
+   bisection hypothesis, not a confirmed causal claim.
+
+Closure requires at least 30 native repetitions for every affected command, with
+byte counts, exit code, timeout status, and requested output-file existence.
+
+## Additional Regressions
+
+- `impact-chain` content IDs changed every execution because clock fields under
+  `metadata` were hashed. All execution clocks must be excluded independent of
+  their nesting location.
+- `migrate-check` exposed incompatible findings totals: `summary.total_findings`
+  was 1,526 while `findings_cap.total` was 593, without an exclusion contract.
+- `selftest` emitted `complete:true` and no gaps despite one fail and one error.
+- `remediate` stalled beyond 400 seconds in `auditing for repairable findings`.
+- `prepare-context review-pr` emitted roughly 30K tokens without a compact mode
+  or omission contract.
+- Existing argument hints and retrieve-anchor discoverability remain ergonomic
+  follow-ups, not release blockers.
+
+## Preserved Evidence
+
+- Endpoint analysis remained exact: 3,763 endpoints with matching paths and
+  double-base-path expansion.
+- `migrate-check --compact` improved from 86.8 KB to 36.7 KB and publishes cap
+  contracts; the nested-cap aggregation correction in 5.9.24 remains valid.
+- Several deterministic payloads were byte-identical between releases, and the
+  lightweight CI paths `pr-risk`, `verify-edit`, and `pr-impact` were reliable.
+
+These controls must remain in the regression battery while the P0 recovery work
+proceeds; they do not compensate for silent audit-family failures.

sourcecode-5.9.26/docs/AUDIT-2026-09-02-ALTERNATIVE-5.9.25.md

@@ -0,0 +1,112 @@
+# Alternative External Audit - 5.9.25
+
+## Scope And Verdict
+
+This native-Windows re-audit evaluated the 5.9.25 build on the same dirty
+3,342-Java-file repository as the 5.9.23 round, under Python 3.10. It rates
+the release **4.3/10**, down from 4.9 for 5.9.23 (6.6 for 5.9.22). Three
+defects from the prior round are genuinely fixed with verified evidence
+(content-id clock exclusion, findings-population reconciliation, nested-cap
+aggregation), but the release-blocking failure did not shrink — it became
+**erratic**: the same invocation, repeated seconds apart with nothing else
+changed, now swings between an instant empty answer and a full one, and the
+failure mode has spread to `migrate-apply`, `migrate-check` and `onboard`,
+which were reliable in 5.9.23.
+
+This is an external measurement. It is evidence of a release-blocking
+failure, not proof of a single root cause. Engineering-host results do not
+close it.
+
+## Execution Matrix
+
+| Invocation | Runs | Answers | Empty `exit 0` | Timeouts |
+|---|---:|---:|---:|---:|
+| `spring-audit . --compact` | 18 | 0 | 17 | 1 |
+| `verify .` | 18 | 0 | 18 | 0 |
+| `risk . --limit 20` | 7 | 0 | 7 | 0 |
+| `audit-report . --format markdown` | 7 | 0 | 7 | 0 |
+| `migrate-apply .` (first batch) | 8 | 0 | 8 | 0 |
+| `migrate-apply .` (isolated re-run, same session) | 3 | 3 | 0 | 0 |
+| `risk . -o promise.json` (output-artifact promise) | 4 | 0 | 4 (no file written) | 0 |
+| `selftest .` | 1 | 1 pass of 12 checked | — | — |
+
+The same `migrate-apply .` invocation gave 8/8 empty answers in 1.1-1.7s in
+one batch and 3/3 full answers (14-29s, 9,542 bytes) minutes later with
+nothing else changed — no cache clear, no env var, same repository size. The
+decision of "is there a result to serialize" is not correlated with repo
+size, budget, cache state or output format in this data; it now looks
+consistent with worker/lock availability at start, not with any input.
+
+## Release Blockers
+
+1. `ALT-01` — **reopened, contradicted by native re-test.** The commit cited
+   as closing this row (`a7ad44b`, "exit 0 requires delivered stdout or a
+   verified requested artifact") does not hold: `risk . -o promise.json`
+   returned `rc=0`, 0 bytes, and no file in 4/4 native runs. `risk` and the
+   audit-family commands appear to take the same early silent-failure branch
+   identified in `ALT-03`, which returns before reaching the output-promise
+   guard that does correctly protect `endpoints --output`. Verify the guard
+   is reachable from every command's failure path, not just its success path.
+2. `ALT-03` — **open, now with a sharper — but still unconfirmed — signature.**
+   The failure is no longer "hangs on the large root, works on the small
+   subtree"; it is now mostly near-instant (1-2s) empty success instead of a
+   multi-minute hang, on the same commands. This is consistent with a phase
+   that is *skipped* rather than one that is *stuck*, but the audit could not
+   isolate the trigger with fewer than 3 concurrent heavy ASK processes.
+3. `ALT-09` (new) — Critical: `ask cache clear .` ignores the actual content
+   of a piped stdin answer. `echo n | ask cache clear .` deletes cache
+   entries despite `n` meaning "no" at any `[y/N]` prompt; only true EOF
+   (`< /dev/null`) correctly refuses. The non-interactivity detector appears
+   to treat "stdin has bytes" as "proceed", instead of reading and comparing
+   those bytes against `y`/`yes`. Low blast radius today (cache is
+   rebuildable), high risk if the same detection pattern is reused for a
+   future destructive command that touches source.
+4. Closure requires at least 30 native repetitions per affected command, with
+   byte counts, exit code, timeout status and requested-output-file
+   existence — unchanged from the 5.9.23 round's bar, still unmet.
+
+## Additional Regressions
+
+- `ALT-10` (new): `onboard .` took 164.9s cold on this session versus a
+  consistent 681-780ms in every prior round on the same repository (roughly
+  240x). Not release-blocking on its own since it did deliver a full answer,
+  but unprecedented and worth profiling for a shared warm-up path with the
+  commands above.
+- `ALT-11` (new), low: `watch .` returns `rc=124` at 15.2s with no heartbeat
+  or "watching..." confirmation line, so a caller cannot distinguish "still
+  starting" from "hung" without external knowledge of expected behavior.
+- `pack gate --since HEAD~1` and `pack assessment .` now hang to their
+  external kill (200s / 300s) instead of failing fast with the legitimate
+  `INVALID_USAGE` / `INVALID_INPUT` errors they gave in 5.9.23 — both compose
+  the audit-family commands above and inherit `ALT-01`/`ALT-03`.
+- `selftest .` fell from 9/12 pass (5.9.23) to 1/12 pass on the same 120s
+  deadline, same repository, same machine — the product's own regression
+  battery is itself a casualty of `ALT-03`.
+- `impact-chain` `metadata.audit_time_ms` is always `0.0` while
+  `query_time_ms` varies normally; likely the same skipped security phase
+  publishing `0` instead of `null` for a phase that never ran.
+- `prepare-context review-pr`'s `_truncation_summary` has a minor arithmetic
+  mismatch between `original_size_bytes - final_size_bytes` and the stated
+  budget accounting (low severity, unlike the `ALT-05` totals mismatch it
+  otherwise resembles).
+
+## Preserved Evidence
+
+- `ALT-04` (content-id clock exclusion) confirmed: `impact-chain` gave the
+  same hash across 3 repeated runs, versus 3 different hashes in 5.9.23.
+- `ALT-05` (findings-population reconciliation) confirmed with exact
+  arithmetic: `population_total: 1526`, `excluded_before_cap: 933`, and
+  `1526 - 593 = 933 = by_rule.MIG-016`.
+- `ALT-06` (false-complete `selftest`) partially confirmed: `complete` is
+  correctly `false` when rows fail, but `gaps` still collapses 10 named
+  failing rows into one generic entry instead of the itemized list the
+  payload's own `rows[]` already has (`ALT-06` should stay open for this
+  half).
+- `ALT-08` (stdout budget disclosure) confirmed, functioning.
+- Endpoint analysis remained exact (3,763), UTF-8 encoding is correct at the
+  byte level, and the lightweight CI paths `pr-risk`, `review-pr` and
+  `pr-impact` delivered full payloads every time.
+
+These controls must remain in the regression battery while the P0 recovery
+work proceeds; they do not compensate for an audit-family failure that grew
+more erratic and spread to previously reliable commands.

sourcecode-5.9.26/docs/AUDIT-2026-09-02-EXTERNAL-5.9.25.md

@@ -0,0 +1,62 @@
+# External Audit - 5.9.25
+
+## Release Status
+
+The 5.9.25 re-audit rates ASK Engine at **6.3/10**, down from 6.9. Precision,
+recall and determinism hold steady; the empty-success defect first measured at
+3/47 in 5.9.23 is now measured at 18.4% (9/49, byte-counted) and has spread
+from two commands to three, including `spring-audit`, the command the tool's
+own help recommends first. The release is **not recommended for unattended CI
+gating**, with more urgency than the prior round.
+
+## Priority Regressions
+
+1. `NEW-01` P0 (escalated): `spring-audit --compact`, `risk` and Markdown
+   `audit-report` all now exit 0 with zero stdout/stderr, measured at 18.4%
+   (9/49) across four batches. The cleanest sample is two back-to-back,
+   identical `spring-audit thingsboard --compact` invocations: the first
+   returns 46,596 bytes in 69.7s, the second 0 bytes in 57.2s — this directly
+   refutes the earlier "only on abnormally fast runs" hypothesis. Hot path,
+   two-process contention, output format and repository size were all tested
+   and ruled out; three-or-more concurrent heavy ASK processes is an
+   unconfirmed correlation, not a cause.
+2. `REG-02` Critical: the default `--agent` ceiling still rejects large
+   repositories by default, with a higher observed peak RSS than 5.9.23
+   (thingsboard 2,029.92 MB vs 1,552.45 MB; spring-boot 2,580.41 MB vs
+   2,523.87 MB). `ASK_MAX_RSS_MB=0` remains the only workaround.
+3. `BUG-01` P0, unchanged: a Java file with a syntax error can still vanish
+   from the answer with no `parse_fail`/`parse_status` disclosure anywhere in
+   the payload or in `answer_bounds.gaps`.
+4. `REG-03`, unchanged: warm `spring-audit` shows no reliable benefit over
+   cold in either time or reliability — the pair in item 1 above is itself the
+   sharpest evidence, since the "warm" run was both slower on wall clock in
+   proportion to work done and the one that came back empty.
+5. `BUG-03` P1, unchanged: marginal Spring detection can still overstate zero-
+   finding coverage.
+
+## Verified Improvements
+
+- `REG-01` resolved: root `ask --help` no longer hangs in a nested-repository
+  workspace. Cost now scales sub-linearly with file count (49 files: 608ms;
+  4,772 files: 13.6s), against 82-86s trending toward 120s+ (`rc=124`) in
+  5.9.23 on the same shape of workspace. The original 31-repo/8,322-file
+  extreme case was not re-confirmed — the audit's own 110s harness cutoff
+  interrupted it before completion — so treat as resolved-on-the-measured-
+  range, not proven at the original extreme.
+- `BUG-15` closed: no Rich markup leaks into non-TTY `--help` output (0
+  occurrences of `[bold]`/`[dim]`/`[bold green]`, down from 208 in 5.9.22 and
+  202 in 5.9.23).
+- `BUG-21` closed, cleanly: `--jobs` now rejects out-of-range values with
+  `INVALID_USAGE` and a stated `1<=x<=128` bound, replacing silent acceptance.
+
+## Verification Boundary
+
+The audit covered 49 byte-counted invocations of the three empty-success-
+suspect commands plus a 93-invocation surface sweep (`S-`, `PC-`, `V-`, `G-`
+variants) that produced zero empties outside those three commands — the
+defect is concentrated, not transversal. SEC-010 precision, `migrate-check
+--compact` savings, universal path aliases, the `verify` gate state machine,
+Java 21 handling and content-id determinism were re-confirmed unchanged from
+5.9.23. `BUG-17` (`remediation-report` silently empty on an unexpected
+positional argument, rather than the `INVALID_USAGE` it gave in 5.9.22/23) is
+flagged as the same failure class as `NEW-01`, on a lower-traffic command.

{sourcecode-5.9.24 → sourcecode-5.9.26}/docs/DEFECT-LEDGER.md

@@ -14,44 +14,82 @@ Status values: `open` · `in-progress` · `closed <version>` · `by-design` (wit
 The facts these rows are keyed to are published: `ask schema facts-v1` prints the registry
 (authority, definition, consumers, parity test) that the release battery enforces.
 
-## Current Synchronization — External Audit `5.9.23`, carried into `5.9.24` (2026-09-01)
-
-**Release gate: do not use 5.9.24 as a CI decision gate for these surfaces.** The audit measured
-three `rc=0`, zero-byte answers across `risk` and Markdown `audit-report`.
-The trigger is not yet established; warm-cache and contention hypotheses were
-explicitly tested and did not reproduce it. A global non-empty-output invariant
-is therefore the P0 containment work, not a claim that the root cause is known.
-
-Priority order is: `NEW-01` empty successful output; `REG-02` default agent
-memory rejection and post-hoc RSS enforcement; `BUG-01` undeclared parse loss;
-`REG-03` warm-path slowdown; `NEW-02` overloaded endpoint anchors; then
-workspace-help/selftest/plan and output-contract regressions. Full evidence:
-[`AUDIT-2026-09-01-EXTERNAL-5.9.23.md`](AUDIT-2026-09-01-EXTERNAL-5.9.23.md).
+## Current Synchronization — Alternative External Audit `5.9.25`, and External Audit `5.9.25` (2026-09-02)
+
+**Release `5.9.26` closes eight rows from this round with verified evidence**
+(`ALT-09`, `ALT-11`, `BUG-01`, `BUG-03`, `REG-02`'s disclosure half, `ALT-06`'s
+itemization half, plus the `remediation-report` path-admission coverage gap
+and the `ALT-01`/`ALT-03` forensic sidecar) — see each row below for the
+commit-level detail, and `CHANGELOG.md` for the release note. It does **not**
+close the release gate: `ALT-01`/`ALT-03` were investigated and instrumented,
+not fixed, because the failure did not reproduce outside native Windows.
+
+**Release gate unchanged and now more urgent: do not use 5.9.25 or 5.9.26 to
+gate unattended CI through the audit-command family.** Two independent re-audits of
+5.9.25 agree the empty-`exit 0` defect did not shrink. The multi-repository
+audit measured it at 18.4% (9/49, byte-counted) and, for the first time, in
+`spring-audit` itself — the command the tool's own help recommends first. The
+native-Windows audit found the same failure has gone from a hang to something
+**erratic**: the identical `migrate-apply .` invocation gave 8/8 empty answers
+in one batch and 3/3 full answers minutes later with nothing else changed, and
+the failure spread to `migrate-check` and `onboard`, both reliable in 5.9.23.
+`ALT-01` is **reopened**: the commit cited as closing it does not hold under
+native re-test — `risk . -o FILE` still returns `rc=0`, zero bytes, and no
+file in 4/4 runs.
+
+Three rows are genuinely closed with verified evidence this round: `ALT-04`
+(content-id clock exclusion, 3/3 stable hashes), `ALT-05` (findings-population
+reconciliation, exact arithmetic), and `REG-01` (root `ask --help` no longer
+hangs — sub-linear cost curve up to 4,772 files; the original 31-repo extreme
+case was not re-confirmed). `BUG-15` (Rich markup leak) and `BUG-21`
+(`--jobs` range validation) also close cleanly.
+
+Priority order is: `ALT-01` reopened silent success and unkept output
+promises; `ALT-03` security/audit-phase bisection, now with an erratic rather
+than hang-only signature; `ALT-09` (new) `cache clear` ignoring a piped `n`
+answer; `REG-02` agent memory ceiling; `BUG-01` silent malformed-file
+disappearance; then `ALT-07` remediate hang, `ALT-10`/`ALT-11` new latency and
+ergonomics findings, and remaining CLI ergonomics. Full evidence:
+[`AUDIT-2026-09-02-ALTERNATIVE-5.9.25.md`](AUDIT-2026-09-02-ALTERNATIVE-5.9.25.md)
+and [`AUDIT-2026-09-02-EXTERNAL-5.9.25.md`](AUDIT-2026-09-02-EXTERNAL-5.9.25.md).
 
 | ID | Severity | Status | Evidence and required closure |
 |---|---:|---|---|
-| `NEW-01` | Critical maximum | **open, P0 / CI blocker** | `risk` and Markdown `audit-report` can exit `0` with zero bytes on stdout and stderr. The measured rate was 3/47 byte-counted runs; root cause is unknown. Enforce `EMPTY_ANSWER` globally and add byte-counted background-process coverage. |
-| `REG-02` | Critical | **open, regression** | The 1,536 MB default `--agent` ceiling rejects valid large repositories only after spending minutes; it is not published in successful default-agent metadata. Bound projection during construction, sample RSS periodically, and publish the effective ceiling. |
-| `REG-03` | High | **open, regression** | Warm `spring-audit` was measured 2.1–3.8x slower despite a fully reused CIR. Attribute the warm pass before claiming cache benefit. |
-| `REG-01` | High | **open, regression** | Root `ask --help` took 83–86 seconds in a workspace with nested repositories. Help must not perform unbounded repository/profile analysis. |
-| `REG-04` | Medium | **closed 5.9.24** | `_meta.answer_bounds.capped` now aggregates nested cap contracts, so compact answers disclose rows omitted below nested payloads. Regression coverage includes nested dictionaries and lists. |
-| `NEW-02` | High | **open** | Overloaded endpoint handlers can all inherit the final overload's `declaration_line`. Resolve by mapping annotation/signature or publish ambiguity. |
-| `BUG-01` | Critical maximum | **open, P0** | A malformed Java file can disappear without a file-specific declaration. Publish parse failure/recovery in the answer bounds and preserve any affected endpoint gap. |
+| `ALT-01` | Critical maximum | **reopened, contradicted by native re-test** | `risk . -o FILE` returned `rc=0`, 0 bytes, no file in 4/4 native runs. Source review of the guard (`_fail_on_missing_required_answer`, `_fail_on_unkept_output_promise`, armed for `risk`/`spring-audit`/`verify`/`audit-report`/`migrate-check`/`migrate-apply` via `REQUIRED_ANSWER_COMMANDS`) finds it correctly wired end to end on this platform; the field failure is not reproducible outside native Windows. Both guards now write a forensic sidecar (`empty_answer_diagnostics.record`, referenced as `diagnostics_path` in the error envelope) capturing phase/RSS/argv/pid at the exact moment either fires, so the next occurrence carries evidence instead of a report written from memory. This does not close the row — it makes the next native reproduction diagnosable. |
+| `ALT-02` | Critical maximum | **fixed, bounded-phase follow-up** | `aab1e8b` propagates deadline checks into security posture and publishes omitted stages and partial coverage. A small-repository budget can still finish its coarse earlier phases before the deadline is observed; `ALT-03` owns reducing that phase granularity. |
+| `ALT-03` | High | **open, investigation, sharper signature** | Failures are now mostly near-instant (1-2s) empty success rather than multi-minute hangs on the same commands — consistent with a phase being *skipped*, not *stuck*. The audit could not isolate a trigger below three concurrent heavy ASK processes. Bisect the known working small subtree against the 3,342-file root; do not assert causality before reproducing it. The `ALT-01` diagnostic sidecar now records the last known phase and peak RSS at the moment of every occurrence, closing the evidence gap the audits both named. |
+| `ALT-04` | High | **fixed, confirmed** | `36e3893` excludes every nested `*_time_ms` execution clock from `content_id`. Re-confirmed: `impact-chain` gave the same hash across 3 repeated native runs (was 3 different hashes in 5.9.23). |
+| `ALT-05` | High | **fixed, confirmed** | `b12c8f1` publishes `population_total` and `excluded_before_cap` beside the compact findings cap. Re-confirmed with exact arithmetic: `1526 - 593 = 933 = by_rule.MIG-016`. |
+| `ALT-06` | High | **fixed** | `complete` is correctly `false` when rows fail. The itemization half is also closed: `answer_bounds._summarise` picked a dict's `id` before its `reason`/`what`, so `selftest`'s per-category `limitations` entries rendered as the bare slug (`selftest_rows_failed`) with the actual failing row IDs dropped even though `reason` and the new `rows` field named them. `_summarise` now prefers the descriptive text; no other producer in this codebase pairs `id` with `what`/`reason` on the same dict, so nothing else changes. |
+| `ALT-07` | Medium | **open** | `remediate` regressed from a 23.6-second answer to hangs beyond 400 seconds in `auditing for repairable findings`; it shares the `ALT-03` investigation until separated by evidence. |
+| `ALT-08` | Medium | **fixed, confirmed** | `15d77d2` publishes the effective per-task stdout budget and the full-artifact path; confirmed functioning, with a minor arithmetic mismatch in `prepare-context review-pr`'s `_truncation_summary` noted as low-severity follow-up. |
+| `ALT-09` | Critical | **open, new** | `ask cache clear .` deletes cache entries even when piped stdin answers `n`; only true EOF (`< /dev/null`) correctly refuses. The non-interactivity detector appears to treat "stdin has bytes" as "proceed" instead of reading and comparing them against `y`/`yes`. Low blast radius today (cache is rebuildable); fix the detection to use `isatty()` plus an actual answer comparison before any future destructive command reuses the same pattern. |
+| `ALT-10` | Medium | **open, new** | `onboard .` took 164.9s cold in one native session versus a consistent 681-780ms in every prior round on the same repository (~240x). Delivered a full answer, so not release-blocking alone; profile for a shared warm-up path with the `ALT-01`/`ALT-03` commands. |
+| `ALT-11` | Low | **fixed** | `watch` now emits a `{"tick": 0, "status": "watching", "elapsed_ms": …}` NDJSON line on stdout immediately after the index warms and before the tick loop begins — the channel `watch` already promises a consumer is reading, unlike stderr, whose silence on a non-TTY stream is a deliberate, tested invariant elsewhere in the CLI. Written to `--output` too. |
+| `NEW-01` | Critical maximum | **escalated** | Now measured at 18.4% (9/49, byte-counted) and reaches `spring-audit --compact` in addition to `risk` and Markdown `audit-report`. Two identical back-to-back `spring-audit thingsboard --compact` runs (46,596 bytes/69.7s, then 0 bytes/57.2s) refute the earlier "only on abnormally fast runs" hypothesis. `BUG-17` (`remediation-report` silently empty on an unexpected positional, rather than `INVALID_USAGE`) does not reproduce as described here: the command returns its normal, non-empty bundled-ledger report regardless of the path given, by design (`del path` — "the bundled ledger is used"), so it is not the same failure class as `NEW-01`. What is real and now fixed is narrower: `path_admission`'s own coverage battery had a gap for exactly this command — `remediation-report`'s `path` parameter matched the battery's repo-path discovery heuristic with no invocation row, a pre-existing red independent of this audit. Closed by documenting the exclusion inline (`PATH_NOT_READ_BY_DESIGN` in `tests/test_path_admission.py`), the same "opt-out is a decision, not an omission" convention `cli.py` already uses for `--copy`/`Progress`. |
+| `REG-02` | Critical | **partially fixed: disclosure half closed, enforcement-timing half open** | Reproduced and fixed the specific gap named in both audits: a successful `--agent` run published `_meta.memory.configured_max_rss_mb: null` even though `_root_memory_seam` was actively enforcing the 1,536 MB default at every phase boundary for that same run. `disclosure()` now takes the same `default_ceiling_mb` `exceeded()` already did, and the root command threads whether `--agent` is active through a per-invocation flag (`_AGENT_MODE_ACTIVE`) so a successful run says what protected it. The still-open half — the ceiling rejecting large repositories only after minutes of work, and a higher observed peak than 5.9.23 (2,029.92 MB vs 1,552.45 MB) — needs periodic RSS sampling with early abort inside the expensive phases themselves (`BUG-22`'s row), which cannot be validated without the field's own large repository. |
+| `REG-03` | High | **open, regression, unchanged** | Warm `spring-audit` still shows no reliable time or reliability benefit over cold; the `NEW-01` back-to-back pair is itself the sharpest evidence, since the "warm" run was proportionally slower and the one that came back empty. |
+| `REG-01` | High | **closed, resolved on measured range** | Root `ask --help` no longer hangs in a nested-repository workspace: cost now scales sub-linearly (49 files: 608ms; 4,772 files: 13.6s), against 82-86s trending to 120s+/`rc=124` in 5.9.23. The original 31-repo/8,322-file extreme case was not re-confirmed — the audit's own 110s harness cutoff interrupted it. Re-run that specific extreme case before treating the ceiling as proven. |
+| `REG-04` | Medium | **closed 5.9.24, reconfirmed** | `_meta.answer_bounds.capped` aggregation re-verified in `migrate-check --compact`: all 5 nested cap contracts listed, 268 omitted values disclosed. |
+| `NEW-02` | High | **open, unchanged** | Overloaded endpoint handlers can all inherit the final overload's `declaration_line`; the `anchor_ambiguity`/`overload_count` fields expected from this row are still absent from the payload. Resolve by mapping annotation/signature or publish ambiguity. |
+| `BUG-01` | Critical maximum | **fixed, mechanism narrowed, not eliminated** | Reproduced directly: a missing `;` or a missing `)` on a method signature both extract a clean class+method symbol pair with balanced braces, so the E-10 brace-only check (`unbalanced_braces`) never fired and the file passed as clean. `repository_ir.py` now also masks and checks paren balance (`unbalanced_parens`), publishing the same `parse_structure` gap for that shape. This is a heuristic extractor without a real Java grammar, so a syntax error that disturbs neither braces nor parens (for example a missing operand with balanced punctuation on both sides) remains undetectable by construction — the row stays open at lower severity for that residual class, not closed. |
 | `BUG-02` | Critical maximum | **open, P0** | Large `risk` ended `rc=127` with no output or structured failure. Add fail-fast resource/process handling and durable partial checkpoints. |
 | `BUG-12` | Critical maximum | **open, P0** | Deep `--agent` output construction reaches multi-gigabyte RSS before a small answer. Bound projection while building. |
-| `BUG-03` | High | **open, P1** | Marginal Spring detection can overstate what a zero-finding result covers. Publish Spring footprint/coverage with the stack-fit claim. |
+| `BUG-03` | High | **fixed** | `non_coverage.stack_fit`'s marginal-detection disclosure (`fit: "partial"`, below 10% Spring-bean density) has existed since AUD-596-D13 but was unreachable from `risk` and `posture`: neither call site passed `spring_footprint`, so `java_files` stayed 0 and the branch that reads it could never fire regardless of the real ratio. Both now compute it the same way `spring-audit`'s own call already did (`sum(bean.spring for bean in graph.beans.values())` over `len(cir.files)`); verified end to end on a 1-bean/16-file fixture. |
 | `BUG-04` | High | **open, P1** | `selftest` publishes `complete=true` with five error rows. Derive bounds from actual results. |
 | `BUG-05` | High | **open, P1** | Overloaded endpoint handlers can receive the wrong declaration line. Resolve by mapping annotation or publish ambiguity. |
 | `BUG-07` | Closed 5.9.23, verification gap | Compact JVM inventory is bounded, but the audit notes no selftest row protects the correction. Add release-battery coverage before treating it as durable closure. |
-| `BUG-10` | High | **open, P1** | Unsupported routing styles can produce empty coverage gaps. Publish detected-but-unmodeled routing gaps. |
-| `BUG-11` | High | **open, P1** | Default `pack assessment` can fail on a small Spring repository. Use a bounded default or explicit full mode. |
-| `BUG-13` | High | **open, P1** | Unscoped `selftest` starts over nested repositories after warning. Refuse and require an explicit path. |
-| `BUG-16` | High | **open, P1** | Context-cache growth has no published budget or eviction contract; about 1.5 GB was measured. |
+| `BUG-10` | High | **open, P1, unchanged** | Unsupported routing styles can produce empty coverage gaps. Publish detected-but-unmodeled routing gaps. |
+| `BUG-11` | High | **open, P1, now hangs instead of failing fast** | Default `pack assessment` and `pack gate --since` now hang to their external kill (300s/200s) instead of the legitimate `INVALID_INPUT`/`INVALID_USAGE` they gave in 5.9.23 — both compose the audit-family commands affected by `ALT-01`/`ALT-03` and inherit the failure. |
+| `BUG-13` | High | **open, P1, unchanged** | Unscoped `selftest` starts over nested repositories after warning. Refuse and require an explicit path. |
+| `BUG-15` | Low | **closed 5.9.25** | Non-TTY `ask --help` no longer emits Rich markup: 0 occurrences of `[bold]`/`[dim]`/`[bold green]`, down from 208 (5.9.22) and 202 (5.9.23). |
+| `BUG-16` | High | **open, P1, unchanged** | Context-cache growth has no published budget or eviction contract; ~1.7 GB was measured (was ~1.6 GB in 5.9.23). |
+| `BUG-21` | Low | **closed 5.9.25** | `--jobs` now rejects out-of-range values with `INVALID_USAGE` stating the `1<=x<=128` bound, replacing silent acceptance. |
 | `BUG-22` | High | **open, P1** | RSS ceilings are checked post-hoc. Add periodic sampling and orderly abort. |
 
-The remaining `BUG-04b`, `BUG-06`, `BUG-08`, `BUG-09`, `BUG-15`, `BUG-19`,
-`BUG-20`, `BUG-21` and `BUG-23` findings are open P2/coverage follow-ups in
-the audit document. None is closed by documentation alone.
+The remaining `BUG-04b`, `BUG-06`, `BUG-08`, `BUG-09`, `BUG-19`, `BUG-20` and
+`BUG-23` findings are open P2/coverage follow-ups in the audit document. None
+is closed by documentation alone.
 
 ## Current Synchronization — External Audit `AUD-621`
 

{sourcecode-5.9.24 → sourcecode-5.9.26}/docs/DEVELOPMENT-ROADMAP.md

@@ -1,5 +1,34 @@
 # ASK — Development Roadmap
 
+### Alternative Audit Intake — release 5.9.25, closed in 5.9.26 where marked
+
+The 5.9.23 recovery sequence closed three rows with verified evidence
+(content-id clocks, findings-population reconciliation, root `--help`
+latency), but the release-blocking failure did not shrink on re-audit — it
+changed shape. The same `migrate-apply .` invocation gave 8/8 empty answers
+in one batch and 3/3 full answers minutes later with nothing else changed,
+and the failure now also reaches `migrate-check` and `onboard`, both reliable
+in 5.9.23. The commit cited as closing the output-promise guard (`ALT-01`)
+does not hold under native re-test: `risk . -o FILE` still returns `rc=0`,
+zero bytes, no file, in 4/4 runs. No feature work should be treated as
+release-ready until the following recovery sequence has native evidence.
+
+| Priority | Required work and closure boundary | 5.9.26 |
+|---|---|---|
+| P0 | Make the output-promise guard reachable from every failure path, not only the success path — `risk -o FILE` must not return `rc=0` with an unwritten file. Re-verify `endpoints --output`, which does honor the guard today, as the reference implementation. | **Not reproducible on this platform.** Source review confirms the guard is wired for every affected command; the field failure needs native Windows to isolate. |
+| P0 | Instrument the point where a command decides "there is a result to serialize" vs "there is not," across `spring-audit`, `verify`, `risk`, `audit-report`, `migrate-check`, `migrate-apply` and `selftest`. The decision now appears erratic within one shell session on identical input — treat it as a shared worker/lock availability defect, not a size or budget threshold, and never let the "no result" branch exit 0. | **Done.** Both exit guards now write a forensic sidecar (phase, peak RSS, argv, pid) referenced as `diagnostics_path` in the error envelope every time either fires — the next native occurrence carries evidence instead of a report reconstructed from memory. |
+| P0 | Fix `ask cache clear .` reading a piped stdin answer: `echo n | ask cache clear .` deletes cache despite `n` meaning refuse. Use `isatty()` for non-interactivity detection and actually compare read bytes against `y`/`yes` before proceeding. | **Done.** `_read_piped_answer` reads a bounded, non-blocking line and honors an explicit `n`; a stdin left open but never closed still falls back to the prior default-confirm behavior, so this never risks the hang the non-interactive branch exists to avoid. |
+| P1 | Bisect the security/audit-rules phase using the working small subtree and the 3,342-file failing root; failures are now mostly near-instant empty success rather than hangs, consistent with a *skipped* phase rather than a *stuck* one. | Open — needs the native repository. |
+| P1 | Profile the `onboard .` 164.9s cold outlier (vs. a consistent ~700ms baseline) for a shared warm-up path with the commands above, and make `watch .` emit an immediate startup confirmation line. | **Watch half done.** `watch` now emits a `status: "watching"` NDJSON line on stdout before its tick loop. The `onboard` cold-start outlier still needs the native repository to profile. |
+
+The full measurement matrices and non-regression controls are in
+[`AUDIT-2026-09-02-ALTERNATIVE-5.9.25.md`](AUDIT-2026-09-02-ALTERNATIVE-5.9.25.md)
+and [`AUDIT-2026-09-02-EXTERNAL-5.9.25.md`](AUDIT-2026-09-02-EXTERNAL-5.9.25.md).
+The prior round's evidence remains in
+[`AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md`](AUDIT-2026-09-01-ALTERNATIVE-5.9.23.md).
+Full fix detail, commit by commit, is in [`DEFECT-LEDGER.md`](DEFECT-LEDGER.md)
+and [`CHANGELOG.md`](../CHANGELOG.md).
+
 ### Release 5.9.20 — JVM evidence inventory
 
 The accepted JVM R&D scope is implemented in `migrate-check`: local framework,