@orangepro/orangepro-mcp 0.1.0

package/dist/local/generate/runHints.js

@@ -0,0 +1,304 @@
+import { looksJson, testsFileExt } from "./compareReport.js";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+/** Directory (inside the developer's repo) the agent should write generated tests to. */
+export const GENERATED_DIR = "orangepro_generated";
+function slug(s) {
+    return (s
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "_")
+        .replace(/^_+|_+$/g, "")
+        .slice(0, 60) || "test");
+}
+function javaPackage(body) {
+    return body.match(/^\s*package\s+([A-Za-z_][A-Za-z0-9_.]*)\s*;/m)?.[1] ?? null;
+}
+function javaClassName(body, fallback) {
+    return body.match(/\bclass\s+([A-Za-z_][A-Za-z0-9_]*)\b/)?.[1] ?? fallback;
+}
+/** The linked existing test file this generated test was grounded on, if any. */
+function linkedTestRef(test) {
+    for (const r of test.grounding?.source_refs ?? []) {
+        if (/(\.(test|spec)\.[cm]?[jt]sx?$)|((^|\/)test\.[cm]?[jt]sx?$)|(_test\.[a-z]+$)|(_spec\.[a-z]+$)|((^|\/)test_[^/]+\.py$)/.test(r))
+            return r;
+    }
+    return null;
+}
+function isTsJsFramework(framework) {
+    const f = framework.toLowerCase();
+    return f.includes("playwright") || f.includes("cypress") || f.includes("vitest") || f.includes("jest") || f.includes("mocha") || f.includes("ava");
+}
+function linkedTsJsTestExt(linked) {
+    const topLevel = linked.match(/(^|\/)test\.([cm]?[jt]sx?)$/i);
+    if (topLevel)
+        return `test.${topLevel[2]}`;
+    const m = linked.match(/\.(test|spec|cy)\.([cm]?[jt]sx?)$/i);
+    return m ? `${m[1]}.${m[2]}` : null;
+}
+function groundingFileRef(test, ext) {
+    const refs = [...(test.grounding?.source_refs ?? []), ...(test.grounding?.entity_ids ?? [])];
+    for (const ref of refs) {
+        const rel = ref.startsWith("sym:") ? ref.slice("sym:".length).split("#")[0] : ref;
+        if (ext.test(rel))
+            return rel;
+    }
+    return null;
+}
+/**
+ * Suggested path inside the repo for the agent to write this test to.
+ *
+ * Grounded tests reuse the linked existing test's imports, which are often
+ * RELATIVE to that test's directory (`./component`) — and monorepo test configs
+ * resolve module roots per package. So the generated test goes NEXT TO the
+ * linked test (same directory, `orangepro_generated_` prefix). Go is also
+ * package-directory sensitive, so Go tests fall back to the related Go file's
+ * directory rather than a new repo-root subpackage.
+ */
+export function suggestedTestPath(test, index) {
+    const linked = linkedTestRef(test);
+    const ext = (linked && isTsJsFramework(test.framework_hint) && linkedTsJsTestExt(linked)) || testsFileExt(test.framework_hint, [test.body]);
+    const stem = `${String(index + 1).padStart(2, "0")}_${slug(test.title)}`;
+    if (ext === "java") {
+        const className = javaClassName(test.body, `${stem.replace(/(^|_)([a-z0-9])/g, (_, _sep, c) => c.toUpperCase())}Test`);
+        const pkg = javaPackage(test.body);
+        return pkg ? `src/test/java/${pkg.replace(/\./g, "/")}/${className}.java` : `${GENERATED_DIR}/${className}.java`;
+    }
+    const file = ext === "go" ? `${stem}_test.go` : `${stem}.${ext}`;
+    if (linked && linked.includes("/")) {
+        return `${linked.slice(0, linked.lastIndexOf("/"))}/${GENERATED_DIR}_${file}`;
+    }
+    if (linked)
+        return `${GENERATED_DIR}_${file}`;
+    if (ext === "go") {
+        const goRef = groundingFileRef(test, /\.go$/i);
+        if (goRef && goRef.includes("/"))
+            return `${goRef.slice(0, goRef.lastIndexOf("/"))}/${GENERATED_DIR}_${file}`;
+        return `${GENERATED_DIR}_${file}`;
+    }
+    return `${GENERATED_DIR}/${file}`;
+}
+/**
+ * Suggested command to run a written test. A hint — the agent should prefer the
+ * repo's own configured command (package.json scripts / pyproject.toml) when it
+ * differs.
+ */
+function packageManager(root) {
+    try {
+        const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+        if (pkg.packageManager?.startsWith("pnpm@"))
+            return "pnpm";
+        if (pkg.packageManager?.startsWith("yarn@"))
+            return "yarn";
+    }
+    catch {
+        /* fall through to lockfiles/default */
+    }
+    if (existsSync(join(root, "pnpm-lock.yaml")))
+        return "pnpm";
+    if (existsSync(join(root, "yarn.lock")))
+        return "yarn";
+    return "npm";
+}
+function frameworkScript(root, framework, path) {
+    let scripts = {};
+    try {
+        const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+        scripts = pkg.scripts ?? {};
+    }
+    catch {
+        return null;
+    }
+    const fw = framework.toLowerCase();
+    const candidates = Object.entries(scripts)
+        .filter(([, command]) => command.toLowerCase().includes(fw))
+        .map(([name, command]) => {
+        const n = name.toLowerCase();
+        const c = command.toLowerCase();
+        if (n.includes("watch") || c.includes("watch"))
+            return { name, score: -1 };
+        if (fw === "vitest" && /\bvitest\b/.test(c) && !/\brun\b/.test(c))
+            return { name, score: -1 };
+        let score = 0;
+        if (path.includes("/unit/") && n.includes("unit"))
+            score += 40;
+        if (/\brun\b/.test(c))
+            score += 20;
+        if (n === "test")
+            score += 15;
+        if (n.startsWith(`test:${fw}`))
+            score += 12;
+        if (n.includes(fw))
+            score += 8;
+        if (n.startsWith("test"))
+            score += 5;
+        return { name, score };
+    })
+        .filter((c) => c.score >= 0)
+        .sort((a, b) => b.score - a.score || a.name.localeCompare(b.name));
+    return candidates[0]?.name ?? null;
+}
+function packageScriptCommand(root, framework, path) {
+    const script = frameworkScript(root, framework, path);
+    if (!script)
+        return null;
+    const pm = packageManager(root);
+    if (pm === "yarn")
+        return `yarn ${script} ${path}`;
+    return `${pm} run ${script} -- ${path}`;
+}
+function pytestMarkerFromBody(body) {
+    if (!body)
+        return null;
+    const markers = [...body.matchAll(/@pytest\.mark\.([A-Za-z_][A-Za-z0-9_]*)\b/g)]
+        .map((m) => m[1])
+        .filter((m) => !["skip", "skipif", "xfail", "parametrize", "usefixtures", "filterwarnings", "timeout"].includes(m));
+    return markers[0] ?? null;
+}
+function javaRunCommand(path, repoRoot) {
+    const javaClass = path.match(/\/([^/]+)\.java$/)?.[1] ?? "GeneratedTest";
+    if (!repoRoot)
+        return `mvn test -Dtest=${javaClass}`;
+    const testRoot = "/src/test/java/";
+    const moduleRel = path.includes(testRoot) ? path.slice(0, path.indexOf(testRoot)) : "";
+    const moduleRoot = join(repoRoot, moduleRel);
+    if (existsSync(join(moduleRoot, "pom.xml"))) {
+        const cmd = existsSync(join(moduleRoot, "mvnw")) ? "./mvnw" : "mvn";
+        return `${cmd} test -Dtest=${javaClass}`;
+    }
+    if (existsSync(join(moduleRoot, "build.gradle")) || existsSync(join(moduleRoot, "build.gradle.kts"))) {
+        const cmd = existsSync(join(moduleRoot, "gradlew")) ? "./gradlew" : "gradle";
+        return `${cmd} test --tests ${javaClass}`;
+    }
+    const cmd = existsSync(join(repoRoot, "mvnw")) ? "./mvnw" : "mvn";
+    return `${cmd} test -Dtest=${javaClass}`;
+}
+export function suggestedRunCommand(framework, path, repoRoot, body) {
+    const f = (framework || "").toLowerCase();
+    if (repoRoot && (f.includes("playwright") || f.includes("cypress") || f.includes("vitest") || f.includes("jest") || f.includes("mocha") || f.includes("ava"))) {
+        const scripted = packageScriptCommand(repoRoot, f.includes("playwright") ? "playwright" : f.includes("cypress") ? "cypress" : f.includes("vitest") ? "vitest" : f.includes("jest") ? "jest" : f.includes("mocha") ? "mocha" : "ava", path);
+        if (scripted)
+            return scripted;
+    }
+    if (f.includes("playwright"))
+        return `npx playwright test ${path}`;
+    if (f.includes("cypress"))
+        return `npx cypress run --spec ${path}`;
+    if (f.includes("vitest"))
+        return `npx vitest run ${path}`;
+    if (f.includes("jest"))
+        return `npx jest ${path}`;
+    if (f.includes("mocha"))
+        return `npx mocha ${path}`;
+    if (f.includes("ava"))
+        return `npx ava ${path}`;
+    if (f.includes("pytest") || f.includes("python")) {
+        const marker = pytestMarkerFromBody(body);
+        return marker ? `pytest ${path} -m ${marker}` : `pytest ${path}`;
+    }
+    if (f.includes("go"))
+        return "go test ./...";
+    if (f.includes("junit") || f.includes("java"))
+        return javaRunCommand(path, repoRoot);
+    return `<your repo's test command> ${path}`;
+}
+function runnerForDynamicProof(framework) {
+    const f = framework.toLowerCase();
+    if (f.includes("vitest"))
+        return "vitest";
+    if (f.includes("jest"))
+        return "jest";
+    if (f.includes("mocha"))
+        return "mocha";
+    return undefined;
+}
+function symbolFile(target) {
+    return target.slice("sym:".length).split("#")[0] ?? "";
+}
+function supportsDynamicProof(target) {
+    return /\.[cm]?[jt]sx?$/i.test(symbolFile(target));
+}
+export function runHintsFor(tests, repoRoot, startIndex = 0) {
+    return tests.map((t, i) => {
+        const suggested_path = suggestedTestPath(t, i + startIndex);
+        const target = t.target_symbol_external_id?.startsWith("sym:") ? t.target_symbol_external_id : undefined;
+        const canProve = target ? supportsDynamicProof(target) : false;
+        return {
+            generated_test_id: t.id,
+            title: t.title,
+            framework: t.framework_hint,
+            ...(target
+                ? {
+                    target_symbol_external_id: target,
+                    ...(canProve
+                        ? {
+                            prove_run: {
+                                tool: "orangepro_prove",
+                                args: {
+                                    target_symbol: target,
+                                    test_path: suggested_path,
+                                    replacement: "return null;",
+                                    ...(runnerForDynamicProof(t.framework_hint) ? { runner: runnerForDynamicProof(t.framework_hint) } : {})
+                                }
+                            }
+                        }
+                        : {
+                            handoff_note: "Dynamic public Proven currently supports TS/JS CodeSymbol targets only; use record_run for static diagnostics."
+                        }),
+                    record_run: {
+                        tool: "orangepro_record_run",
+                        args: { target_symbol: target, test_path: suggested_path }
+                    }
+                }
+                : {
+                    handoff_note: "No deterministic re-prove target (target is not a code symbol); write/run the test, then record the outcome manually."
+                }),
+            suggested_path,
+            run_command: suggestedRunCommand(t.framework_hint, suggested_path, repoRoot, t.body)
+        };
+    });
+}
+/**
+ * A body that is a JSON/XML test-case spec rather than runnable framework code.
+ * Run hints would mislead an agent into
+ * "running" a spec file, so these are excluded. Reuses the SAME JSON detection as
+ * the file-extension chooser (compareTestsExt → looksJson) so the two can never
+ * disagree — including the prose-wrapped ```json case (gpt-5/reasoning models).
+ */
+function isSpecBody(body) {
+    return looksJson(body) || (body || "").trimStart().startsWith("<");
+}
+/**
+ * Run hints for the RUNNABLE (framework-code) tests only. Excludes:
+ *  - non-runnable grounded drafts (`runnable === false`): no validated import /
+ *    assertion, so a run_command would mislead (PLAN 6.5);
+ *  - spec-mode bodies (JSON/XML eval artifacts from comparison mode).
+ * `runnable === undefined` is a legacy record, treated as runnable.
+ */
+export function runnableRunHintsFor(tests, repoRoot) {
+    return runHintsFor(tests.filter((t) => t.runnable !== false && !isSpecBody(t.body)), repoRoot);
+}
+/**
+ * Workflow for the calling agent. Returned alongside generated tests so the agent
+ * knows to write → run → report using its own shell tools.
+ */
+export const AGENT_RUN_WORKFLOW = [
+    "OrangePro returns the test code; YOUR agent runs it. Using your shell tools:",
+    "1. Write each test's `body` to its `suggested_path` in the repo.",
+    "2. Run its `run_command` from the package that owns the test's directory (monorepos: cd into that package first so the framework's module roots resolve) — or use the repo's own test command (npm test, pytest, npx playwright test).",
+    "3. For public Proven, call `prove_run`/`orangepro_prove` after the test passes; it reruns baseline + sentinel-mutant and closes only on a dynamic assertion kill. `record_run` is static diagnostics only.",
+    "4. Report pass/fail, error messages, and stack traces to the developer; propose a fix for failures.",
+    "Runnable Python and Go drafts require local validation tools on PATH (`python3` for pytest syntax checks, `gofmt` for Go syntax checks). If those tools are missing, OrangePro safely returns drafts without run commands.",
+    "Requires the repo's test framework + dependencies to already be installed. If a test fails to run for environment reasons (missing framework/deps), that's a local setup issue, not the generated test.",
+    "Single-repo, local, free-tier. Clean reproducible CI runs (GitHub Actions) and multi-repo lifecycle Knowledge Graph are part of the hosted/paid OrangePro platform — upgrade for those."
+];
+/**
+ * The keyless grounding contract, returned alongside generated tests. Tells the
+ * agent that each test ships with VALIDATED evidence (real graph entities, not
+ * generic guesses) and that it should ground its work in that evidence and report
+ * back which entities it actually used.
+ */
+export const GROUNDING_CONTRACT = [
+    "Each test carries `evidence`: grounding citations already VALIDATED against OrangePro's local graph (every `evidence_id` resolves to a real entity, with its kind, evidence_strength, and source_ref).",
+    "Treat hard/reviewed evidence as proof; weak/candidate evidence is a hint to verify, not trust. `evidence_summary` reports proof coverage and any broken citations.",
+    "Ground the test you keep in this evidence; when you accept or write a test, note which `evidence_id`s you used so OrangePro can record grounding-used vs grounding-ignored."
+];

package/dist/local/graph/citations.js

@@ -0,0 +1,73 @@
+import { redactSecrets } from "../util/redact.js";
+const PROOF_STRENGTHS = new Set(["hard", "reviewed"]);
+function isProof(strength) {
+    return strength !== "unknown" && PROOF_STRENGTHS.has(strength);
+}
+/**
+ * Build an O(1) external_id -> node index for the loaded graph. First-write wins,
+ * mirroring `findNode`'s first-match semantics, so a duplicate external_id
+ * resolves to the same node the rest of the kit would pick.
+ */
+export function buildCitationIndex(graph) {
+    const nodeById = new Map();
+    for (const node of graph.nodes) {
+        if (!nodeById.has(node.external_id))
+            nodeById.set(node.external_id, node);
+    }
+    return { nodeById };
+}
+/**
+ * Validate a generated test's grounding citations against the graph index:
+ * resolve each cited entity_id, attach kind/strength/source_ref, and count how
+ * many are genuine proof (hard/reviewed).
+ */
+export function validateEvidence(index, grounding) {
+    const evidence = grounding.entity_ids.map((id) => {
+        const node = index.nodeById.get(id);
+        if (!node) {
+            return { evidence_id: id, validated: false, kind: "unknown", title: id, evidence_strength: "unknown" };
+        }
+        const cited = {
+            evidence_id: node.external_id,
+            validated: true,
+            kind: node.kind,
+            // Defense-in-depth: titles/source_refs are metadata, but re-scrub at this exit
+            // boundary so the "no secrets" guarantee holds regardless of how the node was
+            // populated (mirrors the evidence-pack exporter's redactDeep). external_id is
+            // structural (path / req id) and stays verbatim so the agent can reconcile it.
+            title: redactSecrets(node.title ?? node.external_id),
+            evidence_strength: node.evidence_strength
+        };
+        if (node.provenance?.source_ref)
+            cited.source_ref = redactSecrets(node.provenance.source_ref);
+        return cited;
+    });
+    const validated_count = evidence.reduce((n, e) => (e.validated ? n + 1 : n), 0);
+    const proof_count = evidence.reduce((n, e) => (e.validated && isProof(e.evidence_strength) ? n + 1 : n), 0);
+    return {
+        evidence,
+        validated_count,
+        invalid_count: evidence.length - validated_count,
+        proof_count,
+        has_proof: proof_count > 0
+    };
+}
+/**
+ * Validate every generated test's citations against the graph and roll the
+ * results into a per-test list plus a run-level summary. Builds the index once.
+ */
+export function summarizeTestEvidence(graph, tests) {
+    const index = buildCitationIndex(graph);
+    const per_test = tests.map((t) => ({
+        generated_test_id: t.id,
+        title: t.title,
+        ...validateEvidence(index, t.grounding)
+    }));
+    const summary = {
+        tests: per_test.length,
+        tests_with_proof: per_test.reduce((n, p) => (p.has_proof ? n + 1 : n), 0),
+        tests_without_validated_evidence: per_test.reduce((n, p) => (p.validated_count === 0 ? n + 1 : n), 0),
+        invalid_citations: per_test.reduce((n, p) => n + p.invalid_count, 0)
+    };
+    return { per_test, summary };
+}

package/dist/local/graph/confirmable.js

@@ -0,0 +1,72 @@
+// Structural-confirmability deferral (Phase 4.5 / Gate 7b).
+//
+// Some behaviors can never be proven by static TS import resolution + symbol
+// evidence because their real coverage lives at a layer the resolver does not
+// traverse (e2e / api). These are NOT gaps (a real test may exist) and NOT
+// confirmed (we cannot prove it). Forcing them into either side breaks trust, so
+// they get a third state: `not_structurally_confirmable` (nsc), excluded from the
+// confirmed-% denominator and recorded with a `defer_reason`.
+//
+// v1 deferral signal: a behavior with NO hard TESTED_BY/COVERS edge whose linked
+// candidate tests are ALL e2e- or api-layer (the AST classifier's authoritative
+// layer). Precedence: a hard edge → confirmed BEFORE nsc is ever considered.
+// (dynamic-import / DI-container / route-registration deferral is a documented
+// follow-up; under-deferring keeps behaviors visible, the safe direction.)
+/**
+ * Map of behavior external_id → defer reason for every behavior that is
+ * not-structurally-confirmable. O(edges + nodes), computed once per consumer.
+ */
+export function structurallyUnconfirmable(graph) {
+    // Behaviors touched by a hard coverage edge (either end) are confirmed — never nsc.
+    const hard = new Set();
+    for (const e of graph.edges) {
+        if (e.relationship_type === "TESTED_BY" || e.relationship_type === "COVERS") {
+            hard.add(e.from_external_id);
+            hard.add(e.to_external_id);
+        }
+    }
+    // TestCase id → its authoritative layer (Phase 4.6).
+    const layerOf = new Map();
+    for (const n of graph.nodes) {
+        if (n.kind === "TestCase") {
+            layerOf.set(n.external_id, typeof n.properties.test_layer === "string" ? n.properties.test_layer : "unknown");
+        }
+    }
+    // behavior id → set of linked TestCase ids (via the weak candidate edges).
+    const linkedTests = new Map();
+    const link = (behavior, test) => {
+        if (!layerOf.has(test))
+            return;
+        let s = linkedTests.get(behavior);
+        if (!s) {
+            s = new Set();
+            linkedTests.set(behavior, s);
+        }
+        s.add(test);
+    };
+    for (const e of graph.candidate_edges) {
+        if (e.relationship_type !== "MAY_BE_TESTED_BY" && e.relationship_type !== "MAY_COVER")
+            continue;
+        // The TestCase is whichever end is a known TestCase; the other (NON-test) end
+        // is the behavior. Mutually exclusive so an edge between two TestCases never
+        // mis-attributes a TestCase as a behavior.
+        const toIsTest = layerOf.has(e.to_external_id);
+        const fromIsTest = layerOf.has(e.from_external_id);
+        if (toIsTest && !fromIsTest)
+            link(e.from_external_id, e.to_external_id);
+        else if (fromIsTest && !toIsTest)
+            link(e.to_external_id, e.from_external_id);
+    }
+    const out = new Map();
+    for (const [behavior, tests] of linkedTests) {
+        if (hard.has(behavior))
+            continue; // confirmed precedence
+        const layers = [...tests].map((t) => layerOf.get(t) ?? "unknown");
+        if (layers.length === 0)
+            continue;
+        if (!layers.every((l) => l === "e2e" || l === "api"))
+            continue;
+        out.set(behavior, layers.includes("e2e") ? "layer_e2e" : "layer_api");
+    }
+    return out;
+}

package/dist/local/graph/factories.js

@@ -0,0 +1,210 @@
+import { stableId } from "../util/ids.js";
+import { BOILERPLATE_REASON } from "../analyze/boilerplate.js";
+import { GENERATED_CODE_REASON, NON_PRODUCT_REASON } from "../analyze/classify.js";
+import { BEHAVIOR_KINDS } from "./ontology.js";
+/**
+ * Kind-based denominator defaults for nodes whose producer did not set the
+ * fields explicitly (hand-built graphs, fixtures). The four real producers
+ * (analyzer UserFlow/CodeSymbol, csv, markdown) always set them explicitly —
+ * these defaults encode the same Gate-3 policy: explicit requirements count,
+ * test-inferred flows never do, and a bare CodeSymbol is NOT counted unless
+ * the analyzer proves it eligible.
+ */
+function denominatorDefaults(kind) {
+    if (kind === "Requirement" || kind === "BusinessRule") {
+        return {
+            behavior_source: "requirement_template",
+            denominator_eligible: true,
+            denominator_reason: "Explicit requirement — always countable."
+        };
+    }
+    if (kind === "UserFlow") {
+        return {
+            behavior_source: "test_inferred",
+            denominator_eligible: false,
+            denominator_reason: "Inferred from test names — a test cannot witness its own requirement."
+        };
+    }
+    if (kind === "CodeSymbol") {
+        return {
+            behavior_source: "code_export",
+            denominator_eligible: false,
+            denominator_reason: "Code export not proven countable (analyzer decides eligibility)."
+        };
+    }
+    return {};
+}
+export function makeNode(input) {
+    const defaults = denominatorDefaults(input.kind);
+    return {
+        id: stableId(input.kind, input.external_id),
+        external_id: input.external_id,
+        kind: input.kind,
+        title: input.title,
+        properties: input.properties ?? {},
+        evidence_strength: input.evidence_strength,
+        review_status: input.review_status,
+        confidence: input.confidence,
+        provenance: input.provenance,
+        content_hash: input.content_hash,
+        behavior_source: input.behavior_source ?? defaults.behavior_source,
+        denominator_eligible: input.denominator_eligible ?? defaults.denominator_eligible,
+        denominator_reason: input.denominator_reason ?? defaults.denominator_reason
+    };
+}
+export function makeTestCaseNode(input) {
+    return makeNode({
+        kind: "TestCase",
+        external_id: `test:${input.testRel}`,
+        title: input.title,
+        properties: {
+            test_layer: input.testLayer,
+            layer_confidence: input.layerConfidence,
+            layer_signals: input.layerSignals,
+            file: input.testRel,
+            test_names: input.testNames
+        },
+        evidence_strength: "hard",
+        review_status: "auto_detected",
+        confidence: 1,
+        provenance: input.provenance,
+        content_hash: input.contentHash
+    });
+}
+export function makeEdge(input) {
+    return {
+        id: stableId("edge", `${input.from_external_id}|${input.relationship_type}|${input.to_external_id}`),
+        ...input
+    };
+}
+export function makeProofEdges(input) {
+    const testExternalId = `test:${input.testRel}`;
+    return [
+        makeEdge({
+            from_external_id: input.symId,
+            to_external_id: testExternalId,
+            relationship_type: "TESTED_BY",
+            evidence_strength: "hard",
+            review_status: "auto_detected",
+            provenance: input.provenance,
+            last_verified: input.lastVerified
+        }),
+        makeEdge({
+            from_external_id: testExternalId,
+            to_external_id: input.symId,
+            relationship_type: "COVERS",
+            evidence_strength: "hard",
+            review_status: "auto_detected",
+            provenance: input.provenance,
+            last_verified: input.lastVerified
+        })
+    ];
+}
+export function makeCandidateEdge(input) {
+    return {
+        id: stableId("cand", `${input.from_external_id}|${input.relationship_type}|${input.to_external_id}`),
+        ...input
+    };
+}
+// ── Graph query helpers ──────────────────────────────────────────────
+export function nodesByKind(graph, kind) {
+    return graph.nodes.filter((n) => n.kind === kind);
+}
+export function findNode(graph, externalId) {
+    return graph.nodes.find((n) => n.external_id === externalId);
+}
+export function behaviorNodes(graph) {
+    return graph.nodes.filter((n) => BEHAVIOR_KINDS.has(n.kind));
+}
+/**
+ * SOLE source of truth for what counts in the coverage denominator (Gate 3).
+ * Nothing else may decide eligibility — not kind sets, not evidence strength.
+ * Stale nodes never count: incremental update keeps deleted files' exports as
+ * `stale: true` ghosts, and a deleted export is not witnessable by the repo.
+ */
+export function isDenominatorEligible(n) {
+    return n.denominator_eligible === true && n.stale !== true;
+}
+/** The behaviors the coverage denominator is computed over. */
+export function denominatorBehaviors(graph) {
+    return graph.nodes.filter(isDenominatorEligible);
+}
+/** Auditable composition of the denominator (shared by score + analyzer). */
+export function denominatorComposition(graph) {
+    const comp = {
+        total: 0,
+        code_export: 0,
+        requirement_template: 0,
+        markdown_requirement: 0,
+        excluded_test_inferred: 0,
+        excluded_boilerplate: 0,
+        excluded_infra: 0,
+        excluded_generated: 0,
+        code_symbols_total: 0,
+        unattributed: 0
+    };
+    for (const n of graph.nodes) {
+        if (n.stale === true)
+            continue; // deleted-file ghosts are not witnessable
+        if (n.kind === "CodeSymbol")
+            comp.code_symbols_total++; // true "found" total (eligible + every excluded class)
+        if (isDenominatorEligible(n)) {
+            comp.total++;
+            if (n.behavior_source === "code_export")
+                comp.code_export++;
+            else if (n.behavior_source === "markdown_requirement")
+                comp.markdown_requirement++;
+            else if (n.behavior_source === "requirement_template")
+                comp.requirement_template++;
+            // An eligible node with a test_inferred/missing source is a producer-bug
+            // combination — surface it, never launder it into a requirement count.
+            else
+                comp.unattributed++;
+        }
+        else if (n.behavior_source === "test_inferred") {
+            comp.excluded_test_inferred++;
+        }
+        else if (n.denominator_reason === BOILERPLATE_REASON) {
+            // Recomputed from nodes (not persisted analysis) so the report disclosure
+            // can never disagree with the graph it is paired with.
+            comp.excluded_boilerplate++;
+        }
+        else if (n.denominator_reason === NON_PRODUCT_REASON) {
+            comp.excluded_infra++;
+        }
+        else if (n.denominator_reason === GENERATED_CODE_REASON) {
+            comp.excluded_generated++;
+        }
+    }
+    return comp;
+}
+/** Hard/reviewed edges where the given external id is the source. */
+export function outgoingEdges(graph, externalId) {
+    return graph.edges.filter((e) => e.from_external_id === externalId);
+}
+/** Hard/reviewed edges where the given external id is the target. */
+export function incomingEdges(graph, externalId) {
+    return graph.edges.filter((e) => e.to_external_id === externalId);
+}
+export function edgesOfType(graph, externalId, type) {
+    return graph.edges.filter((e) => e.relationship_type === type && (e.from_external_id === externalId || e.to_external_id === externalId));
+}
+export function candidateEdgesFrom(graph, externalId) {
+    return graph.candidate_edges.filter((e) => e.from_external_id === externalId);
+}
+export function generatedTestById(graph, testId) {
+    return graph.generated_tests.find((t) => t.id === testId || t.title === testId);
+}
+/** Priority ranking helper used by gaps + generation target selection. */
+export function priorityRank(value) {
+    const p = String(value ?? "").toLowerCase();
+    if (p.includes("crit") || p === "p0")
+        return 4;
+    if (p.includes("high") || p === "p1")
+        return 3;
+    if (p.includes("med") || p === "p2")
+        return 2;
+    if (p.includes("low") || p === "p3")
+        return 1;
+    return 0;
+}

package/dist/local/graph/ontology.js

@@ -0,0 +1,18 @@
+/**
+ * OrangePro local evidence-graph ontology.
+ *
+ * This is an OrangePro-shaped, test-generation-oriented graph — NOT a generic
+ * code graph. Every node and edge carries evidence strength and provenance so
+ * the kit can prove *why* a generated test is grounded, and so a pack can later
+ * be promoted into a hosted tenant graph without changing the conceptual model.
+ *
+ * The graph is built directly by OrangePro; it does not depend on any
+ * third-party graph product or format.
+ */
+export const LOCAL_GRAPH_SCHEMA_VERSION = "orangepro.local_graph.v1";
+/** Node kinds that map to behaviors/requirements for scoring + gaps + generation. */
+export const BEHAVIOR_KINDS = new Set([
+    "Requirement",
+    "UserFlow",
+    "BusinessRule"
+]);