sourcecode 5.9.3__tar.gz → 5.9.4__tar.gz

{sourcecode-5.9.3 → sourcecode-5.9.4}/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## [5.9.4] — 2026-08-27
+
+*External-audit reliability and contract-alignment release.*
+
+**Fixed**
+
+- Rejects missing consumer repositories, malformed CVE feeds and unresolved
+  `pack gate --since` refs as structured input errors.
+- Rejects unknown profiles in `posture --diff` when the repository declares a
+  profile population, while preserving annotation-only profile fixtures.
+- Prevents architectural baseline captures from overwriting the snapshot for
+  the same commit.
+- Makes `endpoints --compact` disclose inline that its empty row list is an
+  intentional omission, and makes unresolved `impact`/`impact-chain` runs exit
+  non-zero even when no Java files are present.
+
+**Documentation and validation**
+
+- Updated README, English and Spanish user guides, roadmap status and CLI help.
+- Dedicated regression tests pass against repositories under
+  `Documents/workspace/testing`.
+
 ## [5.9.3] — 2026-08-27
 
 *Workspace entitlement correctness patch release.*

{sourcecode-5.9.3 → sourcecode-5.9.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.3
+Version: 5.9.4
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.3-blue)
+![Version](https://img.shields.io/badge/version-5.9.4-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -196,7 +196,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.3 retains the shared Canonical IR
+**Current performance status.** Release 5.9.4 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
@@ -218,6 +218,14 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
+Release 5.9.4 also hardens the boundary contracts: missing consumer repositories,
+malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
+input errors; duplicate same-commit baselines are never overwritten. `posture
+--diff` validates unknown profiles when the repository declares profiles. In
+`endpoints --compact`, an empty `endpoints` list is explicitly marked as an
+intentional omission, not an empty API; unresolved `impact` and `impact-chain`
+queries exit non-zero, including on repositories without Java sources.
+
 **What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
 IR). Pass `--views compact` or `--views compact,agent` to warm only selected views; without
@@ -243,7 +251,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.3 — and, on a build that has aged,
+ask version                    # ask 5.9.4 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.3 → sourcecode-5.9.4}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.3-blue)
+![Version](https://img.shields.io/badge/version-5.9.4-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -147,7 +147,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.3 retains the shared Canonical IR
+**Current performance status.** Release 5.9.4 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
@@ -169,6 +169,14 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
+Release 5.9.4 also hardens the boundary contracts: missing consumer repositories,
+malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
+input errors; duplicate same-commit baselines are never overwritten. `posture
+--diff` validates unknown profiles when the repository declares profiles. In
+`endpoints --compact`, an empty `endpoints` list is explicitly marked as an
+intentional omission, not an empty API; unresolved `impact` and `impact-chain`
+queries exit non-zero, including on repositories without Java sources.
+
 **What a warm actually covers.** `ask cache warm` rebuilds the declared root views and their
 shared structural layers (L1/L2 + the Repository Intelligence Snapshot + the shared Canonical
 IR). Pass `--views compact` or `--views compact,agent` to warm only selected views; without
@@ -194,7 +202,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.3 — and, on a build that has aged,
+ask version                    # ask 5.9.4 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

sourcecode-5.9.4/docs/AUDIT-2026-08-27-EXTERNAL-5.9.3.md

@@ -0,0 +1,96 @@
+# External Audit Intake — ASK 5.9.3
+
+**Received:** 2026-08-27  
+**Scope:** reliability, semantic consistency, agent ergonomics and commercial fit  
+**Evidence base:** two external reports covering five parallel batches, eight-plus
+real Java repositories and approximately 180 CLI invocations
+
+## Executive disposition
+
+The reports use different rubrics and must not be collapsed into one KPI:
+
+- **7.2/10** for the first reliability and commercial review. It reports five
+  silent failures, one factual help error and strong agent-oriented bounding.
+- **6.5/10** for the broader semantic and cross-repository review. It reports a
+  critical nondeterminism in `selftest`, a high-confidence Spring detection false
+  positive and several lower-severity contract inconsistencies.
+
+The audit confirms that no analysed repository was modified: five batches remained
+clean, only ASK cache artefacts were created, and no Java files or commits were
+written. It also confirms strong structured errors when an error path is reached,
+default non-destructiveness, deterministic bounding in most commands and accurate
+Spring analysis across Boot 4, Boot 2 and classic Spring repositories.
+
+## Accepted defects and regressions
+
+The following are accepted into the engineering queue because the reports provide
+reproduction details or a directly observable contract violation:
+
+| ID | Severity | Finding | Triage |
+|---|---:|---|---|
+| `AUD-610-B01` | P0 | `ask selftest .` is nondeterministic: intermittent empty exit-1, hang or success across four repositories; individual rows are stable. | Open. Treat as an aggregation/concurrency or uncaught-worker failure until a controlled trace proves otherwise. A silent failure in the product's own reliability command blocks strong reliability claims. |
+| `AUD-610-B02` | P1 | Root `ask . --compact/-agent -f yaml` can exit 1 with both streams empty. | Open. Reproduce on a clean cache and capture the failing subprocess boundary before choosing a fix. |
+| `AUD-610-B03` | P1 | `ask audit-report .` fails silently in markdown, JSON and YAML, with and without output file. | Open. The documented flagship evidence path must return a payload or structured diagnostic, never zero bytes. |
+| `AUD-610-B04` | P1 | `ask risk . --limit 0` crashes despite `0` being a legal documented value. | Open. Add the boundary regression and preserve the existing rejection for negative limits. |
+| `AUD-610-B05` | P1 | `ask endpoints . --consumer <missing>` does not reject the missing consumer path and can produce an oversized unfiltered result. | Open. Validate consumer paths and prove the filter changes the analysed population. |
+| `AUD-610-B06` | P1 | `spring-audit` reports `spring_detected: true` for ANTLR4 after cache clear, while `migrate-check` says no Spring usage. | Open. Establish one shared stack-detection authority; do not infer Spring from unrelated XML or dependency names. |
+| `AUD-610-B07` | P2 | `pack gate --since <missing-ref>` collapses the structured base-ref error into generic `UNVERIFIED`. | Open. Preserve the cause and actionable ref error through pack aggregation. |
+| `AUD-610-B08` | P2 | Malformed CVE feeds yield `status: ok` with the parse failure buried in limitations. | Open. A broken security feed must be visibly non-successful and fail closed for automation. |
+| `AUD-610-B09` | P2 | Unknown profile names in `posture --diff` are accepted without a `PROFILE_NOT_FOUND`-style diagnostic. | Open. Validate profile identifiers against the repository's declared profile set. |
+| `AUD-610-B10` | P2 | Re-capturing the same baseline commit with another `--ref` silently overwrites the first record. | Open. Require explicit replacement or preserve both records; the series contract says history is not reconstructable. |
+
+## Contract and semantic debt
+
+These items are not all regressions, but they weaken cross-command coherence and are
+carried as follow-up acceptance criteria:
+
+- `pr-impact` root help incorrectly says `--files` consumes a unified diff from stdin;
+  it consumes changed-file paths. The help is factually wrong and must be corrected.
+- `impact-chain`, `impact` and related commands use different `not_found` risk values
+  (`0.0`, `low` and `null`). Define one shared unknown/not-found contract and its basis.
+- `endpoints --compact` publishes `endpoints: []` beside a nonzero `total`, while the
+  reason is buried in `_meta.answer_bounds`; place the bounded projection explanation
+  beside the affected field or expose a named summary field.
+- `migrate-check` can headline a Boot migration at monorepo root when only a minority
+  module is Boot-based; attribute the signal to its module and publish mixed-stack scope.
+- `custom_gate_inferred` lacks per-case provenance for inferred counts that exceed
+  direct annotation matches; document inheritance evidence or lower the claim.
+- `self-audit` and `mcp list-tools` report different populations (104 versus 110)
+  without explaining that CLI registration and MCP exposure are distinct counts.
+- `baseline diff`/`trend` fail without history while `baseline attest` returns
+  `no_history`; either document the intentional distinction or unify the family.
+- A replacement character was observed in `posture` non-coverage output. The separate
+  UTF-8 `chunk-file` check passed, so the encoding issue remains localized and needs a
+  raw reproduction before a parser change.
+- One `retrieve` invocation failed silently and then passed on immediate retry. It is
+  not promoted to a confirmed regression without a second controlled reproduction, but
+  logging/timeout evidence is warranted.
+
+## Confirmed strengths and non-regressions
+
+- `audit-report --sign-key` and `audit-verify` remain functional offline HMAC-SHA256
+  integrity checks; this is tamper-evident integrity, not public PKI or certification.
+- `baseline attest` is deterministic and explicit about non-coverage, but remains
+  unsigned; `remediation-report` describes ASK's own ledger, not the user's repository.
+- `self-audit` passed its four internal checks in the broader run; the reported count
+  discrepancy is a disclosure problem, not evidence that either registry is corrupt.
+- Spring semantic analysis, JAX-RS explanation, `verify` exit semantics, cache reuse,
+  UTF-8 chunk preservation and default dry-run/non-destructive behaviour held in the
+  tested repositories.
+- The reported cold-cache figures vary within the supplied range and are not, by
+  themselves, a performance regression.
+
+## Commercial interpretation
+
+The deterministic Spring context and agent-oriented bounding remain differentiated,
+and signed audit bundles strengthen the evidence workflow. However, the flagship
+silent failures and `selftest` nondeterminism directly undermine a reliability-led
+commercial claim. The appropriate position is **conditional pilot**, not an annual
+purchase recommendation, until `AUD-610-B01` through `B06` are fixed and independently
+retested.
+
+The external price bands ($25-40 and $35-50 per developer/month in the two reports)
+are hypotheses, not pricing evidence. No price change, compliance claim or ENS/CRA
+certification claim follows from this audit. The next commercial proof remains a named
+customer reference, signed historical evidence and validated control mapping.
+

{sourcecode-5.9.3 → sourcecode-5.9.4}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,7 +3,17 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT QUEUE — release `5.9.3`; external reconciliation `AUD-608` is implemented.**
+> **CURRENT QUEUE — release `5.9.4`; external reconciliation `AUD-610` is implemented for the reproducible fixes.**
+> The 2026-08-27 external review adds `AUD-610-B01` through `AUD-610-B10`, led by
+> silent `selftest` nondeterminism, silent root/audit-report failures, a legal-zero
+> `risk --limit 0` crash, an unvalidated consumer path and contradictory Spring
+> detection. The reproducible boundary defects are closed in `5.9.4`: consumer
+> admission (`86ed0a3`), CVE feed integrity (`abc6319`), gate ref admission
+> (`6690a7f`), posture profile admission (`f7335b1`, `6e75646`), baseline
+> collision protection (`cbe4da9`), compact endpoint disclosure (`8a1936f`)
+> and unresolved impact exits (`c07581a`). The non-reproduced reliability and
+> Spring observations remain open and must not be presented as fixed. Full triage is in
+> [`AUDIT-2026-08-27-EXTERNAL-5.9.3.md`](AUDIT-2026-08-27-EXTERNAL-5.9.3.md).
 > The 2026-08-27 external review adds `AUD-609-B01` (overlapping workspace paths
 > double-count Java files) and `AUD-609-B02` (missing workspace paths accepted as
 > empty repositories); both are fixed in `5.9.3`. It reports no regression in the

{sourcecode-5.9.3 → sourcecode-5.9.4}/docs/EXECUTIVE-ROADMAP.md

@@ -5,7 +5,7 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
-> **CURRENT UPDATE — release `5.9.3`, following the external `5.9.0` reconciliation (`AUD-608`).**
+> **CURRENT UPDATE — release `5.9.4`, following the external `5.9.3` reconciliation.**
 > The commercial increment adds stateless context budgets, a reproducible context-cost harness,
 > source-level migration SARIF and an opt-in workspace entitlement pilot. Advisory behaviour remains
 > the default; named-buyer validation is still required before broad enforcement.
@@ -34,6 +34,26 @@
 > Workspace entitlement is therefore safer to measure, but remains advisory by default;
 > no pricing or enforcement decision is authorized by this fix alone.
 
+> **EXTERNAL REVIEW — 5.9.3, received 2026-08-27.** Two independent lenses score the
+> build **7.2/10** and **6.5/10**. The reports confirm clean, non-destructive execution
+> across five batches and strong structured errors on normal validation paths, but open
+> a critical reliability issue: `selftest` intermittently hangs or exits silently with
+> no output. They also reproduce silent failures in the root YAML path and all
+> `audit-report` formats, plus a legal-zero `risk --limit 0` crash, an unvalidated
+> `endpoints --consumer` path and contradictory Spring detection on ANTLR4. These are
+> release-blocking reliability concerns for an annual buyer commitment. The commercial
+> posture is conditional pilot until the flagship failures are fixed and re-tested.
+> Full triage: [`AUDIT-2026-08-27-EXTERNAL-5.9.3.md`](AUDIT-2026-08-27-EXTERNAL-5.9.3.md).
+
+> **5.9.4 reliability correction.** The reproducible contract defects from the
+> latest review are closed: missing consumer paths and malformed CVE feeds now
+> fail closed; `pack gate` rejects unresolved refs; posture profile diffs reject
+> unknown declared-population names; baselines refuse same-commit overwrite;
+> compact endpoint output explains omitted rows; and unresolved impact queries
+> return non-zero even without Java sources. The commercial position remains a
+> conditional pilot because the independent `selftest`, root, `audit-report`,
+> `risk --limit 0` and ANTLR4 observations still require reproduction or closure.
+
 > **HISTORICAL STATUS — release `5.9.0`, following two external audits of `5.8.32`, 2026-08-26.** Two
 > independent rounds scored the release **9.7/10** (reverification) and **8/10** (comparison against
 > `5.8.31`). **Neither round reported a regression**, and both maintained the same commercial

{sourcecode-5.9.3 → sourcecode-5.9.4}/docs/MANUAL-USUARIO.md

@@ -1,6 +1,6 @@
 # Manual de usuario — ASK Engine
 
-> Versión de la herramienta: **5.8.21**  ·  El comando que se ejecuta es `ask`.
+> Versión de la herramienta: **5.9.4**  ·  El comando que se ejecuta es `ask`.
 > (`sourcecode` sigue funcionando como alias en desactivación y reenvía a `ask`.)
 > Público: personas que van a usar `ask` por primera vez, sin conocimiento previo.
 
@@ -8,6 +8,21 @@
 
 ## 1. ¿Qué es ASK Engine?
 
+### Contratos de fiabilidad de la versión 5.9.4
+
+Las entradas inválidas se rechazan antes del análisis costoso mediante el
+envelope estructurado `INVALID_INPUT`: un `--consumer` inexistente, un feed CVE
+mal formado o una referencia `pack gate --since` que no existe nunca se tratan
+como un repositorio vacío ni como `UNVERIFIED`. `posture --diff` valida los
+perfiles desconocidos cuando el repositorio declara su población de perfiles.
+
+`baseline capture` no sobrescribe la captura de un mismo commit; en pipelines
+puede usarse `--auto` para omitirla. En `endpoints --compact`, una lista
+`endpoints: []` significa que las filas se omitieron deliberadamente: consulta
+`endpoints_note`, `endpoints_omitted` y `total`, porque no significa que no haya
+rutas. `impact` e `impact-chain` devuelven código de salida 1 si no resuelven
+el objetivo, también cuando el repositorio no contiene fuentes Java.
+
 **ASK** significa **Actionable Software Knowledge** (conocimiento accionable sobre el
 software); el producto es el *Actionable Software Knowledge Engine*, abreviado
 **ASK Engine**, y el comando que se ejecuta es `ask`.

{sourcecode-5.9.3 → sourcecode-5.9.4}/docs/PRODUCT-ROUTE.md

@@ -49,6 +49,15 @@ customer reference, concrete control translation and buyer evidence are still
 required before changing the price, activating workspace enforcement or claiming
 compliance-market fit. External price opinions are hypotheses, not pricing data.
 
+The 5.9.3 external review changes the commercial gate: ASK may be evaluated in a
+short, bounded pilot, but the product must not make a reliability-led annual
+commitment while `selftest` can fail silently or hang and flagship evidence paths
+can return zero bytes. The differentiator remains credible; the purchase proof is
+not. The route therefore requires the confirmed silent-failure and stack-detection
+items in [`AUDIT-2026-08-27-EXTERNAL-5.9.3.md`](AUDIT-2026-08-27-EXTERNAL-5.9.3.md)
+to close and survive independent retesting before price or compliance positioning
+is strengthened.
+
 ## Individual commands and packs
 
 Every existing command remains supported for users who want a precise answer:

{sourcecode-5.9.3 → sourcecode-5.9.4}/docs/USER_GUIDE.md

@@ -46,15 +46,30 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.3, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.4, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.3, with release-artifact verification
+the two pack fixes are included in release 5.9.4, with release-artifact verification
 remaining for detached execution and pack evidence.
 
+### Reliability contracts in 5.9.4
+
+Invalid analysis inputs fail before expensive work and use the structured
+`INVALID_INPUT` envelope: a missing `--consumer` repository, a malformed CVE
+feed, or an unresolved `pack gate --since` ref is never treated as an empty or
+`UNVERIFIED` result. `posture --diff` reports unknown profiles when the project
+declares profiles. `baseline capture` does not replace a snapshot already stored
+for the same commit; use `--auto` when a pipeline should skip it.
+
+With `endpoints --compact`, `endpoints: []` means the rows were deliberately
+omitted. Read `endpoints_note`, `endpoints_omitted` and `total`; an empty list is
+not evidence that the API has no routes. `impact` and `impact-chain` return exit
+code 1 when the target is unresolved, including when the selected repository
+contains no Java sources.
+
 ---
 
 ## The semantic engine
@@ -221,7 +236,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.3
+# ask 5.9.4
 ```
 
 Requires Python 3.9+.

{sourcecode-5.9.3 → sourcecode-5.9.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.3"
+version = "5.9.4"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.3 → sourcecode-5.9.4}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.3"
+__version__ = "5.9.4"

{sourcecode-5.9.3 → sourcecode-5.9.4}/src/sourcecode/architectural_baseline.py

@@ -445,11 +445,15 @@ def _announce_ask_dir(ask_dir: Path) -> None:
 
 
 def write_baseline(baseline: dict, out_dir: Path) -> Path:
-    """Write `baseline` as deterministic JSON under `out_dir`; return the file path."""
+    """Write a new baseline without replacing an existing commit snapshot."""
     _readonly.guard(out_dir, what="baseline history directory")
     out_dir.mkdir(parents=True, exist_ok=True)
     protect_ask_dir(out_dir)
     path = out_dir / _baseline_filename(baseline)
+    if path.exists():
+        raise FileExistsError(
+            f"Baseline already exists for commit {baseline.get('commit') or '-'}: {path}"
+        )
     path.write_text(
         json.dumps(baseline, sort_keys=True, indent=2) + "\n", encoding="utf-8"
     )

{sourcecode-5.9.3 → sourcecode-5.9.4}/src/sourcecode/cli.py

@@ -4552,6 +4552,25 @@ def pack_gate_cmd(
         )
         raise typer.Exit(code=2)
     comparison_ref = since
+    if since is not None:
+        from sourcecode.git_checkout import RefError, repo_root, resolve_ref
+
+        try:
+            resolve_ref(repo_root(root), since)
+        except RefError as exc:
+            # Test doubles and callers that provide a non-Git analysis root are
+            # still handled by the existing pack component contracts. Only a
+            # ref failure in an actual repository is an invalid comparison.
+            if exc.code == "not_a_git_repository":
+                pass
+            else:
+                _emit_error_json(
+                    INVALID_INPUT_CODE,
+                    str(exc),
+                    ref=exc.ref or since,
+                    hint="Use a commit, tag, or local branch that exists in the repository.",
+                )
+                raise typer.Exit(code=2)
     if pr is not None:
         try:
             from sourcecode.github_diff import pull_request_base_ref
@@ -8578,6 +8597,9 @@ def impact_cmd(
       not_found  — no symbol and no substring. `risk_score` is null, never 0:
                    nothing was measured, which is not measuring zero.
 
+    An unresolved target exits with code 1, including when the selected repository
+    contains no Java sources; the structured answer still names `not_found`.
+
     \b
     NOTE: Free on repos up to the size limit; Pro unlocks enterprise-scale
     monoliths. Run 'ask license' for details.
@@ -8652,7 +8674,7 @@ def impact_cmd(
             format,
         )
         _emit_command_output(_nf_output, output_path, copy)
-        return
+        _exit_on_unresolved_target("not_found")
 
     _prog = Progress()
     _prog.start(f"building CIR ({len(file_list)} files) for impact analysis")
@@ -8902,7 +8924,8 @@ def endpoints_cmd(
         False, "--compact",
         help="Answer how exposed the repository is without listing every endpoint: "
              "counts by method, by security policy and by controller. Every count is "
-             "measured over the full population.",
+             "measured over the full population; an empty `endpoints` list means the "
+             "rows were intentionally omitted, not that no endpoints exist.",
     ),
     no_cache: bool = typer.Option(
         False, "--no-cache",
@@ -8980,6 +9003,13 @@ def endpoints_cmd(
     _enforce_format("endpoints", format)
 
     target = _admit_path(path)
+    if consumer:
+        # A missing consumer must fail before the server scan. Treating it as an
+        # empty consumer silently turns a requested join into an unfiltered one.
+        consumer = [
+            _admit_path(item, usage="endpoints --consumer")
+            for item in consumer
+        ]
 
     # AUD-591-A10: a prefix that is not a route selects nothing and reports it
     # as no exposure. Rejected before the analysis, so the shell rewrite is
@@ -9116,6 +9146,12 @@ def endpoints_cmd(
 
         _listed = len(data.get("endpoints", []))
         data["endpoints"] = []
+        data["endpoints_note"] = (
+            f"The endpoints list is intentionally omitted by --compact; "
+            f"{_listed} endpoint(s) were measured. An empty `endpoints` list "
+            "does not mean that the repository has no endpoints. Re-run without "
+            "--compact or narrow the request to retrieve rows."
+        )
         data["endpoints_omitted"] = {
             "total": _listed,
             "shown": 0,
@@ -10599,7 +10635,9 @@ def baseline_capture_cmd(
     ref: Optional[str] = typer.Option(
         None, "--ref",
         help="Human label for this baseline (e.g. a version or milestone). "
-             "The commit is recorded automatically when the path is a git repo.",
+             "The commit is recorded automatically when the path is a git repo. "
+             "A capture never overwrites an existing snapshot for the same commit; "
+             "use --auto to skip an already captured commit.",
     ),
     kind: str = typer.Option(
         "architecture", "--kind",
@@ -10750,7 +10788,16 @@ def baseline_capture_cmd(
     baseline = build_baseline(
         _cir, ref=ref, commit=git_commit(target_dir), record_env=record_env,
     )
-    written = write_baseline(baseline, dest)
+    try:
+        written = write_baseline(baseline, dest)
+    except FileExistsError as exc:
+        _prog.finish()
+        _emit_error_json(
+            INVALID_INPUT_CODE,
+            str(exc),
+            hint="Use `--auto` to skip an already captured commit, or capture a new commit.",
+        )
+        raise typer.Exit(code=1)
     _prog.finish()
 
     t = baseline["totals"]
@@ -14519,7 +14566,9 @@ def posture_cmd(
     Two axes, and they are different questions. `--diff` holds the tree fixed
     and moves the profile set. `--diff-ref` (and `--since`) hold the profile set
     fixed and move the tree: *does this change what a client can reach without
-    authenticating?* That one takes `--fail-on` and is the per-PR gate.
+    authenticating?* That one takes `--fail-on` and is the per-PR gate. When the
+    repository declares profiles, `--diff` rejects a profile name outside that
+    population instead of comparing a configuration that does not exist.
 
     \b
     Examples:
@@ -14743,10 +14792,28 @@ def posture_cmd(
                 )
                 raise typer.Exit(code=1)
             left_raw, right_raw = diff.split(":", 1)
+            left_profiles = _parse_set(left_raw, flag="--diff (left side)")
+            right_profiles = _parse_set(right_raw, flag="--diff (right side)")
+            from sourcecode.spring_profiles import profile_population
+
+            declared_profiles = set(profile_population(path).names)
+            missing_profiles = sorted(
+                (left_profiles | right_profiles) - declared_profiles
+            )
+            if missing_profiles and declared_profiles:
+                _emit_error_json(
+                    INVALID_INPUT_CODE,
+                    "--diff names profile(s) not declared by the repository: "
+                    + ", ".join(missing_profiles),
+                    profiles=missing_profiles,
+                    hint="Use profiles reported by `ask posture <repo>`; use a single "
+                    "posture run to inspect an undeclared profile explicitly.",
+                )
+                raise typer.Exit(code=1)
             data = diff_posture(
                 path,
-                _parse_set(left_raw, flag="--diff (left side)"),
-                _parse_set(right_raw, flag="--diff (right side)"),
+                left_profiles,
+                right_profiles,
                 overrides,
             )
         else:
@@ -15571,7 +15638,7 @@ def impact_chain_cmd(
         output = _serialize_dict(data, format)
         _emit_command_output(output, output_path, copy,
                              success_msg=f"Impact chain written to {output_path}")
-        return
+        _exit_on_unresolved_target("not_found")
 
     _prog = Progress()
     _prog.start(f"analyzing impact ({len(file_list)} files)")

{sourcecode-5.9.3 → sourcecode-5.9.4}/src/sourcecode/cve_feed.py

@@ -258,9 +258,14 @@ def load_feed(feed_path: Path, *, now: Optional[datetime] = None) -> Feed:
                     newest = stamp
 
     if unreadable:
+        feed.error = f"{unreadable} feed file(s) were not valid JSON"
         feed.limitations.append(
-            f"{unreadable} feed file(s) were not valid JSON and were skipped"
+            f"{unreadable} feed file(s) were not valid JSON; the feed was rejected"
         )
+        # Partial advisory data is unsafe for a reachability gate: a skipped
+        # file can contain the one advisory that should have blocked the run.
+        feed.loaded = False
+        return feed
     feed.packages = len(feed.by_package)
     feed.loaded = True