@orangepro/orangepro-mcp 0.1.0

package/dist/local/autoProve.js

@@ -0,0 +1,620 @@
+/**
+ * Auto-prove orchestration for `opro start` (PR 1 of the auto-drive-to-proven spec).
+ *
+ * ORCHESTRATION ONLY — this file mints no proof. After analyze, when a provider key
+ * exists and the user did not opt out, it: selects the top provable TS/JS CodeSymbol
+ * targets (ORS-ranked), generates a runnable test per target via the EXISTING
+ * `generateTests`, writes it under `orangepro_generated/`, and runs it through the
+ * UNCHANGED `opProveLoop`/dynamic-proof oracle. Proven is minted only by that oracle;
+ * a static / non-killing / generation-failed / setup-failed test is an honest skip and
+ * NEVER becomes Proven. A later failed attempt cannot clobber a prior Proven (the #162
+ * fingerprint-scoped RTM selection guarantees this — this file does not defeat it).
+ *
+ * No key ⇒ writes NO files, mints NO proof, returns explicit guidance.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { basename, dirname, posix, resolve, sep } from "node:path";
+import { generateTests, readDeclaredDeps, unresolvedLocalImports } from "./generate/generator.js";
+import { GENERATED_DIR, runHintsFor } from "./generate/runHints.js";
+import { rankRiskGaps } from "./score/risk.js";
+import { resolveProviderConfig } from "./localConfig.js";
+import { buildProvider } from "./generate/providers.js";
+import { resolveContained } from "./reprove/paths.js";
+import { buildRtm } from "./rtm.js";
+import { loadLedger } from "./ledger.js";
+import { loadGraph, workspacePaths } from "./workspace.js";
+import { systemClock } from "./util/time.js";
+import { redactSecrets } from "./util/redact.js";
+import { classifyBaselineFailure, EXPERIMENTAL_SQLITE_TEST_ENV, IMPORT_TIME_CATEGORIES, isNeedsSetupCategory, readEnginesNode, targetNeedsExperimentalSqlite } from "./proofRunnability.js";
+/** Real dynamic proof is TS/JS-only; only these targets are attemptable. */
+function isTsJsFile(file) {
+    return /\.[cm]?[jt]sx?$/i.test(file);
+}
+/**
+ * SOLE trust barrier for auto-prove target selection. `opDynamicProof` has NO
+ * eligibility guard — `resolveTargetSymbol` resolves ANY CodeSymbol and the prove
+ * path never reads eligibility — so handing it an excluded infra symbol would mint
+ * Proven against plumbing. Auto-prove must therefore refuse anything that is not an
+ * entry-point-adjacent behavior surface: eligible (top-level `denominator_eligible`),
+ * `behavior_surface === "entrypoint_adjacent"`, and carrying NO `denominator_reason_code`
+ * (infra_behavior_surface / not_entry_point_adjacent). TS/JS file, always.
+ */
+export function isEligibleProvableTarget(node) {
+    if (!node || node.kind !== "CodeSymbol")
+        return false;
+    if (node.denominator_eligible !== true)
+        return false;
+    if (node.properties.behavior_surface !== "entrypoint_adjacent")
+        return false;
+    if (node.properties.denominator_reason_code != null)
+        return false;
+    const file = typeof node.properties.file === "string" ? node.properties.file : node.external_id.replace(/^sym:/, "").split("#")[0];
+    return isTsJsFile(file);
+}
+const GENERATED_HEADER = "// Generated by OrangePro — do not edit";
+// "Static map first, dynamically prove top 5": ONE unified dynamic-proof budget spans
+// BOTH lanes (existing-tests first, then generation for the remaining eligible gaps).
+// TOTAL attempts (existing + generation) are capped at this budget; `--auto-limit N`
+// overrides it (clamped to MAX_AUTO_LIMIT) for deeper runs (`opro start --auto-limit 25`,
+// `opro prove`, `opro prove-loop`). Static breadth (behaviors/flows/associated/risk) is
+// never gated on this budget — only the dynamic verification pass is.
+const DEFAULT_AUTO_LIMIT = 5;
+const MAX_AUTO_LIMIT = 50;
+/** Generator caps a single call at 5 (MAX_LIMIT); page candidates in windows of that. */
+const GEN_WINDOW = 5;
+// ponytail: cap the weak MAY_*/MAY_RELATE_TO fan-out a single symbol contributes so one hot
+// file (every eligible symbol × every importing test) cannot starve the shared budget before
+// a provable hard-edge symbol is tried. Small K; promote to a flag if a repo needs a wider sweep.
+const EXISTING_LANE_MAX_WEAK_PER_SYMBOL = 3;
+export const NO_KEY_MESSAGE = "No provider key; auto-prove skipped — add OPENAI_API_KEY / ANTHROPIC_API_KEY, or use the OrangePro MCP in your coding agent.";
+/**
+ * Resolve the contained absolute path for a generated file, REJECTING any name that
+ * escapes `<sourceRoot>/orangepro_generated/`. Exported so the guardrail is unit-tested.
+ */
+export function containedGeneratedPath(sourceRoot, filename) {
+    const dir = resolve(sourceRoot, GENERATED_DIR);
+    return resolveContained(dir, filename);
+}
+/** The source file a `sym:` target lives in (workspace-relative). */
+function symbolFile(target) {
+    return target.slice("sym:".length).split("#")[0] ?? "";
+}
+/** Relative import specifiers (`./x`, `../x`) in import/export/require/dynamic-import positions. */
+const REL_IMPORT_RE = /(\bfrom\s*|\bimport\s*|\brequire\s*\(\s*|\bimport\s*\(\s*)(['"])(\.\.?\/[^'"]*)\2/g;
+/**
+ * Re-point a generated test's RELATIVE imports so they resolve from
+ * `orangepro_generated/`. The generator grounds imports against the SOURCE dir (the
+ * model co-locates the test with the module under test, e.g. `./order.service`), but
+ * autoProve writes the test to `orangepro_generated/`. Resolve each `./x` / `../x`
+ * against the target source file's directory, then re-express it relative to
+ * `orangepro_generated/` (POSIX, leading `./`) — e.g. `./order.service` →
+ * `../src/order.service`. Only import/require positions are touched, never plain
+ * string literals. TS/JS only (dynamic proof is TS/JS-only).
+ */
+function rewriteRelativeImports(body, targetFileRel, generatedDir) {
+    const baseDir = posix.dirname(targetFileRel.split(sep).join("/"));
+    return body.replace(REL_IMPORT_RE, (_m, prefix, quote, spec) => {
+        const abs = posix.normalize(posix.join(baseDir === "." ? "" : baseDir, spec));
+        let rel = posix.relative(generatedDir, abs);
+        if (!rel.startsWith("."))
+            rel = `./${rel}`;
+        return `${prefix}${quote}${rel}${quote}`;
+    });
+}
+function fileReaderFor(root) {
+    const absRoot = resolve(root);
+    return (relPath) => {
+        const abs = resolve(absRoot, relPath);
+        if (abs !== absRoot && !abs.startsWith(absRoot + sep))
+            return null;
+        try {
+            return readFileSync(abs, "utf8");
+        }
+        catch {
+            return null;
+        }
+    };
+}
+/**
+ * R-1: classify a prove-loop result. A RED baseline is classified from the oracle's
+ * already-redacted `baseline.failureSummary` (+ the target's declared engines.node vs the
+ * runner Node) into a SPECIFIC reason. logic_failure is a genuine failing test on the real
+ * code → an honest non-proof, NEVER needs_setup. No proof is minted here.
+ */
+function classifyProof(result, ctx) {
+    if ("status" in result && result.status === "unrunnable") {
+        // Setup did not run (env non-event) — nothing was minted, target needs setup.
+        return { classification: "needs_setup", reason: result.reason };
+    }
+    const dyn = result;
+    const record = dyn.record;
+    if (record.closed)
+        return { classification: "proven" };
+    const cert = record.dynamic_proof;
+    if (cert && cert.baseline_green === false) {
+        const { category, reason } = classifyBaselineFailure({
+            failureSummary: dyn.oracle.baseline?.failureSummary,
+            enginesNode: readEnginesNode(ctx.sourceRoot, ctx.targetFileRel),
+            runnerNode: ctx.runnerNode ?? process.version
+        });
+        const classification = isNeedsSetupCategory(category) ? "needs_setup" : "non_killing";
+        return { classification, reason: redactSecrets(reason), category };
+    }
+    return { classification: "non_killing", reason: record.reason ?? "Mutant survived; the test does not assert on the target's real behavior." };
+}
+/**
+ * R-1 sibling-dedup key: a baseline-red import-time failure is a deterministic property of
+ * loading the TARGET FILE with a given runner, independent of which test runs it — so
+ * same-file siblings share it. Keyed on the TARGET FILE only (every caller pins runner to
+ * undefined): the sole deduped cause is engine_mismatch, a package-level fact both lanes
+ * classify against the SAME process.version, so the runner must not be in the key. The old
+ * {runner, target file} key split the cache across lanes (lane 1 wrote "auto <file>", the
+ * generation lane read "<runner> <file>" -> never matched), silently disabling cross-lane
+ * dedup. NEVER merges across different files or a different failure class.
+ */
+function dedupKey(runner, targetFileRel) {
+    return `${runner ?? "auto"}\u0000${targetFileRel}`;
+}
+/** A same-file sibling deduped WITHOUT re-running: shares the first attempt's redacted reason. */
+function dedupedAttempt(targetSymbol, testPath, targetFileRel, blocked) {
+    return {
+        target_symbol: targetSymbol,
+        test_path: testPath,
+        classification: "needs_setup",
+        reason: `${blocked.reason} (shared root cause with a sibling in ${targetFileRel}; not re-run).`,
+        category: blocked.category,
+        deduped: true
+    };
+}
+/**
+ * R-2: the exact experimental-builtin env profile for a target that references node:sqlite,
+ * else undefined. Auto-applied only on a confident source reference; forwarded through the
+ * EXISTING test_env path (opProveLoop → oracle --test-env, spike-allowlisted). It only makes
+ * the baseline RUNNABLE — never asserts, mocks, or mints Proven. Ambient NODE_OPTIONS is never
+ * forwarded (this is an explicit fixed flag, not process.env).
+ */
+function experimentalSqliteTestEnv(reader, targetFileRel) {
+    if (!targetNeedsExperimentalSqlite(reader, targetFileRel))
+        return undefined;
+    // Only inject where the runner Node actually accepts the flag in NODE_OPTIONS. On Node < 22.5 the
+    // flag is rejected outright ("--experimental-sqlite is not allowed in NODE_OPTIONS", exit 9), which
+    // would make the baseline unrunnable for a spurious reason; there node:sqlite is unavailable anyway,
+    // so we skip injection and let R-1 classify it honestly as an experimental-builtin needs_setup.
+    // The oracle spawns the runner with this same Node (process.execPath), so this check is authoritative.
+    if (!process.allowedNodeEnvironmentFlags.has("--experimental-sqlite"))
+        return undefined;
+    return [EXPERIMENTAL_SQLITE_TEST_ENV];
+}
+const zeroSummary = (status, ran, reason) => ({
+    ran,
+    status,
+    reason,
+    attempted: 0,
+    proven: 0,
+    needs_setup: [],
+    skipped: [],
+    generated_files: [],
+    attempts: []
+});
+function symbolFileOf(node) {
+    return typeof node.properties.file === "string" ? node.properties.file : node.external_id.replace(/^sym:/, "").split("#")[0];
+}
+/**
+ * Map each ELIGIBLE CodeSymbol to the existing test files statically linked to it — the
+ * repo's OWN tests. Sources are exactly the edges RTM/coverage read for the "Associated"
+ * tier:
+ *   - hard TESTED_BY/COVERS edges (the confirmer's sym↔TestCase links, `graph.edges`);
+ *   - weak MAY_BE_TESTED_BY/MAY_COVER candidate edges (sym↔TestCase, `graph.candidate_edges`);
+ *   - weak MAY_RELATE_TO candidate edges (a test file resolved-imports a source FILE) —
+ *     the broadest signal, mapped to every eligible symbol in that source file.
+ * The static edge only SELECTS a target+test pair for the oracle — it is never itself proof,
+ * and a symbol the test does not actually exercise simply survives the mutant (honest skip).
+ * AI-suggested candidate edges are excluded (a model guess is not an existing test).
+ */
+export function existingAssociatedTests(graph, nodeById) {
+    const out = new Map();
+    const testFileOf = (id) => {
+        const n = nodeById.get(id);
+        if (!n || n.kind !== "TestCase")
+            return null;
+        return typeof n.properties.file === "string" ? n.properties.file : id.replace(/^test:/, "");
+    };
+    // `hard` = TESTED_BY/COVERS (the confirmer's structural links); weak = MAY_* candidate
+    // edges. Hard is recorded before weak (graph.edges scanned first), so a test already
+    // linked hard is never downgraded; a later weak dup only upgrades an existing weak to hard.
+    const add = (symId, testRel, hard) => {
+        if (!isEligibleProvableTarget(nodeById.get(symId)))
+            return;
+        const list = out.get(symId);
+        if (!list) {
+            out.set(symId, [{ test: testRel, hard }]);
+            return;
+        }
+        const existing = list.find((t) => t.test === testRel);
+        if (existing) {
+            if (hard)
+                existing.hard = true;
+            return;
+        }
+        list.push({ test: testRel, hard });
+    };
+    // A sym↔test edge joins one TestCase endpoint to one CodeSymbol endpoint; resolve
+    // whichever side is the symbol so both edge directions are handled uniformly.
+    const link = (a, b, hard) => {
+        const tb = testFileOf(b);
+        if (tb && nodeById.get(a)?.kind === "CodeSymbol")
+            return add(a, tb, hard);
+        const ta = testFileOf(a);
+        if (ta && nodeById.get(b)?.kind === "CodeSymbol")
+            add(b, ta, hard);
+    };
+    // Eligible symbols grouped by source file, for the file-level MAY_RELATE_TO expansion.
+    const eligibleByFile = new Map();
+    for (const n of graph.nodes) {
+        if (!isEligibleProvableTarget(n))
+            continue;
+        const f = symbolFileOf(n);
+        const list = eligibleByFile.get(f);
+        if (list)
+            list.push(n.external_id);
+        else
+            eligibleByFile.set(f, [n.external_id]);
+    }
+    // MAY_RELATE_TO endpoints are plain workspace-relative file paths; a test file's node id
+    // is `test:${relPath}`. Return the test relPath for whichever endpoint is a TestCase file.
+    const testRelForFile = (relPath) => {
+        const n = nodeById.get(`test:${relPath}`);
+        return n && n.kind === "TestCase" ? relPath : null;
+    };
+    for (const e of graph.edges) {
+        if (e.relationship_type === "TESTED_BY" || e.relationship_type === "COVERS")
+            link(e.from_external_id, e.to_external_id, true);
+    }
+    for (const e of graph.candidate_edges ?? []) {
+        if (e.review_status === "ai_suggested")
+            continue;
+        if (e.relationship_type === "MAY_BE_TESTED_BY" || e.relationship_type === "MAY_COVER") {
+            link(e.from_external_id, e.to_external_id, false);
+        }
+        else if (e.relationship_type === "MAY_RELATE_TO") {
+            const fromTest = testRelForFile(e.from_external_id);
+            const testRel = fromTest ?? testRelForFile(e.to_external_id);
+            const sourceRel = fromTest ? e.to_external_id : e.from_external_id;
+            if (testRel)
+                for (const symId of eligibleByFile.get(sourceRel) ?? [])
+                    add(symId, testRel, false);
+        }
+    }
+    return out;
+}
+/**
+ * Fix 3 — deterministic hard-first, weak-capped attempt order. Every hard TESTED_BY/COVERS
+ * pair precedes ANY weak MAY_* pair (a provable hard-edge symbol is tried before weak fan-out
+ * burns the shared budget), and each symbol contributes at most `maxWeakPerSymbol` weak pairs
+ * so one hot MAY_RELATE_TO file (its every eligible symbol × every importing test) can't starve
+ * the budget. Order within each tier follows the Map's insertion order (graph node/edge order),
+ * so the result is deterministic.
+ */
+export function orderExistingAttempts(testsBySymbol, maxWeakPerSymbol = EXISTING_LANE_MAX_WEAK_PER_SYMBOL) {
+    const hard = [];
+    const weak = [];
+    for (const [symId, tests] of testsBySymbol) {
+        let weakCount = 0;
+        for (const t of tests) {
+            if (t.hard)
+                hard.push({ symId, testRel: t.test, hard: true });
+            else if (weakCount++ < maxWeakPerSymbol)
+                weak.push({ symId, testRel: t.test, hard: false });
+        }
+    }
+    return [...hard, ...weak];
+}
+/**
+ * PR 1.5 lane — prove the repo's OWN existing tests, NO provider key. For each eligible
+ * target with an existing associated test, run the UNCHANGED `opProveLoop` with the test
+ * IN ITS ORIGINAL LOCATION (never copied/relocated — that avoids the generation lane's
+ * import-grounding pitfall) and a null-sentinel mutant. Closes → Proven; survives /
+ * crashes-pre-assert / setup-fails → honest skip (never Proven, and #162 best-ever
+ * selection means it can never clobber a prior Proven). Consumes from the SHARED unified
+ * budget (`budget`) — the generation lane gets whatever this lane leaves unspent, so
+ * TOTAL attempts (existing + generation) never exceed the budget.
+ */
+function proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, proveLoop, proveDeps, alreadyProven, importTimeBlocked, budget) {
+    const attempts = [];
+    const needsSetup = [];
+    const provenSymbols = new Set();
+    let proven = 0;
+    let attempted = 0;
+    const changed = opts.changedFiles && opts.changedFiles.length > 0 ? new Set(opts.changedFiles) : null;
+    const reader = fileReaderFor(sourceRoot); // R-2: source scan for the node:sqlite env profile
+    // Fix 3: hard TESTED_BY/COVERS pairs first, weak MAY_* pairs after and capped per symbol.
+    const queue = orderExistingAttempts(existingAssociatedTests(graph, nodeById));
+    for (const { symId, testRel } of queue) {
+        if (attempted >= budget)
+            break;
+        const node = nodeById.get(symId);
+        // Redundant with existingAssociatedTests' own filter, but the eligibility barrier is
+        // the sole guard against handing plumbing to the guard-less prove path — assert it here too.
+        if (!isEligibleProvableTarget(node))
+            continue;
+        if (changed && !changed.has(symbolFileOf(node)))
+            continue;
+        // Fix 1: already Proven for the CURRENT code (fingerprint match under #162) → skip. Re-closing
+        // it would overstate newly-proven and append a redundant closed cert every run.
+        if (alreadyProven.has(symId))
+            continue;
+        // Proven earlier THIS run — one closing existing test per symbol is enough.
+        if (provenSymbols.has(symId))
+            continue;
+        const targetFileRel = symbolFileOf(node);
+        // R-1 sibling dedup: a prior same-file attempt hit a package-level env root cause
+        // (engine_mismatch: runner Node outside the declared engines range). Every sibling in this
+        // file fails baseline identically → mark it
+        // needs_setup WITHOUT re-running (and WITHOUT consuming the attempt budget).
+        const blocked = importTimeBlocked.get(dedupKey(undefined, targetFileRel));
+        if (blocked) {
+            const attempt = dedupedAttempt(symId, testRel, targetFileRel, blocked);
+            attempts.push(attempt);
+            needsSetup.push(attempt);
+            continue;
+        }
+        attempted++;
+        // R-2: inject NODE_OPTIONS=--experimental-sqlite via the existing test_env path when the
+        // target references node:sqlite. Makes the baseline runnable only; never mints Proven.
+        const testEnv = experimentalSqliteTestEnv(reader, targetFileRel);
+        let result;
+        try {
+            result = proveLoop(root, 
+            // link_node_modules: the isolated proof copy excludes node_modules; without linking,
+            // any target/test importing a repo dependency fails baseline → needs_setup. Linking only
+            // makes real tests runnable — Proven still requires the dynamic oracle's sentinel kill.
+            { target_symbol: symId, source: sourceRoot, test_path: testRel, replacement: "return null;", link_node_modules: true, ...(testEnv ? { test_env: testEnv } : {}), run_id: `auto-prove-existing-${attempted}` }, proveDeps);
+        }
+        catch (e) {
+            const attempt = {
+                target_symbol: symId,
+                test_path: testRel,
+                classification: "needs_setup",
+                reason: `Proof could not run: ${redactSecrets(errMsg(e))}`
+            };
+            attempts.push(attempt);
+            needsSetup.push(attempt);
+            continue;
+        }
+        const { classification, reason, category } = classifyProof(result, { sourceRoot, targetFileRel });
+        const attempt = { target_symbol: symId, test_path: testRel, classification, reason, category };
+        attempts.push(attempt);
+        if (classification === "proven") {
+            proven++;
+            provenSymbols.add(symId); // its remaining queued tests are skipped above
+            continue;
+        }
+        if (classification === "needs_setup") {
+            needsSetup.push(attempt);
+            // Cache an import-time root cause so same-file siblings dedup instead of re-running.
+            if (category && IMPORT_TIME_CATEGORIES.has(category)) {
+                importTimeBlocked.set(dedupKey(undefined, targetFileRel), { category, reason: reason ?? "" });
+            }
+        }
+        // non_killing → keep trying this symbol's other associated tests, if any.
+    }
+    return { attempts, needsSetup, proven, attempted, provenSymbols };
+}
+/**
+ * Drive prove for the top provable TS/JS targets. Two lanes: (1) prove the repo's OWN
+ * existing associated tests — NO key, runs first (PR 1.5); (2) key-gated generate → prove
+ * to fill the remaining gaps (PR 1). The existing oracle is the sole proof judge for both;
+ * generation writes are contained under orangepro_generated/.
+ */
+export async function autoProve(root, opts, deps) {
+    if (opts.noAuto)
+        return zeroSummary("disabled", false, "--no-auto: auto-prove disabled; analyze-only.");
+    const clock = deps.clock ?? systemClock;
+    const proveLoop = deps.proveLoop;
+    const proveDeps = {
+        clock,
+        env: deps.env,
+        dynamicProofRunner: deps.dynamicProofRunner,
+        coverageRunner: deps.coverageRunner,
+        analyze: deps.analyze,
+        aiProvider: deps.aiProvider
+    };
+    const graph = loadGraph(workspacePaths(root).graphPath);
+    const sourceRoot = resolve(graph.workspace.root);
+    const nodeById = new Map(graph.nodes.map((n) => [n.external_id, n]));
+    // Fix 1: symbols already Proven for the CURRENT code. `buildRtm(graph, ledger)` IS the
+    // #162 fingerprint-scoped decision that sets a row's tier to "proven" (via
+    // selectLedgerBySymbol), so we reuse it verbatim rather than re-deriving fingerprints.
+    // Both lanes skip these so res.proven counts only NEWLY-minted proofs this run and no
+    // redundant closed cert is appended. A changed file → different fingerprint → not in
+    // this set → still attempted (re-prove for the new code).
+    const alreadyProven = new Set(buildRtm(graph, loadLedger(root)).rows
+        .filter((r) => r.evidence_tier === "proven")
+        .map((r) => r.code_symbol)
+        .filter(Boolean));
+    // R-1: shared sibling-dedup cache of import-time baseline failures. Spans BOTH lanes so a
+    // node:sqlite-style root cause found once is never re-run across same-file siblings.
+    const importTimeBlocked = new Map();
+    // ONE unified dynamic-proof budget for the whole pass (existing-first → then generation).
+    // Default 5 ("dynamically prove top 5"); `--auto-limit N` overrides it, clamped to
+    // MAX_AUTO_LIMIT. The existing lane consumes from this budget and the generation lane gets
+    // only the remainder, so TOTAL attempts (existing + generation) are ≤ budget.
+    const autoLimit = Math.max(1, Math.min(MAX_AUTO_LIMIT, Math.floor(opts.autoLimit ?? DEFAULT_AUTO_LIMIT)));
+    // ── Lane 1: existing associated tests — NO key required, runs FIRST (PR 1.5). ──
+    const ex = proveExistingAssociatedTests(root, graph, sourceRoot, nodeById, opts, proveLoop, proveDeps, alreadyProven, importTimeBlocked, autoLimit);
+    // Key gate applies ONLY to the generation lane. No provider key ⇒ generation is skipped
+    // (no files, no fake proof) with explicit guidance; the existing-tests lane still counts.
+    const providerConfig = resolveProviderConfig(deps.env, { provider: opts.provider, model: opts.model });
+    if (!providerConfig) {
+        const status = ex.proven > 0 ? "proven-run" : ex.attempted > 0 ? "ran-no-proof" : "skipped-no-key";
+        return {
+            ran: ex.attempted > 0,
+            status,
+            reason: NO_KEY_MESSAGE,
+            attempted: ex.attempted,
+            proven: ex.proven,
+            needs_setup: ex.needsSetup,
+            skipped: [],
+            generated_files: [],
+            attempts: ex.attempts
+        };
+    }
+    const provider = buildProvider(providerConfig);
+    const generate = deps.generate ?? generateTests;
+    const reader = fileReaderFor(sourceRoot);
+    // Generation gets only the budget the existing-tests lane left unspent, so existing +
+    // generation attempts total ≤ autoLimit. Exhausted budget ⇒ genBudget 0 ⇒ no provider call.
+    const genBudget = Math.max(0, autoLimit - ex.attempted);
+    // Candidates = ORS-ranked provable CodeSymbols. rankRiskGaps ranks by OrangePro Risk
+    // Score and excludes hard-confirmed symbols; we ALSO enforce the eligibility barrier
+    // explicitly (isEligibleProvableTarget) at selection so an excluded infra symbol can
+    // NEVER reach the guard-less prove path, and drop any symbol the existing-tests lane
+    // already proved so generation fills only the remaining gaps. PR mode scopes to the
+    // eligible symbols whose file is in the changed set (changed_files → symbols, NOT
+    // affected_behaviors — those are Requirement/UserFlow/BusinessRule ids opDynamicProof
+    // cannot prove).
+    let candidates = rankRiskGaps(graph, { repoRoot: sourceRoot, limit: 500 }).filter((g) => isEligibleProvableTarget(nodeById.get(g.id)) && !ex.provenSymbols.has(g.id) && !alreadyProven.has(g.id));
+    if (opts.changedFiles && opts.changedFiles.length > 0) {
+        const changed = new Set(opts.changedFiles);
+        candidates = candidates.filter((g) => changed.has(g.file));
+    }
+    const attempts = [];
+    const needsSetup = [];
+    const skipped = [];
+    const generatedFiles = [];
+    const declaredDeps = readDeclaredDeps(sourceRoot);
+    let proven = 0;
+    let attempted = 0;
+    for (let start = 0; start < candidates.length && attempted < genBudget; start += GEN_WINDOW) {
+        const window = candidates.slice(start, start + GEN_WINDOW);
+        const need = genBudget - attempted;
+        const windowIds = window.map((g) => g.id);
+        const gen = await generate(graph, { target_ids: windowIds, limit: Math.min(windowIds.length, need) }, provider, reader, clock);
+        const tests = gen.generated_tests;
+        // Global start offset so filenames stay unique across windows — runHintsFor
+        // otherwise resets its index to 0 per window and same-slug targets collide.
+        const hints = runHintsFor(tests, sourceRoot, start);
+        for (let i = 0; i < tests.length && attempted < genBudget; i++) {
+            const test = tests[i];
+            const hint = hints[i];
+            if (!hint.prove_run) {
+                // Non-TS/JS target or no resolvable code symbol → not attemptable.
+                skipped.push({
+                    target_symbol: hint.target_symbol_external_id,
+                    title: test.title,
+                    reason: hint.target_symbol_external_id
+                        ? "Target is not TS/JS; dynamic proof supports TS/JS CodeSymbol targets only."
+                        : "No resolvable TS/JS code-symbol target to prove."
+                });
+                continue;
+            }
+            const { target_symbol, replacement, runner } = hint.prove_run.args;
+            const targetFileRel = symbolFile(target_symbol);
+            // R-1 sibling dedup (cross-lane): a same-file target already hit an import-time env root
+            // cause → a fresh generated test importing the same module fails identically. Skip it
+            // WITHOUT generating/writing/running or consuming the attempt budget.
+            const blocked = importTimeBlocked.get(dedupKey(undefined, targetFileRel));
+            if (blocked) {
+                const attempt = dedupedAttempt(target_symbol, "", targetFileRel, blocked);
+                attempts.push(attempt);
+                needsSetup.push(attempt);
+                continue;
+            }
+            const filename = basename(hint.prove_run.args.test_path);
+            let abs;
+            try {
+                abs = containedGeneratedPath(sourceRoot, filename);
+            }
+            catch (e) {
+                skipped.push({ target_symbol, title: test.title, reason: `Generated path rejected (escapes ${GENERATED_DIR}/): ${redactSecrets(errMsg(e))}` });
+                continue;
+            }
+            const writeRel = `${GENERATED_DIR}/${filename}`;
+            // The generator grounds imports at the source/suggested dir; autoProve writes
+            // to orangepro_generated/. Re-point relative specifiers at the target source
+            // file so they resolve from the write location (`./x` → `../src/x`).
+            const body = rewriteRelativeImports(test.body, symbolFile(target_symbol), GENERATED_DIR);
+            // A "non-runnable" verdict is usually just import LOCATION, which the rewrite
+            // fixes. Re-validate against the ACTUAL write location: skip only if locals
+            // still won't resolve (a genuine setup gap the oracle could never honestly close).
+            if (test.runnable === false && unresolvedLocalImports(body, abs, sourceRoot, declaredDeps).length > 0) {
+                skipped.push({
+                    target_symbol,
+                    title: test.title,
+                    reason: `Generator returned a non-runnable draft${test.unresolved_reason ? `: ${test.unresolved_reason}` : "."}`
+                });
+                continue;
+            }
+            if (existsSync(abs)) {
+                // Guardrail: never overwrite an existing file.
+                skipped.push({ target_symbol, title: test.title, reason: `Existing file ${writeRel} not overwritten.` });
+                continue;
+            }
+            mkdirSync(dirname(abs), { recursive: true });
+            writeFileSync(abs, `${GENERATED_HEADER}\n${body}${body.endsWith("\n") ? "" : "\n"}`, "utf8");
+            generatedFiles.push(writeRel);
+            attempted++;
+            // R-2: inject the node:sqlite env profile when the TARGET source references the builtin.
+            const testEnv = experimentalSqliteTestEnv(reader, targetFileRel);
+            let result;
+            try {
+                result = proveLoop(root, {
+                    target_symbol,
+                    source: sourceRoot,
+                    test_path: writeRel,
+                    replacement,
+                    runner,
+                    // See lane 1: link node_modules so a generated test importing a repo dep can boot.
+                    link_node_modules: true,
+                    ...(testEnv ? { test_env: testEnv } : {}),
+                    run_id: `auto-prove-${start + i + 1}`
+                }, proveDeps);
+            }
+            catch (e) {
+                const attempt = {
+                    target_symbol,
+                    test_path: writeRel,
+                    classification: "needs_setup",
+                    reason: `Proof could not run: ${redactSecrets(errMsg(e))}`
+                };
+                attempts.push(attempt);
+                needsSetup.push(attempt);
+                continue;
+            }
+            const { classification, reason, category } = classifyProof(result, { sourceRoot, targetFileRel });
+            const attempt = { target_symbol, test_path: writeRel, classification, reason, category };
+            attempts.push(attempt);
+            if (classification === "proven")
+                proven++;
+            else if (classification === "needs_setup") {
+                needsSetup.push(attempt);
+                // Cache an import-time root cause so same-file siblings dedup instead of re-running.
+                if (category && IMPORT_TIME_CATEGORIES.has(category)) {
+                    importTimeBlocked.set(dedupKey(undefined, targetFileRel), { category, reason: reason ?? "" });
+                }
+            }
+            // non_killing stays in `attempts` only — an honest skip, never Proven.
+        }
+        // A window that produced nothing (transient generation hiccup) must NOT abandon
+        // lower-ranked candidates: the outer loop already terminates at pool exhaustion
+        // or when the attempt budget (autoLimit) is reached.
+    }
+    // Merge the existing-tests lane (ran first, no key) with the generation lane.
+    const totalProven = ex.proven + proven;
+    const totalAttempted = ex.attempted + attempted;
+    const status = totalProven > 0 ? "proven-run" : totalAttempted > 0 ? "ran-no-proof" : "no-targets";
+    return {
+        ran: true,
+        status,
+        attempted: totalAttempted,
+        proven: totalProven,
+        needs_setup: [...ex.needsSetup, ...needsSetup],
+        skipped,
+        generated_files: generatedFiles,
+        attempts: [...ex.attempts, ...attempts]
+    };
+}
+function errMsg(e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return msg.split("\n", 1)[0] ?? msg;
+}