weavatrix 0.2.14 → 0.2.16

package/src/mcp/catalog.mjs

@@ -39,6 +39,7 @@ const HOT_OWNERS = [
     'actions/graph-lifecycle.mjs', 'actions/advisories.mjs',
     'actions/hosted-architecture.mjs', 'actions/graph-sync.mjs',
     'architecture-starter.mjs', 'architecture-bootstrap.mjs',
+    'company-contract-verdict.mjs',
 ]
 export const HOT_FILES = [...HOT_FACADES, ...HOT_OWNERS, 'catalog.mjs']
 
@@ -50,8 +51,8 @@ function buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps}) {
         {cap: 'graph', name: 'query_graph', description: 'Explore a focused production-first graph around a concept or exact symbols (BFS/DFS). Exact seed files/symbols stay pinned; relation_filter and flow_direction support bounded event/data-flow views without a separate tool. Classified paths and unreferenced constant/field leaves stay suppressed unless explicitly requested.', inputSchema: {type: 'object', properties: {question: {type: 'string', description: 'Optional natural-language question or keyword search when exact seeds are not sufficient'}, mode: {type: 'string', enum: ['bfs', 'dfs'], default: 'bfs'}, depth: {type: 'integer', default: 3}, context_filter: {type: 'array', items: {type: 'string'}}, seed_files: {type: 'array', items: {type: 'string'}, maxItems: 12, description: 'Exact repo-relative file paths. Resolved exact seeds remain pinned unless augment_seeds is true'}, seed_symbols: {type: 'array', items: {type: 'string'}, maxItems: 12, description: 'Exact node IDs or unambiguous symbol labels; enables focused flows without fuzzy query seeds'}, relation_filter: {oneOf: [{type: 'array', items: {type: 'string'}}, {type: 'string'}], description: 'Optional relation allow-list, e.g. calls,references,imports'}, flow_direction: {type: 'string', enum: ['forward', 'backward', 'both'], default: 'both', description: 'Traverse outgoing, incoming, or both directions'}, augment_seeds: {type: 'boolean', default: false, description: 'With exact seeds, also add fuzzy question-derived seeds; false keeps traversal strictly pinned'}, include_classified: {type: 'boolean', default: false, description: 'Allow traversal through tests/e2e/generated/mocks/stories/docs/benchmarks/temp and explicitly excluded paths. An explicit class term in the question enables only that class.'}, include_low_signal: {type: 'boolean', default: false, description: 'Include unreferenced constant/field leaf symbols that do not match a query term'}, token_budget: {type: 'integer', description: 'Higher budget shows more nodes/edges', default: 2000}}, anyOf: [{required: ['question']}, {required: ['seed_files']}, {required: ['seed_symbols']}]}, run: (g, a, ctx) => tg.tQueryGraph(g, a, ctx)},
         {cap: 'graph', name: 'god_nodes', description: 'Rank production-code connectivity hubs by unique call/import/reference neighbors, with class/method ownership reported separately from runtime connectivity. Repeated call sites do not inflate the rank; classified tests, generated/build output and other non-product paths are excluded by default.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', default: 10}, include_classified: {type: 'boolean', default: false, description: 'Include tests/e2e/generated/build output/mocks/stories/docs/benchmarks/temp and paths explicitly excluded by repository classification'}}}, run: (g, a, ctx) => tg.tGodNodes(g, a, ctx)},
         {cap: 'graph', name: 'shortest_path', description: 'Find the shortest path between two concepts in the knowledge graph.', inputSchema: {type: 'object', properties: {source: {type: 'string'}, target: {type: 'string'}, max_hops: {type: 'integer', default: 8}}, required: ['source', 'target']}, run: (g, a) => tg.tShortestPath(g, a)},
-        {cap: 'graph', name: 'get_dependents', description: 'Transitive blast-radius of ONE node: everything that calls/imports/inherits it, directly or through intermediaries (reverse edges, ranked by proximity then connectivity). Symbol queries stay symbol-precise by default; set include_container_importers only for a conservative module-wide radius. Use before refactoring; get_neighbors shows only 1 hop, change_impact covers your whole current diff at once.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Node label or ID'}, depth: {type: 'integer', description: 'Max reverse hops, default 3', default: 3}, max_nodes: {type: 'integer', description: 'Max dependents to list, default 40', default: 40}, include_container_importers: {type: 'boolean', description: 'Also seed importers of the symbol containing file (broader, conservative; default false)', default: false}}, required: ['label']}, run: (g, a) => ti.tGetDependents(g, a)},
-        {cap: 'graph', name: 'change_impact', description: 'Verdict-first, symbol-aware blast radius. Parses a zero-context git diff, distinguishes additive exports from signature/body/removal risk, and reverse-traverses only exact changed seeds so a new API does not inherit every legacy importer of its file. Measured coverage is used when present; otherwise static test reachability is labelled actualCoverage=NOT_AVAILABLE. Pass `diff` for a not-checked-out PR; `files` without a diff remains a conservative fallback.', inputSchema: {type: 'object', properties: {base: {type: 'string', description: 'Base ref, e.g. origin/main or HEAD~1 (default: first existing of origin/HEAD, origin/main, origin/master, main, master)'}, diff: {type: 'string', maxLength: 2097152, description: 'Optional unified diff (prefer --unified=0) for a PR/change that is not checked out; enables symbol-level classification'}, files: {type: 'array', items: {type: 'string'}, maxItems: 500, description: 'Optional repo-relative changed-file hints. Without diff evidence these are classified conservatively rather than guessed additive'}, depth: {type: 'integer', description: 'Max reverse hops, default 2'}, max_nodes: {type: 'integer', description: 'Max impacted nodes to list, default 40'}}}, run: (g, a, ctx) => ti.tChangeImpact(g, a, ctx)},
+        {cap: 'graph', name: 'get_dependents', description: 'Transitive blast-radius of ONE node. JavaScript/TypeScript symbols use a cached on-demand EXACT_LSP point query by default, then traverse exact direct callers through the wider graph; incomplete precision is labelled and never silently presented as exact. Set precision=graph to skip LSP or include_container_importers for a conservative module-wide radius.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Node label or ID'}, depth: {type: 'integer', description: 'Max reverse hops, default 3', default: 3}, max_nodes: {type: 'integer', description: 'Max dependents to list, default 40', default: 40}, precision: {type: 'string', enum: ['auto', 'graph', 'lsp'], default: 'auto', description: 'auto uses exact JS/TS point queries when precision is enabled; graph skips LSP; lsp forces an attempt'}, max_references: {type: 'integer', minimum: 1, maximum: 5000, default: 1000}, timeout_ms: {type: 'integer', minimum: 1000, maximum: 60000, default: 30000}, include_container_importers: {type: 'boolean', description: 'Also seed importers of the symbol containing file (broader, conservative; default false)', default: false}}, required: ['label']}, run: (g, a, ctx) => ti.tGetDependents(g, a, ctx)},
+        {cap: 'graph', name: 'change_impact', description: 'Verdict-first, symbol-aware blast radius. Parses a zero-context git diff and uses one bounded EXACT_LSP batch query for direct references to changed JavaScript/TypeScript symbols; transitive hops stay explicitly graph-backed. Additive exports do not inherit legacy file importers. Measured coverage is used when present; otherwise static reachability is labelled, not treated as coverage.', inputSchema: {type: 'object', properties: {base: {type: 'string', description: 'Base ref, e.g. origin/main or HEAD~1 (default: first existing of origin/HEAD, origin/main, origin/master, main, master)'}, diff: {type: 'string', maxLength: 2097152, description: 'Optional unified diff (prefer --unified=0) for a PR/change that is not checked out; enables symbol-level classification'}, files: {type: 'array', items: {type: 'string'}, maxItems: 500, description: 'Optional repo-relative changed-file hints. Without diff evidence these are classified conservatively rather than guessed additive'}, depth: {type: 'integer', description: 'Max reverse hops, default 2'}, max_nodes: {type: 'integer', description: 'Max impacted nodes to list, default 40'}, precision: {type: 'string', enum: ['auto', 'graph', 'lsp'], default: 'auto'}, max_references: {type: 'integer', minimum: 1, maximum: 16384, default: 5000}, timeout_ms: {type: 'integer', minimum: 1000, maximum: 60000, default: 45000}}}, run: (g, a, ctx) => ti.tChangeImpact(g, a, ctx)},
         {cap: 'graph', name: 'git_history', description: 'Behavioral architecture evidence from bounded local git history: churn × connectivity hotspots, hidden co-change coupling, and expected test/source coupling. Reads numstat only — never commit messages, authors, or source bodies.', inputSchema: {type: 'object', properties: {months: {type: 'integer', enum: [3, 6, 12], default: 6}, max_commits: {type: 'integer', minimum: 1, maximum: 5000, default: 1000}, min_pair_count: {type: 'integer', minimum: 2, maximum: 100, default: 3}, max_pairs: {type: 'integer', minimum: 1, maximum: 500, default: 100}, top_n: {type: 'integer', minimum: 1, maximum: 50, default: 10}}}, run: (g, a, ctx) => thi.tGitHistory(g, a, ctx)},
         {
             cap: 'graph', refreshGraph: true, name: 'verified_change',
@@ -75,12 +76,13 @@ function buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps}) {
         {
             cap: 'crossrepo',
             name: 'trace_api_contract',
-            description: 'Cross-repository HTTP contract, handler-liveness and blast-radius evidence. Select a registered backend and one or more registered clients; joins backend endpoints to built-in, configured, or conservatively auto-discovered HTTP wrappers. Medium/high-confidence external matches mark a handler NOT_DEAD_EXTERNAL_USE; no match remains UNKNOWN. Repository paths stay local and cannot be supplied through this tool.',
+            description: 'Cross-repository HTTP, GraphQL, gRPC and event/topic contract, handler-liveness and blast-radius evidence. Joins static backend contracts to registered client repositories; dynamic URLs/topics, reflection and unresolved runtime configuration remain explicit UNKNOWN evidence. Medium/high-confidence external matches mark a handler/contract NOT_DEAD_EXTERNAL_USE. Repository paths stay local and cannot be supplied through this tool.',
             inputSchema: {
                 type: 'object',
                 properties: {
                     backend: {type: 'string', description: 'Backend repository UUID or exact unambiguous registry label'},
                     clients: {type: 'array', items: {type: 'string'}, minItems: 1, maxItems: 20, description: 'Client repository UUIDs or exact unambiguous registry labels'},
+                    transport: {type: 'string', enum: ['all', 'http', 'graphql', 'grpc', 'event'], default: 'all', description: 'Contract family to trace; all runs every supported static detector'},
                     method: {type: 'string', enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS']},
                     path: {type: 'string', maxLength: 2048, description: 'Optional full route or segment-aligned route fragment; /query matches /edgeAnalytics/query/... and {id}, :id and concrete parameter values are normalized'},
                     changed_files: {type: 'array', items: {type: 'string'}, maxItems: 500, description: 'Optional backend repo-relative changed files; only endpoints declared in those files are traced'},
@@ -104,6 +106,7 @@ function buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps}) {
                         },
                     },
                     auto_discover_wrappers: {type: 'boolean', default: true, description: 'Discover only simple unambiguous functions that forward a URL parameter directly to a known object-style HTTP client'},
+                    runtime_config: {type: 'object', maxProperties: 50, additionalProperties: {type: 'string', maxLength: 2048}, description: 'Optional non-secret static bindings for runtime URL prefixes, e.g. process.env.API_BASE. Values are used locally for this call and are not returned.'},
                     include_tests: {type: 'boolean', default: false},
                     max_impact_depth: {type: 'integer', minimum: 0, maximum: 5, default: 2},
                     max_endpoints: {type: 'integer', minimum: 1, maximum: 500, default: 250},
@@ -138,7 +141,7 @@ function buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps}) {
         {cap: 'health', name: 'propose_architecture_exception', description: 'Prepare, but never apply, a bounded exception proposal for human review.', inputSchema: {type: 'object', properties: {fingerprint: {type: 'string'}, reason: {type: 'string'}, expires: {type: 'string', description: 'Optional YYYY-MM-DD'}}, required: ['fingerprint', 'reason']}, run: (g, a, ctx) => tar.tProposeArchitectureException(g, a, ctx)},
         {cap: 'retarget', name: 'open_repo', description: 'OFFLINE RETARGET: switch this server to another local Git repository, building its graph when missing. This explicit tool call changes the active repository boundary; pass build:false to probe without building. Omitted mode/precision preserve an existing graph; a new graph uses full and the startup precision setting (lsp unless WEAVATRIX_PRECISION=off). Omit the retarget capability at registration to pin one repository.', inputSchema: {type: 'object', properties: {path: {type: 'string', description: 'Absolute path to a Git working tree'}, build: {type: 'boolean', description: 'Build the graph when missing (default true)', default: true}, mode: {type: 'string', enum: ['full', 'no-tests', 'tests-only'], description: 'Optional build mode override; omit to preserve an existing graph'}, precision: {type: 'string', enum: ['lsp', 'off'], description: 'Optional semantic precision override; omit to preserve an existing graph or use the startup setting for a new graph'}} , required: ['path']}, run: (g, a, ctx) => ta.tOpenRepo(g, a, ctx)},
         {cap: 'retarget', name: 'list_known_repos', description: 'OFFLINE RETARGET: list every registered local repository graph from the global per-user registry, regardless of parent folder.', inputSchema: {type: 'object', properties: {}}, run: (g, a, ctx) => ta.tListKnownRepos(g, a, ctx)},
-        {cap: 'advisories', name: 'refresh_advisories', description: "NETWORK / explicit advisories profile: refresh the local OSV advisory store for this repo's lockfile-pinned packages (npm/PyPI/Go). Sends package names + versions to OSV.dev — never automatic, never source code. Afterwards run_audit reads the refreshed store fully offline (~/.weavatrix/advisories.json).", inputSchema: {type: 'object', properties: {timeout_ms: {type: 'integer', description: 'Per-request timeout, default 20000'}}}, run: (g, a, ctx) => ta.tRefreshAdvisories(g, a, ctx)},
+        {cap: 'advisories', name: 'refresh_advisories', description: "NETWORK / explicit advisories profile: refresh the local OSV advisory store for this repo's concrete npm/PyPI/Go/Maven/Gradle/Cargo package versions. Sends package names + versions to OSV.dev — never automatic, never source code. Afterwards run_audit reads the refreshed store fully offline (~/.weavatrix/advisories.json).", inputSchema: {type: 'object', properties: {timeout_ms: {type: 'integer', description: 'Per-request timeout, default 20000'}}}, run: (g, a, ctx) => ta.tRefreshAdvisories(g, a, ctx)},
         {cap: 'hosted', name: 'pull_architecture_contract', description: 'NETWORK / explicit hosted profile: fetch the owner-approved target architecture for the active stable repository UUID, validate it and cache it locally. Sends only the opaque UUID with bearer auth; never source or paths. HTTP failures are returned as actionable AUTH_REQUIRED/FORBIDDEN/NOT_FOUND/REPOSITORY_NOT_READY states.', inputSchema: {type: 'object', properties: {timeout_ms: {type: 'integer', minimum: 1000, maximum: 120000, default: 30000}}}, run: (g, a, ctx) => ta.tPullArchitectureContract(g, a, ctx)},
         {cap: 'hosted', name: 'preview_sync', description: 'LOCAL SAFETY PREVIEW / no network: serialize the exact bounded hosted payload, validate the HTTPS destination, and show hostname/path, repository UUID, fields, sections, node/edge counts, bytes and body hash. Returns a five-minute confirmation token for sync_graph. Source bodies, snippets, absolute paths, environment values, credentials, Git remotes and unknown fields are excluded.', inputSchema: {type: 'object', properties: {payload_version: {type: 'integer', enum: [2, 3], default: 3, description: '3 includes bounded architecture/health/stack/package evidence; 2 is explicit graph-only compatibility'}}}, run: (g, a, ctx) => ta.tPreviewSyncGraph(g, a, ctx)},
         {cap: 'hosted', name: 'sync_graph', description: 'NETWORK / explicit hosted profile. Uploads only the exact payload created by preview_sync and requires dry_run:false plus its short-lived confirm_token after user approval. Calling without dry_run:false remains a no-network preview compatibility alias. Source bodies, snippets, absolute paths and unknown fields are never uploaded.', inputSchema: {type: 'object', properties: {payload_version: {type: 'integer', enum: [2, 3], default: 3, description: 'Used only when producing a compatibility preview; the approved token pins the exact serialized payload'}, dry_run: {type: 'boolean', default: true, description: 'Compatibility safety switch. Must be explicitly false to send.'}, confirm_token: {type: 'string', maxLength: 64, description: 'Short-lived token returned by preview_sync for the exact destination and payload'}, timeout_ms: {type: 'integer', minimum: 1000, maximum: 120000, default: 30000, description: 'Network timeout in milliseconds'}}}, run: (g, a, ctx) => ta.tSyncGraph(g, a, ctx)},

package/src/mcp/company-contract-verdict.mjs

@@ -0,0 +1,42 @@
+export function contractVerdict(analysis, transportAnalysis) {
+    const endpointsWithCallers = analysis.endpoints.filter((endpoint) => endpoint.callsites.length > 0)
+    const transportWithCallers = (transportAnalysis.contracts || []).filter((contract) => contract.callsites.length > 0)
+    const affectedFiles = new Set(), affectedScreens = new Set()
+    for (const contract of [...endpointsWithCallers, ...transportWithCallers]) {
+        for (const item of contract.affected.files || []) affectedFiles.add(`${item.client}\0${item.file}`)
+        for (const item of contract.affected.screens || []) affectedScreens.add(`${item.client}\0${item.file}`)
+    }
+    const totalContracts = analysis.totals.endpoints + transportAnalysis.totals.contracts
+    const totalMatches = analysis.totals.matches + transportAnalysis.totals.matches
+    let code = 'NO_ENDPOINTS_MATCHED', risk = 'unknown'
+    if (totalContracts > 0 && totalMatches === 0) {
+        code = analysis.totals.methodMismatches > 0 ? 'HTTP_METHOD_MISMATCH' : 'NO_STATIC_CLIENT_CALLERS'
+        risk = analysis.totals.methodMismatches > 0 ? 'high' : 'unknown'
+    } else if (totalMatches > 0 && analysis.totals.methodMismatches > 0) {
+        code = 'CLIENTS_AT_RISK_WITH_METHOD_MISMATCHES'; risk = 'high'
+    } else if (totalMatches > 0) {
+        code = 'CLIENTS_AT_RISK'; risk = 'medium'
+    }
+    return {
+        code, risk,
+        endpointsWithCallers: endpointsWithCallers.length + transportWithCallers.length,
+        callsites: totalMatches,
+        affectedFiles: affectedFiles.size,
+        affectedScreens: affectedScreens.size,
+        methodMismatches: analysis.totals.methodMismatches,
+        uncertainCalls: analysis.totals.uncertainCalls + transportAnalysis.totals.uncertain,
+        transportContracts: transportAnalysis.totals.contracts,
+        transportMatches: transportAnalysis.totals.matches,
+        notDeadExternalUse: analysis.totals.notDeadExternalUse,
+        notDeadExternalHandlers: analysis.totals.notDeadExternalHandlers,
+        possibleExternalUse: analysis.totals.possibleExternalUse,
+        unknownLiveness: analysis.totals.unknownLiveness,
+    }
+}
+
+export function contractVerdictLine(verdict, contracts) {
+    if (verdict.code === 'NO_ENDPOINTS_MATCHED') return 'VERDICT NO_ENDPOINTS_MATCHED — no backend contract satisfied the requested transport/method/path/change filter.'
+    if (verdict.code === 'NO_STATIC_CLIENT_CALLERS') return `VERDICT NO_STATIC_CLIENT_CALLERS — ${contracts} backend contract(s) matched, but no bounded static client call was proven; this is unknown, not proof of no consumers.`
+    if (verdict.code === 'HTTP_METHOD_MISMATCH') return `VERDICT HTTP_METHOD_MISMATCH — ${verdict.methodMismatches} client call(s) match the route shape with a different method.`
+    return `VERDICT ${verdict.code} — ${verdict.callsites} callsite(s) reach ${verdict.endpointsWithCallers} contract(s); ${verdict.affectedScreens} screen(s) and ${verdict.affectedFiles} file(s) are in the bounded blast radius.`
+}

package/src/mcp/evidence/duplicate-member-order.mjs

@@ -0,0 +1,8 @@
+const compareText = (left, right) => String(left).localeCompare(String(right), 'en')
+
+// Snapshot construction and hosted-payload validation must use the same stable
+// member order or equivalent evidence can hash differently across the boundary.
+export function compareDuplicateMember(left, right) {
+    return compareText(left.file, right.file) || left.startLine - right.startLine ||
+        left.endLine - right.endLine || compareText(left.graphNodeId || '', right.graphNodeId || '')
+}

package/src/mcp/evidence-snapshot.duplicates.mjs

@@ -3,6 +3,7 @@ import {computeDuplicates} from '../analysis/duplicates.js'
 import {
     CAPS, STATE, VERDICT, bounded, compareText, graphId, repoRelativePath,
 } from './evidence-snapshot.common.mjs'
+import {compareDuplicateMember} from './evidence/duplicate-member-order.mjs'
 
 const CLONE_MIN_SIMILARITY = 80
 const DIVERGENCE_MAX_SIMILARITY = 45
@@ -51,11 +52,6 @@ function memberIdentity(value) {
     return `${value.file}\0${value.startLine}\0${value.endLine}\0${value.graphNodeId || ''}`
 }
 
-function compareMember(a, b) {
-    return compareText(a.file, b.file) || a.startLine - b.startLine || a.endLine - b.endLine ||
-        compareText(a.graphNodeId || '', b.graphNodeId || '')
-}
-
 function eligibleMembers(fragments) {
     const out = new Map()
     for (let index = 0; index < fragments.length; index++) {
@@ -107,7 +103,7 @@ function cloneGroups(data, membersByIndex) {
             const value = membersByIndex.get(index)
             unique.set(memberIdentity(value), value)
         }
-        const members = [...unique.values()].sort(compareMember)
+        const members = [...unique.values()].sort(compareDuplicateMember)
         if (members.length < 2) continue
         const indexSet = new Set(indices)
         const similarities = links
@@ -141,7 +137,7 @@ function divergenceCandidates(data, membersByIndex) {
             if (!Number.isInteger(left) || !Number.isInteger(right) || left === right || !leftMember || !rightMember ||
                 leftMember.file === rightMember.file || !Number.isFinite(similarity) ||
                 similarity < 0 || similarity > DIVERGENCE_MAX_SIMILARITY) continue
-            const members = [leftMember, rightMember].sort(compareMember)
+            const members = [leftMember, rightMember].sort(compareDuplicateMember)
             pairs.push({
                 similarity: Math.trunc(similarity),
                 totalTokens: members[0].tokens + members[1].tokens,

package/src/mcp/git-output.mjs

@@ -0,0 +1,10 @@
+import {spawnSync} from 'node:child_process'
+import {childProcessEnv} from '../child-env.js'
+
+export function gitLines(repoRoot, args) {
+    const result = spawnSync('git', ['-C', repoRoot, ...args], {
+        encoding: 'utf8', timeout: 8000, env: childProcessEnv(), windowsHide: true,
+    })
+    if (result.status !== 0) return null
+    return String(result.stdout || '').split(/\r?\n/).map((line) => line.trim()).filter(Boolean)
+}

package/src/mcp/graph/context-seeds.mjs

@@ -1,4 +1,4 @@
-import {createPathClassifier, hasPathClass} from '../../path-classification.js'
+import {PATH_CLASS_NAMES, PATH_CLASS_QUERY_TERMS, createPathClassifier, hasPathClass} from '../../path-classification.js'
 import {degreeOf, isSymbol, uniqueConnCount} from './context-core.mjs'
 
 const QUERY_STOP = new Set('a an and are around architecture best code do does exact explain find focus focused for from how identify in inspect inspection is logic me of or path production project repository request requests rest show symbol symbols the through to trace what where which with'.split(' '))
@@ -17,17 +17,6 @@ const TOOL_EXECUTION_TERMS = QUERY_INTENTS.find(([id]) => id === 'tool-execution
 const TOOL_EXECUTION_TRIGGERS = new Set(['tool', 'tools', 'tooling', 'mcp'])
 const wordsOf = (value) => String(value ?? '').replace(/([a-z0-9])([A-Z])/g, '$1 $2').toLowerCase().split(/[^a-z0-9_]+/).filter(Boolean)
 const normPath = (value) => String(value ?? '').replace(/\\/g, '/').replace(/^\.\//, '').toLowerCase()
-const NON_PRODUCT_CLASSES = Object.freeze(['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
-const CLASS_QUERY_TERMS = Object.freeze({
-    test: ['test', 'tests', 'testing', 'unit'],
-    e2e: ['e2e', 'playwright', 'cypress'],
-    generated: ['generated', 'autogenerated', 'dist'],
-    mock: ['mock', 'mocks', 'fixture', 'fixtures', 'fake'],
-    story: ['story', 'stories', 'storybook'],
-    docs: ['doc', 'docs', 'documentation', 'readme', 'guide'],
-    benchmark: ['benchmark', 'benchmarks', 'bench'],
-    temp: ['temp', 'temporary', 'tmp'],
-})
 const CODE_FILE_RE = /\.(?:[cm]?[jt]sx?|py|go|java|rs|kt|kts|cs|rb|php)$/i
 const DATA_OR_PROSE_RE = /\.(?:json|ya?ml|toml|ini|md|mdx|rst|adoc|html?|css|scss|less|svg)$/i
 const LANGUAGE_EXTENSIONS = Object.freeze({
@@ -56,7 +45,7 @@ const matchesLanguage = (node, extensions) => {
 
 export function requestedPathClasses(query) {
     const words = new Set(wordsOf(query)), requested = new Set()
-    for (const [category, terms] of Object.entries(CLASS_QUERY_TERMS)) if (terms.some((term) => words.has(term))) requested.add(category)
+    for (const [category, terms] of Object.entries(PATH_CLASS_QUERY_TERMS)) if (terms.some((term) => words.has(term))) requested.add(category)
     if (requested.has('test')) requested.add('e2e')
     if (requested.has('e2e')) requested.add('test')
     return requested
@@ -67,7 +56,7 @@ function isQueryEligible(node, requestedClasses, classificationCache, classifier
     if (!source) return true
     if (!classificationCache.has(source)) classificationCache.set(source, classifier.explain(source, {content: ''}))
     const info = classificationCache.get(source)
-    const classified = NON_PRODUCT_CLASSES.filter((category) => hasPathClass(info, category))
+    const classified = PATH_CLASS_NAMES.filter((category) => hasPathClass(info, category))
     return classified.length === 0 || classified.some((category) => requestedClasses.has(category))
 }
 

package/src/mcp/graph/reverse-reach.mjs

@@ -0,0 +1,42 @@
+import {isStructuralRelation} from '../../graph/relations.js'
+
+// Shared reverse dependency walk for get_dependents and change_impact. Keep one
+// representation so runtime/compile-time depth and edge provenance cannot drift
+// between the two public tools.
+export function reverseReach(g, seeds, maxDepth) {
+    const states = new Map([...seeds].map((id) => [String(id), {
+        runtimeDepth: 0, runtimeRelation: null, runtimeProvenance: null,
+        compileDepth: null, compileRelation: null, compileProvenance: null,
+    }]))
+    const frontier = [...seeds].map((id) => ({id: String(id), depth: 0, compileOnly: false}))
+    for (let cursor = 0; cursor < frontier.length; cursor++) {
+        const current = frontier[cursor]
+        if (current.depth >= maxDepth) continue
+        for (const edge of g.inn.get(current.id) || []) {
+            if (isStructuralRelation(edge.relation) || edge.barrelProxy === true) continue
+            const id = String(edge.id)
+            const compileOnly = current.compileOnly || edge.typeOnly === true || edge.compileOnly === true
+            const depth = current.depth + 1
+            const entry = states.get(id) || {
+                runtimeDepth: null, runtimeRelation: null, runtimeProvenance: null,
+                compileDepth: null, compileRelation: null, compileProvenance: null,
+            }
+            const depthKey = compileOnly ? 'compileDepth' : 'runtimeDepth'
+            const relationKey = compileOnly ? 'compileRelation' : 'runtimeRelation'
+            const provenanceKey = compileOnly ? 'compileProvenance' : 'runtimeProvenance'
+            if (entry[depthKey] != null && entry[depthKey] <= depth) continue
+            entry[depthKey] = depth
+            entry[relationKey] = edge.relation || 'rel'
+            entry[provenanceKey] = edge.provenance || 'UNKNOWN'
+            states.set(id, entry)
+            frontier.push({id, depth, compileOnly})
+        }
+    }
+    return new Map([...states].map(([id, entry]) => [id, {
+        ...entry,
+        depth: entry.runtimeDepth ?? entry.compileDepth ?? 0,
+        compileOnly: entry.runtimeDepth == null,
+        relation: entry.runtimeDepth != null ? entry.runtimeRelation : entry.compileRelation,
+        provenance: entry.runtimeDepth != null ? entry.runtimeProvenance : entry.compileProvenance,
+    }]))
+}

package/src/mcp/sync/evidence-duplicates.mjs

@@ -2,6 +2,7 @@ import {
     CAPS, DUPLICATE_THRESHOLDS, bool, compare, count, graphId, int, list,
     path, reasons, state, text, verdict,
 } from './evidence-common.mjs'
+import {compareDuplicateMember} from '../evidence/duplicate-member-order.mjs'
 
 function duplicateEvidenceId(value) {
     const id = text(value, 64)
@@ -19,10 +20,6 @@ function duplicateMember(value) {
     return out
 }
 
-function compareDuplicateMember(a, b) {
-    return compare(a.file, b.file) || a.startLine - b.startLine || a.endLine - b.endLine || compare(a.graphNodeId || '', b.graphNodeId || '')
-}
-
 function duplicateMembers(values, cap = CAPS.duplicateMembers) {
     const raw = Array.isArray(values) ? values : []
     const unique = new Map()

package/src/mcp/tools-company.mjs

@@ -3,13 +3,15 @@
 // can never pass an arbitrary filesystem path through this tool.
 import {join} from 'node:path'
 import {analyzeHttpContracts} from '../analysis/http-contracts.js'
+import {analyzeTransportContracts} from '../analysis/transport-contracts.js'
 import {buildGraphForRepo} from '../build-graph.js'
 import {graphHomeDir} from '../graph/layout.js'
 import {liveRepositoryRecords} from '../graph/repo-registry.js'
 import {loadGraph} from './graph-context.mjs'
 import {toolResult} from './tool-result.mjs'
+import {contractVerdict, contractVerdictLine} from './company-contract-verdict.mjs'
 
-const CROSS_REPO_HTTP_CONTRACT_V = 2
+const CROSS_REPO_HTTP_CONTRACT_V = 3
 const selectorText = (value) => String(value ?? '').trim()
 
 function selectRecord(records, selector) {
@@ -103,52 +105,6 @@ async function reconcileGraph(record, alias, role, graphHome) {
     }
 }
 
-function verdictFor(analysis) {
-    const endpointsWithCallers = analysis.endpoints.filter((endpoint) => endpoint.callsites.length > 0)
-    const affectedFiles = new Set()
-    const affectedScreens = new Set()
-    for (const endpoint of endpointsWithCallers) {
-        for (const item of endpoint.affected.files || []) affectedFiles.add(`${item.client}\0${item.file}`)
-        for (const item of endpoint.affected.screens || []) affectedScreens.add(`${item.client}\0${item.file}`)
-    }
-    let code = 'NO_ENDPOINTS_MATCHED', risk = 'unknown'
-    if (analysis.totals.endpoints > 0 && analysis.totals.matches === 0) {
-        code = analysis.totals.methodMismatches > 0 ? 'HTTP_METHOD_MISMATCH' : 'NO_STATIC_CLIENT_CALLERS'
-        risk = analysis.totals.methodMismatches > 0 ? 'high' : 'unknown'
-    } else if (analysis.totals.matches > 0 && analysis.totals.methodMismatches > 0) {
-        code = 'CLIENTS_AT_RISK_WITH_METHOD_MISMATCHES'; risk = 'high'
-    } else if (analysis.totals.matches > 0) {
-        code = 'CLIENTS_AT_RISK'; risk = 'medium'
-    }
-    return {
-        code,
-        risk,
-        endpointsWithCallers: endpointsWithCallers.length,
-        callsites: analysis.totals.matches,
-        affectedFiles: affectedFiles.size,
-        affectedScreens: affectedScreens.size,
-        methodMismatches: analysis.totals.methodMismatches,
-        uncertainCalls: analysis.totals.uncertainCalls,
-        notDeadExternalUse: analysis.totals.notDeadExternalUse,
-        notDeadExternalHandlers: analysis.totals.notDeadExternalHandlers,
-        possibleExternalUse: analysis.totals.possibleExternalUse,
-        unknownLiveness: analysis.totals.unknownLiveness,
-    }
-}
-
-function verdictLine(verdict, endpoints) {
-    if (verdict.code === 'NO_ENDPOINTS_MATCHED') {
-        return 'VERDICT NO_ENDPOINTS_MATCHED — no backend endpoint satisfied the requested method/path/change filter.'
-    }
-    if (verdict.code === 'NO_STATIC_CLIENT_CALLERS') {
-        return `VERDICT NO_STATIC_CLIENT_CALLERS — ${endpoints} backend endpoint(s) matched, but no bounded literal/template client call was proven; this is unknown, not proof of no consumers.`
-    }
-    if (verdict.code === 'HTTP_METHOD_MISMATCH') {
-        return `VERDICT HTTP_METHOD_MISMATCH — ${verdict.methodMismatches} client call(s) match the route shape with a different method.`
-    }
-    return `VERDICT ${verdict.code} — ${verdict.callsites} callsite(s) reach ${verdict.endpointsWithCallers} endpoint(s); ${verdict.affectedScreens} screen(s) and ${verdict.affectedFiles} file(s) are in the bounded blast radius.`
-}
-
 export async function tTraceApiContract(_g, args = {}, ctx = {}) {
     const graphHome = ctx.graphHome || graphHomeDir()
     const records = liveRepositoryRecords(graphHome)
@@ -215,7 +171,7 @@ export async function tTraceApiContract(_g, args = {}, ctx = {}) {
     }
 
     try {
-        const analysis = analyzeHttpContracts({
+        let analysis = analyzeHttpContracts({
             backend: {id: backendAlias, repoRoot: backend.repoPath, graph: backendGraph.graph},
             clients: clientGraphs.map((item) => ({id: item.alias, repoRoot: item.record.repoPath, graph: item.graph})),
             method: args.method,
@@ -229,9 +185,25 @@ export async function tTraceApiContract(_g, args = {}, ctx = {}) {
             maxEndpoints: args.max_endpoints,
             maxMatches: args.max_matches,
             maxAffectedFiles: args.max_affected_files,
+            runtimeValues: args.runtime_config,
         })
-        const verdict = verdictFor(analysis)
-        const reasons = [...new Set([...reconciliationReasons, ...(analysis.completeness?.reasons || [])])]
+        const selectedTransport = ['all', 'http', 'graphql', 'grpc', 'event'].includes(args.transport) ? args.transport : 'all'
+        if (!['all', 'http'].includes(selectedTransport)) analysis = {
+            ...analysis, status: 'complete', completeness: {complete: true, reasons: []}, endpoints: [], uncertain: [],
+            totals: {...analysis.totals, endpoints: 0, clientCalls: 0, matches: 0, methodMismatches: 0, uncertainCalls: 0, notDeadExternalUse: 0, notDeadExternalHandlers: 0, possibleExternalUse: 0, unknownLiveness: 0},
+        }
+        const transportAnalysis = selectedTransport === 'http'
+            ? {transportContractsV: 1, transport: 'http', status: 'COMPLETE', completeness: {complete: true, reasons: []}, totals: {contracts: 0, matches: 0, uncertain: 0, filesScanned: 0}, contracts: [], uncertain: []}
+            : analyzeTransportContracts({
+                backend: {id: backendAlias, repoRoot: backend.repoPath, graph: backendGraph.graph},
+                clients: clientGraphs.map((item) => ({id: item.alias, repoRoot: item.record.repoPath, graph: item.graph})),
+                transport: selectedTransport === 'all' ? 'all' : selectedTransport,
+                includeTests: args.include_tests === true,
+                maxImpactDepth: args.max_impact_depth,
+                maxAffectedFiles: args.max_affected_files,
+            })
+        const verdict = contractVerdict(analysis, transportAnalysis)
+        const reasons = [...new Set([...reconciliationReasons, ...(analysis.completeness?.reasons || []), ...(transportAnalysis.completeness?.reasons || [])])]
         const completeness = {
             complete: reasons.length === 0 && analysis.completeness?.complete === true,
             status: reasons.length === 0 && analysis.completeness?.complete === true ? 'COMPLETE' : 'PARTIAL',
@@ -243,8 +215,8 @@ export async function tTraceApiContract(_g, args = {}, ctx = {}) {
             right.affected.files.length - left.affected.files.length ||
             left.path.localeCompare(right.path))
         const lines = [
-            verdictLine(verdict, analysis.totals.endpoints),
-            `Scope: ${backend.label} → ${clients.map(({record}) => record.label).join(', ')}; ${analysis.totals.endpoints} endpoint(s), ${analysis.totals.clientCalls} inspected client call(s), ${analysis.totals.uncertainCalls} uncertain.`,
+            contractVerdictLine(verdict, analysis.totals.endpoints + transportAnalysis.totals.contracts),
+            `Scope: ${backend.label} → ${clients.map(({record}) => record.label).join(', ')}; ${analysis.totals.endpoints} HTTP endpoint(s), ${transportAnalysis.totals.contracts} GraphQL/gRPC/event contract(s), ${analysis.totals.clientCalls} inspected HTTP call(s), ${verdict.uncertainCalls} uncertain.`,
             ...ranked.slice(0, topN).flatMap((endpoint) => {
                 const location = endpoint.file ? ` (${endpoint.backend}:${endpoint.file}${endpoint.line ? `:${endpoint.line}` : ''})` : ''
                 const callsites = endpoint.callsites.slice(0, 3)
@@ -257,8 +229,10 @@ export async function tTraceApiContract(_g, args = {}, ctx = {}) {
                     ...screens,
                 ]
             }),
+            ...transportAnalysis.contracts.filter((contract) => contract.callsites.length).slice(0, topN).map((contract) =>
+                `  ${contract.transport.toUpperCase()} ${contract.service ? `${contract.service}.` : contract.operation ? `${contract.operation} ` : ''}${contract.name} (${contract.file}:${contract.line}) [${contract.liveness}] → ${contract.callsites.length} callsite(s), ${contract.affected.files.length} affected file(s)`),
             completeness.complete
-                ? 'Completeness: complete within the declared repository graphs and static HTTP-call model.'
+                ? 'Completeness: complete within the declared repository graphs and supported static HTTP/GraphQL/gRPC/event models.'
                 : `Completeness: partial — ${completeness.reasons.join('; ')}.`,
         ]
         const result = {
@@ -269,6 +243,7 @@ export async function tTraceApiContract(_g, args = {}, ctx = {}) {
                 clients: clients.map(({record, alias}) => publicRecord(record, alias)),
             },
             ...analysis,
+            transportContracts: transportAnalysis,
             status: completeness.status,
             graphReconciliation,
             completeness,

package/src/mcp/tools-impact-change.mjs

@@ -5,16 +5,11 @@ import {childProcessEnv} from '../child-env.js'
 import {classifyChangeImpact} from '../analysis/change-classification.js'
 import {readCoverageForRepo} from '../analysis/coverage-reports.js'
 import {computeStaticTestReachability} from '../analysis/static-test-reachability.js'
-import {isStructuralRelation} from '../graph/relations.js'
 import {degreeOf, labelOf, rawGraph} from './graph-context.mjs'
+import {reverseReach} from './graph/reverse-reach.mjs'
+import {gitLines} from './git-output.mjs'
 import {toolResult} from './tool-result.mjs'
 
-function gitLines(repoRoot, args) {
-    const result = spawnSync('git', ['-C', repoRoot, ...args], {encoding: 'utf8', timeout: 8000, env: childProcessEnv()})
-    if (result.status !== 0) return null
-    return String(result.stdout || '').split(/\r?\n/).map((line) => line.trim()).filter(Boolean)
-}
-
 function gitValue(repoRoot, args) {
     const result = spawnSync('git', ['-C', repoRoot, ...args], {encoding: 'utf8', timeout: 8000, env: childProcessEnv()})
     if (result.status !== 0) return null
@@ -30,37 +25,6 @@ function resolveImpactBase(repoRoot, requested) {
     return null
 }
 
-function reverseReach(g, seeds, maxDepth) {
-    const states = new Map([...seeds].map((id) => [String(id), {
-        runtimeDepth: 0, runtimeRelation: null, compileDepth: null, compileRelation: null,
-    }]))
-    const frontier = [...seeds].map((id) => ({id: String(id), depth: 0, compileOnly: false}))
-    for (let cursor = 0; cursor < frontier.length; cursor++) {
-        const current = frontier[cursor]
-        if (current.depth >= maxDepth) continue
-        for (const edge of g.inn.get(current.id) || []) {
-            if (isStructuralRelation(edge.relation) || edge.barrelProxy === true) continue
-            const id = String(edge.id)
-            const compileOnly = current.compileOnly || edge.typeOnly === true || edge.compileOnly === true
-            const depth = current.depth + 1
-            const entry = states.get(id) || {runtimeDepth: null, runtimeRelation: null, compileDepth: null, compileRelation: null}
-            const depthKey = compileOnly ? 'compileDepth' : 'runtimeDepth'
-            const relationKey = compileOnly ? 'compileRelation' : 'runtimeRelation'
-            if (entry[depthKey] != null && entry[depthKey] <= depth) continue
-            entry[depthKey] = depth
-            entry[relationKey] = edge.relation || 'rel'
-            states.set(id, entry)
-            frontier.push({id, depth, compileOnly})
-        }
-    }
-    return new Map([...states].map(([id, entry]) => [id, {
-        ...entry,
-        depth: entry.runtimeDepth ?? entry.compileDepth ?? 0,
-        compileOnly: entry.runtimeDepth == null,
-        relation: entry.runtimeDepth != null ? entry.runtimeRelation : entry.compileRelation,
-    }]))
-}
-
 const impactKind = (entry) => entry?.runtimeDepth != null
     ? (entry.compileDepth != null ? `runtime + compile-time(d${entry.compileDepth})` : 'runtime')
     : 'compile-time'

package/src/mcp/tools-impact-precision.mjs

@@ -0,0 +1,89 @@
+import {isStructuralRelation} from '../graph/relations.js'
+import {querySymbolsPrecision} from '../precision/symbol-query.js'
+
+export function graphWithExactDirectReferences(g, targetId, overlay) {
+    const exact = (overlay?.links || []).filter((link) => String(link?.target || '') === targetId
+        && link.provenance === 'EXACT_LSP')
+    const provenEmpty = overlay?.state === 'COMPLETE'
+        && (overlay?.noReferenceSymbols || []).some((id) => String(id) === targetId)
+    if (overlay?.state !== 'COMPLETE' || (!exact.length && !provenEmpty)) return null
+    const inn = new Map(g.inn)
+    const structural = (g.inn.get(targetId) || []).filter((edge) => isStructuralRelation(edge.relation))
+    inn.set(targetId, [...structural, ...exact.map((link) => ({
+        id: String(link.source),
+        relation: link.relation || 'references',
+        provenance: 'EXACT_LSP',
+        ...(link.typeOnly === true ? {typeOnly: true} : {}),
+        ...(link.compileOnly === true ? {compileOnly: true} : {}),
+    }))])
+    return {...g, inn}
+}
+
+export function refineChangeImpact(g, args, ctx, baseline, computeImpact) {
+    const requested = ['auto', 'graph', 'lsp'].includes(args?.precision) ? args.precision : 'auto'
+    if (requested === 'graph' || !baseline?.result?.seeds?.ids || !ctx?.repoRoot || !ctx?.graphPath
+        || (requested === 'auto' && g.graphPrecisionMode === 'off')) return baseline
+    const targets = baseline.result.seeds.ids.filter((id) => {
+        const node = g.byId.get(String(id))
+        return node?.selection_start && /\.(?:[cm]?[jt]sx?)$/i.test(String(node.source_file || ''))
+    }).slice(0, 16)
+    if (!targets.length) return baseline
+    return (async () => {
+        try {
+            const precision = await querySymbolsPrecision({
+                repoRoot: ctx.repoRoot,
+                graphPath: ctx.graphPath,
+                targetIds: targets,
+                maxReferences: Math.max(100, Math.min(16_384, Number(args.max_references) || 5_000)),
+                timeoutMs: Math.max(1_000, Math.min(60_000, Number(args.timeout_ms) || 45_000)),
+                clientFactory: ctx.precisionClientFactory,
+            })
+            let exactGraph = g
+            const verified = []
+            for (const target of targets) {
+                const next = graphWithExactDirectReferences(exactGraph, String(target), precision.overlay)
+                if (!next) continue
+                exactGraph = next
+                verified.push(String(target))
+            }
+            const value = verified.length ? computeImpact(exactGraph, args, ctx) : baseline
+            const allVerified = verified.length === targets.length
+            const status = allVerified ? 'DIRECT_EXACT_TRANSITIVE_GRAPH' : 'PARTIAL'
+            value.text = [
+                value.text.split('\n')[0],
+                `Semantic precision: ${status}; EXACT_LSP verified direct references for ${verified.length}/${targets.length} changed JavaScript/TypeScript symbol(s). Transitive hops remain graph-backed.`,
+                ...value.text.split('\n').slice(1),
+            ].join('\n')
+            value.result.semanticPrecision = {
+                status,
+                requestedTargets: targets,
+                verifiedTargets: verified,
+                exactDirectEdges: (precision.overlay?.links || []).filter((link) => verified.includes(String(link?.target || ''))).length,
+                transitiveEvidence: 'GRAPH',
+                provider: precision.overlay?.engines?.[0]?.provider || null,
+                elapsedMs: precision.elapsedMs,
+            }
+            if (!allVerified) value.warnings.push({
+                code: 'CHANGE_IMPACT_PRECISION_PARTIAL',
+                message: precision.overlay?.reason || 'Not every changed symbol had complete exact direct-reference evidence.',
+            })
+            return value
+        } catch (error) {
+            const reason = error?.message || 'batch point query failed'
+            baseline.result.semanticPrecision = {
+                status: 'UNAVAILABLE', requestedTargets: targets, verifiedTargets: [],
+                exactDirectEdges: 0, transitiveEvidence: 'GRAPH', reason,
+            }
+            baseline.warnings.push({
+                code: 'CHANGE_IMPACT_PRECISION_UNAVAILABLE',
+                message: `Exact changed-symbol references were unavailable; graph evidence was retained (${reason}).`,
+            })
+            baseline.text = [
+                baseline.text.split('\n')[0],
+                `Semantic precision: UNAVAILABLE; graph evidence retained (${reason}).`,
+                ...baseline.text.split('\n').slice(1),
+            ].join('\n')
+            return baseline
+        }
+    })()
+}