[bernardladenthin]

Summary

• Follow-ups of the four reviews of 2026-11-03, on one branch: linear fact counters and a test that measures it, a secrets rule, regenerateOnProfileChange, fileNames / contentMatches / {a,b} globs / BOM, [include] for facts files.
• Profile v3 covers the kinds of an enterprise Java code base: one shared prompt file-body-oop for Java, Kotlin, Groovy and Scala (replaces file-body-java), view, contract and ops prompts, and fact counters for every kind it routes (29 new facts files in all).
• Scripts without an extension are selected and routed by their #! line; fact counters gain [raw], [distinct] and a time limit; the model reads a file's path, not its name alone.
• Measured on OpenRouter twice: before switching Java, and after the prompt changes (tables below).

Fixes

• Fact counters quadratic over unclosed markup: xml-facts, pom-facts (100 KB of unclosed <? took 8.4 s; an unclosed DOCTYPE subset ran for minutes), plus three more the new test found: the Java type arguments and field initializer, the shell option arms. Unclosed regions now run to the end of the file.
• ProfileFactPatternsLinearityTest measures every pattern of every facts file over 110 adversarial lines by counting the characters the matcher reads (4× input ≤ 6× reads), exact on any machine, and asserts that no pattern reaches the new time limit.
• Secrets: every file prompt names a secret and writes *** for its value. The self-test and the examples skip .env, *.tfvars, *.tfstate, Maven settings.xml, keys, *secret* / *credential* configuration.

Engine

• regenerateOn (breaking, replaces regenerateOnProfileChange): one switch per cause next to the global force: source (C), prompt (P), facts (N), model (new M: definition key, remoteModel, model file name), children (new K: the child summaries a package or the project reads), each true by default. A missing/empty summary, another H, X, title or aiVersion rewrite always. Packages and the project now record P, M, K too, so a package is rewritten when its files were re-summarized over unchanged sources (was a gap: its C is built from the children's source checksums). Every example YAML shows the switches.
• fileNames (selection and condition) for files without an extension; contentMatches; {a,b} in every glob (support.AiGlob); BOM / UTF-16 decoding.
• fileInterpreters (selection) and the interpreters condition: a file without an extension whose #! line names bash, perl, python (or a version) is indexed and routed (support.AiShebang, env options read as env reads them; an unreadable file is skipped with a warning).
• contentHeadChars (default 16,384, at least 256): how much contentMatches / interpreters read; never past the file's end.
• Facts files: [include]<TAB><key>; [raw] counts before the [ignore] blanking, [distinct] counts different names; every pattern may read 2,000 characters per character plus 1,000,000, past that its counter is left out with a warning (the profile's patterns read at most ~830).
• The user message of a file starts with its path below the base directory, so two web.xml of different modules read apart. SourceFileIndexer is final (constructor gained two parameters).

Profile v3

• file-body-oop for Java, Kotlin, Groovy, Scala — replaces file-body-java (breaking: a rule naming file-body-java must name file-body-oop). It now names private helpers, constants and calls on dependencies too.
• file-body-view, file-body-contract, file-body-ops (a workflow's name, Gradle scripts); the XML prompt defines EE descriptors, mappings, routes, BPMN, DMN, WSDL.
• Facts files: kotlin, groovy, scala, java-ee, jee, persistence, mybatis, integration, bpmn, dmn, wsdl, jsp, facelets, openapi, asyncapi, proto, avro, graphql, k8s, actions, dockerfile, compose, ansible, terraform, camel-yaml, gradle, properties, powershell, batch. java-facts now skips comments and strings (TODO/FIXME is [raw]).
• examples/copilot-api-gateway/srcmorph-luna.yaml routes every kind; pathGlob keeps matching in the case written (decided, documented).

Measurement (OpenRouter)

docs/ai-index-benchmark/remeasure-2026-11-04/ (3 runs each) and, after the prompt changes, remeasure-2026-11-04b/:

	gpt-oss-20b	GPT-6 Luna
card corpus, file-body-java	99.8 %	99.7 %
card corpus, file-body-oop	99.9 % → 99.5 % (6 runs)	100 % → 100 %
language corpus	98.7 % → 99.0 % (9 runs)	99.8 % → 99.5 %
enterprise corpus (new)	97.9 % → 99.7 %	97.3 % → 99.9 %

The names the first enterprise runs left out (release-backoffice, nextNumber, PREFIX, refund) are named in all six later runs. No summary copied the corpus's password, no fence, no ### heading, no failed file.

Test plan

• Affected unit / integration tests pass locally: mvn install reactor green (core 2070 tests, CLI 74, plugin 54), SpotBugs clean, PIT core 1877/1877, .github/plugin-it.sh passed locally, benchmark tool tests 48/48, reuse lint compliant
• A review agent checked the branch; its findings are fixed in the last commit (Terraform references, PowerShell verbs, AsyncAPI addresses, env options, unreadable files, contentHeadChars bounds, docs)
• CI is green on this branch
• Docs / CHANGELOG updated where applicable (CHANGELOG Unreleased, profiles/README, plugin, core and CLI README, TODO.md keeps only what is open)

Related issues / PRs

Refs #268

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits
• No security-sensitive changes (the secrets rule reduces exposure; nothing else touches credentials)

🤖 Generated with Claude Code

https://claude.ai/code/session_01DuAkLtHrCTx81vP5Mt4jad

[coderabbitai]

Walkthrough

Warning

Review details and warnings were omitted to fit the comment limit.

[sonarqubecloud]

Quality Gate passed

Issues
55 New issues
0 Accepted issues

Measures
0 Security Hotspots
98.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud