@orangepro/orangepro-mcp 0.2.41 → 0.2.43

package/dist/local/provenance.js

@@ -0,0 +1,84 @@
+import { LOCAL_GRAPH_SCHEMA_VERSION } from "./graph/ontology.js";
+import { ORS_VERSION } from "./score/risk.js";
+import { ORANGEPRO_VERSION } from "./version.js";
+import { hashString } from "./util/hash.js";
+export const ARTIFACT_IDENTITY_VERSION = "orangepro.artifact_identity.v1";
+export const ANALYZER_VERSION = "orangepro.analyzer.v2";
+export const PROOF_ORACLE_VERSION = "orangepro.targeted_mutation_oracle.v1";
+function stable(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(stable).join(",")}]`;
+    const record = value;
+    return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stable(record[key])}`).join(",")}}`;
+}
+function digest(value) {
+    return hashString(stable(value));
+}
+/** Included paths + bytes after OrangePro ignore/cap rules. Git metadata is deliberately excluded. */
+export function repositorySnapshot(graph) {
+    return digest(Object.entries(graph.manifest.files)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([path, file]) => ({ path, hash: file.hash })));
+}
+function analysisScope(analysis) {
+    return {
+        max_files: analysis?.max_files ?? null,
+        max_symbols: analysis?.max_symbols ?? null,
+        max_inferred_flows: analysis?.max_inferred_flows ?? null,
+        files_cap_hit: analysis?.files_cap_hit ?? false,
+        symbol_cap_hit: analysis?.symbol_cap_hit ?? false,
+        budget_ms: analysis?.not_analyzed_due_to_budget?.budget_ms ?? null,
+        flow_options: analysis?.flows?.options ?? null,
+        tree_sitter_loaded: [...(analysis?.tree_sitter?.loaded ?? [])].sort(),
+        tree_sitter_downgraded: [...(analysis?.tree_sitter?.downgraded ?? [])].sort()
+    };
+}
+export function buildArtifactIdentity(graph, inputs) {
+    const repository_snapshot = repositorySnapshot(graph);
+    const analyzer_version = inputs.analyzerVersion ?? ANALYZER_VERSION;
+    const ors_version = inputs.orsVersion ?? ORS_VERSION;
+    const oracle_version = inputs.oracleVersion ?? PROOF_ORACLE_VERSION;
+    const analysis_fingerprint = digest({
+        repository_snapshot,
+        analyzer_version,
+        graph_schema_version: LOCAL_GRAPH_SCHEMA_VERSION,
+        source_upload_policy: graph.workspace.source_upload_policy,
+        scope: analysisScope(graph.analysis),
+        history: inputs.history
+    });
+    const ranking_fingerprint = digest({ analysis_fingerprint, risk_config_hash: inputs.configHash, ors_version });
+    const run_fingerprint = digest({ ranking_fingerprint, oracle_version });
+    return {
+        schema_version: ARTIFACT_IDENTITY_VERSION,
+        repository_snapshot,
+        analysis_fingerprint,
+        ranking_fingerprint,
+        run_fingerprint,
+        analyzer_version,
+        graph_schema_version: LOCAL_GRAPH_SCHEMA_VERSION,
+        ors_version,
+        oracle_version,
+        risk_config_hash: inputs.configHash,
+        tool_version: ORANGEPRO_VERSION,
+        git_commit: graph.manifest.git?.commit ?? null,
+        git_dirty: graph.manifest.git?.dirty ?? null
+    };
+}
+export function comparisonCompatibility(previous, current) {
+    if (!previous || !current)
+        return "provenance_incomplete";
+    if (previous.schema_version !== ARTIFACT_IDENTITY_VERSION || current.schema_version !== ARTIFACT_IDENTITY_VERSION) {
+        return "provenance_incomplete";
+    }
+    if (previous.repository_snapshot !== current.repository_snapshot)
+        return "repository_changed";
+    if (previous.analysis_fingerprint !== current.analysis_fingerprint)
+        return "analysis_changed";
+    if (previous.ranking_fingerprint !== current.ranking_fingerprint)
+        return "ranking_changed";
+    if (previous.run_fingerprint !== current.run_fingerprint)
+        return "experiment_changed";
+    return "comparable";
+}

package/dist/local/resolve/importGraph.js

@@ -110,6 +110,19 @@ export function extractImports(file) {
     }
     const sourceFile = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, /*setParentNodes*/ false);
     const imports = [];
+    const esmockBindings = new Set();
+    // `esmock("./module", overrides)` loads the real target module while replacing
+    // selected dependencies. Trust the first argument only when the callee is the
+    // default binding imported from the actual `esmock` package. A local helper
+    // merely named `esmock` must not create a structural module edge.
+    for (const statement of sourceFile.statements) {
+        if (ts.isImportDeclaration(statement) &&
+            ts.isStringLiteralLike(statement.moduleSpecifier) &&
+            statement.moduleSpecifier.text === "esmock" &&
+            statement.importClause?.name) {
+            esmockBindings.add(statement.importClause.name.text);
+        }
+    }
     const moduleText = (node) => node && ts.isStringLiteralLike(node) ? node.text : null;
     const visit = (node) => {
         if (ts.isImportDeclaration(node)) {
@@ -129,8 +142,9 @@ export function extractImports(file) {
             // Dynamic `import("lit")` or `require("lit")` with a string-literal arg.
             const isDynamicImport = node.expression.kind === ts.SyntaxKind.ImportKeyword;
             const isRequire = ts.isIdentifier(node.expression) && node.expression.text === "require";
+            const isEsmock = ts.isIdentifier(node.expression) && esmockBindings.has(node.expression.text);
             // TODO(low): a concatenated dynamic-import arg yields a phantom specifier; ignored.
-            if (isDynamicImport || isRequire) {
+            if (isDynamicImport || isRequire || isEsmock) {
                 const specifier = moduleText(node.arguments[0]);
                 if (specifier !== null)
                     imports.push({ specifier, kind: "runtime", bindings: [] });

package/dist/local/score/rankEligibility.js

@@ -0,0 +1,15 @@
+export const TEST_SUPPORT_RANKING_REASON_CODE = "test_support_helper";
+const TEST_SUPPORT_PATH_RE = /(^|\/)((?:[^/]+-)?e2e[-_]?testing|testing|testutils?|testhelpers?|fixtures?|mocks?|fakes?)(\/|$)/i;
+/**
+ * Built-in ranking-only exclusions. These symbols remain in the graph and keep
+ * their denominator eligibility; they simply do not compete with production
+ * behaviors in the primary priority worklist.
+ */
+export function builtInRankExclusion(file) {
+    if (!TEST_SUPPORT_PATH_RE.test(file))
+        return undefined;
+    return {
+        code: TEST_SUPPORT_RANKING_REASON_CODE,
+        reason: "Test-support helper — retained in the behavior denominator, excluded from the primary production priority ranking."
+    };
+}

package/dist/local/score/risk.js

@@ -1,5 +1,9 @@
 import { loadRiskConfig, globToRegExp } from "./riskConfig.js";
 import { execFileSync } from "node:child_process";
+import { hashString } from "../util/hash.js";
+import { builtInRankExclusion } from "./rankEligibility.js";
+/** Explicit scorer identity. Formula changes require a new value. */
+export const ORS_VERSION = "orangepro.ors.stable_population.v2";
 const ENTRY_PATH_RE = /(^|\/)(routes?|controllers?|handlers?|jobs?|workers?|processors?|queues?|consumers?|subscribers?|listeners?|server|cmd)\//i;
 const ENTRY_FILE_RE = /(^|\/)[^/]*(controller|handler|route|router|job|processor|worker|queue|consumer|subscriber|listener|command|gateway)\.[^.\/]+$/i;
 const API_HANDLER_NAME_RE = /^(GET|POST|PUT|PATCH|DELETE|handle.*|handler|route|controller|endpoint)$/i;
@@ -176,7 +180,26 @@ function gitFirstCommitBatch(root, files) {
     }
     return out;
 }
+/** Exact deterministic identity of the Git-derived inputs consumed by ORS. */
+export function riskHistoryFingerprint(root, files, churnWindow) {
+    const health = inspectRiskInputHealth(root, churnWindow);
+    const sortedFiles = [...new Set(files)].sort();
+    if (!health.churnAvailable) {
+        return hashString(JSON.stringify({ state: health.history, window: health.churnWindow, available: false }));
+    }
+    const churn = gitChurn(root, sortedFiles, health.churnWindow);
+    const first = churn.complete ? gitFirstCommitBatch(root, sortedFiles) : new Map();
+    return hashString(JSON.stringify({
+        state: health.history,
+        window: health.churnWindow,
+        available: churn.complete,
+        churn: sortedFiles.map((file) => [file, churn.values.get(file) ?? 0]),
+        first_commit: sortedFiles.map((file) => [file, first.get(file) ?? 0])
+    }));
+}
 export function isEntryPoint(node) {
+    if (node.properties.cli_entrypoint === true)
+        return true;
     const file = symbolFile(node);
     const title = symbolTitle(node);
     if (API_HANDLER_NAME_RE.test(title) && /(^|\/)api(s)?\//i.test(file))
@@ -194,6 +217,8 @@ function deriveRouteWeight(node) {
     const method = methodMatch?.[1].toUpperCase() ?? "";
     const isStore = /\/store\//i.test(file) || /\/store\b/i.test(file);
     const isAdmin = /\/admin\//i.test(file) || /\/admin\b/i.test(file);
+    if (node.properties.cli_entrypoint === true)
+        return 6;
     if (isHttpRouteSymbol(node) && isStore) {
         if (method === "POST")
             return 10;
@@ -319,6 +344,10 @@ const NEW_CODE_SECONDS = NEW_CODE_DAYS * 24 * 60 * 60;
 // `remove` kept but not for listener/handler/attribute/child tails — those detach,
 // they don't destroy data.
 const DESTRUCTIVE_CALL_RE = /^(?:delete(?!d)|purge|drop|forcedelete|destroy)[A-Za-z0-9_]*$/i;
+// Replacement can overwrite a remote collection, but the verb is too broad to
+// treat by name alone. It is a sink only when the analyzer proves the receiver
+// is a runtime binding imported from an external module.
+const IMPORTED_REPLACEMENT_CALL_RE = /^replace[A-Za-z0-9_]*$/i;
 // `remove*` is only a data sink through a persistence-shaped field; in-memory
 // removals (`pollers.Remove`, `RemoveSpeculativeWorkflowTaskTimeout`) are not.
 const REMOVE_CALL_RE = /^remove(?![A-Za-z0-9_]*(?:listener|handler|observer|callback|attribute|attr|class|child|style|hook|timeout|timer)$)[A-Za-z0-9_]*$/i;
@@ -381,17 +410,19 @@ function candidateSignalIds(graph, candidateIds) {
 }
 export function rankRiskGaps(graph, opts = {}) {
     const limit = opts.limit ?? 20;
-    const confirmed = confirmedBehaviorIds(graph, opts.provenIds);
+    const repoRoot = opts.repoRoot ?? graph.workspace.root;
+    const confirmed = opts.includeAssociated
+        ? new Set(opts.provenIds ?? [])
+        : confirmedBehaviorIds(graph, opts.provenIds);
     // Fix D: ranking hygiene. Test-support code, bare constants/variables, and trivial
     // accessors stay in the behavior DENOMINATOR but never compete for a risk slot.
-    const TEST_SUPPORT_PATH_RE = /(^|\/)(testing|testutils?|testhelpers?|fixtures?|mocks?|fakes?)(\/|$)/i;
-    const cfgEarly = loadRiskConfig(opts.repoRoot ?? graph.workspace.root).config.classification;
+    const cfgEarly = loadRiskConfig(repoRoot).config.classification;
     const extraTestSupportRef = cfgEarly.test_support_paths.map(globToRegExp);
     const rankExcludeRef = cfgEarly.rank_exclude_paths.map(globToRegExp);
     const ACCESSOR_RE = /(^|\.)(Get|Set|Is|Has)[A-Z][A-Za-z0-9]*$/;
     const rankEligible = (n) => {
         const props = (n.properties ?? {});
-        if (TEST_SUPPORT_PATH_RE.test(symbolFile(n)))
+        if (builtInRankExclusion(symbolFile(n)))
             return false;
         if (extraTestSupportRef.some((re) => re.test(symbolFile(n))))
             return false;
@@ -408,12 +439,17 @@ export function rankRiskGaps(graph, opts = {}) {
             return false;
         return true;
     };
-    const suppressedRef = loadRiskConfig(opts.repoRoot ?? graph.workspace.root).config.overrides.filter((o) => o.action === "suppress");
+    const suppressedRef = loadRiskConfig(repoRoot).config.overrides.filter((o) => o.action === "suppress");
     const isSuppressed = (id) => suppressedRef.some((o) => o.symbol === id || globToRegExp(o.symbol).test(id));
-    const symbols = graph.nodes.filter((n) => n.kind === "CodeSymbol" && n.denominator_eligible === true && !n.stale && !confirmed.has(n.external_id) && rankEligible(n) && !isSuppressed(n.external_id));
-    const symbolIds = new Set(symbols.map((s) => s.external_id));
+    // ORS v2 computes structural inputs and normalizes P/I over the stable
+    // denominator-eligible production population. Evidence changes filter the
+    // worklist but do not rescale an unchanged peer.
+    const normalizationSymbols = graph.nodes.filter((n) => n.kind === "CodeSymbol" && n.denominator_eligible === true && !n.stale && rankEligible(n) && !isSuppressed(n.external_id));
+    const symbols = normalizationSymbols.filter((n) => !confirmed.has(n.external_id));
+    const worklistSymbols = symbols.filter((n) => n.properties.ranking_exclusion_reason !== "python_structural_container");
+    const symbolIds = new Set(normalizationSymbols.map((s) => s.external_id));
     const symbolsByFile = new Map();
-    for (const s of symbols) {
+    for (const s of normalizationSymbols) {
         const file = symbolFile(s);
         const list = symbolsByFile.get(file);
         if (list)
@@ -421,8 +457,7 @@ export function rankRiskGaps(graph, opts = {}) {
         else
             symbolsByFile.set(file, [s]);
     }
-    const files = [...new Set(symbols.map(symbolFile))];
-    const repoRoot = opts.repoRoot ?? graph.workspace.root;
+    const files = [...new Set(normalizationSymbols.map(symbolFile))];
     const loadedCfg = loadRiskConfig(repoRoot);
     const cfg = loadedCfg.config;
     const overrideFor = (id) => cfg.overrides.find((o) => o.symbol === id || globToRegExp(o.symbol).test(id));
@@ -476,7 +511,7 @@ export function rankRiskGaps(graph, opts = {}) {
         const total = fileComplexityTotals.get(file) ?? 1;
         return fileChurn * (Math.max(complexityProxy(s), 1) / Math.max(total, 1));
     };
-    const entryPoint = new Map(symbols.map((s) => [s.external_id, isEntryPoint(s)]));
+    const entryPoint = new Map(normalizationSymbols.map((s) => [s.external_id, isEntryPoint(s)]));
     // Single pass over edges (was one full edge scan PER symbol).
     const fanOutTargets = new Map();
     for (const e of graph.edges) {
@@ -486,7 +521,7 @@ export function rankRiskGaps(graph, opts = {}) {
         set.add(e.to_external_id);
         fanOutTargets.set(e.from_external_id, set);
     }
-    const fanOut = new Map(symbols.map((s) => [s.external_id, fanOutTargets.get(s.external_id)?.size ?? 0]));
+    const fanOut = new Map(normalizationSymbols.map((s) => [s.external_id, fanOutTargets.get(s.external_id)?.size ?? 0]));
     // Fix C signals: destructive reach via CALLS (<=3 hops) to a sink; sinks are symbols
     // whose own name, or a retained external callee, is a destructive call.
     const nodeById = new Map(graph.nodes.map((n) => [n.external_id, n]));
@@ -503,11 +538,18 @@ export function rankRiskGaps(graph, opts = {}) {
         if (!n)
             return undefined;
         const ext = n.properties?.external_callees ?? [];
+        const importedStatic = n.properties?.imported_static_callees ?? [];
         // A receiver FIELD path is `x.field.Method` — no call parentheses before the last
         // segment. `q.Clock().Now().Truncate` is a chain of return values, not a surface.
         const viaField = (c) => !c.slice(0, c.lastIndexOf(".")).includes("(");
         const fieldOf = (c) => c.slice(0, c.lastIndexOf("."));
-        return ext.find((c) => viaField(c) && (DESTRUCTIVE_CALL_RE.test(lastSeg(c)) ||
+        const destructive = ext.find((c) => viaField(c) && (DESTRUCTIVE_CALL_RE.test(lastSeg(c)) ||
+            (REMOVE_CALL_RE.test(lastSeg(c)) && PERSISTENCE_FIELD_RE.test(fieldOf(c))) ||
+            extraSinks.some((re) => re.test(lastSeg(c)))));
+        if (destructive)
+            return destructive;
+        return importedStatic.find((c) => viaField(c) && (DESTRUCTIVE_CALL_RE.test(lastSeg(c)) ||
+            IMPORTED_REPLACEMENT_CALL_RE.test(lastSeg(c)) ||
             (REMOVE_CALL_RE.test(lastSeg(c)) && PERSISTENCE_FIELD_RE.test(fieldOf(c))) ||
             extraSinks.some((re) => re.test(lastSeg(c)))));
     };
@@ -528,17 +570,44 @@ export function rankRiskGaps(graph, opts = {}) {
         }
         return undefined;
     };
-    const sinkReached = new Map(symbols.map((s) => [s.external_id, reachedSinkFrom(s.external_id, 2, new Set([s.external_id]))]));
+    const sinkReached = new Map(normalizationSymbols.map((s) => [s.external_id, reachedSinkFrom(s.external_id, 2, new Set([s.external_id]))]));
     const reachesSink = new Map([...sinkReached].map(([k, v]) => [k, v !== undefined]));
     const depthCtx = buildFlowDepthContext(graph);
     const staticLinked = staticTestLinkedIds(graph, symbolIds);
     const candidateLinked = candidateSignalIds(graph, symbolIds);
     const detectionFor = (id) => staticLinked.has(id) ? "associated" : candidateLinked.has(id) ? "candidate" : "none";
     if (opts.legacy) {
-        return symbols
+        // Preserve the legacy option's historical evidence-filtered attribution.
+        const legacyIds = new Set(symbols.map((s) => s.external_id));
+        const legacyByFile = new Map();
+        for (const s of symbols) {
+            const file = symbolFile(s);
+            const list = legacyByFile.get(file);
+            if (list)
+                list.push(s);
+            else
+                legacyByFile.set(file, [s]);
+        }
+        const legacyIncoming = new Map();
+        const legacyFileImports = new Map();
+        for (const e of graph.edges) {
+            if (e.relationship_type === "CALLS" && legacyIds.has(e.to_external_id)) {
+                legacyIncoming.set(e.to_external_id, (legacyIncoming.get(e.to_external_id) ?? 0) + 1);
+            }
+            else if (e.relationship_type === "IMPORTS" && legacyByFile.has(e.to_external_id)) {
+                legacyFileImports.set(e.to_external_id, (legacyFileImports.get(e.to_external_id) ?? 0) + 1);
+            }
+        }
+        for (const [file, count] of legacyFileImports) {
+            const syms = legacyByFile.get(file) ?? [];
+            const share = syms.length > 0 ? count / syms.length : 0;
+            for (const s of syms)
+                legacyIncoming.set(s.external_id, (legacyIncoming.get(s.external_id) ?? 0) + share);
+        }
+        return worklistSymbols
             .map((s) => {
             const file = symbolFile(s);
-            const incoming_refs = incoming.get(s.external_id) ?? 0;
+            const incoming_refs = legacyIncoming.get(s.external_id) ?? 0;
             const git_churn = churn.get(file) ?? 0;
             const isEntry = entryPoint.get(s.external_id) ?? false;
             const churnForScore = Math.min(git_churn, 500);
@@ -556,7 +625,7 @@ export function rankRiskGaps(graph, opts = {}) {
             .sort((a, b) => b.risk_score - a.risk_score || b.incoming_refs - a.incoming_refs || b.git_churn - a.git_churn || a.id.localeCompare(b.id))
             .slice(0, limit);
     }
-    const rawScores = symbols.map((s) => {
+    const rawScores = normalizationSymbols.map((s) => {
         const file = symbolFile(s);
         const incoming_refs = incoming.get(s.external_id) ?? 0;
         const git_churn = symbolChurn(s);
@@ -578,15 +647,19 @@ export function rankRiskGaps(graph, opts = {}) {
     // matter how few callers it has. Impact FLOORS at 5/10 for such paths (a floor,
     // not an increment — an additive bump vanishes under hub-dominated normalization).
     const iScores = iScoresRaw.map((v, idx) => (rawScores[idx].reachesDestructiveSink ? Math.max(v, 5) : v));
-    const ranked = symbols
-        .map((s, idx) => {
+    const rawById = new Map(normalizationSymbols.map((s, idx) => [s.external_id, rawScores[idx]]));
+    const pById = new Map(normalizationSymbols.map((s, idx) => [s.external_id, pScores[idx]]));
+    const iById = new Map(normalizationSymbols.map((s, idx) => [s.external_id, iScores[idx]]));
+    const ranked = worklistSymbols
+        .map((s) => {
         const file = symbolFile(s);
         const incoming_refs = Math.round((incoming.get(s.external_id) ?? 0) * 10) / 10;
         const git_churn = Math.round(symbolChurn(s));
         const fan_out = fanOut.get(s.external_id) ?? 0;
         const isEntry = entryPoint.get(s.external_id) ?? false;
         const route_weight = deriveRouteWeight(s);
-        const data_sensitivity = rawScores[idx].sensitivityOverride !== undefined ? rawScores[idx].sensitivityOverride : rawScores[idx].sensitivityIgnored ? 0 : deriveDataSensitivity(s);
+        const raw = rawById.get(s.external_id);
+        const data_sensitivity = raw.sensitivityOverride !== undefined ? raw.sensitivityOverride : raw.sensitivityIgnored ? 0 : deriveDataSensitivity(s);
         const flow_position = Math.max(0, 5 - getFlowDepth(s, depthCtx));
         const complexity_proxy = complexityProxy(s);
         const firstTs = firstCommitTs.get(file) ?? 0;
@@ -595,11 +668,11 @@ export function rankRiskGaps(graph, opts = {}) {
         // before multiplying previously collapsed whole hot files into identical
         // P×I×D ties (seventeen ORS-100 rows from one service). Integers remain
         // display-only in the decomposition string.
-        const pExact = pScores[idx];
-        const iExact = iScores[idx];
+        const pExact = pById.get(s.external_id);
+        const iExact = iById.get(s.external_id);
         const p = Math.round(pExact);
         const i = Math.round(iExact);
-        const d = rawScores[idx].d;
+        const d = raw.d;
         const detectionTier = detectionFor(s.external_id);
         let score = Math.round(pExact * iExact * d * 10) / 10;
         const disconnected = incoming_refs === 0 && fan_out === 0;
@@ -623,9 +696,9 @@ export function rankRiskGaps(graph, opts = {}) {
             reasons.push("lexical candidate test match only — unconfirmed");
         // Reason chips for the two consequence signals — a reader can disagree with the
         // weight without doubting the fact, and the fact is what's shown.
-        if (rawScores[idx].reachesDestructiveSink)
+        if (raw.reachesDestructiveSink)
             reasons.push("reaches a destructive external call (delete/purge) within 2 hops — impact floored at 5");
-        if (rawScores[idx].scheduledEntry)
+        if (raw.scheduledEntry)
             reasons.push("scheduled/queue-triggered entry with no proof — failures surface nowhere, detection ×1.25");
         const override = overrideFor(s.external_id);
         if (override && override.action !== "suppress")
@@ -633,7 +706,7 @@ export function rankRiskGaps(graph, opts = {}) {
         return {
             ...(override && override.action !== "suppress" ? { override: { action: override.action, reason: override.reason } } : {}),
             ...(sinkReached.get(s.external_id) ? { sink_callee: sinkReached.get(s.external_id) } : {}),
-            ...(rawScores[idx].scheduledEntry ? { scheduled_entry: true } : {}),
+            ...(raw.scheduledEntry ? { scheduled_entry: true } : {}),
             detection_tier: detectionTier,
             id: s.external_id,
             title: s.title || s.external_id,

package/dist/local/viz/behaviorReportData.js

@@ -1,12 +1,11 @@
 import { loadRiskConfig } from "../score/riskConfig.js";
 import { configDisclosureFor } from "../score/risk.js";
-import { createHash } from "node:crypto";
 import path from "node:path";
 import { buildRtm } from "../rtm.js";
-import { inspectRiskInputHealth, isEntryPoint, rankPriorityGaps, rankRiskGaps } from "../score/risk.js";
-import { ORANGEPRO_VERSION } from "../version.js";
+import { inspectRiskInputHealth, isEntryPoint, rankPriorityGaps, rankRiskGaps, riskHistoryFingerprint } from "../score/risk.js";
 import { PROOF_BLOCKER_GUIDE } from "../proofDoctor.js";
 import { classifyGeneratedDraftBlocker } from "../generate/draftGuidance.js";
+import { buildArtifactIdentity, comparisonCompatibility } from "../provenance.js";
 /** Short human phrase per R-1 needs_setup category, for the "blocked because: …" panel copy. */
 const BLOCK_CATEGORY_LABEL = {
     module_not_found: "a missing module or dependency in the sandbox",
@@ -219,6 +218,16 @@ function proofGuidance(ledger, summary, dyn) {
         action: HANDOFF_ACTION
     };
 }
+export function excludedCliCommands(graph) {
+    return graph.nodes
+        .filter((node) => node.kind === "CodeSymbol" && node.properties.cli_entrypoint === true && node.denominator_eligible !== true)
+        .map((node) => ({
+        path: node.title ?? node.external_id,
+        file: String(node.properties.file ?? ""),
+        reason: node.denominator_reason ?? "Excluded from the behavior denominator."
+    }))
+        .sort((a, b) => a.file.localeCompare(b.file) || a.path.localeCompare(b.path));
+}
 function scanBlock(graph, rows) {
     const services = new Map();
     for (const row of rows) {
@@ -259,7 +268,8 @@ function scanBlock(graph, rows) {
         excluded: {
             count: excludedCount > 0 ? String(excludedCount) : "0",
             text: "non-behavior symbols were excluded from the behavior count — generated code, framework internals, test-inferred flows, and infrastructure plumbing."
-        }
+        },
+        excludedCliCommands: excludedCliCommands(graph)
     };
 }
 function behaviorLists(rows, flowIds) {
@@ -344,6 +354,7 @@ function flows(graph, rows, risks) {
             title: flow.entry_point.title || flow.entry_point.external_id,
             trigger,
             root_entry,
+            ...(rootNode?.properties.entry_lane === "cli" ? { entry_lane: "cli" } : {}),
             risk: risk ? riskBucket(risk.risk_score, maxRiskScore) : null,
             proof,
             services,
@@ -500,6 +511,24 @@ function riskContext(risk) {
 /** Pure delta between a persisted baseline and the current report data.
  *  Deterministic: same inputs, same delta. */
 export function computeReportDelta(prev, cur) {
+    const comparisonState = comparisonCompatibility(prev.identity, cur.provenance.identity);
+    if (comparisonState !== "comparable") {
+        return {
+            baselineTs: prev.ts,
+            comparisonState,
+            comparisonReason: comparisonReason(comparisonState),
+            changed: false,
+            totalDelta: 0,
+            provenDelta: 0,
+            associatedDelta: 0,
+            candidateDelta: 0,
+            noneDelta: 0,
+            newRisks: [],
+            droppedRisks: [],
+            generatedDelta: 0,
+            configChanged: comparisonState === "ranking_changed"
+        };
+    }
     const curPaths = cur.risks.map((r) => r.path);
     const prevSet = new Set(prev.riskPaths);
     const curSet = new Set(curPaths);
@@ -507,6 +536,8 @@ export function computeReportDelta(prev, cur) {
     const droppedRisks = prev.riskPaths.filter((p) => !curSet.has(p));
     const d = {
         baselineTs: prev.ts,
+        comparisonState,
+        comparisonReason: comparisonReason(comparisonState),
         changed: false,
         totalDelta: cur.summary.total - prev.summary.total,
         provenDelta: cur.summary.proven - prev.summary.proven,
@@ -524,7 +555,34 @@ export function computeReportDelta(prev, cur) {
     return d;
 }
 export function reportBaselineOf(cur, ts) {
-    return { ts, summary: cur.summary, riskPaths: cur.risks.map((r) => r.path), generatedTotal: cur.generatedTotal, configHash: cur.provenance?.configHash };
+    return { ts, summary: cur.summary, riskPaths: cur.risks.map((r) => r.path), generatedTotal: cur.generatedTotal, configHash: cur.provenance?.configHash, identity: cur.provenance.identity };
+}
+export function firstRunDelta() {
+    return {
+        baselineTs: null,
+        comparisonState: "first_run",
+        comparisonReason: comparisonReason("first_run"),
+        changed: false,
+        totalDelta: 0,
+        provenDelta: 0,
+        associatedDelta: 0,
+        candidateDelta: 0,
+        noneDelta: 0,
+        newRisks: [],
+        droppedRisks: [],
+        generatedDelta: 0
+    };
+}
+function comparisonReason(state) {
+    switch (state) {
+        case "first_run": return "No prior identity-bearing baseline exists.";
+        case "comparable": return "Repository, analysis, ranking and proof-oracle identities match.";
+        case "repository_changed": return "The scanned repository paths or bytes changed; trend deltas are withheld.";
+        case "analysis_changed": return "Analyzer, schema, scope or history inputs changed; treat this as structural recalibration.";
+        case "ranking_changed": return "Risk configuration or ORS version changed; treat this as ranking recalibration.";
+        case "experiment_changed": return "A proof-oracle or declared experiment input changed; only controlled-experiment interpretation is valid.";
+        case "provenance_incomplete": return "The previous artifact lacks the required versioned identity; automated comparison is disabled.";
+    }
 }
 const HTTP_TRIGGER_VERBS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD", "ALL"]);
 const GRAPHQL_TRIGGER_VERBS = new Set(["MUTATION", "QUERY", "SUBSCRIPTION"]);
@@ -571,6 +629,8 @@ export function buildSystemMapModel(data, maxServices = 12) {
     const laneForFlow = (flow) => {
         if (flow.trigger)
             return laneForTrigger(flow.trigger);
+        if (flow.entry_lane === "cli")
+            return { id: "cli", label: "CLI", priority: 60 };
         // A program root without a framework trigger is still a real product entry
         // point (CLI/main). Internal call-graph roots remain excluded.
         return flow.root_entry ? { id: "entry", label: "Entry points", priority: 80 } : null;
@@ -939,10 +999,30 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
         .map((r) => ({ path: r.title, file: r.file, score: r.risk_score, probability: r.probability ?? 0 }));
     // Fix: search the FULL ranking for sinks, not the top 200 — a stable destructive path
     // ranked 300th is exactly what this panel exists to recover.
-    const irreversible = rankRiskGaps(graph, { repoRoot, limit: Number.MAX_SAFE_INTEGER, provenIds }).filter((r) => r.sink_callee).slice(0, 20)
+    // Consequence view: a static test association is not dynamic proof. Keep
+    // Associated sink paths visible here while the main priority-gap list retains
+    // its existing behavior and excludes hard-linked rows.
+    const irreversible = rankRiskGaps(graph, {
+        repoRoot,
+        limit: Number.MAX_SAFE_INTEGER,
+        provenIds,
+        includeAssociated: true
+    }).filter((r) => r.sink_callee).slice(0, 20)
         .map((r) => ({ path: r.title, file: r.file, score: r.risk_score, sink: r.sink_callee ?? "" }));
     const riskHealth = inspectRiskInputHealth(repoRoot);
     const churnAvailable = riskHealth.churnAvailable && riskGaps.every((risk) => risk.churn_available !== false);
+    const configHash = loadRiskConfig(repoRoot).hash;
+    const codeFiles = Object.entries(graph.manifest.files).filter(([, file]) => file.kind === "code").map(([file]) => file);
+    const identity = buildArtifactIdentity(graph, {
+        configHash,
+        history: {
+            state: riskHealth.history,
+            churnWindow: riskHealth.churnWindow,
+            churnAvailable,
+            commitDate: riskHealth.commitDate,
+            inputFingerprint: riskHistoryFingerprint(repoRoot, codeFiles, riskHealth.churnWindow)
+        }
+    });
     const provenance = {
         source: path.basename(repoRoot || graph.workspace.name || "repo"),
         gitRoot: riskHealth.gitRoot ? path.basename(riskHealth.gitRoot) : null,
@@ -950,12 +1030,10 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
         history: riskHealth.history,
         churn: churnAvailable ? "available" : "unavailable",
         churnWindow: riskHealth.churnWindow,
-        toolVersion: ORANGEPRO_VERSION,
-        configHash: loadRiskConfig(repoRoot).hash,
-        inputFingerprint: createHash("sha256")
-            .update(JSON.stringify({ root: graph.workspace.root_hash, commit: riskHealth.commit, history: riskHealth.history, churn: churnAvailable, window: riskHealth.churnWindow, version: ORANGEPRO_VERSION, config: loadRiskConfig(repoRoot).hash }))
-            .digest("hex")
-            .slice(0, 16),
+        toolVersion: identity.tool_version,
+        configHash,
+        identity,
+        inputFingerprint: identity.run_fingerprint.replace(/^sha256:/, "").slice(0, 16),
         reason: churnAvailable ? undefined : (riskHealth.reason ?? "Git churn scan did not complete")
     };
     const lists = behaviorLists(rows, flowIds);
@@ -982,6 +1060,7 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
         configDisclosure: configDisclosureFor(graph, repoRoot),
         zeroProofExplainer: summary.proven === 0 ? { title: ZERO_PROOF_EXPLAINER.title, body: [...ZERO_PROOF_EXPLAINER.body] } : null,
         mapModel: buildSystemMapModel({ flows: flowRows, risks, behaviors: sortedBehaviors }),
+        delta: firstRunDelta(),
         viewMeta: {
             // Every denominator behavior is scored; the risks tab surfaces the top N.
             risks: { shown: risks.length, scored: summary.total },

package/dist/local/viz/behaviorReportHtml.js

@@ -50,6 +50,7 @@ a{color:var(--blue);text-decoration:none}
 .kpi[data-t="nosig"]{--kw:var(--rbg)} .kpi[data-t="nosig"] .kpi-num{color:var(--red)}
 .kpi[data-t="priority"]{--kw:var(--obg)} .kpi[data-t="priority"] .kpi-num{color:var(--orange)}
 .metric-scope{margin:9px 2px 0;color:var(--muted);font-size:11.5px;line-height:1.5}
+.scope-note{margin:9px 0 0;padding:9px 11px;border:1px solid var(--abd);background:var(--abg);color:var(--ink2);font-size:11.5px;line-height:1.5;border-radius:6px}
 
 /* TABS */
 nav.tabs{display:flex;gap:2px;margin:18px 0 0;border-bottom:1px solid var(--bd)}
@@ -343,6 +344,7 @@ body[data-mode="expert"] .simple-only{display:none!important}
   </div>
 </header>
 <div class="provenance" id="provenance"></div>
+<div class="scope-note" id="cli-exclusions" hidden></div>
 
 <section class="kpis" id="kpis"></section>
 <p class="metric-scope" id="metric-scope"></p>
@@ -465,9 +467,13 @@ const D=window.DATA,$=(s)=>document.querySelector(s);
   var el2=document.getElementById("delta-banner");
   var d=D.delta;
   if(!el2||d===undefined)return;
-  if(d===null){el2.innerHTML='';return;} // first run — baseline just recorded, nothing to compare
+  if(d.comparisonState==='first_run'){el2.innerHTML='';return;}
   var when=new Date(d.baselineTs);
   var ago=isNaN(when.getTime())?"last run":when.toLocaleString();
+  if(d.comparisonState!=='comparable'){
+    el2.innerHTML='<div class="delta-wrap"><span class="delta-chip dc-none">Comparison withheld: '+d.comparisonReason+'</span></div>';
+    return;
+  }
   if(!d.changed){
     el2.innerHTML='<div class="delta-wrap"><span class="delta-chip dc-none">No report changes since last run ('+ago+') for the recorded inputs</span></div>';
     return;
@@ -515,7 +521,12 @@ function scrollToRisk(path){
 (function(){
   var hero=document.getElementById("delta-hero");
   var d=D.delta;
-  if(!hero||d===undefined||d===null)return;
+  if(!hero||d===undefined||d.comparisonState==='first_run')return;
+  if(d.comparisonState!=='comparable'){
+    hero.className="delta-hero simple-only dh-clear";
+    hero.innerHTML='<h3>Comparison withheld</h3><p>'+d.comparisonReason+'</p>';
+    return;
+  }
   if(!d.changed){
     var when=new Date(d.baselineTs);
     var ago=isNaN(when.getTime())?"last run":when.toLocaleDateString();
@@ -677,6 +688,12 @@ const prov=$("#provenance");
 const provisional=P.churn!=="available";
 prov.classList.toggle("warn",provisional);
 prov.textContent=(provisional?"PROVISIONAL RANKING · ":"VERIFIED INPUTS · ")+"source "+P.source+" · commit "+(P.commit?P.commit.slice(0,12):"unavailable")+" · history "+P.history+" · churn "+P.churn+" ("+P.churnWindow+") · OrangePro "+P.toolVersion+" · input "+P.inputFingerprint+(P.reason?" · "+P.reason:"");
+const excludedCli=D.scan.excludedCliCommands||[];
+if(excludedCli.length){
+  const note=$("#cli-exclusions");
+  note.hidden=false;
+  note.textContent="CLI command entries excluded from the behavior count: "+excludedCli.map(x=>x.path+" ("+x.reason+")").join(" · ");
+}
 $("#fw-pill").textContent=D.framework;
 
 // bridge text in codebase tab