@orangepro/orangepro-mcp 0.2.4 → 0.2.5

package/dist/local/rtm.js

@@ -3,11 +3,12 @@ import { languageOf } from "./analyze/classify.js";
 import { targetFingerprint } from "./ledger.js";
 const STATUS_ORDER = {
     "No integration signal": 0,
-    "Associated signal": 1,
-    "Generated-unverifiable": 2,
-    "Runtime-covered": 3,
-    "Proven": 4,
-    "Reproven (this run)": 5
+    "Candidate signal (unconfirmed)": 1,
+    "Associated signal": 2,
+    "Generated-unverifiable": 3,
+    "Runtime-covered": 4,
+    "Proven": 5,
+    "Reproven (this run)": 6
 };
 const GENERIC_TEST_CATEGORIES = [
     "happy-path",
@@ -72,6 +73,7 @@ export function renderRtmMarkdown(result) {
         `| Dynamically Proven | ${provenValue} |`,
         `| Runtime-covered | ${s.runtime_covered} |`,
         `| Associated signal | ${s.associated} |`,
+        `| Candidate signal (unconfirmed) | ${s.candidate} |`,
         `| No integration signal | ${s.no_link} |`,
         `| Reproven this run | ${s.reproven_this_run} |`,
         `| Generated unverifiable | ${s.generated_unverifiable} |`,
@@ -164,8 +166,13 @@ function evidenceTierFor(indexes, node, file, dynamicProof) {
         return "proven";
     if (node.kind === "CodeSymbol" && node.properties.runtime_covered === true)
         return "runtime";
-    if (hasAssociatedSignal(indexes, node.external_id, file))
+    // Epistemic tiers (mirrors the platform's Proof/Candidate/Weak model):
+    // associated = a hard static test link (COVERS/TESTED_BY via real import) exists;
+    // candidate  = only a lexical/Jaccard candidate edge exists — a lead, not evidence.
+    if (indexes.staticSignalsById.has(node.external_id))
         return "associated";
+    if (indexes.candidateSignalsById.has(node.external_id) || (file !== "" && indexes.candidateSignalsByFile.has(file)))
+        return "candidate";
     return "none";
 }
 function statusFor(evidence, ledgerRecord, dynamicProof) {
@@ -177,6 +184,8 @@ function statusFor(evidence, ledgerRecord, dynamicProof) {
         return "Generated-unverifiable";
     if (evidence === "associated")
         return "Associated signal";
+    if (evidence === "candidate")
+        return "Candidate signal (unconfirmed)";
     return "No integration signal";
 }
 /**
@@ -196,6 +205,7 @@ function summarizeRows(rows, unionRows = []) {
         proven,
         runtime_covered: rows.filter((row) => row.evidence_tier === "runtime").length,
         associated: rows.filter((row) => row.evidence_tier === "associated").length,
+        candidate: rows.filter((row) => row.evidence_tier === "candidate").length,
         no_link: rows.filter((row) => row.evidence_tier === "none").length,
         reproven_this_run: reproven,
         generated_unverifiable: rows.filter((row) => row.status === "Generated-unverifiable").length,
@@ -252,8 +262,8 @@ function compareLedgerRecords(a, aIndex, b, bIndex) {
 function buildRtmIndexes(graph) {
     const nodeById = new Map(graph.nodes.map((n) => [n.external_id, n]));
     const staticSignalsById = new Map();
-    const associatedSignalsById = new Map();
-    const associatedSignalsByFile = new Map();
+    const candidateSignalsById = new Map();
+    const candidateSignalsByFile = new Map();
     const add = (map, key, value) => {
         const set = map.get(key);
         if (set)
@@ -261,21 +271,16 @@ function buildRtmIndexes(graph) {
         else
             map.set(key, new Set([value]));
     };
-    const importTargetsByFile = new Map();
+    // Candidate (lexical/Jaccard) signals attach ONLY to the matched file itself.
+    // They must never propagate through imports: one lexical match on a barrel file
+    // previously marked its whole import subtree as "associated" — that inflated
+    // 93% of Twenty behaviors into the test-signal tier with zero real evidence.
     const addFileAssociation = (file, value) => {
-        add(associatedSignalsByFile, file, value);
-        const imports = importTargetsByFile.get(file) ?? [];
-        if (imports.length > ASSOCIATED_IMPORT_PROPAGATION_LIMIT)
-            return;
-        for (const importedFile of imports)
-            add(associatedSignalsByFile, importedFile, value);
+        add(candidateSignalsByFile, file, value);
     };
     for (const e of graph.edges) {
         if (e.evidence_strength !== "hard")
             continue;
-        if (e.relationship_type === "IMPORTS" && isFileSignalKey(e.from_external_id) && isFileSignalKey(e.to_external_id)) {
-            importTargetsByFile.set(e.from_external_id, [...(importTargetsByFile.get(e.from_external_id) ?? []), e.to_external_id]);
-        }
         if (e.relationship_type !== "COVERS" && e.relationship_type !== "TESTED_BY")
             continue;
         const from = nodeById.get(e.from_external_id);
@@ -290,8 +295,8 @@ function buildRtmIndexes(graph) {
             continue;
         if (e.relationship_type !== "MAY_RELATE_TO" && e.relationship_type !== "MAY_BE_TESTED_BY" && e.relationship_type !== "MAY_COVER")
             continue;
-        add(associatedSignalsById, e.from_external_id, e.to_external_id);
-        add(associatedSignalsById, e.to_external_id, e.from_external_id);
+        add(candidateSignalsById, e.from_external_id, e.to_external_id);
+        add(candidateSignalsById, e.to_external_id, e.from_external_id);
         for (const [key, value] of [[e.from_external_id, e.to_external_id], [e.to_external_id, e.from_external_id]]) {
             if (isFileSignalKey(key))
                 addFileAssociation(key, value);
@@ -300,21 +305,18 @@ function buildRtmIndexes(graph) {
     const freeze = (map) => new Map([...map.entries()].map(([key, values]) => [key, [...values].sort()]));
     return {
         staticSignalsById: freeze(staticSignalsById),
-        associatedSignalsById: freeze(associatedSignalsById),
-        associatedSignalsByFile: freeze(associatedSignalsByFile)
+        candidateSignalsById: freeze(candidateSignalsById),
+        candidateSignalsByFile: freeze(candidateSignalsByFile)
     };
 }
 function isFileSignalKey(id) {
     return !id.startsWith("sym:") && !id.startsWith("test:") && !id.startsWith("flow:");
 }
-function hasAssociatedSignal(indexes, externalId, file) {
-    return indexes.staticSignalsById.has(externalId) || indexes.associatedSignalsById.has(externalId) || (file !== "" && indexes.associatedSignalsByFile.has(file));
-}
 function testSignalFor(indexes, externalId, file) {
     const staticSignals = indexes.staticSignalsById.get(externalId) ?? [];
     if (staticSignals.length > 0)
         return `static candidate: ${staticSignals.slice(0, 3).join("; ")}`;
-    const associated = [...(indexes.associatedSignalsById.get(externalId) ?? []), ...(file ? indexes.associatedSignalsByFile.get(file) ?? [] : [])]
+    const associated = [...(indexes.candidateSignalsById.get(externalId) ?? []), ...(file ? indexes.candidateSignalsByFile.get(file) ?? [] : [])]
         .filter((id) => id !== externalId && id !== file)
         .sort();
     if (associated.length > 0)
@@ -366,6 +368,8 @@ function normalizeStatusFilter(statuses) {
             out.add("Runtime-covered");
         else if (s === "associated")
             out.add("Associated signal");
+        else if (s === "candidate" || s === "candidate-signal")
+            out.add("Candidate signal (unconfirmed)");
         else if (s === "no-link" || s === "nolink" || s === "none")
             out.add("No integration signal");
         else if (s === "reproven" || s === "reproven-this-run")

package/dist/local/score/risk.js

@@ -93,15 +93,6 @@ function gitFirstCommitBatch(root, files) {
     }
     return out;
 }
-function countOutgoingCalls(symbolId, graph) {
-    const targets = new Set();
-    for (const e of graph.edges) {
-        if (e.relationship_type === "CALLS" && e.from_external_id === symbolId) {
-            targets.add(e.to_external_id);
-        }
-    }
-    return targets.size;
-}
 function isEntryPoint(node) {
     const file = symbolFile(node);
     const title = symbolTitle(node);
@@ -160,11 +151,8 @@ function deriveDataSensitivity(node) {
     }
     return 1;
 }
-function getFlowDepth(node, graph) {
+export function buildFlowDepthContext(graph) {
     const entryIds = new Set(graph.nodes.filter((n) => n.kind === "CodeSymbol" && isEntryPoint(n)).map((n) => n.external_id));
-    if (entryIds.has(node.external_id))
-        return 0;
-    // BFS backward over CALLS edges to find nearest entry point.
     const callers = new Map();
     for (const e of graph.edges) {
         if (e.relationship_type === "CALLS") {
@@ -173,14 +161,27 @@ function getFlowDepth(node, graph) {
             callers.set(e.to_external_id, set);
         }
     }
+    return { entryIds, callers, cache: new Map() };
+}
+function getFlowDepth(node, ctx) {
+    const cached = ctx.cache.get(node.external_id);
+    if (cached !== undefined)
+        return cached;
+    const { entryIds, callers } = ctx;
+    if (entryIds.has(node.external_id)) {
+        ctx.cache.set(node.external_id, 0);
+        return 0;
+    }
     let depth = 0;
     let frontier = new Set(callers.get(node.external_id) ?? []);
     const seen = new Set(frontier);
     while (frontier.size > 0 && depth < 6) {
         depth++;
         for (const id of frontier) {
-            if (entryIds.has(id))
+            if (entryIds.has(id)) {
+                ctx.cache.set(node.external_id, depth);
                 return depth;
+            }
         }
         const next = new Set();
         for (const id of frontier) {
@@ -193,7 +194,9 @@ function getFlowDepth(node, graph) {
         }
         frontier = next;
     }
-    return depth >= 6 ? 6 : depth;
+    const out = depth >= 6 ? 6 : depth;
+    ctx.cache.set(node.external_id, out);
+    return out;
 }
 function complexityProxy(node) {
     const start = typeof node.properties.start_line === "number" ? node.properties.start_line : 0;
@@ -213,23 +216,40 @@ function normalizeScores(values) {
 const DETECTION_MAP = {
     proven: 1,
     associated: 5,
+    // A lexical/Jaccard candidate is a lead, not evidence — detection stays hard.
+    candidate: 8,
     none: 10
 };
 const NEW_CODE_DAYS = 30;
 const NEW_CODE_SECONDS = NEW_CODE_DAYS * 24 * 60 * 60;
-function computeRawORS(node, graph, incomingRefs, gitChurn, fanOut, detectionTier, firstCommitTs, nowSec) {
+function computeRawORS(node, depthCtx, incomingRefs, gitChurn, fanOut, detectionTier, firstCommitTs, nowSec) {
     const isNew = firstCommitTs > 0 && nowSec - firstCommitTs < NEW_CODE_SECONDS;
     const complexity = complexityProxy(node);
     const rawP = gitChurn * 0.35 + fanOut * 0.3 + (isNew ? 15 : 0) + complexity * 0.2;
     const routeWeight = deriveRouteWeight(node);
-    const flowDepth = getFlowDepth(node, graph);
+    const flowDepth = getFlowDepth(node, depthCtx);
     const flowPosition = Math.max(0, 5 - flowDepth);
     const dataSensitivity = deriveDataSensitivity(node);
     const rawI = incomingRefs * 0.3 + routeWeight * 0.3 + flowPosition * 0.2 + dataSensitivity * 0.2;
     const d = DETECTION_MAP[detectionTier];
     return { p: rawP, i: rawI, d };
 }
-function associatedBehaviorIds(graph, candidateIds) {
+function staticTestLinkedIds(graph, candidateIds) {
+    const ids = new Set();
+    const kinds = new Map(graph.nodes.map((n) => [n.external_id, n.kind]));
+    for (const e of graph.edges) {
+        if (e.evidence_strength !== "hard")
+            continue;
+        if (e.relationship_type !== "TESTED_BY" && e.relationship_type !== "COVERS")
+            continue;
+        if (kinds.get(e.from_external_id) === "TestCase" && candidateIds.has(e.to_external_id))
+            ids.add(e.to_external_id);
+        if (kinds.get(e.to_external_id) === "TestCase" && candidateIds.has(e.from_external_id))
+            ids.add(e.from_external_id);
+    }
+    return ids;
+}
+function candidateSignalIds(graph, candidateIds) {
     const ids = new Set();
     for (const e of graph.candidate_edges ?? []) {
         if (e.relationship_type !== "MAY_BE_TESTED_BY" && e.relationship_type !== "MAY_COVER" && e.relationship_type !== "MAY_RELATE_TO") {
@@ -264,19 +284,58 @@ export function rankRiskGaps(graph, opts = {}) {
     const churn = gitChurn(opts.repoRoot ?? graph.workspace.root, files, opts.churnWindow ?? "180 days ago");
     const firstCommitTs = gitFirstCommitBatch(opts.repoRoot ?? graph.workspace.root, files);
     const nowSec = Math.floor(Date.now() / 1000);
+    // Method-level attribution. CALLS edges are already symbol-granular and count
+    // at full weight. IMPORTS edges are file-granular: previously every symbol in
+    // an imported file inherited the file's full import count, which made all 17
+    // methods of a hot service tie at the same "incoming refs" and saturated the
+    // ranking. Split the file's import count across its eligible symbols instead.
     const incoming = new Map();
+    const fileImports = new Map();
     for (const e of graph.edges) {
         if (e.relationship_type === "CALLS" && symbolIds.has(e.to_external_id)) {
             incoming.set(e.to_external_id, (incoming.get(e.to_external_id) ?? 0) + 1);
         }
-        else if (e.relationship_type === "IMPORTS") {
-            for (const s of symbolsByFile.get(e.to_external_id) ?? [])
-                incoming.set(s.external_id, (incoming.get(s.external_id) ?? 0) + 1);
+        else if (e.relationship_type === "IMPORTS" && symbolsByFile.has(e.to_external_id)) {
+            fileImports.set(e.to_external_id, (fileImports.get(e.to_external_id) ?? 0) + 1);
         }
     }
+    for (const [file, count] of fileImports) {
+        const syms = symbolsByFile.get(file) ?? [];
+        if (syms.length === 0)
+            continue;
+        const share = count / syms.length;
+        for (const s of syms)
+            incoming.set(s.external_id, (incoming.get(s.external_id) ?? 0) + share);
+    }
+    // Per-symbol churn share: file churn weighted by the symbol's line span so one
+    // hot file no longer awards its full churn to every method it contains.
+    const fileComplexityTotals = new Map();
+    for (const [file, syms] of symbolsByFile) {
+        fileComplexityTotals.set(file, syms.reduce((acc, s) => acc + Math.max(complexityProxy(s), 1), 0));
+    }
+    const symbolChurn = (s) => {
+        const file = symbolFile(s);
+        const fileChurn = churn.get(file) ?? 0;
+        if (fileChurn === 0)
+            return 0;
+        const total = fileComplexityTotals.get(file) ?? 1;
+        return fileChurn * (Math.max(complexityProxy(s), 1) / Math.max(total, 1));
+    };
     const entryPoint = new Map(symbols.map((s) => [s.external_id, isEntryPoint(s)]));
-    const fanOut = new Map(symbols.map((s) => [s.external_id, countOutgoingCalls(s.external_id, graph)]));
-    const associated = associatedBehaviorIds(graph, symbolIds);
+    // Single pass over edges (was one full edge scan PER symbol).
+    const fanOutTargets = new Map();
+    for (const e of graph.edges) {
+        if (e.relationship_type !== "CALLS" || !symbolIds.has(e.from_external_id))
+            continue;
+        const set = fanOutTargets.get(e.from_external_id) ?? new Set();
+        set.add(e.to_external_id);
+        fanOutTargets.set(e.from_external_id, set);
+    }
+    const fanOut = new Map(symbols.map((s) => [s.external_id, fanOutTargets.get(s.external_id)?.size ?? 0]));
+    const depthCtx = buildFlowDepthContext(graph);
+    const staticLinked = staticTestLinkedIds(graph, symbolIds);
+    const candidateLinked = candidateSignalIds(graph, symbolIds);
+    const detectionFor = (id) => staticLinked.has(id) ? "associated" : candidateLinked.has(id) ? "candidate" : "none";
     if (opts.legacy) {
         return symbols
             .map((s) => {
@@ -300,42 +359,49 @@ export function rankRiskGaps(graph, opts = {}) {
     const rawScores = symbols.map((s) => {
         const file = symbolFile(s);
         const incoming_refs = incoming.get(s.external_id) ?? 0;
-        const git_churn = churn.get(file) ?? 0;
+        const git_churn = symbolChurn(s);
         const fan_out = fanOut.get(s.external_id) ?? 0;
         const ts = firstCommitTs.get(file) ?? 0;
-        const detectionTier = associated.has(s.external_id) ? "associated" : "none";
-        return computeRawORS(s, graph, incoming_refs, git_churn, fan_out, detectionTier, ts, nowSec);
+        return computeRawORS(s, depthCtx, incoming_refs, git_churn, fan_out, detectionFor(s.external_id), ts, nowSec);
     });
     const pScores = normalizeScores(rawScores.map((r) => r.p));
     const iScores = normalizeScores(rawScores.map((r) => r.i));
-    return symbols
+    const ranked = symbols
         .map((s, idx) => {
         const file = symbolFile(s);
-        const incoming_refs = incoming.get(s.external_id) ?? 0;
-        const git_churn = churn.get(file) ?? 0;
+        const incoming_refs = Math.round((incoming.get(s.external_id) ?? 0) * 10) / 10;
+        const git_churn = Math.round(symbolChurn(s));
         const fan_out = fanOut.get(s.external_id) ?? 0;
         const isEntry = entryPoint.get(s.external_id) ?? false;
         const route_weight = deriveRouteWeight(s);
         const data_sensitivity = deriveDataSensitivity(s);
-        const flow_position = Math.max(0, 5 - getFlowDepth(s, graph));
+        const flow_position = Math.max(0, 5 - getFlowDepth(s, depthCtx));
         const complexity_proxy = complexityProxy(s);
         const firstTs = firstCommitTs.get(file) ?? 0;
         const is_new_code = firstTs > 0 && nowSec - firstTs < NEW_CODE_SECONDS;
-        const p = Math.round(pScores[idx]);
-        const i = Math.round(iScores[idx]);
+        // Score on the CONTINUOUS normalized values; rounding P and I to integers
+        // before multiplying previously collapsed whole hot files into identical
+        // P×I×D ties (seventeen ORS-100 rows from one service). Integers remain
+        // display-only in the decomposition string.
+        const pExact = pScores[idx];
+        const iExact = iScores[idx];
+        const p = Math.round(pExact);
+        const i = Math.round(iExact);
         const d = rawScores[idx].d;
-        const detectionTier = associated.has(s.external_id) ? "associated" : "none";
-        const score = p * i * d;
+        const detectionTier = detectionFor(s.external_id);
+        const score = Math.round(pExact * iExact * d * 10) / 10;
         const reasons = [
-            `ORS ${score} = P${p} × I${i} × D${d}`,
-            `${incoming_refs} incoming structural reference${incoming_refs === 1 ? "" : "s"}`,
-            `${git_churn} git churn line${git_churn === 1 ? "" : "s"} in 180 days`,
+            `ORS ${score} ≈ P${p} × I${i} × D${d}`,
+            `${incoming_refs} incoming structural reference${incoming_refs === 1 ? "" : "s"} (method-attributed)`,
+            `${git_churn} git churn line${git_churn === 1 ? "" : "s"} attributed to this symbol in 180 days`,
             `route weight ${route_weight}, data sensitivity ${data_sensitivity}, fan-out ${fan_out}`
         ];
         if (isEntry)
             reasons.push("near an API/route/handler entry point");
         if (is_new_code)
             reasons.push("new code (< 30 days)");
+        if (detectionTier === "candidate")
+            reasons.push("lexical candidate test match only — unconfirmed");
         return {
             id: s.external_id,
             title: s.title || s.external_id,
@@ -357,6 +423,31 @@ export function rankRiskGaps(graph, opts = {}) {
             integration_signal: detectionTier
         };
     })
+        .sort((a, b) => b.risk_score - a.risk_score || b.incoming_refs - a.incoming_refs || b.git_churn - a.git_churn || a.id.localeCompare(b.id));
+    // Portfolio diversity: cap how many gaps a single file contributes to the
+    // surfaced list, then backfill with the remaining highest scores if short.
+    const maxPerFile = Math.max(1, opts.maxPerFile ?? 3);
+    const perFile = new Map();
+    const surfaced = [];
+    const overflow = [];
+    for (const gap of ranked) {
+        const used = perFile.get(gap.file) ?? 0;
+        if (used < maxPerFile) {
+            perFile.set(gap.file, used + 1);
+            surfaced.push(gap);
+        }
+        else {
+            overflow.push(gap);
+        }
+        if (surfaced.length >= limit)
+            break;
+    }
+    if (surfaced.length < limit)
+        surfaced.push(...overflow.slice(0, limit - surfaced.length));
+    // Guarantee: the surfaced list is ALWAYS highest-risk-first, even when the
+    // per-file diversity backfill re-admits overflow items (which otherwise land
+    // appended after lower-scored rows).
+    return surfaced
         .sort((a, b) => b.risk_score - a.risk_score || b.incoming_refs - a.incoming_refs || b.git_churn - a.git_churn || a.id.localeCompare(b.id))
         .slice(0, limit);
 }