sourcecode 5.9.28__tar.gz → 5.9.29__tar.gz

{sourcecode-5.9.28 → sourcecode-5.9.29}/CHANGELOG.md

@@ -1,5 +1,82 @@
 # Changelog
 
+## [5.9.29] — 2026-09-02
+
+*The 5.9.28 field round's two P0s and its P1, plus the suite's first green run
+in several releases. Where 5.9.28 answered a question about the worker pool,
+this release answers the one about where a run stops when it stops.*
+
+### Added
+
+- **An in-flight marker for runs that never finish (`R-01-INFLIGHT`).** The
+  field measured four `spring-audit` hangs and could say nothing about any of
+  them: every diagnostic this product had — the envelope, the forensic sidecar
+  — lives on a path a hung run never reaches. A marker is now written when a
+  hang-prone command starts, rewritten at each phase and stage change the
+  heartbeat already reports, and deleted on the way out. A run killed
+  externally leaves `inflight/<pid>.json` naming its argv, its start time, the
+  phase and the stage it stopped in. Abandoned markers are published by a
+  later run in `_meta.incomplete_runs`, because the run that stops cannot
+  report anything itself; each row states whether it is a measurement (the
+  process is gone) or an inference (no refresh, on a platform that cannot
+  probe liveness safely). Covers the audit family plus `onboard` and
+  `remediate`, the two commands the field reports hanging outside it.
+  `ASK_NO_INFLIGHT_MARKER=1` disables it.
+- **`timings.rule_families`** — wall time per rule family, highest first, with
+  a basis stating that it ranks cost and not complexity. The phase split could
+  say `security_rules: 12,617 ms` and never which of six families spent it.
+
+### Fixed
+
+- **The most expensive rule family is between 3 and 24 times faster, with a
+  byte-identical answer (P1).** `SEC-010` was 85 % of the rule phase and 35 %
+  of a whole audit; profiling found the walk under it re-reading every
+  remaining source, from disk, once per callee name it resolved — 96,399 reads
+  for 28 lookups. It indexes declarable names in the pass that already reads
+  each file once. Measured warm: `SEC-010` 10,830 → 3,246 ms on a 3,860-file
+  repository (audit 15.5 → 12.2 s) and 64,391 → 2,628 ms on an 878-file one
+  (audit 71.1 → 8.4 s), unchanged where a repository has no HTTP-input seeds.
+  `content_id` identical on all three.
+- **That family reports while it runs, and a deadline can stop it inside.** It
+  owned the longest stretch of an audit and left one heartbeat line unchanged
+  for the whole of it, which from outside is what the field calls a hang. A
+  budget cut returns what it measured instead of surfacing as an analysis
+  error.
+- **`manifest_cache` keyed its entries on a list that omitted every
+  lockfile.** Two repositories with identical manifests and different resolved
+  dependencies hashed the same, and the second was served the first's answer.
+  The key now reads the analyzer's own `INPUT_FILENAMES`, and a battery reads
+  that module's source and fails if it opens a file the set does not name.
+- **`SpringAuditResult.merge()` dropped `spring_footprint`**, which switched
+  BUG-03's marginal-detection disclosure back off on every `--scope all` run —
+  the default.
+- Machine-census leases are refreshed while a run is alive, so a killed run no
+  longer makes every later run on that machine halve its worker pool for an
+  hour; the lease directory is capped.
+
+### Changed
+
+- The suite is green: 13,748 tests, 0 failures. It had carried twenty-one
+  standing reds for several releases, which is how a real regression becomes
+  indistinguishable from the background. Two were the product defects above;
+  the rest were assertions that had fallen behind the code they pin, each
+  fixed or opted out with the reason stated.
+
+### Known Limitations
+
+- `ALT-01`/`ALT-03` remain open. The bisection the field asked for ran over two
+  corpora — 250 to 4,772 files on one, 9,195 on another — and found no size at
+  which `spring-audit` stops answering: 5.8 s to 39.6 s, sublinear, `rc=0`
+  throughout. File count alone is exonerated on this platform at up to 2.75x
+  the field repository's size. This release makes the stretch the failing runs
+  sat in several times shorter and, for the first time, visible while it
+  happens; it does not claim to have fixed the hang.
+- The next field round should send `inflight/` and `entry-trace.jsonl`
+  together after a hang. A marker still stuck in `SEC-010` says the family is
+  not the cause; a marker in another stage moves the search there; no marker
+  at all keeps it upstream of `main_entry`.
+- `BUG-02` and `BUG-12` still need the field's own large repository.
+
 ## [5.9.28] — 2026-09-02
 
 *Remediation batch on the 5.9.27 audit queue: nine rows, one commit each. The

{sourcecode-5.9.28 → sourcecode-5.9.29}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.28
+Version: 5.9.29
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.28-blue)
+![Version](https://img.shields.io/badge/version-5.9.29-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -290,7 +290,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.28 — and, on a build that has aged,
+ask version                    # ask 5.9.29 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.28 → sourcecode-5.9.29}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.28-blue)
+![Version](https://img.shields.io/badge/version-5.9.29-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -241,7 +241,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.28 — and, on a build that has aged,
+ask version                    # ask 5.9.29 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.28 → sourcecode-5.9.29}/docs/AUDIT-2026-09-01-EXTERNAL-5.9.22.md

@@ -12,7 +12,7 @@ a regression assertion exist.
 
 ## Executive Result
 
-The audit rates ASK Engine **6.6/10** on the large MSAS corpus and **7.5/10** on
+The audit rates ASK Engine **6.6/10** on the large native-Windows corpus and **7.5/10** on
 the smaller nine-axis assessment. The measurements agree on the main risk:
 source analysis is accurate and unusually explicit about uncertainty, but large
 repository execution and several output contracts are not yet reliable enough
@@ -52,7 +52,7 @@ SQL-injection recall, memory, and inconsistent CLI contracts.
 ## Performance Evidence
 
 The audit measured `--agent` on ThingsBoard at **182.6 s / 2,088 MB RSS** and
-`spring-audit` at **164.2 s cold**. On the larger MSAS corpus it reports
+`spring-audit` at **164.2 s cold**. On the larger native-Windows corpus it reports
 `ask . --agent` at **447 s**, `contract-diff` at **329 s**, `delta` at **187 s**,
 and `validation --compact` at **91 s**. Warm root compact analysis can be below
 one second; these are cold/deep-path costs.

{sourcecode-5.9.28 → sourcecode-5.9.29}/docs/AUDIT-2026-09-02-ALTERNATIVE-5.9.27.md

@@ -2,7 +2,7 @@
 
 ## Scope And Verdict
 
-Native-Windows re-audit on the same MSAS repository (3,342 Java files) used
+Native-Windows re-audit on the same audited repository (3,342 Java files) used
 in every prior round. Score **4.6/10**, the first uptick in four rounds (5.9.22
 6.6, 5.9.23 4.9, 5.9.25 4.3, 5.9.26 3.8). The uptick carries a large
 qualification discovered mid-session: this audit's own machine was shared
@@ -40,7 +40,7 @@ pass ... 0/35 ... 3.8/10"). This auditor states plainly that the first pass
 and its 7.4/10 score do not correspond to anything they ran or reported. Given
 the newly confirmed shared-machine contention, the likely explanation is that
 5.9.26's report mixed observations from two concurrent, independent audit
-sessions on the same machine (the MSAS/native-Windows lineage and a
+sessions on the same machine (the native-Windows lineage and a
 multi-repository "testing/" corpus lineage matching the five OSS repos found
 in the trace this round) rather than one evaluator's two passes. Recorded as
 an open provenance question, not resolved either way — see
@@ -97,6 +97,6 @@ concurrent `ask` test harness during at least part of the observation window.
 Reliability figures in this round should be read as measured under
 uncontrolled, real contention, not as an isolated single-process baseline.
 The auditor's own recommendation: repeat `spring-audit . --compact` x3 on
-both a reference repo and MSAS in the same clean window, nothing else
+both a reference repo and the audited repository in the same clean window, nothing else
 running, to separate "the repository" from "the shared machine" as the
 variable.

sourcecode-5.9.29/docs/AUDIT-2026-09-02-ALTERNATIVE-5.9.28.md

@@ -0,0 +1,174 @@
+# Alternative External Audit - 5.9.28
+
+*The audited repository is referred to neutrally throughout (3,342 Java files,
+`repo_id 7fced5c877cacfc5`, dirty working tree) — it is the same subject as
+every prior round in this lineage.*
+
+## Scope And Verdict
+
+Native-Windows re-audit, sixth round in this lineage. Score **6.2/10** (5.9.22
+6.6, 5.9.23 4.9, 5.9.25 4.3, 5.9.26 3.8, 5.9.27 4.6, 5.9.28 6.2) — the first
+substantial rise in five versions, and the first with a root cause identified
+in code rather than a symptom patched. **No regression against 5.9.27 was
+found.** Windows 11 Pro 10.0.26200, Python 3.10.0, pipx, `ask.EXE`, build
+`adbbf9ca7652e2ad2dfdb2db911c12e1793dded5`.
+
+| Axis | 5.9.27 | 5.9.28 | Basis |
+|---|---:|---:|---|
+| Analysis accuracy | 9.0 | 9.5 | Overload anchoring exact and cross-checked against the real source |
+| Honesty of figures | 9.0 | 9.3 | `audit_time_ms` null instead of a false `0.0`; every cache store publishes its eviction contract |
+| Diagnostic instrumentation | partial progress | real step, known limit | `_meta.concurrency` is precise and actionable — and absent from exactly the runs that fail |
+| CLI ergonomics | 6.5 | 7.5 | Nested-workspace `selftest` refusal; `retrieve --target` explains and redirects |
+| Audit-family reliability | 2/12 | 2/8, cause bounded | `migrate-check`/`migrate-apply` clean; `spring-audit` 0/4, `verify` 0/1, `risk` 0/1, `audit-report` 0/1 |
+| Light-path performance | 6.5 | 6.5 | `impact-chain` 11.3 s, `review-pr` 29.4 s — within range under residual contention |
+
+## Priority Finding — The Hang Reproduces With Contention Ruled Down
+
+The most important measurement of this round. The auditor isolated the
+contention variable to its lowest observable level across six sessions, and
+the failure persisted at 100%:
+
+1. `entry-trace.jsonl` was monitored for 120 s with nothing launched, waiting
+   for a quiet window.
+2. 100 s of total calm confirmed — no new lines.
+3. `timeout -k 5 150 ask spring-audit . --compact` launched into that window.
+4. Result: `rc=124`, 150,176 ms, **0 bytes of stdout**.
+5. The trace grew by two lines over the whole 150 s window: the auditor's own
+   invocation, and one light foreign invocation (`risk thingsboard --limit
+   20`) — against the *dozens* of concurrent foreign invocations measured in
+   the 5.9.27 session.
+
+Session total: **4/4 hangs** of `spring-audit . --compact`, the last of them
+under the lowest contention load obtainable in six audits.
+
+The 5.9.28 release note states: *"one hang was observed with nothing else
+running, and that is unexplained."* This round supplies four repetitions of
+that case rather than one, which turns "unexplained" into "unexplained and
+reproducible" — a better-defined problem, still unsolved. Contention is a
+real, now precisely measured factor; it is **not the sole cause**. Something
+specific to this repository still breaks `spring-audit` on a near-idle
+machine.
+
+The auditor's recommendation: profile the `applying all rules over 3342 Java
+files` phase (the one the stderr heartbeat names) against a growing subset of
+the repository — 250, 500, 1,000, 2,000, 3,342 files — to find where the
+behaviour changes from "answers" to "hangs indefinitely". If the command
+exhausts memory or time deterministically on some code pattern in this tree,
+contention would be worsening a failure that already exists in isolation
+rather than causing one.
+
+## Instrumentation Gap — The Blind Spot `_meta.concurrency` Cannot Cover
+
+`_meta.concurrency` is described as the best instrumentation to appear in six
+sessions. On a successful `endpoints --output` run it read
+`{"peer_invocations_at_start": 17, "worker_budget_shared": true, "jobs": 1,
+"jobs_unshared": 4}` — exact, actionable, and enough for any consumer to tell
+a contaminated timing from an isolated one without doing process archaeology.
+
+It never appears on a hung or empty run: stderr across the four `spring-audit`
+hangs contains zero mentions of `concurrency`, because those processes die
+before assembling any payload. This is the same blind spot `R-01` identified
+in the 5.9.26 round (the process does not reach the output guard); what has
+changed is that we now know it *would* publish something useful if it got
+there.
+
+Concrete suggestion from the auditor: write an in-flight marker
+(`inflight/<pid>.json` carrying `{argv, started_at, last_phase}`, updated at
+each phase change the heartbeat already reports) when an audit-family command
+starts, and delete it on completion. A process that hangs or dies leaves that
+file orphaned — which is precisely the forensic evidence the next field
+session needs, without depending on an external observer correlating
+timestamps in a trace file shared with an unknown number of other processes.
+
+## Measured Reliability — Six Versions, Same Invocation, Same Repository
+
+| Invocation | 5.9.23 | 5.9.25 | 5.9.26 | 5.9.27 | 5.9.28 |
+|---|---:|---:|---:|---:|---|
+| `spring-audit . --compact` | 0/24 | 0/18 | 0/8 | 0/5 | 0/4 (3 under verified-minimal contention) |
+| `verify .` | 0/24 | 0/18 | 0/5 | 0/1 | 0/1 |
+| `migrate-check . --compact` | 7/12 | 4/26 | 0/5 | 1/1 | 1/1 ✓ |
+| `migrate-apply .` | 14/24 | 0/26 | 0/5 | 1/1 | 1/1 ✓ |
+| `risk . --limit 20` | 0/13 | 0/7 | 0/4 | 0/1 | 0/1 |
+| `audit-report . --format markdown` | 0/7 | 0/7 | 0/4 | 0/1 | 0/1 |
+
+`migrate-check` and `migrate-apply` have now answered reliably in two
+consecutive sessions (38–39 s, correct payloads) — a trend rather than luck.
+The other four remain at zero.
+
+## Verified Fixes — Checked With The Auditor's Own Data
+
+- **`NEW-02`/`BUG-05` (overload anchoring) — closed, cross-checked against the
+  real source.** `ask endpoints . --output`: the four endpoints of one
+  overloaded handler pair now publish `anchor_ambiguity: true`,
+  `overload_count: 2`, `anchor_candidate_lines: [134, 145]`, and those two
+  line numbers match the two real annotations the auditor had verified by hand
+  three sessions earlier. First defect tracked since the 5.9.22 round that is
+  genuinely resolved rather than "not reproduced this time".
+- **`BUG-13` (nested-workspace `selftest`) — closed, verified against a
+  purpose-built fixture.** The auditor built a workspace holding two real
+  nested Git repositories: refusal in **373 ms**, `{"code": "INVALID_USAGE",
+  ..., "nested_repositories": 2}`, with `--allow-nested` documented. Against
+  1/12 rows passing in 120 s before.
+- **`BUG-16` (cache eviction contract) — closed.** `ask cache status` now
+  prints, per store, when and how entries are evicted — information absent for
+  four versions.
+- **`ALT-25` (`impact-chain.audit_time_ms`) — closed.** `null` with
+  `findings_status: "not_computed"` and the rule stated, replacing the
+  misleading `0.0`.
+- **`retrieve security-surface --target` — closed, high quality.** The refusal
+  now says the intent is repository-wide and names
+  `ask retrieve security-chain --target <symbol>`, after four sessions of
+  "No such option: --target".
+- **`R-01`'s mechanism — confirmed real and quantified** (see above), with the
+  reservation that the disclosure cannot reach the failing runs.
+
+## Not Verified This Round
+
+- **`ALT-08` — the auditor ran the wrong command and says so.**
+  `ask review-pr . --files -` (119,979 bytes, above the declared 100,000-byte
+  ceiling) carries no `_truncation_summary` at all: that field belongs to
+  `ask prepare-context review-pr`, a different command sharing the task name.
+  Neither claimed nor refuted; pending a repeat with the correct command.
+- `BUG-22`/`REG-02` (`--agent` not relaunched), `BUG-10` (needs a repository
+  with the routing styles it detects, absent here), `ALT-07`, `ALT-10`,
+  `BUG-02`, `BUG-12`, `BUG-09`, `BUG-23`: not relaunched for time budget, no
+  regression signal against any of them.
+- `ask --help`: 12.3 s cold, 2.9 s on immediate repetition. Still high on the
+  audit machine, consistent with residual contention rather than a defect in
+  the command.
+
+## Verified And Defect-Free In 5.9.28
+
+`endpoints` (3,763, exact), `impact-chain` (37,445 bytes), `posture`,
+`verify-edit`, `explain`, `impact`, `drift`, `trend`, `chunk-file`, `intent`,
+`pr-risk`, `review-pr` (119,979 bytes, coherent), `migrate-check` (38,081
+bytes), `migrate-apply` (10,142 bytes), `selftest` with an explicit path
+(`rc=75`, 9,910 bytes) and with nesting detection (`rc=2`). `--jobs`
+out-of-range rejection confirmed for the sixth consecutive session.
+
+## Commercial Position
+
+The reliable subset grew for real this round — `migrate-check`,
+`migrate-apply`, `endpoints`, `posture`, `impact-chain`, `pr-risk`,
+`review-pr`, `selftest` with an explicit path, now with correct overload
+anchors — and is valued at **18–20 €/dev/month**, up from prior rounds. The
+central security-audit family (`spring-audit`, `verify`, `risk`,
+`audit-report`) remains unusable on this repository for the sixth consecutive
+version.
+
+**Upgrade recommendation: yes, unconditionally** — no regression against
+5.9.27, and four corrections verified with the auditor's own data rather than
+accepted on the changelog's word. For anyone who needs the audit family on
+this repository specifically: still not the moment, but for the first time the
+team has a concrete, reproducible lead instead of a diffuse symptom.
+
+## Attack Order Requested By The Auditor
+
+1. `R-01` — bisect the `applying all rules` phase over a growing file subset
+   (250 → 3,342) to find where the behaviour changes; the trigger may not be
+   purely concurrency.
+2. Extend `R-01`'s instrumentation to runs that never complete — the in-flight
+   marker above.
+3. `R-02` — repeat the `ALT-08` verification with `ask prepare-context
+   review-pr`.
+4. Remaining rows unchanged in priority from the 5.9.27 report.

{sourcecode-5.9.28 → sourcecode-5.9.29}/docs/DEFECT-LEDGER.md

@@ -14,6 +14,110 @@ Status values: `open` · `in-progress` · `closed <version>` · `by-design` (wit
 The facts these rows are keyed to are published: `ask schema facts-v1` prints the registry
 (authority, definition, consumers, parity test) that the release battery enforces.
 
+## Current Synchronization — Release `5.9.29`, hardening pass and a green suite (2026-09-02)
+
+**The suite is green — 13 748 tests, 0 failures — for the first time in
+several releases.** It had carried twenty-one standing reds, which is how a
+real regression becomes indistinguishable from the background. Two of them
+were product defects, not stale assertions.
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `manifest-cache-key` (new) | High | **fixed** | `manifest_cache` keyed its entries on a hand-kept copy of the manifest names that omitted **every lockfile** — `poetry.lock`, `Cargo.lock`, `Gemfile.lock`, `pnpm-lock.yaml`, `yarn.lock`, `composer.lock`, `uv.lock`, `Pipfile.lock`. Two repositories with identical manifests and different *resolved* dependencies hashed the same, so the second was served the first's answer: a stale result with nothing in it to say so. The key now reads `dependency_analyzer.INPUT_FILENAMES`, and a battery reads that module's own source and fails if it opens a file the declared set does not name. |
+| `BUG-03` (merge half) | High | **fixed** | `SpringAuditResult.merge()` dropped `spring_footprint`, so the marginal-detection disclosure closed in 5.9.26 was switched back off on every `--scope all` run — the default. Fixing a producer and leaving a consumer unbound is the exact failure this ledger's maintenance rule exists for, found here by the battery that pins every dataclass field through the merge. |
+| `R-01` (lease liveness) | — | **hardened before shipping** | A lease outlived its process by up to an hour, and the field's harness kills runs with `timeout` constantly — on Windows, where liveness cannot be probed, every later run would have believed it was sharing the machine with a corpse and halved its pool for the whole TTL. Live runs refresh the lease at each phase change; the TTL drops to 900 s, which only has to outlast the longest single phase; the directory is capped. |
+| `R-01-INFLIGHT` (coverage) | — | **widened** | The marker covered the audit family only. `ALT-10` (`onboard`, 904 ms to a 200-second kill in one session) and `ALT-07` (`remediate`, 23,6 s to hangs past 400 s) are the field's other unexplained hangs, and a marker is the only evidence either row can leave behind. Both are covered now; `--help` and the light path still pay nothing. |
+| Suite hygiene | — | **closed** | Nineteen further rows were assertions that had fallen behind: a missing import and a missing fixture parameter, a `--jobs` bound stated twice (one `JOBS_MAX` now feeds the range and the help), a budget block that gained a field, a deadline modelled as a count of consultations rather than a state of the run, a no-context emulation importing a Typer module this version does not ship, `SEC-010` declaring neither a repair recipe nor a reason it cannot be mechanised, and the budget-authority battery holding external audit records to a rule meant for documents that instruct. |
+
+## Current Synchronization — P1 closed: the expensive family, profiled and fixed (2026-09-02)
+
+**The row asked for two things and both are done: `SEC-010` now reports while
+it runs, and the walk underneath it is between 3 and 24 times faster with a
+byte-identical answer.** Profiling `risk._http_input_query_sinks` on a
+3 860-file repository found the mechanism in one line of the profile: `get()`
+re-read every remaining source, from disk, **once per callee name it
+resolved** — 96 399 `_text_of` calls for 28 lookups, six seconds of pure I/O
+inside an 18,3-second walk, with the parse it triggers accounting for the
+rest.
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `SEC-010` cost | Medium | **fixed** | `seeds()` already reads every source once, so it now indexes, per file, the names that could be *declared* there. The predicate is unchanged where it matters — a Java declaration is never preceded by a dot, so `helper.lookup(` cannot declare `lookup`, while every file that could declare a name stays a candidate — which preserves the walk's own claim that reading fewer files cannot change the answer. Measured warm, serialized, `spring-audit --compact`: `SEC-010` 10 830 → 3 246 ms and the audit 15,5 → 12,2 s on a 3 860-file repository; **64 391 → 2 628 ms** and the audit **71,1 → 8,4 s** on an 878-file one where the family had been 90 % of the clock; unchanged on a repository with no HTTP-input seeds. `content_id` byte-identical on all three. |
+| `SEC-010` silence | Medium | **fixed** | The family owned the most expensive stretch of an audit and reported nothing while it ran — one heartbeat line, unchanged, which from outside is exactly what the field calls a hang. It ticks through `FamilyBudget` now (`SEC-010: parsing callees 129/772 files`), which also makes the family that spends the most time the one a deadline can stop *inside*: a cut returns what it measured, and is recorded as a cut rather than surfacing as an analysis error. |
+| `ALT-01` / `ALT-03` | Critical maximum | **open, one contributing factor removed** | The field's failing runs sat in `SEC-010` and this release makes that stretch several times shorter and, for the first time, visible while it happens. That is not a claim the hang is fixed: an 878-file repository spending 71 s on one family is a plausible contributor to a 150-second timeout, not a proven cause of one, and the field's own repository was never available here. What the next round can do that no previous one could: read `inflight/<pid>.json` after a hang and see whether the stage is still `SEC-010`. |
+
+## Current Synchronization — The two 5.9.28 P0s, worked (2026-09-02)
+
+**The bisection ran, and its headline result is negative: there is no knee.**
+`spring-audit --compact` over deterministic subsets of a 4 772-file repository
+took 5,8 s (250 files), 6,0 s (500), 9,2 s (1 000), 10,4 s (2 000), 16,9 s
+(3 342 — the field's own file count) and 24,1 s (4 772); a second corpus of
+9 195 files finished in 39,6 s. Sublinear per file, `rc=0` everywhere, no hang
+at any size. **File count alone does not explain the field's failure on this
+platform**, and the auditor's hypothesis — a costly loop that trips at a
+certain size — is not reproducible here at up to 2,75× their repository.
+
+What the bisection did find is where the time goes, and why the heartbeat
+looks stuck: **one family dominates**. On the 4 772-file repository, `SEC-010`
+measured **10 670 ms of a 30 099 ms run — 85 % of the rule phase** — and its
+heartbeat line stops changing for the last 10,6 s of it. That is precisely the
+shape the field reports as a hang, and `timings.phases` could say
+`security_rules: 12 617 ms` while never naming which of the six families spent
+it. `SEC-010` delegates to `risk._http_input_query_sinks`, already recorded as
+the CLI's single most expensive walk on two corpora in the 5.8.5 round.
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `R-01-INFLIGHT` | Critical maximum | **shipped** | `inflight/<pid>.json` is written when an audit-family command starts, rewritten at each phase and stage change the heartbeat already reports, and deleted on the way out. A run killed externally leaves it behind carrying argv, start time, the phase, the stage (the rule family) and how long it had been in each. Abandoned markers are published by a later run in `_meta.incomplete_runs` and attached to the forensic snapshot when a guard fires — the run that stops cannot report anything itself. Each row states its basis: a dead pid is a measurement, an old timestamp is an inference, and Windows offers only the second. `ASK_NO_INFLIGHT_MARKER=1` disables it. Field closure: the next hang should leave a marker naming its stage. |
+| `ALT-03` (bisection) | High | **measured, hypothesis not reproduced** | Six sizes on one corpus, three on a second, serialized on a quiet machine: no size at which the behaviour changes from *answers* to *hangs*. The remaining differences with the field are the platform (native Windows, four-worker cap), that repository's own content, and a dirty working tree. The bisection is not repeatable from outside without the repository, so the instruments below move the next attempt inside the product. |
+| `ALT-03` (attribution) | High | **instrumented** | `timings.rule_families` publishes wall time per family, highest first, with a basis stating that it ranks cost and not complexity (the families are not comparable units). Two `perf_counter` reads per family. A family the budget cut stays absent and is named in `_partial.rules_not_run`, so a missing entry is never read as a free family. |
+| `SEC-010` cost | Medium | **open, new, measured** | 85 % of the rule phase and 35 % of the whole audit on a 4 772-file repository; growth measured at roughly `n^1.2` between 1 553 and 3 860 analysed files (3,6 s → 10,6 s of unchanged heartbeat). Its own sub-progress is not reported, so a slow run and a stopped one look identical from outside for the whole stretch. Two separable pieces of work: report progress *inside* the family, and profile `risk._http_input_query_sinks`, which the 5.8.5 round already measured as this CLI's most expensive walk on two corpora. |
+
+## Current Synchronization — Alternative External Audit `5.9.28`, the hang reproduces on a near-idle machine (2026-09-02)
+
+**First substantial score rise in five rounds (4.6 → 6.2/10), with no
+regression found — and the sharpest evidence yet that contention was never the
+whole story.** The auditor isolated the contention variable to its lowest
+observable level in six sessions (120 s of monitoring, 100 s of confirmed calm
+before launch, one light foreign invocation across the whole 150 s window,
+against dozens in the 5.9.27 round) and `spring-audit . --compact` still hung
+**4 of 4 times**, `rc=124`, 0 bytes. The 5.9.28 release note said "one hang was
+observed with nothing else running, and that is unexplained"; this round turns
+that into *unexplained and reproducible*, which is a better-defined problem and
+still an open one. Full evidence:
+[`AUDIT-2026-09-02-ALTERNATIVE-5.9.28.md`](AUDIT-2026-09-02-ALTERNATIVE-5.9.28.md).
+
+**Five rows are confirmed closed with the auditor's own data, not on the
+changelog's word:** `NEW-02`/`BUG-05` (cross-checked against the real source —
+`anchor_candidate_lines: [134, 145]` matches two annotations the auditor had
+verified by hand three sessions earlier, and it is the first defect tracked
+since 5.9.22 that is genuinely resolved rather than "not reproduced this
+time"), `BUG-13` (373 ms refusal against a purpose-built two-repository
+workspace), `BUG-16`, `ALT-25`, and the `retrieve security-surface --target`
+refusal. `_meta.concurrency` is described as the best instrumentation to appear
+in six sessions.
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `R-01` (contention) | Critical maximum | **mechanism confirmed real and quantified; no longer sufficient as an explanation** | Measured on a successful run: `{"peer_invocations_at_start": 17, "worker_budget_shared": true, "jobs": 1, "jobs_unshared": 4}` — exact and actionable, and it settles from the outside what the 5.9.27 round could only infer from timestamps. But `spring-audit` hung 4/4 with third-party contention verified at its lowest in six sessions, so the division of the worker budget is a real fix for a real defect that is **not** the whole cause. Closure now needs the bisection below, not another contention measurement. |
+| `R-01-INFLIGHT` (new) | Critical maximum | **open, instrumentation gap named precisely** | `_meta.concurrency` never appears on a hung or empty run — zero mentions of `concurrency` across the four hangs' stderr — because those processes die before assembling any payload. Same blind spot as the 5.9.26 `R-01` (the run does not reach the output guard), now with the knowledge that the disclosure would be useful if it got there. The auditor's proposal, adopted as the row's required work: write `inflight/<pid>.json` with `{argv, started_at, last_phase}` when an audit-family command starts, update it at each phase change the heartbeat already reports, delete it on completion. An orphaned file is the forensic record no external observer can reconstruct by correlating a shared trace. |
+| `ALT-01` / `ALT-03` | Critical maximum | **open, now systematic and reproducible for this repository** | `spring-audit . --compact` 0/4 this round (0/5, 0/8, 0/18, 0/24 in the four before it); `verify` 0/1, `risk` 0/1, `audit-report` 0/1. The bisection the row has asked for since 5.9.25 now has a specific target: profile the `applying all rules over 3342 Java files` phase — the one the stderr heartbeat names — over a growing subset (250, 500, 1 000, 2 000, 3 342 files) and find where the behaviour changes from *answers* to *hangs indefinitely*. If it is deterministic on this tree, contention worsens a failure that already exists in isolation rather than causing one. |
+| `NEW-02` / `BUG-05` | High | **closed 5.9.28, confirmed in the field** | `anchor_ambiguity: true`, `overload_count: 2`, `anchor_candidate_lines: [134, 145]`, cross-checked against the two real annotations on the overloaded handler pair. Correct, not merely present. |
+| `BUG-13` | High | **closed 5.9.28, confirmed against an independent fixture** | Two real nested Git repositories, refusal in 373 ms with `nested_repositories: 2` and `--allow-nested` documented — against 1 of 12 rows passing in 120 s before. |
+| `BUG-16` | High | **closed 5.9.28, confirmed** | `cache status` prints each store's eviction contract; the auditor notes the information had been absent for four versions. |
+| `ALT-25` | Low | **closed 5.9.28, confirmed** | `audit_time_ms: null` with `findings_status: "not_computed"` and the rule stated beside it. |
+| `retrieve security-surface --target` | Low | **closed 5.9.28, confirmed** | The refusal states the intent is repository-wide and names `ask retrieve security-chain --target <symbol>`. |
+| `ALT-08` (arithmetic half) | Low | **fixed, field verification still owed** | Not verified this round and the auditor says so plainly: they exercised `ask review-pr`, which carries no `_truncation_summary` at all, instead of `ask prepare-context review-pr`, the command the field owns. Neither claimed nor refuted. Re-verify with the correct command before treating the field evidence as either way. |
+| `migrate-check` / `migrate-apply` | — | **reliable two sessions running** | 1/1 and 1/1 again (38–39 s, correct payloads). Two consecutive clean sessions after 0/5 in 5.9.26 — a trend rather than luck, and the shape of what a fixed audit-family command should look like. |
+| `ask --help` latency | Low | **open, still not a command-level defect** | 12.3 s cold, 2.9 s on immediate repetition on the audit machine, against 0.41–0.44 s on the engineering host. Consistent with residual contention; not reproduced as a defect of the command in either place. |
+| `BUG-22`/`REG-02`, `BUG-10`, `ALT-07`, `ALT-10`, `BUG-02`, `BUG-12`, `BUG-09`, `BUG-23` | — | **open/unchanged, not relaunched** | Time budget, and no regression signal. `BUG-10` in particular cannot be exercised on this repository — it has none of the routing styles that fix detects. |
+
+**No regression was found against 5.9.27, and the upgrade is recommended
+unconditionally** — the first round in six where the auditor reports a net,
+verified improvement with nothing new broken. The release gate is unchanged:
+the audit-command family is still not usable for unattended CI on this
+repository.
+
 ## Current Synchronization — Release `5.9.28`, nine rows closed on the 5.9.27 queue (2026-09-02)
 
 **`R-01`'s architectural question is answered in source, and the answer was

{sourcecode-5.9.28 → sourcecode-5.9.29}/docs/DEVELOPMENT-ROADMAP.md

@@ -1,5 +1,77 @@
 # ASK — Development Roadmap
 
+### Release 5.9.29 — hardening pass, green suite
+
+The suite is green (13 748 / 0) for the first time in several releases. Two of
+the twenty-one standing reds were product defects — a cache key that omitted
+every lockfile, and a merge that dropped the field BUG-03's fix depends on —
+and the rest were assertions that had fallen behind the code they pin.
+
+| Priority | Required work and closure boundary |
+|---|---|
+| P0 | Unchanged and now fully instrumented: ask the next field round for `inflight/` and `entry-trace.jsonl` after a hang. The marker covers `onboard` and `remediate` too, so `ALT-07` and `ALT-10` can finally leave evidence. |
+| P1 | Keep the suite green. A red set that survives a release is what made this session's two real defects invisible for as long as they were; the value of the battery is the signal, and twenty-one permanent reds is no signal. |
+| P2 | One order-dependent flake was observed once under `-n auto` and did not reproduce in two further full runs (`test_qualified_target_resolution_e17`). Recorded rather than chased — if it returns, it is a CliRunner/stream-capture interaction, not an analysis defect. |
+
+### P1 closed — the expensive rule family profiled, fixed and made visible
+
+`SEC-010` was 85 % of the rule phase and reported nothing while it ran. Both
+halves are closed. The profile named the mechanism immediately: the walk
+re-read the whole remaining corpus, from disk, once per callee name — 96 399
+reads for 28 lookups. It now indexes declarable names in the pass that already
+reads every file once.
+
+| Priority | Required work and closure boundary |
+|---|---|
+| P0 | Unchanged: get `inflight/` and `entry-trace.jsonl` from the next field round after a hang. With `SEC-010` several times cheaper *and* reporting counted progress, a marker still stuck in that stage says the family is not the cause; a marker in a different stage moves the search there; no marker at all keeps it upstream of `main_entry`. |
+| P1 | **Closed.** `SEC-010` 10 830 → 3 246 ms on a 3 860-file repository and 64 391 → 2 628 ms on an 878-file one (audit 71,1 → 8,4 s), `content_id` byte-identical on three corpora. The family ticks through `FamilyBudget`, so its line now counts, and a deadline can stop it mid-walk instead of only between families. |
+| P2 | The remaining cost in that walk is `_methods_in_text` over the files a name lookup admits — 11,4 s of the original 18,3 s profile, now the dominant term. Worth a look only if the field's next round still points here; the answer must stay byte-identical, which is the constraint that shaped this fix. |
+
+### The two 5.9.28 P0s, worked — bisection measured, in-flight marker shipped
+
+Both P0s from the round below are done. `R-01-INFLIGHT` shipped: an
+audit-family run now leaves `inflight/<pid>.json` naming its argv, phase,
+stage and how long it had been in each, deleted on a normal exit, published by
+a later run as `_meta.incomplete_runs`. The bisection ran over two corpora and
+**did not reproduce the failure**: 5,8 s at 250 files rising sublinearly to
+24,1 s at 4 772, and 39,6 s at 9 195 files, `rc=0` throughout.
+
+| Priority | Required work and closure boundary |
+|---|---|
+| P0 | The field's next hang is now supposed to leave a marker. Ask for `inflight/` and `entry-trace.jsonl` together in the next round: a marker naming `security rules (SEC-010)` would close the mechanism question that six sessions could not, and no marker at all would prove the process dies before `main_entry` returns, which is a different search entirely. |
+| P1 | `SEC-010` is 85 % of the rule phase and 35 % of a 4 772-file audit, with no sub-progress of its own — a slow run and a stopped one are indistinguishable from outside for that whole stretch. Report progress inside the family (it walks a countable population), then profile `risk._http_input_query_sinks`, which the 5.8.5 round already measured as the CLI's most expensive walk on two corpora. Cost, not correctness: the answer must not move. |
+| P2 | The bisection exonerated file count on this platform up to 2,75× the field's repository. The variables left are the platform (native Windows, four-worker cap), that repository's own content, and its dirty working tree. Do not spend another round re-measuring size; the marker moves the question inside the product. |
+
+Method note, for repeatability: subsets were built deterministically (first N
+`.java` files in sorted order plus every build manifest on their ancestor
+paths), runs were serialized, and the heartbeat was redirected with
+`ASK_PROGRESS=file:<path>` so a run that never answered would still say which
+phase and stage it stopped in.
+
+### Alternative Audit Intake — release 5.9.28, the hang reproduces on a near-idle machine
+
+Score 6.2/10 (4.6 in 5.9.27) — the first substantial rise in five rounds, with
+**no regression found** and five rows confirmed closed against the auditor's
+own data rather than the changelog's word. The round's decisive measurement is
+negative, though: with third-party contention isolated to its lowest observable
+level in six sessions (100 s of confirmed calm before launch; one light foreign
+invocation across the whole 150 s window, against dozens the round before),
+`spring-audit . --compact` still hung **4 of 4 times**, `rc=124`, 0 bytes. The
+worker-budget division shipped in 5.9.28 fixed a real defect that is not the
+whole cause.
+
+| Priority | Required work and closure boundary |
+|---|---|
+| P0 | Bisect the `applying all rules over 3342 Java files` phase — the one the stderr heartbeat already names — over a growing subset of a large repository (250, 500, 1 000, 2 000, 3 342 files) and find the point where the behaviour changes from *answers* to *hangs indefinitely*. This is the bisection `ALT-03` has asked for since 5.9.25, now with the added constraint that the trigger is not purely concurrency: it reproduces on a near-idle machine. |
+| P0 | `R-01-INFLIGHT`: extend the diagnostic to runs that never assemble a payload. `_meta.concurrency` is exact and actionable on successful runs (`peer_invocations_at_start: 17`, `jobs_unshared: 4` → `jobs: 1`) and absent from every hang — zero mentions across four of them. Write `inflight/<pid>.json` with `{argv, started_at, last_phase}` at the start of each audit-family command, update it at each phase change the heartbeat already reports, delete it on completion; an orphaned file is the forensic record an external observer cannot reconstruct from a shared trace. |
+| P1 | `R-02`: re-verify `ALT-08` with `ask prepare-context review-pr`. The auditor exercised `ask review-pr`, which carries no `_truncation_summary` at all, and neither claims nor refutes the row. Add a battery assertion that pins which command owns the field, so the next round cannot spend a session on the wrong one. |
+| P2 | `ask --help` measured 12.3 s cold and 2.9 s on immediate repetition on the audit machine, against 0.41–0.44 s on the engineering host. Consistent with residual contention in both readings; do not profile it as a command-level defect until a round measures it with `peer_invocations_at_start: 0`. |
+| — | `migrate-check`/`migrate-apply` have answered reliably for two consecutive sessions (1/1 and 1/1, 38–39 s). Treat their path as the reference shape when bisecting the four commands that stay at zero. |
+
+Full evidence, including the isolation methodology and the trace line counts,
+is in
+[`AUDIT-2026-09-02-ALTERNATIVE-5.9.28.md`](AUDIT-2026-09-02-ALTERNATIVE-5.9.28.md).
+
 ### Release 5.9.28 — remediation batch on the 5.9.27 queue, the pool question answered in source
 
 The P0 below it asked whether the shared worker pool tolerates concurrent

{sourcecode-5.9.28 → sourcecode-5.9.29}/docs/EXECUTIVE-ROADMAP.md

@@ -5,6 +5,69 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
+> **RELEASE 5.9.29 — the regression battery is fully green again, and it
+> caught two real defects on the way.** The test suite had carried twenty-one
+> permanent failures for several releases; a permanent failure is background
+> noise, and background noise is where a genuine regression hides. Clearing it
+> surfaced two product defects that had been invisible: a dependency cache
+> that ignored lockfiles, so two projects with the same manifests and
+> different resolved versions were given each other's answer, and a merge step
+> that silently switched off a disclosure fixed three releases ago on the
+> default code path. Both are fixed, both are pinned by assertions that fail
+> if the vocabulary drifts again. The release also hardens what shipped in the
+> last one against the customer's own machine, where runs are killed by
+> timeouts constantly, and extends the new forensic record to the two further
+> commands the customer reports hanging.
+
+> **THE EXPENSIVE PART OF A SECURITY AUDIT IS NOW BETWEEN 3 AND 24 TIMES
+> FASTER, WITH THE SAME ANSWER.** The rule that dominated audit time was
+> re-reading the whole repository from disk once for every method name it had
+> to resolve. It reads each file once now. On a mid-size customer-shaped
+> repository the whole audit went from 71 seconds to 8; on a larger one, from
+> 15.5 to 12.2. The answers are byte-identical on every repository tested —
+> that was the constraint the work was done under, and it is checked rather
+> than asserted. The same rule also reports progress while it runs for the
+> first time, so the stretch that used to look like a hang now shows a moving
+> count, and a time budget can stop inside it instead of only between rules.
+
+> **BOTH 5.9.28 P0s WORKED — the product now records where a run stopped, and
+> the bisection came back negative.** A run that is killed or hangs leaves a
+> small file naming what it was doing and for how long, deleted the moment it
+> finishes normally; the next successful run reports that an earlier one
+> stopped without being able to say so. That closes, from the inside, the gap
+> an external auditor has been filling by hand for three rounds. The bisection
+> the same auditor asked for ran over two large repositories and found no size
+> at which the audit stops answering — up to 2,75× the file count of the
+> repository that fails in the field — which removes "the repository is simply
+> too big" from the table and leaves the platform and that repository's own
+> content as the open variables. It also produced the first hard attribution:
+> a single rule family accounts for 85 % of the rule phase, and it is the one
+> the failing runs were last seen in. The payload now names it, so the next
+> field session reads that fact instead of inferring it.
+
+> **5.9.28 RE-AUDIT — first substantial score rise in five rounds (4.6 →
+> 6.2/10), no regression found, and the upgrade recommended without
+> conditions.** Five corrections were verified by the auditor with their own
+> data rather than accepted on the changelog's word: the overload-anchoring
+> defect tracked since the first round of this lineage is genuinely closed
+> (the published candidate lines match annotations they had verified by hand
+> three sessions earlier), the nested-workspace refusal answers in 373 ms
+> where the command used to degrade for two minutes, the cache eviction
+> contract is published for the first time in four versions, a misleading zero
+> became an honest null, and a four-round CLI complaint now explains itself and
+> names the right command. The concurrency telemetry is called the best
+> instrumentation to appear in six sessions.
+>
+> The round's decisive measurement is the negative one, and it changes where
+> the remaining work sits: with contention isolated to its lowest observable
+> level in six sessions, the audit family's core command still failed every
+> time. Machine contention was a real defect and is fixed; it was not the
+> whole cause. The reliable subset — migration checks, endpoints, posture,
+> impact and the PR-review path — grew and is valued by the auditor at 18–20
+> €/dev/month, while the security-audit family stays unusable on that
+> repository for a sixth version. The release gate is unchanged. See
+> [`AUDIT-2026-09-02-ALTERNATIVE-5.9.28.md`](AUDIT-2026-09-02-ALTERNATIVE-5.9.28.md).
+
 > **RELEASE 5.9.28 — the pool question is answered, and the answer was
 > "exclusive use".** The audit asked engineering a direct question
 > instead of reporting another symptom, and reading the source settled it: the

{sourcecode-5.9.28 → sourcecode-5.9.29}/docs/USER_GUIDE.md

@@ -279,7 +279,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.28
+# ask 5.9.29
 ```
 
 Requires Python 3.9+.