@orangepro/orangepro-mcp 0.2.2 → 0.2.4

package/README.md

@@ -2,33 +2,50 @@
 
 **Find the behaviors your tests miss. Generate grounded tests that actually run.**
 
-`opro` builds a knowledge graph from your local checkout, maps every behavior in your code, shows which ones are tested and which aren't, and generates integration-level tests grounded in real symbols — not hallucinated imports. Runs as a CLI and an MCP server.
+`opro` builds a knowledge graph from your local checkout, maps every behavior in your code, shows which ones are tested and which aren't, and generates integration-level tests grounded in real symbols — not hallucinated imports. It runs as a CLI and a local stdio MCP server.
+
+Install the target repository's dependencies first, then run OrangePro from that repository:
 
 ```bash
-npx @orangepro/mcp-server
 cd /path/to/your/repo
-opro
+npm install # or pnpm install / bun install / the repository's package manager
+
+# Optional: enables AI candidate links, candidate flows, and test generation.
+export ANTHROPIC_API_KEY="..." # or OPENAI_API_KEY / OLLAMA_BASE_URL
+
+npx -y @orangepro/mcp-server@latest start . --prompt-version v5
+open .orangepro/behavior-coverage.html
 ```
 
-That's it. You get:
+With no model key, the same command still performs deterministic analysis, renders the report, and dynamically proves eligible behaviors using existing tests. With a key, it also discovers AI candidate flows and drafts grounded tests for the highest-risk gaps. AI output never changes evidence tiers; only the mutation-kill oracle can mint **Dynamically Proven**.
+
+The command writes:
 
 ```
 .orangepro/
 ├── behavior-coverage.html   ← open this: interactive gap report
+├── graph.json               ← deterministic evidence graph
+├── COVERAGE_REPORT.md       ← coverage and gap summary
 ├── rtm.md                   ← requirements traceability matrix
-└── evidence-pack.json       ← machine-readable metadata export
+└── ai/                      ← candidate AI links/flows when a provider is configured
+
+orangepro_generated/         ← contained generated tests; existing source files are untouched
 ```
 
+Run `opro export` when you want a machine-readable evidence pack.
+<img width="895" height="960" alt="Screenshot 2026-07-08 at 1 18 01 AM" src="https://github.com/user-attachments/assets/73b8a812-2eab-43a1-8aed-4289545e630b" />
+
 ---
 
 ## Install
 
 ```bash
-# No install needed (npx)
-npx @orangepro/mcp-server
+# No install needed: run the full local workflow in the current repository
+npx -y @orangepro/mcp-server@latest start . --prompt-version v5
 
 # Or global install
 npm install -g @orangepro/orangepro-mcp
+opro start . --prompt-version v5
 
 # Or from source
 git clone https://github.com/OrangeproAI/orangepro-mcp.git
@@ -41,7 +58,38 @@ cd orangepro-mcp && npm ci && npm run build && npm link
 
 OrangePro runs as an MCP server. Any MCP-compatible agent (Cursor, Claude Code, Codex, Copilot, OpenCode) can drive it.
 
-### Setup
+### Quick agent setup
+
+If you already have `opro` on your PATH, print the exact config for your client:
+
+```bash
+opro agent --client codex
+opro agent --client claude-code
+opro agent --client cursor
+opro agent --client opencode
+opro agent --client generic
+```
+
+No global install is required. These commands use the published package:
+
+```bash
+# Codex
+npx -y @orangepro/mcp-server@latest agent --client codex
+
+# Claude Code
+npx -y @orangepro/mcp-server@latest agent --client claude-code
+
+# Cursor
+npx -y @orangepro/mcp-server@latest agent --client cursor
+
+# OpenCode
+npx -y @orangepro/mcp-server@latest agent --client opencode
+
+# Generic MCP clients, including VS Code/Copilot-style MCP settings
+npx -y @orangepro/mcp-server@latest agent --client generic
+```
+
+### Manual MCP config
 
 Add to your client's MCP config:
 
@@ -57,11 +105,12 @@ Add to your client's MCP config:
 ```
 
 | Client | Config location |
-|--------|----------------|
+| --- | --- |
 | Claude Code | `.mcp.json` or `~/.claude.json` |
 | Cursor | `~/.cursor/mcp.json` or Settings → MCP |
-| Codex | MCP config printed by `opro agent --client codex`; plugin install after OrangePro is listed in a configured marketplace |
-| VS Code / Copilot | MCP settings |
+| Codex | Config printed by `opro agent --client codex` or `npx -y @orangepro/mcp-server@latest agent --client codex` |
+| VS Code / Copilot | MCP settings; use the `generic` config if your client accepts raw MCP server JSON |
+| OpenCode | Config printed by `opro agent --client opencode` |
 
 ### The workflow
 
@@ -111,6 +160,7 @@ opro rtm                      # traceability matrix
 opro export                   # metadata-only evidence pack
 opro mcp                      # run as MCP server (stdio)
 opro doctor                   # what evidence to add next
+opro doctor --proof           # explain why dynamic proof could not close
 opro coverage                 # ingest runtime coverage
 ```
 
@@ -161,6 +211,8 @@ Every behavior gets exactly one tier. Nothing is labeled "tested" on faith.
 
 > **"Dynamically Proven 0" is normal on first run.** Static analysis always runs. Dynamic proof requires running tests against targeted mutations. That's the trust model — nothing is Dynamically Proven until a real test kills a real mutant.
 
+When runtime coverage is available, `opro start` also compares Runtime-covered and Dynamically Proven behaviors over the same deterministic denominator. It never compares source-line coverage with behavior proof or folds off-denominator proofs into that percentage.
+
 ---
 
 ## Language support
@@ -237,9 +289,10 @@ OrangePro separates **analysis** (what your code does) from **proof** (whether t
 ## Privacy
 
 - **No stored source.** Reads code in-process. Never uploads to an OrangePro server.
-- **No source mutation.** Never edits your existing files. Writes metadata to `.orangepro/`.
+- **No existing-source mutation.** Never edits existing source or test files. Writes metadata to `.orangepro/`; keyed auto-drive may write new, reviewable tests under `orangepro_generated/`.
 - **Metadata-only exports.** File paths, names, hashes, scores — not raw source.
 - **Your keys stay yours.** Read from env at call time, never persisted.
+- **BYOK is direct.** When AI lanes are enabled, grounded code context is sent directly to the model provider you configure; OrangePro's hosted service is not in that path.
 
 ---
 

package/dist/local/analyze/analyzer.js

@@ -1534,6 +1534,40 @@ export function analyzeRepo(root, opts = {}) {
             const symId = `sym:${targetRel}#${name}`;
             return codeSymbolIds.has(symId) ? symId : null;
         };
+        /**
+         * ALL package method symbols whose bare name is `bareName` — receiver-qualified
+         * `Recv.M` hits plus bare-named ones (underivable receiver). Go method symbols
+         * are minted qualified (engine `goReceiverBaseName`), so a bare test callee maps
+         * back through this. Same-named FREE functions never appear (kind-filtered):
+         * the mutator's receiver-exact `--recv` match means a free fn can never be
+         * mutated in a method attempt.
+         */
+        const goPackageMethodHits = (dir, bareName) => {
+            const suffix = `.${bareName}`;
+            const hits = [];
+            for (const f of goFilesByDir.get(dir) ?? []) {
+                if (isNonProductFile(f))
+                    continue;
+                for (const n of symbolsByFile.get(f) ?? []) {
+                    if ((n === bareName || n.endsWith(suffix)) && symbolKind(f, n) === "method")
+                        hits.push({ file: f, qualified: n });
+                }
+            }
+            return hits;
+        };
+        /**
+         * Receiver type pinned from a constructor's DECLARED result: `p := New(...)` →
+         * New's single `T`/`*T` result base name (engine `goCtorResults`, structurally
+         * capturable results only). Undefined — never a guess — when the ctor is not
+         * package-unique or its result was not capturable (multi-return, interface,
+         * qualified, generic): receiver pinning must fail closed.
+         */
+        const goCtorResultType = (dir, ctorName) => {
+            const ctorFile = uniqueGoPackageSymbol(dir, ctorName);
+            if (!ctorFile)
+                return undefined;
+            return nonTsStructureByFile.get(ctorFile)?.structure.goCtorResults?.[ctorName];
+        };
         const eligiblePythonSymbol = (targetRel, name) => {
             if (!targetRel || !(proofEligibleSymbolsByFile.get(targetRel) ?? []).includes(name))
                 return null;
@@ -1554,13 +1588,38 @@ export function analyzeRepo(root, opts = {}) {
             const symId = `sym:${targetRel}#${name}`;
             return codeSymbolIds.has(symId) ? symId : null;
         };
-        const resolveGoProofTarget = (testRel, structure, qualifier, callee, shadowed) => {
+        const resolveGoProofTarget = (testRel, structure, qualifier, callee, shadowed, receiverLocal, receiverCtor) => {
             if (!qualifier) {
                 if (shadowed.has(callee) || structure.packageName?.endsWith("_test"))
                     return null;
                 return eligibleGoSymbol(uniqueGoPackageSymbol(dirOf(testRel), callee), callee);
             }
             const rootQualifier = qualifier.split(".")[0];
+            // Receiver-local METHOD call `p.M()`: the qualifier `p` is a LOCAL by design
+            // (declared `p := New(...)`), so this must be checked BEFORE the qualifier-shadow
+            // guard (which exists to reject package-func names shadowed by locals, not receivers).
+            // Resolve the bare callee among the package's receiver-qualified method symbols
+            // (`Recv.M`):
+            //   - ONE method named M package-wide → take it (the #212 unique-name behavior;
+            //     the mutator's `--recv` exact match keeps the mutation on that receiver).
+            //   - MULTIPLE methods named M → pin the receiver TYPE from the constructor's
+            //     DECLARED result (`p := New(...)` → goCtorResultType, structurally provable
+            //     results only) and require exactly one `pin.M` hit; no provable pin → refuse
+            //     (the pre-pinning fail-closed behavior).
+            // The pin SELECTS only — it never rejects the unique candidate (an interface- or
+            // alias-returning ctor would name an abstraction, not a receiver, and a wrong
+            // selection is fail-safe anyway: the frozen oracle only fails closed in the
+            // survive direction). Callee and ctor both honor shadowing.
+            if (receiverLocal && !shadowed.has(callee) && !structure.packageName?.endsWith("_test")) {
+                const hits = goPackageMethodHits(dirOf(testRel), callee);
+                if (hits.length === 1)
+                    return eligibleGoSymbol(hits[0].file, hits[0].qualified);
+                const pinned = receiverCtor && !shadowed.has(receiverCtor) ? goCtorResultType(dirOf(testRel), receiverCtor) : undefined;
+                if (!pinned)
+                    return null;
+                const match = hits.filter((h) => h.qualified === `${pinned}.${callee}`);
+                return match.length === 1 ? eligibleGoSymbol(match[0].file, match[0].qualified) : null;
+            }
             if (shadowed.has(rootQualifier))
                 return null;
             const binding = structure.imports.find((i) => i.local === rootQualifier && i.kind === "module");
@@ -1730,7 +1789,7 @@ export function analyzeRepo(root, opts = {}) {
             const testExternalId = `test:${testRel}`;
             for (const proof of structure.goProofCalls ?? []) {
                 goProofAttempted++;
-                const symId = resolveGoProofTarget(testRel, structure, proof.qualifier, proof.callee, new Set(proof.shadowed));
+                const symId = resolveGoProofTarget(testRel, structure, proof.qualifier, proof.callee, new Set(proof.shadowed), proof.receiverLocal, proof.receiverCtor);
                 if (!symId)
                     continue;
                 const edgeKey = `${testExternalId}|${symId}`;

package/dist/local/analyze/parseCache.js

@@ -54,7 +54,7 @@
 // Swift protocol methods, and Rust trait signatures while dropping Rust aliases.
 // v16: symbol extraction now carries source line spans for runtime coverage
 // report ingestion; warm v15 entries lack the ranges and cannot be mapped.
-export const PARSER_VERSION = 16;
+export const PARSER_VERSION = 17; // 17: Go method symbols receiver-qualified (Recv.M + member_of)
 const SYMBOL_KINDS = new Set(["function", "class", "const", "method"]);
 /** Strict structural validation — persisted data is untrusted FOR SHAPE; reject anything off-shape. */
 function validSymbols(v) {

package/dist/local/analyze/treeSitter/engine.js

@@ -252,8 +252,12 @@ export function extractTreeSitterSymbols(content, language) {
         if (kind && shouldEmitSymbol(node, language)) {
             const name = symbolName(node, cfg);
             if (name && !RESERVED_SYMBOL_NAMES.has(name)) {
+                // Go methods mint receiver-qualified names (`Recv.M`, mirroring TS/JS
+                // `Class.method` + member_of) so same-named methods on different receivers
+                // stay distinct symbols; an underivable receiver falls back to the bare name.
+                const recv = kind === "method" && language === "go" ? goReceiverBaseName(node) : undefined;
                 add(kind === "method"
-                    ? { name, symbol_kind: kind, trivial_accessor: isTrivialAccessorBody(node, language), ...nodeLines(node) }
+                    ? { name: recv ? `${recv}.${name}` : name, ...(recv ? { member_of: recv } : {}), symbol_kind: kind, trivial_accessor: isTrivialAccessorBody(node, language), ...nodeLines(node) }
                     : { name, symbol_kind: kind, ...nodeLines(node) });
             }
         }
@@ -381,6 +385,20 @@ function functionName(node, language) {
         return name;
     return name;
 }
+/**
+ * Base receiver type name for a Go method declaration — `(p *Parser)` → "Parser",
+ * `(g Generic[T])` → "Generic". Undefined when the receiver shape is underivable,
+ * in which case callers fall back to the bare method name (the pre-qualified
+ * behavior). NOT used for test-name extraction — suite test names must stay bare
+ * (`^Test` gate at extractGoProofCalls).
+ */
+function goReceiverBaseName(node) {
+    const param = node.childForFieldName("receiver")?.namedChild(0);
+    let t = param?.childForFieldName("type") ?? undefined;
+    if (t && (t.type === "pointer_type" || t.type === "generic_type"))
+        t = t.namedChild(0) ?? undefined;
+    return t?.type === "type_identifier" ? t.text : undefined;
+}
 function javaPackage(root) {
     const pkg = namedChildren(root).find((n) => n.type === "package_declaration");
     return pkg ? namedChildren(pkg).find((n) => n.type.endsWith("identifier"))?.text : undefined;
@@ -389,6 +407,29 @@ function goPackage(root) {
     const pkg = namedChildren(root).find((n) => n.type === "package_clause");
     return pkg ? namedChildren(pkg).find((n) => n.type === "package_identifier")?.text : undefined;
 }
+/**
+ * Top-level Go function name → base name of its single declared result type
+ * (`func New(n int) *Parser` → "Parser"). ONLY a bare `type_identifier` (optionally
+ * behind one `*`) is captured; multi-return (`parameter_list`), interface, qualified
+ * (`pkg.T`), and generic results are omitted — constructor-based receiver pinning
+ * must fail closed on any result it cannot prove structurally.
+ */
+function extractGoCtorResults(root) {
+    const out = {};
+    for (const child of namedChildren(root)) {
+        if (child.type !== "function_declaration")
+            continue;
+        const name = child.childForFieldName("name")?.text;
+        if (!name)
+            continue;
+        let r = child.childForFieldName("result") ?? undefined;
+        if (r?.type === "pointer_type")
+            r = r.namedChild(0) ?? undefined;
+        if (r?.type === "type_identifier")
+            out[name] = r.text;
+    }
+    return out;
+}
 function kotlinPackage(root) {
     const pkg = namedChildren(root).find((n) => n.type === "package_header");
     return pkg ? namedChildren(pkg).find((n) => n.type === "identifier")?.text : undefined;
@@ -766,6 +807,17 @@ function goAssertionCalls(node, assertLocals, dotAssertMethods, shadowed) {
         return Boolean(fn?.type === "identifier" && !shadowed.has(fn.text) && dotAssertMethods.has(fn.text));
     });
 }
+function goAssertionIdentifierArgs(assertion, testingParams) {
+    const sel = callFunctionSelector(assertion);
+    const name = sel?.name ?? assertion.childForFieldName("function")?.text;
+    const args = namedChildren(assertion.childForFieldName("arguments") ?? assertion).filter((n) => n.type !== "comment");
+    if (!name || args.length < 2)
+        return [];
+    if (!testingParams.has(args[0]?.text ?? ""))
+        return [];
+    const slots = name === "Equal" || name === "NotEqual" ? [args[1], args[2]] : [args[1]];
+    return slots.filter((n) => n?.type === "identifier").map((n) => n.text);
+}
 function goAssertionSubject(assertion, testingParams) {
     const sel = callFunctionSelector(assertion);
     const name = sel?.name ?? assertion.childForFieldName("function")?.text;
@@ -849,6 +901,11 @@ function goShortVarCalls(stmt) {
 function extractGoProofCalls(root, imports) {
     const out = [];
     const seen = new Set();
+    // Var name → constructor name for locals declared in the CURRENT test func by a
+    // bare same-package `x := New(...)` (single unqualified call). Reset per top-level
+    // test func; marks a qualified proof-call `p.M()` as receiver-local AND carries
+    // the ctor name so the analyzer can pin p's receiver type from New's result.
+    let receiverLocals = new Map();
     const assertLocals = goAssertLocals(imports);
     const dotAssertMethods = goDotAssertMethods(root);
     const suiteTypes = goCanonicalSuiteTypes(root, goSuiteLocals(imports));
@@ -858,13 +915,41 @@ function extractGoProofCalls(root, imports) {
             if (seen.has(key))
                 continue;
             seen.add(key);
-            out.push({ caller: testName, testName, ...c, shadowed: [...shadowed], assertion, ...(assertionLine ? { assertionLine } : {}) });
+            const receiverCtor = c.via === "qualified" && !!c.qualifier && !c.qualifier.includes(".") ? receiverLocals.get(c.qualifier) : undefined;
+            out.push({ caller: testName, testName, ...c, shadowed: [...shadowed], assertion, ...(assertionLine ? { assertionLine } : {}), ...(receiverCtor ? { receiverLocal: true, receiverCtor } : {}) });
         }
     };
     const processBlock = (block, testName, testingParams, shadowed) => {
+        // ONE-HOP block-local dataflow: a standalone `x, err := F(...)` statement is
+        // credited when a LATER statement in the SAME block checks a declared name
+        // (if-fail condition or assert subject). This covers the dominant real-Go
+        // idiom the if-initializer shape misses. Discipline kept: single product
+        // call per statement (goShortVarCalls), last write wins, plain reassignment
+        // invalidates, never crosses block boundaries. Metadata only — the dynamic
+        // oracle still re-verifies every edge before anything is Proven.
+        const pending = new Map();
+        // Deferred pending credits: witness lines are collected per call and flushed
+        // after the block — one witness keeps its exact line (subtest binding),
+        // several witnesses drop the line (the oracle's frame-line gate must never
+        // refuse a real kill firing at a sibling check).
+        const pendingHits = new Map();
+        const hitPending = (assertion, calls, line) => {
+            for (const c of calls) {
+                const key = `${assertion}|${c.qualifier ?? ""}|${c.callee}`;
+                const hit = pendingHits.get(key) ?? { assertion, calls: [c], lines: new Set() };
+                if (line !== undefined)
+                    hit.lines.add(line);
+                pendingHits.set(key, hit);
+            }
+        };
         for (const stmt of blockStatements(block)) {
             for (const assertion of goAssertionCalls(stmt, assertLocals, dotAssertMethods, shadowed)) {
-                add(testName, shadowed, "assert_helper", singleGoProductCallIn(goAssertionSubject(assertion, testingParams)), assertion.startPosition.row + 1);
+                const subject = goAssertionSubject(assertion, testingParams);
+                add(testName, shadowed, "assert_helper", singleGoProductCallIn(subject), assertion.startPosition.row + 1);
+                for (const argName of goAssertionIdentifierArgs(assertion, testingParams)) {
+                    if (pending.has(argName))
+                        hitPending("assert_helper", pending.get(argName), assertion.startPosition.row + 1);
+                }
             }
             if (stmt.type === "if_statement" && hasGoTestingFailure(stmt.childForFieldName("consequence"), testingParams)) {
                 const condition = stmt.childForFieldName("condition");
@@ -876,6 +961,10 @@ function extractGoProofCalls(root, imports) {
                 const initCalls = init ? goShortVarCalls(init) : null;
                 if (initCalls && containsIdentifier(condition, initCalls.names))
                     add(testName, shadowed, "testing_fail", initCalls.calls, failLine);
+                for (const [name, calls] of pending) {
+                    if (containsIdentifier(condition, new Set([name])))
+                        hitPending("testing_fail", calls, failLine);
+                }
             }
             for (const child of namedChildren(stmt)) {
                 if (child.type === "block")
@@ -886,6 +975,45 @@ function extractGoProofCalls(root, imports) {
                 const subTestName = subtest.subName ? `${testName}/${subtest.subName}` : testName;
                 processBlock(subtest.body, subTestName, subtest.testingParams, shadowed);
             }
+            // Record declarations AFTER uses: a declaration is never its own check.
+            const sv = stmt.type === "short_var_declaration" ? goShortVarCalls(stmt) : null;
+            if (sv) {
+                for (const name of sv.names)
+                    pending.set(name, sv.calls);
+            }
+            if (stmt.type === "short_var_declaration") {
+                // A lone `x := New(...)` makes x a receiver-local: its type comes from a
+                // same-package constructor, so `x.M()` targets a same-package method. This
+                // check inspects the TOP-LEVEL RHS call directly (not goShortVarCalls, whose
+                // single-product-call rule drops `New(strings.NewReader(...))` for its nested
+                // arg — the real phcparser shape). Refuses composite literals, qualified/
+                // imported calls, and multi-assign — none are receiver-locals.
+                const rhsNames = new Set();
+                collectNames(stmt.childForFieldName("left") ?? stmt.namedChild(0), rhsNames);
+                const rhs = stmt.childForFieldName("right");
+                const rhsCalls = rhs ? namedChildren(rhs).filter((n) => n.type === "call_expression") : [];
+                if (rhsNames.size === 1 && rhsCalls.length === 1) {
+                    const cp = callParts(rhsCalls[0], "go");
+                    if (cp && cp.via === "free")
+                        receiverLocals.set([...rhsNames][0], cp.callee);
+                }
+            }
+            else if (stmt.type === "assignment_statement") {
+                // Reassigning a receiver-local invalidates it too.
+                const reassignedRl = new Set();
+                collectNames(stmt.childForFieldName("left") ?? stmt.namedChild(0), reassignedRl);
+                for (const name of reassignedRl)
+                    receiverLocals.delete(name);
+                // Plain reassignment kills the binding — the checked value is no longer F's.
+                const reassigned = new Set();
+                collectNames(stmt.childForFieldName("left") ?? stmt.namedChild(0), reassigned);
+                for (const name of reassigned)
+                    pending.delete(name);
+            }
+        }
+        for (const hit of pendingHits.values()) {
+            const line = hit.lines.size === 1 ? [...hit.lines][0] : undefined;
+            add(testName, shadowed, hit.assertion, hit.calls, line);
         }
     };
     const processSuiteBlock = (block, testName, receiver, shadowed) => {
@@ -920,6 +1048,7 @@ function extractGoProofCalls(root, imports) {
         const body = child.childForFieldName("body");
         if (!testingParams.size || !body)
             continue;
+        receiverLocals = new Map();
         processBlock(body, name, testingParams, localBindings(child, "go"));
     }
     return out;
@@ -1383,7 +1512,14 @@ export function extractTreeSitterStructure(content, language) {
                 nextInsideFunction = true;
             }
             else {
-                const name = functionName(node, language);
+                let name = functionName(node, language);
+                // Go method symbols are receiver-qualified — attribute calls to the
+                // qualified caller so Layer-1 edges keep matching the emitted symbol.
+                if (name && language === "go" && node.type === "method_declaration") {
+                    const recv = goReceiverBaseName(node);
+                    if (recv)
+                        name = `${recv}.${name}`;
+                }
                 if (name) {
                     nextCaller = name;
                     nextShadowed = localBindings(node, language);
@@ -1402,7 +1538,7 @@ export function extractTreeSitterStructure(content, language) {
     const imports = extractImports(root, language);
     const result = {
         ...(language === "java" ? { packageName: javaPackage(root), javaClasses: javaClassInfos(root), javaProofCalls: extractJavaProofCalls(root, imports) } : {}),
-        ...(language === "go" ? { packageName: goPackage(root) } : {}),
+        ...(language === "go" ? { packageName: goPackage(root), goCtorResults: extractGoCtorResults(root) } : {}),
         ...(language === "kotlin" ? { packageName: kotlinPackage(root), topLevelSymbols: kotlinTopLevelSymbols(root) } : {}),
         ...(language === "php" ? { moduleName: phpNamespace(root) } : {}),
         ...(language === "csharp" ? { moduleName: csharpNamespace(root) } : {}),

package/dist/local/autoProve.js

@@ -108,15 +108,18 @@ function pytestNodeidsForTarget(sourceRoot, testRel, testName) {
  * `behavior_surface === "entrypoint_adjacent"`, and carrying NO `denominator_reason_code`
  * (infra_behavior_surface / not_entry_point_adjacent).
  *
- * Language: TS/JS (unchanged), Go (G-INT-2), OR Java (J-INT-2). Go dynamic proof
- * (G-1) proves FREE FUNCTIONS ONLY — a Go method classifies `unrunnable` and never
- * mints, so admitting one is safe (never a false Proven) but wastes an attempt; when
- * the clean `symbol_kind === "method"` signal is present we exclude it up front. Java
- * dynamic proof (J-1) is the INVERSE — it proves single-top-level-return METHODS, so
- * we admit Java methods; a non-J-1-shape method (void/constructor/nested/generic) just
- * classifies `unrunnable` and never mints, safe by construction. Everything downstream
- * of `closed`/the cert is language-agnostic and mints Go/Java only through the
- * unchanged G-INT-1/J-INT-1 gates.
+ * Language: TS/JS (unchanged), Go (G-INT-2), OR Java (J-INT-2). This STRICT predicate
+ * keeps Go to FREE FUNCTIONS ONLY. The Go oracle can also prove receiver METHODS, but
+ * a method's no-false-Proven story rests entirely on the analyzer-minted hard
+ * receiver-local TESTED_BY/COVERS edge (package-unique method-name gating) — so Go
+ * methods are admitted solely by `isEligibleHardExistingTarget` on the hard-edge lane,
+ * never here: this predicate also feeds PR/changed-scope selection, weak MAY_*
+ * expansion, and generation candidate filtering, where no hard edge backs the pick.
+ * Java dynamic proof (J-1) is the INVERSE — it proves single-top-level-return METHODS,
+ * so we admit Java methods; a non-J-1-shape method (void/constructor/nested/generic)
+ * just classifies `unrunnable` and never mints, safe by construction. Everything
+ * downstream of `closed`/the cert is language-agnostic and mints Go/Java only through
+ * the unchanged G-INT-1/J-INT-1 gates.
  */
 export function isEligibleProvableTarget(node) {
     if (!node || node.kind !== "CodeSymbol")
@@ -133,18 +136,27 @@ export function isEligibleProvableTarget(node) {
  * The LANGUAGE + oracle-SHAPE half of eligibility, factored out so both the strict
  * `isEligibleProvableTarget` (which layers the entry-point-adjacent SCOPE guards on top)
  * and the relaxed hard-edge existing-tests path share ONE definition of "a shape the
- * oracle can prove". CodeSymbol + a TS/JS file, a Go free function, a Java method, or a
- * Python function/method.
+ * oracle can prove". CodeSymbol + a TS/JS file, a Go free function (a receiver method
+ * only when the caller opts in via `allowGoMethod`), a Java method, or a Python
+ * function/method.
  */
-function matchesProvableLanguageShape(node) {
+function matchesProvableLanguageShape(node, opts) {
     if (node.kind !== "CodeSymbol")
         return false;
     const file = codeSymbolFile(node);
     if (isTsJsFile(file))
         return true;
-    // Go: free functions only. A method is out of scope for the Go oracle (G-1 refuses it).
-    if (isGoFile(file))
-        return node.properties.symbol_kind !== "method";
+    // Go: free functions only, unless the caller opts into methods (`allowGoMethod`).
+    // Only the hard-edge lane opts in: a method's no-false-Proven story rests on the
+    // analyzer's uniqueness-gated receiver-local TESTED_BY/COVERS edge, which the strict
+    // callers (changed-scope selection, weak MAY_* expansion, generation candidates)
+    // do not have — admitting methods there would break the invariant that a Go method
+    // only ever becomes a proof attempt via a hard receiver-local edge.
+    if (isGoFile(file)) {
+        if (node.properties.symbol_kind === "function")
+            return true;
+        return opts?.allowGoMethod === true && node.properties.symbol_kind === "method";
+    }
     // Java: METHODS only (J-1 proves single-top-level-return methods). A non-J-1-shape
     // method classifies `unrunnable` and never mints, so admitting all Java methods is
     // safe (never a false Proven); a non-method Java symbol (a class container) is out
@@ -173,7 +185,11 @@ function matchesProvableLanguageShape(node) {
  * by the frozen oracle, never false-Proven. Guards deliberately KEPT:
  *   - `infra_behavior_surface` still excludes plumbing (getters/registry accessors) — a
  *     hard edge does not buy an infra symbol an attempt (waste, and preserves the #4 bar);
- *   - the language + oracle-shape filter (never hand a class container / Go method down).
+ *   - the language + oracle-shape filter (never hand a class container down).
+ * This is also the ONLY caller that admits Go receiver METHODS (`allowGoMethod`): it is
+ * reached solely behind a hard TESTED_BY/COVERS edge, and the analyzer mints a method
+ * edge only for the uniqueness-gated receiver-local shape — the strict predicate keeps
+ * Go methods out of every other selection path.
  * Used solely on the hard lane; weak MAY_* fan-out stays strict.
  */
 function isEligibleHardExistingTarget(node) {
@@ -181,7 +197,7 @@ function isEligibleHardExistingTarget(node) {
         return false;
     if (node.properties.denominator_reason_code === "infra_behavior_surface")
         return false;
-    return matchesProvableLanguageShape(node);
+    return matchesProvableLanguageShape(node, { allowGoMethod: true });
 }
 /** Go `_test.go` top-level test-name regex (matches `extractTestNames`'s Go pattern). */
 const GO_TEST_NAME_RE = /^Test[A-Za-z0-9_]+$/;
@@ -206,9 +222,10 @@ function anchorGoTestRun(name) {
  * its target test BY NAME (`go test -run ^TestX$`), so auto-drive must derive that
  * name — G-INT-1 took it as an explicit input.
  *
- * The link is the analyzer's HARD `TESTED_BY`/`COVERS` proof edge (Go free-fn sym ↔
- * `test:<file>_test.go`), emitted only for an eligible Go symbol whose test genuinely
- * asserts on it. PRIMARY: the edge carries `properties.test_name` — the EXACT enclosing
+ * The link is the analyzer's HARD `TESTED_BY`/`COVERS` proof edge (Go sym — free fn,
+ * or receiver-local method — ↔ `test:<file>_test.go`), emitted only for an eligible Go
+ * symbol whose test genuinely asserts on it. PRIMARY: the edge carries
+ * `properties.test_name` — the EXACT enclosing
  * `func TestXxx` where the assertion witnessed THIS target (structural metadata, never
  * proof) — which disambiguates even a `_test.go` file with many tests. FALLBACK (old
  * graphs / no edge metadata): the linked TestCase node's file-level `test_names[]`,
@@ -519,7 +536,8 @@ export function existingAssociatedTests(graph, nodeById) {
     };
     // `hard` = TESTED_BY/COVERS (the confirmer's structural links); weak = MAY_* candidate
     // edges. Hard is recorded before weak (graph.edges scanned first), so a test already
-    // linked hard is never downgraded; a later weak dup only upgrades an existing weak to hard.
+    // linked hard is never downgraded, and a later weak dup of the same pair is a no-op —
+    // the hard flag can only ever originate from a genuine TESTED_BY/COVERS edge.
     const add = (symId, testRel, hard, testName) => {
         // A HARD TESTED_BY/COVERS edge is a real derivable test; admit it even when the symbol
         // is not_entry_point_adjacent (relaxed shape-only guard). Weak MAY_* fan-out stays strict.

package/dist/local/cli.js

@@ -2,6 +2,7 @@
 import { parseArgs, collectSetupCommands } from "./cliArgs.js";
 import { opAnalyze, opAiFlows, opAiLinks, opChanged, opCompare, opDoctor, opProofDoctor, opDynamicProof, opExplain, opGaps, opGenerate, opBehaviorCoverageHtml, opCoverageReport, opInit, opProveLoop, opRuntimeCoverage, opScore, opRecordRun, opRtm, opStats, opStatus, opUpdate, opSetModelDefault, opStart, getModelDefault, resolveDiffTargets, resolvePrCheckout, writeCompareReport } from "./operations.js";
 import { dominantBlockReason } from "./viz/behaviorReportData.js";
+import { coverageRevealLine } from "./viz/coverageReveal.js";
 import { autoProve, isRoastSurvivor } from "./autoProve.js";
 import { opRecipeDbSqljs } from "./recipe/dbSqljs.js";
 import { runExportCli } from "./exportCli.js";
@@ -106,7 +107,7 @@ Usage:
   opro ai-links [--all] [--apply] [--provider openai|anthropic|ollama] [--model <name>] [--max-behaviors <n>] [--symbols-per-behavior <n>] [--max-prompt-tokens <n>] [--json]
     # opt-in AI lane: stage weak candidate behavior↔code links in .orangepro/ai/links.json; --apply merges them into candidate_edges only
   opro ai-flows [--apply] [--provider openai|anthropic|ollama] [--model <name>] [--json]
-    # opt-in AI lane: stage candidate behavior flows (closed anchor set) in .orangepro/ai/flows.json; --apply stores them under analysis.candidate_flows only — a verify-these worklist, never evidence
+    # opt-in AI lane: stage candidate behavior flows (closed anchor set) in .orangepro/flows.json; --apply stores them under analysis.candidate_flows only — a verify-these worklist, never evidence
   opro generate [--target REQ-001] [--base <ref>] [--pr <n> [--yes]] [--changed] [--framework playwright] [--limit 3] [--prompt-version v2|v5] [--provider openai|anthropic|ollama|deterministic] [--model <name>] [--single [--raw]] [--background] [--json]
     # default: A/B both arms (prompt-only vs Local KG, same model) scored side by side + writes a fresh report; --single generates one arm only
     # --base <ref>: NON-MUTATING default for PR/branch review — generate only for the behaviors the diff vs <ref> touches (e.g. --base main); read-only \`git diff\`, no checkout
@@ -236,6 +237,11 @@ async function main() {
                         out(`    skipped:             ${skip.target_symbol ?? skip.title} — ${skip.reason}`);
                 }
                 out(`  Runtime-covered:       ${res.rtm.summary.runtime_covered}`);
+                // G6: same-denominator coverage-vs-proof reveal — renders only when runtime
+                // coverage was ingested; percentages share summary.total (never mixed scopes).
+                const reveal = coverageRevealLine(res.rtm.summary);
+                if (reveal)
+                    out(`  ${reveal}`);
                 out(`  Statically Linked:     ${res.rtm.summary.associated} (static test link, not dynamic proof)`);
                 out(`  No integration signal: ${res.rtm.summary.no_link}`);
                 out(`  AI-linked:      ${res.ai_linked.behaviors} behavior(s), ${res.ai_linked.symbols} symbol(s), ${res.ai_linked.links} weak link(s) — not coverage`);