sourcecode 5.9.2__tar.gz → 5.9.3__tar.gz

{sourcecode-5.9.2 → sourcecode-5.9.3}/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [5.9.3] — 2026-08-27
+
+*Workspace entitlement correctness patch release.*
+
+**Fixed**
+
+- `auth workspace` collapses overlapping parent/child repository paths and
+  publishes `overlapping_paths`, preventing physical Java files from being
+  counted twice.
+- `auth workspace` rejects nonexistent or non-directory paths through the
+  standard structured `INVALID_INPUT` / `missing` contract instead of treating
+  them as empty repositories.
+
+**Validation**
+
+- Added regression coverage for duplicate, overlapping, invalid and mixed
+  workspace inputs.
+- Rechecked the contract against representative repositories under
+  `Documents/workspace/testing`.
+
 ## [5.9.2] — 2026-08-27
 
 *Commercial positioning increment: bounded agent context, reproducible cost

{sourcecode-5.9.2 → sourcecode-5.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.2
+Version: 5.9.3
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.2-blue)
+![Version](https://img.shields.io/badge/version-5.9.3-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -196,7 +196,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.2 retains the shared Canonical IR
+**Current performance status.** Release 5.9.3 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
@@ -212,6 +212,12 @@ aggregate Java entitlement. `--enforce` is an opt-in named-buyer pilot that reus
 the existing Pro gate; advisory mode remains the default and no billing is
 performed by the CLI.
 
+`auth workspace` normalizes its repository arguments before counting. If one
+path contains another, the parent is counted once and the overlap is published
+in `overlapping_paths`; a missing or non-directory path is rejected as structured
+invalid input rather than treated as an empty repository. This prevents silent
+entitlement errors in CI and does not change per-repository gates or billing.
+
 **What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
 IR). Pass `--views compact` or `--views compact,agent` to warm only selected views; without
@@ -237,7 +243,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.2 — and, on a build that has aged,
+ask version                    # ask 5.9.3 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.2 → sourcecode-5.9.3}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.2-blue)
+![Version](https://img.shields.io/badge/version-5.9.3-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -147,7 +147,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.2 retains the shared Canonical IR
+**Current performance status.** Release 5.9.3 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
@@ -163,6 +163,12 @@ aggregate Java entitlement. `--enforce` is an opt-in named-buyer pilot that reus
 the existing Pro gate; advisory mode remains the default and no billing is
 performed by the CLI.
 
+`auth workspace` normalizes its repository arguments before counting. If one
+path contains another, the parent is counted once and the overlap is published
+in `overlapping_paths`; a missing or non-directory path is rejected as structured
+invalid input rather than treated as an empty repository. This prevents silent
+entitlement errors in CI and does not change per-repository gates or billing.
+
 **What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
 IR). Pass `--views compact` or `--views compact,agent` to warm only selected views; without
@@ -188,7 +194,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.2 — and, on a build that has aged,
+ask version                    # ask 5.9.3 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

sourcecode-5.9.3/docs/AUDIT-2026-08-27-EXTERNAL-5.9.2.md

@@ -0,0 +1,68 @@
+# External Audit Intake — ASK 5.9.2
+
+**Received:** 2026-08-27  
+**Scope:** regression battery and commercial-positioning review against 5.9.1  
+**Source:** external audit supplied in the Codex task attachment
+
+## Executive disposition
+
+The report uses two different scoring lenses: **9.8/10** for the regression and
+functional battery, and **9/10** for the strategic comparison against 5.9.1.
+They are retained as separate assessments, not averaged into a product KPI.
+
+The audit reports no critical defect and no regression in the previously closed
+surface. It confirms stable behaviour for `SEC-004` / `DEAD-001`, `boot3_readiness`,
+the `selftest` scope warning, pack-gate test-file poisoning, JAX-RS explainability,
+CVE inventory scope, `pr-risk` error handling, `posture --diff --limit`, cache,
+telemetry, baseline and pack flows.
+
+Two new `auth workspace` defects are accepted into the engineering queue:
+
+- **AUD-609-B01, medium:** overlapping repository arguments can double-count the
+  same physical Java files when a parent path and one of its descendants are both
+  supplied. This can make entitlement aggregation inaccurate and can produce a
+  false threshold crossing near the limit.
+- **AUD-609-B02, low-medium:** a nonexistent repository path is treated as a valid
+  empty repository. A typo can therefore produce a successful but misleading
+  entitlement result in automation.
+
+The audit's reproduction is accepted as a defect report, not as proof of the
+suspected implementation mechanism. The fix must establish the invariant through
+tests: overlapping inputs are explicit and deterministic, and invalid paths cannot
+silently become empty repositories.
+
+## Confirmed capabilities
+
+- `audit-report --sign-key` and `audit-verify` perform an offline HMAC-SHA256
+  roundtrip: correct key and untouched content validate; an incorrect key or one-byte
+  content mutation fails with the appropriate result and exit code.
+- `audit-report --pack ens` is evidence mapping only. It publishes `legal_claim: false`
+  and distinguishes present from missing control evidence; it is not ENS certification.
+- `baseline attest` is deterministic, read-only and explicit about non-coverage, but
+  it does **not** sign or hash the attestation for independent integrity verification.
+- `remediation-report` is a redacted JSON projection of ASK's own defect ledger, not
+  a remediation report for the user's analysed repository.
+- `auth workspace --enforce` remains an opt-in named-buyer pilot and was not exercised
+  in this round.
+- `schema` includes `ens-evidence-pack-v1`; `ask version` publishes closure coverage
+  and release cadence provenance.
+
+## Commercial reading
+
+The signed audit bundle materially strengthens the evidence-bundle thesis and is a
+credible compliance-workflow input. It must be described as **tamper-evident integrity
+evidence**, not a certificate: HMAC is symmetric, requires key sharing, and is not
+public PKI. ENS/CRA mappings remain evidence mapping, not legal or regulatory advice.
+
+The commercial route is therefore positive but not fully validated. The missing proof
+is a signed historical attestation, concrete ENS/CRA control translation and a real
+customer reference. The external price indication ($40-60 per developer/month) and
+the "strong buy" verdict are market hypotheses, not pricing evidence; no price change
+is authorized without buyer interviews, usage data or a paid reference.
+
+## Regression and non-regression record
+
+The reported cold-cache measurement (130.2 seconds) is within the supplied historical
+range and is not a regression claim. The seven commands not yet composed into the
+assessment/gate packs are a product opportunity, not a bug. All other re-checks in the
+report are recorded as stable unless contradicted by the two defects above.

{sourcecode-5.9.2 → sourcecode-5.9.3}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,7 +3,12 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT QUEUE — release `5.9.2`; external reconciliation `AUD-608` is implemented.**
+> **CURRENT QUEUE — release `5.9.3`; external reconciliation `AUD-608` is implemented.**
+> The 2026-08-27 external review adds `AUD-609-B01` (overlapping workspace paths
+> double-count Java files) and `AUD-609-B02` (missing workspace paths accepted as
+> empty repositories); both are fixed in `5.9.3`. It reports no regression in the
+> prior closure set. Evidence and the commercial interpretation are in
+> [`AUDIT-2026-08-27-EXTERNAL-5.9.2.md`](AUDIT-2026-08-27-EXTERNAL-5.9.2.md).
 > `AUD-608-C01` is closed in `fe1f624`: `cve` declares static
 > dependency-inventory coverage and non-coverage. `AUD-608-P01` is closed in
 > `b479465`: `pr-risk --since` constructs its base context and surfaces failures
@@ -100,6 +105,20 @@ aspirations: each is asserted by that row's tests.
 | `AUD-607-X09` | P3 | `self-audit` — run ASK against its own build. | `ask self-audit` (`self-audit-v1`) | **Implemented (`f1fa913`), with its "not recommended" reason shipped inside the payload.** The semantic engine does not apply to Python source, so those figures are absent and declared rather than reported as zeros. What it does check — cache model, format contract, schema registry and output affordances over the INSTALLED build — found a real drift on its first run. |
 | `ASK-COM-01` | P1 | Continuous evidence attestation over persisted baseline history. | `ask baseline attest` (`baseline-attestation-v1`) | **Implemented.** Read-only projection of architecture or findings trend; publishes capture boundaries, latest commit, comparability and explicit non-coverage. It never claims legal compliance, improvement, or a clean zero without history. |
 
+### Feature Intake — external review of 5.9.2, 2026-08-27
+
+The supplied regression and market review reports no regression in the prior closure
+set. Its two reproducible `auth workspace` defects are opened below; the report's
+commercial recommendations are recorded as hypotheses, not product claims. Full
+triage is in [`AUDIT-2026-08-27-EXTERNAL-5.9.2.md`](AUDIT-2026-08-27-EXTERNAL-5.9.2.md).
+
+| ID | Priority | Feature / defect | Acceptance criteria | Status/order |
+|---|---:|---|---|---|
+| `AUD-609-B01` | P2 | `auth workspace` double-counts overlapping repository paths. | Normalize paths, detect parent/descendant overlap and prevent silent double-counting; publish an explicit overlap decision or reject the ambiguous input. Preserve deterministic per-repository evidence and add fixtures for parent-only, child-only and overlapping inputs. | **Fixed in `5.9.3`.** Parent/descendant inputs collapse to one counted tree and publish `overlapping_paths`. |
+| `AUD-609-B02` | P2 | `auth workspace` accepts a nonexistent path as an empty repository. | Validate every input path before counting; return the repository's standard structured path error, or an explicit invalid entry that cannot yield a successful entitlement decision. Add a regression fixture for typos and mixed valid/invalid inputs. | **Fixed in `5.9.3`.** Invalid paths fail with structured `INVALID_INPUT` / `missing`. |
+| `AUD-609-C01` | P2 | Signed evidence and historical attestation use different integrity contracts. | Decide whether `baseline attest` gains the existing signing mechanism or clearly publishes that it is unsigned; document the choice in help, schema and buyer-facing material. Do not call unsigned output a certificate or compliance proof. | **Queued, commercial validation.** No implementation claim until the signing boundary and key model are explicit. |
+| `AUD-609-C02` | P3 | Translate technical evidence into concrete ENS/CRA controls. | Define a named control mapping with source evidence, missing evidence and `legal_claim: false`; validate it with a named compliance buyer or auditor before presenting it as a market capability. | **Queued, buyer-gated.** `audit-report --pack ens` remains evidence mapping only. |
+
 ### Explicitly Rejected
 
 These are not roadmap work: `--format` and `--compact` remain separate contracts;

{sourcecode-5.9.2 → sourcecode-5.9.3}/docs/EXECUTIVE-ROADMAP.md

@@ -5,7 +5,7 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
-> **CURRENT UPDATE — release `5.9.2`, following the external `5.9.0` reconciliation (`AUD-608`).**
+> **CURRENT UPDATE — release `5.9.3`, following the external `5.9.0` reconciliation (`AUD-608`).**
 > The commercial increment adds stateless context budgets, a reproducible context-cost harness,
 > source-level migration SARIF and an opt-in workspace entitlement pilot. Advisory behaviour remains
 > the default; named-buyer validation is still required before broad enforcement.
@@ -19,6 +19,21 @@
 > non-reproduction did not cover the payload shape now identified. Details are
 > in [`AUDIT-2026-08-26-EXTERNAL-5.9.0.md`](AUDIT-2026-08-26-EXTERNAL-5.9.0.md).
 
+> **EXTERNAL REVIEW — 5.9.2, received 2026-08-27.** No regression was reported in the
+> previously closed surface. Two `auth workspace` defects are now open: overlapping
+> parent/child paths can double-count Java files, and nonexistent paths are accepted as
+> empty repositories. Both affect entitlement accuracy and must close before pricing or
+> enforcement decisions rely on workspace aggregation. `audit-report --sign-key` plus
+> `audit-verify` is confirmed as working offline HMAC-SHA256 integrity evidence.
+> `baseline attest` remains unsigned and must not be sold as a tamper-verifiable
+> certificate. ENS output is evidence mapping only (`legal_claim: false`); no customer
+> reference or buyer validation exists yet. Full triage: [`AUDIT-2026-08-27-EXTERNAL-5.9.2.md`](AUDIT-2026-08-27-EXTERNAL-5.9.2.md).
+
+> **5.9.3 correction.** `auth workspace` now counts overlapping parent/child paths once
+> and rejects missing or non-directory paths with the standard structured input error.
+> Workspace entitlement is therefore safer to measure, but remains advisory by default;
+> no pricing or enforcement decision is authorized by this fix alone.
+
 > **HISTORICAL STATUS — release `5.9.0`, following two external audits of `5.8.32`, 2026-08-26.** Two
 > independent rounds scored the release **9.7/10** (reverification) and **8/10** (comparison against
 > `5.8.31`). **Neither round reported a regression**, and both maintained the same commercial

{sourcecode-5.9.2 → sourcecode-5.9.3}/docs/PRODUCT-ROUTE.md

@@ -33,6 +33,22 @@ The public trust layer, if activated, must be a generated and redacted
 projection, never the raw defect ledger. Its acceptance rules must exclude
 maintainer paths, third-party evaluation subjects and unsupported claims.
 
+### Evidence and commercial validation boundary
+
+The 5.9.2 external review confirms that `audit-report --sign-key` and
+`audit-verify` provide offline HMAC-SHA256 integrity verification for an evidence
+bundle. The route may describe this as tamper-evident bundle integrity, not as a
+certificate or public-PKI trust: HMAC is symmetric and requires controlled key
+sharing. `audit-report --pack ens` remains an evidence mapping with
+`legal_claim: false`, not ENS/CRA certification or legal advice.
+
+`baseline attest` is a deterministic, read-only continuity projection, but it is
+currently unsigned. Until its integrity contract is decided and validated, it
+must not be positioned as independently verifiable historical evidence. A real
+customer reference, concrete control translation and buyer evidence are still
+required before changing the price, activating workspace enforcement or claiming
+compliance-market fit. External price opinions are hypotheses, not pricing data.
+
 ## Individual commands and packs
 
 Every existing command remains supported for users who want a precise answer:

{sourcecode-5.9.2 → sourcecode-5.9.3}/docs/USER_GUIDE.md

@@ -46,13 +46,13 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.2, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.3, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.2, with release-artifact verification
+the two pack fixes are included in release 5.9.3, with release-artifact verification
 remaining for detached execution and pack evidence.
 
 ---
@@ -221,7 +221,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.2
+# ask 5.9.3
 ```
 
 Requires Python 3.9+.
@@ -1180,6 +1180,8 @@ the stored architecture or findings series (`--kind findings`) and publishes its
 boundaries, latest commit, comparability and explicit limits as `baseline-attestation-v1`.
 It is evidence continuity, not a legal or regulatory compliance verdict, and it returns
 `status: no_history` instead of manufacturing a clean zero when no capture exists.
+Unlike `audit-report --sign-key`, `baseline attest` is currently unsigned: its
+`content_id` supports deterministic comparison, not third-party tamper verification.
 
 For a multi-repository buyer, `ask auth workspace <repo>...` previews the aggregate Java
 population that a workspace-sized entitlement would see. The preview is advisory only: it
@@ -1187,6 +1189,10 @@ does not change the current per-repository gate or charge the workspace.
 For a named-buyer pilot, add `--enforce`: crossing the aggregate threshold then requires
 the existing Pro entitlement and exits with the standard license-required contract; below
 the threshold it passes. This flag is opt-in and does not change per-repository gates.
+Repository arguments are normalized before counting. If a parent and descendant are both
+supplied, the parent is counted once and the overlap is listed in `overlapping_paths`.
+Missing or non-directory paths fail with the standard structured `INVALID_INPUT` / `missing`
+contract; they are never treated as empty repositories.
 
 ---
 

{sourcecode-5.9.2 → sourcecode-5.9.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.2"
+version = "5.9.3"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.2 → sourcecode-5.9.3}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.2"
+__version__ = "5.9.3"

{sourcecode-5.9.2 → sourcecode-5.9.3}/src/sourcecode/cli.py

@@ -17919,7 +17919,8 @@ def auth_workspace_cmd(
         "--enforce",
         help=(
             "Pilot gate: require the existing Pro entitlement when the aggregate "
-            "workspace threshold is exceeded. Advisory by default."
+            "workspace threshold is exceeded. Advisory by default. Overlapping "
+            "paths are counted once; missing paths are rejected."
         ),
     ),
 ) -> None:
@@ -17927,12 +17928,17 @@ def auth_workspace_cmd(
 
     Advisory mode is the default. Use ``--enforce`` only for the named-buyer
     pilot: it reuses the existing Pro gate when the aggregate threshold is
-    crossed and performs no billing.
+    crossed and performs no billing. Repository paths are normalized, parent /
+    descendant overlaps are counted once, and missing paths are rejected.
     """
     _enforce_format("auth-workspace", format)
     from sourcecode.license import require_pro, workspace_entitlement
 
-    data = workspace_entitlement([str(repo) for repo in repos], enforce=enforce)
+    validated_repos = [
+        _admit_path(repo, usage="auth workspace")
+        for repo in repos
+    ]
+    data = workspace_entitlement([str(repo) for repo in validated_repos], enforce=enforce)
     if data["enforcement_decision"] == "pro_required":
         require_pro("workspace entitlement")
     _emit_command_output(

{sourcecode-5.9.2 → sourcecode-5.9.3}/src/sourcecode/license.py

@@ -550,7 +550,33 @@ def workspace_entitlement(
     aggregate crosses the threshold. This function only publishes the decision;
     it never changes the per-repository rule or performs billing.
     """
-    unique = sorted({str(Path(path).resolve()) for path in repo_paths})
+    normalized = sorted({str(Path(path).resolve()) for path in repo_paths})
+    invalid = [path for path in normalized if not Path(path).is_dir()]
+    if invalid:
+        raise FileNotFoundError(
+            "Workspace repository path does not exist or is not a directory: "
+            + invalid[0]
+        )
+    unique: list[str] = []
+    overlapping_paths: list[dict[str, str]] = []
+    for candidate in normalized:
+        parent = next(
+            (existing for existing in unique if Path(candidate) == Path(existing)
+             or Path(existing) in Path(candidate).parents),
+            None,
+        )
+        if parent is not None:
+            overlapping_paths.append({"parent": parent, "child": candidate})
+            continue
+        descendants = [
+            existing for existing in unique
+            if Path(candidate) in Path(existing).parents
+        ]
+        for descendant in descendants:
+            unique.remove(descendant)
+            overlapping_paths.append({"parent": candidate, "child": descendant})
+        unique.append(candidate)
+    unique.sort()
     repositories = [
         {"path": path, "java_files": count_java_files(path)}
         for path in unique
@@ -561,6 +587,7 @@ def workspace_entitlement(
         "status": "ok" if repositories else "no_repositories",
         "repository_count": len(repositories),
         "repositories": repositories,
+        "overlapping_paths": overlapping_paths,
         "workspace_java_files": total,
         "workspace_java_file_limit": _FREE_REPO_JAVA_FILE_LIMIT,
         "workspace_threshold_exceeded": total > _FREE_REPO_JAVA_FILE_LIMIT,