ucn 5.6.0 → 5.6.1

package/languages/rust.js

@@ -287,7 +287,10 @@ const RUST_TRANSPARENT_FN_ATTRIBUTES = new Set([
 ]);
 
 function rustAttributePath(node) {
-    return node && ['identifier', 'scoped_identifier'].includes(node.type) ? node.text.replace(/\s+/g, '') : null;
+    // Raw identifiers change the spelling, not the attribute's identity.
+    return node && ['identifier', 'scoped_identifier'].includes(node.type)
+        ? node.text.replace(/\s+/g, '').split('::').map(part => part.startsWith('r#') ? part.slice(2) : part).join('::')
+        : null;
 }
 
 /** Outer attribute paths of an item; `cfg_attr(pred, a, b)` yields a, b. */
@@ -314,7 +317,7 @@ function rustOuterAttributePaths(itemNode) {
                 continue;
             }
             if (group === 0 || !expectPath) continue;
-            if (token.type === 'identifier' || token.type === '::') current += token.text;
+            if (token.type === 'identifier' || token.type === '::') current += rustAttributePath(token) || token.text;
             else { if (current) paths.push(current); current = ''; expectPath = false; }
         }
         if (current) paths.push(current);
@@ -602,93 +605,42 @@ function extractVisibility(text) {
 /**
  * Extract attributes from a function node (e.g., #[test], #[tokio::main])
  * @param {Node} node - AST node
- * @param {string} code - Source code
  * @returns {string[]} Array of attribute names
  */
-function extractAttributes(node, codeOrLines) {
+function outerAttributeNodes(node) {
     const attributes = [];
-    const lines = Array.isArray(codeOrLines) ? codeOrLines : codeOrLines.split('\n');
-
-    // Look at lines before the function for attributes
-    const startLine = node.startPosition.row;
-    for (let i = startLine - 1; i >= 0 && i >= startLine - 5; i--) {
-        const line = lines[i]?.trim();
-        if (!line) break;
-        if (line.startsWith('#[')) {
-            // Extract attribute name (e.g., #[test] -> test, #[tokio::main] -> tokio::main)
-            const match = line.match(/#\[([^\]]+)\]/);
-            if (match) {
-                const attrContent = match[1];
-                // Get just the attribute name (without arguments)
-                const attrName = attrContent.split('(')[0].trim();
-                // Skip compiler hint attributes that aren't semantically meaningful for display
-                const SKIP_ATTRS = new Set(['allow', 'deny', 'warn', 'forbid', 'cfg_attr', 'doc']);
-                if (!SKIP_ATTRS.has(attrName)) {
-                    attributes.push(attrName);
-                }
-            }
-        } else if (!line.startsWith('//')) {
-            // Stop at non-comment, non-attribute lines
-            break;
-        }
+    for (let sibling = node.previousNamedSibling; sibling; sibling = sibling.previousNamedSibling) {
+        if (sibling.type === 'line_comment' || sibling.type === 'block_comment') continue;
+        if (sibling.type !== 'attribute_item') break;
+        const attribute = sibling.namedChildren.find(child => child.type === 'attribute');
+        if (attribute) attributes.unshift(attribute);
     }
-
     return attributes;
 }
 
-/**
- * Extract attributes WITH their argument tokens (for routing decorator detection).
- * Returns array of { name, args: rawArgString } objects.
- *   #[get("/users")] → [{ name: 'get', args: '"/users"' }]
- *   #[tokio::main] → [{ name: 'tokio::main', args: null }]
- *
- * @param {Node} node - Function AST node
- * @param {string|string[]} codeOrLines - Source code or pre-split lines
- * @returns {Array<{name: string, args: string|null}>}
- */
-function extractAttributesWithArgs(node, codeOrLines) {
-    const result = [];
-    const lines = Array.isArray(codeOrLines) ? codeOrLines : codeOrLines.split('\n');
-
-    const startLine = node.startPosition.row;
-    for (let i = startLine - 1; i >= 0 && i >= startLine - 5; i--) {
-        const line = lines[i]?.trim();
-        if (!line) break;
-        if (line.startsWith('#[')) {
-            // Match #[name(...args...)] or #[name]
-            // Need to handle nested parens; use a simple bracket-matching approach.
-            // (The line is trimmed: only a line ending in ']' can match; a
-            // macro expansion's generated line can be very long.)
-            const m = line.charCodeAt(line.length - 1) === 93 ? line.match(/^#\[(.+)\]\s*$/) : null;
-            if (m) {
-                const attrContent = m[1];
-                const parenIdx = attrContent.indexOf('(');
-                if (parenIdx === -1) {
-                    result.unshift({ name: attrContent.trim(), args: null });
-                } else {
-                    const name = attrContent.slice(0, parenIdx).trim();
-                    // Extract content within outer parens (find matching close)
-                    let depth = 0;
-                    let endIdx = -1;
-                    for (let k = parenIdx; k < attrContent.length; k++) {
-                        const ch = attrContent[k];
-                        if (ch === '(') depth++;
-                        else if (ch === ')') {
-                            depth--;
-                            if (depth === 0) { endIdx = k; break; }
-                        }
-                    }
-                    const args = endIdx > parenIdx
-                        ? attrContent.slice(parenIdx + 1, endIdx).trim()
-                        : attrContent.slice(parenIdx + 1).trim();
-                    result.unshift({ name, args });
-                }
-            }
-        } else if (!line.startsWith('//')) {
-            break;
+function extractAttributes(node) {
+    const skip = new Set(['allow', 'deny', 'warn', 'forbid', 'cfg_attr', 'doc']);
+    // Preserve the established nearest-first modifier ordering. Ownership
+    // comes from adjacent AST siblings, never preceding source lines.
+    return extractAttributesWithArgs(node).reverse().map(attribute => attribute.name)
+        .filter(name => !skip.has(name));
+}
+
+/** Written outer attributes attached to this item, in source order. */
+function extractAttributesWithArgs(node) {
+    const attributes = [];
+    for (const attribute of outerAttributeNodes(node)) {
+        let name = rustAttributePath(attribute.namedChild(0));
+        if (!name) continue;
+        const argumentsNode = attribute.childForFieldName('arguments');
+        // The existing attribute record keeps name-value attributes whole
+        // (notably path = "module.rs", which module resolution consumes).
+        if (!argumentsNode && attribute.children.some(child => child.type === '=')) {
+            name += attribute.text.slice(attribute.namedChild(0).endIndex - attribute.startIndex).trimEnd();
         }
+        attributes.push({ name, args: argumentsNode ? argumentsNode.text.slice(1, -1).trim() : null });
     }
-    return result;
+    return attributes;
 }
 
 // --- Module-scope constants for state object detection ---
@@ -701,30 +653,14 @@ function extractAttributesWithArgs(node, codeOrLines) {
  * functions inside a `mod tests` block as test entry points even when
  * they don't carry a direct `#[test]` attribute (BUG-CY).
  */
-function _isInsideCfgTestModule(node, lines) {
-    let parent = node.parent;
-    while (parent) {
-        if (parent.type === 'mod_item') {
-            const startRow = parent.startPosition.row;
-            // Look at preceding lines for #[cfg(test)] or #[cfg(any(test,...))] / #[cfg(all(...,test,...))]
-            for (let i = startRow - 1; i >= 0 && i >= startRow - 5; i--) {
-                const line = lines[i]?.trim();
-                if (!line) break;
-                if (line.startsWith('#[')) {
-                    // Match #[cfg(...)] forms that include a `test` predicate.
-                    // Conservatively look for the literal token `test` inside the cfg(...) args.
-                    const m = line.match(/#\[\s*cfg\s*\(([^\]]*)\)\s*\]/);
-                    if (m) {
-                        const args = m[1];
-                        // Word-boundary match for `test` to avoid matching e.g. `testing_module`.
-                        if (/\btest\b/.test(args)) return true;
-                    }
-                } else if (!line.startsWith('//')) {
-                    break;
-                }
-            }
-        }
-        parent = parent.parent;
+function _isInsideCfgTestModule(node) {
+    const namesTest = part => part.type === 'identifier' && rustAttributePath(part) === 'test' ||
+        part.namedChildren.some(namesTest);
+    for (let parent = node.parent; parent; parent = parent.parent) {
+        if (parent.type !== 'mod_item') continue;
+        if (outerAttributeNodes(parent).some(attribute =>
+            rustAttributePath(attribute.namedChild(0)) === 'cfg' &&
+            attribute.childForFieldName('arguments')?.namedChildren.some(namesTest))) return true;
     }
     return false;
 }
@@ -6404,6 +6340,67 @@ const RUST_INERT_ATTRIBUTES = new Set(['test', 'ignore', 'should_panic', 'cfg',
     'forbid', 'expect', 'doc', 'inline', 'cold', 'must_use', 'deprecated', 'track_caller', 'no_mangle', 'case',
     'values', 'timeout']);
 
+/** The comma-separated syntax groups of an attribute's token tree. */
+function rustAttributeGroups(argumentsNode) {
+    const groups = [[]];
+    for (const child of argumentsNode?.children || []) {
+        if (['(', ')', '[', ']', '{', '}', 'line_comment', 'block_comment'].includes(child.type)) continue;
+        if (child.type === ',') groups.push([]);
+        else groups[groups.length - 1].push(child);
+    }
+    return groups.filter(group => group.length > 0);
+}
+
+/** An attribute written inside cfg_attr is token-tree syntax, not an attribute node. */
+function rustNestedAttribute(nodes) {
+    let name = '';
+    let args = null;
+    for (const node of nodes) {
+        if (node.type === 'token_tree') { args = node; break; }
+        if (['identifier', 'scoped_identifier', '::'].includes(node.type)) name += rustAttributePath(node) || node.text;
+        else break;
+    }
+    return { name, args };
+}
+
+// Only configuration facts intrinsic to a test build are decided here.
+// Feature, target and user cfg values remain unknown, including their negations.
+function rustTestCfgValue(nodes) {
+    if (nodes.length === 1 && nodes[0].type === 'identifier' && rustAttributePath(nodes[0]) === 'test') return true;
+    const { name, args } = rustNestedAttribute(nodes);
+    if (!args) return null;
+    const values = rustAttributeGroups(args).map(rustTestCfgValue);
+    if (name === 'all') return values.includes(false) ? false : values.includes(null) ? null : true;
+    if (name === 'any') return values.includes(true) ? true : values.includes(null) ? null : false;
+    if (name === 'not' && values.length === 1) return values[0] === null ? null : !values[0];
+    return null;
+}
+
+/** Possible attributes cfg_attr adds to this exact declaration, never a neighbor. */
+function rustConditionalTestAttributes(node) {
+    const attributes = [];
+    const expand = (name, args, active) => {
+        if (active === false) return;
+        if (name !== 'cfg_attr') {
+            if (name) attributes.push({ name, certain: active === true });
+            return;
+        }
+        const [condition, ...nested] = rustAttributeGroups(args);
+        const value = condition ? rustTestCfgValue(condition) : null;
+        const enabled = value === false ? false : active === null || value === null ? null : true;
+        for (const group of nested) {
+            const attribute = rustNestedAttribute(group);
+            expand(attribute.name, attribute.args, enabled);
+        }
+    };
+    for (const attribute of outerAttributeNodes(node)) {
+        if (rustAttributePath(attribute.namedChild(0)) === 'cfg_attr') {
+            expand('cfg_attr', attribute.childForFieldName('arguments'), true);
+        }
+    }
+    return attributes;
+}
+
 /**
  * The tests a Rust file declares, as the test harness lists them: a
  * function carrying #[test] or an attribute whose path ends in ::test
@@ -6415,11 +6412,26 @@ const RUST_INERT_ATTRIBUTES = new Set(['test', 'ignore', 'should_panic', 'cfg',
 function testUnits(fileEntry, helpers) {
     const units = [];
     const holding = new Set();
+    const attributesOf = symbol => symbol.attributesWithArgs || [];
+    let conditionalAttributes;
+    const conditionalAttributesOf = symbol => {
+        if (!attributesOf(symbol).some(attribute => attribute.name === 'cfg_attr')) return [];
+        if (!conditionalAttributes) {
+            conditionalAttributes = new Map();
+            for (const node of helpers.tree()?.rootNode.descendantsOfType('function_item') || []) {
+                conditionalAttributes.set(node.startIndex, rustConditionalTestAttributes(node));
+            }
+        }
+        return conditionalAttributes.get(symbol.sourceSpan?.start) || [];
+    };
     for (const symbol of fileEntry.symbols || []) {
-        if (symbol.type !== 'function') continue;
-        const attributes = symbol.attributesWithArgs || [];
+        if (symbol.type !== 'function' || symbol.macroExpansion) continue;
+        const attributes = attributesOf(symbol);
         // The attribute's path: `ignore = "why"` is the attribute `ignore`.
-        const names = attributes.map(attribute => String(attribute.name).split(/[\s=(]/)[0]);
+        const directNames = attributes.map(attribute => String(attribute.name).split(/[\s=(]/)[0]);
+        const conditional = conditionalAttributesOf(symbol);
+        const names = [...directNames, ...conditional.map(attribute => attribute.name)];
+        const ignored = directNames.includes('ignore') || conditional.some(attribute => attribute.name === 'ignore' && attribute.certain);
         const plain = names.some(name => /(^|::)test$/.test(name));
         const cases = names.some(name => RUST_CASE_ATTRIBUTES.has(name.split('::').pop()));
         if (!plain && !cases) continue;
@@ -6428,6 +6440,8 @@ function testUnits(fileEntry, helpers) {
         const gates = chain.filter(outer => (outer.modifiers || []).includes('cfg')).length;
         const ownGate = attributes.some(attribute => /^cfg(_attr)?$/.test(String(attribute.name)) &&
             String(attribute.args || '').replace(/[\s()]/g, '') !== 'test');
+        const outerGate = chain.some(outer => attributesOf(outer).some(attribute =>
+            /^cfg(_attr)?$/.test(String(attribute.name)) && String(attribute.args || '').replace(/[\s()]/g, '') !== 'test'));
         const inTestModule = (symbol.modifiers || []).includes('cfg_test_module');
         // An attribute that is none of the language's is a macro that rewrites the function.
         const rewritten = names.some(name => !/(^|::)test$/.test(name) &&
@@ -6437,11 +6451,11 @@ function testUnits(fileEntry, helpers) {
         units.push({
             kind: 'test', name: symbol.name, suite: chain.map(outer => outer.name),
             line: symbol.nameLine || symbol.startLine, startLine: symbol.startLine,
-            endLine: symbol.endLine ?? symbol.startLine,
+            endLine: symbol.endLine ?? symbol.startLine, sourceSpan: symbol.sourceSpan,
             // Declared, and left out of a run unless asked for.
-            ...(names.includes('ignore') && { ignored: true, skipped: true }),
-            ...((ownGate || gates > (inTestModule ? 1 : 0)) && { conditional: true, notInEveryBuild: true }),
-            ...(!(ownGate || gates > (inTestModule ? 1 : 0)) && rewritten && { conditional: true }),
+            ...(ignored && { ignored: true, skipped: true }),
+            ...((ownGate || outerGate || gates > (inTestModule ? 1 : 0)) && { conditional: true, notInEveryBuild: true }),
+            ...(!(ownGate || outerGate || gates > (inTestModule ? 1 : 0)) && rewritten && { conditional: true }),
             // What a macro makes of the function is not read: none, one
             // or several tests.
             ...(rewritten && { several: true }),
@@ -6452,7 +6466,7 @@ function testUnits(fileEntry, helpers) {
         units.push({
             kind: 'suite', name: outer.name, suite: helpers.enclosing(outer).map(up => up.name),
             line: outer.nameLine || outer.startLine, startLine: outer.startLine,
-            endLine: outer.endLine ?? outer.startLine,
+            endLine: outer.endLine ?? outer.startLine, sourceSpan: outer.sourceSpan,
         });
     }
     // Tests a macro makes are not listed: a function a macro of the

package/languages/static-js.js

@@ -0,0 +1,88 @@
+'use strict';
+
+const { sameNode } = require('./utils');
+const SCOPES = new Set(['program', 'statement_block', 'switch_body', 'for_statement', 'for_in_statement',
+    'function_declaration', 'generator_function_declaration', 'function_expression', 'generator_function',
+    'arrow_function', 'method_definition', 'catch_clause', 'class', 'class_declaration']);
+const FUNCTIONS = new Set(['function_declaration', 'generator_function_declaration', 'function_expression',
+    'generator_function', 'arrow_function', 'method_definition']);
+
+function hasName(pattern, name) {
+    return !!pattern && (pattern.text === name ||
+        pattern.descendantsOfType(['identifier', 'shorthand_property_identifier_pattern']).some(id => id.text === name));
+}
+
+/** Decode a JavaScript literal without evaluating project code. */
+function jsString(node) {
+    if (!node || !['string', 'template_string'].includes(node.type) ||
+        node.namedChildren.some(child => child.type === 'template_substitution')) return null;
+    const escapes = { n: '\n', t: '\t', r: '\r', b: '\b', f: '\f', v: '\v', 0: '\0' };
+    return node.text.slice(1, -1).replace(/\\(u\{[0-9a-fA-F]+\}|u[0-9a-fA-F]{4}|x[0-9a-fA-F]{2}|[0-3][0-7]{0,2}|[4-7][0-7]?|\r?\n|[\s\S])/g, (whole, escape) => {
+        if (/^[0-7]+$/.test(escape)) return String.fromCharCode(parseInt(escape, 8));
+        if (escape[0] === 'u' || escape[0] === 'x') {
+            const code = parseInt(escape.replace(/^[ux]\{?|\}$/g, ''), 16);
+            return code <= 0x10ffff ? String.fromCodePoint(code) : whole;
+        }
+        if (escape === '\n' || escape === '\r\n') return '';
+        return Object.hasOwn(escapes, escape) ? escapes[escape] : escape;
+    });
+}
+
+/** One stable const binding, with block and parameter shadowing. */
+function jsConstValue(node, constructedMutable = false) {
+    if (node?.type !== 'identifier') return null;
+    const name = node.text;
+    for (let scope = node.parent; scope; scope = scope.parent) {
+        if (scope.type === 'with_statement') return null;
+        if (!SCOPES.has(scope.type)) continue;
+        // Named function/generator/class expressions bind their own name in
+        // their body; it never denotes an outer const of the same spelling.
+        if (['function_expression', 'generator_function', 'function_declaration',
+            'generator_function_declaration', 'class', 'class_declaration'].includes(scope.type) &&
+            scope.childForFieldName('name')?.text === name) return null;
+        const params = scope.childForFieldName('parameters') || scope.childForFieldName('parameter');
+        if (hasName(params, name) || (scope.type === 'for_in_statement' && hasName(scope.childForFieldName('left'), name))) return null;
+        if (FUNCTIONS.has(scope.type)) {
+            let shadow = false;
+            const scanVars = current => {
+                for (const child of current.namedChildren) {
+                    if (FUNCTIONS.has(child.type)) continue;
+                    if (child.type === 'variable_declarator' && child.parent?.type === 'variable_declaration' &&
+                        hasName(child.childForFieldName('name'), name)) shadow = true;
+                    scanVars(child);
+                }
+            };
+            scanVars(scope);
+            if (shadow) return null;
+        }
+        const bindings = [];
+        const walk = current => {
+            for (const child of current.namedChildren) {
+                if (['function_declaration', 'generator_function_declaration', 'class_declaration'].includes(child.type) && child.childForFieldName('name')?.text === name) bindings.push(child);
+                if (SCOPES.has(child.type) && !sameNode(child, scope)) continue;
+                if (child.type === 'variable_declarator' && hasName(child.childForFieldName('name'), name)) bindings.push(child);
+                else if (child.type === 'import_statement' && hasName(child, name)) bindings.push(child);
+                walk(child);
+            }
+        };
+        walk(scope);
+        if (bindings.length === 0) continue;
+        if (bindings.length !== 1) return null;
+        const binding = bindings[0];
+        if (binding.type !== 'variable_declarator' || binding.childForFieldName('name')?.type !== 'identifier' ||
+            binding.endIndex > node.startIndex) return null;
+        const value = binding.childForFieldName('value');
+        if (binding.parent?.type === 'lexical_declaration' && binding.parent.child(0)?.type === 'const') return value;
+        if (!constructedMutable || value?.type !== 'new_expression') return null;
+        const writes = node.tree.rootNode.descendantsOfType(['assignment_expression', 'augmented_assignment_expression', 'update_expression']);
+        if (writes.some(write => hasName(write.childForFieldName('left') || write.childForFieldName('argument'), name))) return null;
+        return value;
+    }
+    return null;
+}
+
+function jsStaticKey(node) {
+    return jsString(node) ?? jsString(jsConstValue(node));
+}
+
+module.exports = { jsString, jsConstValue, jsStaticKey };

package/mcp/server.js

@@ -247,7 +247,7 @@ Use UCN for semantic questions: exact definitions, symbol-aware callers/callees,
 - impact: symbol impact when name is set; Git-diff impact when it is omitted.
 - tests: static direct links by default; depth>0 includes transitive affected links. Each test is named by its file, suites and name, with the command that runs it where the runner is proven. Empty results are not runtime coverage proof.
 - deps/api/entrypoints/endpoints: architecture and public surfaces.
-- check: symbol signature check when name is set; precommit check when omitted (per changed symbol: BLOCKED = a break was observed, REVIEW = can reach existing code, READY = nothing existing depends on it; staged=true reads the git index, not the worktree). plan previews the selected declaration plus indexed call/import/export edits; with delete=true it assesses deleting the declaration (no-static-dependents, has-static-dependents, or review with the reason), by the rule deadcode applies to every name. A .ucn.json "kind": "application" lets exported symbols be assessed.
+- check: symbol signature check when name is set; precommit check when omitted (per changed symbol: BLOCKED = a break was observed, REVIEW = change exposure or a changed call cannot be settled, READY = no unresolved exposure in the modeled checks, not compiler or runtime proof; staged=true reads the git index, not the worktree). plan previews the selected declaration plus indexed call/import/export edits; with delete=true it assesses deleting the declaration (no-static-dependents, has-static-dependents, or review with the reason), by the rule deadcode applies to every name. A .ucn.json "kind": "application" lets exported symbols be assessed.
 - deadcode/audit_async/stacktrace: focused audits and runtime evidence. Computed dispatch is reported as a health/deletion blind spot; unknown decorators and member-assigned handlers are withheld from default dead-code claims.
 
 CONFIRMED carries target-identity evidence. UNVERIFIED is possible and requires review; when same-name definitions compete, show returns their stable handles once above the sites. ACCOUNT conserves observed literal-name lines; an observed-text zero never claims semantic completeness or safe deletion. CONTRACT is a state: text-complete means every literal-name line of project source was classified, never that aliases, indirect calls, generated code or runtime dispatch are absent. Source UCN reads without analyzing (bundles, paths excluded in .ucn.json, oversized files, unsupported languages) is searched for each name and listed only when the name occurs there; a path that cannot be read degrades every account. repo health states the scope once. Evidence weights are ordinal, not probabilities. Warnings, excluded reasons, and contract metadata remain visible when caller evidence is returned. Releases are gated on pinned real repositories: sampled callers, callees, value references, and dead-code claims are compared with ts-morph, Pyright, gopls, rust-analyzer, JDT LS, Roslyn, and clangd, and one handle's claims must agree across find, show, source, impact, tests, check, and caller trace.` + generateMcpParamSection();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ucn",
-  "version": "5.6.0",
+  "version": "5.6.1",
   "mcpName": "io.github.mleoca/ucn",
   "description": "Auditable AST code intelligence for AI agents: 18 task-oriented commands through one MCP tool, CLI, or agent skill. Supports JS/TS, Python, Go, Rust, Java, C, C++, C#, and HTML.",
   "main": "index.js",
@@ -10,7 +10,7 @@
   },
   "scripts": {
     "version": "node scripts/sync-server-version.js && node scripts/changelog.js && git add server.json CHANGELOG.md",
-    "test": "node --test test/audit-5.4.0.test.js test/audit-5.3.8.test.js test/audit-5.3.7.test.js test/audit-5.3.6.test.js test/evidence-provenance.test.js test/evidence-bands.test.js test/constructed-receiver.test.js test/provenance-unit.test.js test/provenance-scope.test.js test/shell-output.test.js test/param-table.test.js test/changelog.test.js test/repo-facts.test.js test/parser-unit.test.js test/integration.test.js test/cache.test.js test/formatter.test.js test/interactive.test.js test/feature.test.js test/regression-js.test.js test/regression-py.test.js test/regression-go.test.js test/regression-java.test.js test/regression-rust.test.js test/regression-c-family.test.js test/regression-cross.test.js test/regression-mcp.test.js test/mcp-protocol.test.js test/mcp-sdk-compat.test.js test/dependency-security.test.js test/regression-parser.test.js test/regression-commands.test.js test/regression-fixes.test.js test/regression-bugfixes.test.js test/release-surface-regressions.test.js test/prerelease-audit.test.js test/release-readiness-audit.test.js test/cross-language.test.js test/accuracy.test.js test/command-coverage.test.js test/perf-optimizations.test.js test/performance-gate-policy.test.js test/oracle-gate-policy.test.js test/outcome-policy.test.js test/outcome-mutations.test.js test/source-universe.test.js test/deletion.test.js test/check-change-kinds.test.js test/test-units.test.js test/check-staged.test.js test/consistency-eval.test.js test/agent-public-surface-benchmark.test.js test/command-contracts.test.js test/language-adapter.test.js test/systematic-test.js test/mcp-edge-cases.js test/conservation.test.js test/parity-test.js test/trust-matrix.test.js",
+    "test": "node --test test/audit-5.4.0.test.js test/audit-5.3.8.test.js test/audit-5.3.7.test.js test/audit-5.3.6.test.js test/evidence-provenance.test.js test/evidence-bands.test.js test/constructed-receiver.test.js test/provenance-unit.test.js test/provenance-scope.test.js test/shell-output.test.js test/param-table.test.js test/changelog.test.js test/repo-facts.test.js test/parser-unit.test.js test/integration.test.js test/cache.test.js test/formatter.test.js test/interactive.test.js test/feature.test.js test/regression-js.test.js test/regression-py.test.js test/regression-go.test.js test/regression-java.test.js test/regression-rust.test.js test/regression-c-family.test.js test/regression-cross.test.js test/regression-mcp.test.js test/mcp-protocol.test.js test/mcp-sdk-compat.test.js test/dependency-security.test.js test/regression-parser.test.js test/regression-commands.test.js test/regression-fixes.test.js test/regression-bugfixes.test.js test/release-surface-regressions.test.js test/prerelease-audit.test.js test/release-readiness-audit.test.js test/cross-language.test.js test/accuracy.test.js test/command-coverage.test.js test/perf-optimizations.test.js test/performance-gate-policy.test.js test/oracle-gate-policy.test.js test/outcome-policy.test.js test/outcome-mutations.test.js test/source-universe.test.js test/deletion.test.js test/check-change-kinds.test.js test/check-outgoing.test.js test/check-performance.test.js test/test-units.test.js test/check-staged.test.js test/consistency-eval.test.js test/agent-public-surface-benchmark.test.js test/command-contracts.test.js test/language-adapter.test.js test/systematic-test.js test/mcp-edge-cases.js test/conservation.test.js test/parity-test.js test/trust-matrix.test.js",
     "benchmark:agent": "node test/agent-public-surface-benchmark.js",
     "benchmark:agent:gate": "node test/agent-public-surface-benchmark.js --gate",
     "benchmark:agent:legacy": "node test/agent-understanding-benchmark.js",
@@ -21,7 +21,8 @@
     "eval:host-calibration": "node eval/lib/host-calibration.js --pin",
     "eval:consistency": "node eval/run-consistency-eval.js --project .",
     "profile:callers": "node eval/profile-callers.js",
-    "lint": "eslint core/ cli/ mcp/ languages/ eval/run-*.js eval/*-gate-policy.js eval/outcome-policy.js eval/outcome-mutations.js eval/deletion-matrix-cases.js eval/check-matrix-cases.js eval/test-unit-matrix-cases.js eval/profile-callers.js eval/oracles/*.js",
+    "profile:check": "node eval/profile-check.js",
+    "lint": "eslint core/ cli/ mcp/ languages/ eval/run-*.js eval/*-gate-policy.js eval/outcome-policy.js eval/outcome-mutations.js eval/deletion-matrix-cases.js eval/check-matrix-cases.js eval/check-outgoing-cases.js eval/test-unit-matrix-cases.js eval/profile-callers.js eval/profile-check.js eval/oracles/*.js",
     "verify": "npm run lint && npm test",
     "trust:gate:semantic": "node eval/run-oracle-eval.js --release --min-precision 0.98 --max-unscored-ratio 0.10",
     "trust:gate:deadcode": "node eval/run-deadcode-eval.js --release --sample 100 --arm default",