sourcecode 5.9.3__py3-none-any.whl → 5.9.4__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.3"
+__version__ = "5.9.4"

sourcecode/_build_commit.py

@@ -1,5 +1,5 @@
 """Generated at build time by hatch_build.py. Do not edit (AUD-592-D04)."""
 
-BUILD_COMMIT = 'a0b0aba2d197881146491fccf60155b9d776bdb8'
+BUILD_COMMIT = 'ec6b285e69ecb8d5dc90f82b106af14c221d1856'
 CLOSURE_PROVENANCE = {'Window': {'commit': '', 'status': 'uncited'}, '`AUD-588-F05`': {'commit': '470e4a4', 'status': 'present'}, '`AUD-590-B01` / `B-01`, `F-01`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B02` / `B-02`, `F-02`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B03` / `B-03`, `F-03`': {'commit': '', 'status': 'uncited'}, '`AUD-590-B04` / `B-04`, `F-04`': {'commit': '', 'status': 'uncited'}, '`AUD-590-R01` / `R-01`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A01` / `A-1`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A02` / `A-2`, `A-4`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A03` / `A-3`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A05` / `A-5`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A06` / `A-6`, `A-7`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A08` / `A-8`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A09` / `A-9`': {'commit': '', 'status': 'uncited'}, '`AUD-591-A10` / `A-10`': {'commit': '', 'status': 'uncited'}, '`AUD-592-A02` / `A-1` second half, `§12.5`': {'commit': '63f3d61', 'status': 'present'}, '`AUD-592-B01` / `B-8`': {'commit': '8329614', 'status': 'present'}, '`AUD-592-D01` / `D-1`': {'commit': '0f8e03f', 'status': 'present'}, '`AUD-592-D02` / `D-2`': {'commit': '1d3db4d', 'status': 'present'}, '`AUD-592-D03` / `D-3`': {'commit': 'f28fe40', 'status': 'present'}, '`AUD-592-R01` / `A-1`': {'commit': '216025f', 'status': 'present'}, '`AUD-592-R02` / `N-4`, reopens `AUD-513-N04`': {'commit': 'ec3050d', 'status': 'present'}, '`AUD-593-N01` / `N-01`': {'commit': 'dd6a706', 'status': 'present'}, '`AUD-593-N02` / `N-02`': {'commit': 'f539787', 'status': 'present'}, '`AUD-593-N03` / `N-03`': {'commit': '1dd0b1c', 'status': 'present'}, '`AUD-593-N05` / `N-05`': {'commit': 'aa89388', 'status': 'present'}, '`AUD-593-N06` / `N-06`': {'commit': 'aa584a6', 'status': 'present'}, '`AUD-594-N04` / `D-5`, disclosure half of `B-3`': {'commit': 'a0060b7', 'status': 'present'}, '`AUD-594-X01` / `A-1`, residual of `AUD-593-N03`': {'commit': 'dd222b9', 'status': 'present'}, '`AUD-594-X02` / `A-1` second half': {'commit': '1193937', 'status': 'present'}, '`AUD-594-X03` / `X-03`, residual of `AUD-593-N01`': {'commit': 'e89e8f0', 'status': 'present'}, '`AUD-594-X04`': {'commit': '05b8cc9', 'status': 'present'}, '`AUD-595-A02` / `N-5`, advisory half of `AUD-588-B11`': {'commit': '3e15227', 'status': 'present'}, '`AUD-595-A03` / `B-6` exit-code half': {'commit': 'ab7285f', 'status': 'present'}, '`AUD-595-A05`': {'commit': 'e0b3d10', 'status': 'present'}, '`AUD-595-A07`, narrow half of `AUD-592-A02`': {'commit': 'cc15177', 'status': 'present'}, '`AUD-595-B01` / §B': {'commit': 'b77a1ad', 'status': 'present'}, '`AUD-595-Q01`': {'commit': '91a6566', 'status': 'present'}, '`AUD-596-A01` / `ASK-DET-001`': {'commit': 'fa508b4', 'status': 'present'}, '`AUD-596-A02` / `ASK-SELF-001`': {'commit': '4dfadc8', 'status': 'present'}, '`AUD-596-A03` / `ASK-C1-001`': {'commit': 'bffa3a6', 'status': 'present'}, '`AUD-596-A04` / `ASK-UX-003` + `ASK-UX-004`': {'commit': 'f0aac3c', 'status': 'present'}, '`AUD-596-B01` / `B-01`, harder witness for `BUG-6`': {'commit': '567d09d', 'status': 'present'}, '`AUD-596-B02` / `B-02`, class residual of `R2`': {'commit': '', 'status': 'uncited'}, '`AUD-596-B03` / `B-03`': {'commit': 'a8cb814', 'status': 'present'}, '`AUD-596-B06` / `B-06`': {'commit': '8107927', 'status': 'present'}, '`AUD-596-B07` / `B-07`, class residual of `AUD-592-R02`': {'commit': 'e060485', 'status': 'present'}, '`AUD-596-B09` / `B-09`': {'commit': '5b8146c', 'status': 'present'}, '`AUD-596-B10` / `B-10`': {'commit': '5cb994d', 'status': 'present'}, '`AUD-596-B16` / `B-16`': {'commit': '1507f69', 'status': 'present'}, '`AUD-596-D01` / `B-13` + `B-14`': {'commit': '0b1bdf0', 'status': 'present'}, '`AUD-596-D02` / `B-08`, residual of `AUD-594-N04`': {'commit': 'e7f73c3', 'status': 'present'}, '`AUD-596-D03` / `ASK-AGT-001`': {'commit': '8c46967', 'status': 'present'}, '`AUD-596-D04` / `B-18`': {'commit': '040f027', 'status': 'present'}, '`AUD-596-D05` / `B-19`': {'commit': 'fd2bf68', 'status': 'present'}, '`AUD-596-D06` / `B-20`': {'commit': '784cd83', 'status': 'present'}, '`AUD-596-D07` / `B-17`, half refuted': {'commit': 'c3ff822', 'status': 'present'}, '`AUD-596-D08` / `B-22`, class residual of `AUD-591-A06`': {'commit': 'b396c6a', 'status': 'present'}, '`AUD-596-D09` / `B-23`, surviving half of `B26`': {'commit': 'fd3d63f', 'status': 'present'}, '`AUD-596-D10` / `B-29`': {'commit': '', 'status': 'uncited'}, '`AUD-596-D11` / `ASK-UX-005`': {'commit': 'f4b4f77', 'status': 'present'}, '`AUD-596-D12` — six hints that send the reader back to the error': {'commit': '498df44', 'status': 'present'}, '`AUD-596-D13` / `B-28`': {'commit': '1014c72', 'status': 'present'}, '`AUD-596-D14` / `B-15`, narrow half of `B20`': {'commit': '10f2827', 'status': 'present'}, '`AUD-596-R01` / `B-05`': {'commit': '', 'status': 'uncited'}, '`AUD-596-X01` / `ASK-GATE-001`, gating half of `B24`': {'commit': 'e59c655', 'status': 'present'}, '`AUD-596-X02` / `ASK-UX-001` + `ASK-UX-002` + `B-21`': {'commit': 'f6ebf50', 'status': 'present'}, '`AUD-597-A01` / `ASK-UX-001` + `N-01`': {'commit': 'f8cf061', 'status': 'present'}, '`AUD-597-A02` / `ASK-UX-008` + `ASK-DOC-002`': {'commit': '9d47a4c', 'status': 'present'}, '`AUD-597-A03` / `ASK-DET-001`': {'commit': '4c7622a', 'status': 'present'}, '`AUD-597-A04` / `ASK-LEDGER-001`': {'commit': '46fb870', 'status': 'present'}, '`AUD-597-D01` / `B-04`': {'commit': '1094e6a', 'status': 'present'}, '`AUD-597-D02` / `ASK-DOC-001`': {'commit': 'ecb1bb7', 'status': 'present'}, '`AUD-597-D03` / `N-06`': {'commit': '9784333', 'status': 'present'}, '`AUD-597-D04` / `N-05`': {'commit': 'e51c087', 'status': 'present'}, '`AUD-597-D05` / `N-04`, fourth appearance of `C4-27`': {'commit': '9cccc15', 'status': 'present'}, '`AUD-597-D06` / `ASK-CLI-001`': {'commit': '178aa6d', 'status': 'present'}, '`AUD-597-D07` / `N-03`': {'commit': '9245e35', 'status': 'present'}, '`AUD-597-R01` / `ASK-PERF-001`': {'commit': '6910054', 'status': 'present'}, '`AUD-597-R02` / `ASK-ENC-001`': {'commit': 'ce6dac1', 'status': 'present'}, '`AUD-597-R03` / `ASK-UX-002`': {'commit': 'c57e50b', 'status': 'present'}, '`AUD-597-X01` / `ASK-BUILD-001` + `ASK-META-001` / `B-12`': {'commit': '354338b', 'status': 'present'}, '`AUD-598-B01` / `ASK-META-001`': {'commit': 'b2f7c65', 'status': 'present'}, '`AUD-598-B02` / `ASK-UX-002`': {'commit': '56a4bf7', 'status': 'present'}, '`AUD-598-B03` / `B-11`': {'commit': 'c63cb24', 'status': 'present'}, '`AUD-598-B04` / `N-02`': {'commit': '187937f', 'status': 'present'}, '`AUD-598-R01` / `ASK-PERF-002`': {'commit': '', 'status': 'uncited'}, '`AUD-598-X01` / `N-01` + `B-13` + `B-14` + `B-29` + `N-06`': {'commit': '6f2f5a4', 'status': 'present'}, '`AUD-600-B01` / `P-01`': {'commit': '366ffed', 'status': 'present'}, '`AUD-600-B02` / `P-02` + `ASK-PACK-002`': {'commit': '2a814c3', 'status': 'present'}, '`AUD-600-B03` / `ASK-PACK-001`': {'commit': '452f2a0', 'status': 'present'}, '`AUD-600-D01`': {'commit': '1224e1b', 'status': 'present'}, '`AUD-600-D02`': {'commit': 'eab8172', 'status': 'present'}, '`AUD-600-R01` / `R-01`': {'commit': '88add64', 'status': 'present'}, '`AUD-601-B01` / `N-02`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-B02` / `ASK-PACK-004`': {'commit': '', 'status': 'uncited'}, '`AUD-601-D01` / `N-01`, `ASK-UX-001`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-D02` / `B-13`, `B-14`, 5th round': {'commit': '', 'status': 'uncited'}, '`AUD-601-M01` / `B-26`, `B-27` retracted': {'commit': '', 'status': 'uncited'}, '`AUD-601-R01` / `R-02`': {'commit': '', 'status': 'uncited'}, '`B-3`': {'commit': '773268d', 'status': 'present'}, '`B-6`': {'commit': '17c6e06', 'status': 'present'}, '`B-8`': {'commit': '8329614', 'status': 'present'}, '`BUG-3` / `443b345`': {'commit': '', 'status': 'uncited'}, '`BUG-4a` / `AUD-588-B11` residual': {'commit': '24b4185', 'status': 'present'}, '`BUG-4b` / `AUD-588-B11` residual': {'commit': '0376350', 'status': 'present'}, '`E-39`, class residual of `AUD-593-N06`': {'commit': '25fc11f', 'status': 'present'}, '`N-5`': {'commit': 'c68083f', 'status': 'present'}, '`N-7`': {'commit': '082e9de', 'status': 'present'}, '`R-1`': {'commit': '424fb1c', 'status': 'present'}, '`R-2`': {'commit': '5158b92', 'status': 'present'}, '`R-3`': {'commit': '88aec04', 'status': 'present'}, '`R-4`': {'commit': '04fd04f', 'status': 'present'}}
 CLOSURE_COVERAGE = {'closed_rows': 113, 'present': 88, 'absent': 0, 'unresolved': 0, 'uncited': 25, 'unknown': 0}

sourcecode/_docs/USER_GUIDE.md

@@ -46,15 +46,30 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.3, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.4, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.3, with release-artifact verification
+the two pack fixes are included in release 5.9.4, with release-artifact verification
 remaining for detached execution and pack evidence.
 
+### Reliability contracts in 5.9.4
+
+Invalid analysis inputs fail before expensive work and use the structured
+`INVALID_INPUT` envelope: a missing `--consumer` repository, a malformed CVE
+feed, or an unresolved `pack gate --since` ref is never treated as an empty or
+`UNVERIFIED` result. `posture --diff` reports unknown profiles when the project
+declares profiles. `baseline capture` does not replace a snapshot already stored
+for the same commit; use `--auto` when a pipeline should skip it.
+
+With `endpoints --compact`, `endpoints: []` means the rows were deliberately
+omitted. Read `endpoints_note`, `endpoints_omitted` and `total`; an empty list is
+not evidence that the API has no routes. `impact` and `impact-chain` return exit
+code 1 when the target is unresolved, including when the selected repository
+contains no Java sources.
+
 ---
 
 ## The semantic engine
@@ -221,7 +236,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.3
+# ask 5.9.4
 ```
 
 Requires Python 3.9+.

sourcecode/architectural_baseline.py

@@ -445,11 +445,15 @@ def _announce_ask_dir(ask_dir: Path) -> None:
 
 
 def write_baseline(baseline: dict, out_dir: Path) -> Path:
-    """Write `baseline` as deterministic JSON under `out_dir`; return the file path."""
+    """Write a new baseline without replacing an existing commit snapshot."""
     _readonly.guard(out_dir, what="baseline history directory")
     out_dir.mkdir(parents=True, exist_ok=True)
     protect_ask_dir(out_dir)
     path = out_dir / _baseline_filename(baseline)
+    if path.exists():
+        raise FileExistsError(
+            f"Baseline already exists for commit {baseline.get('commit') or '-'}: {path}"
+        )
     path.write_text(
         json.dumps(baseline, sort_keys=True, indent=2) + "\n", encoding="utf-8"
     )

sourcecode/cli.py

@@ -4552,6 +4552,25 @@ def pack_gate_cmd(
         )
         raise typer.Exit(code=2)
     comparison_ref = since
+    if since is not None:
+        from sourcecode.git_checkout import RefError, repo_root, resolve_ref
+
+        try:
+            resolve_ref(repo_root(root), since)
+        except RefError as exc:
+            # Test doubles and callers that provide a non-Git analysis root are
+            # still handled by the existing pack component contracts. Only a
+            # ref failure in an actual repository is an invalid comparison.
+            if exc.code == "not_a_git_repository":
+                pass
+            else:
+                _emit_error_json(
+                    INVALID_INPUT_CODE,
+                    str(exc),
+                    ref=exc.ref or since,
+                    hint="Use a commit, tag, or local branch that exists in the repository.",
+                )
+                raise typer.Exit(code=2)
     if pr is not None:
         try:
             from sourcecode.github_diff import pull_request_base_ref
@@ -8578,6 +8597,9 @@ def impact_cmd(
       not_found  — no symbol and no substring. `risk_score` is null, never 0:
                    nothing was measured, which is not measuring zero.
 
+    An unresolved target exits with code 1, including when the selected repository
+    contains no Java sources; the structured answer still names `not_found`.
+
     \b
     NOTE: Free on repos up to the size limit; Pro unlocks enterprise-scale
     monoliths. Run 'ask license' for details.
@@ -8652,7 +8674,7 @@ def impact_cmd(
             format,
         )
         _emit_command_output(_nf_output, output_path, copy)
-        return
+        _exit_on_unresolved_target("not_found")
 
     _prog = Progress()
     _prog.start(f"building CIR ({len(file_list)} files) for impact analysis")
@@ -8902,7 +8924,8 @@ def endpoints_cmd(
         False, "--compact",
         help="Answer how exposed the repository is without listing every endpoint: "
              "counts by method, by security policy and by controller. Every count is "
-             "measured over the full population.",
+             "measured over the full population; an empty `endpoints` list means the "
+             "rows were intentionally omitted, not that no endpoints exist.",
     ),
     no_cache: bool = typer.Option(
         False, "--no-cache",
@@ -8980,6 +9003,13 @@ def endpoints_cmd(
     _enforce_format("endpoints", format)
 
     target = _admit_path(path)
+    if consumer:
+        # A missing consumer must fail before the server scan. Treating it as an
+        # empty consumer silently turns a requested join into an unfiltered one.
+        consumer = [
+            _admit_path(item, usage="endpoints --consumer")
+            for item in consumer
+        ]
 
     # AUD-591-A10: a prefix that is not a route selects nothing and reports it
     # as no exposure. Rejected before the analysis, so the shell rewrite is
@@ -9116,6 +9146,12 @@ def endpoints_cmd(
 
         _listed = len(data.get("endpoints", []))
         data["endpoints"] = []
+        data["endpoints_note"] = (
+            f"The endpoints list is intentionally omitted by --compact; "
+            f"{_listed} endpoint(s) were measured. An empty `endpoints` list "
+            "does not mean that the repository has no endpoints. Re-run without "
+            "--compact or narrow the request to retrieve rows."
+        )
         data["endpoints_omitted"] = {
             "total": _listed,
             "shown": 0,
@@ -10599,7 +10635,9 @@ def baseline_capture_cmd(
     ref: Optional[str] = typer.Option(
         None, "--ref",
         help="Human label for this baseline (e.g. a version or milestone). "
-             "The commit is recorded automatically when the path is a git repo.",
+             "The commit is recorded automatically when the path is a git repo. "
+             "A capture never overwrites an existing snapshot for the same commit; "
+             "use --auto to skip an already captured commit.",
     ),
     kind: str = typer.Option(
         "architecture", "--kind",
@@ -10750,7 +10788,16 @@ def baseline_capture_cmd(
     baseline = build_baseline(
         _cir, ref=ref, commit=git_commit(target_dir), record_env=record_env,
     )
-    written = write_baseline(baseline, dest)
+    try:
+        written = write_baseline(baseline, dest)
+    except FileExistsError as exc:
+        _prog.finish()
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            str(exc),
+            hint="Use `--auto` to skip an already captured commit, or capture a new commit.",
+        )
+        raise typer.Exit(code=1)
     _prog.finish()
 
     t = baseline["totals"]
@@ -14519,7 +14566,9 @@ def posture_cmd(
     Two axes, and they are different questions. `--diff` holds the tree fixed
     and moves the profile set. `--diff-ref` (and `--since`) hold the profile set
     fixed and move the tree: *does this change what a client can reach without
-    authenticating?* That one takes `--fail-on` and is the per-PR gate.
+    authenticating?* That one takes `--fail-on` and is the per-PR gate. When the
+    repository declares profiles, `--diff` rejects a profile name outside that
+    population instead of comparing a configuration that does not exist.
 
     \b
     Examples:
@@ -14743,10 +14792,28 @@ def posture_cmd(
                 )
                 raise typer.Exit(code=1)
             left_raw, right_raw = diff.split(":", 1)
+            left_profiles = _parse_set(left_raw, flag="--diff (left side)")
+            right_profiles = _parse_set(right_raw, flag="--diff (right side)")
+            from sourcecode.spring_profiles import profile_population
+
+            declared_profiles = set(profile_population(path).names)
+            missing_profiles = sorted(
+                (left_profiles | right_profiles) - declared_profiles
+            )
+            if missing_profiles and declared_profiles:
+                _emit_error_json(
+                    INVALID_INPUT_CODE,
+                    "--diff names profile(s) not declared by the repository: "
+                    + ", ".join(missing_profiles),
+                    profiles=missing_profiles,
+                    hint="Use profiles reported by `ask posture <repo>`; use a single "
+                    "posture run to inspect an undeclared profile explicitly.",
+                )
+                raise typer.Exit(code=1)
             data = diff_posture(
                 path,
-                _parse_set(left_raw, flag="--diff (left side)"),
-                _parse_set(right_raw, flag="--diff (right side)"),
+                left_profiles,
+                right_profiles,
                 overrides,
             )
         else:
@@ -15571,7 +15638,7 @@ def impact_chain_cmd(
         output = _serialize_dict(data, format)
         _emit_command_output(output, output_path, copy,
                              success_msg=f"Impact chain written to {output_path}")
-        return
+        _exit_on_unresolved_target("not_found")
 
     _prog = Progress()
     _prog.start(f"analyzing impact ({len(file_list)} files)")

sourcecode/cve_feed.py

@@ -258,9 +258,14 @@ def load_feed(feed_path: Path, *, now: Optional[datetime] = None) -> Feed:
                     newest = stamp
 
     if unreadable:
+        feed.error = f"{unreadable} feed file(s) were not valid JSON"
         feed.limitations.append(
-            f"{unreadable} feed file(s) were not valid JSON and were skipped"
+            f"{unreadable} feed file(s) were not valid JSON; the feed was rejected"
         )
+        # Partial advisory data is unsafe for a reachability gate: a skipped
+        # file can contain the one advisory that should have blocked the run.
+        feed.loaded = False
+        return feed
     feed.packages = len(feed.by_package)
     feed.loaded = True
 

{sourcecode-5.9.3.dist-info → sourcecode-5.9.4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.3
+Version: 5.9.4
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.3-blue)
+![Version](https://img.shields.io/badge/version-5.9.4-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -196,7 +196,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.3 retains the shared Canonical IR
+**Current performance status.** Release 5.9.4 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
@@ -218,6 +218,14 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
+Release 5.9.4 also hardens the boundary contracts: missing consumer repositories,
+malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
+input errors; duplicate same-commit baselines are never overwritten. `posture
+--diff` validates unknown profiles when the repository declares profiles. In
+`endpoints --compact`, an empty `endpoints` list is explicitly marked as an
+intentional omission, not an empty API; unresolved `impact` and `impact-chain`
+queries exit non-zero, including on repositories without Java sources.
+
 **What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
 IR). Pass `--views compact` or `--views compact,agent` to warm only selected views; without
@@ -243,7 +251,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.3 — and, on a build that has aged,
+ask version                    # ask 5.9.4 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.3.dist-info → sourcecode-5.9.4.dist-info}/RECORD

@@ -1,12 +1,12 @@
-sourcecode/__init__.py,sha256=UDhga2gkkWXn74Pt5-7wx8lD43QwN3SpJUzes_yiE-s,308
+sourcecode/__init__.py,sha256=0qlYxElAIApXgtaqvLvB59Bcp23mslHDvyztYWrQZD0,308
 sourcecode/__main__.py,sha256=qDFVkobwsdZrX0B3stiRqsUNivVpybKO-egzAwCW4xw,165
-sourcecode/_build_commit.py,sha256=_5RY0YyRD9M5XcuDOokJ_Lx30t5eia8v9rvq3NDpzB0,8740
+sourcecode/_build_commit.py,sha256=W0ohkcA2_TncmrWEsLzLPfZNmCxpl2xc1rVqQD4-i6o,8740
 sourcecode/access_drift.py,sha256=1R7_fiAPvKNOnxc9uxkH3JH-k8MiAuyE7FwWUX1r4Fg,8995
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/analysis_budget.py,sha256=ZuNEboPF8A6GK-_V7WNt92ezgriga7_Rbr-vvSN4UEE,4183
 sourcecode/answer_bounds.py,sha256=_51_DCuYEUmI_xwUFxDMiprSavkNakkLiIBbPjevQ3M,9793
 sourcecode/archetype.py,sha256=V_s5grgpbanrXb8qGEQb73W5Cg5iKW9FQHWKgg5KM8Y,41201
-sourcecode/architectural_baseline.py,sha256=4GiMVBLJVHvRKSWQGf2ZVurI1-R0qk5pmaevgvGSgVA,26325
+sourcecode/architectural_baseline.py,sha256=9ds-ZYw4dEJUKWZSdq_ufHq7d2AXnMbEHteSQlT7iu8,26468
 sourcecode/architectural_delta.py,sha256=JhZVmA0gYUryt4x4ieVuxPbcvoBygHgADZaYJ_o4gdk,15142
 sourcecode/architecture_analyzer.py,sha256=GFc4ek-s1IHWM7pl-0L32WahZ93AmDgrAMcOuBKA5Dk,61463
 sourcecode/architecture_summary.py,sha256=BVVRHd952cjRhjHnR6CPrvKgaa-tdM16l-pBi1yDCPs,32395
@@ -35,7 +35,7 @@ sourcecode/change_plan.py,sha256=drAoDsqFplutCLc6Y0xue7sYkTls0SpYh7aOXvttv3I,129
 sourcecode/ci_output.py,sha256=X4NRokWWMRF9Ex8OQrEO2g04GzJ00GDP5zYIoqI9YCc,4625
 sourcecode/cir_graphs.py,sha256=RytqSv1WF8kdlfXj2fPQz16LY4akS2kyThbdWL8beCQ,14835
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=quyqy_kgnVGoCue8UcibOX3EjDg1epoLMV7uwSeOHUg,933170
+sourcecode/cli.py,sha256=_8CaYY1ye6GNc1VEYzOa4JbTkmUiGoxfnUffIi7i1Zo,936454
 sourcecode/client_calls.py,sha256=YOPnfRZzRyqmdHvXSVeiunW8cuiuCuWXacNIQRgKMCw,22640
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=Lnfmm9I3k0H1jP1tV6ZJ-R7znjQPLPLCe5TzV1Jb_PM,15323
@@ -52,7 +52,7 @@ sourcecode/contract_init.py,sha256=bXRCqWM9tvrDLeT8j7ea6IWf87jB4VJxnlSzGBsRRXo,1
 sourcecode/contract_model.py,sha256=nRxJKPMs1VHwFTa8AVXhGmaLjti3Lr2sjHDpWgv1bfE,3917
 sourcecode/contract_pipeline.py,sha256=4XE-xhab7ysdExXyUOBl2hAH4MABo7moKnT9V4XcEwQ,30243
 sourcecode/coverage_parser.py,sha256=X9scuUWxacahYTrTBGea2Ku-sf-WCVcnc9OEB35_3IU,19340
-sourcecode/cve_feed.py,sha256=t93Ofu0uxB3zyI8W9nUKmH4Ljbt4qZpGIg68IP_aTrY,10749
+sourcecode/cve_feed.py,sha256=IBVpQaY04biXKEeNf1qKO_95GqEV23fwhj4oNk7s1-g,11028
 sourcecode/cve_reachability.py,sha256=aEHkG3IaeLxgekK79cz07QTcv9LZHEqEYqyLGjwjzSE,20409
 sourcecode/data_exposure.py,sha256=73EcuHsN3ESKdSvSj1B2FzD1myGJqzlNJpYO1NpI5WM,19963
 sourcecode/data_labels.py,sha256=9v0JaICRH7jIZ015T1_DuT5E0MFfeL-Wcq1WOPE0Fe0,10965
@@ -276,10 +276,10 @@ sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec
 sourcecode/_docs/DEFECT-LEDGER.md,sha256=EkYSJieDrazfADCZ8tsCsybyW9U0nAzWDQ8rS4KmGTU,1115164
 sourcecode/_docs/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
 sourcecode/_docs/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode/_docs/USER_GUIDE.md,sha256=Yz49suorAuiyJLgdl3yPZAWH3aMzycejEhY8Aoeszcc,103883
-sourcecode-5.9.3.dist-info/METADATA,sha256=mxk_hAlo_FQe8kyHzN4d9ZXqBK3a6wt8xbeFw776CbI,64209
-sourcecode-5.9.3.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-5.9.3.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-5.9.3.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
-sourcecode-5.9.3.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
-sourcecode-5.9.3.dist-info/RECORD,,
+sourcecode/_docs/USER_GUIDE.md,sha256=cE9Q2IMoCXELmhwpvZHslppGBGK2nlR0RSzksifni7U,104721
+sourcecode-5.9.4.dist-info/METADATA,sha256=PivRgNyboaCJ75FC86-6HQ4OIIk0l5TAperOYb4uTsI,64752
+sourcecode-5.9.4.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-5.9.4.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-5.9.4.dist-info/licenses/LICENSE,sha256=23-fk61oSWGVmkWyka-FIM0rhAPM2hcYHnsaridL8Uo,1859
+sourcecode-5.9.4.dist-info/licenses/NOTICE,sha256=Br-AA8Y3iJo1WXa5uP8QBpzqI5nDu3iGLbFyvDt3BOs,321
+sourcecode-5.9.4.dist-info/RECORD,,