@orangepro/orangepro-mcp 0.2.2 → 0.2.4

package/dist/local/flows/llmFlowDiscovery.js

@@ -19,8 +19,20 @@ const MAX_PROMPT_ENTRIES = 60;
 const MAX_PROMPT_SYMBOLS = 300;
 const MAX_COMPLETION_TOKENS = 3000;
 export function aiFlowsPath(root) {
+    return join(workspacePaths(root).dir, "flows.json");
+}
+function legacyAiFlowsPath(root) {
     return join(workspacePaths(root).dir, "ai", "flows.json");
 }
+function readAiFlowsArtifact(root) {
+    const path = aiFlowsPath(root);
+    const current = readArtifact(path);
+    if (current.artifact || current.invalid)
+        return { ...current, path };
+    const legacy = legacyAiFlowsPath(root);
+    const fallback = readArtifact(legacy);
+    return { ...fallback, path: fallback.artifact || fallback.invalid ? legacy : path };
+}
 function buildAnchorContext(graph) {
     const entries = dedupeEntries([
         ...endpointEntries(graph.nodes, graph.edges),
@@ -210,12 +222,12 @@ export async function generateAiFlows(root, graph, provider, clock) {
         node_set_hash: nodeSetHash
     }));
     const path = aiFlowsPath(root);
-    const cached = readArtifact(path);
+    const cached = readAiFlowsArtifact(root);
     if (cached.artifact?.cache_key === cacheKey) {
         const hit = cached.artifact;
         return {
             mode: "generate",
-            ai_flows_path: path,
+            ai_flows_path: cached.path,
             cache_hit: true,
             model_provider: hit.model_provider,
             model_name: hit.model_name,
@@ -306,8 +318,7 @@ export async function generateAiFlows(root, graph, provider, clock) {
  * edges/candidate_edges/nodes/analysis.flows.
  */
 export function applyAiFlows(root, graph) {
-    const path = aiFlowsPath(root);
-    const { artifact, invalid } = readArtifact(path);
+    const { path, artifact, invalid } = readAiFlowsArtifact(root);
     if (invalid) {
         throw new Error(`AI flows artifact at ${path} is invalid or corrupted; re-run \`opro ai-flows\` to regenerate it.`);
     }
@@ -413,7 +424,7 @@ function toCandidateFlow(flow, entriesById, knownEdges, provenance) {
         ...(flow.rationale ? { rationale: flow.rationale } : {}),
         provenance: {
             source_scope_id: `ai:${provenance.cache_key}`,
-            source_ref: ".orangepro/ai/flows.json",
+            source_ref: ".orangepro/flows.json",
             detector: "ai_flows",
             model_provider: provenance.model_provider,
             model_name: provenance.model_name,

package/dist/local/graph/ontology.js

@@ -9,7 +9,9 @@
  * The graph is built directly by OrangePro; it does not depend on any
  * third-party graph product or format.
  */
-export const LOCAL_GRAPH_SCHEMA_VERSION = "orangepro.local_graph.v1";
+// v2: Go method symbol ids are receiver-qualified (`sym:file.go#Recv.M`) — old
+// graphs hold bare-name method ids and must force-rebuild (loadGraph hard-fails).
+export const LOCAL_GRAPH_SCHEMA_VERSION = "orangepro.local_graph.v2";
 /** Node kinds that map to behaviors/requirements for scoring + gaps + generation. */
 export const BEHAVIOR_KINDS = new Set([
     "Requirement",

package/dist/local/mcp.js

@@ -407,7 +407,7 @@ export function createLocalServer() {
     });
     server.registerTool("orangepro_ai_flows", {
         title: "Stage/apply AI candidate flows",
-        description: "Opt-in AI lane: propose candidate behavior-flow chains over existing deterministic entry and CodeSymbol ids. Generate writes .orangepro/ai/flows.json only; apply=true stores survivors under analysis.candidate_flows. Candidate flows are a verify-these worklist and never affect Proven, deterministic flow counts, tiers, or coverage.",
+        description: "Opt-in AI lane: propose candidate behavior-flow chains over existing deterministic entry and CodeSymbol ids. Generate writes .orangepro/flows.json only; apply=true stores survivors under analysis.candidate_flows. Candidate flows are a verify-these worklist and never affect Proven, deterministic flow counts, tiers, or coverage.",
         inputSchema: {
             ...Workspace,
             apply: z.boolean().optional().describe("Apply staged flows into analysis.candidate_flows. Default false stages flows only."),

package/dist/local/operations.js

@@ -273,11 +273,14 @@ function symbolTargetParts(symExtId) {
         throw new Error(`Cannot derive dynamic proof target from symbol id: ${symExtId}`);
     }
     const [, file, symbolName] = match;
-    const method = symbolName.split(".").filter(Boolean).pop();
+    const segments = symbolName.split(".").filter(Boolean);
+    const method = segments.pop();
     if (!file || !method) {
         throw new Error(`Cannot derive dynamic proof target from symbol id: ${symExtId}`);
     }
-    return { file, method };
+    // The owner qualifier of a member id (TS `Class.method`, Go `Recv.M`). The Go
+    // lane passes it as --recv so the mutator matches the exact receiver.
+    return { file, method, ...(segments.length ? { memberQualifier: segments.join(".") } : {}) };
 }
 function assertProofTargetMatchesSymbol(opts, symbolTarget) {
     if (opts.target_path !== undefined && opts.target_path !== "") {
@@ -560,8 +563,9 @@ export function opAnalyze(root, opts = {}, deps = defaultDeps()) {
         ? (!opts.suppressProgress && reportProgress("coverage: generating local runtime coverage before graph build", { current: 2, total: 4 }),
             prepareRuntimeCoverage(scanRoot, { generate: true, timeoutMs: opts.coverageTimeoutMs, runner: deps.coverageRunner }))
         : undefined;
-    if (!workspaceInitialized(root))
-        initWorkspace(root, now);
+    // Idempotent for existing workspaces and also applies conservative migrations
+    // to untouched generated workspace files (for example .orangeproignore).
+    initWorkspace(root, now);
     if (!opts.suppressProgress) {
         reportProgress("analyze: parsing source and building deterministic graph", {
             current: opts.generateCoverage ? 3 : 2,
@@ -1007,6 +1011,10 @@ export function opDynamicProof(root, opts, deps = defaultDeps()) {
         // Slice 2: bind a runtime-named subtest's mutant failure to the exact assertion line.
         if (opts.go_assertion_line !== undefined)
             args.push("--go-assertion-line", String(opts.go_assertion_line));
+        // Receiver-qualified method target (`sym:file.go#Recv.M`) → the mutator must
+        // match the exact receiver, never a same-named decl on another type.
+        if (symbolTarget.memberQualifier)
+            args.push("--recv", symbolTarget.memberQualifier);
         const run = (deps.dynamicProofRunner ?? defaultDynamicProofRunner)(args, {
             cwd: goRoot,
             scriptPath: dynamicProofSpikePathFor("go")
@@ -1458,6 +1466,28 @@ export function autoProveChangedScope(graph, changed, baseRef) {
     });
     return hasEligibleTarget ? meaningful : undefined; // no eligible provable target in scope → global top-5
 }
+function writeStartStaticSnapshot(root, baseRef, warnings) {
+    let behaviorCoveragePath;
+    try {
+        reportProgress("artifacts: writing static behavior view (proof still running)", { current: 4, total: 8 });
+        behaviorCoveragePath = opBehaviorCoverageHtml(root, `${WORKSPACE_DIR}/behavior-coverage.html`, {
+            attempted: 0,
+            proven: 0,
+            needsSetup: []
+        }).behavior_coverage_path;
+    }
+    catch (error) {
+        warnings.push(`static behavior view not written: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    try {
+        reportProgress("artifacts: writing static RTM (proof still running)", { current: 4, total: 8 });
+        opRtm(root, { format: "md", baseRef, limit: START_RTM_LIMIT });
+    }
+    catch (error) {
+        warnings.push(`static RTM not written: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return behaviorCoveragePath ? { behaviorCoveragePath } : {};
+}
 export async function opStart(root, opts = {}, deps = defaultDeps()) {
     const providerOpts = startProviderOverride(root, opts);
     const scanRoot = opts.source ? resolve(opts.source) : resolve(root);
@@ -1475,6 +1505,7 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
     }, deps);
     const warnings = [...analyze.warnings];
     reportProgress("start: deterministic graph is ready", { current: 4, total: 8 });
+    const staticSnapshot = writeStartStaticSnapshot(root, opts.baseRef, warnings);
     const providerConfigured = deps.aiProvider !== undefined || resolveProviderConfig(providerEnv, providerOpts) !== null;
     let aiLinks = { status: "skipped", reason: "AI candidate links disabled for this run." };
     if (opts.ai !== false) {
@@ -1611,7 +1642,7 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
     catch (error) {
         warnings.push(`coverage report not written: ${error instanceof Error ? error.message : String(error)}`);
     }
-    let coverageHtml;
+    let coverageHtml = staticSnapshot.behaviorCoveragePath;
     try {
         reportProgress("artifacts: writing behavior coverage view", { current: 7, total: 8 });
         // Forward THIS-RUN dynamic-proof outcome so the report can name the dominant setup/runnability

package/dist/local/util/walk.js

@@ -66,20 +66,21 @@ export function loadIgnore(root) {
             const line = raw.trim();
             if (!line || line.startsWith("#") || line.startsWith("!"))
                 continue;
+            const rootAnchored = line.startsWith("/");
             const cleaned = line.replace(/^\/+/, "").replace(/\/+$/, "");
             if (!cleaned)
                 continue;
-            if (!cleaned.includes("/") && !cleaned.includes("*")) {
+            if (!rootAnchored && !cleaned.includes("/") && !cleaned.includes("*")) {
                 names.add(cleaned);
             }
             else {
-                matchers.push(globToRegExp(cleaned));
+                matchers.push(globToRegExp(cleaned, rootAnchored));
             }
         }
     }
     return { names, matchers };
 }
-function globToRegExp(glob) {
+function globToRegExp(glob, rootAnchored = false) {
     // Use a plain-ASCII sentinel for `**` so the file stays text (no NUL bytes)
     // and `*` substitution does not re-match the globstar.
     const GLOBSTAR = "__ORANGEPRO_GLOBSTAR__";
@@ -90,7 +91,7 @@ function globToRegExp(glob) {
         .split(GLOBSTAR)
         .join(".*")
         .replace(/\?/g, "[^/]");
-    return new RegExp(`(^|/)${escaped}(/|$)`);
+    return new RegExp(`${rootAnchored ? "^" : "(^|/)"}${escaped}(/|$)`);
 }
 function isIgnored(relPath, baseName, rules) {
     if (rules.names.has(baseName))

package/dist/local/viz/behaviorReportData.js

@@ -375,7 +375,6 @@ function riskRows(risks, graph) {
             firstRowForFile.set(r.file, r.id);
     return risks.map((risk, idx) => {
         const methodMatch = risk.title.match(/^(GET|POST|PUT|PATCH|DELETE)\s+(.+)$/i);
-        const pathMatch = risk.file.match(/\/api\/(.+)$/);
         const tags = [];
         const bucket = riskBucket(risk.risk_score);
         if (bucket)
@@ -394,8 +393,8 @@ function riskRows(risks, graph) {
                     applicableCategories: [...new Set(generatedTests.map((t) => t.concern).filter((c) => Boolean(c)))]
                 };
             })(),
-            verb: methodMatch?.[1]?.toUpperCase() ?? (risk.entry_point ? "ENTRY" : "CODE"),
-            path: methodMatch?.[2] ?? (pathMatch ? `/${pathMatch[1]}` : risk.file),
+            verb: methodMatch?.[1]?.toUpperCase() ?? "BEHAVIOR",
+            path: methodMatch?.[2] ?? risk.title,
             desc: risk.reasons.join(" · "),
             tags,
             todo: "Write an integration or behavior test that calls this behavior and asserts the observable outcome."

package/dist/local/viz/behaviorReportHtml.js

@@ -470,8 +470,9 @@ if(cf&&cf.flows.length){
 }
 
 // risks + generated test samples
-let activeRiskFilter="all";
 const riskList=$("#risk-list"),riskTools=$("#risk-tools");
+const generatedRiskCount=D.risks.filter(r=>r.generatedTests&&r.generatedTests.length).length;
+let activeRiskFilter=generatedRiskCount?"generated":"all";
 function riskMatchesFilter(r){
   const hasGenerated=Boolean(r.generatedTests&&r.generatedTests.length);
   if(activeRiskFilter==="generated")return hasGenerated;
@@ -481,7 +482,7 @@ function riskMatchesFilter(r){
 function renderRiskFilters(){
   const options=[
     ["all","All",D.risks.length],
-    ["generated","Generated tests",D.risks.filter(r=>r.generatedTests&&r.generatedTests.length).length],
+    ["generated","Flows with tests",generatedRiskCount],
     ["missing","No generated tests",D.risks.filter(r=>!(r.generatedTests&&r.generatedTests.length)).length]
   ];
   riskTools.innerHTML=options.map(([key,label,count])=>\`<button class="risk-filter" type="button" data-risk-filter="\${key}" aria-pressed="\${key===activeRiskFilter}">\${label} <span class="gc">\${count}</span></button>\`).join("");
@@ -519,16 +520,16 @@ function renderRisks(){
   riskList.innerHTML="";
   D.risks.filter(riskMatchesFilter).forEach(r=>riskList.append(el("div","risk-card",riskCardHtml(r))));
   if(activeRiskFilter==="all"&&D.generatedTotal){
-    const hiddenGenerated=Math.max(0,D.generatedTotal-D.shownCount);
-    const remainingRiskFlows=Math.max(0,D.risks.length-D.generatedTotal);
+    const hiddenGeneratedFlows=Math.max(0,generatedRiskCount-D.risks.filter(riskMatchesFilter).length);
+    const remainingRiskFlows=Math.max(0,D.risks.length-generatedRiskCount);
     riskList.append(el("div","paywall",
-      hiddenGenerated
-        ? \`<div class="paywall-num">\${hiddenGenerated} more tests generated</div>
-           <div class="paywall-txt">OrangePro generated tests for \${D.generatedTotal} behaviors across your highest-risk flows. You're seeing \${D.shownCount}.</div>
+      hiddenGeneratedFlows
+        ? \`<div class="paywall-num">\${hiddenGeneratedFlows} more flows with tests</div>
+           <div class="paywall-txt">OrangePro accepted \${D.generatedTotal} runnable generated test\${D.generatedTotal===1?"":"s"} across \${generatedRiskCount} high-risk flow\${generatedRiskCount===1?"":"s"}. Use the “Flows with tests” filter to review them first.</div>
            <a class="paywall-btn" href="https://app.orangepro.ai" target="_blank">View all on OrangePro Platform &rarr;</a>\`
         : remainingRiskFlows
           ? \`<div class="paywall-num">\${remainingRiskFlows} high-risk flows left</div>
-             <div class="paywall-txt">The local MCP accepted \${D.generatedTotal} runnable generated test\${D.generatedTotal===1?"":"s"} for this report. Generate the remaining high-risk flow tests on OrangePro Platform.</div>
+             <div class="paywall-txt">The local MCP accepted \${D.generatedTotal} runnable generated test\${D.generatedTotal===1?"":"s"} across \${generatedRiskCount} high-risk flow\${generatedRiskCount===1?"":"s"}. Generate the remaining high-risk flow tests on OrangePro Platform.</div>
              <a class="paywall-btn" href="https://app.orangepro.ai" target="_blank">Generate remaining tests on Platform &rarr;</a>\`
           : \`<div class="paywall-num">All generated tests are shown</div>
              <div class="paywall-txt">OrangePro generated tests for every high-risk flow in this report, and every generated test is visible here.</div>\`));

package/dist/local/viz/coverageReveal.js

@@ -0,0 +1,29 @@
+/**
+ * G6 — the coverage-vs-proof reveal line for the start summary.
+ *
+ * Compares ONLY same-scope numbers: both sides are RTM counts over the SAME
+ * denominator (`summary.total`). The proven side is `coverage_confirmed` — the
+ * IN-DENOMINATOR proven count — never `summary.proven`, which also counts
+ * off-denominator proofs (relaxed hard-edge targets below the entry-point bar)
+ * and can exceed `total` (a 5/3 = 167% render). The signature omits `proven`
+ * entirely so the off-denominator number cannot be passed by mistake.
+ *
+ * `runtime_covered` is the DISJOINT runtime tier — behaviors a repo coverage
+ * report executed that are NOT dynamically proven. Runtime coverage only proves
+ * EXECUTION, and the unproven side may simply be unattempted or unrunnable —
+ * the line says so and never blames the tests outright. Source-report
+ * line-coverage totals (lcov LF/LH etc.) are NOT retained by ingestion and are
+ * never invented here (spec G6 guardrail). Never implies proven SHOULD equal
+ * coverage — they measure different things.
+ *
+ * Null when no runtime coverage was ingested (nothing to reveal) or the
+ * denominator is empty.
+ */
+export function coverageRevealLine(summary) {
+    if (summary.runtime_covered <= 0 || summary.total <= 0)
+        return null;
+    const pct = (n) => Math.round((n / summary.total) * 100);
+    return (`Coverage vs proof: ${summary.runtime_covered}/${summary.total} behaviors are runtime-covered but not Dynamically Proven ` +
+        `(${pct(summary.runtime_covered)}%) vs ${summary.coverage_confirmed}/${summary.total} Dynamically Proven (${pct(summary.coverage_confirmed)}%) — ` +
+        `coverage only proves execution; the unproven side may be unattempted, blocked, or covered by tests that never assert these behaviors.`);
+}

package/dist/local/workspace.js

@@ -21,7 +21,7 @@ export function workspaceInitialized(root) {
 export function graphExists(root) {
     return existsSync(workspacePaths(root).graphPath);
 }
-const ORANGEPROIGNORE_TEMPLATE = `# .orangeproignore — paths the OrangePro local proof kit should never read.
+const ORANGEPROIGNORE_PREAMBLE = `# .orangeproignore — paths the OrangePro local proof kit should never read.
 # Same spirit as .gitignore. Secrets and large assets are excluded by default.
 *.env
 *.pem
@@ -32,7 +32,8 @@ secrets/
 
 # Product-denominator defaults: example/demo apps are useful references, but
 # they usually should not count as product behavior coverage.
-examples/
+`;
+export const LEGACY_ORANGEPROIGNORE_TEMPLATE = `${ORANGEPROIGNORE_PREAMBLE}examples/
 example/
 demos/
 demo/
@@ -42,6 +43,16 @@ docs/examples/
 docs/demo/
 docs/demos/
 `;
+export const ORANGEPROIGNORE_TEMPLATE = `${ORANGEPROIGNORE_PREAMBLE}/examples/
+/example/
+/demos/
+/demo/
+/samples/
+/sample/
+/docs/examples/
+/docs/demo/
+/docs/demos/
+`;
 export function initWorkspace(root, now) {
     const paths = workspacePaths(root);
     mkdirSync(paths.dir, { recursive: true });
@@ -58,6 +69,18 @@ export function initWorkspace(root, now) {
     if (!existsSync(ignorePath)) {
         writeFileSync(ignorePath, ORANGEPROIGNORE_TEMPLATE, "utf8");
     }
+    else {
+        // Upgrade only the untouched generated template. A user-edited ignore file
+        // is configuration and must never be rewritten implicitly.
+        try {
+            if (readFileSync(ignorePath, "utf8") === LEGACY_ORANGEPROIGNORE_TEMPLATE) {
+                writeFileSync(ignorePath, ORANGEPROIGNORE_TEMPLATE, "utf8");
+            }
+        }
+        catch {
+            // A read-only or transiently unavailable ignore file must not fail init.
+        }
+    }
     return { paths, config: loadConfig(paths) };
 }
 export function loadConfig(paths) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orangepro/orangepro-mcp",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "private": false,
   "description": "OrangePro (`opro`) — a local-first, BYOK CLI + MCP server that builds an evidence graph from a local checkout, ingests runtime coverage, and generates grounded tests. Metadata-only exports; no source upload; generated tests stay local.",
   "license": "MIT",
@@ -85,7 +85,11 @@
     "test:integration:go:auto:slow": "OPRO_SLOW_GO_AUTO=1 vitest run tests/local/autoProveGo.test.ts --pool=forks --poolOptions.forks.maxForks=1",
     "test:integration:java:1": "vitest run tests/local/javaProveIntegration.test.ts -t \"^(?!.*(no-false-Proven|mints the same Proven)).*\" --pool=forks --poolOptions.forks.maxForks=1",
     "test:integration:java:2": "vitest run tests/local/javaProveIntegration.test.ts -t \"no-false-Proven|mints the same Proven\" --pool=forks --poolOptions.forks.maxForks=1",
-    "test:integration:java:3": "vitest run tests/local/autoProveJava.test.ts --pool=forks --poolOptions.forks.maxForks=1",
+    "test:integration:java:3": "npm run test:integration:java:3:unit && npm run test:integration:java:3:prove && npm run test:integration:java:3:survivor && npm run test:integration:java:3:refused",
+    "test:integration:java:3:unit": "vitest run tests/local/autoProveJava.test.ts -t \"javaTestForTarget|isEligibleProvableTarget\" --pool=forks --poolOptions.forks.maxForks=1",
+    "test:integration:java:3:prove": "vitest run tests/local/autoProveJava.test.ts -t \"mints DP\" --pool=forks --poolOptions.forks.maxForks=1",
+    "test:integration:java:3:survivor": "vitest run tests/local/autoProveJava.test.ts -t \"equivalent survivor\" --pool=forks --poolOptions.forks.maxForks=1",
+    "test:integration:java:3:refused": "vitest run tests/local/autoProveJava.test.ts -t \"refused-shape\" --pool=forks --poolOptions.forks.maxForks=1",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "smoke:gap-fill": "npm run build && node scripts/smoke-gap-fill-loop.mjs",
     "smoke:generate-prove": "npm run build && node scripts/smoke-generate-prove-e2e.mjs",

package/scripts/spikes/go-dynamic-proof-spike.mjs

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 // go-dynamic-proof-spike.mjs — Go dynamic-proof MECHANISM (G-1).
 //
-// Proves ONE free function 0->1 on a single Go module by mutation: it byte-copies
+// Proves ONE free function or receiver method 0->1 on a single Go module by
+// mutation: it byte-copies
 // the module into a hermetic sandbox, runs `go test -json` baseline, replaces the
 // target function body with a signature-derived sentinel (via go-mutate.go), reruns
 // the SAME test, and classifies. It emits a JSON verdict mirroring the TS/JS spike's
@@ -21,12 +22,13 @@
 // assertion call (`t.Error`/`t.Errorf`, or testify `assert.`/`require.`), NOT a
 // `t.Fatal`/`t.Fatalf`/`t.FailNow`/`t.SkipNow` hard-stop or a helper call. A build
 // error, a panic, a t.Fatal precondition, a setup/helper failure, an unbindable
-// failure, and an ambiguous/method/no-return name all classify as `unrunnable`,
+// failure, and an ambiguous or no-return name all classify as `unrunnable`,
 // never `proven`. An equivalent-value mutation survives -> `associated_survived`.
 //
-// This is a spike harness only: it writes no graph edges or product artifacts and is
-// NOT wired into autoProve / cert / RTM / the mint path. Use only on trusted checkouts
-// for local measurement.
+// PRODUCT-WIRED: `opro` routes Go dynamic proof through this script (operations.ts
+// dynamicProofSpikePathFor("go")). The script itself writes no graph edges or product
+// artifacts — it emits a JSON verdict; the orchestrator is the sole interpreter and
+// the only place proof is minted.
 import { spawnSync } from "node:child_process";
 import { cpSync, existsSync, lstatSync, mkdtempSync, mkdirSync, readFileSync, rmSync, symlinkSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -39,11 +41,12 @@ function usage() {
   return [
     "Usage: node scripts/spikes/go-dynamic-proof-spike.mjs --root <module> --test-run <^TestName$> --target <rel.go> --func <name> [--json]",
     "",
-    "Runs a Go baseline test, mutates the target free function body in an isolated byte-copy, reruns the same test, and classifies the result.",
+    "Runs a Go baseline test, mutates the target free function or method body in an isolated byte-copy, reruns the same test, and classifies the result.",
     "--test-run is passed verbatim to `go test -run` and should anchor a single test, e.g. '^TestCompute$'.",
+    "--recv <T> (optional): receiver base type — mutate only `func (x T) <name>` / `func (x *T) <name>`, so a same-named method on another receiver (or a free function) can never be the mutation target.",
     "--go-assertion-line <n> (optional): 1-based test-source line of the target's assertion. When set, the mutant's failure must bind to a frame at EXACTLY that line and subtest frames are considered — so a runtime-named subtest can prove while a sibling asserting elsewhere is refused.",
-    "G-1 scope: FREE FUNCTIONS ONLY. Methods are refused (unrunnable). Equivalent-value mutations survive (associated_survived).",
-    "This is a spike harness only; it does not write graph edges or product artifacts and is not wired into prove/RTM/mint."
+    "Scope: free functions and receiver methods. Without --recv the name must resolve to exactly ONE declaration in the target file; with --recv exactly one declaration on the selected base receiver must match. Ambiguity within the filtered receiver and generic receivers still fail closed. Equivalent-value mutations survive (associated_survived).",
+    "Product wiring: opro prove/auto-prove invokes this script for Go targets; it writes no graph edges or product artifacts itself — the caller interprets the JSON verdict."
   ].join("\n");
 }
 
@@ -460,9 +463,9 @@ function redactSecrets(text) {
 // Run the AST mutator (go run go-mutate.go). Because `go run` collapses any
 // non-zero child status to 1, we classify on the MUTATE_ERROR:<code> marker the
 // helper prints to stderr, not the exit code.
-function mutateFunc({ targetAbs, func, mode, cacheRoot, timeoutMs }) {
+function mutateFunc({ targetAbs, func, recv, mode, cacheRoot, timeoutMs }) {
   const helper = path.join(path.dirname(fileURLToPath(import.meta.url)), "go-mutate.go");
-  const result = spawnSync(goBin(), ["run", helper, "--file", targetAbs, "--func", func, "--mode", mode], {
+  const result = spawnSync(goBin(), ["run", helper, "--file", targetAbs, "--func", func, ...(recv ? ["--recv", recv] : []), "--mode", mode], {
     encoding: "utf8",
     timeout: timeoutMs,
     env: hermeticEnv(cacheRoot),
@@ -481,9 +484,9 @@ function mutateFunc({ targetAbs, func, mode, cacheRoot, timeoutMs }) {
 
 function mutateErrorReason(code) {
   switch (code) {
-    case 3: return "target function name is ambiguous (more than one free function)";
-    case 4: return "target free function was not found";
-    case 5: return "target is a method (out of scope for G-1)";
+    case 3: return "target name is ambiguous (more than one free function or method)";
+    case 4: return "target free function or method was not found";
+    // code 5 (method out of scope) is retired — methods are mutable now, never emitted.
     case 6: return "target function has no return value (not mutable)";
     default: return "mutation could not be applied";
   }
@@ -565,6 +568,7 @@ function main() {
     const mutation = mutateFunc({
       targetAbs: path.join(mutantCopy.repoRoot, targetRel),
       func: args.func,
+      recv: args.recv,
       mode: args.mode,
       cacheRoot: mutantCopy.tmpRoot,
       timeoutMs

package/scripts/spikes/go-mutate.go

@@ -2,11 +2,16 @@
 
 // go-mutate.go — AST-based body replacer for the Go dynamic-proof spike (G-1).
 //
-// Locates ONE free function `func Name(params) rets { ... }` by exact name and
-// replaces its BODY with a signature-derived sentinel, then writes the mutated
-// file. It is a spike helper only: it writes no product artifacts and is not
-// wired into prove/RTM/mint. G-1 scope is FREE FUNCTIONS ONLY — methods
-// (`func (r Recv) M()`) are recognized and refused as out-of-scope (G-2).
+// Locates ONE function declaration by exact name — a free function `func Name(...)`
+// or a receiver method `func (r Recv) Name(...)` — and replaces its BODY with a
+// signature-derived sentinel, then writes the mutated file. Invoked by
+// go-dynamic-proof-spike.mjs (the product Go proof path); it writes ONLY the
+// mutated file inside the sandbox copy — no graph or product artifacts. The
+// name must resolve to exactly ONE declaration — in the whole file without
+// --recv, or on the selected base receiver with --recv <T> (receiver-exact
+// selection for receiver-qualified `Recv.M` targets — never the wrong decl,
+// so A.M and B.M can coexist and still be individually mutable). Ambiguity
+// within that filter fails(3); generic receivers are refused (not found).
 //
 // Modes:
 //   sentinel   — replace body with a type-compatible, deliberately-wrong value
@@ -19,9 +24,10 @@
 // Exit codes (distinct, so the Node orchestrator can classify precisely):
 //   0  ok, mutated file written
 //   2  usage / IO / parse error
-//   3  ambiguous: more than one free function with that name
-//   4  not found: no free function with that name
-//   5  out of scope: a METHOD with that name exists (G-2, refused in G-1)
+//   3  ambiguous: more than one declaration (free and/or method) with that name
+//   4  not found: no free function or method with that name
+//   5  RETIRED — was "method out of scope (G-2)" before methods became mutable;
+//      no longer emitted (kept so codes 3/4/6 stay stable for the orchestrator)
 //   6  not mutable: the function has no return values (no signature-derived
 //      sentinel is possible) -> fail closed, never mutated
 package main
@@ -35,6 +41,7 @@ import (
 	"go/printer"
 	"go/token"
 	"os"
+	"strings"
 )
 
 // fail prints a stable, machine-readable marker plus a human message and exits
@@ -50,7 +57,8 @@ func fail(code int, format string, args ...any) {
 
 func main() {
 	file := flag.String("file", "", "path to the Go source file to mutate")
-	fn := flag.String("func", "", "exact name of the free function to mutate")
+	fn := flag.String("func", "", "exact name of the free function or method to mutate")
+	recv := flag.String("recv", "", "receiver base type name; when set, match only methods on this receiver")
 	out := flag.String("out", "", "path to write the mutated file (defaults to --file)")
 	mode := flag.String("mode", "sentinel", "sentinel | equivalent")
 	flag.Parse()
@@ -72,31 +80,47 @@ func main() {
 		fail(2, "parse error: %v", err)
 	}
 
-	var freeMatches []*ast.FuncDecl
-	methodMatch := false
+	// Collect BOTH free functions and methods named *fn. The proof lane only ever
+	// targets a method whose name is UNIQUE in its package (the analyzer's
+	// uniqueGoPackageSymbol refuses cross-file collisions before an edge is minted);
+	// this file-scoped count is the in-file backstop, so free+method or two-method
+	// collisions fail(3) as ambiguous — never a mislabeled mutation. A lone decl
+	// (free OR method) is mutated identically via the receiver-agnostic sentinel.
+	var matches []*ast.FuncDecl
 	for _, decl := range astFile.Decls {
 		fd, ok := decl.(*ast.FuncDecl)
 		if !ok || fd.Name == nil || fd.Name.Name != *fn {
 			continue
 		}
-		if fd.Recv != nil { // method -> out of scope for G-1
-			methodMatch = true
+		// Refuse generic receivers (r T[U]) — receiver base type is not a bare Ident.
+		if fd.Recv != nil && recvBaseIdent(fd) == nil {
 			continue
 		}
-		freeMatches = append(freeMatches, fd)
+		// Receiver-exact selection: when --recv is set, only a method on that base
+		// receiver type matches — a free function or another receiver never can, so
+		// a receiver-qualified target can never mutate the wrong declaration.
+		if *recv != "" {
+			if fd.Recv == nil {
+				continue
+			}
+			if id := recvBaseIdent(fd); id == nil || id.Name != *recv {
+				continue
+			}
+		}
+		matches = append(matches, fd)
 	}
 
-	if len(freeMatches) > 1 {
-		fail(3, "ambiguous: %d free functions named %q", len(freeMatches), *fn)
+	if len(matches) > 1 {
+		fail(3, "ambiguous: %d declarations named %q (free and/or methods)", len(matches), *fn)
 	}
-	if len(freeMatches) == 0 {
-		if methodMatch {
-			fail(5, "out of scope: %q is a method (G-2); G-1 handles free functions only", *fn)
+	if len(matches) == 0 {
+		if *recv != "" {
+			fail(4, "not found: no method named %q on receiver %q", *fn, *recv)
 		}
-		fail(4, "not found: no free function named %q", *fn)
+		fail(4, "not found: no free function or method named %q", *fn)
 	}
 
-	target := freeMatches[0]
+	target := matches[0]
 	results := target.Type.Results
 	if results == nil || len(results.List) == 0 {
 		fail(6, "not mutable: %q has no return values; no signature-derived sentinel is possible", *fn)
@@ -104,6 +128,15 @@ func main() {
 
 	if *mode == "sentinel" {
 		target.Body = sentinelBody(results)
+		// The sentinel body can orphan imports the original body used (Go
+		// rejects unused imports, so the mutant would fail to BUILD and the
+		// oracle would refuse — an honest but useless verdict for most real
+		// functions). Rewrite now-unused imports to blank imports: package
+		// init side effects are preserved, no behavior is added, and the
+		// repair is fail-safe in both directions — over-blanking a used
+		// import still fails the build (refusal, never proof), and a missed
+		// unused import is exactly today's behavior.
+		blankUnusedImports(astFile)
 	}
 	// equivalent mode: leave target.Body untouched (semantically identical).
 
@@ -117,6 +150,55 @@ func main() {
 	}
 }
 
+// blankUnusedImports renames imports whose package qualifier is no longer
+// referenced anywhere in the file to blank imports (`_ "path"`). Dot imports
+// and existing blank imports are left untouched. Qualifier detection is
+// syntactic (selector bases), which over-approximates "used" — the safe
+// direction: we only ever blank an import nothing references.
+func blankUnusedImports(f *ast.File) {
+	used := map[string]bool{}
+	ast.Inspect(f, func(n ast.Node) bool {
+		if sel, ok := n.(*ast.SelectorExpr); ok {
+			if id, ok := sel.X.(*ast.Ident); ok {
+				used[id.Name] = true
+			}
+		}
+		return true
+	})
+	for _, imp := range f.Imports {
+		if imp.Name != nil {
+			if imp.Name.Name == "_" || imp.Name.Name == "." {
+				continue
+			}
+			if !used[imp.Name.Name] {
+				imp.Name = ast.NewIdent("_")
+			}
+			continue
+		}
+		path := strings.Trim(imp.Path.Value, "\"")
+		base := path[strings.LastIndex(path, "/")+1:]
+		if !used[base] {
+			imp.Name = ast.NewIdent("_")
+		}
+	}
+}
+
+// recvBaseIdent returns the receiver type's base identifier for a method decl
+// (unwrapping a pointer receiver `*T` to `T`), or nil for a generic/unsupported
+// receiver. Used only to refuse generic receivers; value-vs-pointer is irrelevant
+// to body mutation (Go auto-(de)refs at the call site).
+func recvBaseIdent(fd *ast.FuncDecl) *ast.Ident {
+	if fd.Recv == nil || len(fd.Recv.List) != 1 {
+		return nil
+	}
+	t := fd.Recv.List[0].Type
+	if star, ok := t.(*ast.StarExpr); ok {
+		t = star.X
+	}
+	id, _ := t.(*ast.Ident)
+	return id
+}
+
 // sentinelBody builds `{ return <zero>, <zero>, ... }` matching the function's
 // result signature so the mutant COMPILES. Zero values are type-derived and
 // deliberately wrong for any function whose real return is non-zero; when a