@orangepro/orangepro-mcp 0.1.0 → 0.2.0

package/dist/local/autoProve.js

@@ -26,10 +26,71 @@ import { loadGraph, workspacePaths } from "./workspace.js";
 import { systemClock } from "./util/time.js";
 import { redactSecrets } from "./util/redact.js";
 import { classifyBaselineFailure, EXPERIMENTAL_SQLITE_TEST_ENV, IMPORT_TIME_CATEGORIES, isNeedsSetupCategory, readEnginesNode, targetNeedsExperimentalSqlite } from "./proofRunnability.js";
-/** Real dynamic proof is TS/JS-only; only these targets are attemptable. */
+/** Real dynamic proof is profile-gated; only wired runner targets are attemptable. */
 function isTsJsFile(file) {
     return /\.[cm]?[jt]sx?$/i.test(file);
 }
+function isGoFile(file) {
+    return /\.go$/i.test(file);
+}
+function isJavaFile(file) {
+    return /\.java$/i.test(file);
+}
+function isPythonFile(file) {
+    return /\.py$/i.test(file);
+}
+function replacementForTarget(file) {
+    return isPythonFile(file) ? "return 0" : "return null;";
+}
+function codeSymbolFile(node) {
+    return typeof node.properties.file === "string" ? node.properties.file : node.external_id.replace(/^sym:/, "").split("#")[0];
+}
+function isRunnablePythonTestPath(testRel) {
+    const file = testRel.split("::", 1)[0] ?? testRel;
+    return /(^|\/)(test_[^/]+|[^/]+_test)\.py$/i.test(file);
+}
+function isRunnableTestForTarget(node, testRel) {
+    const file = codeSymbolFile(node);
+    if (isPythonFile(file))
+        return isRunnablePythonTestPath(testRel);
+    return true;
+}
+function pytestNodeidsForFile(sourceRoot, testRel) {
+    if (testRel.includes("::"))
+        return [testRel];
+    if (!isRunnablePythonTestPath(testRel))
+        return [testRel];
+    let text = "";
+    try {
+        text = readFileSync(resolve(sourceRoot, testRel), "utf8");
+    }
+    catch {
+        return [testRel];
+    }
+    const out = [];
+    let currentClass = null;
+    let classIndent = 0;
+    for (const line of text.split(/\r?\n/)) {
+        const indent = line.match(/^\s*/)?.[0].length ?? 0;
+        const classMatch = /^(\s*)class\s+(Test[A-Za-z0-9_]*)\b/.exec(line);
+        if (classMatch) {
+            currentClass = classMatch[2];
+            classIndent = classMatch[1].length;
+            continue;
+        }
+        if (currentClass && indent <= classIndent && line.trim() !== "" && !line.startsWith(" "))
+            currentClass = null;
+        const fnMatch = /^(\s*)def\s+(test_[A-Za-z0-9_]*)\s*\(/.exec(line);
+        if (!fnMatch)
+            continue;
+        const fnIndent = fnMatch[1].length;
+        if (currentClass && fnIndent > classIndent)
+            out.push(`${testRel}::${currentClass}::${fnMatch[2]}`);
+        else
+            out.push(`${testRel}::${fnMatch[2]}`);
+    }
+    return out.length ? out.slice(0, 25) : [testRel];
+}
 /**
  * SOLE trust barrier for auto-prove target selection. `opDynamicProof` has NO
  * eligibility guard — `resolveTargetSymbol` resolves ANY CodeSymbol and the prove
@@ -37,7 +98,17 @@ function isTsJsFile(file) {
  * Proven against plumbing. Auto-prove must therefore refuse anything that is not an
  * entry-point-adjacent behavior surface: eligible (top-level `denominator_eligible`),
  * `behavior_surface === "entrypoint_adjacent"`, and carrying NO `denominator_reason_code`
- * (infra_behavior_surface / not_entry_point_adjacent). TS/JS file, always.
+ * (infra_behavior_surface / not_entry_point_adjacent).
+ *
+ * Language: TS/JS (unchanged), Go (G-INT-2), OR Java (J-INT-2). Go dynamic proof
+ * (G-1) proves FREE FUNCTIONS ONLY — a Go method classifies `unrunnable` and never
+ * mints, so admitting one is safe (never a false Proven) but wastes an attempt; when
+ * the clean `symbol_kind === "method"` signal is present we exclude it up front. Java
+ * dynamic proof (J-1) is the INVERSE — it proves single-top-level-return METHODS, so
+ * we admit Java methods; a non-J-1-shape method (void/constructor/nested/generic) just
+ * classifies `unrunnable` and never mints, safe by construction. Everything downstream
+ * of `closed`/the cert is language-agnostic and mints Go/Java only through the
+ * unchanged G-INT-1/J-INT-1 gates.
  */
 export function isEligibleProvableTarget(node) {
     if (!node || node.kind !== "CodeSymbol")
@@ -48,8 +119,218 @@ export function isEligibleProvableTarget(node) {
         return false;
     if (node.properties.denominator_reason_code != null)
         return false;
-    const file = typeof node.properties.file === "string" ? node.properties.file : node.external_id.replace(/^sym:/, "").split("#")[0];
-    return isTsJsFile(file);
+    return matchesProvableLanguageShape(node);
+}
+/**
+ * The LANGUAGE + oracle-SHAPE half of eligibility, factored out so both the strict
+ * `isEligibleProvableTarget` (which layers the entry-point-adjacent SCOPE guards on top)
+ * and the relaxed hard-edge existing-tests path share ONE definition of "a shape the
+ * oracle can prove". CodeSymbol + a TS/JS file, a Go free function, a Java method, or a
+ * Python function/method.
+ */
+function matchesProvableLanguageShape(node) {
+    if (node.kind !== "CodeSymbol")
+        return false;
+    const file = codeSymbolFile(node);
+    if (isTsJsFile(file))
+        return true;
+    // Go: free functions only. A method is out of scope for the Go oracle (G-1 refuses it).
+    if (isGoFile(file))
+        return node.properties.symbol_kind !== "method";
+    // Java: METHODS only (J-1 proves single-top-level-return methods). A non-J-1-shape
+    // method classifies `unrunnable` and never mints, so admitting all Java methods is
+    // safe (never a false Proven); a non-method Java symbol (a class container) is out
+    // of scope. No graph return-shape signal exists to pre-filter, so we admit broadly
+    // and let the Java oracle refuse non-J-1 shapes at run time.
+    if (isJavaFile(file))
+        return node.properties.symbol_kind === "method";
+    if (isPythonFile(file)) {
+        const symbolKind = typeof node.properties.symbol_kind === "string" ? node.properties.symbol_kind : "";
+        if (symbolKind !== "function" && symbolKind !== "method")
+            return false;
+        const member = node.external_id.split("#")[1] ?? "";
+        if (/^__.*__$/.test(member))
+            return false;
+        return true;
+    }
+    return false;
+}
+/**
+ * Relaxed eligibility for the existing-tests HARD-edge path ONLY. A symbol carrying a
+ * HARD `TESTED_BY`/`COVERS` proof edge (a real, analyzer-derived test) is admitted even
+ * when it is `not_entry_point_adjacent` — a Formatter/Converter SPI method like
+ * `PetTypeFormatter#print` is a genuine behavior the repo's own test exercises, but it
+ * sits below the entry-point-adjacent denominator bar. Only the `not_entry_point_adjacent`
+ * SCOPE guard is dropped, NOT a trust guard: a relaxed pick is only ever proven-or-refused
+ * by the frozen oracle, never false-Proven. Guards deliberately KEPT:
+ *   - `infra_behavior_surface` still excludes plumbing (getters/registry accessors) — a
+ *     hard edge does not buy an infra symbol an attempt (waste, and preserves the #4 bar);
+ *   - the language + oracle-shape filter (never hand a class container / Go method down).
+ * Used solely on the hard lane; weak MAY_* fan-out stays strict.
+ */
+function isEligibleHardExistingTarget(node) {
+    if (!node)
+        return false;
+    if (node.properties.denominator_reason_code === "infra_behavior_surface")
+        return false;
+    return matchesProvableLanguageShape(node);
+}
+/** Go `_test.go` top-level test-name regex (matches `extractTestNames`'s Go pattern). */
+const GO_TEST_NAME_RE = /^Test[A-Za-z0-9_]+$/;
+/**
+ * Edge `test_name` may also be a literal-named subtest path (`TestX/sub`, `TestX/a/b`).
+ * The analyzer only records `[A-Za-z0-9_]` segments (a runtime `tc.Name` or a literal
+ * needing Go's `-run` sanitization is dropped to the bare parent), so each segment is
+ * `-run`-safe verbatim and this stays a strict superset of `GO_TEST_NAME_RE`.
+ */
+const GO_TEST_PATH_RE = /^Test[A-Za-z0-9_]+(\/[A-Za-z0-9_]+)*$/;
+/**
+ * Anchor a Go test-name path into a fully-anchored `-run` pattern the oracle binds to
+ * EXACTLY one test: `TestX` → `^TestX$`; `TestX/sub` → `^TestX$/^sub$` (every segment
+ * anchored so no segment can prefix-match a sibling). Mirrors the spike's `targetTestName`.
+ */
+function anchorGoTestRun(name) {
+    return name.split("/").map((seg) => `^${seg}$`).join("/");
+}
+/**
+ * G-INT-2: resolve a Go CodeSymbol target to the single anchored `^TestName$` that
+ * exercises it, or null when it cannot be resolved uniquely. The Go oracle selects
+ * its target test BY NAME (`go test -run ^TestX$`), so auto-drive must derive that
+ * name — G-INT-1 took it as an explicit input.
+ *
+ * The link is the analyzer's HARD `TESTED_BY`/`COVERS` proof edge (Go free-fn sym ↔
+ * `test:<file>_test.go`), emitted only for an eligible Go symbol whose test genuinely
+ * asserts on it. PRIMARY: the edge carries `properties.test_name` — the EXACT enclosing
+ * `func TestXxx` where the assertion witnessed THIS target (structural metadata, never
+ * proof) — which disambiguates even a `_test.go` file with many tests. FALLBACK (old
+ * graphs / no edge metadata): the linked TestCase node's file-level `test_names[]`,
+ * usable only when it lists exactly ONE Go test. Either way we return a name only when
+ * it resolves UNIQUELY across all associated tests; zero/ambiguous ⇒ null (SKIP). A
+ * wrong name never mints a false Proven — the mutant survives an unrelated test and
+ * classifies unproven — but it wastes a run and the spike refuses a broad pattern anyway.
+ */
+export function goTestRunForTarget(nodeById, graph, symId) {
+    const names = new Set();
+    const testIds = new Set();
+    for (const e of graph.edges) {
+        const isTestedBy = e.from_external_id === symId && e.relationship_type === "TESTED_BY";
+        const isCovers = e.to_external_id === symId && e.relationship_type === "COVERS";
+        if (!isTestedBy && !isCovers)
+            continue;
+        testIds.add(isTestedBy ? e.to_external_id : e.from_external_id);
+        const edgeName = e.properties?.test_name;
+        if (typeof edgeName === "string" && GO_TEST_PATH_RE.test(edgeName))
+            names.add(edgeName);
+    }
+    if (names.size >= 1)
+        return names.size === 1 ? anchorGoTestRun([...names][0]) : null;
+    // Fallback: no per-edge test_name (older graph) — a file that holds exactly one
+    // (bare, top-level) test; file-level `test_names[]` never carries subtest paths.
+    for (const testId of testIds) {
+        const tc = nodeById.get(testId);
+        if (!tc || tc.kind !== "TestCase")
+            continue;
+        const testNames = Array.isArray(tc.properties.test_names) ? tc.properties.test_names : [];
+        for (const n of testNames)
+            if (typeof n === "string" && GO_TEST_NAME_RE.test(n))
+                names.add(n);
+    }
+    return names.size === 1 ? anchorGoTestRun([...names][0]) : null;
+}
+/**
+ * Slice 2: the assertion source line for the edge whose `test_name` anchors to `testRun`.
+ * Returned only when EXACTLY ONE such edge carries a numeric `assertion_line` (unique-else-
+ * undefined, mirroring `goTestRunForTarget`'s discipline). Undefined ⇒ the spike keeps its
+ * exact-name behavior. Never widens trust — a wrong line makes the oracle refuse, not prove.
+ */
+export function goAssertionLineForTarget(graph, symId, testRun) {
+    const lines = new Set();
+    for (const e of graph.edges) {
+        const isTestedBy = e.from_external_id === symId && e.relationship_type === "TESTED_BY";
+        const isCovers = e.to_external_id === symId && e.relationship_type === "COVERS";
+        if (!isTestedBy && !isCovers)
+            continue;
+        const edgeName = e.properties?.test_name;
+        const line = e.properties?.assertion_line;
+        if (typeof edgeName === "string" && GO_TEST_PATH_RE.test(edgeName) && anchorGoTestRun(edgeName) === testRun && typeof line === "number") {
+            lines.add(line);
+        }
+    }
+    return lines.size === 1 ? [...lines][0] : undefined;
+}
+/** A JUnit test method identifier (any Java identifier — JUnit does not require a Test* prefix). */
+const JAVA_TEST_METHOD_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+/** The simple test-class name for a Java `test:<relPath>` id — the file basename without `.java`. */
+function javaTestClassOf(testRelId) {
+    if (!testRelId.startsWith("test:"))
+        return null;
+    const rel = testRelId.slice("test:".length);
+    if (!/\.java$/i.test(rel))
+        return null;
+    const base = rel.split("/").pop() ?? rel;
+    return base.replace(/\.java$/i, "") || null;
+}
+/**
+ * J-INT-2: resolve a Java CodeSymbol target to the single `Class#method` JUnit test
+ * that exercises it, or null when it cannot be resolved uniquely. The Java oracle
+ * selects its target test with `mvn test -Dtest=Class#method`, so auto-drive must
+ * derive that selector — J-INT-1 took it as an explicit input.
+ *
+ * The link is the analyzer's HARD `TESTED_BY`/`COVERS` proof edge (Java method sym ↔
+ * `test:<...>Test.java`), emitted only for a Java symbol a JUnit test genuinely
+ * asserts on. The test CLASS is the test file's simple class name (its basename, per
+ * Java's one-public-class-per-file convention; the spike accepts a simple class).
+ * The test METHOD is, PRIMARY: the edge's `properties.test_name` — the exact enclosing
+ * `@Test` method where the assertion witnessed THIS target (structural metadata, never
+ * proof) — which disambiguates a test class with many @Test methods. FALLBACK (older
+ * graphs / no edge metadata): the linked TestCase node's file-level `test_names[]`,
+ * usable only when it lists exactly ONE test. We return a `Class#method` only when the
+ * PAIR resolves UNIQUELY across all associated tests; zero/ambiguous ⇒ null (SKIP). A
+ * wrong selector never mints a false Proven — the mutant survives an unrelated test and
+ * classifies unproven — but it wastes a run, so we refuse to guess.
+ */
+export function javaTestForTarget(nodeById, graph, symId) {
+    const selectors = new Set();
+    // Per test id, the enclosing @Test method names named by proof edges (primary source).
+    const edgeMethodsByTest = new Map();
+    const testIds = new Set();
+    for (const e of graph.edges) {
+        const isTestedBy = e.from_external_id === symId && e.relationship_type === "TESTED_BY";
+        const isCovers = e.to_external_id === symId && e.relationship_type === "COVERS";
+        if (!isTestedBy && !isCovers)
+            continue;
+        const testId = isTestedBy ? e.to_external_id : e.from_external_id;
+        testIds.add(testId);
+        const edgeName = e.properties?.test_name;
+        if (typeof edgeName === "string" && JAVA_TEST_METHOD_RE.test(edgeName)) {
+            const set = edgeMethodsByTest.get(testId) ?? new Set();
+            set.add(edgeName);
+            edgeMethodsByTest.set(testId, set);
+        }
+    }
+    for (const testId of testIds) {
+        const cls = javaTestClassOf(testId);
+        if (!cls)
+            continue;
+        for (const m of edgeMethodsByTest.get(testId) ?? [])
+            selectors.add(`${cls}#${m}`);
+    }
+    if (selectors.size >= 1)
+        return selectors.size === 1 ? [...selectors][0] : null;
+    // Fallback: no per-edge test_name (older graph) — a test class holding exactly one test.
+    for (const testId of testIds) {
+        const cls = javaTestClassOf(testId);
+        if (!cls)
+            continue;
+        const tc = nodeById.get(testId);
+        if (!tc || tc.kind !== "TestCase")
+            continue;
+        const testNames = Array.isArray(tc.properties.test_names) ? tc.properties.test_names : [];
+        const valid = testNames.filter((n) => typeof n === "string" && JAVA_TEST_METHOD_RE.test(n));
+        if (valid.length === 1)
+            selectors.add(`${cls}#${valid[0]}`);
+    }
+    return selectors.size === 1 ? [...selectors][0] : null;
 }
 const GENERATED_HEADER = "// Generated by OrangePro — do not edit";
 // "Static map first, dynamically prove top 5": ONE unified dynamic-proof budget spans
@@ -67,6 +348,9 @@ const GEN_WINDOW = 5;
 // a provable hard-edge symbol is tried. Small K; promote to a flag if a repo needs a wider sweep.
 const EXISTING_LANE_MAX_WEAK_PER_SYMBOL = 3;
 export const NO_KEY_MESSAGE = "No provider key; auto-prove skipped — add OPENAI_API_KEY / ANTHROPIC_API_KEY, or use the OrangePro MCP in your coding agent.";
+export function isRoastSurvivor(attempt) {
+    return attempt.classification === "non_killing" && attempt.mutant_status === "associated_survived";
+}
 /**
  * Resolve the contained absolute path for a generated file, REJECTING any name that
  * escapes `<sourceRoot>/orangepro_generated/`. Exported so the guardrail is unit-tested.
@@ -89,7 +373,8 @@ const REL_IMPORT_RE = /(\bfrom\s*|\bimport\s*|\brequire\s*\(\s*|\bimport\s*\(\s*
  * against the target source file's directory, then re-express it relative to
  * `orangepro_generated/` (POSIX, leading `./`) — e.g. `./order.service` →
  * `../src/order.service`. Only import/require positions are touched, never plain
- * string literals. TS/JS only (dynamic proof is TS/JS-only).
+ * string literals. TS/JS only — this rewrite serves the TS/JS generation lane;
+ * Go/Java/Python proofs route through their own language spikes.
  */
 function rewriteRelativeImports(body, targetFileRel, generatedDir) {
     const baseDir = posix.dirname(targetFileRel.split(sep).join("/"));
@@ -142,6 +427,11 @@ function classifyProof(result, ctx) {
     }
     return { classification: "non_killing", reason: record.reason ?? "Mutant survived; the test does not assert on the target's real behavior." };
 }
+function mutantStatusOf(result) {
+    if ("status" in result && result.status === "unrunnable")
+        return "unrunnable";
+    return result.record.dynamic_proof?.mutant_status;
+}
 /**
  * R-1 sibling-dedup key: a baseline-red import-time failure is a deterministic property of
  * loading the TARGET FILE with a given runner, independent of which test runs it — so
@@ -223,7 +513,10 @@ export function existingAssociatedTests(graph, nodeById) {
     // edges. Hard is recorded before weak (graph.edges scanned first), so a test already
     // linked hard is never downgraded; a later weak dup only upgrades an existing weak to hard.
     const add = (symId, testRel, hard) => {
-        if (!isEligibleProvableTarget(nodeById.get(symId)))
+        // A HARD TESTED_BY/COVERS edge is a real derivable test; admit it even when the symbol
+        // is not_entry_point_adjacent (relaxed shape-only guard). Weak MAY_* fan-out stays strict.
+        const node = nodeById.get(symId);
+        if (!(hard ? isEligibleHardExistingTarget(node) : isEligibleProvableTarget(node)))
             return;
         const list = out.get(symId);
         if (!list) {
@@ -313,11 +606,13 @@ export function orderExistingAttempts(testsBySymbol, maxWeakPerSymbol = EXISTING
  * PR 1.5 lane — prove the repo's OWN existing tests, NO provider key. For each eligible
  * target with an existing associated test, run the UNCHANGED `opProveLoop` with the test
  * IN ITS ORIGINAL LOCATION (never copied/relocated — that avoids the generation lane's
- * import-grounding pitfall) and a null-sentinel mutant. Closes → Proven; survives /
- * crashes-pre-assert / setup-fails → honest skip (never Proven, and #162 best-ever
- * selection means it can never clobber a prior Proven). Consumes from the SHARED unified
- * budget (`budget`) — the generation lane gets whatever this lane leaves unspent, so
- * TOTAL attempts (existing + generation) never exceed the budget.
+ * import-grounding pitfall). TS/JS uses a null-sentinel mutant; Go (G-INT-2) selects the
+ * test by its derived `^TestName$` and lets the Go oracle compute its own zero-value
+ * sentinel. Closes → Proven; survives / crashes-pre-assert / setup-fails / (Go)
+ * unresolvable-test-name → honest skip (never Proven, and #162 best-ever selection means
+ * it can never clobber a prior Proven). Consumes from the SHARED unified budget (`budget`)
+ * — the generation lane gets whatever this lane leaves unspent, so TOTAL attempts
+ * (existing + generation) never exceed the budget.
  */
 function proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, proveLoop, proveDeps, alreadyProven, importTimeBlocked, budget) {
     const attempts = [];
@@ -329,13 +624,14 @@ function proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, p
     const reader = fileReaderFor(sourceRoot); // R-2: source scan for the node:sqlite env profile
     // Fix 3: hard TESTED_BY/COVERS pairs first, weak MAY_* pairs after and capped per symbol.
     const queue = orderExistingAttempts(existingAssociatedTests(graph, nodeById));
-    for (const { symId, testRel } of queue) {
+    for (const { symId, testRel, hard } of queue) {
         if (attempted >= budget)
             break;
         const node = nodeById.get(symId);
         // Redundant with existingAssociatedTests' own filter, but the eligibility barrier is
         // the sole guard against handing plumbing to the guard-less prove path — assert it here too.
-        if (!isEligibleProvableTarget(node))
+        // A hard-edge pick uses the relaxed shape-only guard (mirrors the add() decision above).
+        if (!(hard ? isEligibleHardExistingTarget(node) : isEligibleProvableTarget(node)))
             continue;
         if (changed && !changed.has(symbolFileOf(node)))
             continue;
@@ -351,29 +647,66 @@ function proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, p
         // (engine_mismatch: runner Node outside the declared engines range). Every sibling in this
         // file fails baseline identically → mark it
         // needs_setup WITHOUT re-running (and WITHOUT consuming the attempt budget).
+        const isPython = isPythonFile(targetFileRel);
+        const candidateTestRels = isPython
+            ? pytestNodeidsForFile(sourceRoot, testRel).filter((candidate) => isRunnableTestForTarget(node, candidate))
+            : [testRel];
+        if (candidateTestRels.length === 0)
+            continue;
+        const proofTestRel = candidateTestRels[0];
         const blocked = importTimeBlocked.get(dedupKey(undefined, targetFileRel));
         if (blocked) {
-            const attempt = dedupedAttempt(symId, testRel, targetFileRel, blocked);
+            const attempt = dedupedAttempt(symId, proofTestRel, targetFileRel, blocked);
             attempts.push(attempt);
             needsSetup.push(attempt);
             continue;
         }
+        // Go and Java targets select the test BY NAME and let their oracle derive its own
+        // typed sentinel — no test_path/replacement/link_node_modules/test_env apply. Go
+        // uses `go test -run ^TestX$`; Java uses `mvn test -Dtest=Class#method`. Resolve the
+        // exact selector; if it can't be resolved uniquely, SKIP without spending the attempt
+        // budget (a broad/wrong selector is refused/unmatched by the oracle and wastes a run).
+        const isGo = isGoFile(targetFileRel);
+        const isJava = isJavaFile(targetFileRel);
+        let nativeTestRun = null;
+        let goAssertionLine;
+        if (isGo) {
+            nativeTestRun = goTestRunForTarget(nodeById, graph, symId);
+            if (!nativeTestRun)
+                continue;
+            goAssertionLine = goAssertionLineForTarget(graph, symId, nativeTestRun);
+        }
+        else if (isJava) {
+            nativeTestRun = javaTestForTarget(nodeById, graph, symId);
+            if (!nativeTestRun)
+                continue;
+        }
         attempted++;
         // R-2: inject NODE_OPTIONS=--experimental-sqlite via the existing test_env path when the
         // target references node:sqlite. Makes the baseline runnable only; never mints Proven.
-        const testEnv = experimentalSqliteTestEnv(reader, targetFileRel);
+        const testEnv = isGo || isJava || isPython ? undefined : experimentalSqliteTestEnv(reader, targetFileRel);
+        const displayTest = nativeTestRun ?? proofTestRel;
         let result;
         try {
-            result = proveLoop(root, 
-            // link_node_modules: the isolated proof copy excludes node_modules; without linking,
-            // any target/test importing a repo dependency fails baseline → needs_setup. Linking only
-            // makes real tests runnable — Proven still requires the dynamic oracle's sentinel kill.
-            { target_symbol: symId, source: sourceRoot, test_path: testRel, replacement: "return null;", link_node_modules: true, ...(testEnv ? { test_env: testEnv } : {}), run_id: `auto-prove-existing-${attempted}` }, proveDeps);
+            result = proveLoop(root, nativeTestRun
+                ? { target_symbol: symId, source: sourceRoot, test_run: nativeTestRun, ...(goAssertionLine !== undefined ? { go_assertion_line: goAssertionLine } : {}), run_id: `auto-prove-existing-${attempted}` }
+                // link_node_modules: the isolated proof copy excludes node_modules; without linking,
+                // any target/test importing a repo dependency fails baseline → needs_setup. Linking only
+                // makes real tests runnable — Proven still requires the dynamic oracle's sentinel kill.
+                : {
+                    target_symbol: symId,
+                    source: sourceRoot,
+                    test_path: proofTestRel,
+                    replacement: replacementForTarget(targetFileRel),
+                    link_node_modules: true,
+                    ...(testEnv ? { test_env: testEnv } : {}),
+                    run_id: `auto-prove-existing-${attempted}`
+                }, proveDeps);
         }
         catch (e) {
             const attempt = {
                 target_symbol: symId,
-                test_path: testRel,
+                test_path: displayTest,
                 classification: "needs_setup",
                 reason: `Proof could not run: ${redactSecrets(errMsg(e))}`
             };
@@ -382,7 +715,14 @@ function proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, p
             continue;
         }
         const { classification, reason, category } = classifyProof(result, { sourceRoot, targetFileRel });
-        const attempt = { target_symbol: symId, test_path: testRel, classification, reason, category };
+        const attempt = {
+            target_symbol: symId,
+            test_path: displayTest,
+            classification,
+            reason,
+            category,
+            mutant_status: mutantStatusOf(result)
+        };
         attempts.push(attempt);
         if (classification === "proven") {
             proven++;
@@ -442,6 +782,20 @@ export async function autoProve(root, opts, deps) {
     const autoLimit = Math.max(1, Math.min(MAX_AUTO_LIMIT, Math.floor(opts.autoLimit ?? DEFAULT_AUTO_LIMIT)));
     // ── Lane 1: existing associated tests — NO key required, runs FIRST (PR 1.5). ──
     const ex = proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, proveLoop, proveDeps, alreadyProven, importTimeBlocked, autoLimit);
+    if (opts.existingOnly) {
+        const status = ex.proven > 0 ? "proven-run" : ex.attempted > 0 ? "ran-no-proof" : "no-targets";
+        return {
+            ran: ex.attempted > 0,
+            status,
+            reason: "existing-tests-only: generation disabled.",
+            attempted: ex.attempted,
+            proven: ex.proven,
+            needs_setup: ex.needsSetup,
+            skipped: [],
+            generated_files: [],
+            attempts: ex.attempts
+        };
+    }
     // Key gate applies ONLY to the generation lane. No provider key ⇒ generation is skipped
     // (no files, no fake proof) with explicit guidance; the existing-tests lane still counts.
     const providerConfig = resolveProviderConfig(deps.env, { provider: opts.provider, model: opts.model });
@@ -489,7 +843,7 @@ export async function autoProve(root, opts, deps) {
         const window = candidates.slice(start, start + GEN_WINDOW);
         const need = genBudget - attempted;
         const windowIds = window.map((g) => g.id);
-        const gen = await generate(graph, { target_ids: windowIds, limit: Math.min(windowIds.length, need) }, provider, reader, clock);
+        const gen = await generate(graph, { target_ids: windowIds, limit: Math.min(windowIds.length, need), ...(opts.prompt_version ? { prompt_version: opts.prompt_version } : {}) }, provider, reader, clock);
         const tests = gen.generated_tests;
         // Global start offset so filenames stay unique across windows — runHintsFor
         // otherwise resets its index to 0 per window and same-slug targets collide.
@@ -498,13 +852,26 @@ export async function autoProve(root, opts, deps) {
             const test = tests[i];
             const hint = hints[i];
             if (!hint.prove_run) {
-                // Non-TS/JS target or no resolvable code symbol → not attemptable.
+                // No JS prove_run. Go and Java are dynamically provable only through their OWN
+                // test in the target's package/module (the existing-tests lane): the Go oracle
+                // runs `go test -run ^TestX$ ./<pkgdir>` and the Java oracle runs
+                // `mvn test -Dtest=Class#method` in the target's Maven module, so a freshly
+                // generated test written to orangepro_generated/ is in the wrong package/module
+                // and can never be reached. Skip generated Go/Java here with an honest reason
+                // (the existing-tests lane covers both).
+                const genFile = hint.target_symbol_external_id ? symbolFile(hint.target_symbol_external_id) : "";
+                const goGen = genFile ? isGoFile(genFile) : false;
+                const javaGen = genFile ? isJavaFile(genFile) : false;
                 skipped.push({
                     target_symbol: hint.target_symbol_external_id,
                     title: test.title,
-                    reason: hint.target_symbol_external_id
-                        ? "Target is not TS/JS; dynamic proof supports TS/JS CodeSymbol targets only."
-                        : "No resolvable TS/JS code-symbol target to prove."
+                    reason: goGen
+                        ? "Go dynamic proof runs the target package's own test; a generated Go test is out of that package — proven via the existing-tests lane instead."
+                        : javaGen
+                            ? "Java dynamic proof runs the target module's own test; a generated Java test is out of that module — proven via the existing-tests lane instead."
+                            : hint.target_symbol_external_id
+                                ? "Target is not TS/JS; dynamic proof supports TS/JS CodeSymbol targets only."
+                                : "No resolvable TS/JS code-symbol target to prove."
                 });
                 continue;
             }
@@ -582,7 +949,14 @@ export async function autoProve(root, opts, deps) {
                 continue;
             }
             const { classification, reason, category } = classifyProof(result, { sourceRoot, targetFileRel });
-            const attempt = { target_symbol, test_path: writeRel, classification, reason, category };
+            const attempt = {
+                target_symbol,
+                test_path: writeRel,
+                classification,
+                reason,
+                category,
+                mutant_status: mutantStatusOf(result)
+            };
             attempts.push(attempt);
             if (classification === "proven")
                 proven++;