@orangepro/orangepro-mcp 0.2.9 → 0.2.10

package/dist/local/analyze/analyzer.js

@@ -1,5 +1,6 @@
 import { readFileSync } from "node:fs";
 import path from "node:path";
+import ts from "typescript";
 import { LOCAL_GRAPH_SCHEMA_VERSION } from "../graph/ontology.js";
 import { makeCandidateEdge, makeEdge, makeNode, makeProofEdges, makeTestCaseNode } from "../graph/factories.js";
 import { hashString } from "../util/hash.js";
@@ -205,6 +206,69 @@ function packagePublicEntryPaths(root, relPaths) {
                 addCandidate(packageDir, `${conventional}${extension}`);
         }
     }
+    // Public package entries are often zero-logic barrels. Follow only explicit,
+    // relative AST re-exports so the callable implementation remains public
+    // without widening every internal helper into the denominator. Handles both
+    // ESM barrels and the conventional CommonJS `module.exports = require(...)`.
+    const queued = [...entries];
+    const visited = new Set();
+    const addRelativeTarget = (fromFile, rawTarget) => {
+        if (!rawTarget.startsWith("."))
+            return;
+        const base = path.posix.normalize(path.posix.join(path.posix.dirname(fromFile), rawTarget));
+        if (base === ".." || base.startsWith("../"))
+            return;
+        const candidates = new Set([base]);
+        const withoutExt = base.replace(RUNTIME_SOURCE_EXT_RE, "");
+        for (const extension of extensions) {
+            candidates.add(`${withoutExt}${extension}`);
+            candidates.add(`${withoutExt}/index${extension}`);
+        }
+        for (const candidate of candidates) {
+            if (normalizedPaths.has(candidate) && !entries.has(candidate)) {
+                entries.add(candidate);
+                queued.push(candidate);
+            }
+        }
+    };
+    while (queued.length) {
+        const entry = queued.shift();
+        if (!entry || visited.has(entry))
+            continue;
+        visited.add(entry);
+        try {
+            const source = ts.createSourceFile(entry, readFileSync(path.join(root, entry), "utf8"), ts.ScriptTarget.Latest, false, ts.ScriptKind.TSX);
+            for (const statement of source.statements) {
+                if (ts.isExportDeclaration(statement) && statement.moduleSpecifier && ts.isStringLiteral(statement.moduleSpecifier)) {
+                    addRelativeTarget(entry, statement.moduleSpecifier.text);
+                    continue;
+                }
+                if (!ts.isExpressionStatement(statement))
+                    continue;
+                let assignment = ts.isBinaryExpression(statement.expression) && statement.expression.operatorToken.kind === ts.SyntaxKind.EqualsToken
+                    ? statement.expression
+                    : undefined;
+                while (assignment) {
+                    const left = assignment.left;
+                    const isModuleExports = ts.isPropertyAccessExpression(left)
+                        && ts.isIdentifier(left.expression)
+                        && left.expression.text === "module"
+                        && left.name.text === "exports";
+                    if (isModuleExports && ts.isCallExpression(assignment.right) && ts.isIdentifier(assignment.right.expression) && assignment.right.expression.text === "require") {
+                        const [arg] = assignment.right.arguments;
+                        if (arg && ts.isStringLiteral(arg))
+                            addRelativeTarget(entry, arg.text);
+                    }
+                    assignment = ts.isBinaryExpression(assignment.right) && assignment.right.operatorToken.kind === ts.SyntaxKind.EqualsToken
+                        ? assignment.right
+                        : undefined;
+                }
+            }
+        }
+        catch {
+            // An unreadable barrel cannot widen the public surface; keep the manifest entry only.
+        }
+    }
     return entries;
 }
 const FLOW_LINK_STOPWORDS = new Set([

package/dist/local/analyze/parseCache.js

@@ -55,7 +55,11 @@ import { createRequire } from "node:module";
 // Swift protocol methods, and Rust trait signatures while dropping Rust aliases.
 // v16: symbol extraction now carries source line spans for runtime coverage
 // report ingestion; warm v15 entries lack the ranges and cannot be mapped.
-export const PARSER_VERSION = 17; // 17: Go method symbols receiver-qualified (Recv.M + member_of)
+// v17: Go method symbols are receiver-qualified (Recv.M + member_of).
+// v18: TS/JS extracts direct callable CommonJS exports.
+// v19: chained assignments (`exports = module.exports = fn`) also expose the
+// callable subject; warm v18 entries can still omit conventional CJS entries.
+export const PARSER_VERSION = 19;
 /** Tool package version, folded into the cache guard so UPGRADES auto-invalidate
  *  the cache — bumping PARSER_VERSION by hand is a discipline; this is a lock.
  *  (The stale-cache incident: upgraded binary served old per-file results.) */

package/dist/local/analyze/symbols.js

@@ -283,10 +283,11 @@ function collectTsJsExports(content) {
         const localDecls = new Map();
         const classNodes = new Map(); // for default-subject member extraction
         const defaultExprs = [];
+        const commonJsAssignments = [];
         for (const stmt of sf.statements) {
             if (ts.isFunctionDeclaration(stmt) && stmt.name) {
                 const lines = nodeLines(sf, stmt);
-                localDecls.set(stmt.name.text, { kind: "function", eligible: true, lines });
+                localDecls.set(stmt.name.text, { kind: "function", eligible: true, callable: true, lines });
                 if (hasExportModifier(stmt))
                     record(stmt.name.text, "function", false, undefined, lines);
             }
@@ -297,7 +298,7 @@ function collectTsJsExports(content) {
                 if (ts.canHaveModifiers(stmt) && ts.getModifiers(stmt)?.some((mod) => mod.kind === ts.SyntaxKind.DeclareKeyword))
                     continue;
                 const lines = nodeLines(sf, stmt);
-                localDecls.set(stmt.name.text, { kind: "class", eligible: true, lines });
+                localDecls.set(stmt.name.text, { kind: "class", eligible: true, callable: true, lines });
                 classNodes.set(stmt.name.text, stmt);
                 if (hasExportModifier(stmt)) {
                     record(stmt.name.text, "class", false, undefined, lines);
@@ -312,7 +313,7 @@ function collectTsJsExports(content) {
                     const init = decl.initializer ? unwrapInitializer(decl.initializer) : undefined;
                     const callable = !!init && (ts.isArrowFunction(init) || ts.isFunctionExpression(init));
                     const lines = nodeLines(sf, decl);
-                    localDecls.set(decl.name.text, { kind: "const", eligible: isComponentLikeConst(decl.name.text, init), lines });
+                    localDecls.set(decl.name.text, { kind: "const", eligible: isComponentLikeConst(decl.name.text, init), callable, lines });
                     if (exported)
                         record(decl.name.text, "const", callable, undefined, lines); // regular exports keep the strict callable rule
                 }
@@ -322,6 +323,27 @@ function collectTsJsExports(content) {
                 // (`export { default } from './x'`) are ExportDeclarations, never collected.
                 defaultExprs.push(stmt.expression);
             }
+            else if (ts.isExpressionStatement(stmt) && ts.isBinaryExpression(stmt.expression) && stmt.expression.operatorToken.kind === ts.SyntaxKind.EqualsToken) {
+                let assignment = stmt.expression;
+                while (assignment) {
+                    const left = assignment.left;
+                    if (ts.isPropertyAccessExpression(left)) {
+                        const directDefault = ts.isIdentifier(left.expression) && left.expression.text === "module" && left.name.text === "exports";
+                        const namedOnExports = ts.isIdentifier(left.expression) && left.expression.text === "exports";
+                        const namedOnModule = ts.isPropertyAccessExpression(left.expression)
+                            && ts.isIdentifier(left.expression.expression)
+                            && left.expression.expression.text === "module"
+                            && left.expression.name.text === "exports";
+                        if (directDefault)
+                            commonJsAssignments.push({ exportName: null, expression: assignment.right });
+                        else if (namedOnExports || namedOnModule)
+                            commonJsAssignments.push({ exportName: left.name.text, expression: assignment.right });
+                    }
+                    assignment = ts.isBinaryExpression(assignment.right) && assignment.right.operatorToken.kind === ts.SyntaxKind.EqualsToken
+                        ? assignment.right
+                        : undefined;
+                }
+            }
         }
         // A default export is the file's primary behavior. Record its LOCAL subject
         // only when it is a function/class or a component-like const — skips require()
@@ -341,6 +363,31 @@ function collectTsJsExports(content) {
                     recordClassMethods(sf, node, name); // default-exported class → its methods
             }
         }
+        // CommonJS public surface, judged by the same AST-backed callable bar as ESM:
+        // module.exports = localFn, exports.name = localFn, or an inline function.
+        // Re-export shims and config/object assignments remain excluded.
+        for (const assignment of commonJsAssignments) {
+            const expr = unwrapInitializer(assignment.expression);
+            if (ts.isIdentifier(expr)) {
+                const d = localDecls.get(expr.text);
+                if (!d || !d.callable)
+                    continue;
+                record(expr.text, d.kind, d.kind === "const", undefined, d.lines);
+                if (d.kind === "class") {
+                    const node = classNodes.get(expr.text);
+                    if (node)
+                        recordClassMethods(sf, node, expr.text);
+                }
+            }
+            else if (ts.isFunctionExpression(expr) || ts.isArrowFunction(expr)) {
+                const name = assignment.exportName ?? (ts.isFunctionExpression(expr) && expr.name ? expr.name.text : undefined);
+                if (name)
+                    record(name, "function", false, undefined, nodeLines(sf, expr));
+            }
+            else if (ts.isClassExpression(expr) && expr.name) {
+                record(expr.name.text, "class", false, undefined, nodeLines(sf, expr));
+            }
+        }
     }
     return acc;
 }
@@ -381,7 +428,7 @@ export function extractSymbolsWithMeta(content, language) {
         // TS/JS from the AST — comment/string-safe. Cheap gate: any "export"
         // followed by whitespace (matches the old `export\s+`, so `export\tfunction`
         // / `export\nclass` are NOT skipped).
-        if (/export\s/.test(content)) {
+        if (/export\s|module\s*\.\s*exports|exports\s*\./.test(content)) {
             for (const [name, sym] of collectTsJsExports(content))
                 consider(name, sym.kind, sym.callable, sym.member_of, sym);
         }

package/dist/local/operations.js

@@ -2003,7 +2003,10 @@ export function opBehaviorCoverageHtml(root, outputPath = "orangepro-behavior-co
     // proof-attempts sidecar ONLY when it anchors to the current graph+commit
     // (stale evidence is dropped — fail closed; display copy only, no tier math).
     const dyn = dynamicProof ?? sidecarDynamicProof(root, graph);
-    const data = buildBehaviorReportData(graph, loadLedger(root), { repoRoot: root, dynamicProof: dyn });
+    // Artifacts may be written from a different working directory when callers
+    // use `opro start <source>`. Risk scoring must follow the analyzed source
+    // root recorded in the graph, never the artifact/output root.
+    const data = buildBehaviorReportData(graph, loadLedger(root), { repoRoot: graph.workspace.root, dynamicProof: dyn });
     // Delta-since-last-run: best-effort read of the previous snapshot; a missing
     // or unreadable baseline means first run (banner hidden). Display-only —
     // the delta never touches tiers, ranks, or counts.

package/dist/local/score/risk.js

@@ -27,10 +27,49 @@ function confirmedBehaviorIds(graph) {
     return ids;
 }
 const GIT_CHURN_BATCH = 200;
+export function inspectRiskInputHealth(root, churnWindow) {
+    const unavailableWindow = churnWindow ?? "180 days before HEAD";
+    if (!root)
+        return { sourceRoot: null, gitRoot: null, commit: null, commitDate: null, history: "unavailable", churnWindow: unavailableWindow, churnAvailable: false, reason: "source root unavailable" };
+    try {
+        const gitRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 4000 }).trim();
+        const commit = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 4000 }).trim();
+        const commitDate = execFileSync("git", ["show", "-s", "--format=%cI", "HEAD"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 4000 }).trim();
+        const shallow = execFileSync("git", ["rev-parse", "--is-shallow-repository"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 4000 }).trim() === "true";
+        let partial = false;
+        try {
+            partial = execFileSync("git", ["config", "--get-regexp", "^remote\\..*\\.promisor$"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 4000 })
+                .split(/\r?\n/)
+                .some((line) => /\btrue$/i.test(line.trim()));
+        }
+        catch {
+            // A normal full clone has no promisor-remote configuration.
+        }
+        const commitMs = Date.parse(commitDate);
+        const resolvedWindow = churnWindow ?? (Number.isFinite(commitMs) ? new Date(commitMs - 180 * 24 * 60 * 60 * 1000).toISOString() : unavailableWindow);
+        return {
+            sourceRoot: root,
+            gitRoot,
+            commit,
+            commitDate,
+            history: shallow ? "shallow" : partial ? "partial" : "full",
+            churnWindow: resolvedWindow,
+            churnAvailable: !shallow && !partial,
+            reason: shallow
+                ? "shallow Git history cannot support a complete churn window"
+                : partial
+                    ? "partial-clone Git objects cannot guarantee a complete offline churn window"
+                    : undefined
+        };
+    }
+    catch {
+        return { sourceRoot: root, gitRoot: null, commit: null, commitDate: null, history: "unavailable", churnWindow: unavailableWindow, churnAvailable: false, reason: "Git history could not be read from the analyzed source root" };
+    }
+}
 function gitChurn(root, files, window) {
     const out = new Map();
     if (!root || files.length === 0)
-        return out;
+        return { values: out, complete: Boolean(root) };
     for (let i = 0; i < files.length; i += GIT_CHURN_BATCH) {
         const batch = files.slice(i, i + GIT_CHURN_BATCH);
         try {
@@ -51,10 +90,10 @@ function gitChurn(root, files, window) {
             }
         }
         catch {
-            continue;
+            return { values: new Map(), complete: false };
         }
     }
-    return out;
+    return { values: out, complete: true };
 }
 function gitFirstCommitBatch(root, files) {
     const out = new Map();
@@ -137,18 +176,25 @@ function deriveRouteWeight(node) {
     return 2;
 }
 function deriveDataSensitivity(node) {
-    const text = `${node.external_id} ${symbolFile(node)} ${symbolTitle(node)}`.toLowerCase();
-    const tiers = [
-        [/payment|stripe|refund|charge(?!r)|billing|payout|chargeback/, 10],
-        [/auth(?!or\b)|token(?!iz)|session|password|credential|jwt|oauth/, 9],
-        [/order|cart|checkout|invoice|transaction/, 7],
-        [/customer|user|account|profile|pii|gdpr/, 6],
-        [/notification|email|sms|webhook|push/, 3]
-    ];
-    for (const [re, weight] of tiers) {
-        if (re.test(text))
-            return weight;
-    }
+    const raw = `${node.external_id} ${symbolFile(node)} ${symbolTitle(node)}`;
+    const tokens = new Set(raw
+        .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .filter(Boolean));
+    const has = (...values) => values.some((value) => tokens.has(value));
+    // `capture` alone is not a payment signal (for example CapturePanic). It is
+    // payment-sensitive only when the same symbol/path also contains payment context.
+    if (has("payment", "stripe", "refund", "charge", "billing", "payout", "chargeback") || (has("capture") && has("payment", "stripe", "transaction")))
+        return 10;
+    if (has("auth", "token", "session", "password", "credential", "jwt", "oauth"))
+        return 9;
+    if (has("order", "cart", "checkout", "invoice", "transaction"))
+        return 7;
+    if (has("customer", "user", "account", "profile", "pii", "gdpr"))
+        return 6;
+    if (has("notification", "email", "sms", "webhook", "push"))
+        return 3;
     return 1;
 }
 export function buildFlowDepthContext(graph) {
@@ -281,9 +327,16 @@ export function rankRiskGaps(graph, opts = {}) {
             symbolsByFile.set(file, [s]);
     }
     const files = [...new Set(symbols.map(symbolFile))];
-    const churn = gitChurn(opts.repoRoot ?? graph.workspace.root, files, opts.churnWindow ?? "180 days ago");
-    const firstCommitTs = gitFirstCommitBatch(opts.repoRoot ?? graph.workspace.root, files);
-    const nowSec = Math.floor(Date.now() / 1000);
+    const repoRoot = opts.repoRoot ?? graph.workspace.root;
+    const inputHealth = inspectRiskInputHealth(repoRoot, opts.churnWindow);
+    const churnWindow = inputHealth.churnWindow;
+    const churnResult = inputHealth.churnAvailable ? gitChurn(repoRoot, files, churnWindow) : { values: new Map(), complete: false };
+    const churn = churnResult.values;
+    const churnAvailable = inputHealth.churnAvailable && churnResult.complete;
+    const firstCommitTs = churnAvailable ? gitFirstCommitBatch(repoRoot, files) : new Map();
+    const commitMs = Date.parse(inputHealth.commitDate ?? "");
+    const graphMs = Date.parse(graph.updated_at || graph.created_at || "");
+    const nowSec = Math.floor((Number.isFinite(commitMs) ? commitMs : Number.isFinite(graphMs) ? graphMs : 0) / 1000);
     // Method-level attribution. CALLS edges are already symbol-granular and count
     // at full weight. IMPORTS edges are file-granular: previously every symbol in
     // an imported file inherited the file's full import count, which made all 17
@@ -347,11 +400,13 @@ export function rankRiskGaps(graph, opts = {}) {
             const score = Math.round((incoming_refs * 0.4 + churnForScore * 0.4 + (isEntry ? 20 : 0)) * 10) / 10;
             const reasons = [
                 `${incoming_refs} incoming structural reference${incoming_refs === 1 ? "" : "s"}`,
-                `${git_churn} git churn line${git_churn === 1 ? "" : "s"} in 180 days${git_churn > 500 ? " (score capped at 500)" : ""}`
+                churnAvailable
+                    ? `${git_churn} git churn line${git_churn === 1 ? "" : "s"} in 180 days${git_churn > 500 ? " (score capped at 500)" : ""}`
+                    : "Git churn unavailable — provisional static-only ranking"
             ];
             if (isEntry)
                 reasons.push("near an API/route/handler entry point");
-            return { id: s.external_id, title: s.title || s.external_id, file, risk_score: score, incoming_refs, git_churn, entry_point: isEntry, reasons };
+            return { id: s.external_id, title: s.title || s.external_id, file, risk_score: score, incoming_refs, git_churn, churn_available: churnAvailable, entry_point: isEntry, reasons };
         })
             .sort((a, b) => b.risk_score - a.risk_score || b.incoming_refs - a.incoming_refs || b.git_churn - a.git_churn || a.id.localeCompare(b.id))
             .slice(0, limit);
@@ -390,14 +445,16 @@ export function rankRiskGaps(graph, opts = {}) {
         const d = rawScores[idx].d;
         const detectionTier = detectionFor(s.external_id);
         let score = Math.round(pExact * iExact * d * 10) / 10;
-        const disconnected = (incoming.get(s.external_id) ?? 0) === 0 && fan_out === 0;
+        const disconnected = incoming_refs === 0 && fan_out === 0;
         if (disconnected)
             score = Math.round(score * 0.25 * 10) / 10;
         const reasons = [
             `ORS ${score} ≈ P${p} × I${i} × D${d}`,
             `${incoming_refs} incoming structural reference${incoming_refs === 1 ? "" : "s"} (method-attributed)`,
-            `${git_churn} git churn line${git_churn === 1 ? "" : "s"} attributed to this symbol in 180 days`,
-            `route weight ${route_weight}, data sensitivity ${data_sensitivity}, fan-out ${fan_out}`
+            churnAvailable
+                ? `${git_churn} git churn line${git_churn === 1 ? "" : "s"} attributed to this symbol in 180 days`
+                : "Git churn unavailable — provisional static-only ranking",
+            `route weight ${route_weight}, data sensitivity ${data_sensitivity}, flow position ${flow_position}, complexity ${complexity_proxy}, fan-out ${fan_out}`
         ];
         if (isEntry)
             reasons.push("near an API/route/handler entry point");
@@ -414,6 +471,7 @@ export function rankRiskGaps(graph, opts = {}) {
             risk_score: score,
             incoming_refs,
             git_churn,
+            churn_available: churnAvailable,
             entry_point: isEntry,
             reasons,
             probability: p,
@@ -438,7 +496,7 @@ export function rankRiskGaps(graph, opts = {}) {
     const perFile = new Map();
     // Multi-program repos flood identical titles (76 x main) across files; the
     // per-FILE cap cannot see it. Same diversity principle, second axis.
-    const maxPerTitle = 2;
+    const maxPerTitle = Math.max(1, opts.maxPerTitle ?? 2);
     const perTitle = new Map();
     const surfaced = [];
     const overflow = [];
@@ -457,8 +515,21 @@ export function rankRiskGaps(graph, opts = {}) {
         if (surfaced.length >= limit)
             break;
     }
-    if (surfaced.length < limit)
-        surfaced.push(...overflow.slice(0, limit - surfaced.length));
+    // A report-level title cap is a hard product constraint: relaxing it during
+    // backfill recreates duplicate Invoke/Config cards. We may relax only the
+    // per-file cap to fill remaining slots with distinct behavior titles.
+    if (surfaced.length < limit) {
+        for (const gap of overflow) {
+            const tKey = (gap.title || "").split("(")[0].trim();
+            const tUsed = perTitle.get(tKey) ?? 0;
+            if (tUsed >= maxPerTitle)
+                continue;
+            perTitle.set(tKey, tUsed + 1);
+            surfaced.push(gap);
+            if (surfaced.length >= limit)
+                break;
+        }
+    }
     // Guarantee: the surfaced list is ALWAYS highest-risk-first, even when the
     // per-file diversity backfill re-admits overflow items (which otherwise land
     // appended after lower-scored rows).

package/dist/local/viz/behaviorReportData.js

@@ -1,6 +1,8 @@
+import { createHash } from "node:crypto";
 import path from "node:path";
 import { buildRtm } from "../rtm.js";
-import { isEntryPoint, rankRiskGaps } from "../score/risk.js";
+import { inspectRiskInputHealth, isEntryPoint, rankRiskGaps } from "../score/risk.js";
+import { ORANGEPRO_VERSION } from "../version.js";
 import { PROOF_BLOCKER_GUIDE } from "../proofDoctor.js";
 /** Short human phrase per R-1 needs_setup category, for the "blocked because: …" panel copy. */
 const BLOCK_CATEGORY_LABEL = {
@@ -105,13 +107,27 @@ function isNoneTier(tier) {
     return tier !== "proven" && tier !== "associated" && tier !== "runtime" && tier !== "candidate";
 }
 function summaryFromRows(rows, flowIds) {
+    // buildRtm intentionally unions valid proof rows that fall outside the static
+    // denominator. They remain visible and count as Dynamically Proven, but must
+    // never increase the "Methods found" denominator.
+    const denominatorRows = rows.filter((r) => r.off_denominator !== true);
     const proven = rows.filter((r) => r.evidence_tier === "proven").length;
-    const associated = rows.filter((r) => r.evidence_tier === "associated" || r.evidence_tier === "runtime").length;
-    const candidate = rows.filter((r) => r.evidence_tier === "candidate").length;
-    const noneRows = rows.filter((r) => isNoneTier(r.evidence_tier));
+    const provenOutsideDenominator = rows.filter((r) => r.off_denominator === true && r.evidence_tier === "proven").length;
+    const associated = denominatorRows.filter((r) => r.evidence_tier === "associated" || r.evidence_tier === "runtime").length;
+    const candidate = denominatorRows.filter((r) => r.evidence_tier === "candidate").length;
+    const noneRows = denominatorRows.filter((r) => isNoneTier(r.evidence_tier));
     // DISPLAY-ONLY split of `none`: a none-tier symbol that shows up in a static flow is "Reachable Untested".
     const reachableUntested = noneRows.filter((r) => flowIds.has(r.behavior_id)).length;
-    return { total: rows.length, proven, associated, candidate, none: noneRows.length, reachableUntested, noSignal: noneRows.length - reachableUntested };
+    return {
+        total: denominatorRows.length,
+        proven,
+        ...(provenOutsideDenominator > 0 ? { provenOutsideDenominator } : {}),
+        associated,
+        candidate,
+        none: noneRows.length,
+        reachableUntested,
+        noSignal: noneRows.length - reachableUntested
+    };
 }
 /** Verbatim 0-dynamic-proof explainer copy. Rendered only when summary.proven === 0. */
 const ZERO_PROOF_EXPLAINER = {
@@ -402,12 +418,10 @@ function riskGeneratedTests(graph, gap, riskIds, isFirstRowForFile) {
         runnable: t.runnable !== false
     }));
 }
-/** Incoming refs are method-attributed and can be fractional (a file-level
- *  reference split across its symbols). Display rounds; sub-1 shows "<1". */
+/** Incoming refs are method-attributed and can be fractional when a file-level
+ * reference is split across its symbols. Preserve that weighting honestly. */
 function fmtRefs(n) {
-    if (n > 0 && n < 1)
-        return "<1";
-    return String(Math.round(n));
+    return Number.isInteger(n) ? String(n) : n.toFixed(1);
 }
 function displayTitle(title, file) {
     if (title.includes("."))
@@ -430,9 +444,12 @@ function riskContext(risk) {
             ? `${5 - (risk.flow_position ?? 0)} call${5 - (risk.flow_position ?? 0) === 1 ? "" : "s"} from the nearest entry point`
             : "deep in the call graph";
     const refs = fmtRefs(risk.incoming_refs);
+    const churn = risk.churn_available !== false
+        ? `${risk.git_churn} line${risk.git_churn === 1 ? "" : "s"} changed in 180 days`
+        : "Git churn unavailable (provisional static-only ranking)";
     const parts = [
         `Sits at ${pos}${sens ? ` on ${sens} paths` : ""}.`,
-        `${refs} caller${refs === "1" ? "" : "s"}, ${risk.fan_out ?? 0} downstream call${(risk.fan_out ?? 0) === 1 ? "" : "s"}, ${risk.git_churn} line${risk.git_churn === 1 ? "" : "s"} changed in 180 days — and no test proves its behavior.`
+        `${refs} weighted incoming reference${risk.incoming_refs === 1 ? "" : "s"}, ${risk.fan_out ?? 0} downstream call${(risk.fan_out ?? 0) === 1 ? "" : "s"}, ${churn} — and no test proves its behavior.`
     ];
     return parts.join(" ");
 }
@@ -748,12 +765,11 @@ function riskTodo(risk, verb, path, generatedTests) {
         : risk.entry_point
             ? `invokes ${displayTitle(risk.title, risk.file)} through its entry point`
             : `calls ${displayTitle(risk.title, risk.file)} directly`;
-    const s = risk.data_sensitivity ?? 1;
-    const sens = s >= 10
-        ? " Include a failure case: a rejected transaction must leave no partial state."
-        : s >= 9
+    const sens = (risk.data_sensitivity ?? 1) >= 10
+        ? " Include a failure case: a rejected payment must leave no partial state."
+        : (risk.data_sensitivity ?? 1) >= 9
             ? " Include a negative case: invalid or expired credentials must fail closed."
-            : s >= 7
+            : (risk.data_sensitivity ?? 1) >= 7
                 ? " Include a failure case: a rejected transaction must leave no partial state."
                 : "";
     if (risk.integration_signal === "candidate") {
@@ -789,9 +805,11 @@ function riskRows(risks, graph) {
         const methodMatch = risk.title.match(/^(GET|POST|PUT|PATCH|DELETE)\s+(.+)$/i);
         const tags = [];
         const bucket = riskBucket(risk.risk_score, maxRiskScore);
-        if (bucket)
+        if (risk.churn_available === false)
+            tags.push(["provisional rank", "info"]);
+        else if (bucket)
             tags.push([`${bucket} risk`, "risk"]);
-        tags.push([`${fmtRefs(risk.incoming_refs)} incoming refs`, "info"]);
+        tags.push([`${fmtRefs(risk.incoming_refs)} weighted refs`, "info"]);
         if (risk.entry_point)
             tags.push(["Entry point", "entry"]);
         return {
@@ -833,7 +851,23 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
     const flowIds = flowSymbolIds(graph);
     const summary = summaryFromRows(rows, flowIds);
     const repoRoot = opts.repoRoot ?? graph.workspace.root;
-    const riskGaps = rankRiskGaps(graph, { repoRoot, limit: opts.riskLimit ?? 20, maxPerFile: 3 });
+    const riskGaps = rankRiskGaps(graph, { repoRoot, limit: opts.riskLimit ?? 20, maxPerFile: 3, maxPerTitle: 1 });
+    const riskHealth = inspectRiskInputHealth(repoRoot);
+    const churnAvailable = riskHealth.churnAvailable && riskGaps.every((risk) => risk.churn_available !== false);
+    const provenance = {
+        source: path.basename(repoRoot || graph.workspace.name || "repo"),
+        gitRoot: riskHealth.gitRoot ? path.basename(riskHealth.gitRoot) : null,
+        commit: riskHealth.commit,
+        history: riskHealth.history,
+        churn: churnAvailable ? "available" : "unavailable",
+        churnWindow: riskHealth.churnWindow,
+        toolVersion: ORANGEPRO_VERSION,
+        inputFingerprint: createHash("sha256")
+            .update(JSON.stringify({ root: graph.workspace.root_hash, commit: riskHealth.commit, history: riskHealth.history, churn: churnAvailable, window: riskHealth.churnWindow, version: ORANGEPRO_VERSION }))
+            .digest("hex")
+            .slice(0, 16),
+        reason: churnAvailable ? undefined : (riskHealth.reason ?? "Git churn scan did not complete")
+    };
     const lists = behaviorLists(rows, flowIds);
     const risks = riskRows(riskGaps, graph);
     const sortedBehaviors = [...lists.behaviors].sort((a, b) => tierRank(a) - tierRank(b));
@@ -843,6 +877,7 @@ export function buildBehaviorReportData(graph, ledger, opts = {}) {
         scanned: (graph.updated_at || graph.created_at || new Date(0).toISOString()).slice(0, 10),
         framework: frameworkLabel(graph),
         analysisKind: summary.proven > 0 ? "static+dynamic" : "static",
+        provenance,
         summary,
         proofGuidance: proofGuidance(ledger, summary, opts.dynamicProof),
         pipeline: pipeline(graph, ledger, summary),

package/dist/local/viz/behaviorReportHtml.js

@@ -33,9 +33,11 @@ a{color:var(--blue);text-decoration:none}
 .hdr-name{font-size:15px;font-weight:650;letter-spacing:-.01em}
 .hdr-right{font-size:11.5px;color:var(--muted);display:flex;gap:10px;align-items:center}
 .hdr-tag{background:var(--s2);border:1px solid var(--bd);border-radius:4px;padding:2px 7px;font-family:var(--mono);font-size:10.5px;color:var(--ink2)}
+.provenance{margin:10px 0 0;padding:8px 10px;border:1px solid var(--bd);border-radius:7px;background:var(--s1);color:var(--muted);font:10.5px/1.45 var(--mono)}
+.provenance.warn{border-color:var(--rbd);background:var(--rbg);color:var(--red)}
 
 /* KPI STRIP */
-.kpis{display:grid;grid-template-columns:repeat(5,1fr);gap:10px;margin:16px 0 0}
+.kpis{display:grid;grid-template-columns:repeat(4,1fr);gap:10px;margin:16px 0 0}
 .kpi{background:var(--s1);border:1px solid var(--bd);border-radius:9px;padding:13px 14px;position:relative;overflow:hidden}
 .kpi::before{content:"";position:absolute;inset:0;pointer-events:none;opacity:.4;background:radial-gradient(90px 70px at 100% 0%,var(--kw,transparent),transparent 70%)}
 .kpi-lbl{font-size:10px;color:var(--muted);font-weight:600;letter-spacing:.05em;text-transform:uppercase;position:relative}
@@ -46,6 +48,8 @@ a{color:var(--blue);text-decoration:none}
 .kpi[data-t="signal"]{--kw:var(--abg)} .kpi[data-t="signal"] .kpi-num{color:var(--amber)}
 .kpi[data-t="reach"]{--kw:var(--bbg)} .kpi[data-t="reach"] .kpi-num{color:var(--blue)}
 .kpi[data-t="nosig"]{--kw:var(--rbg)} .kpi[data-t="nosig"] .kpi-num{color:var(--red)}
+.kpi[data-t="priority"]{--kw:var(--obg)} .kpi[data-t="priority"] .kpi-num{color:var(--orange)}
+.metric-scope{margin:9px 2px 0;color:var(--muted);font-size:11.5px;line-height:1.5}
 
 /* TABS */
 nav.tabs{display:flex;gap:2px;margin:18px 0 0;border-bottom:1px solid var(--bd)}
@@ -261,12 +265,14 @@ nav.tabs{display:flex;gap:2px;margin:18px 0 0;border-bottom:1px solid var(--bd)}
     <span id="scan-date">—</span>
   </div>
 </header>
+<div class="provenance" id="provenance"></div>
 
 <section class="kpis" id="kpis"></section>
+<p class="metric-scope" id="metric-scope"></p>
 
 <nav class="tabs" role="tablist">
   <button class="tab" role="tab" aria-selected="true" data-tab="codebase">Your Code</button>
-  <button class="tab" role="tab" aria-selected="false" data-tab="risks">Risks <span class="tc" id="t-risk">—</span></button>
+  <button class="tab" role="tab" aria-selected="false" data-tab="risks">Priority gaps <span class="tc" id="t-risk">—</span></button>
   <button class="tab" role="tab" aria-selected="false" data-tab="flows">Flows <span class="tc" id="t-flow">—</span></button>
   <button class="tab" role="tab" aria-selected="false" data-tab="behaviors">Behaviors <span class="tc" id="t-beh">—</span></button>
 </nav>
@@ -276,7 +282,7 @@ nav.tabs{display:flex;gap:2px;margin:18px 0 0;border-bottom:1px solid var(--bd)}
   <p class="bridge">We scanned your repo and found <b id="br-methods">—</b> public methods across <b id="br-services">—</b> services, with <b id="br-tests">—</b> test files. Here's what we're working with.</p>
   <div id="delta-banner"></div>
   <div class="card" id="sysmap-card" hidden>
-    <p class="card-lbl">Your system, as the graph sees it — entry lanes flowing into the services they reach. Node size = flow traffic; color = dominant evidence tier; red ring = top-20 risk. Identical on every run.</p>
+    <p class="card-lbl">Your system, as the graph sees it — entry lanes flowing into the services they reach. Node size = flow traffic; color = dominant evidence tier; red ring = top-20 risk. Repeatable for the same commit, Git history, configuration, and OrangePro version.</p>
     <div id="sysmap"></div>
   </div>
   <div class="cols2">
@@ -325,7 +331,7 @@ nav.tabs{display:flex;gap:2px;margin:18px 0 0;border-bottom:1px solid var(--bd)}
 
 <!-- TAB 4: RISKS — actionable -->
 <section class="panel" id="panel-risks" role="tabpanel">
-  <p class="bridge">These are the flows with the highest blast radius and the weakest test coverage, <b>sorted highest risk first</b>. Each one tells you exactly what to do next.</p>
+  <p class="bridge">This is the <b>priority-gap worklist</b>, ranked by blast radius and test weakness. It is separate from the coverage-status cards above: <b>Reachable · no test signal</b> is one strict coverage bucket, not the number of priority gaps.</p>
   <p class="bridge" id="risk-cap-note" style="font-size:12px;opacity:.75"></p>
   <div class="risk-tools" id="risk-tools"></div>
   <div id="risk-list"></div>
@@ -356,7 +362,7 @@ const D=window.DATA,$=(s)=>document.querySelector(s);
   var when=new Date(d.baselineTs);
   var ago=isNaN(when.getTime())?"last run":when.toLocaleString();
   if(!d.changed){
-    el2.innerHTML='<div class="delta-wrap"><span class="delta-chip dc-none">No changes since last run ('+ago+') — identical graph, identical ranking</span></div>';
+    el2.innerHTML='<div class="delta-wrap"><span class="delta-chip dc-none">No report changes since last run ('+ago+') for the recorded inputs</span></div>';
     return;
   }
   var chips=[];
@@ -471,6 +477,11 @@ const S=D.summary;
 $("#repo-name").textContent=D.repo;
 $("#scan-date").textContent=new Date(D.scanned+"T00:00:00").toLocaleDateString("en-US",{month:"short",day:"numeric",year:"numeric"});
 $("#framework").textContent=D.framework;
+const P=D.provenance;
+const prov=$("#provenance");
+const provisional=P.churn!=="available";
+prov.classList.toggle("warn",provisional);
+prov.textContent=(provisional?"PROVISIONAL RANKING · ":"VERIFIED INPUTS · ")+"source "+P.source+" · commit "+(P.commit?P.commit.slice(0,12):"unavailable")+" · history "+P.history+" · churn "+P.churn+" ("+P.churnWindow+") · OrangePro "+P.toolVersion+" · input "+P.inputFingerprint+(P.reason?" · "+P.reason:"");
 $("#fw-pill").textContent=D.framework;
 
 // bridge text in codebase tab
@@ -484,18 +495,23 @@ $("#t-flow").textContent=D.flows.length;
 $("#t-risk").textContent=D.risks.length;
 
 // KPIs
+const priorityGapCount=D.risks.length;
 [
   {lbl:"Methods found",num:S.total,sub:"public, with observable outcome",t:"total"},
   {lbl:"Dynamically Proven",num:S.proven,sub:"test breaks if you change it",t:"proven"},
   {lbl:"Test signal",num:S.associated,sub:"hard static test link, no proof",t:"signal"},
   {lbl:"Candidate",num:S.candidate??0,sub:"lexical match only — unconfirmed",t:"cand"},
-  {lbl:"Reachable",num:S.reachableUntested,sub:"called but untested",t:"reach"},
-  {lbl:"No signal",num:S.noSignal,sub:"nothing touches it",t:"nosig"},
+  {lbl:"Reachable · no test signal",num:S.reachableUntested,sub:"coverage bucket — not the risk count",t:"reach"},
+  {lbl:"Unreached · no test signal",num:S.noSignal,sub:"no detected flow or test signal",t:"nosig"},
+  {lbl:"Priority gaps",num:priorityGapCount,sub:"top-ranked worklist across unproven tiers",t:"priority"},
 ].forEach(k=>{
   const d=el("div","kpi",\`<div class="kpi-lbl">\${k.lbl}</div><div class="kpi-num">\${k.num}</div><div class="kpi-sub">\${k.sub}</div>\`);
   d.dataset.t=k.t;
   $("#kpis").append(d);
 });
+const outsideProofs=S.provenOutsideDenominator??0;
+const coverageAccounted=(S.proven-outsideProofs)+S.associated+(S.candidate??0)+S.reachableUntested+S.noSignal;
+$("#metric-scope").textContent="Coverage status classifies "+coverageAccounted.toLocaleString()+" of "+S.total.toLocaleString()+" mapped behaviors. Priority gaps is a separate ranked worklist of "+priorityGapCount.toLocaleString()+" unproven behaviors; it does not equal the Reachable count."+(outsideProofs?" "+outsideProofs.toLocaleString()+" additional dynamically proven behavior"+(outsideProofs===1?" is":"s are")+" shown outside the static denominator.":"");
 
 // codebase
 D.scan.services.forEach(([nm,ct])=>$("#svc-list").append(el("div","svc",\`<span class="nm">\${esc(nm)}</span><span class="ct">\${ct}</span>\`)));
@@ -630,7 +646,7 @@ document.onkeydown=e=>{if(e.key==="Escape"){drill.classList.remove("open");docum
 // flows
 const fl=$("#flow-list");
 D.flows.forEach(f=>{
-  const rBadge=f.risk==="critical"?\`<span class="badge b-risk"><span class="d"></span>critical</span>\`:\`<span class="badge b-signal"><span class="d"></span>high</span>\`;
+  const rBadge=f.risk==="critical"?\`<span class="badge b-risk"><span class="d"></span>critical</span>\`:f.risk==="high"?\`<span class="badge b-signal"><span class="d"></span>high</span>\`:\`<span class="badge b-info"><span class="d"></span>medium risk</span>\`;
   const pBadge=f.proof==="proven"?\`<span class="badge b-proven"><span class="d"></span>dynamically proven</span>\`:f.proof==="assoc"?\`<span class="badge b-signal"><span class="d"></span>signal</span>\`:\`<span class="badge b-nosig"><span class="d"></span>no proof</span>\`;
 
   const totalNodes=(f.trigger?1:0)+f.steps.length;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orangepro/orangepro-mcp",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "private": false,
   "description": "OrangePro (`opro`) — a local-first, BYOK CLI + MCP server that builds an evidence graph from a local checkout, ingests runtime coverage, and generates grounded tests. Metadata-only exports; no source upload; generated tests stay local.",
   "license": "MIT",