@orangepro/orangepro-mcp 0.2.3 → 0.2.5

package/README.md

@@ -2,33 +2,52 @@
 
 **Find the behaviors your tests miss. Generate grounded tests that actually run.**
 
-`opro` builds a knowledge graph from your local checkout, maps every behavior in your code, shows which ones are tested and which aren't, and generates integration-level tests grounded in real symbols — not hallucinated imports. Runs as a CLI and an MCP server.
+`opro` builds a knowledge graph from your local checkout, maps every behavior in your code, shows which ones are tested and which aren't, and generates integration-level tests grounded in real symbols — not hallucinated imports. It runs as a CLI and a local stdio MCP server.
+
+Install the target repository's dependencies first, then run OrangePro from that repository:
 
 ```bash
-npx @orangepro/mcp-server
 cd /path/to/your/repo
-opro
+npm install # or pnpm install / bun install / the repository's package manager
+
+# Optional: enables AI candidate links, candidate flows, and test generation.
+export ANTHROPIC_API_KEY="..." # or OPENAI_API_KEY / OLLAMA_BASE_URL
+
+npx -y @orangepro/mcp-server@latest start . --prompt-version v5
+open .orangepro/behavior-coverage.html
 ```
 
-That's it. You get:
+With no model key, the same command still performs deterministic analysis, renders the report, and dynamically proves eligible behaviors using existing tests. With a key, it also discovers AI candidate flows and drafts grounded tests for the highest-risk gaps. AI output never changes evidence tiers; only the mutation-kill oracle can mint **Dynamically Proven**.
+
+The command writes:
 
 ```
 .orangepro/
-├── behavior-coverage.html   ← open this: interactive gap report
+├── behavior-coverage.html   ← open this: system map, risks, flows, behaviors
+├── graph.json               ← deterministic evidence graph
+├── COVERAGE_REPORT.md       ← coverage and gap summary
 ├── rtm.md                   ← requirements traceability matrix
-└── evidence-pack.json       ← machine-readable metadata export
+└── ai/                      ← candidate AI links/flows when a provider is configured
+
+orangepro_generated/         ← contained generated tests; existing source files are untouched
 ```
 
+The report opens on a **system map** of your repo — entry lanes (GraphQL/HTTP/Jobs) flowing into the services they reach, sized by traffic, colored by evidence tier, risk-ringed — identical on every run. Each rerun shows a **delta banner**: what changed since last run, or "No changes — identical graph, identical ranking." Every one of the ~N behaviors gets a plain-English description; every top risk gets a deterministic context line and a state-aware next step.
+
+Run `opro export` when you want a machine-readable evidence pack.
+<img width="895" height="960" alt="Screenshot 2026-07-08 at 1 18 01 AM" src="https://github.com/user-attachments/assets/73b8a812-2eab-43a1-8aed-4289545e630b" />
+
 ---
 
 ## Install
 
 ```bash
-# No install needed (npx)
-npx @orangepro/mcp-server
+# No install needed: run the full local workflow in the current repository
+npx -y @orangepro/mcp-server@latest start . --prompt-version v5
 
 # Or global install
 npm install -g @orangepro/orangepro-mcp
+opro start . --prompt-version v5
 
 # Or from source
 git clone https://github.com/OrangeproAI/orangepro-mcp.git
@@ -89,7 +108,6 @@ Add to your client's MCP config:
 
 | Client | Config location |
 | --- | --- |
-|--------|----------------|
 | Claude Code | `.mcp.json` or `~/.claude.json` |
 | Cursor | `~/.cursor/mcp.json` or Settings → MCP |
 | Codex | Config printed by `opro agent --client codex` or `npx -y @orangepro/mcp-server@latest agent --client codex` |
@@ -144,6 +162,7 @@ opro rtm                      # traceability matrix
 opro export                   # metadata-only evidence pack
 opro mcp                      # run as MCP server (stdio)
 opro doctor                   # what evidence to add next
+opro doctor --proof           # explain why dynamic proof could not close
 opro coverage                 # ingest runtime coverage
 ```
 
@@ -164,11 +183,13 @@ Each generated test includes:
 - **Run hints** — where to write it, how to run it
 - **Scenario bucket + technique** — what failure mode it targets and how
 
+If the environment can't run tests yet (dependencies not installed, runner unconfigured), rejected drafts are kept as **Manual tests** — scenario, Given/When/Then steps, synthetic test data, and expected outcome in plain English, with the exact blocker named. Install dependencies and re-run `opro start` to turn them into runnable tests. Runnable tests always replace Manual tests for the same behavior; the two are never mixed.
+
 ---
 
 ## Test categories
 
-Generation is evidence-gated. A category is produced only when the graph has supporting evidence — never padded with generic filler. These are the public local generation buckets. The broader concern taxonomy used by planning prompts is not a public coverage taxonomy and does not change report tiers.
+Generation is evidence-gated. A category is produced only when the graph has supporting evidence — never padded with generic filler. These are the local generation buckets. The report additionally shows each risk's **applicable testing categories** (contract, boundary limits, integration flow, state lifecycle, failure recovery, …), derived deterministically from graph facts — covered categories from real attached tests render normally; the rest render locked, meaning "warranted here, generated on the platform," never "hidden tests exist." Neither taxonomy changes evidence tiers.
 
 | Category | What it targets |
 |----------|-----------------|
@@ -189,11 +210,14 @@ Every behavior gets exactly one tier. Nothing is labeled "tested" on faith.
 |------|---------------|------------------|
 | **Dynamically Proven** | A real test kills a targeted mutant of this behavior | `opro prove` after writing/running a test |
 | **Runtime-covered** | Coverage tool executed this code | `opro start --generate-coverage` |
-| **Statically Linked** | Import/name/structural match links a test to this code | Automatic during analysis |
+| **Statically Linked** | A test **imports and calls** this code — a hard structural link | Automatic during analysis |
+| **Unconfirmed Candidate** | A lexically similar test file exists, but nothing links it — a lead, **not evidence** | Automatic; upgrade it by writing the linking test |
 | **No Signal** | Nothing tests this behavior yet | — |
 
 > **"Dynamically Proven 0" is normal on first run.** Static analysis always runs. Dynamic proof requires running tests against targeted mutations. That's the trust model — nothing is Dynamically Proven until a real test kills a real mutant.
 
+When runtime coverage is available, `opro start` also compares Runtime-covered and Dynamically Proven behaviors over the same deterministic denominator. It never compares source-line coverage with behavior proof or folds off-denominator proofs into that percentage.
+
 ---
 
 ## Language support
@@ -265,14 +289,17 @@ OrangePro separates **analysis** (what your code does) from **proof** (whether t
 | **Generate** | Grounded tests for top gaps, per-behavior | Yes (BYOK) |
 | **Prove** | Mutation-kill oracle confirms test actually breaks if behavior changes | No |
 
+Reruns are cache-accelerated: unchanged files skip re-parsing, BYOK stages don't re-spend tokens on unchanged inputs, and proof certificates persist in a local ledger until the certified file changes. Upgrading the tool auto-invalidates caches.
+
 ---
 
 ## Privacy
 
 - **No stored source.** Reads code in-process. Never uploads to an OrangePro server.
-- **No source mutation.** Never edits your existing files. Writes metadata to `.orangepro/`.
+- **No existing-source mutation.** Never edits existing source or test files. Writes metadata to `.orangepro/`; keyed auto-drive may write new, reviewable tests under `orangepro_generated/`.
 - **Metadata-only exports.** File paths, names, hashes, scores — not raw source.
 - **Your keys stay yours.** Read from env at call time, never persisted.
+- **BYOK is direct.** When AI lanes are enabled, grounded code context is sent directly to the model provider you configure; OrangePro's hosted service is not in that path.
 
 ---
 

package/dist/local/analyze/analyzer.js

@@ -1534,6 +1534,40 @@ export function analyzeRepo(root, opts = {}) {
             const symId = `sym:${targetRel}#${name}`;
             return codeSymbolIds.has(symId) ? symId : null;
         };
+        /**
+         * ALL package method symbols whose bare name is `bareName` — receiver-qualified
+         * `Recv.M` hits plus bare-named ones (underivable receiver). Go method symbols
+         * are minted qualified (engine `goReceiverBaseName`), so a bare test callee maps
+         * back through this. Same-named FREE functions never appear (kind-filtered):
+         * the mutator's receiver-exact `--recv` match means a free fn can never be
+         * mutated in a method attempt.
+         */
+        const goPackageMethodHits = (dir, bareName) => {
+            const suffix = `.${bareName}`;
+            const hits = [];
+            for (const f of goFilesByDir.get(dir) ?? []) {
+                if (isNonProductFile(f))
+                    continue;
+                for (const n of symbolsByFile.get(f) ?? []) {
+                    if ((n === bareName || n.endsWith(suffix)) && symbolKind(f, n) === "method")
+                        hits.push({ file: f, qualified: n });
+                }
+            }
+            return hits;
+        };
+        /**
+         * Receiver type pinned from a constructor's DECLARED result: `p := New(...)` →
+         * New's single `T`/`*T` result base name (engine `goCtorResults`, structurally
+         * capturable results only). Undefined — never a guess — when the ctor is not
+         * package-unique or its result was not capturable (multi-return, interface,
+         * qualified, generic): receiver pinning must fail closed.
+         */
+        const goCtorResultType = (dir, ctorName) => {
+            const ctorFile = uniqueGoPackageSymbol(dir, ctorName);
+            if (!ctorFile)
+                return undefined;
+            return nonTsStructureByFile.get(ctorFile)?.structure.goCtorResults?.[ctorName];
+        };
         const eligiblePythonSymbol = (targetRel, name) => {
             if (!targetRel || !(proofEligibleSymbolsByFile.get(targetRel) ?? []).includes(name))
                 return null;
@@ -1554,13 +1588,38 @@ export function analyzeRepo(root, opts = {}) {
             const symId = `sym:${targetRel}#${name}`;
             return codeSymbolIds.has(symId) ? symId : null;
         };
-        const resolveGoProofTarget = (testRel, structure, qualifier, callee, shadowed) => {
+        const resolveGoProofTarget = (testRel, structure, qualifier, callee, shadowed, receiverLocal, receiverCtor) => {
             if (!qualifier) {
                 if (shadowed.has(callee) || structure.packageName?.endsWith("_test"))
                     return null;
                 return eligibleGoSymbol(uniqueGoPackageSymbol(dirOf(testRel), callee), callee);
             }
             const rootQualifier = qualifier.split(".")[0];
+            // Receiver-local METHOD call `p.M()`: the qualifier `p` is a LOCAL by design
+            // (declared `p := New(...)`), so this must be checked BEFORE the qualifier-shadow
+            // guard (which exists to reject package-func names shadowed by locals, not receivers).
+            // Resolve the bare callee among the package's receiver-qualified method symbols
+            // (`Recv.M`):
+            //   - ONE method named M package-wide → take it (the #212 unique-name behavior;
+            //     the mutator's `--recv` exact match keeps the mutation on that receiver).
+            //   - MULTIPLE methods named M → pin the receiver TYPE from the constructor's
+            //     DECLARED result (`p := New(...)` → goCtorResultType, structurally provable
+            //     results only) and require exactly one `pin.M` hit; no provable pin → refuse
+            //     (the pre-pinning fail-closed behavior).
+            // The pin SELECTS only — it never rejects the unique candidate (an interface- or
+            // alias-returning ctor would name an abstraction, not a receiver, and a wrong
+            // selection is fail-safe anyway: the frozen oracle only fails closed in the
+            // survive direction). Callee and ctor both honor shadowing.
+            if (receiverLocal && !shadowed.has(callee) && !structure.packageName?.endsWith("_test")) {
+                const hits = goPackageMethodHits(dirOf(testRel), callee);
+                if (hits.length === 1)
+                    return eligibleGoSymbol(hits[0].file, hits[0].qualified);
+                const pinned = receiverCtor && !shadowed.has(receiverCtor) ? goCtorResultType(dirOf(testRel), receiverCtor) : undefined;
+                if (!pinned)
+                    return null;
+                const match = hits.filter((h) => h.qualified === `${pinned}.${callee}`);
+                return match.length === 1 ? eligibleGoSymbol(match[0].file, match[0].qualified) : null;
+            }
             if (shadowed.has(rootQualifier))
                 return null;
             const binding = structure.imports.find((i) => i.local === rootQualifier && i.kind === "module");
@@ -1730,7 +1789,7 @@ export function analyzeRepo(root, opts = {}) {
             const testExternalId = `test:${testRel}`;
             for (const proof of structure.goProofCalls ?? []) {
                 goProofAttempted++;
-                const symId = resolveGoProofTarget(testRel, structure, proof.qualifier, proof.callee, new Set(proof.shadowed));
+                const symId = resolveGoProofTarget(testRel, structure, proof.qualifier, proof.callee, new Set(proof.shadowed), proof.receiverLocal, proof.receiverCtor);
                 if (!symId)
                     continue;
                 const edgeKey = `${testExternalId}|${symId}`;

package/dist/local/analyze/behaviorContracts.js

@@ -6,8 +6,15 @@ const HTTP_METHODS = new Set(["get", "post", "put", "delete", "patch", "options"
 // - computed router methods/paths are ignored.
 // That is intentional while Endpoint nodes are informational only and excluded
 // from the coverage denominator.
-const NEST_METHOD_DECORATOR = /@(Get|Post|Put|Delete|Patch|Options|Head|All)\s*\(\s*(?:(["'`])([^"'`]*)\2)?\s*\)(?:\s|\/\*[\s\S]*?\*\/|\/\/[^\n]*\n)*?(?:public\s+|private\s+|protected\s+|async\s+)*([A-Za-z_$][A-Za-z0-9_$]*)\s*\(/g;
-const NEST_CONTROLLER_DECORATOR = /@Controller\s*\(\s*(?:(["'`])([^"'`]*)\1)?\s*\)\s*(?:export\s+)?class\s+([A-Za-z_$][A-Za-z0-9_$]*)/g;
+// Tolerates intermediate decorators (@UseGuards, @UseFilters, @HttpCode, …)
+// between the route decorator and the method name — decorator-stacked NestJS
+// controllers (Twenty: every route) previously produced ZERO endpoint contracts.
+const NEST_METHOD_DECORATOR = /@(Get|Post|Put|Delete|Patch|Options|Head|All)\s*\(\s*(?:(["'`])([^"'`]*)\2|\[\s*(["'`])([^"'`]*)\4\s*\])?\s*\)(?:\s|@[A-Za-z_$][A-Za-z0-9_$]*(?:\s*\((?:[^()]|\([^()]*\))*\))?|\/\*[\s\S]*?\*\/|\/\/[^\n]*\n)*?(?:public\s+|private\s+|protected\s+|async\s+)*([A-Za-z_$][A-Za-z0-9_$]*)\s*\(/g;
+const CLASS_DECLARATION = /(?:export\s+)?(?:abstract\s+)?class\s+([A-Za-z_$][A-Za-z0-9_$]*)/g;
+const NEST_GQL_METHOD_DECORATOR = /@(Query|Mutation|Subscription|ResolveField)\s*\((?:[^()]|\([^()]*\))*\)(?:\s|@[A-Za-z_$][A-Za-z0-9_$]*(?:\s*\((?:[^()]|\([^()]*\))*\))?|\/\*[\s\S]*?\*\/|\/\/[^\n]*\n)*?(?:public\s+|private\s+|protected\s+|async\s+)*([A-Za-z_$][A-Za-z0-9_$]*)\s*\(/g;
+const NEST_PROCESSOR_DECORATOR = /@Processor\s*\(\s*(?:(["'`])([^"'`]*)\1|[A-Za-z_$][A-Za-z0-9_$.]*)?\s*\)(?:\s|@[A-Za-z_$][A-Za-z0-9_$]*(?:\s*\((?:[^()]|\([^()]*\))*\))?|\/\*[\s\S]*?\*\/|\/\/[^\n]*\n)*?(?:export\s+)?class\s+([A-Za-z_$][A-Za-z0-9_$]*)/g;
+const NEST_PROCESS_METHOD_DECORATOR = /@Process\s*\((?:[^()]|\([^()]*\))*\)(?:\s|@[A-Za-z_$][A-Za-z0-9_$]*(?:\s*\((?:[^()]|\([^()]*\))*\))?|\/\*[\s\S]*?\*\/|\/\/[^\n]*\n)*?(?:public\s+|private\s+|protected\s+|async\s+)*([A-Za-z_$][A-Za-z0-9_$]*)\s*\(/g;
+const NEST_CONTROLLER_DECORATOR = /@Controller\s*\(\s*(?:(["'`])([^"'`]*)\1)?\s*\)(?:\s|@[A-Za-z_$][A-Za-z0-9_$]*(?:\s*\((?:[^()]|\([^()]*\))*\))?|\/\*[\s\S]*?\*\/|\/\/[^\n]*\n)*?(?:export\s+)?class\s+([A-Za-z_$][A-Za-z0-9_$]*)/g;
 const EXPRESS_ROUTER_CALL = /\b(?:router|app)\s*\.\s*(get|post|put|delete|patch|options|head|all)\s*\(\s*(["'`])([^"'`]*)\2\s*,\s*([A-Za-z_$][A-Za-z0-9_$]*(?:\.[A-Za-z_$][A-Za-z0-9_$]*)?|\([^)]*\)\s*=>|async\s+\([^)]*\)\s*=>|function\s+[A-Za-z_$][A-Za-z0-9_$]*)/gi;
 const EXPRESS_ROUTE_CHAIN = /\b(?:router|app)\s*\.\s*route\s*\(\s*(["'`])([^"'`]*)\1\s*\)((?:\s*\.\s*(?:get|post|put|delete|patch|options|head|all)\s*\([^)]*\))+)/gi;
 const CHAINED_METHOD_CALL = /\.\s*(get|post|put|delete|patch|options|head|all)\s*\(\s*([A-Za-z_$][A-Za-z0-9_$]*(?:\.[A-Za-z_$][A-Za-z0-9_$]*)?|\([^)]*\)\s*=>|async\s+\([^)]*\)\s*=>|function\s+[A-Za-z_$][A-Za-z0-9_$]*)/gi;
@@ -17,6 +24,8 @@ export function extractBehaviorContracts(content, file) {
     return dedupeContracts([
         ...extractFileRouteContracts(content, file),
         ...extractNestContracts(content, file),
+        ...extractNestGraphqlContracts(content, file),
+        ...extractNestProcessorContracts(content, file),
         ...extractRouterContracts(content, file, EXPRESS_ROUTER_CALL, "express"),
         ...extractExpressRouteChains(content, file),
         ...extractRouterContracts(content, file, FASTIFY_CALL, "fastify")
@@ -52,8 +61,8 @@ function extractNestContracts(content, file) {
         const index = match.index ?? 0;
         const controller = nearestController(controllers, index);
         const method = httpMethod(match[1]);
-        const routePath = joinRoutePaths(controller?.path ?? "", match[3] ?? "");
-        const handler = match[4];
+        const routePath = joinRoutePaths(controller?.path ?? "", match[3] ?? match[5] ?? "");
+        const handler = match[6];
         contracts.push(makeContract({
             file,
             framework: "nestjs",
@@ -65,6 +74,70 @@ function extractNestContracts(content, file) {
     }
     return contracts;
 }
+function extractNestGraphqlContracts(content, file) {
+    // GraphQL resolvers are first-class user-triggerable entry points. In
+    // NestJS-heavy monorepos (Twenty: 415 @Query/@Mutation methods vs 139 HTTP
+    // routes) skipping them left almost every user behavior without an Endpoint
+    // anchor, so static flows rooted at internal orphan methods instead.
+    if (!/@(Query|Mutation|Subscription)\s*\(/.test(content))
+        return [];
+    const resolvers = [...content.matchAll(CLASS_DECLARATION)].map((match) => ({
+        index: match.index ?? 0,
+        path: "",
+        name: match[1]
+    }));
+    if (resolvers.length === 0)
+        return [];
+    const contracts = [];
+    for (const match of content.matchAll(NEST_GQL_METHOD_DECORATOR)) {
+        const resolver = nearestController(resolvers, match.index ?? 0);
+        if (!resolver)
+            continue;
+        const opKind = match[1].toUpperCase();
+        if (opKind === "RESOLVEFIELD")
+            continue; // field resolvers are not user-triggerable operations
+        const handler = match[2];
+        contracts.push(makeContract({
+            file,
+            framework: "nestjs",
+            kind: "graphql_operation",
+            method: opKind,
+            path: `graphql:${handler}`,
+            handler,
+            controller: resolver.name
+        }));
+    }
+    return contracts;
+}
+function extractNestProcessorContracts(content, file) {
+    // Background jobs and crons are behaviors (June 27 definition: user- or
+    // system-triggerable, cross-layer, observable outcome). Anchoring them lets
+    // the flow walker show queue-driven chains instead of orphan roots.
+    const processors = [...content.matchAll(NEST_PROCESSOR_DECORATOR)].map((match) => ({
+        index: match.index ?? 0,
+        path: normalizeRoutePath(match[2] ?? ""),
+        name: match[3]
+    }));
+    if (processors.length === 0)
+        return [];
+    const contracts = [];
+    for (const match of content.matchAll(NEST_PROCESS_METHOD_DECORATOR)) {
+        const processor = nearestController(processors, match.index ?? 0);
+        if (!processor)
+            continue;
+        const handler = match[1];
+        contracts.push(makeContract({
+            file,
+            framework: "nestjs",
+            kind: "queue_processor",
+            method: "JOB",
+            path: `queue:${processor.path || processor.name}`,
+            handler,
+            controller: processor.name
+        }));
+    }
+    return contracts;
+}
 function nearestController(controllers, index) {
     let current;
     for (const controller of controllers) {
@@ -111,7 +184,7 @@ function makeContract(input) {
     return {
         id: `endpoint:${slugify(`${input.method}-${input.path}-${input.file}-${input.handler ?? ""}`)}`,
         title,
-        kind: "http_endpoint",
+        kind: input.kind ?? "http_endpoint",
         framework: input.framework,
         method: input.method,
         path: input.path,

package/dist/local/analyze/parseCache.js

@@ -1,3 +1,4 @@
+import { createRequire } from "node:module";
 /**
  * Phase 5.4.2 — persistent PARSE cache.
  *
@@ -54,7 +55,20 @@
 // Swift protocol methods, and Rust trait signatures while dropping Rust aliases.
 // v16: symbol extraction now carries source line spans for runtime coverage
 // report ingestion; warm v15 entries lack the ranges and cannot be mapped.
-export const PARSER_VERSION = 16;
+export const PARSER_VERSION = 17; // 17: Go method symbols receiver-qualified (Recv.M + member_of)
+/** Tool package version, folded into the cache guard so UPGRADES auto-invalidate
+ *  the cache — bumping PARSER_VERSION by hand is a discipline; this is a lock.
+ *  (The stale-cache incident: upgraded binary served old per-file results.) */
+export const TOOL_VERSION = (() => {
+    try {
+        // dist/local/analyze/ → ../../../package.json
+        const req = createRequire(import.meta.url);
+        return String(req("../../../package.json").version ?? "0");
+    }
+    catch {
+        return "0";
+    }
+})();
 const SYMBOL_KINDS = new Set(["function", "class", "const", "method"]);
 /** Strict structural validation — persisted data is untrusted FOR SHAPE; reject anything off-shape. */
 function validSymbols(v) {
@@ -100,7 +114,7 @@ export class ParseCache {
     constructor(data) {
         this.entries = new Map();
         // A version mismatch (or no data) starts empty — never trust a stale schema.
-        if (!data || data.version !== PARSER_VERSION || !data.entries || typeof data.entries !== "object")
+        if (!data || data.version !== PARSER_VERSION || data.tool !== TOOL_VERSION || !data.entries || typeof data.entries !== "object")
             return;
         for (const [key, raw] of Object.entries(data.entries)) {
             if (!raw || typeof raw !== "object")
@@ -159,6 +173,6 @@ export class ParseCache {
             if (e)
                 entries[key] = e;
         }
-        return { version: PARSER_VERSION, entries };
+        return { version: PARSER_VERSION, tool: TOOL_VERSION, entries };
     }
 }

package/dist/local/analyze/treeSitter/engine.js

@@ -252,8 +252,12 @@ export function extractTreeSitterSymbols(content, language) {
         if (kind && shouldEmitSymbol(node, language)) {
             const name = symbolName(node, cfg);
             if (name && !RESERVED_SYMBOL_NAMES.has(name)) {
+                // Go methods mint receiver-qualified names (`Recv.M`, mirroring TS/JS
+                // `Class.method` + member_of) so same-named methods on different receivers
+                // stay distinct symbols; an underivable receiver falls back to the bare name.
+                const recv = kind === "method" && language === "go" ? goReceiverBaseName(node) : undefined;
                 add(kind === "method"
-                    ? { name, symbol_kind: kind, trivial_accessor: isTrivialAccessorBody(node, language), ...nodeLines(node) }
+                    ? { name: recv ? `${recv}.${name}` : name, ...(recv ? { member_of: recv } : {}), symbol_kind: kind, trivial_accessor: isTrivialAccessorBody(node, language), ...nodeLines(node) }
                     : { name, symbol_kind: kind, ...nodeLines(node) });
             }
         }
@@ -381,6 +385,20 @@ function functionName(node, language) {
         return name;
     return name;
 }
+/**
+ * Base receiver type name for a Go method declaration — `(p *Parser)` → "Parser",
+ * `(g Generic[T])` → "Generic". Undefined when the receiver shape is underivable,
+ * in which case callers fall back to the bare method name (the pre-qualified
+ * behavior). NOT used for test-name extraction — suite test names must stay bare
+ * (`^Test` gate at extractGoProofCalls).
+ */
+function goReceiverBaseName(node) {
+    const param = node.childForFieldName("receiver")?.namedChild(0);
+    let t = param?.childForFieldName("type") ?? undefined;
+    if (t && (t.type === "pointer_type" || t.type === "generic_type"))
+        t = t.namedChild(0) ?? undefined;
+    return t?.type === "type_identifier" ? t.text : undefined;
+}
 function javaPackage(root) {
     const pkg = namedChildren(root).find((n) => n.type === "package_declaration");
     return pkg ? namedChildren(pkg).find((n) => n.type.endsWith("identifier"))?.text : undefined;
@@ -389,6 +407,29 @@ function goPackage(root) {
     const pkg = namedChildren(root).find((n) => n.type === "package_clause");
     return pkg ? namedChildren(pkg).find((n) => n.type === "package_identifier")?.text : undefined;
 }
+/**
+ * Top-level Go function name → base name of its single declared result type
+ * (`func New(n int) *Parser` → "Parser"). ONLY a bare `type_identifier` (optionally
+ * behind one `*`) is captured; multi-return (`parameter_list`), interface, qualified
+ * (`pkg.T`), and generic results are omitted — constructor-based receiver pinning
+ * must fail closed on any result it cannot prove structurally.
+ */
+function extractGoCtorResults(root) {
+    const out = {};
+    for (const child of namedChildren(root)) {
+        if (child.type !== "function_declaration")
+            continue;
+        const name = child.childForFieldName("name")?.text;
+        if (!name)
+            continue;
+        let r = child.childForFieldName("result") ?? undefined;
+        if (r?.type === "pointer_type")
+            r = r.namedChild(0) ?? undefined;
+        if (r?.type === "type_identifier")
+            out[name] = r.text;
+    }
+    return out;
+}
 function kotlinPackage(root) {
     const pkg = namedChildren(root).find((n) => n.type === "package_header");
     return pkg ? namedChildren(pkg).find((n) => n.type === "identifier")?.text : undefined;
@@ -860,6 +901,11 @@ function goShortVarCalls(stmt) {
 function extractGoProofCalls(root, imports) {
     const out = [];
     const seen = new Set();
+    // Var name → constructor name for locals declared in the CURRENT test func by a
+    // bare same-package `x := New(...)` (single unqualified call). Reset per top-level
+    // test func; marks a qualified proof-call `p.M()` as receiver-local AND carries
+    // the ctor name so the analyzer can pin p's receiver type from New's result.
+    let receiverLocals = new Map();
     const assertLocals = goAssertLocals(imports);
     const dotAssertMethods = goDotAssertMethods(root);
     const suiteTypes = goCanonicalSuiteTypes(root, goSuiteLocals(imports));
@@ -869,7 +915,8 @@ function extractGoProofCalls(root, imports) {
             if (seen.has(key))
                 continue;
             seen.add(key);
-            out.push({ caller: testName, testName, ...c, shadowed: [...shadowed], assertion, ...(assertionLine ? { assertionLine } : {}) });
+            const receiverCtor = c.via === "qualified" && !!c.qualifier && !c.qualifier.includes(".") ? receiverLocals.get(c.qualifier) : undefined;
+            out.push({ caller: testName, testName, ...c, shadowed: [...shadowed], assertion, ...(assertionLine ? { assertionLine } : {}), ...(receiverCtor ? { receiverLocal: true, receiverCtor } : {}) });
         }
     };
     const processBlock = (block, testName, testingParams, shadowed) => {
@@ -934,7 +981,29 @@ function extractGoProofCalls(root, imports) {
                 for (const name of sv.names)
                     pending.set(name, sv.calls);
             }
+            if (stmt.type === "short_var_declaration") {
+                // A lone `x := New(...)` makes x a receiver-local: its type comes from a
+                // same-package constructor, so `x.M()` targets a same-package method. This
+                // check inspects the TOP-LEVEL RHS call directly (not goShortVarCalls, whose
+                // single-product-call rule drops `New(strings.NewReader(...))` for its nested
+                // arg — the real phcparser shape). Refuses composite literals, qualified/
+                // imported calls, and multi-assign — none are receiver-locals.
+                const rhsNames = new Set();
+                collectNames(stmt.childForFieldName("left") ?? stmt.namedChild(0), rhsNames);
+                const rhs = stmt.childForFieldName("right");
+                const rhsCalls = rhs ? namedChildren(rhs).filter((n) => n.type === "call_expression") : [];
+                if (rhsNames.size === 1 && rhsCalls.length === 1) {
+                    const cp = callParts(rhsCalls[0], "go");
+                    if (cp && cp.via === "free")
+                        receiverLocals.set([...rhsNames][0], cp.callee);
+                }
+            }
             else if (stmt.type === "assignment_statement") {
+                // Reassigning a receiver-local invalidates it too.
+                const reassignedRl = new Set();
+                collectNames(stmt.childForFieldName("left") ?? stmt.namedChild(0), reassignedRl);
+                for (const name of reassignedRl)
+                    receiverLocals.delete(name);
                 // Plain reassignment kills the binding — the checked value is no longer F's.
                 const reassigned = new Set();
                 collectNames(stmt.childForFieldName("left") ?? stmt.namedChild(0), reassigned);
@@ -979,6 +1048,7 @@ function extractGoProofCalls(root, imports) {
         const body = child.childForFieldName("body");
         if (!testingParams.size || !body)
             continue;
+        receiverLocals = new Map();
         processBlock(body, name, testingParams, localBindings(child, "go"));
     }
     return out;
@@ -1442,7 +1512,14 @@ export function extractTreeSitterStructure(content, language) {
                 nextInsideFunction = true;
             }
             else {
-                const name = functionName(node, language);
+                let name = functionName(node, language);
+                // Go method symbols are receiver-qualified — attribute calls to the
+                // qualified caller so Layer-1 edges keep matching the emitted symbol.
+                if (name && language === "go" && node.type === "method_declaration") {
+                    const recv = goReceiverBaseName(node);
+                    if (recv)
+                        name = `${recv}.${name}`;
+                }
                 if (name) {
                     nextCaller = name;
                     nextShadowed = localBindings(node, language);
@@ -1461,7 +1538,7 @@ export function extractTreeSitterStructure(content, language) {
     const imports = extractImports(root, language);
     const result = {
         ...(language === "java" ? { packageName: javaPackage(root), javaClasses: javaClassInfos(root), javaProofCalls: extractJavaProofCalls(root, imports) } : {}),
-        ...(language === "go" ? { packageName: goPackage(root) } : {}),
+        ...(language === "go" ? { packageName: goPackage(root), goCtorResults: extractGoCtorResults(root) } : {}),
         ...(language === "kotlin" ? { packageName: kotlinPackage(root), topLevelSymbols: kotlinTopLevelSymbols(root) } : {}),
         ...(language === "php" ? { moduleName: phpNamespace(root) } : {}),
         ...(language === "csharp" ? { moduleName: csharpNamespace(root) } : {}),

package/dist/local/autoProve.js

@@ -108,15 +108,18 @@ function pytestNodeidsForTarget(sourceRoot, testRel, testName) {
  * `behavior_surface === "entrypoint_adjacent"`, and carrying NO `denominator_reason_code`
  * (infra_behavior_surface / not_entry_point_adjacent).
  *
- * Language: TS/JS (unchanged), Go (G-INT-2), OR Java (J-INT-2). Go dynamic proof
- * (G-1) proves FREE FUNCTIONS ONLY — a Go method classifies `unrunnable` and never
- * mints, so admitting one is safe (never a false Proven) but wastes an attempt; when
- * the clean `symbol_kind === "method"` signal is present we exclude it up front. Java
- * dynamic proof (J-1) is the INVERSE — it proves single-top-level-return METHODS, so
- * we admit Java methods; a non-J-1-shape method (void/constructor/nested/generic) just
- * classifies `unrunnable` and never mints, safe by construction. Everything downstream
- * of `closed`/the cert is language-agnostic and mints Go/Java only through the
- * unchanged G-INT-1/J-INT-1 gates.
+ * Language: TS/JS (unchanged), Go (G-INT-2), OR Java (J-INT-2). This STRICT predicate
+ * keeps Go to FREE FUNCTIONS ONLY. The Go oracle can also prove receiver METHODS, but
+ * a method's no-false-Proven story rests entirely on the analyzer-minted hard
+ * receiver-local TESTED_BY/COVERS edge (package-unique method-name gating) — so Go
+ * methods are admitted solely by `isEligibleHardExistingTarget` on the hard-edge lane,
+ * never here: this predicate also feeds PR/changed-scope selection, weak MAY_*
+ * expansion, and generation candidate filtering, where no hard edge backs the pick.
+ * Java dynamic proof (J-1) is the INVERSE — it proves single-top-level-return METHODS,
+ * so we admit Java methods; a non-J-1-shape method (void/constructor/nested/generic)
+ * just classifies `unrunnable` and never mints, safe by construction. Everything
+ * downstream of `closed`/the cert is language-agnostic and mints Go/Java only through
+ * the unchanged G-INT-1/J-INT-1 gates.
  */
 export function isEligibleProvableTarget(node) {
     if (!node || node.kind !== "CodeSymbol")
@@ -133,18 +136,27 @@ export function isEligibleProvableTarget(node) {
  * The LANGUAGE + oracle-SHAPE half of eligibility, factored out so both the strict
  * `isEligibleProvableTarget` (which layers the entry-point-adjacent SCOPE guards on top)
  * and the relaxed hard-edge existing-tests path share ONE definition of "a shape the
- * oracle can prove". CodeSymbol + a TS/JS file, a Go free function, a Java method, or a
- * Python function/method.
+ * oracle can prove". CodeSymbol + a TS/JS file, a Go free function (a receiver method
+ * only when the caller opts in via `allowGoMethod`), a Java method, or a Python
+ * function/method.
  */
-function matchesProvableLanguageShape(node) {
+function matchesProvableLanguageShape(node, opts) {
     if (node.kind !== "CodeSymbol")
         return false;
     const file = codeSymbolFile(node);
     if (isTsJsFile(file))
         return true;
-    // Go: free functions only. A method is out of scope for the Go oracle (G-1 refuses it).
-    if (isGoFile(file))
-        return node.properties.symbol_kind !== "method";
+    // Go: free functions only, unless the caller opts into methods (`allowGoMethod`).
+    // Only the hard-edge lane opts in: a method's no-false-Proven story rests on the
+    // analyzer's uniqueness-gated receiver-local TESTED_BY/COVERS edge, which the strict
+    // callers (changed-scope selection, weak MAY_* expansion, generation candidates)
+    // do not have — admitting methods there would break the invariant that a Go method
+    // only ever becomes a proof attempt via a hard receiver-local edge.
+    if (isGoFile(file)) {
+        if (node.properties.symbol_kind === "function")
+            return true;
+        return opts?.allowGoMethod === true && node.properties.symbol_kind === "method";
+    }
     // Java: METHODS only (J-1 proves single-top-level-return methods). A non-J-1-shape
     // method classifies `unrunnable` and never mints, so admitting all Java methods is
     // safe (never a false Proven); a non-method Java symbol (a class container) is out
@@ -173,7 +185,11 @@ function matchesProvableLanguageShape(node) {
  * by the frozen oracle, never false-Proven. Guards deliberately KEPT:
  *   - `infra_behavior_surface` still excludes plumbing (getters/registry accessors) — a
  *     hard edge does not buy an infra symbol an attempt (waste, and preserves the #4 bar);
- *   - the language + oracle-shape filter (never hand a class container / Go method down).
+ *   - the language + oracle-shape filter (never hand a class container down).
+ * This is also the ONLY caller that admits Go receiver METHODS (`allowGoMethod`): it is
+ * reached solely behind a hard TESTED_BY/COVERS edge, and the analyzer mints a method
+ * edge only for the uniqueness-gated receiver-local shape — the strict predicate keeps
+ * Go methods out of every other selection path.
  * Used solely on the hard lane; weak MAY_* fan-out stays strict.
  */
 function isEligibleHardExistingTarget(node) {
@@ -181,7 +197,7 @@ function isEligibleHardExistingTarget(node) {
         return false;
     if (node.properties.denominator_reason_code === "infra_behavior_surface")
         return false;
-    return matchesProvableLanguageShape(node);
+    return matchesProvableLanguageShape(node, { allowGoMethod: true });
 }
 /** Go `_test.go` top-level test-name regex (matches `extractTestNames`'s Go pattern). */
 const GO_TEST_NAME_RE = /^Test[A-Za-z0-9_]+$/;
@@ -206,9 +222,10 @@ function anchorGoTestRun(name) {
  * its target test BY NAME (`go test -run ^TestX$`), so auto-drive must derive that
  * name — G-INT-1 took it as an explicit input.
  *
- * The link is the analyzer's HARD `TESTED_BY`/`COVERS` proof edge (Go free-fn sym ↔
- * `test:<file>_test.go`), emitted only for an eligible Go symbol whose test genuinely
- * asserts on it. PRIMARY: the edge carries `properties.test_name` — the EXACT enclosing
+ * The link is the analyzer's HARD `TESTED_BY`/`COVERS` proof edge (Go sym — free fn,
+ * or receiver-local method — ↔ `test:<file>_test.go`), emitted only for an eligible Go
+ * symbol whose test genuinely asserts on it. PRIMARY: the edge carries
+ * `properties.test_name` — the EXACT enclosing
  * `func TestXxx` where the assertion witnessed THIS target (structural metadata, never
  * proof) — which disambiguates even a `_test.go` file with many tests. FALLBACK (old
  * graphs / no edge metadata): the linked TestCase node's file-level `test_names[]`,
@@ -519,7 +536,8 @@ export function existingAssociatedTests(graph, nodeById) {
     };
     // `hard` = TESTED_BY/COVERS (the confirmer's structural links); weak = MAY_* candidate
     // edges. Hard is recorded before weak (graph.edges scanned first), so a test already
-    // linked hard is never downgraded; a later weak dup only upgrades an existing weak to hard.
+    // linked hard is never downgraded, and a later weak dup of the same pair is a no-op —
+    // the hard flag can only ever originate from a genuine TESTED_BY/COVERS edge.
     const add = (symId, testRel, hard, testName) => {
         // A HARD TESTED_BY/COVERS edge is a real derivable test; admit it even when the symbol
         // is not_entry_point_adjacent (relaxed shape-only guard). Weak MAY_* fan-out stays strict.