@orangepro/orangepro-mcp 0.2.3 → 0.2.4

package/README.md

@@ -2,33 +2,50 @@
 
 **Find the behaviors your tests miss. Generate grounded tests that actually run.**
 
-`opro` builds a knowledge graph from your local checkout, maps every behavior in your code, shows which ones are tested and which aren't, and generates integration-level tests grounded in real symbols — not hallucinated imports. Runs as a CLI and an MCP server.
+`opro` builds a knowledge graph from your local checkout, maps every behavior in your code, shows which ones are tested and which aren't, and generates integration-level tests grounded in real symbols — not hallucinated imports. It runs as a CLI and a local stdio MCP server.
+
+Install the target repository's dependencies first, then run OrangePro from that repository:
 
 ```bash
-npx @orangepro/mcp-server
 cd /path/to/your/repo
-opro
+npm install # or pnpm install / bun install / the repository's package manager
+
+# Optional: enables AI candidate links, candidate flows, and test generation.
+export ANTHROPIC_API_KEY="..." # or OPENAI_API_KEY / OLLAMA_BASE_URL
+
+npx -y @orangepro/mcp-server@latest start . --prompt-version v5
+open .orangepro/behavior-coverage.html
 ```
 
-That's it. You get:
+With no model key, the same command still performs deterministic analysis, renders the report, and dynamically proves eligible behaviors using existing tests. With a key, it also discovers AI candidate flows and drafts grounded tests for the highest-risk gaps. AI output never changes evidence tiers; only the mutation-kill oracle can mint **Dynamically Proven**.
+
+The command writes:
 
 ```
 .orangepro/
 ├── behavior-coverage.html   ← open this: interactive gap report
+├── graph.json               ← deterministic evidence graph
+├── COVERAGE_REPORT.md       ← coverage and gap summary
 ├── rtm.md                   ← requirements traceability matrix
-└── evidence-pack.json       ← machine-readable metadata export
+└── ai/                      ← candidate AI links/flows when a provider is configured
+
+orangepro_generated/         ← contained generated tests; existing source files are untouched
 ```
 
+Run `opro export` when you want a machine-readable evidence pack.
+<img width="895" height="960" alt="Screenshot 2026-07-08 at 1 18 01 AM" src="https://github.com/user-attachments/assets/73b8a812-2eab-43a1-8aed-4289545e630b" />
+
 ---
 
 ## Install
 
 ```bash
-# No install needed (npx)
-npx @orangepro/mcp-server
+# No install needed: run the full local workflow in the current repository
+npx -y @orangepro/mcp-server@latest start . --prompt-version v5
 
 # Or global install
 npm install -g @orangepro/orangepro-mcp
+opro start . --prompt-version v5
 
 # Or from source
 git clone https://github.com/OrangeproAI/orangepro-mcp.git
@@ -89,7 +106,6 @@ Add to your client's MCP config:
 
 | Client | Config location |
 | --- | --- |
-|--------|----------------|
 | Claude Code | `.mcp.json` or `~/.claude.json` |
 | Cursor | `~/.cursor/mcp.json` or Settings → MCP |
 | Codex | Config printed by `opro agent --client codex` or `npx -y @orangepro/mcp-server@latest agent --client codex` |
@@ -144,6 +160,7 @@ opro rtm                      # traceability matrix
 opro export                   # metadata-only evidence pack
 opro mcp                      # run as MCP server (stdio)
 opro doctor                   # what evidence to add next
+opro doctor --proof           # explain why dynamic proof could not close
 opro coverage                 # ingest runtime coverage
 ```
 
@@ -194,6 +211,8 @@ Every behavior gets exactly one tier. Nothing is labeled "tested" on faith.
 
 > **"Dynamically Proven 0" is normal on first run.** Static analysis always runs. Dynamic proof requires running tests against targeted mutations. That's the trust model — nothing is Dynamically Proven until a real test kills a real mutant.
 
+When runtime coverage is available, `opro start` also compares Runtime-covered and Dynamically Proven behaviors over the same deterministic denominator. It never compares source-line coverage with behavior proof or folds off-denominator proofs into that percentage.
+
 ---
 
 ## Language support
@@ -270,9 +289,10 @@ OrangePro separates **analysis** (what your code does) from **proof** (whether t
 ## Privacy
 
 - **No stored source.** Reads code in-process. Never uploads to an OrangePro server.
-- **No source mutation.** Never edits your existing files. Writes metadata to `.orangepro/`.
+- **No existing-source mutation.** Never edits existing source or test files. Writes metadata to `.orangepro/`; keyed auto-drive may write new, reviewable tests under `orangepro_generated/`.
 - **Metadata-only exports.** File paths, names, hashes, scores — not raw source.
 - **Your keys stay yours.** Read from env at call time, never persisted.
+- **BYOK is direct.** When AI lanes are enabled, grounded code context is sent directly to the model provider you configure; OrangePro's hosted service is not in that path.
 
 ---
 

package/dist/local/analyze/analyzer.js

@@ -1534,6 +1534,40 @@ export function analyzeRepo(root, opts = {}) {
             const symId = `sym:${targetRel}#${name}`;
             return codeSymbolIds.has(symId) ? symId : null;
         };
+        /**
+         * ALL package method symbols whose bare name is `bareName` — receiver-qualified
+         * `Recv.M` hits plus bare-named ones (underivable receiver). Go method symbols
+         * are minted qualified (engine `goReceiverBaseName`), so a bare test callee maps
+         * back through this. Same-named FREE functions never appear (kind-filtered):
+         * the mutator's receiver-exact `--recv` match means a free fn can never be
+         * mutated in a method attempt.
+         */
+        const goPackageMethodHits = (dir, bareName) => {
+            const suffix = `.${bareName}`;
+            const hits = [];
+            for (const f of goFilesByDir.get(dir) ?? []) {
+                if (isNonProductFile(f))
+                    continue;
+                for (const n of symbolsByFile.get(f) ?? []) {
+                    if ((n === bareName || n.endsWith(suffix)) && symbolKind(f, n) === "method")
+                        hits.push({ file: f, qualified: n });
+                }
+            }
+            return hits;
+        };
+        /**
+         * Receiver type pinned from a constructor's DECLARED result: `p := New(...)` →
+         * New's single `T`/`*T` result base name (engine `goCtorResults`, structurally
+         * capturable results only). Undefined — never a guess — when the ctor is not
+         * package-unique or its result was not capturable (multi-return, interface,
+         * qualified, generic): receiver pinning must fail closed.
+         */
+        const goCtorResultType = (dir, ctorName) => {
+            const ctorFile = uniqueGoPackageSymbol(dir, ctorName);
+            if (!ctorFile)
+                return undefined;
+            return nonTsStructureByFile.get(ctorFile)?.structure.goCtorResults?.[ctorName];
+        };
         const eligiblePythonSymbol = (targetRel, name) => {
             if (!targetRel || !(proofEligibleSymbolsByFile.get(targetRel) ?? []).includes(name))
                 return null;
@@ -1554,13 +1588,38 @@ export function analyzeRepo(root, opts = {}) {
             const symId = `sym:${targetRel}#${name}`;
             return codeSymbolIds.has(symId) ? symId : null;
         };
-        const resolveGoProofTarget = (testRel, structure, qualifier, callee, shadowed) => {
+        const resolveGoProofTarget = (testRel, structure, qualifier, callee, shadowed, receiverLocal, receiverCtor) => {
             if (!qualifier) {
                 if (shadowed.has(callee) || structure.packageName?.endsWith("_test"))
                     return null;
                 return eligibleGoSymbol(uniqueGoPackageSymbol(dirOf(testRel), callee), callee);
             }
             const rootQualifier = qualifier.split(".")[0];
+            // Receiver-local METHOD call `p.M()`: the qualifier `p` is a LOCAL by design
+            // (declared `p := New(...)`), so this must be checked BEFORE the qualifier-shadow
+            // guard (which exists to reject package-func names shadowed by locals, not receivers).
+            // Resolve the bare callee among the package's receiver-qualified method symbols
+            // (`Recv.M`):
+            //   - ONE method named M package-wide → take it (the #212 unique-name behavior;
+            //     the mutator's `--recv` exact match keeps the mutation on that receiver).
+            //   - MULTIPLE methods named M → pin the receiver TYPE from the constructor's
+            //     DECLARED result (`p := New(...)` → goCtorResultType, structurally provable
+            //     results only) and require exactly one `pin.M` hit; no provable pin → refuse
+            //     (the pre-pinning fail-closed behavior).
+            // The pin SELECTS only — it never rejects the unique candidate (an interface- or
+            // alias-returning ctor would name an abstraction, not a receiver, and a wrong
+            // selection is fail-safe anyway: the frozen oracle only fails closed in the
+            // survive direction). Callee and ctor both honor shadowing.
+            if (receiverLocal && !shadowed.has(callee) && !structure.packageName?.endsWith("_test")) {
+                const hits = goPackageMethodHits(dirOf(testRel), callee);
+                if (hits.length === 1)
+                    return eligibleGoSymbol(hits[0].file, hits[0].qualified);
+                const pinned = receiverCtor && !shadowed.has(receiverCtor) ? goCtorResultType(dirOf(testRel), receiverCtor) : undefined;
+                if (!pinned)
+                    return null;
+                const match = hits.filter((h) => h.qualified === `${pinned}.${callee}`);
+                return match.length === 1 ? eligibleGoSymbol(match[0].file, match[0].qualified) : null;
+            }
             if (shadowed.has(rootQualifier))
                 return null;
             const binding = structure.imports.find((i) => i.local === rootQualifier && i.kind === "module");
@@ -1730,7 +1789,7 @@ export function analyzeRepo(root, opts = {}) {
             const testExternalId = `test:${testRel}`;
             for (const proof of structure.goProofCalls ?? []) {
                 goProofAttempted++;
-                const symId = resolveGoProofTarget(testRel, structure, proof.qualifier, proof.callee, new Set(proof.shadowed));
+                const symId = resolveGoProofTarget(testRel, structure, proof.qualifier, proof.callee, new Set(proof.shadowed), proof.receiverLocal, proof.receiverCtor);
                 if (!symId)
                     continue;
                 const edgeKey = `${testExternalId}|${symId}`;

package/dist/local/analyze/parseCache.js

@@ -54,7 +54,7 @@
 // Swift protocol methods, and Rust trait signatures while dropping Rust aliases.
 // v16: symbol extraction now carries source line spans for runtime coverage
 // report ingestion; warm v15 entries lack the ranges and cannot be mapped.
-export const PARSER_VERSION = 16;
+export const PARSER_VERSION = 17; // 17: Go method symbols receiver-qualified (Recv.M + member_of)
 const SYMBOL_KINDS = new Set(["function", "class", "const", "method"]);
 /** Strict structural validation — persisted data is untrusted FOR SHAPE; reject anything off-shape. */
 function validSymbols(v) {

package/dist/local/analyze/treeSitter/engine.js

@@ -252,8 +252,12 @@ export function extractTreeSitterSymbols(content, language) {
         if (kind && shouldEmitSymbol(node, language)) {
             const name = symbolName(node, cfg);
             if (name && !RESERVED_SYMBOL_NAMES.has(name)) {
+                // Go methods mint receiver-qualified names (`Recv.M`, mirroring TS/JS
+                // `Class.method` + member_of) so same-named methods on different receivers
+                // stay distinct symbols; an underivable receiver falls back to the bare name.
+                const recv = kind === "method" && language === "go" ? goReceiverBaseName(node) : undefined;
                 add(kind === "method"
-                    ? { name, symbol_kind: kind, trivial_accessor: isTrivialAccessorBody(node, language), ...nodeLines(node) }
+                    ? { name: recv ? `${recv}.${name}` : name, ...(recv ? { member_of: recv } : {}), symbol_kind: kind, trivial_accessor: isTrivialAccessorBody(node, language), ...nodeLines(node) }
                     : { name, symbol_kind: kind, ...nodeLines(node) });
             }
         }
@@ -381,6 +385,20 @@ function functionName(node, language) {
         return name;
     return name;
 }
+/**
+ * Base receiver type name for a Go method declaration — `(p *Parser)` → "Parser",
+ * `(g Generic[T])` → "Generic". Undefined when the receiver shape is underivable,
+ * in which case callers fall back to the bare method name (the pre-qualified
+ * behavior). NOT used for test-name extraction — suite test names must stay bare
+ * (`^Test` gate at extractGoProofCalls).
+ */
+function goReceiverBaseName(node) {
+    const param = node.childForFieldName("receiver")?.namedChild(0);
+    let t = param?.childForFieldName("type") ?? undefined;
+    if (t && (t.type === "pointer_type" || t.type === "generic_type"))
+        t = t.namedChild(0) ?? undefined;
+    return t?.type === "type_identifier" ? t.text : undefined;
+}
 function javaPackage(root) {
     const pkg = namedChildren(root).find((n) => n.type === "package_declaration");
     return pkg ? namedChildren(pkg).find((n) => n.type.endsWith("identifier"))?.text : undefined;
@@ -389,6 +407,29 @@ function goPackage(root) {
     const pkg = namedChildren(root).find((n) => n.type === "package_clause");
     return pkg ? namedChildren(pkg).find((n) => n.type === "package_identifier")?.text : undefined;
 }
+/**
+ * Top-level Go function name → base name of its single declared result type
+ * (`func New(n int) *Parser` → "Parser"). ONLY a bare `type_identifier` (optionally
+ * behind one `*`) is captured; multi-return (`parameter_list`), interface, qualified
+ * (`pkg.T`), and generic results are omitted — constructor-based receiver pinning
+ * must fail closed on any result it cannot prove structurally.
+ */
+function extractGoCtorResults(root) {
+    const out = {};
+    for (const child of namedChildren(root)) {
+        if (child.type !== "function_declaration")
+            continue;
+        const name = child.childForFieldName("name")?.text;
+        if (!name)
+            continue;
+        let r = child.childForFieldName("result") ?? undefined;
+        if (r?.type === "pointer_type")
+            r = r.namedChild(0) ?? undefined;
+        if (r?.type === "type_identifier")
+            out[name] = r.text;
+    }
+    return out;
+}
 function kotlinPackage(root) {
     const pkg = namedChildren(root).find((n) => n.type === "package_header");
     return pkg ? namedChildren(pkg).find((n) => n.type === "identifier")?.text : undefined;
@@ -860,6 +901,11 @@ function goShortVarCalls(stmt) {
 function extractGoProofCalls(root, imports) {
     const out = [];
     const seen = new Set();
+    // Var name → constructor name for locals declared in the CURRENT test func by a
+    // bare same-package `x := New(...)` (single unqualified call). Reset per top-level
+    // test func; marks a qualified proof-call `p.M()` as receiver-local AND carries
+    // the ctor name so the analyzer can pin p's receiver type from New's result.
+    let receiverLocals = new Map();
     const assertLocals = goAssertLocals(imports);
     const dotAssertMethods = goDotAssertMethods(root);
     const suiteTypes = goCanonicalSuiteTypes(root, goSuiteLocals(imports));
@@ -869,7 +915,8 @@ function extractGoProofCalls(root, imports) {
             if (seen.has(key))
                 continue;
             seen.add(key);
-            out.push({ caller: testName, testName, ...c, shadowed: [...shadowed], assertion, ...(assertionLine ? { assertionLine } : {}) });
+            const receiverCtor = c.via === "qualified" && !!c.qualifier && !c.qualifier.includes(".") ? receiverLocals.get(c.qualifier) : undefined;
+            out.push({ caller: testName, testName, ...c, shadowed: [...shadowed], assertion, ...(assertionLine ? { assertionLine } : {}), ...(receiverCtor ? { receiverLocal: true, receiverCtor } : {}) });
         }
     };
     const processBlock = (block, testName, testingParams, shadowed) => {
@@ -934,7 +981,29 @@ function extractGoProofCalls(root, imports) {
                 for (const name of sv.names)
                     pending.set(name, sv.calls);
             }
+            if (stmt.type === "short_var_declaration") {
+                // A lone `x := New(...)` makes x a receiver-local: its type comes from a
+                // same-package constructor, so `x.M()` targets a same-package method. This
+                // check inspects the TOP-LEVEL RHS call directly (not goShortVarCalls, whose
+                // single-product-call rule drops `New(strings.NewReader(...))` for its nested
+                // arg — the real phcparser shape). Refuses composite literals, qualified/
+                // imported calls, and multi-assign — none are receiver-locals.
+                const rhsNames = new Set();
+                collectNames(stmt.childForFieldName("left") ?? stmt.namedChild(0), rhsNames);
+                const rhs = stmt.childForFieldName("right");
+                const rhsCalls = rhs ? namedChildren(rhs).filter((n) => n.type === "call_expression") : [];
+                if (rhsNames.size === 1 && rhsCalls.length === 1) {
+                    const cp = callParts(rhsCalls[0], "go");
+                    if (cp && cp.via === "free")
+                        receiverLocals.set([...rhsNames][0], cp.callee);
+                }
+            }
             else if (stmt.type === "assignment_statement") {
+                // Reassigning a receiver-local invalidates it too.
+                const reassignedRl = new Set();
+                collectNames(stmt.childForFieldName("left") ?? stmt.namedChild(0), reassignedRl);
+                for (const name of reassignedRl)
+                    receiverLocals.delete(name);
                 // Plain reassignment kills the binding — the checked value is no longer F's.
                 const reassigned = new Set();
                 collectNames(stmt.childForFieldName("left") ?? stmt.namedChild(0), reassigned);
@@ -979,6 +1048,7 @@ function extractGoProofCalls(root, imports) {
         const body = child.childForFieldName("body");
         if (!testingParams.size || !body)
             continue;
+        receiverLocals = new Map();
         processBlock(body, name, testingParams, localBindings(child, "go"));
     }
     return out;
@@ -1442,7 +1512,14 @@ export function extractTreeSitterStructure(content, language) {
                 nextInsideFunction = true;
             }
             else {
-                const name = functionName(node, language);
+                let name = functionName(node, language);
+                // Go method symbols are receiver-qualified — attribute calls to the
+                // qualified caller so Layer-1 edges keep matching the emitted symbol.
+                if (name && language === "go" && node.type === "method_declaration") {
+                    const recv = goReceiverBaseName(node);
+                    if (recv)
+                        name = `${recv}.${name}`;
+                }
                 if (name) {
                     nextCaller = name;
                     nextShadowed = localBindings(node, language);
@@ -1461,7 +1538,7 @@ export function extractTreeSitterStructure(content, language) {
     const imports = extractImports(root, language);
     const result = {
         ...(language === "java" ? { packageName: javaPackage(root), javaClasses: javaClassInfos(root), javaProofCalls: extractJavaProofCalls(root, imports) } : {}),
-        ...(language === "go" ? { packageName: goPackage(root) } : {}),
+        ...(language === "go" ? { packageName: goPackage(root), goCtorResults: extractGoCtorResults(root) } : {}),
         ...(language === "kotlin" ? { packageName: kotlinPackage(root), topLevelSymbols: kotlinTopLevelSymbols(root) } : {}),
         ...(language === "php" ? { moduleName: phpNamespace(root) } : {}),
         ...(language === "csharp" ? { moduleName: csharpNamespace(root) } : {}),

package/dist/local/autoProve.js

@@ -108,15 +108,18 @@ function pytestNodeidsForTarget(sourceRoot, testRel, testName) {
  * `behavior_surface === "entrypoint_adjacent"`, and carrying NO `denominator_reason_code`
  * (infra_behavior_surface / not_entry_point_adjacent).
  *
- * Language: TS/JS (unchanged), Go (G-INT-2), OR Java (J-INT-2). Go dynamic proof
- * (G-1) proves FREE FUNCTIONS ONLY — a Go method classifies `unrunnable` and never
- * mints, so admitting one is safe (never a false Proven) but wastes an attempt; when
- * the clean `symbol_kind === "method"` signal is present we exclude it up front. Java
- * dynamic proof (J-1) is the INVERSE — it proves single-top-level-return METHODS, so
- * we admit Java methods; a non-J-1-shape method (void/constructor/nested/generic) just
- * classifies `unrunnable` and never mints, safe by construction. Everything downstream
- * of `closed`/the cert is language-agnostic and mints Go/Java only through the
- * unchanged G-INT-1/J-INT-1 gates.
+ * Language: TS/JS (unchanged), Go (G-INT-2), OR Java (J-INT-2). This STRICT predicate
+ * keeps Go to FREE FUNCTIONS ONLY. The Go oracle can also prove receiver METHODS, but
+ * a method's no-false-Proven story rests entirely on the analyzer-minted hard
+ * receiver-local TESTED_BY/COVERS edge (package-unique method-name gating) — so Go
+ * methods are admitted solely by `isEligibleHardExistingTarget` on the hard-edge lane,
+ * never here: this predicate also feeds PR/changed-scope selection, weak MAY_*
+ * expansion, and generation candidate filtering, where no hard edge backs the pick.
+ * Java dynamic proof (J-1) is the INVERSE — it proves single-top-level-return METHODS,
+ * so we admit Java methods; a non-J-1-shape method (void/constructor/nested/generic)
+ * just classifies `unrunnable` and never mints, safe by construction. Everything
+ * downstream of `closed`/the cert is language-agnostic and mints Go/Java only through
+ * the unchanged G-INT-1/J-INT-1 gates.
  */
 export function isEligibleProvableTarget(node) {
     if (!node || node.kind !== "CodeSymbol")
@@ -133,18 +136,27 @@ export function isEligibleProvableTarget(node) {
  * The LANGUAGE + oracle-SHAPE half of eligibility, factored out so both the strict
  * `isEligibleProvableTarget` (which layers the entry-point-adjacent SCOPE guards on top)
  * and the relaxed hard-edge existing-tests path share ONE definition of "a shape the
- * oracle can prove". CodeSymbol + a TS/JS file, a Go free function, a Java method, or a
- * Python function/method.
+ * oracle can prove". CodeSymbol + a TS/JS file, a Go free function (a receiver method
+ * only when the caller opts in via `allowGoMethod`), a Java method, or a Python
+ * function/method.
  */
-function matchesProvableLanguageShape(node) {
+function matchesProvableLanguageShape(node, opts) {
     if (node.kind !== "CodeSymbol")
         return false;
     const file = codeSymbolFile(node);
     if (isTsJsFile(file))
         return true;
-    // Go: free functions only. A method is out of scope for the Go oracle (G-1 refuses it).
-    if (isGoFile(file))
-        return node.properties.symbol_kind !== "method";
+    // Go: free functions only, unless the caller opts into methods (`allowGoMethod`).
+    // Only the hard-edge lane opts in: a method's no-false-Proven story rests on the
+    // analyzer's uniqueness-gated receiver-local TESTED_BY/COVERS edge, which the strict
+    // callers (changed-scope selection, weak MAY_* expansion, generation candidates)
+    // do not have — admitting methods there would break the invariant that a Go method
+    // only ever becomes a proof attempt via a hard receiver-local edge.
+    if (isGoFile(file)) {
+        if (node.properties.symbol_kind === "function")
+            return true;
+        return opts?.allowGoMethod === true && node.properties.symbol_kind === "method";
+    }
     // Java: METHODS only (J-1 proves single-top-level-return methods). A non-J-1-shape
     // method classifies `unrunnable` and never mints, so admitting all Java methods is
     // safe (never a false Proven); a non-method Java symbol (a class container) is out
@@ -173,7 +185,11 @@ function matchesProvableLanguageShape(node) {
  * by the frozen oracle, never false-Proven. Guards deliberately KEPT:
  *   - `infra_behavior_surface` still excludes plumbing (getters/registry accessors) — a
  *     hard edge does not buy an infra symbol an attempt (waste, and preserves the #4 bar);
- *   - the language + oracle-shape filter (never hand a class container / Go method down).
+ *   - the language + oracle-shape filter (never hand a class container down).
+ * This is also the ONLY caller that admits Go receiver METHODS (`allowGoMethod`): it is
+ * reached solely behind a hard TESTED_BY/COVERS edge, and the analyzer mints a method
+ * edge only for the uniqueness-gated receiver-local shape — the strict predicate keeps
+ * Go methods out of every other selection path.
  * Used solely on the hard lane; weak MAY_* fan-out stays strict.
  */
 function isEligibleHardExistingTarget(node) {
@@ -181,7 +197,7 @@ function isEligibleHardExistingTarget(node) {
         return false;
     if (node.properties.denominator_reason_code === "infra_behavior_surface")
         return false;
-    return matchesProvableLanguageShape(node);
+    return matchesProvableLanguageShape(node, { allowGoMethod: true });
 }
 /** Go `_test.go` top-level test-name regex (matches `extractTestNames`'s Go pattern). */
 const GO_TEST_NAME_RE = /^Test[A-Za-z0-9_]+$/;
@@ -206,9 +222,10 @@ function anchorGoTestRun(name) {
  * its target test BY NAME (`go test -run ^TestX$`), so auto-drive must derive that
  * name — G-INT-1 took it as an explicit input.
  *
- * The link is the analyzer's HARD `TESTED_BY`/`COVERS` proof edge (Go free-fn sym ↔
- * `test:<file>_test.go`), emitted only for an eligible Go symbol whose test genuinely
- * asserts on it. PRIMARY: the edge carries `properties.test_name` — the EXACT enclosing
+ * The link is the analyzer's HARD `TESTED_BY`/`COVERS` proof edge (Go sym — free fn,
+ * or receiver-local method — ↔ `test:<file>_test.go`), emitted only for an eligible Go
+ * symbol whose test genuinely asserts on it. PRIMARY: the edge carries
+ * `properties.test_name` — the EXACT enclosing
  * `func TestXxx` where the assertion witnessed THIS target (structural metadata, never
  * proof) — which disambiguates even a `_test.go` file with many tests. FALLBACK (old
  * graphs / no edge metadata): the linked TestCase node's file-level `test_names[]`,
@@ -519,7 +536,8 @@ export function existingAssociatedTests(graph, nodeById) {
     };
     // `hard` = TESTED_BY/COVERS (the confirmer's structural links); weak = MAY_* candidate
     // edges. Hard is recorded before weak (graph.edges scanned first), so a test already
-    // linked hard is never downgraded; a later weak dup only upgrades an existing weak to hard.
+    // linked hard is never downgraded, and a later weak dup of the same pair is a no-op —
+    // the hard flag can only ever originate from a genuine TESTED_BY/COVERS edge.
     const add = (symId, testRel, hard, testName) => {
         // A HARD TESTED_BY/COVERS edge is a real derivable test; admit it even when the symbol
         // is not_entry_point_adjacent (relaxed shape-only guard). Weak MAY_* fan-out stays strict.

package/dist/local/cli.js

@@ -2,6 +2,7 @@
 import { parseArgs, collectSetupCommands } from "./cliArgs.js";
 import { opAnalyze, opAiFlows, opAiLinks, opChanged, opCompare, opDoctor, opProofDoctor, opDynamicProof, opExplain, opGaps, opGenerate, opBehaviorCoverageHtml, opCoverageReport, opInit, opProveLoop, opRuntimeCoverage, opScore, opRecordRun, opRtm, opStats, opStatus, opUpdate, opSetModelDefault, opStart, getModelDefault, resolveDiffTargets, resolvePrCheckout, writeCompareReport } from "./operations.js";
 import { dominantBlockReason } from "./viz/behaviorReportData.js";
+import { coverageRevealLine } from "./viz/coverageReveal.js";
 import { autoProve, isRoastSurvivor } from "./autoProve.js";
 import { opRecipeDbSqljs } from "./recipe/dbSqljs.js";
 import { runExportCli } from "./exportCli.js";
@@ -236,6 +237,11 @@ async function main() {
                         out(`    skipped:             ${skip.target_symbol ?? skip.title} — ${skip.reason}`);
                 }
                 out(`  Runtime-covered:       ${res.rtm.summary.runtime_covered}`);
+                // G6: same-denominator coverage-vs-proof reveal — renders only when runtime
+                // coverage was ingested; percentages share summary.total (never mixed scopes).
+                const reveal = coverageRevealLine(res.rtm.summary);
+                if (reveal)
+                    out(`  ${reveal}`);
                 out(`  Statically Linked:     ${res.rtm.summary.associated} (static test link, not dynamic proof)`);
                 out(`  No integration signal: ${res.rtm.summary.no_link}`);
                 out(`  AI-linked:      ${res.ai_linked.behaviors} behavior(s), ${res.ai_linked.symbols} symbol(s), ${res.ai_linked.links} weak link(s) — not coverage`);

package/dist/local/graph/ontology.js

@@ -9,7 +9,9 @@
  * The graph is built directly by OrangePro; it does not depend on any
  * third-party graph product or format.
  */
-export const LOCAL_GRAPH_SCHEMA_VERSION = "orangepro.local_graph.v1";
+// v2: Go method symbol ids are receiver-qualified (`sym:file.go#Recv.M`) — old
+// graphs hold bare-name method ids and must force-rebuild (loadGraph hard-fails).
+export const LOCAL_GRAPH_SCHEMA_VERSION = "orangepro.local_graph.v2";
 /** Node kinds that map to behaviors/requirements for scoring + gaps + generation. */
 export const BEHAVIOR_KINDS = new Set([
     "Requirement",

package/dist/local/operations.js

@@ -273,11 +273,14 @@ function symbolTargetParts(symExtId) {
         throw new Error(`Cannot derive dynamic proof target from symbol id: ${symExtId}`);
     }
     const [, file, symbolName] = match;
-    const method = symbolName.split(".").filter(Boolean).pop();
+    const segments = symbolName.split(".").filter(Boolean);
+    const method = segments.pop();
     if (!file || !method) {
         throw new Error(`Cannot derive dynamic proof target from symbol id: ${symExtId}`);
     }
-    return { file, method };
+    // The owner qualifier of a member id (TS `Class.method`, Go `Recv.M`). The Go
+    // lane passes it as --recv so the mutator matches the exact receiver.
+    return { file, method, ...(segments.length ? { memberQualifier: segments.join(".") } : {}) };
 }
 function assertProofTargetMatchesSymbol(opts, symbolTarget) {
     if (opts.target_path !== undefined && opts.target_path !== "") {
@@ -560,8 +563,9 @@ export function opAnalyze(root, opts = {}, deps = defaultDeps()) {
         ? (!opts.suppressProgress && reportProgress("coverage: generating local runtime coverage before graph build", { current: 2, total: 4 }),
             prepareRuntimeCoverage(scanRoot, { generate: true, timeoutMs: opts.coverageTimeoutMs, runner: deps.coverageRunner }))
         : undefined;
-    if (!workspaceInitialized(root))
-        initWorkspace(root, now);
+    // Idempotent for existing workspaces and also applies conservative migrations
+    // to untouched generated workspace files (for example .orangeproignore).
+    initWorkspace(root, now);
     if (!opts.suppressProgress) {
         reportProgress("analyze: parsing source and building deterministic graph", {
             current: opts.generateCoverage ? 3 : 2,
@@ -1007,6 +1011,10 @@ export function opDynamicProof(root, opts, deps = defaultDeps()) {
         // Slice 2: bind a runtime-named subtest's mutant failure to the exact assertion line.
         if (opts.go_assertion_line !== undefined)
             args.push("--go-assertion-line", String(opts.go_assertion_line));
+        // Receiver-qualified method target (`sym:file.go#Recv.M`) → the mutator must
+        // match the exact receiver, never a same-named decl on another type.
+        if (symbolTarget.memberQualifier)
+            args.push("--recv", symbolTarget.memberQualifier);
         const run = (deps.dynamicProofRunner ?? defaultDynamicProofRunner)(args, {
             cwd: goRoot,
             scriptPath: dynamicProofSpikePathFor("go")
@@ -1458,6 +1466,28 @@ export function autoProveChangedScope(graph, changed, baseRef) {
     });
     return hasEligibleTarget ? meaningful : undefined; // no eligible provable target in scope → global top-5
 }
+function writeStartStaticSnapshot(root, baseRef, warnings) {
+    let behaviorCoveragePath;
+    try {
+        reportProgress("artifacts: writing static behavior view (proof still running)", { current: 4, total: 8 });
+        behaviorCoveragePath = opBehaviorCoverageHtml(root, `${WORKSPACE_DIR}/behavior-coverage.html`, {
+            attempted: 0,
+            proven: 0,
+            needsSetup: []
+        }).behavior_coverage_path;
+    }
+    catch (error) {
+        warnings.push(`static behavior view not written: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    try {
+        reportProgress("artifacts: writing static RTM (proof still running)", { current: 4, total: 8 });
+        opRtm(root, { format: "md", baseRef, limit: START_RTM_LIMIT });
+    }
+    catch (error) {
+        warnings.push(`static RTM not written: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return behaviorCoveragePath ? { behaviorCoveragePath } : {};
+}
 export async function opStart(root, opts = {}, deps = defaultDeps()) {
     const providerOpts = startProviderOverride(root, opts);
     const scanRoot = opts.source ? resolve(opts.source) : resolve(root);
@@ -1475,6 +1505,7 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
     }, deps);
     const warnings = [...analyze.warnings];
     reportProgress("start: deterministic graph is ready", { current: 4, total: 8 });
+    const staticSnapshot = writeStartStaticSnapshot(root, opts.baseRef, warnings);
     const providerConfigured = deps.aiProvider !== undefined || resolveProviderConfig(providerEnv, providerOpts) !== null;
     let aiLinks = { status: "skipped", reason: "AI candidate links disabled for this run." };
     if (opts.ai !== false) {
@@ -1611,7 +1642,7 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
     catch (error) {
         warnings.push(`coverage report not written: ${error instanceof Error ? error.message : String(error)}`);
     }
-    let coverageHtml;
+    let coverageHtml = staticSnapshot.behaviorCoveragePath;
     try {
         reportProgress("artifacts: writing behavior coverage view", { current: 7, total: 8 });
         // Forward THIS-RUN dynamic-proof outcome so the report can name the dominant setup/runnability

package/dist/local/util/walk.js

@@ -66,20 +66,21 @@ export function loadIgnore(root) {
             const line = raw.trim();
             if (!line || line.startsWith("#") || line.startsWith("!"))
                 continue;
+            const rootAnchored = line.startsWith("/");
             const cleaned = line.replace(/^\/+/, "").replace(/\/+$/, "");
             if (!cleaned)
                 continue;
-            if (!cleaned.includes("/") && !cleaned.includes("*")) {
+            if (!rootAnchored && !cleaned.includes("/") && !cleaned.includes("*")) {
                 names.add(cleaned);
             }
             else {
-                matchers.push(globToRegExp(cleaned));
+                matchers.push(globToRegExp(cleaned, rootAnchored));
             }
         }
     }
     return { names, matchers };
 }
-function globToRegExp(glob) {
+function globToRegExp(glob, rootAnchored = false) {
     // Use a plain-ASCII sentinel for `**` so the file stays text (no NUL bytes)
     // and `*` substitution does not re-match the globstar.
     const GLOBSTAR = "__ORANGEPRO_GLOBSTAR__";
@@ -90,7 +91,7 @@ function globToRegExp(glob) {
         .split(GLOBSTAR)
         .join(".*")
         .replace(/\?/g, "[^/]");
-    return new RegExp(`(^|/)${escaped}(/|$)`);
+    return new RegExp(`${rootAnchored ? "^" : "(^|/)"}${escaped}(/|$)`);
 }
 function isIgnored(relPath, baseName, rules) {
     if (rules.names.has(baseName))

package/dist/local/viz/coverageReveal.js

@@ -0,0 +1,29 @@
+/**
+ * G6 — the coverage-vs-proof reveal line for the start summary.
+ *
+ * Compares ONLY same-scope numbers: both sides are RTM counts over the SAME
+ * denominator (`summary.total`). The proven side is `coverage_confirmed` — the
+ * IN-DENOMINATOR proven count — never `summary.proven`, which also counts
+ * off-denominator proofs (relaxed hard-edge targets below the entry-point bar)
+ * and can exceed `total` (a 5/3 = 167% render). The signature omits `proven`
+ * entirely so the off-denominator number cannot be passed by mistake.
+ *
+ * `runtime_covered` is the DISJOINT runtime tier — behaviors a repo coverage
+ * report executed that are NOT dynamically proven. Runtime coverage only proves
+ * EXECUTION, and the unproven side may simply be unattempted or unrunnable —
+ * the line says so and never blames the tests outright. Source-report
+ * line-coverage totals (lcov LF/LH etc.) are NOT retained by ingestion and are
+ * never invented here (spec G6 guardrail). Never implies proven SHOULD equal
+ * coverage — they measure different things.
+ *
+ * Null when no runtime coverage was ingested (nothing to reveal) or the
+ * denominator is empty.
+ */
+export function coverageRevealLine(summary) {
+    if (summary.runtime_covered <= 0 || summary.total <= 0)
+        return null;
+    const pct = (n) => Math.round((n / summary.total) * 100);
+    return (`Coverage vs proof: ${summary.runtime_covered}/${summary.total} behaviors are runtime-covered but not Dynamically Proven ` +
+        `(${pct(summary.runtime_covered)}%) vs ${summary.coverage_confirmed}/${summary.total} Dynamically Proven (${pct(summary.coverage_confirmed)}%) — ` +
+        `coverage only proves execution; the unproven side may be unattempted, blocked, or covered by tests that never assert these behaviors.`);
+}

package/dist/local/workspace.js

@@ -21,7 +21,7 @@ export function workspaceInitialized(root) {
 export function graphExists(root) {
     return existsSync(workspacePaths(root).graphPath);
 }
-const ORANGEPROIGNORE_TEMPLATE = `# .orangeproignore — paths the OrangePro local proof kit should never read.
+const ORANGEPROIGNORE_PREAMBLE = `# .orangeproignore — paths the OrangePro local proof kit should never read.
 # Same spirit as .gitignore. Secrets and large assets are excluded by default.
 *.env
 *.pem
@@ -32,7 +32,8 @@ secrets/
 
 # Product-denominator defaults: example/demo apps are useful references, but
 # they usually should not count as product behavior coverage.
-examples/
+`;
+export const LEGACY_ORANGEPROIGNORE_TEMPLATE = `${ORANGEPROIGNORE_PREAMBLE}examples/
 example/
 demos/
 demo/
@@ -42,6 +43,16 @@ docs/examples/
 docs/demo/
 docs/demos/
 `;
+export const ORANGEPROIGNORE_TEMPLATE = `${ORANGEPROIGNORE_PREAMBLE}/examples/
+/example/
+/demos/
+/demo/
+/samples/
+/sample/
+/docs/examples/
+/docs/demo/
+/docs/demos/
+`;
 export function initWorkspace(root, now) {
     const paths = workspacePaths(root);
     mkdirSync(paths.dir, { recursive: true });
@@ -58,6 +69,18 @@ export function initWorkspace(root, now) {
     if (!existsSync(ignorePath)) {
         writeFileSync(ignorePath, ORANGEPROIGNORE_TEMPLATE, "utf8");
     }
+    else {
+        // Upgrade only the untouched generated template. A user-edited ignore file
+        // is configuration and must never be rewritten implicitly.
+        try {
+            if (readFileSync(ignorePath, "utf8") === LEGACY_ORANGEPROIGNORE_TEMPLATE) {
+                writeFileSync(ignorePath, ORANGEPROIGNORE_TEMPLATE, "utf8");
+            }
+        }
+        catch {
+            // A read-only or transiently unavailable ignore file must not fail init.
+        }
+    }
     return { paths, config: loadConfig(paths) };
 }
 export function loadConfig(paths) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orangepro/orangepro-mcp",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "private": false,
   "description": "OrangePro (`opro`) — a local-first, BYOK CLI + MCP server that builds an evidence graph from a local checkout, ingests runtime coverage, and generates grounded tests. Metadata-only exports; no source upload; generated tests stay local.",
   "license": "MIT",

package/scripts/spikes/go-dynamic-proof-spike.mjs

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 // go-dynamic-proof-spike.mjs — Go dynamic-proof MECHANISM (G-1).
 //
-// Proves ONE free function 0->1 on a single Go module by mutation: it byte-copies
+// Proves ONE free function or receiver method 0->1 on a single Go module by
+// mutation: it byte-copies
 // the module into a hermetic sandbox, runs `go test -json` baseline, replaces the
 // target function body with a signature-derived sentinel (via go-mutate.go), reruns
 // the SAME test, and classifies. It emits a JSON verdict mirroring the TS/JS spike's
@@ -21,12 +22,13 @@
 // assertion call (`t.Error`/`t.Errorf`, or testify `assert.`/`require.`), NOT a
 // `t.Fatal`/`t.Fatalf`/`t.FailNow`/`t.SkipNow` hard-stop or a helper call. A build
 // error, a panic, a t.Fatal precondition, a setup/helper failure, an unbindable
-// failure, and an ambiguous/method/no-return name all classify as `unrunnable`,
+// failure, and an ambiguous or no-return name all classify as `unrunnable`,
 // never `proven`. An equivalent-value mutation survives -> `associated_survived`.
 //
-// This is a spike harness only: it writes no graph edges or product artifacts and is
-// NOT wired into autoProve / cert / RTM / the mint path. Use only on trusted checkouts
-// for local measurement.
+// PRODUCT-WIRED: `opro` routes Go dynamic proof through this script (operations.ts
+// dynamicProofSpikePathFor("go")). The script itself writes no graph edges or product
+// artifacts — it emits a JSON verdict; the orchestrator is the sole interpreter and
+// the only place proof is minted.
 import { spawnSync } from "node:child_process";
 import { cpSync, existsSync, lstatSync, mkdtempSync, mkdirSync, readFileSync, rmSync, symlinkSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -39,11 +41,12 @@ function usage() {
   return [
     "Usage: node scripts/spikes/go-dynamic-proof-spike.mjs --root <module> --test-run <^TestName$> --target <rel.go> --func <name> [--json]",
     "",
-    "Runs a Go baseline test, mutates the target free function body in an isolated byte-copy, reruns the same test, and classifies the result.",
+    "Runs a Go baseline test, mutates the target free function or method body in an isolated byte-copy, reruns the same test, and classifies the result.",
     "--test-run is passed verbatim to `go test -run` and should anchor a single test, e.g. '^TestCompute$'.",
+    "--recv <T> (optional): receiver base type — mutate only `func (x T) <name>` / `func (x *T) <name>`, so a same-named method on another receiver (or a free function) can never be the mutation target.",
     "--go-assertion-line <n> (optional): 1-based test-source line of the target's assertion. When set, the mutant's failure must bind to a frame at EXACTLY that line and subtest frames are considered — so a runtime-named subtest can prove while a sibling asserting elsewhere is refused.",
-    "G-1 scope: FREE FUNCTIONS ONLY. Methods are refused (unrunnable). Equivalent-value mutations survive (associated_survived).",
-    "This is a spike harness only; it does not write graph edges or product artifacts and is not wired into prove/RTM/mint."
+    "Scope: free functions and receiver methods. Without --recv the name must resolve to exactly ONE declaration in the target file; with --recv exactly one declaration on the selected base receiver must match. Ambiguity within the filtered receiver and generic receivers still fail closed. Equivalent-value mutations survive (associated_survived).",
+    "Product wiring: opro prove/auto-prove invokes this script for Go targets; it writes no graph edges or product artifacts itself — the caller interprets the JSON verdict."
   ].join("\n");
 }
 
@@ -460,9 +463,9 @@ function redactSecrets(text) {
 // Run the AST mutator (go run go-mutate.go). Because `go run` collapses any
 // non-zero child status to 1, we classify on the MUTATE_ERROR:<code> marker the
 // helper prints to stderr, not the exit code.
-function mutateFunc({ targetAbs, func, mode, cacheRoot, timeoutMs }) {
+function mutateFunc({ targetAbs, func, recv, mode, cacheRoot, timeoutMs }) {
   const helper = path.join(path.dirname(fileURLToPath(import.meta.url)), "go-mutate.go");
-  const result = spawnSync(goBin(), ["run", helper, "--file", targetAbs, "--func", func, "--mode", mode], {
+  const result = spawnSync(goBin(), ["run", helper, "--file", targetAbs, "--func", func, ...(recv ? ["--recv", recv] : []), "--mode", mode], {
     encoding: "utf8",
     timeout: timeoutMs,
     env: hermeticEnv(cacheRoot),
@@ -481,9 +484,9 @@ function mutateFunc({ targetAbs, func, mode, cacheRoot, timeoutMs }) {
 
 function mutateErrorReason(code) {
   switch (code) {
-    case 3: return "target function name is ambiguous (more than one free function)";
-    case 4: return "target free function was not found";
-    case 5: return "target is a method (out of scope for G-1)";
+    case 3: return "target name is ambiguous (more than one free function or method)";
+    case 4: return "target free function or method was not found";
+    // code 5 (method out of scope) is retired — methods are mutable now, never emitted.
     case 6: return "target function has no return value (not mutable)";
     default: return "mutation could not be applied";
   }
@@ -565,6 +568,7 @@ function main() {
     const mutation = mutateFunc({
       targetAbs: path.join(mutantCopy.repoRoot, targetRel),
       func: args.func,
+      recv: args.recv,
       mode: args.mode,
       cacheRoot: mutantCopy.tmpRoot,
       timeoutMs

package/scripts/spikes/go-mutate.go

@@ -2,11 +2,16 @@
 
 // go-mutate.go — AST-based body replacer for the Go dynamic-proof spike (G-1).
 //
-// Locates ONE free function `func Name(params) rets { ... }` by exact name and
-// replaces its BODY with a signature-derived sentinel, then writes the mutated
-// file. It is a spike helper only: it writes no product artifacts and is not
-// wired into prove/RTM/mint. G-1 scope is FREE FUNCTIONS ONLY — methods
-// (`func (r Recv) M()`) are recognized and refused as out-of-scope (G-2).
+// Locates ONE function declaration by exact name — a free function `func Name(...)`
+// or a receiver method `func (r Recv) Name(...)` — and replaces its BODY with a
+// signature-derived sentinel, then writes the mutated file. Invoked by
+// go-dynamic-proof-spike.mjs (the product Go proof path); it writes ONLY the
+// mutated file inside the sandbox copy — no graph or product artifacts. The
+// name must resolve to exactly ONE declaration — in the whole file without
+// --recv, or on the selected base receiver with --recv <T> (receiver-exact
+// selection for receiver-qualified `Recv.M` targets — never the wrong decl,
+// so A.M and B.M can coexist and still be individually mutable). Ambiguity
+// within that filter fails(3); generic receivers are refused (not found).
 //
 // Modes:
 //   sentinel   — replace body with a type-compatible, deliberately-wrong value
@@ -19,9 +24,10 @@
 // Exit codes (distinct, so the Node orchestrator can classify precisely):
 //   0  ok, mutated file written
 //   2  usage / IO / parse error
-//   3  ambiguous: more than one free function with that name
-//   4  not found: no free function with that name
-//   5  out of scope: a METHOD with that name exists (G-2, refused in G-1)
+//   3  ambiguous: more than one declaration (free and/or method) with that name
+//   4  not found: no free function or method with that name
+//   5  RETIRED — was "method out of scope (G-2)" before methods became mutable;
+//      no longer emitted (kept so codes 3/4/6 stay stable for the orchestrator)
 //   6  not mutable: the function has no return values (no signature-derived
 //      sentinel is possible) -> fail closed, never mutated
 package main
@@ -51,7 +57,8 @@ func fail(code int, format string, args ...any) {
 
 func main() {
 	file := flag.String("file", "", "path to the Go source file to mutate")
-	fn := flag.String("func", "", "exact name of the free function to mutate")
+	fn := flag.String("func", "", "exact name of the free function or method to mutate")
+	recv := flag.String("recv", "", "receiver base type name; when set, match only methods on this receiver")
 	out := flag.String("out", "", "path to write the mutated file (defaults to --file)")
 	mode := flag.String("mode", "sentinel", "sentinel | equivalent")
 	flag.Parse()
@@ -73,31 +80,47 @@ func main() {
 		fail(2, "parse error: %v", err)
 	}
 
-	var freeMatches []*ast.FuncDecl
-	methodMatch := false
+	// Collect BOTH free functions and methods named *fn. The proof lane only ever
+	// targets a method whose name is UNIQUE in its package (the analyzer's
+	// uniqueGoPackageSymbol refuses cross-file collisions before an edge is minted);
+	// this file-scoped count is the in-file backstop, so free+method or two-method
+	// collisions fail(3) as ambiguous — never a mislabeled mutation. A lone decl
+	// (free OR method) is mutated identically via the receiver-agnostic sentinel.
+	var matches []*ast.FuncDecl
 	for _, decl := range astFile.Decls {
 		fd, ok := decl.(*ast.FuncDecl)
 		if !ok || fd.Name == nil || fd.Name.Name != *fn {
 			continue
 		}
-		if fd.Recv != nil { // method -> out of scope for G-1
-			methodMatch = true
+		// Refuse generic receivers (r T[U]) — receiver base type is not a bare Ident.
+		if fd.Recv != nil && recvBaseIdent(fd) == nil {
 			continue
 		}
-		freeMatches = append(freeMatches, fd)
+		// Receiver-exact selection: when --recv is set, only a method on that base
+		// receiver type matches — a free function or another receiver never can, so
+		// a receiver-qualified target can never mutate the wrong declaration.
+		if *recv != "" {
+			if fd.Recv == nil {
+				continue
+			}
+			if id := recvBaseIdent(fd); id == nil || id.Name != *recv {
+				continue
+			}
+		}
+		matches = append(matches, fd)
 	}
 
-	if len(freeMatches) > 1 {
-		fail(3, "ambiguous: %d free functions named %q", len(freeMatches), *fn)
+	if len(matches) > 1 {
+		fail(3, "ambiguous: %d declarations named %q (free and/or methods)", len(matches), *fn)
 	}
-	if len(freeMatches) == 0 {
-		if methodMatch {
-			fail(5, "out of scope: %q is a method (G-2); G-1 handles free functions only", *fn)
+	if len(matches) == 0 {
+		if *recv != "" {
+			fail(4, "not found: no method named %q on receiver %q", *fn, *recv)
 		}
-		fail(4, "not found: no free function named %q", *fn)
+		fail(4, "not found: no free function or method named %q", *fn)
 	}
 
-	target := freeMatches[0]
+	target := matches[0]
 	results := target.Type.Results
 	if results == nil || len(results.List) == 0 {
 		fail(6, "not mutable: %q has no return values; no signature-derived sentinel is possible", *fn)
@@ -160,6 +183,22 @@ func blankUnusedImports(f *ast.File) {
 	}
 }
 
+// recvBaseIdent returns the receiver type's base identifier for a method decl
+// (unwrapping a pointer receiver `*T` to `T`), or nil for a generic/unsupported
+// receiver. Used only to refuse generic receivers; value-vs-pointer is irrelevant
+// to body mutation (Go auto-(de)refs at the call site).
+func recvBaseIdent(fd *ast.FuncDecl) *ast.Ident {
+	if fd.Recv == nil || len(fd.Recv.List) != 1 {
+		return nil
+	}
+	t := fd.Recv.List[0].Type
+	if star, ok := t.(*ast.StarExpr); ok {
+		t = star.X
+	}
+	id, _ := t.(*ast.Ident)
+	return id
+}
+
 // sentinelBody builds `{ return <zero>, <zero>, ... }` matching the function's
 // result signature so the mutant COMPILES. Zero values are type-derived and
 // deliberately wrong for any function whose real return is non-zero; when a

package/scripts/spikes/java-dynamic-proof-spike.mjs

@@ -21,9 +21,11 @@
 // classify as `unrunnable`, never `proven`. An equivalent-value mutation survives ->
 // `associated_survived`. An ambiguous method name is refused -> `unrunnable`.
 //
-// This is a spike harness only: it writes no graph edges or product artifacts and
-// is NOT wired into autoProve / cert / RTM / the mint path. Pin: Maven + Surefire +
-// JUnit 5 (the Spring Boot default). Gradle / JUnit4 are later parsers.
+// PRODUCT-WIRED: `opro` routes Java dynamic proof through this script (operations.ts
+// dynamicProofSpikePathFor("java")). The script itself writes no graph edges or
+// product artifacts — it emits a JSON verdict; the orchestrator is the sole
+// interpreter and the only place proof is minted. Pin: Maven + Surefire + JUnit 5
+// (the Spring Boot default). Gradle / JUnit4 are later parsers.
 import { spawnSync } from "node:child_process";
 import { cpSync, existsSync, lstatSync, mkdtempSync, mkdirSync, readFileSync, readdirSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -40,7 +42,7 @@ function usage() {
     "",
     "Runs ONE Surefire target test on a byte-copy of a single-module Maven + JUnit 5 project, mutates the target method body via a signature-derived sentinel, reruns the SAME test, and classifies from the structured surefire report.",
     "J-1 scope: SIMPLEST SHAPE ONLY — a concrete non-void return, a single top-level return, no generics, no overloads. Equivalent-value mutations survive (associated_survived). Ambiguous names are refused (unrunnable).",
-    "This is a spike harness only; it does not write graph edges or product artifacts and is not wired into prove/RTM/mint."
+    "Product wiring: opro prove/auto-prove invokes this script for Java targets; it writes no graph edges or product artifacts itself — the caller interprets the JSON verdict."
   ].join("\n");
 }
 

package/scripts/spikes/java-mutate.mjs

@@ -5,8 +5,9 @@
 // by exact name via tree-sitter Java (the SAME grammar the static layer already
 // uses — tree-sitter-wasms + web-tree-sitter, no new dependency) and replaces its
 // BODY with a signature-derived, type-compatible sentinel by splicing the body
-// block's byte range. It is a spike helper only: it writes no product artifacts and
-// is not wired into prove / RTM / mint.
+// block's byte range. Invoked by java-dynamic-proof-spike.mjs (the product Java
+// proof path); it writes ONLY the mutated file inside the sandbox copy — no graph
+// or product artifacts.
 //
 // J-1 scope is the SIMPLEST SHAPE ONLY: a concrete non-void, non-type-variable
 // return type, EXACTLY one top-level `return <expr>;` (no nested return in an