sigmap 8.14.0 → 8.16.1

package/AGENTS.md

@@ -35,15 +35,15 @@ src/extractors/python_ast.py ← ast
 
 ## changes (last 5 commits — 0 seconds ago)
 ```
-src/graph/blast-radius.js                     +tierFor  +_normRel  +_bfs  +methodBlastRadius
+src/evidence/pack.js                          +riskFactorsFor  ~parseAnchor  ~buildEvidencePack  ~formatMarkdown
 src/graph/call-graph.js                       +calls  +maskRust  +name  +goDefs
 src/mcp/handlers.js                           +that  +getMethodImpact  ~queryContext  ~squeezeOutput
 src/mcp/server.js                             ~dispatch
 src/mcp/tools.js                              +it
+src/retrieval/ranker.js                       ~scoreFile  ~rank
+src/graph/blast-radius.js                     +tierFor  +_normRel  +_bfs  +methodBlastRadius
 src/review/pr-evidence.js                     ~buildPrEvidence  ~formatPrEvidenceMarkdown
 src/review/review-pr.js                       ~isSource  ~reviewPr
-src/format/terse.js                           +splitAnchor  +encodeTerseSig  +encodeTerseSigs  +_tokens
-src/wiki/generate.js                          +_rel  +_pct  +_identity  +_modules
 ```
 
 ## packages
@@ -175,18 +175,33 @@ code-fence ---
 
 ## src
 
-### src/graph/blast-radius.js
+### src/config/defaults.js
 ```
-module.exports = { methodBlastRadius, tierFor, DIRECT_WEIGHT, TRANSITIVE_WEIGHT }  :132-132
-function tierFor(score)  :25-31
-function _normRel(p)  :33-35
-function _bfs(seedIds, reverse, maxDepth)  :38-60
-function methodBlastRadius(changedFiles, cwd, opts = {}) → { * available: boolean, *  :78-130
+module.exports = { DEFAULTS }  :163-163
+```
+
+### src/evidence/pack.js
+```
+module.exports = { buildEvidencePack, formatJSON, formatMarkdown, parseAnchor, riskLabelFor, riskFactorsFor, findRelatedTests, SCHEMA_VERSION, SCHEMA_URL, TEST_DISCOVERY }  :326-337
+function parseAnchor(sig) → { symbol: string, start:   :64-72
+function riskLabelFor(relPath) → 'generated'|'test'|'migra  :84-86
+function riskFactorsFor(relPath) → string[]  :96-108
+function stemOf(relPath)  :111-114
+function testTargetStem(relPath) → string  :126-132
+function findRelatedTests(relPath, allFiles) → string[]  :143-154
+function reasonFor(signals)  :157-168
+function sigTokens(sigs)  :171-173
+function canonicalize(value) → string  :180-182
+function sortKeys(value)  :184-192
+function buildEvidencePack(query, cwd, opts = {}) → object  :205-281
+function ranked0Empty(query)  :284-286
+function formatJSON(pack)  :289-291
+function formatMarkdown(pack)  :294-324
 ```
 
 ### src/graph/call-graph.js
 ```
-module.exports = { buildCallGraph, methodImpact, methodCallees, formatCallGraph, formatCallGraphJSON, extractDefs, maskJs, maskPy, maskRust }  :527-531
+module.exports = { buildCallGraph, buildCallFileGraph, methodImpact, methodCallees, formatCallGraph, formatCallGraphJSON, extractDefs, maskJs, maskPy, maskRust }  :563-567
 function normalizePath(p)  :41-41
 function toRel(cwd, f)  :42-42
 function symId(cwd, absFile, name)  :43-43
@@ -205,17 +220,18 @@ function extractDefs(filePath, src)  :307-315
 function callsInRange(masked, start, end)  :318-330
 function _walk(dir, excludeSet, out, depth)  :334-347
 function buildCallGraph(cwd, opts = {}) → { * forward: Map<string,s  :363-446
-function _resolveSymbol(symbol, defs)  :449-454
-function _bfs(seedIds, graph, maxDepth)  :457-470
-function methodImpact(symbol, cwd, opts = {}) → { symbol:string, resolved  :480-486
-function methodCallees(symbol, cwd, opts = {}) → { symbol:string, resolved  :492-498
-function formatCallGraph(result, kind)  :501-513
-function formatCallGraphJSON(result, kind)  :515-525
+function buildCallFileGraph(cwd, opts = {}) → { forward: Map<string,str  :459-482
+function _resolveSymbol(symbol, defs)  :485-490
+function _bfs(seedIds, graph, maxDepth)  :493-506
+function methodImpact(symbol, cwd, opts = {}) → { symbol:string, resolved  :516-522
+function methodCallees(symbol, cwd, opts = {}) → { symbol:string, resolved  :528-534
+function formatCallGraph(result, kind)  :537-549
+… +1 more signatures
 ```
 
 ### src/mcp/handlers.js
 ```
-module.exports = { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getMethodImpact, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview, verifySuggestion, squeezeOutput }  :966-966
+module.exports = { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getMethodImpact, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview, verifySuggestion, squeezeOutput }  :975-975
 function _readContextFiles(cwd)  :10-17
 function readContext(args, cwd)  :36-66
 function searchSignatures(args, cwd)  :74-100
@@ -224,21 +240,21 @@ function createCheckpoint(args, cwd)  :143-215
 function getRouting(args, cwd)  :224-261
 function explainFile(args, cwd)  :269-356
 function listModules(args, cwd)  :364-403
-function queryContext(args, cwd)  :411-429
-function getMethodImpact(args, cwd)  :437-451
-function getImpact(args, cwd)  :459-471
-function getLines(args, cwd)  :480-528
-function readMemory(args, cwd)  :536-571
-function getCalleeSignatures(args, cwd)  :580-625
-function _pkgVersion(cwd)  :632-635
-function notifyFileCreated(args, cwd)  :639-661
-function notifySymbolAdded(args, cwd)  :664-684
-function notifyFileDeleted(args, cwd)  :687-701
-function _changedFiles(cwd, args)  :707-719
-function getDiffContext(args, cwd)  :728-799
-function getArchitectureOverview(args, cwd)  :808-876
-function verifySuggestion(args, cwd)  :886-921
-function squeezeOutput(args, cwd)  :931-964
+function queryContext(args, cwd)  :411-438
+function getMethodImpact(args, cwd)  :446-460
+function getImpact(args, cwd)  :468-480
+function getLines(args, cwd)  :489-537
+function readMemory(args, cwd)  :545-580
+function getCalleeSignatures(args, cwd)  :589-634
+function _pkgVersion(cwd)  :641-644
+function notifyFileCreated(args, cwd)  :648-670
+function notifySymbolAdded(args, cwd)  :673-693
+function notifyFileDeleted(args, cwd)  :696-710
+function _changedFiles(cwd, args)  :716-728
+function getDiffContext(args, cwd)  :737-808
+function getArchitectureOverview(args, cwd)  :817-885
+function verifySuggestion(args, cwd)  :895-930
+function squeezeOutput(args, cwd)  :940-973
 ```
 
 ### src/mcp/server.js
@@ -255,19 +271,22 @@ function start(cwd)  :113-139
 module.exports = { TOOLS }  :392-392
 ```
 
-### src/review/pr-evidence.js
-```
-module.exports = { buildPrEvidence, formatPrEvidenceMarkdown }  :157-157
-function buildPrEvidence(changedFiles, cwd, opts = {}) → { scope:string, files:obj  :31-84
-function formatPrEvidenceMarkdown(evidence, opts = {})  :89-155
+### src/retrieval/ranker.js
 ```
-
-### src/review/review-pr.js
-```
-module.exports = { reviewPr, SECURITY_PATTERNS, GOD_NODE_THRESHOLD, SCOPE_DIR_THRESHOLD }  :150-150
-function isTestFile(p)  :32-34
-function isSource(p)  :35-37
-function reviewPr(changedFiles, cwd, opts = {}) → { findings: object[], bla  :48-148
+module.exports = { rank, buildSigIndex, scoreFile, formatRankTable, formatRankJSON, DEFAULT_WEIGHTS, GRAPH_BOOST_AMOUNTS, detectIntent }  :598-598
+function _computePenalty(filePath)  :63-70
+function _computeHubs(graph)  :73-84
+function _isHub(filePath)  :87-91
+function scoreFile(filePath, sigs, queryTokens, weights) → { score: number, signals:  :102-159
+function rank(query, sigIndex, opts) → { file: string, score: nu  :177-302
+function _parseContextFile(contextPath) → Map<string, string[]>  :372-404
+function _mergeSigIndex(target, source)  :407-415
+function _buildSigIndexFromCache(cwd) → Map<string, string[]>  :422-442
+function _enrichSigIndexFromStrategy(cwd, index) → Map<string, string[]>  :450-456
+function buildSigIndex(cwd, opts) → Map<string, string[]>  :473-506
+function formatRankTable(results, query) → string  :515-551
+function formatRankJSON(results, query) → object  :560-575
+function detectIntent(query)  :590-596
 ```
 
 ### src/analysis/coverage-score.js
@@ -307,11 +326,6 @@ function getChangedFiles(files, cache) → { changed: string[], unch  :71-88
 function updateCacheEntries(cache, extracted)  :96-103
 ```
 
-### src/config/defaults.js
-```
-module.exports = { DEFAULTS }  :161-161
-```
-
 ### src/config/loader.js
 ```
 module.exports = { loadConfig, loadBaseConfig }  :313-313
@@ -525,24 +539,6 @@ function scoreUsefulness(taskResult, rankingScore)  :11-38
 function computeUsefulnessStats(taskResults)  :40-66
 ```
 
-### src/evidence/pack.js
-```
-module.exports = { buildEvidencePack, formatJSON, formatMarkdown, parseAnchor, riskLabelFor, findRelatedTests, SCHEMA_VERSION }  :293-301
-function parseAnchor(sig) → { symbol: string, start:   :50-58
-function riskLabelFor(relPath) → 'generated'|'test'|'migra  :70-81
-function stemOf(relPath)  :84-87
-function testTargetStem(relPath) → string  :99-105
-function findRelatedTests(relPath, allFiles) → string[]  :116-127
-function reasonFor(signals)  :130-141
-function sigTokens(sigs)  :144-146
-function canonicalize(value) → string  :153-155
-function sortKeys(value)  :157-165
-function buildEvidencePack(query, cwd, opts = {}) → object  :178-249
-function ranked0Empty(query)  :252-254
-function formatJSON(pack)  :257-259
-function formatMarkdown(pack)  :262-291
-```
-
 ### src/extractors/coverage.js
 ```
 module.exports = { buildTestIndex, isTested }  :79-79
@@ -1012,6 +1008,15 @@ function renderReportHtml(result, opts = {}) → string  :48-115
 function renderReportMarkdown(result)  :144-162
 ```
 
+### src/graph/blast-radius.js
+```
+module.exports = { methodBlastRadius, tierFor, DIRECT_WEIGHT, TRANSITIVE_WEIGHT }  :132-132
+function tierFor(score)  :25-31
+function _normRel(p)  :33-35
+function _bfs(seedIds, reverse, maxDepth)  :38-60
+function methodBlastRadius(changedFiles, cwd, opts = {}) → { * available: boolean, *  :78-130
+```
+
 ### src/graph/builder.js
 ```
 module.exports = { build, buildFromCwd, extractFileDeps, normalizePath, loadAliasMap, resolveAlias }  :494-494
@@ -1187,30 +1192,27 @@ function expandQuery(qToks) → Map<string, number>  :132-141
 function bm25rank(query, candidates) → Array<object & { score: n  :154-193
 ```
 
-### src/retrieval/ranker.js
-```
-module.exports = { rank, buildSigIndex, scoreFile, formatRankTable, formatRankJSON, DEFAULT_WEIGHTS, GRAPH_BOOST_AMOUNTS, detectIntent }  :570-570
-function _computePenalty(filePath)  :62-69
-function _computeHubs(graph)  :72-83
-function _isHub(filePath)  :86-90
-function scoreFile(filePath, sigs, queryTokens, weights) → { score: number, signals:  :101-158
-function rank(query, sigIndex, opts) → { file: string, score: nu  :174-298
-function _parseContextFile(contextPath) → Map<string, string[]>  :344-376
-function _mergeSigIndex(target, source)  :379-387
-function _buildSigIndexFromCache(cwd) → Map<string, string[]>  :394-414
-function _enrichSigIndexFromStrategy(cwd, index) → Map<string, string[]>  :422-428
-function buildSigIndex(cwd, opts) → Map<string, string[]>  :445-478
-function formatRankTable(results, query) → string  :487-523
-function formatRankJSON(results, query) → object  :532-547
-function detectIntent(query)  :562-568
-```
-
 ### src/retrieval/tokenizer.js
 ```
 module.exports = { tokenize, STOP_WORDS }  :54-54
 function tokenize(text, opts) → string[]  :31-52
 ```
 
+### src/review/pr-evidence.js
+```
+module.exports = { buildPrEvidence, formatPrEvidenceMarkdown }  :157-157
+function buildPrEvidence(changedFiles, cwd, opts = {}) → { scope:string, files:obj  :31-84
+function formatPrEvidenceMarkdown(evidence, opts = {})  :89-155
+```
+
+### src/review/review-pr.js
+```
+module.exports = { reviewPr, SECURITY_PATTERNS, GOD_NODE_THRESHOLD, SCOPE_DIR_THRESHOLD }  :150-150
+function isTestFile(p)  :32-34
+function isSource(p)  :35-37
+function reviewPr(changedFiles, cwd, opts = {}) → { findings: object[], bla  :48-148
+```
+
 ### src/routing/classifier.js
 ```
 module.exports = { classify, classifyAll }  :102-102

package/CHANGELOG.md

@@ -10,6 +10,35 @@ Format: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [8.16.1] — 2026-07-12
+
+Patch release — **benchmark hygiene**; the published package is unchanged (scripts + tests only).
+
+### Fixed
+- **Hermetic grounding benchmark (#480, PR #481):** the grounding suite regenerated the shared cached benchmark repos with a plain default config, silently overwriting the retrieval harness's per-repo-scoped contexts — later context-reading suites saw degraded indexes (the callgraph A/B measured 32.2% hit@5 instead of ~87.8%). `measureGroundingHermetic` now snapshots every context artifact before its regen and restores them byte-exactly after measuring (leftovers removed). Verified: A/B 87.8% → grounding → 87.8%; first retrieval run post-grounding 87.8% with no transient; grounding's own aggregate unchanged. The callgraph A/B also discloses it reads contexts as-is. 3 regression tests.
+
+---
+
+## [8.16.0] — 2026-07-12
+
+Minor release — **Evidence Pack schema v2** (the last Machine-lever item from the master plan §7.4). Also the first published release carrying v8.15.0, which was prepared but never tagged (see its note below).
+
+### Added
+- **Evidence Pack schema v2 (#477, PR #478):** additive over v1 — `schemaVersion: '2.0'` + `schemaUrl` pointing at a **published draft-07 JSON Schema** (`sigmap.io/schemas/evidence-pack-2.json`) that CI/agents can validate packs against; **`files[].riskFactors`** exposes *every* matched risk category in precedence order (a migration touching payments carries `['migration','payment']`) while `riskLabel` stays the first factor for v1 consumers; a **`testDiscovery` provenance block** carries the measured accuracy of the stem-affix related-tests method (**F1 0.98, precision 0.971, recall 0.988** over 3,701 pairs / 28 repos) — constants sourced from the committed benchmark report and guard-tested against it; and `generator: { name, version }` records what built the pack. Byte-stable; `contextHash` determinism preserved.
+
+---
+
+## [8.15.0] — 2026-07-11
+
+> **Not published as a standalone release** — prepared and merged to main, but never tagged; first shipped as part of v8.16.0.
+
+Minor release — **call-graph ranking boost, opt-in and measure-gated**. The milestone item "call-graph edges into ranking" is done — and shipped **dark**, because the measure gate said so.
+
+### Added
+- **Call-graph ranking boost (#474, PR #475):** `buildCallFileGraph` collapses symbol edges to deterministic file-level bidirectional edges; `rank()` gains `opts.callGraph` — a single-hop, hub-suppressed neighbor boost (`callHop: 0.30`) with a `callGraphBoost` explain signal. Config-gated (non-fatal) into `ask`, `--query`, and the `query_context` MCP tool via **`retrieval.callGraphBoost` (default `false`)**. **Measured** by the new `npm run benchmark:callgraph-boost` A/B (90 tasks / 18 cached repos through the full ranker): import-graph arm 80% hit@5, +call-graph arm 80% — **delta +0, no repo moved** — so per the gate the default stays off; the boost exists for call-topology-heavy repos (Go/Java same-package) where import edges structurally can't see the relationship. The headline BM25 harness is untouched and reproduces 87.8%. Report: `benchmarks/reports/callgraph-boost.json`.
+
+---
+
 ## [8.14.0] — 2026-07-11
 
 Minor release — **call-graph support for Java, Go, and Rust** (GR1 language expansion). The method-level call-graph goes from 2 to 5 languages, and every consumer — `--callers`/`--callees`, blast-radius scoring, `review-pr` method-blast findings, `get_method_impact` — inherits them with no further changes.

package/README.md

@@ -122,7 +122,7 @@ Ask → Rank → Context → Validate → Judge → Learn
 
 <!--SM:benchmarkBlock-->
 ```
-Benchmark : sigmap-v8.14-main (21 repositories, including R language)
+Benchmark : sigmap-v8.16-main (21 repositories, including R language)
 Date      : 2026-07-11
 
 Hit@5          : 87.8%   (baseline 13.6%  — 6.5× lift)

package/gen-context.js

@@ -1531,6 +1531,8 @@ __factories["./src/config/defaults"] = function(module, exports) {
       topK: 10,
       // Multiplier applied to recently-changed files (>1 boosts them up)
       recencyBoost: 1.5,
+      // Boost files call-graph-connected to query matches (opt-in, measure-gated)
+      callGraphBoost: false,
     },
 
     // Impact layer settings (v2.5)
@@ -4731,12 +4733,15 @@ __factories["./src/eval/usefulness-scorer"] = function(module, exports) {
 __factories["./src/evidence/pack"] = function(module, exports) {
   
   /**
-   * Evidence Pack v1 (v8.0 E1).
+   * Evidence Pack v2 (v8.0 E1; schema v2 adds a published schema URL, per-file
+   * multi-factor risk labels, measured test-discovery provenance, and generator
+   * identity — all additive over v1).
    *
    * A deterministic, machine-consumable signature-and-evidence map. Replaces the
    * "paste this into your prompt" workflow with a byte-stable JSON artifact that
    * an agent or CI can ingest directly — every entry anchored to a real file,
-   * symbol, and line range.
+   * symbol, and line range. The published schema lives at
+   * docs-vp/public/schemas/evidence-pack-2.json (sigmap.io/schemas/).
    *
    * Composed entirely from shipped zero-dep modules:
    *   - retrieval/ranker        → ranked files, scores, signals
@@ -4756,10 +4761,21 @@ __factories["./src/evidence/pack"] = function(module, exports) {
   const { buildSigIndex, rank, detectIntent } = __require('./src/retrieval/ranker');
   const { scan } = __require('./src/security/scanner');
 
-  const SCHEMA_VERSION = '1.0';
+  const SCHEMA_VERSION = '2.0';
+  const SCHEMA_URL = 'https://sigmap.io/schemas/evidence-pack-2.json';
   const DEFAULT_BUDGET = 6000;
   const DEFAULT_TOP = 12;
 
+  // Measured accuracy of the stem-affix test-discovery method (C2). Constants
+  // are sourced from the committed benchmarks/reports/test-discovery.json and
+  // guarded by a test that fails on drift — re-run `npm run
+  // benchmark:test-discovery` and update together, never hand-invent.
+  const TEST_DISCOVERY = {
+    method: 'stem-affix-match',
+    measured: { f1: 0.98, precision: 0.971, recall: 0.988, pairs: 3701, repos: 28 },
+    benchmark: 'npm run benchmark:test-discovery',
+  };
+
   const GENERATED_RE = /(^|\/)(dist|build|out|vendor|node_modules)\/|\.(generated|min|bundle)\.|\.(pb|_pb)\.|\.pb\.go$|_pb2\.py$/;
   const TEST_RE = /(^|\/)(tests?|__tests__|spec|specs)\/|\.(test|spec)\.[a-z]+$|(^|\/)test_[^/]+\.py$|_test\.(go|py|rb)$/;
   const CONFIG_RE = /\.(json|ya?ml|toml|ini|conf|config|properties|env)$|(^|\/)(\.?[a-z]+rc)$|\.config\.[a-z]+$/i;
@@ -4798,16 +4814,29 @@ __factories["./src/evidence/pack"] = function(module, exports) {
    * @returns {'generated'|'test'|'migration'|'payment'|'auth'|'security'|'config'|'public-api'|'source'}
    */
   function riskLabelFor(relPath) {
+    return riskFactorsFor(relPath)[0];
+  }
+
+  /**
+   * Every risk category a file matches, in the same strict precedence order
+   * riskLabelFor uses (schema v2). Where v1 collapsed a migration touching
+   * payments to `migration`, the factors list carries both. Always non-empty:
+   * a file matching nothing is `['source']`.
+   * @param {string} relPath
+   * @returns {string[]}
+   */
+  function riskFactorsFor(relPath) {
     const p = relPath.replace(/\\/g, '/');
-    if (GENERATED_RE.test(p)) return 'generated';
-    if (TEST_RE.test(p)) return 'test';
-    if (MIGRATION_RE.test(p)) return 'migration';
-    if (PAYMENT_RE.test(p)) return 'payment';
-    if (AUTH_RE.test(p)) return 'auth';
-    if (SECURITY_RE.test(p)) return 'security';
-    if (CONFIG_RE.test(p)) return 'config';
-    if (PUBLIC_API_RE.test(p)) return 'public-api';
-    return 'source';
+    const factors = [];
+    if (GENERATED_RE.test(p)) factors.push('generated');
+    if (TEST_RE.test(p)) factors.push('test');
+    if (MIGRATION_RE.test(p)) factors.push('migration');
+    if (PAYMENT_RE.test(p)) factors.push('payment');
+    if (AUTH_RE.test(p)) factors.push('auth');
+    if (SECURITY_RE.test(p)) factors.push('security');
+    if (CONFIG_RE.test(p)) factors.push('config');
+    if (PUBLIC_API_RE.test(p)) factors.push('public-api');
+    return factors.length ? factors : ['source'];
   }
 
   /** Filename stem (basename minus the first extension chain). */
@@ -4939,6 +4968,7 @@ __factories["./src/evidence/pack"] = function(module, exports) {
         if (start !== null) sourceLines.push({ symbol, start, end });
       }
 
+      const riskFactors = riskFactorsFor(r.file);
       files.push({
         path: r.file,
         symbols,
@@ -4946,7 +4976,8 @@ __factories["./src/evidence/pack"] = function(module, exports) {
         confidence: maxScore > 0 ? Math.round((r.score / maxScore) * 100) / 100 : 0,
         sourceLines,
         relatedTests: findRelatedTests(r.file, allFiles),
-        riskLabel: riskLabelFor(r.file),
+        riskLabel: riskFactors[0],
+        riskFactors,
       });
     }
 
@@ -4955,11 +4986,14 @@ __factories["./src/evidence/pack"] = function(module, exports) {
 
     const pack = {
       schemaVersion: SCHEMA_VERSION,
+      schemaUrl: SCHEMA_URL,
+      generator: { name: 'sigmap', version: typeof opts.version === 'string' ? opts.version : null },
       query,
       intent,
       files,
       tokenBudget: { limit: budget, used, remaining: Math.max(0, budget - used) },
       droppedFiles,
+      testDiscovery: TEST_DISCOVERY,
       grounding: {
         symbolCount,
         anchoredSymbols,
@@ -5001,7 +5035,8 @@ __factories["./src/evidence/pack"] = function(module, exports) {
     L.push('');
 
     for (const f of pack.files) {
-      L.push(`## \`${f.path}\`  _(${f.riskLabel}, confidence ${f.confidence})_`);
+      const risk = (f.riskFactors && f.riskFactors.length > 1) ? f.riskFactors.join(' + ') : f.riskLabel;
+      L.push(`## \`${f.path}\`  _(${risk}, confidence ${f.confidence})_`);
       L.push(`_${f.reason}_`);
       if (f.relatedTests.length) L.push(`Related tests: ${f.relatedTests.map((t) => `\`${t}\``).join(', ')}`);
       L.push('');
@@ -5026,8 +5061,11 @@ __factories["./src/evidence/pack"] = function(module, exports) {
     formatMarkdown,
     parseAnchor,
     riskLabelFor,
+    riskFactorsFor,
     findRelatedTests,
     SCHEMA_VERSION,
+    SCHEMA_URL,
+    TEST_DISCOVERY,
   };
   
 };
@@ -11386,6 +11424,42 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
     return { forward: toArr(forward), reverse: toArr(reverse), defs };
   }
 
+  /**
+   * Collapse the symbol-level call-graph to FILE-level bidirectional edges for
+   * the ranker's neighbor boost (opt-in via `retrieval.callGraphBoost`). A file
+   * whose functions call into — or are called by — another file gets an edge in
+   * both directions. Keys are `path.resolve`-form absolute paths (matching the
+   * ranker's lookups); entries and neighbor lists are sorted for determinism.
+   *
+   * @param {string} cwd
+   * @param {object} [opts] { graph } to inject a prebuilt call graph (tests)
+   * @returns {{ forward: Map<string,string[]> }}
+   */
+  function buildCallFileGraph(cwd, opts = {}) {
+    const graph = opts.graph || buildCallGraph(cwd, opts);
+    const edges = new Map(); // absFile → Set<absFile>
+    const add = (a, b) => {
+      if (a === b) return;
+      if (!edges.has(a)) edges.set(a, new Set());
+      edges.get(a).add(b);
+    };
+    for (const [callerId, calleeIds] of graph.forward.entries()) {
+      const callerDef = graph.defs.get(callerId);
+      if (!callerDef) continue;
+      for (const calleeId of calleeIds) {
+        const calleeDef = graph.defs.get(calleeId);
+        if (!calleeDef || calleeDef.file === callerDef.file) continue;
+        const a = path.resolve(cwd, callerDef.file);
+        const b = path.resolve(cwd, calleeDef.file);
+        add(a, b);
+        add(b, a);
+      }
+    }
+    const forward = new Map();
+    for (const k of [...edges.keys()].sort()) forward.set(k, [...edges.get(k)].sort());
+    return { forward };
+  }
+
   // Resolve a user-supplied symbol (bare name or full `file#name` id) to ids.
   function _resolveSymbol(symbol, defs) {
     if (defs.has(symbol)) return [symbol];
@@ -11466,7 +11540,7 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
   }
 
   module.exports = {
-    buildCallGraph, methodImpact, methodCallees,
+    buildCallGraph, buildCallFileGraph, methodImpact, methodCallees,
     formatCallGraph, formatCallGraphJSON,
     extractDefs, maskJs, maskPy, maskRust,
   };
@@ -13618,7 +13692,16 @@ __factories["./src/mcp/handlers"] = function(module, exports) {
       // Build dependency graph for neighbor boost — non-fatal if it fails
       let graph = null;
       try { graph = buildFromCwd(cwd); } catch (_) {}
-      const results = rank(args.query, index, { topK, cwd, graph });
+      // Opt-in call-graph neighbor boost (retrieval.callGraphBoost) — non-fatal
+      let callGraph = null;
+      try {
+        const { loadConfig } = __require('./src/config/loader');
+        const retrieval = loadConfig(cwd).retrieval;
+        if (retrieval && retrieval.callGraphBoost) {
+          callGraph = __require('./src/graph/call-graph').buildCallFileGraph(cwd);
+        }
+      } catch (_) {}
+      const results = rank(args.query, index, { topK, cwd, graph, callGraph });
       return formatRankTable(results, args.query);
     } catch (err) {
       return `_query_context failed: ${err.message}_`;
@@ -14331,7 +14414,7 @@ __factories["./src/mcp/server"] = function(module, exports) {
 
   const SERVER_INFO = {
     name: 'sigmap',
-    version: '8.14.0',
+    version: '8.16.1',
     description: 'SigMap MCP server — code signatures on demand',
   };
 
@@ -15396,6 +15479,7 @@ __factories["./src/retrieval/ranker"] = function(module, exports) {
   const GRAPH_BOOST_AMOUNTS = {
     hop1: 0.40,   // direct import neighbor of a file with score > 0
     hop2: 0.15,   // 2 hops away (transitive), with decay
+    callHop: 0.30, // call-graph file neighbor (opt-in retrieval.callGraphBoost)
   };
 
   // Intent-specific weight adjustments
@@ -15528,6 +15612,8 @@ __factories["./src/retrieval/ranker"] = function(module, exports) {
    * @param {object}  [opts.weights]               - override scoring weights
    * @param {string}  [opts.cwd]                   - project root for learned ranking weights
    * @param {{ forward: Map<string,string[]> }} [opts.graph] - dependency graph for neighbor boost
+   * @param {{ forward: Map<string,string[]> }} [opts.callGraph] - file-level call-graph edges
+   *        (from buildCallFileGraph) for the opt-in call-neighbor boost
    * @returns {{ file: string, score: number, sigs: string[], tokens: number, intent: string, signals: object }[]}
    */
   function rank(query, sigIndex, opts) {
@@ -15651,6 +15737,31 @@ __factories["./src/retrieval/ranker"] = function(module, exports) {
       }
     }
 
+    // Call-graph neighbor boost (opt-in via retrieval.callGraphBoost): a file
+    // whose functions call into — or are called by — a positively-scored file is
+    // relevant even when no import edge exists (Go/Java same-package, dynamic
+    // dispatch). Single hop; seeds snapshotted first so boosts never cascade.
+    const callGraph = (opts && opts.callGraph && opts.callGraph.forward instanceof Map) ? opts.callGraph : null;
+    if (callGraph && cwd) {
+      const path = require('path');
+      const relToIdx = new Map();
+      for (let i = 0; i < scored.length; i++) relToIdx.set(scored[i].file, i);
+      const hubs = _computeHubs(callGraph);
+      const seeds = scored.filter((e) => e.score > 0).map((e) => e.file);
+      for (const file of seeds) {
+        const abs = path.resolve(cwd, file);
+        for (const neighborAbs of (callGraph.forward.get(abs) || [])) {
+          if (_isHub(neighborAbs) || hubs.has(neighborAbs)) continue;
+          const neighborRel = path.relative(cwd, neighborAbs).replace(/\\/g, '/');
+          const idx = relToIdx.get(neighborRel);
+          if (idx !== undefined && scored[idx].file !== file) {
+            scored[idx].score += GRAPH_BOOST_AMOUNTS.callHop;
+            scored[idx].signals.callGraphBoost = (scored[idx].signals.callGraphBoost || 0) + GRAPH_BOOST_AMOUNTS.callHop;
+          }
+        }
+      }
+    }
+
     // Compute confidence levels based on score distribution
     if (scored.length > 0) {
       const scores = scored.map(s => s.score);
@@ -19344,7 +19455,7 @@ function __tryGit(args, opts = {}) {
   catch (_) { return ''; }
 }
 
-const VERSION = '8.14.0';
+const VERSION = '8.16.1';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
 
 function requireSourceOrBundled(key) {
@@ -21667,7 +21778,13 @@ function main() {
       } catch (_) { /* squeeze is best-effort — never break ask */ }
     }
 
-    let ranked = rank(query, sigIndex, { topK: 5, weights: intentWeights, cwd });
+    // Opt-in call-graph neighbor boost (retrieval.callGraphBoost) — non-fatal
+    let askCallGraph = null;
+    if (config && config.retrieval && config.retrieval.callGraphBoost) {
+      try { askCallGraph = requireSourceOrBundled('./src/graph/call-graph').buildCallFileGraph(cwd); } catch (_) {}
+    }
+
+    let ranked = rank(query, sigIndex, { topK: 5, weights: intentWeights, cwd, callGraph: askCallGraph });
 
     // v6.10: Workspace scoping — infer package from query and apply boost
     const workspaces = detectWorkspaces(cwd);
@@ -21824,7 +21941,7 @@ function main() {
 
     const { buildEvidencePack, formatJSON, formatMarkdown } = requireSourceOrBundled('./src/evidence/pack');
 
-    const opts = {};
+    const opts = { version: VERSION };
     const topIdx = args.indexOf('--top');
     if (topIdx !== -1 && args[topIdx + 1]) opts.top = parseInt(args[topIdx + 1], 10);
     const budgetIdx = args.indexOf('--budget');
@@ -23839,7 +23956,12 @@ function main() {
       const topK = topIdx >= 0 ? Math.min(Math.max(1, parseInt(args[topIdx + 1], 10) || 10), 25)
                                : ((config && config.retrieval && config.retrieval.topK) || 10);
       const recencyBoost = (config && config.retrieval && config.retrieval.recencyBoost) || 1.5;
-      const results = rank(query, index, { topK, recencyBoost, cwd });
+      // Opt-in call-graph neighbor boost (retrieval.callGraphBoost) — non-fatal
+      let queryCallGraph = null;
+      if (config && config.retrieval && config.retrieval.callGraphBoost) {
+        try { queryCallGraph = requireSourceOrBundled('./src/graph/call-graph').buildCallFileGraph(cwd); } catch (_) {}
+      }
+      const results = rank(query, index, { topK, recencyBoost, cwd, callGraph: queryCallGraph });
       if (args.includes('--context')) {
         const miniCtx  = buildMiniContext(results, cwd);
         const ctxOut   = path.join(cwd, '.context', 'query-context.md');

package/llms-full.txt

@@ -11,13 +11,13 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.14.0 | Benchmark: sigmap-v8.14-main (2026-07-11)
+# Version: 8.16.1 | Benchmark: sigmap-v8.16-main (2026-07-11)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ---
 
-## Core metrics (benchmark: sigmap-v8.14-main, 2026-07-11)
+## Core metrics (benchmark: sigmap-v8.16-main, 2026-07-11)
 
 | Metric | Without SigMap | With SigMap |
 |--------|----------------|-------------|
@@ -343,7 +343,7 @@ testCoverage = false
 testDirs = ["tests","test","__tests__","spec"]
 sigCache = false
 impactRadius = false
-retrieval = {"topK":10,"recencyBoost":1.5}
+retrieval = {"topK":10,"recencyBoost":1.5,"callGraphBoost":false}
 impact = {"depth":3,"includeSigs":true}
 ```
 

package/llms.txt

@@ -11,7 +11,7 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.14.0 | Benchmark: sigmap-v8.14-main (2026-07-11)
+# Version: 8.16.1 | Benchmark: sigmap-v8.16-main (2026-07-11)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
@@ -23,7 +23,7 @@ Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 - No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
 - Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
 
-## Core metrics (benchmark: sigmap-v8.14-main, 2026-07-11)
+## Core metrics (benchmark: sigmap-v8.16-main, 2026-07-11)
 
 - hit@5 retrieval: 87.8% vs 13.6% random baseline (6.5× lift)
 - Token reduction: 97.0% average across benchmark repos

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "8.14.0",
+  "version": "8.16.1",
   "description": "The deterministic, verifiable grounding layer for AI code work — a zero-dependency signature-and-evidence map that grounds Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP agents against your real code (repo + installed libraries) so they stop hallucinating files, imports & APIs. Runs offline via npx; byte-stable output; ~97% token reduction as proof.",
   "main": "packages/core/index.js",
   "exports": {
@@ -30,6 +30,7 @@
     "benchmark:squeeze": "node scripts/run-squeeze-benchmark.mjs --save",
     "benchmark:test-discovery": "node scripts/run-test-discovery-benchmark.mjs --save",
     "benchmark:terse": "node scripts/run-terse-benchmark.mjs --save",
+    "benchmark:callgraph-boost": "node scripts/run-callgraph-boost-benchmark.mjs --save",
     "validate:squeeze": "node scripts/run-squeeze-benchmark.mjs --gate",
     "health": "node gen-context.js --health",
     "map": "node gen-project-map.js",

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "8.14.0",
+  "version": "8.16.1",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "8.14.0",
+  "version": "8.16.1",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/config/defaults.js

@@ -147,6 +147,8 @@ const DEFAULTS = {
     topK: 10,
     // Multiplier applied to recently-changed files (>1 boosts them up)
     recencyBoost: 1.5,
+    // Boost files call-graph-connected to query matches (opt-in, measure-gated)
+    callGraphBoost: false,
   },
 
   // Impact layer settings (v2.5)

package/src/evidence/pack.js

@@ -1,12 +1,15 @@
 'use strict';
 
 /**
- * Evidence Pack v1 (v8.0 E1).
+ * Evidence Pack v2 (v8.0 E1; schema v2 adds a published schema URL, per-file
+ * multi-factor risk labels, measured test-discovery provenance, and generator
+ * identity — all additive over v1).
  *
  * A deterministic, machine-consumable signature-and-evidence map. Replaces the
  * "paste this into your prompt" workflow with a byte-stable JSON artifact that
  * an agent or CI can ingest directly — every entry anchored to a real file,
- * symbol, and line range.
+ * symbol, and line range. The published schema lives at
+ * docs-vp/public/schemas/evidence-pack-2.json (sigmap.io/schemas/).
  *
  * Composed entirely from shipped zero-dep modules:
  *   - retrieval/ranker        → ranked files, scores, signals
@@ -26,10 +29,21 @@ const crypto = require('crypto');
 const { buildSigIndex, rank, detectIntent } = require('../retrieval/ranker');
 const { scan } = require('../security/scanner');
 
-const SCHEMA_VERSION = '1.0';
+const SCHEMA_VERSION = '2.0';
+const SCHEMA_URL = 'https://sigmap.io/schemas/evidence-pack-2.json';
 const DEFAULT_BUDGET = 6000;
 const DEFAULT_TOP = 12;
 
+// Measured accuracy of the stem-affix test-discovery method (C2). Constants
+// are sourced from the committed benchmarks/reports/test-discovery.json and
+// guarded by a test that fails on drift — re-run `npm run
+// benchmark:test-discovery` and update together, never hand-invent.
+const TEST_DISCOVERY = {
+  method: 'stem-affix-match',
+  measured: { f1: 0.98, precision: 0.971, recall: 0.988, pairs: 3701, repos: 28 },
+  benchmark: 'npm run benchmark:test-discovery',
+};
+
 const GENERATED_RE = /(^|\/)(dist|build|out|vendor|node_modules)\/|\.(generated|min|bundle)\.|\.(pb|_pb)\.|\.pb\.go$|_pb2\.py$/;
 const TEST_RE = /(^|\/)(tests?|__tests__|spec|specs)\/|\.(test|spec)\.[a-z]+$|(^|\/)test_[^/]+\.py$|_test\.(go|py|rb)$/;
 const CONFIG_RE = /\.(json|ya?ml|toml|ini|conf|config|properties|env)$|(^|\/)(\.?[a-z]+rc)$|\.config\.[a-z]+$/i;
@@ -68,16 +82,29 @@ function parseAnchor(sig) {
  * @returns {'generated'|'test'|'migration'|'payment'|'auth'|'security'|'config'|'public-api'|'source'}
  */
 function riskLabelFor(relPath) {
+  return riskFactorsFor(relPath)[0];
+}
+
+/**
+ * Every risk category a file matches, in the same strict precedence order
+ * riskLabelFor uses (schema v2). Where v1 collapsed a migration touching
+ * payments to `migration`, the factors list carries both. Always non-empty:
+ * a file matching nothing is `['source']`.
+ * @param {string} relPath
+ * @returns {string[]}
+ */
+function riskFactorsFor(relPath) {
   const p = relPath.replace(/\\/g, '/');
-  if (GENERATED_RE.test(p)) return 'generated';
-  if (TEST_RE.test(p)) return 'test';
-  if (MIGRATION_RE.test(p)) return 'migration';
-  if (PAYMENT_RE.test(p)) return 'payment';
-  if (AUTH_RE.test(p)) return 'auth';
-  if (SECURITY_RE.test(p)) return 'security';
-  if (CONFIG_RE.test(p)) return 'config';
-  if (PUBLIC_API_RE.test(p)) return 'public-api';
-  return 'source';
+  const factors = [];
+  if (GENERATED_RE.test(p)) factors.push('generated');
+  if (TEST_RE.test(p)) factors.push('test');
+  if (MIGRATION_RE.test(p)) factors.push('migration');
+  if (PAYMENT_RE.test(p)) factors.push('payment');
+  if (AUTH_RE.test(p)) factors.push('auth');
+  if (SECURITY_RE.test(p)) factors.push('security');
+  if (CONFIG_RE.test(p)) factors.push('config');
+  if (PUBLIC_API_RE.test(p)) factors.push('public-api');
+  return factors.length ? factors : ['source'];
 }
 
 /** Filename stem (basename minus the first extension chain). */
@@ -209,6 +236,7 @@ function buildEvidencePack(query, cwd, opts = {}) {
       if (start !== null) sourceLines.push({ symbol, start, end });
     }
 
+    const riskFactors = riskFactorsFor(r.file);
     files.push({
       path: r.file,
       symbols,
@@ -216,7 +244,8 @@ function buildEvidencePack(query, cwd, opts = {}) {
       confidence: maxScore > 0 ? Math.round((r.score / maxScore) * 100) / 100 : 0,
       sourceLines,
       relatedTests: findRelatedTests(r.file, allFiles),
-      riskLabel: riskLabelFor(r.file),
+      riskLabel: riskFactors[0],
+      riskFactors,
     });
   }
 
@@ -225,11 +254,14 @@ function buildEvidencePack(query, cwd, opts = {}) {
 
   const pack = {
     schemaVersion: SCHEMA_VERSION,
+    schemaUrl: SCHEMA_URL,
+    generator: { name: 'sigmap', version: typeof opts.version === 'string' ? opts.version : null },
     query,
     intent,
     files,
     tokenBudget: { limit: budget, used, remaining: Math.max(0, budget - used) },
     droppedFiles,
+    testDiscovery: TEST_DISCOVERY,
     grounding: {
       symbolCount,
       anchoredSymbols,
@@ -271,7 +303,8 @@ function formatMarkdown(pack) {
   L.push('');
 
   for (const f of pack.files) {
-    L.push(`## \`${f.path}\`  _(${f.riskLabel}, confidence ${f.confidence})_`);
+    const risk = (f.riskFactors && f.riskFactors.length > 1) ? f.riskFactors.join(' + ') : f.riskLabel;
+    L.push(`## \`${f.path}\`  _(${risk}, confidence ${f.confidence})_`);
     L.push(`_${f.reason}_`);
     if (f.relatedTests.length) L.push(`Related tests: ${f.relatedTests.map((t) => `\`${t}\``).join(', ')}`);
     L.push('');
@@ -296,6 +329,9 @@ module.exports = {
   formatMarkdown,
   parseAnchor,
   riskLabelFor,
+  riskFactorsFor,
   findRelatedTests,
   SCHEMA_VERSION,
+  SCHEMA_URL,
+  TEST_DISCOVERY,
 };

package/src/graph/call-graph.js

@@ -445,6 +445,42 @@ function buildCallGraph(cwd, opts = {}) {
   return { forward: toArr(forward), reverse: toArr(reverse), defs };
 }
 
+/**
+ * Collapse the symbol-level call-graph to FILE-level bidirectional edges for
+ * the ranker's neighbor boost (opt-in via `retrieval.callGraphBoost`). A file
+ * whose functions call into — or are called by — another file gets an edge in
+ * both directions. Keys are `path.resolve`-form absolute paths (matching the
+ * ranker's lookups); entries and neighbor lists are sorted for determinism.
+ *
+ * @param {string} cwd
+ * @param {object} [opts] { graph } to inject a prebuilt call graph (tests)
+ * @returns {{ forward: Map<string,string[]> }}
+ */
+function buildCallFileGraph(cwd, opts = {}) {
+  const graph = opts.graph || buildCallGraph(cwd, opts);
+  const edges = new Map(); // absFile → Set<absFile>
+  const add = (a, b) => {
+    if (a === b) return;
+    if (!edges.has(a)) edges.set(a, new Set());
+    edges.get(a).add(b);
+  };
+  for (const [callerId, calleeIds] of graph.forward.entries()) {
+    const callerDef = graph.defs.get(callerId);
+    if (!callerDef) continue;
+    for (const calleeId of calleeIds) {
+      const calleeDef = graph.defs.get(calleeId);
+      if (!calleeDef || calleeDef.file === callerDef.file) continue;
+      const a = path.resolve(cwd, callerDef.file);
+      const b = path.resolve(cwd, calleeDef.file);
+      add(a, b);
+      add(b, a);
+    }
+  }
+  const forward = new Map();
+  for (const k of [...edges.keys()].sort()) forward.set(k, [...edges.get(k)].sort());
+  return { forward };
+}
+
 // Resolve a user-supplied symbol (bare name or full `file#name` id) to ids.
 function _resolveSymbol(symbol, defs) {
   if (defs.has(symbol)) return [symbol];
@@ -525,7 +561,7 @@ function formatCallGraphJSON(result, kind) {
 }
 
 module.exports = {
-  buildCallGraph, methodImpact, methodCallees,
+  buildCallGraph, buildCallFileGraph, methodImpact, methodCallees,
   formatCallGraph, formatCallGraphJSON,
   extractDefs, maskJs, maskPy, maskRust,
 };

package/src/mcp/handlers.js

@@ -421,7 +421,16 @@ function queryContext(args, cwd) {
     // Build dependency graph for neighbor boost — non-fatal if it fails
     let graph = null;
     try { graph = buildFromCwd(cwd); } catch (_) {}
-    const results = rank(args.query, index, { topK, cwd, graph });
+    // Opt-in call-graph neighbor boost (retrieval.callGraphBoost) — non-fatal
+    let callGraph = null;
+    try {
+      const { loadConfig } = require('../config/loader');
+      const retrieval = loadConfig(cwd).retrieval;
+      if (retrieval && retrieval.callGraphBoost) {
+        callGraph = require('../graph/call-graph').buildCallFileGraph(cwd);
+      }
+    } catch (_) {}
+    const results = rank(args.query, index, { topK, cwd, graph, callGraph });
     return formatRankTable(results, args.query);
   } catch (err) {
     return `_query_context failed: ${err.message}_`;

package/src/mcp/server.js

@@ -18,7 +18,7 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '8.14.0',
+  version: '8.16.1',
   description: 'SigMap MCP server — code signatures on demand',
 };
 

package/src/retrieval/ranker.js

@@ -37,6 +37,7 @@ const DEFAULT_WEIGHTS = {
 const GRAPH_BOOST_AMOUNTS = {
   hop1: 0.40,   // direct import neighbor of a file with score > 0
   hop2: 0.15,   // 2 hops away (transitive), with decay
+  callHop: 0.30, // call-graph file neighbor (opt-in retrieval.callGraphBoost)
 };
 
 // Intent-specific weight adjustments
@@ -169,6 +170,8 @@ function scoreFile(filePath, sigs, queryTokens, weights) {
  * @param {object}  [opts.weights]               - override scoring weights
  * @param {string}  [opts.cwd]                   - project root for learned ranking weights
  * @param {{ forward: Map<string,string[]> }} [opts.graph] - dependency graph for neighbor boost
+ * @param {{ forward: Map<string,string[]> }} [opts.callGraph] - file-level call-graph edges
+ *        (from buildCallFileGraph) for the opt-in call-neighbor boost
  * @returns {{ file: string, score: number, sigs: string[], tokens: number, intent: string, signals: object }[]}
  */
 function rank(query, sigIndex, opts) {
@@ -292,6 +295,31 @@ function rank(query, sigIndex, opts) {
     }
   }
 
+  // Call-graph neighbor boost (opt-in via retrieval.callGraphBoost): a file
+  // whose functions call into — or are called by — a positively-scored file is
+  // relevant even when no import edge exists (Go/Java same-package, dynamic
+  // dispatch). Single hop; seeds snapshotted first so boosts never cascade.
+  const callGraph = (opts && opts.callGraph && opts.callGraph.forward instanceof Map) ? opts.callGraph : null;
+  if (callGraph && cwd) {
+    const path = require('path');
+    const relToIdx = new Map();
+    for (let i = 0; i < scored.length; i++) relToIdx.set(scored[i].file, i);
+    const hubs = _computeHubs(callGraph);
+    const seeds = scored.filter((e) => e.score > 0).map((e) => e.file);
+    for (const file of seeds) {
+      const abs = path.resolve(cwd, file);
+      for (const neighborAbs of (callGraph.forward.get(abs) || [])) {
+        if (_isHub(neighborAbs) || hubs.has(neighborAbs)) continue;
+        const neighborRel = path.relative(cwd, neighborAbs).replace(/\\/g, '/');
+        const idx = relToIdx.get(neighborRel);
+        if (idx !== undefined && scored[idx].file !== file) {
+          scored[idx].score += GRAPH_BOOST_AMOUNTS.callHop;
+          scored[idx].signals.callGraphBoost = (scored[idx].signals.callGraphBoost || 0) + GRAPH_BOOST_AMOUNTS.callHop;
+        }
+      }
+    }
+  }
+
   // Compute confidence levels based on score distribution
   if (scored.length > 0) {
     const scores = scored.map(s => s.score);