sourcecode 5.9.2__py3-none-any.whl → 5.9.4__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.2"
+__version__ = "5.9.4"

sourcecode/_build_commit.py

@@ -1,5 +1,5 @@
 """Generated at build time by hatch_build.py. Do not edit (AUD-592-D04)."""
 
-BUILD_COMMIT = 'cbecede0ebc0e7fe99d4c064d5fc052b1b37799e'
+BUILD_COMMIT = 'ec6b285e69ecb8d5dc90f82b106af14c221d1856'
 CLOSURE_PROVENANCE = {'Window': {'commit': '', 'status': 'uncited'}, '`AUD-588-F05`': {'commit': '470e4a4', 'status': 'present'}, '`AUD-590-B01` / `B-01`, `F-01`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B02` / `B-02`, `F-02`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B03` / `B-03`, `F-03`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B04` / `B-04`, `F-04`': {'commit': '', 'status': 'uncited'}, '`AUD-590-R01` / `R-01`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A01` / `A-1`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A02` / `A-2`, `A-4`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A03` / `A-3`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A05` / `A-5`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A06` / `A-6`, `A-7`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A08` / `A-8`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A09` / `A-9`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A10` / `A-10`': {'commit': '', 'status': 'uncited'}, '`AUD-592-A02` / `A-1` second half, `§12.5`': {'commit': '63f3d61', 'status': 'present'}, '`AUD-592-B01` / `B-8`': {'commit': '8329614', 'status': 'present'}, '`AUD-592-D01` / `D-1`': {'commit': '0f8e03f', 'status': 'present'}, '`AUD-592-D02` / `D-2`': {'commit': '1d3db4d', 'status': 'present'}, '`AUD-592-D03` / `D-3`': {'commit': 'f28fe40', 'status': 'present'}, '`AUD-592-R01` / `A-1`': {'commit': '216025f', 'status': 'present'}, '`AUD-592-R02` / `N-4`, reopens `AUD-513-N04`': {'commit': 'ec3050d', 'status': 'present'}, '`AUD-593-N01` / `N-01`': {'commit': 'dd6a706', 'status': 'present'}, '`AUD-593-N02` / `N-02`': {'commit': 'f539787', 'status': 'present'}, '`AUD-593-N03` / `N-03`': {'commit': '1dd0b1c', 'status': 'present'}, '`AUD-593-N05` / `N-05`': {'commit': 'aa89388', 'status': 'present'}, '`AUD-593-N06` / `N-06`': {'commit': 'aa584a6', 'status': 'present'}, '`AUD-594-N04` / `D-5`, disclosure half of `B-3`': {'commit': 'a0060b7', 'status': 'present'}, '`AUD-594-X01` / `A-1`, residual of `AUD-593-N03`': {'commit': 'dd222b9', 'status': 'present'}, '`AUD-594-X02` / `A-1` second half': {'commit': '1193937', 'status': 'present'}, '`AUD-594-X03` / `X-03`, residual of `AUD-593-N01`': {'commit': 'e89e8f0', 'status': 'present'}, '`AUD-594-X04`': {'commit': '05b8cc9', 'status': 'present'}, '`AUD-595-A02` / `N-5`, advisory half of `AUD-588-B11`': {'commit': '3e15227', 'status': 'present'}, '`AUD-595-A03` / `B-6` exit-code half': {'commit': 'ab7285f', 'status': 'present'}, '`AUD-595-A05`': {'commit': 'e0b3d10', 'status': 'present'}, '`AUD-595-A07`, narrow half of `AUD-592-A02`': {'commit': 'cc15177', 'status': 'present'}, '`AUD-595-B01` / §B': {'commit': 'b77a1ad', 'status': 'present'}, '`AUD-595-Q01`': {'commit': '91a6566', 'status': 'present'}, '`AUD-596-A01` / `ASK-DET-001`': {'commit': 'fa508b4', 'status': 'present'}, '`AUD-596-A02` / `ASK-SELF-001`': {'commit': '4dfadc8', 'status': 'present'}, '`AUD-596-A03` / `ASK-C1-001`': {'commit': 'bffa3a6', 'status': 'present'}, '`AUD-596-A04` / `ASK-UX-003` + `ASK-UX-004`': {'commit': 'f0aac3c', 'status': 'present'}, '`AUD-596-B01` / `B-01`, harder witness for `BUG-6`': {'commit': '567d09d', 'status': 'present'}, '`AUD-596-B02` / `B-02`, class residual of `R2`': {'commit': '', 'status': 'uncited'}, '`AUD-596-B03` / `B-03`': {'commit': 'a8cb814', 'status': 'present'}, '`AUD-596-B06` / `B-06`': {'commit': '8107927', 'status': 'present'}, '`AUD-596-B07` / `B-07`, class residual of `AUD-592-R02`': {'commit': 'e060485', 'status': 'present'}, '`AUD-596-B09` / `B-09`': {'commit': '5b8146c', 'status': 'present'}, '`AUD-596-B10` / `B-10`': {'commit': '5cb994d', 'status': 'present'}, '`AUD-596-B16` / `B-16`': {'commit': '1507f69', 'status': 'present'}, '`AUD-596-D01` / `B-13` + `B-14`': {'commit': '0b1bdf0', 'status': 'present'}, '`AUD-596-D02` / `B-08`, residual of `AUD-594-N04`': {'commit': 'e7f73c3', 'status': 'present'}, '`AUD-596-D03` / `ASK-AGT-001`': {'commit': '8c46967', 'status': 'present'}, '`AUD-596-D04` / `B-18`': {'commit': '040f027', 'status': 'present'}, '`AUD-596-D05` / `B-19`': {'commit': 'fd2bf68', 'status': 'present'}, '`AUD-596-D06` / `B-20`': {'commit': '784cd83', 'status': 'present'}, '`AUD-596-D07` / `B-17`, half refuted': {'commit': 'c3ff822', 'status': 'present'}, '`AUD-596-D08` / `B-22`, class residual of `AUD-591-A06`': {'commit': 'b396c6a', 'status': 'present'}, '`AUD-596-D09` / `B-23`, surviving half of `B26`': {'commit': 'fd3d63f', 'status': 'present'}, '`AUD-596-D10` / `B-29`': {'commit': '', 'status': 'uncited'}, '`AUD-596-D11` / `ASK-UX-005`': {'commit': 'f4b4f77', 'status': 'present'}, '`AUD-596-D12` — six hints that send the reader back to the error': {'commit': '498df44', 'status': 'present'}, '`AUD-596-D13` / `B-28`': {'commit': '1014c72', 'status': 'present'}, '`AUD-596-D14` / `B-15`, narrow half of `B20`': {'commit': '10f2827', 'status': 'present'}, '`AUD-596-R01` / `B-05`': {'commit': '', 'status': 'uncited'}, '`AUD-596-X01` / `ASK-GATE-001`, gating half of `B24`': {'commit': 'e59c655', 'status': 'present'}, '`AUD-596-X02` / `ASK-UX-001` + `ASK-UX-002` + `B-21`': {'commit': 'f6ebf50', 'status': 'present'}, '`AUD-597-A01` / `ASK-UX-001` + `N-01`': {'commit': 'f8cf061', 'status': 'present'}, '`AUD-597-A02` / `ASK-UX-008` + `ASK-DOC-002`': {'commit': '9d47a4c', 'status': 'present'}, '`AUD-597-A03` / `ASK-DET-001`': {'commit': '4c7622a', 'status': 'present'}, '`AUD-597-A04` / `ASK-LEDGER-001`': {'commit': '46fb870', 'status': 'present'}, '`AUD-597-D01` / `B-04`': {'commit': '1094e6a', 'status': 'present'}, '`AUD-597-D02` / `ASK-DOC-001`': {'commit': 'ecb1bb7', 'status': 'present'}, '`AUD-597-D03` / `N-06`': {'commit': '9784333', 'status': 'present'}, '`AUD-597-D04` / `N-05`': {'commit': 'e51c087', 'status': 'present'}, '`AUD-597-D05` / `N-04`, fourth appearance of `C4-27`': {'commit': '9cccc15', 'status': 'present'}, '`AUD-597-D06` / `ASK-CLI-001`': {'commit': '178aa6d', 'status': 'present'}, '`AUD-597-D07` / `N-03`': {'commit': '9245e35', 'status': 'present'}, '`AUD-597-R01` / `ASK-PERF-001`': {'commit': '6910054', 'status': 'present'}, '`AUD-597-R02` / `ASK-ENC-001`': {'commit': 'ce6dac1', 'status': 'present'}, '`AUD-597-R03` / `ASK-UX-002`': {'commit': 'c57e50b', 'status': 'present'}, '`AUD-597-X01` / `ASK-BUILD-001` + `ASK-META-001` / `B-12`': {'commit': '354338b', 'status': 'present'}, '`AUD-598-B01` / `ASK-META-001`': {'commit': 'b2f7c65', 'status': 'present'}, '`AUD-598-B02` / `ASK-UX-002`': {'commit': '56a4bf7', 'status': 'present'}, '`AUD-598-B03` / `B-11`': {'commit': 'c63cb24', 'status': 'present'}, '`AUD-598-B04` / `N-02`': {'commit': '187937f', 'status': 'present'}, '`AUD-598-R01` / `ASK-PERF-002`': {'commit': '', 'status': 'uncited'}, '`AUD-598-X01` / `N-01` + `B-13` + `B-14` + `B-29` + `N-06`': {'commit': '6f2f5a4', 'status': 'present'}, '`AUD-600-B01` / `P-01`': {'commit': '366ffed', 'status': 'present'}, '`AUD-600-B02` / `P-02` + `ASK-PACK-002`': {'commit': '2a814c3', 'status': 'present'}, '`AUD-600-B03` / `ASK-PACK-001`': {'commit': '452f2a0', 'status': 'present'}, '`AUD-600-D01`': {'commit': '1224e1b', 'status': 'present'}, '`AUD-600-D02`': {'commit': 'eab8172', 'status': 'present'}, '`AUD-600-R01` / `R-01`': {'commit': '88add64', 'status': 'present'}, '`AUD-601-B01` / `N-02`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-B02` / `ASK-PACK-004`': {'commit': '', 'status': 'uncited'}, '`AUD-601-D01` / `N-01`, `ASK-UX-001`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-D02` / `B-13`, `B-14`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-M01` / `B-26`, `B-27` retracted': {'commit': '', 'status': 'uncited'}, '`AUD-601-R01` / `R-02`': {'commit': '', 'status': 'uncited'}, '`B-3`': {'commit': '773268d', 'status': 'present'}, '`B-6`': {'commit': '17c6e06', 'status': 'present'}, '`B-8`': {'commit': '8329614', 'status': 'present'}, '`BUG-3` / `443b345`': {'commit': '', 'status': 'uncited'}, '`BUG-4a` / `AUD-588-B11` residual': {'commit': '24b4185', 'status': 'present'}, '`BUG-4b` / `AUD-588-B11` residual': {'commit': '0376350', 'status': 'present'}, '`E-39`, class residual of `AUD-593-N06`': {'commit': '25fc11f', 'status': 'present'}, '`N-5`': {'commit': 'c68083f', 'status': 'present'}, '`N-7`': {'commit': '082e9de', 'status': 'present'}, '`R-1`': {'commit': '424fb1c', 'status': 'present'}, '`R-2`': {'commit': '5158b92', 'status': 'present'}, '`R-3`': {'commit': '88aec04', 'status': 'present'}, '`R-4`': {'commit': '04fd04f', 'status': 'present'}}
 CLOSURE_COVERAGE = {'closed_rows': 113, 'present': 88, 'absent': 0, 'unresolved': 0, 'uncited': 25, 'unknown': 0}

sourcecode/_docs/USER_GUIDE.md

@@ -46,15 +46,30 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.2, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.4, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.2, with release-artifact verification
+the two pack fixes are included in release 5.9.4, with release-artifact verification
 remaining for detached execution and pack evidence.
 
+### Reliability contracts in 5.9.4
+
+Invalid analysis inputs fail before expensive work and use the structured
+`INVALID_INPUT` envelope: a missing `--consumer` repository, a malformed CVE
+feed, or an unresolved `pack gate --since` ref is never treated as an empty or
+`UNVERIFIED` result. `posture --diff` reports unknown profiles when the project
+declares profiles. `baseline capture` does not replace a snapshot already stored
+for the same commit; use `--auto` when a pipeline should skip it.
+
+With `endpoints --compact`, `endpoints: []` means the rows were deliberately
+omitted. Read `endpoints_note`, `endpoints_omitted` and `total`; an empty list is
+not evidence that the API has no routes. `impact` and `impact-chain` return exit
+code 1 when the target is unresolved, including when the selected repository
+contains no Java sources.
+
 ---
 
 ## The semantic engine
@@ -221,7 +236,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.2
+# ask 5.9.4
 ```
 
 Requires Python 3.9+.
@@ -1180,6 +1195,8 @@ the stored architecture or findings series (`--kind findings`) and publishes its
 boundaries, latest commit, comparability and explicit limits as `baseline-attestation-v1`.
 It is evidence continuity, not a legal or regulatory compliance verdict, and it returns
 `status: no_history` instead of manufacturing a clean zero when no capture exists.
+Unlike `audit-report --sign-key`, `baseline attest` is currently unsigned: its
+`content_id` supports deterministic comparison, not third-party tamper verification.
 
 For a multi-repository buyer, `ask auth workspace <repo>...` previews the aggregate Java
 population that a workspace-sized entitlement would see. The preview is advisory only: it
@@ -1187,6 +1204,10 @@ does not change the current per-repository gate or charge the workspace.
 For a named-buyer pilot, add `--enforce`: crossing the aggregate threshold then requires
 the existing Pro entitlement and exits with the standard license-required contract; below
 the threshold it passes. This flag is opt-in and does not change per-repository gates.
+Repository arguments are normalized before counting. If a parent and descendant are both
+supplied, the parent is counted once and the overlap is listed in `overlapping_paths`.
+Missing or non-directory paths fail with the standard structured `INVALID_INPUT` / `missing`
+contract; they are never treated as empty repositories.
 
 ---
 

sourcecode/architectural_baseline.py

@@ -445,11 +445,15 @@ def _announce_ask_dir(ask_dir: Path) -> None:
 
 
 def write_baseline(baseline: dict, out_dir: Path) -> Path:
-    """Write `baseline` as deterministic JSON under `out_dir`; return the file path."""
+    """Write a new baseline without replacing an existing commit snapshot."""
     _readonly.guard(out_dir, what="baseline history directory")
     out_dir.mkdir(parents=True, exist_ok=True)
     protect_ask_dir(out_dir)
     path = out_dir / _baseline_filename(baseline)
+    if path.exists():
+        raise FileExistsError(
+            f"Baseline already exists for commit {baseline.get('commit') or '-'}: {path}"
+        )
     path.write_text(
         json.dumps(baseline, sort_keys=True, indent=2) + "\n", encoding="utf-8"
     )

sourcecode/cli.py

@@ -4552,6 +4552,25 @@ def pack_gate_cmd(
         )
         raise typer.Exit(code=2)
     comparison_ref = since
+    if since is not None:
+        from sourcecode.git_checkout import RefError, repo_root, resolve_ref
+
+        try:
+            resolve_ref(repo_root(root), since)
+        except RefError as exc:
+            # Test doubles and callers that provide a non-Git analysis root are
+            # still handled by the existing pack component contracts. Only a
+            # ref failure in an actual repository is an invalid comparison.
+            if exc.code == "not_a_git_repository":
+                pass
+            else:
+                _emit_error_json(
+                    INVALID_INPUT_CODE,
+                    str(exc),
+                    ref=exc.ref or since,
+                    hint="Use a commit, tag, or local branch that exists in the repository.",
+                )
+                raise typer.Exit(code=2)
     if pr is not None:
         try:
             from sourcecode.github_diff import pull_request_base_ref
@@ -8578,6 +8597,9 @@ def impact_cmd(
       not_found  — no symbol and no substring. `risk_score` is null, never 0:
                    nothing was measured, which is not measuring zero.
 
+    An unresolved target exits with code 1, including when the selected repository
+    contains no Java sources; the structured answer still names `not_found`.
+
     \b
     NOTE: Free on repos up to the size limit; Pro unlocks enterprise-scale
     monoliths. Run 'ask license' for details.
@@ -8652,7 +8674,7 @@ def impact_cmd(
             format,
         )
         _emit_command_output(_nf_output, output_path, copy)
-        return
+        _exit_on_unresolved_target("not_found")
 
     _prog = Progress()
     _prog.start(f"building CIR ({len(file_list)} files) for impact analysis")
@@ -8902,7 +8924,8 @@ def endpoints_cmd(
         False, "--compact",
         help="Answer how exposed the repository is without listing every endpoint: "
              "counts by method, by security policy and by controller. Every count is "
-             "measured over the full population.",
+             "measured over the full population; an empty `endpoints` list means the "
+             "rows were intentionally omitted, not that no endpoints exist.",
     ),
     no_cache: bool = typer.Option(
         False, "--no-cache",
@@ -8980,6 +9003,13 @@ def endpoints_cmd(
     _enforce_format("endpoints", format)
 
     target = _admit_path(path)
+    if consumer:
+        # A missing consumer must fail before the server scan. Treating it as an
+        # empty consumer silently turns a requested join into an unfiltered one.
+        consumer = [
+            _admit_path(item, usage="endpoints --consumer")
+            for item in consumer
+        ]
 
     # AUD-591-A10: a prefix that is not a route selects nothing and reports it
     # as no exposure. Rejected before the analysis, so the shell rewrite is
@@ -9116,6 +9146,12 @@ def endpoints_cmd(
 
         _listed = len(data.get("endpoints", []))
         data["endpoints"] = []
+        data["endpoints_note"] = (
+            f"The endpoints list is intentionally omitted by --compact; "
+            f"{_listed} endpoint(s) were measured. An empty `endpoints` list "
+            "does not mean that the repository has no endpoints. Re-run without "
+            "--compact or narrow the request to retrieve rows."
+        )
         data["endpoints_omitted"] = {
             "total": _listed,
             "shown": 0,
@@ -10599,7 +10635,9 @@ def baseline_capture_cmd(
     ref: Optional[str] = typer.Option(
         None, "--ref",
         help="Human label for this baseline (e.g. a version or milestone). "
-             "The commit is recorded automatically when the path is a git repo.",
+             "The commit is recorded automatically when the path is a git repo. "
+             "A capture never overwrites an existing snapshot for the same commit; "
+             "use --auto to skip an already captured commit.",
     ),
     kind: str = typer.Option(
         "architecture", "--kind",
@@ -10750,7 +10788,16 @@ def baseline_capture_cmd(
     baseline = build_baseline(
         _cir, ref=ref, commit=git_commit(target_dir), record_env=record_env,
     )
-    written = write_baseline(baseline, dest)
+    try:
+        written = write_baseline(baseline, dest)
+    except FileExistsError as exc:
+        _prog.finish()
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            str(exc),
+            hint="Use `--auto` to skip an already captured commit, or capture a new commit.",
+        )
+        raise typer.Exit(code=1)
     _prog.finish()
 
     t = baseline["totals"]
@@ -14519,7 +14566,9 @@ def posture_cmd(
     Two axes, and they are different questions. `--diff` holds the tree fixed
     and moves the profile set. `--diff-ref` (and `--since`) hold the profile set
     fixed and move the tree: *does this change what a client can reach without
-    authenticating?* That one takes `--fail-on` and is the per-PR gate.
+    authenticating?* That one takes `--fail-on` and is the per-PR gate. When the
+    repository declares profiles, `--diff` rejects a profile name outside that
+    population instead of comparing a configuration that does not exist.
 
     \b
     Examples:
@@ -14743,10 +14792,28 @@ def posture_cmd(
                 )
                 raise typer.Exit(code=1)
             left_raw, right_raw = diff.split(":", 1)
+            left_profiles = _parse_set(left_raw, flag="--diff (left side)")
+            right_profiles = _parse_set(right_raw, flag="--diff (right side)")
+            from sourcecode.spring_profiles import profile_population
+
+            declared_profiles = set(profile_population(path).names)
+            missing_profiles = sorted(
+                (left_profiles | right_profiles) - declared_profiles
+            )
+            if missing_profiles and declared_profiles:
+                _emit_error_json(
+                    INVALID_INPUT_CODE,
+                    "--diff names profile(s) not declared by the repository: "
+                    + ", ".join(missing_profiles),
+                    profiles=missing_profiles,
+                    hint="Use profiles reported by `ask posture <repo>`; use a single "
+                    "posture run to inspect an undeclared profile explicitly.",
+                )
+                raise typer.Exit(code=1)
             data = diff_posture(
                 path,
-                _parse_set(left_raw, flag="--diff (left side)"),
-                _parse_set(right_raw, flag="--diff (right side)"),
+                left_profiles,
+                right_profiles,
                 overrides,
             )
         else:
@@ -15571,7 +15638,7 @@ def impact_chain_cmd(
         output = _serialize_dict(data, format)
         _emit_command_output(output, output_path, copy,
                              success_msg=f"Impact chain written to {output_path}")
-        return
+        _exit_on_unresolved_target("not_found")
 
     _prog = Progress()
     _prog.start(f"analyzing impact ({len(file_list)} files)")
@@ -17919,7 +17986,8 @@ def auth_workspace_cmd(
         "--enforce",
         help=(
             "Pilot gate: require the existing Pro entitlement when the aggregate "
-            "workspace threshold is exceeded. Advisory by default."
+            "workspace threshold is exceeded. Advisory by default. Overlapping "
+            "paths are counted once; missing paths are rejected."
         ),
     ),
 ) -> None:
@@ -17927,12 +17995,17 @@ def auth_workspace_cmd(
 
     Advisory mode is the default. Use ``--enforce`` only for the named-buyer
     pilot: it reuses the existing Pro gate when the aggregate threshold is
-    crossed and performs no billing.
+    crossed and performs no billing. Repository paths are normalized, parent /
+    descendant overlaps are counted once, and missing paths are rejected.
     """
     _enforce_format("auth-workspace", format)
     from sourcecode.license import require_pro, workspace_entitlement
 
-    data = workspace_entitlement([str(repo) for repo in repos], enforce=enforce)
+    validated_repos = [
+        _admit_path(repo, usage="auth workspace")
+        for repo in repos
+    ]
+    data = workspace_entitlement([str(repo) for repo in validated_repos], enforce=enforce)
     if data["enforcement_decision"] == "pro_required":
         require_pro("workspace entitlement")
     _emit_command_output(

sourcecode/cve_feed.py

@@ -258,9 +258,14 @@ def load_feed(feed_path: Path, *, now: Optional[datetime] = None) -> Feed:
                     newest = stamp
 
     if unreadable:
+        feed.error = f"{unreadable} feed file(s) were not valid JSON"
         feed.limitations.append(
-            f"{unreadable} feed file(s) were not valid JSON and were skipped"
+            f"{unreadable} feed file(s) were not valid JSON; the feed was rejected"
         )
+        # Partial advisory data is unsafe for a reachability gate: a skipped
+        # file can contain the one advisory that should have blocked the run.
+        feed.loaded = False
+        return feed
     feed.packages = len(feed.by_package)
     feed.loaded = True
 

sourcecode/license.py

@@ -550,7 +550,33 @@ def workspace_entitlement(
     aggregate crosses the threshold. This function only publishes the decision;
     it never changes the per-repository rule or performs billing.
     """
-    unique = sorted({str(Path(path).resolve()) for path in repo_paths})
+    normalized = sorted({str(Path(path).resolve()) for path in repo_paths})
+    invalid = [path for path in normalized if not Path(path).is_dir()]
+    if invalid:
+        raise FileNotFoundError(
+            "Workspace repository path does not exist or is not a directory: "
+            + invalid[0]
+        )
+    unique: list[str] = []
+    overlapping_paths: list[dict[str, str]] = []
+    for candidate in normalized:
+        parent = next(
+            (existing for existing in unique if Path(candidate) == Path(existing)
+             or Path(existing) in Path(candidate).parents),
+            None,
+        )
+        if parent is not None:
+            overlapping_paths.append({"parent": parent, "child": candidate})
+            continue
+        descendants = [
+            existing for existing in unique
+            if Path(candidate) in Path(existing).parents
+        ]
+        for descendant in descendants:
+            unique.remove(descendant)
+            overlapping_paths.append({"parent": candidate, "child": descendant})
+        unique.append(candidate)
+    unique.sort()
     repositories = [
         {"path": path, "java_files": count_java_files(path)}
         for path in unique
@@ -561,6 +587,7 @@ def workspace_entitlement(
         "status": "ok" if repositories else "no_repositories",
         "repository_count": len(repositories),
         "repositories": repositories,
+        "overlapping_paths": overlapping_paths,
         "workspace_java_files": total,
         "workspace_java_file_limit": _FREE_REPO_JAVA_FILE_LIMIT,
         "workspace_threshold_exceeded": total > _FREE_REPO_JAVA_FILE_LIMIT,

{sourcecode-5.9.2.dist-info → sourcecode-5.9.4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.2
+Version: 5.9.4
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.2-blue)
+![Version](https://img.shields.io/badge/version-5.9.4-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -196,7 +196,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.2 retains the shared Canonical IR
+**Current performance status.** Release 5.9.4 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
@@ -212,6 +212,20 @@ aggregate Java entitlement. `--enforce` is an opt-in named-buyer pilot that reus
 the existing Pro gate; advisory mode remains the default and no billing is
 performed by the CLI.
 
+`auth workspace` normalizes its repository arguments before counting. If one
+path contains another, the parent is counted once and the overlap is published
+in `overlapping_paths`; a missing or non-directory path is rejected as structured
+invalid input rather than treated as an empty repository. This prevents silent
+entitlement errors in CI and does not change per-repository gates or billing.
+
+Release 5.9.4 also hardens the boundary contracts: missing consumer repositories,
+malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
+input errors; duplicate same-commit baselines are never overwritten. `posture
+--diff` validates unknown profiles when the repository declares profiles. In
+`endpoints --compact`, an empty `endpoints` list is explicitly marked as an
+intentional omission, not an empty API; unresolved `impact` and `impact-chain`
+queries exit non-zero, including on repositories without Java sources.
+
 **What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
 IR). Pass `--views compact` or `--views compact,agent` to warm only selected views; without
@@ -237,7 +251,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.2 — and, on a build that has aged,
+ask version                    # ask 5.9.4 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.2.dist-info → sourcecode-5.9.4.dist-info}/RECORD

@@ -1,12 +1,12 @@
-sourcecode/__init__.py,sha256=ut7y9JuYeIRLMJEe0f5IzU0SKAdtECMoi4vqjiB12d4,308
+sourcecode/__init__.py,sha256=0qlYxElAIApXgtaqvLvB59Bcp23mslHDvyztYWrQZD0,308
 sourcecode/__main__.py,sha256=qDFVkobwsdZrX0B3stiRqsUNivVpybKO-egzAwCW4xw,165
-sourcecode/_build_commit.py,sha256=F8XcP7GedwxwV4VpzoMYIzsaNzln5x6bazw5rs5xHGw,8740
+sourcecode/_build_commit.py,sha256=W0ohkcA2_TncmrWEsLzLPfZNmCxpl2xc1rVqQD4-i6o,8740
 sourcecode/access_drift.py,sha256=1R7_fiAPvKNOnxc9uxkH3JH-k8MiAuyE7FwWUX1r4Fg,8995
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/analysis_budget.py,sha256=ZuNEboPF8A6GK-_V7WNt92ezgriga7_Rbr-vvSN4UEE,4183
 sourcecode/answer_bounds.py,sha256=_51_DCuYEUmI_xwUFxDMiprSavkNakkLiIBbPjevQ3M,9793
 sourcecode/archetype.py,sha256=V_s5grgpbanrXb8qGEQb73W5Cg5iKW9FQHWKgg5KM8Y,41201
-sourcecode/architectural_baseline.py,sha256=4GiMVBLJVHvRKSWQGf2ZVurI1-R0qk5pmaevgvGSgVA,26325
+sourcecode/architectural_baseline.py,sha256=9ds-ZYw4dEJUKWZSdq_ufHq7d2AXnMbEHteSQlT7iu8,26468
 sourcecode/architectural_delta.py,sha256=JhZVmA0gYUryt4x4ieVuxPbcvoBygHgADZaYJ_o4gdk,15142
 sourcecode/architecture_analyzer.py,sha256=GFc4ek-s1IHWM7pl-0L32WahZ93AmDgrAMcOuBKA5Dk,61463
 sourcecode/architecture_summary.py,sha256=BVVRHd952cjRhjHnR6CPrvKgaa-tdM16l-pBi1yDCPs,32395
@@ -35,7 +35,7 @@ sourcecode/change_plan.py,sha256=drAoDsqFplutCLc6Y0xue7sYkTls0SpYh7aOXvttv3I,129
 sourcecode/ci_output.py,sha256=X4NRokWWMRF9Ex8OQrEO2g04GzJ00GDP5zYIoqI9YCc,4625
 sourcecode/cir_graphs.py,sha256=RytqSv1WF8kdlfXj2fPQz16LY4akS2kyThbdWL8beCQ,14835
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=W4OUlL5RIy81G2cByGjyQfA7HLurirL1sftErTxhkuE,932859
+sourcecode/cli.py,sha256=_8CaYY1ye6GNc1VEYzOa4JbTkmUiGoxfnUffIi7i1Zo,936454
 sourcecode/client_calls.py,sha256=YOPnfRZzRyqmdHvXSVeiunW8cuiuCuWXacNIQRgKMCw,22640
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=Lnfmm9I3k0H1jP1tV6ZJ-R7znjQPLPLCe5TzV1Jb_PM,15323
@@ -52,7 +52,7 @@ sourcecode/contract_init.py,sha256=bXRCqWM9tvrDLeT8j7ea6IWf87jB4VJxnlSzGBsRRXo,1
 sourcecode/contract_model.py,sha256=nRxJKPMs1VHwFTa8AVXhGmaLjti3Lr2sjHDpWgv1bfE,3917
 sourcecode/contract_pipeline.py,sha256=4XE-xhab7ysdExXyUOBl2hAH4MABo7moKnT9V4XcEwQ,30243
 sourcecode/coverage_parser.py,sha256=X9scuUWxacahYTrTBGea2Ku-sf-WCVcnc9OEB35_3IU,19340
-sourcecode/cve_feed.py,sha256=t93Ofu0uxB3zyI8W9nUKmH4Ljbt4qZpGIg68IP_aTrY,10749
+sourcecode/cve_feed.py,sha256=IBVpQaY04biXKEeNf1qKO_95GqEV23fwhj4oNk7s1-g,11028
 sourcecode/cve_reachability.py,sha256=aEHkG3IaeLxgekK79cz07QTcv9LZHEqEYqyLGjwjzSE,20409
 sourcecode/data_exposure.py,sha256=73EcuHsN3ESKdSvSj1B2FzD1myGJqzlNJpYO1NpI5WM,19963
 sourcecode/data_labels.py,sha256=9v0JaICRH7jIZ015T1_DuT5E0MFfeL-Wcq1WOPE0Fe0,10965
@@ -96,7 +96,7 @@ sourcecode/identity_fallback.py,sha256=uRC_j_80uaI4Ue4tf-OhKX4h472dmufYcjEFGSxY2
 sourcecode/integration_coordinates.py,sha256=rvuApnS7WdRUbeQLg_oKj-Gi0koO2RKdw6HenXNgrDo,12443
 sourcecode/intent_router.py,sha256=64d5Q1TKj9h2vv_iuWbCEb0eeeG6H5wYvSX7V_7w-gw,15511
 sourcecode/jdk_exports.py,sha256=fCrlwNAXUT9gge_joq6kMnY3zJxYB2pxqy-0w3o3MJI,874
-sourcecode/license.py,sha256=yXMZkgP8uDFxj6bWQLS2eM9go2o1OA1LiPa3d5bovxM,29913
+sourcecode/license.py,sha256=Rx_TXEztUJB9TzI352hEh8cmCd-30J9WS6iT4EndcW0,30974
 sourcecode/manifest_cache.py,sha256=aPRHUs781d00fVbtlTiSaq0-AS9bAqS7_zJ0snZvlJs,2244
 sourcecode/mcp_nudge.py,sha256=beNjfyb7z09T1rnS4t6Q4qfbLzZQNaP6ddCA4XpmV0s,3256
 sourcecode/metrics_analyzer.py,sha256=gLoRWKygF18jLgwsqmGXSWopw-f5iO1VbM7Jjdif6ag,22809
@@ -276,10 +276,10 @@ sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec
 sourcecode/_docs/DEFECT-LEDGER.md,sha256=EkYSJieDrazfADCZ8tsCsybyW9U0nAzWDQ8rS4KmGTU,1115164
 sourcecode/_docs/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
 sourcecode/_docs/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode/_docs/USER_GUIDE.md,sha256=Hs6k1Au2LqvCO1_eydxRUj0q5l_7cd17AED81QTeobg,103394
-sourcecode-5.9.2.dist-info/METADATA,sha256=oGUpHe6x5KBnysYq5ke8YU9PV-iHDWXQQbUrLinnwRA,63813
-sourcecode-5.9.2.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-5.9.2.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-5.9.2.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
-sourcecode-5.9.2.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode-5.9.2.dist-info/RECORD,,
+sourcecode/_docs/USER_GUIDE.md,sha256=cE9Q2IMoCXELmhwpvZHslppGBGK2nlR0RSzksifni7U,104721
+sourcecode-5.9.4.dist-info/METADATA,sha256=PivRgNyboaCJ75FC86-6HQ4OIIk0l5TAperOYb4uTsI,64752
+sourcecode-5.9.4.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-5.9.4.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-5.9.4.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
+sourcecode-5.9.4.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
+sourcecode-5.9.4.dist-info/RECORD,,