deepdebug-local-agent 1.2.0 → 1.4.0

package/test/ws-channel/policy-offline.test.js

@@ -0,0 +1,99 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createConnectionState } from '../../src/ws-channel/connection-state.js';
+import { createOfflinePolicyGuard, requiresPolicyGate, decideOffline } from '../../src/ws-channel/policy-offline.js';
+import { decideExec } from '../../src/utils/exec-policy.js';
+
+test('connection state: online only while open and fresh', () => {
+  let t = 0;
+  const c = createConnectionState({ now: () => t, staleAfterMs: 90_000 });
+  assert.equal(c.isOnline(), false);
+  c.markOpen();
+  assert.equal(c.isOnline(), true);
+  t = 60_000; c.markSeen();
+  t = 120_000;
+  assert.equal(c.isOnline(), true);
+  t = 200_000;
+  assert.equal(c.isOnline(), false, 'stale = offline');
+  c.markSeen(); // ignored while stale? still open, refreshes
+  assert.equal(c.isOnline(), true);
+  c.markClosed();
+  assert.equal(c.isOnline(), false);
+  c.markSeen();
+  assert.equal(c.isOnline(), false, 'a message on a closed socket does not revive it');
+});
+
+test('D19 classification: only PolicyGate-backed decisions need the gate', () => {
+  assert.equal(requiresPolicyGate('platform-tool:git_push'), true);
+  assert.equal(requiresPolicyGate('human-approval:ana'), true);
+  assert.equal(requiresPolicyGate('allowlist:git'), false);
+  assert.equal(requiresPolicyGate('policy-off'), false);
+  assert.deepEqual(decideOffline({ gated: true, online: false }).decision, 'DENY');
+  assert.deepEqual(decideOffline({ gated: true, online: true }).decision, 'ALLOW');
+  assert.deepEqual(decideOffline({ gated: false, online: false }).decision, 'ALLOW');
+});
+
+test('D19 guard: offline DENY for gated allows, allowlisted local commands unaffected', () => {
+  const state = { online: false };
+  const denied = [];
+  const guard = createOfflinePolicyGuard({ connection: { isOnline: () => state.online }, onDeny: (d) => denied.push(d) });
+  const gated = { allow: true, via: 'platform-tool:git_push' };
+  const local = { allow: true, via: 'allowlist:git' };
+
+  const d = guard(gated);
+  assert.equal(d.allow, false);
+  assert.equal(d.status, 403);
+  assert.equal(d.via, 'policy-gate-offline');
+  assert.deepEqual(denied, [{ via: 'platform-tool' }]);
+  assert.equal(guard(local), local);
+  assert.deepEqual(guard({ allow: false, via: 'rejected' }), { allow: false, via: 'rejected' });
+
+  state.online = true;
+  assert.equal(guard(gated), gated, 'online: PolicyGate path unchanged');
+});
+
+test('D19 via decideExec: a signed platform tool is denied offline, allowed online; flag off = unchanged', () => {
+  const input = {
+    command: 'git push origin feat/x', root: process.cwd(), headers: {},
+    body: { commandOrigin: 'platform', tool: 'git_push' }, vhSignature: { verified: true },
+  };
+  const base = { mode: 'enforce' };
+  assert.equal(decideExec(input, base).allow, true, 'flag off (no guard): unchanged');
+  let online = false;
+  const cfg = { mode: 'enforce', offlineGuard: createOfflinePolicyGuard({ connection: { isOnline: () => online } }) };
+  const off = decideExec(input, cfg);
+  assert.equal(off.allow, false);
+  assert.equal(off.via, 'policy-gate-offline');
+  online = true;
+  assert.equal(decideExec(input, cfg).allow, true);
+});
+
+test('D19 on the MCP bridge: /mcp/execute-command denies a platform tool offline, allows it online', async () => {
+  const net = await import('node:net');
+  const { startMCPHttpServer } = await import('../../src/mcp-http-server.js');
+  const { internalSignatureHeaders } = await import('../../src/utils/request-signing.js');
+  const port = await new Promise((resolve) => {
+    const s = net.createServer().listen(0, '127.0.0.1', () => { const p = s.address().port; s.close(() => resolve(p)); });
+  });
+  let online = false;
+  const execPolicy = { mode: 'enforce', offlineGuard: createOfflinePolicyGuard({ connection: { isOnline: () => online } }) };
+  const app = startMCPHttpServer({ resolveRoot: () => process.cwd(), count: 0, list: () => [] }, port, execPolicy);
+  await new Promise((r) => (app.locals.server.listening ? r() : app.locals.server.once('listening', r)));
+  try {
+    const call = () => fetch(`http://127.0.0.1:${port}/mcp/execute-command`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', ...internalSignatureHeaders() },
+      body: JSON.stringify({ workspaceId: 'w', command: 'git --version', commandOrigin: 'platform', tool: 'current_branch' }),
+    });
+    const off = await call();
+    const offBody = await off.json();
+    assert.equal(off.status, 403);
+    assert.equal(offBody.ok, false);
+    assert.match(String(offBody.reason), /control plane|offline|policy/i);
+    online = true;
+    const on = await call();
+    assert.notEqual(on.status, 403, 'online: PolicyGate path unchanged');
+  } finally {
+    app.locals.server.close();
+  }
+});

package/test/ws-channel/tunnel-e2e.test.js

@@ -0,0 +1,88 @@
+// End-to-end: boots the real agent against a fake control-plane WS server and
+// inspects what actually leaves the socket (T4-10).
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import net from 'node:net';
+import os from 'node:os';
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { WebSocketServer } from 'ws';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+const SECRET = 'TOP_SECRET_SOURCE_MARKER_8841';
+
+const freePort = () => new Promise((res) => { const s = net.createServer().listen(0, '127.0.0.1', () => { const p = s.address().port; s.close(() => res(p)); }); });
+
+async function run({ flag, disableTunnel = false }) {
+  const ws = fs.mkdtempSync(path.join(os.tmpdir(), 'wsmeta-ws-'));
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'wsmeta-home-'));
+  fs.writeFileSync(path.join(ws, 'secret.txt'), SECRET);
+  const wss = new WebSocketServer({ port: 0, host: '127.0.0.1' });
+  await new Promise((r) => wss.on('listening', r));
+  const frames = [];
+  let connections = 0;
+  wss.on('connection', (sock) => {
+    connections++;
+    sock.on('message', (d) => {
+      const t = d.toString();
+      if (t === 'ping') return;
+      frames.push(JSON.parse(t));
+      if (frames[frames.length - 1].type === 'register') {
+        sock.send(JSON.stringify({ requestId: 'req-health', command: 'health', params: {} }));
+        sock.send(JSON.stringify({ requestId: 'req-file', command: 'workspace.file-content', params: { path: 'secret.txt', workspacePath: ws } }));
+      }
+    });
+  });
+  const env = { ...process.env, PORT: String(await freePort()), GATEWAY_URL: `http://127.0.0.1:${wss.address().port}`,
+    TENANT_ID: 'tenant-test', AUTH_TOKEN: 'test-token', WORKSPACE_ROOT: ws, HOME: home,
+    LOCAL_AGENT_SIGNATURE_MODE: 'off', ...(flag ? { LOCAL_AGENT_WS_METADATA_ONLY: flag } : {}),
+    ...(disableTunnel ? { DISABLE_WS_TUNNEL: 'true' } : {}) };
+  delete env.LOCAL_AGENT_TOKEN;
+  const child = spawn(process.execPath, ['src/server.js'], { cwd: ROOT, env, stdio: 'ignore' });
+  try {
+    const deadline = Date.now() + (disableTunnel ? 4000 : 20000);
+    while (Date.now() < deadline) {
+      if (frames.some((f) => f.requestId === 'req-file') && frames.some((f) => f.requestId === 'req-health')) break;
+      await new Promise((r) => setTimeout(r, 100));
+    }
+  } finally {
+    child.kill('SIGKILL');
+    for (const c of wss.clients) c.terminate();
+    await new Promise((r) => wss.close(r));
+    fs.rmSync(ws, { recursive: true, force: true });
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+  return { frames, connections };
+}
+
+test('flag off (default): legacy channel is unchanged', async () => {
+  const { frames } = await run({});
+  const reg = frames.find((f) => f.type === 'register');
+  assert.ok(reg && 'workspacePath' in reg, 'legacy register still carries workspacePath');
+  const file = frames.find((f) => f.requestId === 'req-file');
+  assert.equal(file.content, SECRET, 'legacy content command still works with the flag off');
+});
+
+test('enforce: nothing but allowlisted metadata leaves the socket, content never does', async () => {
+  const { frames } = await run({ flag: 'enforce' });
+  assert.ok(frames.length >= 3, 'register + 2 replies expected');
+  assert.equal(JSON.stringify(frames).includes(SECRET), false);
+  assert.equal(JSON.stringify(frames).includes('secret.txt'), false);
+  const reg = frames.find((f) => f.type === 'register');
+  assert.equal(reg.workspacePath, undefined);
+  assert.match(reg.workspaceHash, /^[a-f0-9]{64}$/);
+  assert.deepEqual(frames.find((f) => f.requestId === 'req-file'),
+    { requestId: 'req-file', command: 'workspace.file-content', ok: false, errorCode: 'blocked_metadata_only' });
+  const health = frames.find((f) => f.requestId === 'req-health');
+  assert.equal(health.status, 'ok');
+  assert.equal('workspace' in health, false);
+});
+
+test('DISABLE_WS_TUNNEL=true: no socket is opened, whatever the flag', async () => {
+  for (const flag of [undefined, 'enforce']) {
+    const { connections } = await run({ flag, disableTunnel: true });
+    assert.equal(connections, 0, `flag=${flag}`);
+  }
+});

package/tools/graphify-validation/extras/README.md

@@ -0,0 +1,19 @@
+# Graphify validation extras (T4-06, round 2, 2026-10-28)
+
+Evidence scripts used for `10 Library/Plans/Fecho Dados 2026-10-28 T4.md`. They sit beside the harness and read its
+output; nothing here is part of the agent runtime. Layout expected under `$GV_T4_ROOT`:
+`harness/` (a `git archive` of this repo), `out/run1/` (a `run.sh --out` directory: `venv/`, `work/`, `results/`),
+`bin/rg` (ripgrep wrapper), `g10/home/` (empty HOME), `pub/` (shallow clones of public Go/Terraform repos).
+
+| Script | What it measures |
+|---|---|
+| `g10.py` | cold run, network denied, determinism and per-language file coverage for extra repos (Python, TS, Go, Terraform, SQL) |
+| `truth2.py` | `affected` recall against a code-only ground truth (comment, import and test lines removed), class level and class+methods |
+| `bymethod.py` | `affected` by class versus by method, against `rg -w` as the harness does |
+| `hybrid.py` | recall@8 of graph, lexical, reciprocal-rank fusion and lexical-first interleave |
+| `g3aug.py` | G3 Spring fixture with a wrapper-level "call via interface reaches implementations" post-process |
+| `docker/` | G9: image from `requirements-py311.lock` (build context `tools/graphify-validation`), `inner.sh` measures wall time and cgroup peak |
+
+Docker run used for the numbers: `docker run --rm --read-only --network none --user 10001:10001 --cpus=2 --memory=4g
+--tmpfs /tmp -e HOME=/data/home -v DATA:/data -v inner.sh:/inner.sh:ro --entrypoint /bin/sh IMAGE /inner.sh REPO RUN`.
+Public repos are only parsed (tree-sitter), never executed. No customer repository is involved.

package/tools/graphify-validation/extras/bymethod.py

@@ -0,0 +1,35 @@
+import os
+import sys, json, pathlib, subprocess, os
+SP=pathlib.Path(os.environ['GV_T4_ROOT'])
+sys.path.insert(0,str(SP/'harness/tools/graphify-validation/lib'))
+os.environ['RG']=str(SP/'bin/rg')
+import affected_vs_rg as A, gv_common as gc, graph_metrics as gm
+S=json.load(open(SP/'harness/tools/graphify-validation/config/symbols.json'))
+env=gc.clean_env(SP/'g10/home',str(SP/'out/run1/venv/bin')); G=str(SP/'out/run1/venv/bin/graphify')
+out={}
+for repo in ['vh-api-gateway','visionhammer-agents','deepdebug-local-agent']:
+    wd=SP/'out/run1/work'/repo; g=gm.load_graph(wd)
+    syms=S[repo] if isinstance(S,dict) else S
+    rows=[]
+    for sym in syms:
+        cls=[n for n in g['nodes'] if n.get('label')==sym and n.get('source_file') and not n['label']==n['source_file'].rsplit('/',1)[-1]]
+        if not cls: rows.append({'symbol':sym,'status':'nodef'}); continue
+        defs={n['source_file'] for n in cls}
+        ids=[n['id'] for n in cls]
+        for n in g['nodes']:
+            if n.get('source_file') in defs and n.get('label','').startswith('.') and n['label'].endswith('()'):
+                ids.append(n['id'])
+        files=set()
+        for i in ids:
+            r=subprocess.run([G,'affected',i,'--depth','1'],cwd=str(wd),env=env,capture_output=True,text=True,timeout=300)
+            files|=A.parse_affected(r.stdout)
+        files-=defs
+        rgf=gc.files_with_word(wd,sym,include_tests=True)-defs
+        m=lambda s:{f for f in s if not gc.is_test_path(f)}
+        gf,rf=m(files),m(rgf)
+        rows.append({'symbol':sym,'methods':len(ids)-len(cls),'graph':len(gf),'rg':len(rf),'recall':round(100*len(gf&rf)/len(rf),1) if rf else None,'precision':round(100*len(gf&rf)/len(gf),1) if gf else None})
+    rr=[r for r in rows if r.get('recall') is not None]
+    tot_rg=sum(r['rg'] for r in rr); tot_both=sum(round(r['recall']*r['rg']/100) for r in rr)
+    out[repo]={'rows':rows,'agg_recall_pct':round(100*tot_both/tot_rg,1) if tot_rg else None}
+    print(repo,out[repo]['agg_recall_pct'],[(r['symbol'],r.get('methods'),r.get('recall')) for r in rows])
+json.dump(out,open(SP/'g10/bymethod.json','w'),indent=1)

package/tools/graphify-validation/extras/docker/Dockerfile

@@ -0,0 +1,16 @@
+# T4-06 G9 test image: mirrors the python slice of the LA Dockerfile.full (node:20-slim = Debian 12, python3 3.11) + packaging plan 2.2
+FROM node:20-slim AS base
+RUN apt-get update && apt-get install -y --no-install-recommends git python3 python3-pip \
+ && rm -rf /var/lib/apt/lists/*
+
+FROM base AS graphify
+RUN apt-get update && apt-get install -y --no-install-recommends python3-venv ripgrep \
+ && rm -rf /var/lib/apt/lists/*
+COPY requirements-py311.lock /tmp/graphify.lock
+RUN python3 -m venv /opt/vh-graphify \
+ && /opt/vh-graphify/bin/pip install --no-cache-dir --disable-pip-version-check \
+      --require-hashes --no-deps --only-binary=:all: -r /tmp/graphify.lock \
+ && /opt/vh-graphify/bin/python -m compileall -q /opt/vh-graphify/lib \
+ && rm -f /opt/vh-graphify/bin/graphify-mcp /tmp/graphify.lock
+RUN useradd -u 10001 -m -d /nonexistent-home vhga 2>/dev/null || true
+ENV PATH=/opt/vh-graphify/bin:$PATH PYTHONDONTWRITEBYTECODE=1 PYTHONHASHSEED=0

package/tools/graphify-validation/extras/docker/inner.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+# runs inside the container: $1 = repo dir under /data/ws
+S=$(date +%s.%N)
+graphify update /data/ws/$1 > /data/log-$1-$2.txt 2>&1; RC=$?
+E=$(date +%s.%N)
+PEAK=$(cat /sys/fs/cgroup/memory.peak 2>/dev/null)
+echo "repo=$1 run=$2 rc=$RC wall=$(echo "$E $S" | awk '{printf "%.1f",$1-$2}')s cgroup_peak_mb=$(echo $PEAK | awk '{printf "%.0f",$1/1048576}')"

package/tools/graphify-validation/extras/g10.py

@@ -0,0 +1,59 @@
+import os
+import sys, os, json, subprocess, shutil, pathlib, collections
+LIB=os.path.join(os.environ['GV_T4_ROOT'],'harness/tools/graphify-validation/lib')
+sys.path.insert(0, LIB)
+import run_graphify as rgf, graph_metrics as gm, gv_common as gc
+SP=pathlib.Path(os.environ['GV_T4_ROOT'])
+VENV=SP/'out/run1/venv'; BIN=str(VENV/'bin'); G=str(VENV/'bin/graphify')
+W=SP/'g10/work'; W.mkdir(exist_ok=True)
+HOME=SP/'g10/home'; HOME.mkdir(exist_ok=True)
+BASE='/Users/eduardooliveira/Documents/visionhammer projects/'
+targets=[
+ ('vh-litellm', BASE+'vh-litellm','origin/main'),
+ ('visionhammer-pentest', BASE+'../x','') ,
+ ('vision-heart-glow','%svision-heart-glow-3478cd8d'%BASE,'origin/main'),
+ ('go-chi-chi', str(SP/'pub/chi'),'HEAD'),
+ ('spf13-cobra', str(SP/'pub/cobra'),'HEAD'),
+ ('tf-aws-vpc', str(SP/'pub/terraform-aws-vpc'),'HEAD'),
+ ('tf-provider-random', str(SP/'pub/terraform-provider-random'),'HEAD'),
+]
+targets=[t for t in targets if t[2]]
+targets.append(('visionhammer-pentest', str(pathlib.Path(os.environ.get('GV_PENTEST_CLONE','/nonexistent'))),'HEAD'))
+wrap,mech=rgf.network_wrapper()
+ok,why=rgf.verify_block(wrap,sys.executable)
+print('network block',mech,ok,why)
+EXTS={'.java':'java','.ts':'ts','.tsx':'ts','.js':'js','.jsx':'js','.mjs':'js','.py':'python','.go':'go','.tf':'terraform','.sql':'sql'}
+res={}
+for name,repo,ref in targets:
+    d=W/name
+    if d.exists(): shutil.rmtree(d)
+    d.mkdir(parents=True)
+    a=subprocess.Popen(['git','-C',repo,'archive',ref],stdout=subprocess.PIPE)
+    subprocess.run(['tar','-x','-C',str(d)],stdin=a.stdout,check=True); a.wait()
+    shutil.rmtree(d/'graphify-out',ignore_errors=True)
+    env=gc.clean_env(HOME,BIN)
+    audit=SP/('g10/audit-%s.tsv'%name)
+    r1=rgf.measure([G,'update','.'],d,env,wrapper=wrap,audit_file=audit)
+    g=gm.load_graph(d)
+    sig1=gm.signature(g)
+    # second cold
+    shutil.rmtree(d/'graphify-out')
+    r2=rgf.measure([G,'update','.'],d,env)
+    sig2=gm.signature(gm.load_graph(d))
+    # per-language coverage (own: includes sql), files with >=1 symbol
+    with_sym,_=gm.file_node_labels(g)
+    cnt=collections.defaultdict(lambda:[0,0])
+    for p in d.rglob('*'):
+        if p.is_file() and p.suffix in EXTS and 'node_modules' not in p.parts and 'graphify-out' not in p.parts and '.git' not in p.parts:
+            rel=str(p.relative_to(d)); lang=EXTS[p.suffix]
+            if gc.is_test_path(rel) and lang!='go': pass
+            cnt[lang][0]+=1
+            if rel in with_sym: cnt[lang][1]+=1
+    cov={k:{'files':v[0],'with_symbols':v[1],'pct':round(100*v[1]/v[0],1) if v[0] else None} for k,v in cnt.items()}
+    g2=gm.g2_edges(g)
+    rel=collections.Counter(e.get('relation') for e in gm.edges_of(g))
+    res[name]={'ref':ref,'cold':{k:r1[k] for k in ('exit_code','wall_s','peak_tree_rss_mb','max_child_rss_mb')},
+       'network_events':r1.get('audit'),'deterministic':sig1==sig2,'signature':sig1,'coverage_by_lang':cov,
+       'g1_harness':gm.g1_extraction(g,d),'inferred_pct':g2['inferred_pct'],'inferred_by_relation':g2['inferred_by_relation'],'relations_top':dict(rel.most_common(8))}
+    print(name, json.dumps({k:res[name][k] for k in ('cold','deterministic','coverage_by_lang','inferred_pct')}))
+json.dump(res,open(SP/'g10/g10.json','w'),indent=1)

package/tools/graphify-validation/extras/g3aug.py

@@ -0,0 +1,49 @@
+import os
+import sys, json, pathlib, os, copy, collections
+SP=pathlib.Path(os.environ['GV_T4_ROOT'])
+sys.path.insert(0,str(SP/'harness/tools/graphify-validation/lib'))
+import spring_fixture as sf, graph_metrics as gm
+wd=SP/'out/run1/work/spring-fixture'
+g=gm.load_graph(wd)
+exp=json.load(open(SP/'harness/tools/graphify-validation/fixtures/spring/expected.json'))
+base=sf.check(g,exp)
+print('baseline',{k:(v['found'],v['expected']) for k,v in base['groups'].items()})
+def augment(g):
+    g=copy.deepcopy(g); es=gm.edges_of(g)
+    byid={n['id']:n for n in g['nodes']}
+    # class of a method node = node in same file with non-method label (first)
+    file_cls={}
+    for n in g['nodes']:
+        sfile=n.get('source_file'); lab=n.get('label','')
+        if sfile and not lab.startswith('.') and lab!=os.path.basename(sfile): file_cls.setdefault(sfile,n['id'])
+    impls=collections.defaultdict(list)   # interface class id -> impl class ids
+    for e in es:
+        if e.get('relation') in ('implements','inherits','extends'): impls[e['target']].append(e['source'])
+    methods=collections.defaultdict(dict) # class id -> {label: id}
+    for n in g['nodes']:
+        lab=n.get('label','')
+        if lab.startswith('.') and n.get('source_file') in file_cls: methods[file_cls[n['source_file']]][lab]=n['id']
+    new=[]
+    for e in es:
+        if e.get('relation')!='calls': continue
+        t=byid.get(e['target']); 
+        if not t or t.get('source_file') not in file_cls: continue
+        iface=file_cls[t['source_file']]
+        for c in impls.get(iface,[]):
+            m=methods[c].get(t['label'])
+            if m: new.append({**e,'target':m,'relation':'calls','confidence':'INFERRED','note':'via-interface (wrapper)'})
+    # field-type edges (references) + implements: class A references interface I => A reaches impl classes (depth)
+    for e in es:
+        if e.get('relation')=='references' and e['target'] in impls:
+            for c in impls[e['target']]: new.append({**e,'target':c,'relation':'references','confidence':'INFERRED'})
+    g['links']=es+new if 'links' in g else g.get('edges',[])+new
+    if 'edges' in g and 'links' not in g: g['edges']=es+new
+    return g,len(new)
+g2,n=augment(g)
+aug=sf.check(g2,exp)
+print('augmented (+%d synthetic edges)'%n,{k:(v['found'],v['expected']) for k,v in aug['groups'].items()})
+print('interface_impl pct',base['groups']['interface_impl']['pct'],'->',aug['groups']['interface_impl']['pct'])
+for k,v in aug['groups'].items():
+    for it in v['items']:
+        if not it['found']: print('  still failing',k,it['id'],it['detail'])
+json.dump({'baseline':{k:v['pct'] for k,v in base['groups'].items()},'augmented':{k:v['pct'] for k,v in aug['groups'].items()},'synthetic_edges':n},open(SP/'g10/g3aug.json','w'))

package/tools/graphify-validation/extras/hybrid.py

@@ -0,0 +1,34 @@
+import os
+import sys, json, pathlib
+SP=pathlib.Path(os.environ['GV_T4_ROOT'])
+sys.path.insert(0,str(SP/'harness/tools/graphify-validation/lib'))
+import recall as R, gv_common as gc
+import os
+os.environ['RG']=str(SP/'bin/rg')
+Q=json.load(open(SP/'harness/tools/graphify-validation/config/questions.json'))
+env=gc.clean_env(SP/'g10/home',str(SP/'out/run1/venv/bin'))
+G=str(SP/'out/run1/venv/bin/graphify')
+def rrf(*ranks,k=60):
+    s={}
+    for r in ranks:
+        for i,f in enumerate(R.clean(r)): s[f]=s.get(f,0)+1/(k+i+1)
+    return [f for f,_ in sorted(s.items(),key=lambda kv:-kv[1])]
+def interleave(a,b):
+    out=[]
+    for x,y in zip(R.clean(a),R.clean(b)):
+        for z in (y,x):
+            if z not in out: out.append(z)
+    return out + [f for f in R.clean(a)+R.clean(b) if f not in out]
+res={}
+for repo,wd in [('vh-api-gateway',SP/'out/run1/work/vh-api-gateway'),('visionhammer-agents',SP/'out/run1/work/visionhammer-agents'),('deepdebug-local-agent',SP/'out/run1/work/deepdebug-local-agent')]:
+    rows=[]
+    for q in Q[repo]:
+        g,_=R.rank_graph(G,wd,q['question'],env)
+        l=R.rank_lexical(wd,R.auto_keywords(q['question']),whole_word=False,ignore_case=True)
+        rows.append({'kind':q['kind'],'graph':R.recall_at(g,q['truth'])[0],'lex':R.recall_at(l,q['truth'])[0],
+                     'rrf':R.recall_at(rrf(g,l),q['truth'])[0],'inter':R.recall_at(interleave(l,g),q['truth'])[0]})
+    def avg(sel,k): return round(100*sum(r[k] for r in sel)/len(sel),1) if sel else None
+    res[repo]={kind:{k:avg([r for r in rows if kind=='all' or r['kind']==kind],k) for k in ('graph','lex','rrf','inter')}|{'n':len([r for r in rows if kind=='all' or r['kind']==kind])} for kind in ('all','symbolic','conceptual')}
+    print(repo,json.dumps(res[repo]))
+tot=[];
+json.dump(res,open(SP/'g10/hybrid.json','w'),indent=1)

package/tools/graphify-validation/extras/truth2.py

@@ -0,0 +1,44 @@
+import os
+import sys, json, pathlib, subprocess, os, re
+SP=pathlib.Path(os.environ['GV_T4_ROOT'])
+sys.path.insert(0,str(SP/'harness/tools/graphify-validation/lib'))
+os.environ['RG']=str(SP/'bin/rg')
+import affected_vs_rg as A, gv_common as gc, graph_metrics as gm
+S=json.load(open(SP/'harness/tools/graphify-validation/config/symbols.json'))
+env=gc.clean_env(SP/'g10/home',str(SP/'out/run1/venv/bin')); G=str(SP/'out/run1/venv/bin/graphify')
+SKIP=re.compile(r'^\s*(\*|//|/\*|#|import\s|from\s|package\s|\*/)')
+def code_files(wd,word):
+    r=subprocess.run([str(SP/'bin/rg'),'-w','-n','--no-heading','--glob','*.java','--glob','*.js','--glob','*.mjs','--glob','*.ts','--glob','*.tsx','--glob','*.py','--glob','!**/test/**','--glob','!**/tests/**','--glob','!**/node_modules/**','--glob','!graphify-out/**',word,'.'],cwd=str(wd),capture_output=True,text=True)
+    fs=set()
+    for ln in r.stdout.splitlines():
+        m=re.match(r'\./([^:]+):\d+:(.*)',ln)
+        if not m: continue
+        f,t=m.groups()
+        if SKIP.match(t) or gc.is_test_path(f): continue
+        fs.add(f)
+    return fs
+out={}
+tot={'class':[0,0,0],'union':[0,0,0]}
+for repo in ['vh-api-gateway','visionhammer-agents','deepdebug-local-agent']:
+    wd=SP/'out/run1/work'/repo; g=gm.load_graph(wd); rows=[]
+    for sym in S[repo]:
+        cls=[n for n in g['nodes'] if n.get('label')==sym and n.get('source_file') and n['label']!=n['source_file'].rsplit('/',1)[-1]]
+        if not cls: continue
+        defs={n['source_file'] for n in cls}
+        ids=[n['id'] for n in cls]
+        meth=[n['id'] for n in g['nodes'] if n.get('source_file') in defs and n.get('label','').startswith('.') and n['label'].endswith('()')]
+        def aff(idl):
+            fs=set()
+            for i in idl:
+                r=subprocess.run([G,'affected',i,'--depth','1'],cwd=str(wd),env=env,capture_output=True,text=True,timeout=300); fs|=A.parse_affected(r.stdout)
+            return {f for f in fs-defs if not gc.is_test_path(f)}
+        truth=code_files(wd,sym)-defs
+        a_c=aff(ids); a_u=aff(ids+meth)
+        row={'symbol':sym,'truth_code_files':len(truth),'class':[len(a_c),len(a_c&truth)],'union':[len(a_u),len(a_u&truth)]}
+        rows.append(row)
+    for k,idx in (('class','class'),('union','union')):
+        tt=sum(r['truth_code_files'] for r in rows); bb=sum(r[idx][1] for r in rows); gg=sum(r[idx][0] for r in rows)
+        out.setdefault(repo,{})[k]={'recall_pct':round(100*bb/tt,1) if tt else None,'precision_pct':round(100*bb/gg,1) if gg else None,'truth':tt}
+    out[repo]['rows']=rows
+    print(repo,json.dumps({k:out[repo][k] for k in ('class','union')}),[(r['symbol'],r['truth_code_files'],r['class'][1],r['union'][1]) for r in rows])
+json.dump(out,open(SP/'g10/truth2.json','w'),indent=1)