@orangepro/orangepro-mcp 0.1.0 → 0.2.1

package/dist/local/operations.js

@@ -1,6 +1,6 @@
 import { execFileSync, spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve, sep } from "node:path";
+import { dirname, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { LOCAL_GRAPH_SCHEMA_VERSION } from "./graph/ontology.js";
 import { systemClock } from "./util/time.js";
@@ -42,6 +42,7 @@ import { confirmedCoverageByLayer } from "./score/coverage.js";
 import { prepareRuntimeCoverage } from "./analyze/coverageArtifacts.js";
 import { appendLedgerRecord, canReproveLanguage, loadLedger, ledgerStats, proofEdgesFor, reproveTarget, resolveTargetSymbol, targetFingerprint, targetLanguage } from "./ledger.js";
 import { buildRtm, renderRtmCsv, renderRtmMarkdown } from "./rtm.js";
+import { buildProofDoctor, distillProofAttempts, loadProofAttempts, proofAttemptsFresh, writeProofAttempts } from "./proofDoctor.js";
 import { tryScopedReprove } from "./reprove/scoped.js";
 import { resolveContained, toWorkspaceRel } from "./reprove/paths.js";
 import { hashBuffer } from "./util/hash.js";
@@ -56,8 +57,81 @@ function dynamicProofSpikePath() {
     const here = dirname(fileURLToPath(import.meta.url));
     return resolve(here, "..", "..", "scripts", "spikes", "dynamic-proof-spike.mjs");
 }
+/**
+ * Resolve the Go MODULE root: the nearest `go.mod` ancestor of the target file,
+ * searched from the target's directory up to (and including) sourceRoot. For a
+ * single-module repo this is sourceRoot itself. Confined to sourceRoot so the spike
+ * never sandboxes a directory outside the trusted checkout.
+ * ponytail: nearest-ancestor go.mod; multi-module edge cases (nested/replace) resolve to G-INT-3.
+ */
+/**
+ * G2 — confinement bound for module-root walk-up: the walk may pass ABOVE the
+ * analyzed source path (fixing `opro start ./subpkg` inside a bigger module)
+ * but never escapes the INVOCATION root the user ran opro from. If the analyzed
+ * path lies outside the invocation root, keep the old sourceRoot confinement.
+ * Discovery/scoping only — the proof gate is untouched, and when the chosen
+ * module root differs from the analyzed path it is named in progress output
+ * and on the result (module_root).
+ */
+function moduleRootBound(sourceRoot, workspaceRoot) {
+    const src = resolve(sourceRoot);
+    const ws = resolve(workspaceRoot);
+    return src === ws || src.startsWith(ws + sep) ? ws : src;
+}
+function goModuleRoot(sourceRoot, targetRel, workspaceRoot) {
+    let dir = dirname(resolve(sourceRoot, targetRel));
+    const stop = moduleRootBound(sourceRoot, workspaceRoot);
+    for (;;) {
+        if (existsSync(join(dir, "go.mod")))
+            return dir;
+        if (dir === stop)
+            break;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    throw new Error(`No go.mod found for Go target ${targetRel} under ${stop}.`);
+}
+/**
+ * Resolve the Java MODULE root: the nearest `pom.xml` (or `build.gradle` /
+ * `build.gradle.kts`) ancestor of the target file, searched from the target's
+ * directory up to (and including) sourceRoot. Mirrors goModuleRoot — for a
+ * single-module project this is sourceRoot itself. Confined to sourceRoot so the
+ * spike never sandboxes a directory outside the trusted checkout.
+ * ponytail: nearest-ancestor build file; multi-module reactor edge cases resolve to J-INT-3.
+ */
+function javaModuleRoot(sourceRoot, targetRel, workspaceRoot) {
+    let dir = dirname(resolve(sourceRoot, targetRel));
+    const stop = moduleRootBound(sourceRoot, workspaceRoot);
+    for (;;) {
+        if (existsSync(join(dir, "pom.xml")) || existsSync(join(dir, "build.gradle")) || existsSync(join(dir, "build.gradle.kts"))) {
+            return dir;
+        }
+        if (dir === stop)
+            break;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    throw new Error(`No pom.xml or build.gradle found for Java target ${targetRel} under ${stop}.`);
+}
+/** Route to the per-language spike. TS/JS keeps the original path; native profiles use their own mechanisms. */
+function dynamicProofSpikePathFor(language) {
+    if (language === "go" || language === "java" || language === "python") {
+        const here = dirname(fileURLToPath(import.meta.url));
+        const script = language === "go"
+            ? "go-dynamic-proof-spike.mjs"
+            : language === "java"
+                ? "java-dynamic-proof-spike.mjs"
+                : "python-dynamic-proof-spike.mjs";
+        return resolve(here, "..", "..", "scripts", "spikes", script);
+    }
+    return dynamicProofSpikePath();
+}
 function defaultDynamicProofRunner(args, opts = {}) {
-    const script = dynamicProofSpikePath();
+    const script = opts.scriptPath ?? dynamicProofSpikePath();
     if (!existsSync(script)) {
         throw new Error(`Dynamic proof spike runner not found at ${script}. Run this command from an OrangePro source checkout with scripts/spikes available.`);
     }
@@ -83,6 +157,107 @@ function parseDynamicProofJson(stdout, stderr) {
         throw new Error(`Dynamic proof runner did not return JSON.${detail ? ` stderr/stdout: ${detail}` : ""}`);
     }
 }
+/** The label recorded as the cert `sentinel` for a Go proof (Go derives a zero-value return). */
+const GO_SENTINEL_LABEL = "go-zero-return";
+/**
+ * Map the Go spike's JSON onto the SAME language-agnostic DynamicProofOracleSummary the
+ * unchanged `dynamicProofSucceeded` and cert block read. This is the ONE trust-adjacent
+ * seam, so mapping is STRICT: `assertionFailure` is true ONLY when the Go spike genuinely
+ * returned `mutant.trustedAssertion === true`. A skipped/refused mutation, a survived
+ * mutation, or any absent field maps to `assertionFailure = false` — never a false Proven.
+ */
+function mapGoOracle(go) {
+    const mutant = go.mutant;
+    // A refused/skipped mutation co-occurs with status "unrunnable"; it must never close.
+    const skipped = Boolean(mutant && "skipped" in mutant && mutant.skipped === true);
+    const runMutant = !skipped && mutant ? mutant : undefined;
+    return {
+        status: go.status,
+        proven: go.proven === true,
+        reason: go.reason,
+        runner: "go",
+        replacementMode: GO_SENTINEL_LABEL,
+        test: go.testRun,
+        target: go.target,
+        method: go.func,
+        baseline: go.baseline
+            ? { exitCode: go.baseline.exitCode, timedOut: go.baseline.timedOut, failureSummary: go.baseline.failureSummary ?? null }
+            : undefined,
+        // STRICT: trustedAssertion must be exactly true AND the mutant must carry a NUMERIC non-zero
+        // exit code. A missing/undefined/zero exitCode ⇒ assertionFailure=false ⇒ non-close, so the
+        // shared gate (which asserts `exitCode !== 0`, where `undefined !== 0` is truthy) can never
+        // false-close on an absent exit code. skipped/absent/false ⇒ false ⇒ non-close.
+        mutant: runMutant
+            ? {
+                exitCode: runMutant.exitCode,
+                timedOut: runMutant.timedOut,
+                assertionFailure: runMutant.trustedAssertion === true &&
+                    typeof runMutant.exitCode === "number" &&
+                    runMutant.exitCode !== 0
+            }
+            : { assertionFailure: false },
+        medianProofMs: go.medianProofMs
+    };
+}
+/** Test-only handle on the Go→oracle mapper (the one trust-adjacent seam). */
+export function __mapGoOracleForTest(go) {
+    return mapGoOracle(go);
+}
+/** The label recorded as the cert `sentinel` for a Java proof (Java derives a typed sentinel from the return type). */
+const JAVA_SENTINEL_LABEL = "java-typed-sentinel";
+/**
+ * Map the Java spike's JSON onto the SAME language-agnostic DynamicProofOracleSummary the
+ * unchanged `dynamicProofSucceeded` and cert block read. This is the ONE trust-adjacent
+ * seam, so mapping is STRICT: `assertionFailure` is true ONLY when the Java spike genuinely
+ * signalled a trusted JUnit assertion failure — the mutant ran (not skipped), the SAME
+ * target test FAILED, AND surefire classified it as a trusted assertion (`isAssertion`).
+ * A skipped/refused mutation, a survived (associated_survived) mutation, a compile failure,
+ * a non-assertion error, or any absent field maps to `assertionFailure = false` — never a
+ * false Proven. The spike itself already gates `status: "proven"` on all of this; the mapper
+ * re-derives the assertion signal independently so the cert's `mutant_failed_assertion` never
+ * trusts the spike's verdict alone.
+ */
+function mapJavaOracle(java) {
+    const mutant = java.mutant;
+    // A refused/skipped mutation co-occurs with status "unrunnable"; it must never close.
+    const skipped = Boolean(mutant && "skipped" in mutant && mutant.skipped === true);
+    const runMutant = !skipped && mutant
+        ? mutant
+        : undefined;
+    return {
+        status: java.status,
+        proven: java.proven === true,
+        reason: java.reason,
+        runner: "junit",
+        replacementMode: JAVA_SENTINEL_LABEL,
+        test: java.testClass && java.testMethod ? `${java.testClass}#${java.testMethod}` : java.testMethod,
+        target: java.target,
+        method: java.method,
+        baseline: java.baseline
+            ? { exitCode: java.baseline.exitCode, timedOut: java.baseline.timedOut, failureSummary: java.baseline.failureSummary ?? null }
+            : undefined,
+        // STRICT: the mutant must have RUN, FAILED the same target test, the failure must be a trusted
+        // JUnit assertion, AND the mutant must carry a NUMERIC non-zero exit code. A missing/undefined/
+        // zero exitCode ⇒ assertionFailure=false ⇒ non-close, so the shared gate (which asserts
+        // `exitCode !== 0`, where `undefined !== 0` is truthy) can never false-close on an absent exit
+        // code. skipped/survived/compile-fail/non-assertion/absent ⇒ false ⇒ non-close.
+        mutant: runMutant
+            ? {
+                exitCode: runMutant.exitCode,
+                timedOut: runMutant.timedOut,
+                assertionFailure: runMutant.targetTestFailed === true &&
+                    runMutant.isAssertion === true &&
+                    typeof runMutant.exitCode === "number" &&
+                    runMutant.exitCode !== 0
+            }
+            : { assertionFailure: false },
+        medianProofMs: java.medianProofMs
+    };
+}
+/** Test-only handle on the Java→oracle mapper (the one trust-adjacent seam). */
+export function __mapJavaOracleForTest(java) {
+    return mapJavaOracle(java);
+}
 function dynamicProofSucceeded(oracle) {
     return (oracle.status === "proven" &&
         oracle.proven === true &&
@@ -617,6 +792,17 @@ export function opDoctor(root) {
     const graph = loadGraph(workspacePaths(root).graphPath);
     return doctorGraph(graph, scoreGraph(graph));
 }
+/**
+ * G1 — proof-focused doctor: why are top targets not Dynamically Proven?
+ * Read-only: consumes the canonical RTM judgment (buildRtm) plus the last run's
+ * redacted proof-attempts sidecar. Mints nothing, mutates no ledger, writes no
+ * files — under staleness or ambiguity it fails closed to "re-run".
+ */
+export function opProofDoctor(root) {
+    const graph = loadGraph(workspacePaths(root).graphPath);
+    const rtm = buildRtm(graph, loadLedger(root));
+    return buildProofDoctor(graph, rtm, loadProofAttempts(root));
+}
 export function opGaps(root, opts = {}) {
     const graph = loadGraph(workspacePaths(root).graphPath);
     const gaps = findGaps(graph, opts);
@@ -736,6 +922,33 @@ export function opRecordRun(root, opts, deps = defaultDeps()) {
         ts: deps.clock()
     });
 }
+/**
+ * G2 — Python sandbox NARROWING: the nearest pyproject.toml/setup.py/setup.cfg
+ * ancestor of the target, confined to sourceRoot, used only when the test also
+ * lives inside it. Falls back to sourceRoot (today's behavior) otherwise —
+ * this only ever shrinks the copied sandbox, never widens or breaks it.
+ */
+function pythonModuleRoot(sourceRoot, targetRel, testRel) {
+    const stop = resolve(sourceRoot);
+    let dir = dirname(resolve(sourceRoot, targetRel));
+    let found = null;
+    for (;;) {
+        if (existsSync(join(dir, "pyproject.toml")) || existsSync(join(dir, "setup.py")) || existsSync(join(dir, "setup.cfg"))) {
+            found = dir;
+            break;
+        }
+        if (dir === stop)
+            break;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    if (!found || found === stop)
+        return stop;
+    const testAbs = resolve(sourceRoot, testRel);
+    return testAbs === found || testAbs.startsWith(found + sep) ? found : stop;
+}
 export function opDynamicProof(root, opts, deps = defaultDeps()) {
     const paths = workspacePaths(root);
     const graph = loadGraph(paths.graphPath);
@@ -745,59 +958,199 @@ export function opDynamicProof(root, opts, deps = defaultDeps()) {
         throw new Error("prove requires --target-symbol sym:<file>#<Symbol>, or a target id that resolves to exactly one CodeSymbol.");
     }
     const language = targetLanguage(target);
-    if (language !== "typescript") {
-        throw new Error(`prove currently supports JavaScript/TypeScript targets only; found ${language}.`);
+    if (language !== "typescript" && language !== "go" && language !== "java" && language !== "python") {
+        throw new Error(`prove currently supports JavaScript/TypeScript, Go, Java, and Python targets only; found ${language}.`);
     }
-    if (!opts.test_path)
-        throw new Error("prove requires --test <path>.");
-    if (opts.replacement === undefined)
-        throw new Error("prove requires --replacement <sentinel>.");
     const sourceRoot = resolve(opts.source ?? root);
     assertProofSourceMatchesGraph(sourceRoot, graph);
     const symbolTarget = symbolTargetParts(target);
     const providedTargetRel = opts.target_path ? toWorkspaceRel(sourceRoot, resolveContained(sourceRoot, opts.target_path)) : undefined;
     assertProofTargetMatchesSymbol({ ...opts, target_path: providedTargetRel }, symbolTarget);
-    const testRel = toWorkspaceRel(sourceRoot, resolveContained(sourceRoot, opts.test_path));
     const targetRel = symbolTarget.file;
     const method = symbolTarget.method;
     assertTargetFileFresh(sourceRoot, targetRel, graph);
-    const replacementMode = opts.replacement_mode ?? "return-json";
-    const runner = opts.runner ?? "auto";
-    if (replacementMode !== "return-json" && replacementMode !== "promise-json") {
-        throw new Error("prove --replacement-mode must be one of: return-json, promise-json.");
-    }
-    if (runner !== "auto" && runner !== "vitest" && runner !== "jest" && runner !== "mocha") {
-        throw new Error("prove --runner must be one of: auto, vitest, jest, mocha.");
-    }
-    const args = [
-        "--root",
-        sourceRoot,
-        "--test",
-        testRel,
-        "--target",
-        targetRel,
-        "--method",
-        method,
-        "--replacement",
-        opts.replacement,
-        "--replacement-mode",
-        replacementMode,
-        "--runner",
-        runner,
-        "--json"
-    ];
-    if (opts.timeout_ms !== undefined)
-        args.push("--timeout-ms", String(opts.timeout_ms));
-    if (opts.link_node_modules)
-        args.push("--link-node-modules");
-    if (opts.vitest_config)
-        args.push("--vitest-config", toWorkspaceRel(sourceRoot, resolveContained(sourceRoot, opts.vitest_config)));
-    if (opts.jest_config)
-        args.push("--jest-config", toWorkspaceRel(sourceRoot, resolveContained(sourceRoot, opts.jest_config)));
-    for (const entry of opts.test_env ?? [])
-        args.push("--test-env", entry);
-    const run = (deps.dynamicProofRunner ?? defaultDynamicProofRunner)(args, { cwd: sourceRoot });
-    const oracle = parseDynamicProofJson(run.stdout, run.stderr);
+    // Per-language routing produces the spike args + a mapped oracle in the SAME
+    // DynamicProofOracleSummary shape. Everything from `closed` onward (the trust gate,
+    // the cert, appendLedgerRecord, the return summary) is language-agnostic and unchanged.
+    let oracle;
+    let proofModuleRoot;
+    let testRel;
+    let replacementMode;
+    let runner;
+    if (language === "go") {
+        // Go selects the target test by NAME (`go test -run ^TestX$`), derives its own
+        // zero-value sentinel, and always uses `go test`. No --replacement/--runner/
+        // --vitest-config/--jest-config/--test-env/--link-node-modules apply.
+        if (!opts.test_run)
+            throw new Error("prove requires --test-run '^TestName$' for Go targets.");
+        if (!/^\^.+\$$/.test(opts.test_run)) {
+            throw new Error("prove --test-run must be a fully-anchored test name, e.g. '^TestName$'.");
+        }
+        const goRoot = goModuleRoot(sourceRoot, targetRel, root);
+        if (goRoot !== resolve(sourceRoot)) {
+            proofModuleRoot = goRoot;
+            reportProgress(`proof scope: Go module root ${goRoot} (above the analyzed path)`);
+        }
+        const args = [
+            "--root",
+            goRoot,
+            "--target",
+            relative(goRoot, resolve(sourceRoot, targetRel)).split(sep).join("/"),
+            "--func",
+            method,
+            "--test-run",
+            opts.test_run,
+            "--json"
+        ];
+        if (opts.timeout_ms !== undefined)
+            args.push("--timeout-ms", String(opts.timeout_ms));
+        // Slice 2: bind a runtime-named subtest's mutant failure to the exact assertion line.
+        if (opts.go_assertion_line !== undefined)
+            args.push("--go-assertion-line", String(opts.go_assertion_line));
+        const run = (deps.dynamicProofRunner ?? defaultDynamicProofRunner)(args, {
+            cwd: goRoot,
+            scriptPath: dynamicProofSpikePathFor("go")
+        });
+        oracle = mapGoOracle(parseDynamicProofJson(run.stdout, run.stderr));
+        testRel = opts.test_run;
+        replacementMode = GO_SENTINEL_LABEL;
+        runner = "go";
+    }
+    else if (language === "java") {
+        // Java selects the target test by class#method (`mvn test -Dtest=Class#method`),
+        // derives its own type-compatible sentinel from the return type, and always uses
+        // Surefire. The single `test_run` field carries `Class#method` (FQCN or simple
+        // class both accepted by the spike). No --replacement/--runner/--vitest-config/
+        // --jest-config/--test-env/--link-node-modules apply.
+        if (!opts.test_run)
+            throw new Error("prove requires --test-run 'TestClass#testMethod' for Java targets.");
+        const hash = opts.test_run.lastIndexOf("#");
+        if (hash <= 0 || hash === opts.test_run.length - 1) {
+            throw new Error("prove --test-run must be 'TestClass#testMethod' for Java targets, e.g. 'CalculatorTest#addsTwoNumbers'.");
+        }
+        const testClass = opts.test_run.slice(0, hash);
+        const testMethod = opts.test_run.slice(hash + 1);
+        const javaRoot = javaModuleRoot(sourceRoot, targetRel, root);
+        if (javaRoot !== resolve(sourceRoot)) {
+            proofModuleRoot = javaRoot;
+            reportProgress(`proof scope: Java module root ${javaRoot} (above the analyzed path)`);
+        }
+        const args = [
+            "--root",
+            javaRoot,
+            "--test-class",
+            testClass,
+            "--test-method",
+            testMethod,
+            "--target",
+            relative(javaRoot, resolve(sourceRoot, targetRel)).split(sep).join("/"),
+            "--method",
+            method,
+            "--json"
+        ];
+        if (opts.timeout_ms !== undefined)
+            args.push("--timeout-ms", String(opts.timeout_ms));
+        const run = (deps.dynamicProofRunner ?? defaultDynamicProofRunner)(args, {
+            cwd: javaRoot,
+            scriptPath: dynamicProofSpikePathFor("java")
+        });
+        oracle = mapJavaOracle(parseDynamicProofJson(run.stdout, run.stderr));
+        testRel = opts.test_run;
+        replacementMode = JAVA_SENTINEL_LABEL;
+        runner = "junit";
+    }
+    else if (language === "python") {
+        if (!opts.test_path)
+            throw new Error("prove requires --test <path>.");
+        if (opts.replacement === undefined)
+            throw new Error("prove requires --replacement <sentinel>.");
+        testRel = toWorkspaceRel(sourceRoot, resolveContained(sourceRoot, opts.test_path));
+        replacementMode = opts.replacement_mode ?? "return-json";
+        runner = opts.runner ?? "auto";
+        if (replacementMode !== "return-json") {
+            throw new Error("prove --replacement-mode promise-json is not supported for Python targets.");
+        }
+        if (runner !== "auto" && runner !== "pytest") {
+            throw new Error("prove Python targets require --runner auto or --runner pytest.");
+        }
+        if ((opts.test_env?.length ?? 0) > 0) {
+            throw new Error("prove --test-env is not supported for Python targets yet.");
+        }
+        // G2: narrow the copied sandbox to the owning Python project when both the
+        // target and the test live inside it (bounded copy — no full-repo OOM).
+        const pyRoot = pythonModuleRoot(sourceRoot, targetRel, testRel);
+        if (pyRoot !== resolve(sourceRoot)) {
+            proofModuleRoot = pyRoot;
+            reportProgress(`proof scope: Python project root ${pyRoot} (narrowed from the analyzed path)`);
+        }
+        const args = [
+            "--root",
+            pyRoot,
+            "--test",
+            relative(pyRoot, resolve(sourceRoot, testRel)).split(sep).join("/"),
+            "--target",
+            relative(pyRoot, resolve(sourceRoot, targetRel)).split(sep).join("/"),
+            "--func",
+            method,
+            "--mode",
+            "sentinel",
+            "--json"
+        ];
+        if (opts.timeout_ms !== undefined)
+            args.push("--timeout-ms", String(opts.timeout_ms));
+        const run = (deps.dynamicProofRunner ?? defaultDynamicProofRunner)(args, {
+            cwd: pyRoot,
+            scriptPath: dynamicProofSpikePathFor("python")
+        });
+        oracle = parseDynamicProofJson(run.stdout, run.stderr);
+    }
+    else {
+        if (!opts.test_path)
+            throw new Error("prove requires --test <path>.");
+        if (opts.replacement === undefined)
+            throw new Error("prove requires --replacement <sentinel>.");
+        testRel = toWorkspaceRel(sourceRoot, resolveContained(sourceRoot, opts.test_path));
+        replacementMode = opts.replacement_mode ?? "return-json";
+        runner = opts.runner ?? "auto";
+        if (replacementMode !== "return-json" && replacementMode !== "promise-json") {
+            throw new Error("prove --replacement-mode must be one of: return-json, promise-json.");
+        }
+        if (runner === "pytest") {
+            throw new Error("prove --runner pytest requires a Python target.");
+        }
+        if (runner !== "auto" && runner !== "vitest" && runner !== "jest" && runner !== "mocha") {
+            throw new Error("prove --runner must be one of: auto, vitest, jest, mocha.");
+        }
+        const args = [
+            "--root",
+            sourceRoot,
+            "--test",
+            testRel,
+            "--target",
+            targetRel,
+            "--method",
+            method,
+            "--replacement",
+            opts.replacement,
+            "--replacement-mode",
+            replacementMode,
+            "--runner",
+            runner,
+            "--json"
+        ];
+        if (opts.timeout_ms !== undefined)
+            args.push("--timeout-ms", String(opts.timeout_ms));
+        if (opts.link_node_modules)
+            args.push("--link-node-modules");
+        if (opts.vitest_config)
+            args.push("--vitest-config", toWorkspaceRel(sourceRoot, resolveContained(sourceRoot, opts.vitest_config)));
+        if (opts.jest_config)
+            args.push("--jest-config", toWorkspaceRel(sourceRoot, resolveContained(sourceRoot, opts.jest_config)));
+        for (const entry of opts.test_env ?? [])
+            args.push("--test-env", entry);
+        const run = (deps.dynamicProofRunner ?? defaultDynamicProofRunner)(args, { cwd: sourceRoot });
+        oracle = parseDynamicProofJson(run.stdout, run.stderr);
+    }
     const closed = dynamicProofSucceeded(oracle);
     const baselineGreen = oracle.baseline?.exitCode === 0 && oracle.baseline?.timedOut !== true;
     const mutantFailedAssertion = oracle.mutant?.assertionFailure === true && oracle.mutant?.timedOut !== true;
@@ -830,6 +1183,7 @@ export function opDynamicProof(root, opts, deps = defaultDeps()) {
     });
     return {
         ...result,
+        ...(proofModuleRoot ? { module_root: proofModuleRoot } : {}),
         oracle: {
             status: oracle.status,
             proven: oracle.proven,
@@ -927,8 +1281,8 @@ export function opProveLoop(root, opts, deps = defaultDeps()) {
         throw new Error("prove requires --target-symbol sym:<file>#<Symbol>, or a target id that resolves to exactly one CodeSymbol.");
     }
     const language = targetLanguage(target);
-    if (language !== "typescript") {
-        throw new Error(`prove currently supports JavaScript/TypeScript targets only; found ${language}.`);
+    if (language !== "typescript" && language !== "go" && language !== "java" && language !== "python") {
+        throw new Error(`prove currently supports JavaScript/TypeScript, Go, Java, and Python targets only; found ${language}.`);
     }
     const setupCommands = (opts.setup_commands ?? []).map((command, index) => validateSetupCommand(command, index));
     const sourceRoot = resolve(opts.source ?? root);
@@ -947,6 +1301,8 @@ export function opProveLoop(root, opts, deps = defaultDeps()) {
         target_id: opts.target_id,
         source: opts.source,
         test_path: opts.test_path,
+        test_run: opts.test_run,
+        go_assertion_line: opts.go_assertion_line,
         target_path: opts.target_path,
         method: opts.method,
         replacement: opts.replacement,
@@ -1183,6 +1539,7 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
             noAuto: opts.noAuto,
             provider: providerOpts.provider,
             model: providerOpts.model,
+            prompt_version: opts.promptVersion,
             changedFiles: autoProveChangedScope(loadGraph(workspacePaths(root).graphPath), changed, opts.baseRef)
         }, { ...providerDeps, proveLoop: opProveLoop });
         for (const skip of autoProveResult.skipped)
@@ -1203,6 +1560,19 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
         };
         warnings.push(`auto-prove skipped: ${reason}`);
     }
+    // G1: persist the distilled, already-redacted attempt classifications so
+    // `opro doctor --proof` and standalone report regens can explain blockers
+    // after this process exits. Sidecar only — never read by the oracle, RTM,
+    // or ledger paths; a write failure must never fail start.
+    try {
+        writeProofAttempts(root, distillProofAttempts(autoProveResult, {
+            generatedAt: deps.clock(),
+            graph: loadGraph(workspacePaths(root).graphPath)
+        }));
+    }
+    catch (error) {
+        warnings.push(`proof-attempts sidecar not written: ${error instanceof Error ? error.message : String(error)}`);
+    }
     let coverageReport;
     try {
         reportProgress("artifacts: writing coverage report", { current: 6, total: 8 });
@@ -1274,10 +1644,10 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
     if (rtm.rows.length < rtm.summary.total)
         nextActions.push("For full machine-readable RTM, run `opro rtm --format json --out .orangepro/rtm-full.json`; avoid opening full Markdown on very large repos.");
     if (changed.status === "ok" && changed.affected_behaviors.length > 0) {
-        nextActions.push(`In your coding agent, call orangepro_generate_tests with base_ref=${changed.base_ref}; write runnable tests, then follow each returned handoff: use prove_run when present for public Proven, otherwise record_run for static diagnostics.`);
+        nextActions.push(`In your coding agent, call orangepro_generate_tests with base_ref=${changed.base_ref}; write runnable tests, then follow each returned handoff: call orangepro_prove with returned prove_run args when present for public Proven, otherwise record_run is static diagnostics only.`);
     }
     else if (gaps.gaps.length > 0) {
-        nextActions.push(`In your coding agent, call orangepro_generate_tests for ${gaps.gaps[0].external_id}; write runnable tests, then follow each returned handoff: use prove_run when present for public Proven, otherwise record_run for static diagnostics.`);
+        nextActions.push(`In your coding agent, call orangepro_generate_tests for ${gaps.gaps[0].external_id}; write runnable tests, then follow each returned handoff: call orangepro_prove with returned prove_run args when present for public Proven, otherwise record_run is static diagnostics only.`);
     }
     else {
         nextActions.push("No deterministic gap target was found; inspect the RTM and graph before generating tests.");
@@ -1365,6 +1735,16 @@ export async function opGenerate(root, opts = {}, deps = defaultDeps()) {
             updated_at: deps.clock()
         };
         saveGraph(paths.graphPath, next);
+        // Keep the behavior report in sync with the freshly persisted generated
+        // tests — analyze/start would REBUILD the graph and drop them, so this is
+        // the only command that can surface them. Display-only refresh; a render
+        // failure must never fail generate.
+        try {
+            opBehaviorCoverageHtml(root, `${WORKSPACE_DIR}/behavior-coverage.html`);
+        }
+        catch {
+            /* best-effort report refresh */
+        }
     }
     // Validate each test's grounding citations against the graph the tests cite.
     // This is the keyless grounding contract: provenance must be verifiable, and a
@@ -1553,11 +1933,33 @@ export function opGraphHtml(root, outputPath = "orangepro-graph.html") {
 /** Write the self-contained offline behavior-coverage view (deterministic, metadata only). */
 export function opBehaviorCoverageHtml(root, outputPath = "orangepro-behavior-coverage.html", dynamicProof) {
     const graph = loadGraph(workspacePaths(root).graphPath);
-    const html = renderBehaviorReport(buildBehaviorReportData(graph, loadLedger(root), { repoRoot: root, dynamicProof }));
+    // Standalone regens have no this-run outcome: fall back to the persisted
+    // proof-attempts sidecar ONLY when it anchors to the current graph+commit
+    // (stale evidence is dropped — fail closed; display copy only, no tier math).
+    const dyn = dynamicProof ?? sidecarDynamicProof(root, graph);
+    const html = renderBehaviorReport(buildBehaviorReportData(graph, loadLedger(root), { repoRoot: root, dynamicProof: dyn }));
     const htmlPath = resolve(root, outputPath);
     writeFileSync(htmlPath, html, "utf8");
     return { behavior_coverage_path: htmlPath };
 }
+/** Fresh-only sidecar view for report regens; unreadable or stale ⇒ undefined. */
+function sidecarDynamicProof(root, graph) {
+    try {
+        const attempts = loadProofAttempts(root);
+        if (!attempts || !proofAttemptsFresh(attempts, graph))
+            return undefined;
+        return {
+            attempted: attempts.attempted,
+            proven: attempts.proven,
+            needsSetup: attempts.attempts
+                .filter((a) => a.classification === "needs_setup")
+                .map((a) => ({ category: a.category, reason: a.reason }))
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
 /** Phase 5.2 — write the human-readable COVERAGE_REPORT.md (3-file contract). */
 export function opCoverageReport(root, outputPath = "COVERAGE_REPORT.md") {
     const graph = loadGraph(workspacePaths(root).graphPath);
@@ -1663,7 +2065,7 @@ const NO_CODE_CHANGES_GUIDANCE = "The diff vs the base ref only touched docs (.m
  * `base_ref` defaults to `main`. The diff runs from `git merge-base <base> HEAD`
  * to the working tree: the branch's own commits AND uncommitted edits, never
  * upstream churn on the base (falls back to the base tip when no merge-base
- * exists). Read-only: no repo writes, no source upload.
+ * exists). This diff resolver is read-only: it does not write repo files or upload source.
  */
 export function resolveDiffContext(graph, baseRefInput) {
     const scanRoot = graph.workspace.root;

package/dist/local/pack/coverageReport.js

@@ -3,8 +3,8 @@ import { resolveCoverage } from "../score/coverage.js";
 import { rankRiskGaps } from "../score/risk.js";
 import { buildRtm } from "../rtm.js";
 /**
- * Phase 5.2 — `COVERAGE_REPORT.md`, the human-readable third file of the
- * 3-file contract (graph.html / COVERAGE_REPORT.md / graph.json). It states,
+ * Phase 5.2 — `COVERAGE_REPORT.md`, the human-readable summary beside
+ * `behavior-coverage.html`, `graph.json`, and optional graph export. It states,
  * auditably and in one place:
  *  - dynamic Proven % over the DENOMINATOR behaviors;
  *  - what the denominator is made of (Gate 3 composition line);
@@ -36,7 +36,7 @@ export function renderCoverageReport(graph, ledger = emptyLedger()) {
     lines.push(`_Graph schema: ${graph.schema_version}_`);
     lines.push(`_Generated: ${graph.updated_at || graph.created_at || "(unknown)"}_`);
     lines.push("");
-    // ---- Public Proven + denominator: ONE atomic pair (shared with graph.html) ----
+    // ---- Public Proven + denominator: ONE atomic pair (shared with report views) ----
     const { coverage: staticCov, denominator: comp } = resolveCoverage(graph);
     const rtm = buildRtm(graph, ledger);
     const s = rtm.summary;