sourcecode 5.9.4__tar.gz → 5.9.6__tar.gz

{sourcecode-5.9.4 → sourcecode-5.9.6}/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## [5.9.6] — 2026-08-27
+
+*Roadmap correction and release-alignment patch release.*
+
+**Fixed**
+
+- Makes explicit cache warming durable across processes.
+- Reconciles Spring presence detection for foreign member annotations.
+- Removes split Markdown badge fragments from README-derived summaries.
+- Makes empty baseline history an explicit `no_history` result.
+- Explains the intentional CLI/MCP population difference in `self-audit`.
+
+**Validation**
+
+- Added dedicated regression coverage using `/Users/user/Documents/workspace/testing/teavm`.
+- Updated README, English and Spanish guides, roadmap, ledger and CLI version output.
+
 ## [5.9.4] — 2026-08-27
 
 *External-audit reliability and contract-alignment release.*

{sourcecode-5.9.4 → sourcecode-5.9.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.9.4
+Version: 5.9.6
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 Project-URL: Homepage, https://github.com/HarounDominique/sourcecode
 Project-URL: Repository, https://github.com/HarounDominique/sourcecode
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.4-blue)
+![Version](https://img.shields.io/badge/version-5.9.6-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -196,7 +196,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.4 retains the shared Canonical IR
+**Current performance status.** Release 5.9.6 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
@@ -218,7 +218,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.4 also hardens the boundary contracts: missing consumer repositories,
+Release 5.9.6 also hardens the boundary contracts: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -251,7 +251,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.4 — and, on a build that has aged,
+ask version                    # ask 5.9.6 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.4 → sourcecode-5.9.6}/README.md

@@ -10,7 +10,7 @@
 > question. All analysis is local and deterministic; see [Privacy](#configuration--privacy)
 > before inspecting a repository whose telemetry policy you need to control.
 
-![Version](https://img.shields.io/badge/version-5.9.4-blue)
+![Version](https://img.shields.io/badge/version-5.9.6-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 Copyright (c) 2026 Dominique Haroun. All rights reserved. ASK Engine 5.7.0 and
@@ -147,7 +147,7 @@ set `ASK_MAX_RSS_MB=<megabytes>`; if the process exceeds it, ASK refuses the
 answer with `MEMORY_TOO_LARGE`, including the observed peak and limit. Leave it
 unset, or set it to `0`, to disable the ceiling explicitly.
 
-**Current performance status.** Release 5.9.4 retains the shared Canonical IR
+**Current performance status.** Release 5.9.6 retains the shared Canonical IR
 path used by `validation` and now passes that same CIR into labelled `data-exposure`
 runs; the no-label path remains parse-free. These are implementation properties,
 not duration promises. A controlled external warm-path audit has opened performance
@@ -169,7 +169,7 @@ in `overlapping_paths`; a missing or non-directory path is rejected as structure
 invalid input rather than treated as an empty repository. This prevents silent
 entitlement errors in CI and does not change per-repository gates or billing.
 
-Release 5.9.4 also hardens the boundary contracts: missing consumer repositories,
+Release 5.9.6 also hardens the boundary contracts: missing consumer repositories,
 malformed CVE feeds and unresolved `pack gate --since` refs fail as structured
 input errors; duplicate same-commit baselines are never overwritten. `posture
 --diff` validates unknown profiles when the repository declares profiles. In
@@ -202,7 +202,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.9.4 — and, on a build that has aged,
+ask version                    # ask 5.9.6 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.9.4 → sourcecode-5.9.6}/docs/DEFECT-LEDGER.md

@@ -16,6 +16,70 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ## Current Synchronization
 
+**Field simulation on TeaVM, 2026-08-27 — `ASK-FIELD`.** A deep, non-destructive
+run of ASK `5.9.5` against `/Users/user/Documents/workspace/testing/teavm`
+(4,024 files; 3,539 Java files) exercised the main analysis commands, packs,
+baseline lifecycle, contracts and cache lifecycle. The checkout stayed clean
+and the prior release closure set showed no regression. Three behaviours were
+reproduced and are now closed below: cache warming was not visible to subsequent
+processes, root README summary extraction emitted a Markdown-link fragment, and
+Spring presence disagreed between `spring-audit` and `migrate-check`. The run
+also confirmed that endpoint zero-result disclosure, legal input refusals,
+baseline collision protection, pack `UNVERIFIED` semantics and target
+non-mutation remain intact. This is field evidence, not an external audit; it
+must not be represented as a release certification.
+
+| ID | Severity | Status | Evidence and required closure |
+|---|---:|---|---|
+| `ASK-FIELD-01` | P1 | **closed 5.9.6 (`829f9fa`)** | Explicit warm persists synchronously in its declared namespace; the fresh-process TeaVM lifecycle battery passes. |
+| `ASK-FIELD-02` | P1 | **closed 5.9.6 (`6a659fa`)** | Member annotation imports resolve from the declaring class and confirmed Spring evidence drives presence; TeaVM and Spring control parity passes. |
+| `ASK-FIELD-03` | P2 | **closed 5.9.6 (`55b0d51`)** | Split Markdown badge continuations are discarded without changing normal inline-link unwrapping; the real TeaVM summary regression passes. |
+
+The simulation did not open the Kotlin/Java/Node classification as a defect:
+the signals were explicitly confidence-scored and may represent a legitimate
+polyglot repository. It also did not open zero endpoints, minimum token-budget
+refusal, unsupported `explain --compact`, or contractless `verify`: each matched
+the declared contract and non-coverage in the observed run.
+
+**External audit intake `AUD-610`, release 5.9.3 — 2026-08-27.** The attached
+report scored the build **7.2/10** after five parallel batches and approximately
+120 invocations. It verified a clean target repository, no Java-file changes,
+no commits and no unauthorized persistence. The report praised structured errors,
+output bounding for agents and dry-run safety, but identified 17 defects or
+follow-ups. The full future closure criteria are maintained in
+[`DEVELOPMENT-ROADMAP.md`](DEVELOPMENT-ROADMAP.md); the ledger records their
+status boundary here so a later fix cannot silently close only one consumer.
+
+The report's P1 reliability cluster was `AUD-610-B01` (root YAML compact/agent
+zero-byte failure), `AUD-610-B02` (all `audit-report` formats zero-byte failure),
+`AUD-610-B03` (`risk --limit 0` legal-boundary crash) and `AUD-610-B04`
+(`timeline --since` pays for work then fails silently). None reproduced in the
+TeaVM `5.9.5` simulation; they are held as release-artifact verification items,
+not open deterministic defects.
+
+The remaining rows are: `AUD-610-B05` consumer-path admission (**closed
+5.9.4**, `86ed0a3`); `AUD-610-B06` invalid-input exit parity (**closed**,
+`ae2e8b1`, `f4b4f77`); `AUD-610-B07` command/path typo disambiguation
+(**closed**, `178aa6d`); `AUD-610-B08` pack
+gate ref admission (**closed 5.9.4**, `6690a7f`); `AUD-610-B09` inaccurate
+root help for `--files -` (**closed**, `f66cd28`, `52bcc36`); `AUD-610-B10`
+not-found envelope parity (**closed**, `c07581a`);
+`AUD-610-B11` malformed CVE feed status (**closed 5.9.4**, `abc6319`);
+`AUD-610-B12` unknown posture profiles (**closed 5.9.4**, `f7335b1`, `6e75646`);
+`AUD-610-B13` baseline overwrite (**closed 5.9.4**, `cbe4da9`);
+`AUD-610-B14` CLI/MCP population explanation (**closed**, `7c9b23e`);
+`AUD-610-B15` no-history contract parity (**closed**, `a130637`);
+`AUD-610-B16` UTF-8 replacement character (**platform verification hold**);
+and `AUD-610-B17` one-off retrieve silent failure (**investigation hold, not
+reproduced**).
+
+Commercially, the report recommends conditional pilot/adoption and a provisional
+`$35-50/developer/month` band, requiring closure of the flagship zero-byte paths
+before an annual commitment. This is recorded as external market evidence, not
+as a pricing approval or a product claim. The destructive commands excluded by
+the auditor remain outside the evidence set because only their dry-run paths were
+executed.
+
 **External `5.9.0` audit received, 2026-08-26 - `AUD-608`; corrections shipped in `5.9.1`.** The audited
 revision is the released `5.9.0` commit. The three confirmed corrections are
 closed: `AUD-608-C01` (P1, `cve` now declares its static inventory scope,

{sourcecode-5.9.4 → sourcecode-5.9.6}/docs/DEVELOPMENT-ROADMAP.md

@@ -3,7 +3,7 @@
 *Chief-engineer development record. This is the internal, dev-facing counterpart to the
 customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 
-> **CURRENT QUEUE — release `5.9.4`; external reconciliation `AUD-610` is implemented for the reproducible fixes.**
+> **CURRENT QUEUE — release `5.9.6`; external reconciliation `AUD-610` is triaged and the reproducible fixes are implemented.**
 > The 2026-08-27 external review adds `AUD-610-B01` through `AUD-610-B10`, led by
 > silent `selftest` nondeterminism, silent root/audit-report failures, a legal-zero
 > `risk --limit 0` crash, an unvalidated consumer path and contradictory Spring
@@ -11,14 +11,29 @@ customer-facing `docs/EXECUTIVE-ROADMAP.md`.*
 > admission (`86ed0a3`), CVE feed integrity (`abc6319`), gate ref admission
 > (`6690a7f`), posture profile admission (`f7335b1`, `6e75646`), baseline
 > collision protection (`cbe4da9`), compact endpoint disclosure (`8a1936f`)
-> and unresolved impact exits (`c07581a`). The non-reproduced reliability and
-> Spring observations remain open and must not be presented as fixed. Full triage is in
+> and unresolved impact exits (`c07581a`). The remaining external-only reliability
+> observations are held for release-artifact verification and must not be presented
+> as product defects. Full triage is in
 > [`AUDIT-2026-08-27-EXTERNAL-5.9.3.md`](AUDIT-2026-08-27-EXTERNAL-5.9.3.md).
 > The 2026-08-27 external review adds `AUD-609-B01` (overlapping workspace paths
 > double-count Java files) and `AUD-609-B02` (missing workspace paths accepted as
 > empty repositories); both are fixed in `5.9.3`. It reports no regression in the
 > prior closure set. Evidence and the commercial interpretation are in
 > [`AUDIT-2026-08-27-EXTERNAL-5.9.2.md`](AUDIT-2026-08-27-EXTERNAL-5.9.2.md).
+
+> **FIELD SIMULATION — TeaVM, 2026-08-27.** A deep real-use simulation of the
+> released `5.9.6` build was run against
+> `/Users/user/Documents/workspace/testing/teavm` (4,024 files, 3,539 Java
+> files, clean checkout before and after, 96 persisted artefacts). It exercised
+> root JSON/YAML, `spring-audit`, `migrate-check`, `endpoints`, `risk`, `impact`,
+> `impact-chain`, `posture --diff`, audit reports, self-audit, packs, contracts,
+> baselines, attestation and cache lifecycle. No regression was found in the
+> previously closed contract fixes, and the target repository was not modified.
+> It did, however, confirm three follow-up defects: cache persistence across
+> processes, a split Markdown badge fragment in the README summary, and divergent
+> Spring-presence signals. All three are now closed below as `ASK-FIELD-01` through
+> `ASK-FIELD-03`; the fix evidence does not imply that TeaVM is a supported Spring
+> target.
 > `AUD-608-C01` is closed in `fe1f624`: `cve` declares static
 > dependency-inventory coverage and non-coverage. `AUD-608-P01` is closed in
 > `b479465`: `pr-risk --since` constructs its base context and surfaces failures
@@ -129,6 +144,77 @@ triage is in [`AUDIT-2026-08-27-EXTERNAL-5.9.2.md`](AUDIT-2026-08-27-EXTERNAL-5.
 | `AUD-609-C01` | P2 | Signed evidence and historical attestation use different integrity contracts. | Decide whether `baseline attest` gains the existing signing mechanism or clearly publishes that it is unsigned; document the choice in help, schema and buyer-facing material. Do not call unsigned output a certificate or compliance proof. | **Queued, commercial validation.** No implementation claim until the signing boundary and key model are explicit. |
 | `AUD-609-C02` | P3 | Translate technical evidence into concrete ENS/CRA controls. | Define a named control mapping with source evidence, missing evidence and `legal_claim: false`; validate it with a named compliance buyer or auditor before presenting it as a market capability. | **Queued, buyer-gated.** `audit-report --pack ens` remains evidence mapping only. |
 
+### Field Follow-up — TeaVM simulation, 2026-08-27
+
+These rows are engineering follow-ups from a controlled real-repository
+simulation, not findings from an external auditor. They are intentionally
+separate from `AUD-610`: the earlier release audit's non-reproduced observations
+remain non-reproduced, while these three behaviours were reproduced directly on
+the TeaVM checkout. The simulation also confirms that the normal structured-error
+paths, pack verdicts, baseline collision protection, output bounds and target
+repository cleanliness continue to behave as documented.
+
+| ID | Priority | Finding | Acceptance criteria | Status/order |
+|---|---:|---|---|---|
+| `ASK-FIELD-01` | P1 | `cache warm` failed to make the next process observe persisted cache state. | Use one canonical cache namespace and target identity; a fresh process must observe the declared warm state and persisted entries. | **Closed in `5.9.6` (`829f9fa`).** Explicit warm persistence is synchronous and the TeaVM lifecycle battery passes. |
+| `ASK-FIELD-02` | P1 | TeaVM exposed divergent Spring-presence signals between `spring-audit` and `migrate-check`. | Resolve member annotation imports and require confirmed Spring evidence for cross-command presence. | **Closed in `5.9.6` (`6a659fa`).** TeaVM and a Spring control repository now agree; no heuristic broadening was added. |
+| `ASK-FIELD-03` | P2 | Root compact summary leaked a split Markdown Discord badge continuation. | README summaries must never emit URL delimiters or badge fragments while preserving normal inline links. | **Closed in `5.9.6` (`55b0d51`).** The TeaVM README regression and summarizer battery pass. |
+
+**Observed but not opened as defects:** TeaVM was classified as Kotlin
+full-stack with Java as a low-confidence secondary signal and Node.js from a
+manifest; this may be expected multi-language evidence but needs corpus review
+before changing classification. `endpoints` returning zero was accompanied by
+the declared zero-result/non-coverage explanation. `repo-ir --budget-tokens`
+refusing a budget below its minimum estimate, `explain --compact` rejecting an
+unsupported flag, and `verify` returning `UNVERIFIED` without contracts all
+matched their documented contracts. These behaviours must remain in regression
+coverage, but are not roadmap bugs from this run.
+
+### External Audit Intake — `AUD-610` detail, release 5.9.3
+
+The attached external report audited ASK `5.9.3` in five parallel batches
+(approximately 120 invocations), scored it **7.2/10**, and found the audited
+repository clean: no Java files, commits or unauthorized persisted files were
+changed. Its strongest positive evidence was structured error quality (9.0),
+agent-oriented output bounding (9.5) and default non-destructiveness (9.0).
+Its commercial conclusion was **conditional adoption/pilot**, with a suggested
+price band of `$35-50/developer/month`, contingent on closing the flagship
+silent-failure paths before an annual commitment. That price is an external
+hypothesis, not an ASK pricing decision.
+
+The detailed intake below preserves every reported error and its future closure
+boundary. Status is evaluated against the current `5.9.6` documentation and the
+TeaVM simulation above, not blindly copied from the audited `5.9.3` build.
+
+| ID | Severity | Reported issue | Roadmap disposition and future closure |
+|---|---:|---|---|
+| `AUD-610-B01` | P1 | Root YAML compact/agent reportedly returned zero bytes and progress reportedly exited 127. | **Not reproduced in `5.9.5` TeaVM; held as release-artifact verification, not an open product defect.** Current usage/error batteries require structured stderr on failure. |
+| `AUD-610-B02` | P1 | `audit-report` reportedly returned zero bytes across formats and output modes. | **Not reproduced in `5.9.5` TeaVM; held as release-artifact verification.** JSON, YAML, Markdown and file-output paths completed with evidence. |
+| `AUD-610-B03` | P1 | `risk --limit 0` reportedly crashed silently. | **Not reproduced in `5.9.5` TeaVM; held as release-artifact verification.** TeaVM accepted zero as a legal empty-list bound and the boundary battery passes. |
+| `AUD-610-B04` | P1 | `timeline --since HEAD~5` reportedly paid for work and then returned empty output. | **Not reproduced in `5.9.5` TeaVM; held as release-artifact verification.** Timeline failures publish structured diagnostics and sampled failures retain per-sample reasons. |
+| `AUD-610-B05` | P1 | `endpoints --consumer <missing-path>` reportedly behaved like a valid consumer path and produced the same oversized result. | **Closed in `5.9.4` (`86ed0a3`).** Consumer paths now have explicit admission and fail closed; retain the missing-path and valid-path differential battery. |
+| `AUD-610-B06` | P2 | Semantic input errors reportedly had inconsistent process exits. | **Closed by the shared error contract (`ae2e8b1`, `f4b4f77`).** `INVALID_INPUT` is exit 1 and parser/grammar failures are exit 2; usage and subprocess parity batteries pass. |
+| `AUD-610-B07` | P2 | Unknown subcommands were reportedly swallowed as repository paths. | **Closed (`178aa6d`).** Registry-derived dispatch rejects the typo before path fallback and preserves valid lone path arguments. |
+| `AUD-610-B08` | P2 | `pack gate --since <missing-ref>` reportedly collapsed the actionable Git ref error into generic `UNVERIFIED`, unlike direct `pr-impact`. | **Closed in `5.9.4` (`6690a7f`).** Unresolved refs are rejected at admission with structured input evidence; preserve direct-vs-pack parity coverage. |
+| `AUD-610-B09` | P2 | Root help reportedly described `--files -` ambiguously. | **Closed (`f66cd28`, `52bcc36`).** Root and subcommand help state path-list stdin, file and comma-separated shapes; real unified diffs are rejected as invalid input. |
+| `AUD-610-B10` | P2 | Missing symbols reportedly produced divergent impact risk/score semantics. | **Closed (`c07581a` plus `tests/test_direct_callers_unit.py`).** Unresolved paths use the shared `not_found` vocabulary, unknown risk, null score where arithmetic is not applicable and consistent non-zero exit. |
+| `AUD-610-B11` | P2 | Malformed CVE feed reportedly yielded `status: ok` with the parse problem buried in `limitations`. | **Closed in `5.9.4` (`abc6319`).** Feed integrity is fail-closed and statically scoped; preserve malformed, empty and mixed-validity feed tests so a security feed cannot silently degrade to “clean”. |
+| `AUD-610-B12` | P2 | Invented posture profile names were accepted and returned a normal-looking result. | **Closed in `5.9.4` (`f7335b1`, `6e75646`).** Unknown declared populations are rejected; retain profile-admission and cross-command tests. |
+| `AUD-610-B13` | P2 | Repeated baseline capture at the same commit reportedly overwrote the prior evidence without warning or `--force`. | **Closed in `5.9.4` (`cbe4da9`).** Same-commit collisions are rejected; retain duplicate, explicit overwrite and cross-kind tests. |
+| `AUD-610-B14` | P2 | `self-audit` reported a different CLI/MCP count without explaining the populations. | **Closed in `5.9.6` (`7c9b23e`).** `self-audit` publishes both populations, native MCP additions and the relationship formula; TeaVM process regression passes. |
+| `AUD-610-B15` | P3 | `baseline diff`/`trend` failed on no history while `baseline attest` returned `no_history`. | **Closed in `5.9.6` (`a130637`).** Diff, trend and attest now return `status: no_history`, exit 0 and explicit `non_coverage` for empty history. |
+| `AUD-610-B16` | P3 | A replacement character (`�`) reportedly appeared in production JSON around a UTF-8 boundary in posture non-coverage text. | **Open reproduction follow-up.** Run byte-level UTF-8 tests on the exact payload and supported platforms, including em dash/arrow boundaries. If confirmed, fix serialization/truncation at code-point boundaries; if not, record the platform cause and keep the claim withdrawn. |
+| `AUD-610-B17` | P3 | One `retrieve endpoint-security` invocation reportedly failed silently, then succeeded immediately on retry; no second reproduction was obtained. | **Investigation only.** Add correlation IDs, phase-level failure capture and a repeated/concurrent cache-control test. Do not classify a transient single sample as a deterministic defect until reproduced. |
+
+**Audit exclusions and interpretation:** destructive `rename-class` without
+`--dry-run` and `migrate-apply --write` were not executed for safety; the latter
+was additionally blocked by the auditor's sandbox heuristic, not by an ASK
+failure. The report found no regression in the previously closed surfaces and
+confirmed dry-run/non-destructive behaviour. Until `AUD-610-B01` through
+`AUD-610-B04` and the remaining consistency rows are independently closed, ASK
+must retain conditional-pilot positioning and must not promise silent-failure
+freedom or annual-grade reliability.
+
 ### Explicitly Rejected
 
 These are not roadmap work: `--format` and `--compact` remain separate contracts;

{sourcecode-5.9.4 → sourcecode-5.9.6}/docs/EXECUTIVE-ROADMAP.md

@@ -5,7 +5,7 @@
 > `pack assessment` and `pack gate`, and make evidence and safe change the
 > product surface. This roadmap must not introduce a competing product thesis.
 
-> **CURRENT UPDATE — release `5.9.4`, following the external `5.9.3` reconciliation.**
+> **CURRENT UPDATE — release `5.9.6`, following the external `5.9.3` reconciliation.**
 > The commercial increment adds stateless context budgets, a reproducible context-cost harness,
 > source-level migration SARIF and an opt-in workspace entitlement pilot. Advisory behaviour remains
 > the default; named-buyer validation is still required before broad enforcement.
@@ -45,7 +45,7 @@
 > posture is conditional pilot until the flagship failures are fixed and re-tested.
 > Full triage: [`AUDIT-2026-08-27-EXTERNAL-5.9.3.md`](AUDIT-2026-08-27-EXTERNAL-5.9.3.md).
 
-> **5.9.4 reliability correction.** The reproducible contract defects from the
+> **5.9.6 reliability correction.** The reproducible contract defects from the
 > latest review are closed: missing consumer paths and malformed CVE feeds now
 > fail closed; `pack gate` rejects unresolved refs; posture profile diffs reject
 > unknown declared-population names; baselines refuse same-commit overwrite;

{sourcecode-5.9.4 → sourcecode-5.9.6}/docs/MANUAL-USUARIO.md

@@ -1,6 +1,6 @@
 # Manual de usuario — ASK Engine
 
-> Versión de la herramienta: **5.9.4**  ·  El comando que se ejecuta es `ask`.
+> Versión de la herramienta: **5.9.6**  ·  El comando que se ejecuta es `ask`.
 > (`sourcecode` sigue funcionando como alias en desactivación y reenvía a `ask`.)
 > Público: personas que van a usar `ask` por primera vez, sin conocimiento previo.
 
@@ -8,7 +8,7 @@
 
 ## 1. ¿Qué es ASK Engine?
 
-### Contratos de fiabilidad de la versión 5.9.4
+### Contratos de fiabilidad de la versión 5.9.6
 
 Las entradas inválidas se rechazan antes del análisis costoso mediante el
 envelope estructurado `INVALID_INPUT`: un `--consumer` inexistente, un feed CVE

{sourcecode-5.9.4 → sourcecode-5.9.6}/docs/USER_GUIDE.md

@@ -46,16 +46,16 @@ CLI commands        — impact, endpoints, spring-audit, explain, … each a pro
 The key idea: the extraction is **content-addressed**. Commands reuse the parse cache and,
 where their analysed scope matches, the shared Canonical IR; `ask cache model` names what a
 warm buys for each command rather than implying that every projection costs the same. In
-5.9.4, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
+5.9.6, `validation` enters through that shared CIR and `data-exposure` reuses one semantic
 model across all declared label seeds. (The extraction and consumption contract is fixed in
 the architecture ADRs 0001–0004 under `docs/architecture/`.)
 
 The current external pack audit intake is tracked in
 [`AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md`](AUDIT-2026-08-26-EXTERNAL-5.8.28-PACK.md);
-the two pack fixes are included in release 5.9.4, with release-artifact verification
+the two pack fixes are included in release 5.9.6, with release-artifact verification
 remaining for detached execution and pack evidence.
 
-### Reliability contracts in 5.9.4
+### Reliability contracts in 5.9.6
 
 Invalid analysis inputs fail before expensive work and use the structured
 `INVALID_INPUT` envelope: a missing `--consumer` repository, a malformed CVE
@@ -236,7 +236,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.9.4
+# ask 5.9.6
 ```
 
 Requires Python 3.9+.

{sourcecode-5.9.4 → sourcecode-5.9.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.9.4"
+version = "5.9.6"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.9.4 → sourcecode-5.9.6}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.9.4"
+__version__ = "5.9.6"

{sourcecode-5.9.4 → sourcecode-5.9.6}/src/sourcecode/cli.py

@@ -6987,7 +6987,6 @@ def main(
         return _core_dict_for_writers
 
     if not no_cache and _core_key and not _pipeline_error and not changed_only:
-        import atexit as _atexit
         import threading as _threading
 
         # Pre-compute core dict in the main thread — avoids the 5-second atexit
@@ -7028,9 +7027,18 @@ def main(
                 except Exception:
                     pass
 
-            _cache_write_thread = _threading.Thread(target=_write_cache_async, daemon=True)
-            _cache_write_thread.start()
-            _atexit.register(_cache_write_thread.join, 30.0)
+            # `cache warm` is an explicit persistence command. A daemon writer
+            # may still be serialising a large core when the child exits, so a
+            # successful warm could leave no entry for the next process to read.
+            # Keep the low-latency asynchronous path for ordinary analysis, but
+            # make the explicit warm contract synchronous and fail closed.
+            if os.environ.get("SOURCECODE_CACHE_SYNC") in ("1", "true", "yes"):
+                _write_cache_async()
+            else:
+                import atexit as _atexit
+                _cache_write_thread = _threading.Thread(target=_write_cache_async, daemon=True)
+                _cache_write_thread.start()
+                _atexit.register(_cache_write_thread.join, 30.0)
 
     # Update RIS with aggregated snapshot data (non-fatal side-effect).
     # Update RIS whenever git is available, even when L1/L2 cache is skipped
@@ -10893,16 +10901,26 @@ def baseline_diff_cmd(
         _history = _resolve_history_dir((history_dir or target_dir).resolve())
         _series = load_series(_history)
         if not _series:
-            # No stored capture is not "nothing changed": there is no base to
-            # compare against, and answering with an empty diff would read as one.
-            _emit_error_json(
-                INVALID_INPUT_CODE,
-                f"No findings baseline is stored for '{target_dir}'.",
-                path=str(_history),
-                hint="Capture one first: ask baseline capture <path> --kind findings.",
-                expected="A stored findings-baseline-v1 JSON file.",
+            # Empty history is an honest query result, not invalid input. Keep
+            # diff/trend/attest interchangeable so automation can branch on one
+            # status instead of treating the same state as success in one command
+            # and a failure in another.
+            _emit_command_output(
+                _serialize_dict({
+                    "schema": "findings-delta-v1",
+                    "status": "no_history",
+                    "history_dir": str(_history),
+                    "message": "No findings baseline is stored; no delta was computed.",
+                    "non_coverage": [
+                        "Capture one first: ask baseline capture <path> --kind findings."
+                    ],
+                    "counts": {"new": 0, "resolved": 0, "unchanged": 0},
+                }, format),
+                output_path, copy,
+                success_msg=f"Findings delta written to {output_path} (no history)",
+                fmt=format,
             )
-            raise typer.Exit(code=1)
+            return
 
         _prog = Progress()
         _prog.start("auditing the working tree")
@@ -10933,15 +10951,18 @@ def baseline_diff_cmd(
         history = _resolve_history_dir((history_dir or target_dir).resolve())
         latest = latest_baseline_path(history)
         if latest is None:
-            _emit_error_json(
-                INVALID_INPUT_CODE,
-                f"No captured baseline found for '{target_dir}'.",
-                path=str(history),
-                hint=_BASELINE_HISTORY_HINT,
-                expected="A stored architectural-baseline-v1 JSON file, or a "
-                         "repository whose .ask/baselines holds one.",
+            _emit_command_output(
+                _serialize_dict({
+                    "schema": "architectural-delta-v1",
+                    "status": "no_history",
+                    "history_dir": str(history),
+                    "message": "No captured baseline was found; no delta was computed.",
+                    "non_coverage": [_BASELINE_HISTORY_HINT],
+                }, format),
+                output_path, copy,
+                success_msg=f"Baseline diff written to {output_path} (no history)",
             )
-            raise typer.Exit(code=1)
+            return
         baseline_file = latest
 
     if not baseline_file.exists():
@@ -11069,15 +11090,19 @@ def baseline_trend_cmd(
 
     baselines = load_baselines_dir(trend_dir)
     if not baselines:
-        _emit_error_json(
-            INVALID_INPUT_CODE,
-            f"No architectural baselines found in '{trend_dir}'.",
-            path=str(trend_dir),
-            hint=_BASELINE_HISTORY_HINT,
-            expected="A repository with a captured history, or a directory "
-                     "containing architectural-baseline-v1 JSON files.",
+        _emit_command_output(
+            _serialize_dict({
+                "schema": "architectural-trend-v1",
+                "status": "no_history",
+                "baseline_count": 0,
+                "points": [],
+                "hotspot_trends": [],
+                "non_coverage": [_BASELINE_HISTORY_HINT],
+            }, format),
+            output_path, copy,
+            success_msg=f"Trend written to {output_path} (no history)",
         )
-        raise typer.Exit(code=1)
+        return
 
     data = build_trend(baselines)
     output = _serialize_dict(data, format)
@@ -20373,6 +20398,11 @@ def cache_warm_cmd(
     # console script from PATH. A stale global script can otherwise warm one
     # package installation while the caller reads another one, leaving a view
     # apparently fresh even though its cache entry was never written.
+    # The warm's child must finish its cache writes before reporting success.
+    # This is scoped to the child so ordinary root analyses retain their async
+    # write latency while `cache warm` has a durable cross-process contract.
+    _sc_env = os.environ.copy()
+    _sc_env["SOURCECODE_CACHE_SYNC"] = "1"
     _sc_bin = [sys.executable, "-m", "sourcecode"]
 
     # AUD-600-R01: which views a warm builds is `cache_model`'s fact, not a pair
@@ -20430,7 +20460,9 @@ def cache_warm_cmd(
             # none of it — only the exit code and, on failure, stderr. Capturing it
             # held a whole repository's answer in memory for nothing; on a 24 074-file
             # repository that is megabytes the parent buffers and drops.
-            result = _sub.run(cmd, stdout=_sub.DEVNULL, stderr=_sub.PIPE, text=True)
+            result = _sub.run(
+                cmd, stdout=_sub.DEVNULL, stderr=_sub.PIPE, text=True, env=_sc_env
+            )
         finally:
             _prog.stop()
         if result.returncode != 0:

{sourcecode-5.9.4 → sourcecode-5.9.6}/src/sourcecode/self_audit.py

@@ -246,6 +246,15 @@ def run_self_audit() -> dict:
     from sourcecode import __version__
 
     commands = _registered_commands()
+    # CLI leaves and MCP tools are related populations, not aliases of one
+    # another: MCP also serves native orchestration tools with no CLI command.
+    from sourcecode.mcp.registry import build_mcp_tool_specs
+    from sourcecode.mcp.server import _NATIVE_MCP_TOOLS
+
+    cli_command_count = len(commands)
+    mcp_registry_count = len(build_mcp_tool_specs())
+    native_mcp_count = len(_NATIVE_MCP_TOOLS)
+    mcp_tool_count = mcp_registry_count + native_mcp_count
     checks = [
         _check_cache_model(commands),
         _check_format_contract(commands),
@@ -268,7 +277,22 @@ def run_self_audit() -> dict:
         "schema": SCHEMA_ID,
         "verdict": verdict,
         "tool_version": __version__,
-        "commands_registered": len(commands),
+        "commands_registered": cli_command_count,
+        "mcp_tools_served": mcp_tool_count,
+        "tool_populations": {
+            "cli_commands": {
+                "count": cli_command_count,
+                "definition": "registered CLI leaf commands, including commands hidden from MCP",
+            },
+            "mcp_tools": {
+                "count": mcp_tool_count,
+                "definition": "runtime-derived MCP tools plus native orchestration tools",
+                "runtime_derived": mcp_registry_count,
+                "native_orchestration": native_mcp_count,
+            },
+            "relationship": "mcp_tools = runtime_derived_mcp_tools + native_orchestration_tools; "
+            "CLI command count is not expected to equal MCP tool count",
+        },
         "counts": {
             "checks": len(checks),
             "passed": sum(1 for c in checks if c.status == STATUS_PASS),

{sourcecode-5.9.4 → sourcecode-5.9.6}/src/sourcecode/spring_model.py

@@ -130,6 +130,21 @@ def _resolve_bean_annotation(
     """
     simple = ann.lstrip("@")
     imports = imports_by_class.get(owner_fqn) or {}
+    if not imports:
+        # Field and method nodes carry a member suffix, while imports belong to
+        # their declaring class. Missing this join turns a foreign annotation
+        # such as Maven's `@Component` into an unresolved one and can falsely
+        # advertise a non-Spring repository as Spring. Member nodes have used
+        # both `Class#member` and `Class.member` identities over time.
+        owner_class = owner_fqn.split("#", 1)[0]
+        imports = imports_by_class.get(owner_class) or {}
+        if not imports:
+            declaring = max(
+                (name for name in imports_by_class if owner_fqn.startswith(name + ".")),
+                key=len,
+                default="",
+            )
+            imports = imports_by_class.get(declaring) or {}
 
     exact = imports.get(simple)
     if exact:
@@ -387,6 +402,22 @@ class BeanGraph:
             for b in self.beans.values()
         )
 
+    def has_confirmed_spring_beans(self) -> bool:
+        """True only when a bean annotation resolves to ``org.springframework``.
+
+        An unresolved simple annotation remains admissible for model consumers:
+        the missing import is not proof that the annotation is foreign. It is,
+        however, insufficient evidence for the cross-command product fact
+        ``spring_detected``. Otherwise a repository such as TeaVM, which uses
+        Maven's ``@Component`` spelling without Spring, is advertised as Spring.
+        """
+        return any(
+            b.spring
+            and b.annotation_fqn.startswith(_SPRING_PACKAGE_PREFIX)
+            and b.stereotype not in _JPA_ONLY_STEREOTYPES
+            for b in self.beans.values()
+        )
+
     def spring_beans(self) -> dict[str, BeanNode]:
         """The Spring IoC bean-definition population, keyed by symbol.
 
@@ -652,4 +683,13 @@ def spring_detected(
     can still ask.
     """
     graph = model.bean_graph if model is not None else BeanGraph.build(cir)
-    return bool(graph.has_spring_beans()) or int(tx_total or 0) > 0
+    if graph.has_confirmed_spring_beans() or int(tx_total or 0) > 0:
+        return True
+    # Preserve the conservative model behaviour for a genuinely unresolved
+    # annotation, but never let a resolved foreign annotation trigger presence.
+    return any(
+        b.spring
+        and not b.annotation_fqn
+        and b.stereotype not in _JPA_ONLY_STEREOTYPES
+        for b in graph.beans.values()
+    )

{sourcecode-5.9.4 → sourcecode-5.9.6}/src/sourcecode/summarizer.py

@@ -458,6 +458,10 @@ class ProjectSummarizer:
             if (
                 _BADGE_RE.match(line)
                 or _LINK_ONLY_RE.match(line)
+                # A Markdown badge may wrap before its closing `](url)`. The
+                # first line is discarded above, but the continuation must not
+                # become a standalone project description.
+                or _re.match(r"^\s*\)?\]\([^)]*\)\s*$", line)
                 or ("<" in line and ">" in line and not _html_stripped)
             ):
                 # AUD-596-B07: a bar written on one line never becomes a