weavatrix 0.2.15 → 0.2.16

package/README.md

@@ -117,10 +117,20 @@ Every dead-code, orphan, dependency and duplicate item remains review evidence.
 conventions and source use before editing; Weavatrix does not auto-delete or merge findings.
 
 `run_audit` also returns an explicit capability matrix. `STRUCTURE CHECKED` and a supported package
-ecosystem do not imply `RUNTIME_CORRECTNESS` or `CONCURRENCY` is complete. Maven/Gradle manifests are
-reported `NOT_SUPPORTED`/`PARTIAL` for import-to-artifact verification rather than as a false clean
-`0 declared / 0 external`; bounded Go/Java correctness checks disclose that they are neither compiler
-proof nor a race detector.
+ecosystem do not imply `RUNTIME_CORRECTNESS` or `CONCURRENCY` is complete. npm, nested Python and Go
+modules, Maven properties, common Gradle declarations/version catalogs, and Cargo workspace/renamed
+packages are compared with indexed imports. JVM reflection/generated/runtime-only use, Cargo
+features/proc macros and unresolved build logic remain review evidence; bounded Go/Java checks are
+neither compiler proof nor a race detector.
+
+### Where this saves agent context — and where it does not
+
+The largest saving comes from graph operations that replace repeated discovery: one
+`change_impact`, `get_dependents`, `context_bundle`, contract trace or dependency audit can collapse
+many search/read hops into a bounded evidence set. `read_source` is mainly a convenient exact window
+and is not inherently cheaper than a client's native offset read. Database queries, runtime state,
+disk forensics and background workflow investigation remain outside a static repository graph.
+Typecheck, tests and runtime checks remain the release authority.
 
 ### Trace an event, queue, worker, cron or CLI flow
 
@@ -259,8 +269,9 @@ and builds a missing graph automatically. A normal
 probes without building and refuses a legacy graph. Retargeting is offline but intentionally changes
 the filesystem boundary for subsequent tools; select `pinned` when that boundary must not move.
 
-An agent skill with recipes ships in [skill/SKILL.md](skill/SKILL.md) — install as
-`~/.claude/skills/weavatrix/SKILL.md`.
+An agent skill with recipes ships in [skill/SKILL.md](skill/SKILL.md) — install it as
+`~/.claude/skills/weavatrix/SKILL.md` for Claude Code or
+`~/.codex/skills/weavatrix/SKILL.md` for Codex.
 
 ## Tools
 
@@ -281,6 +292,13 @@ disabled and only static evidence is active. Java and Rust language-server provi
 their edges never become `EXACT_LSP`, even when a mixed repository reports a complete
 TypeScript/JavaScript overlay.
 
+Configured TypeScript plugins (including Next.js) are recorded but suppressed; repository-local
+plugin code is never loaded. The broad overlay is deliberately budgeted, so `PARTIAL` can mean the
+candidate cap was reached. `get_dependents` then spends a bounded point query on the requested JS/TS
+symbol and replaces direct heuristic references only when exact absence/presence is proven.
+`change_impact` batches the same exact query for changed symbols. Further transitive hops remain
+graph-backed and are labelled as such.
+
 The bounded JS/TS provider is enabled by default for new graphs. Set `WEAVATRIX_PRECISION=off`
 before starting the MCP server for parser-only operation from the first build, or pass
 `precision:"off"` to `rebuild_graph` / `open_repo`. The MCPB installer exposes the same `lsp` / `off`
@@ -302,8 +320,8 @@ functions, methods, and symbols, with evidence tiers, completed/remaining verifi
 public/framework/dynamic caveats),
 `run_audit` (an explicit capability matrix plus unused files/exports/dependencies with per-finding manifest/indexed-source/script/config verification;
 `category:dependencies` isolates missing/unused/duplicate declarations, unresolved imports and lockfile drift,
-missing npm/Go/Python deps, honest Maven/Gradle `NOT_SUPPORTED`/`PARTIAL` import verification, bounded
-Go/Java correctness candidates, runtime
+missing npm/Go/Python/Maven/Gradle/Cargo deps, bounded import-to-artifact/crate verification, concrete
+npm/PyPI/Go/Maven/crates.io advisory pins, Go/Java correctness candidates, runtime
 cycles, type-only/compile-only coupling, orphans, boundary rules, offline OSV vulnerabilities + typosquat +
 lockfile drift; accepts an immutable `base_ref`, `changed_files`, and `debt: new|existing|all` for
 review-scoped results; production paths are the default and `include_classified:true` opts into
@@ -392,6 +410,21 @@ metrics are not persisted or transmitted by Weavatrix. If a source checkout's pa
 while an old daemon remains alive, `initialize`, `tools/list`, and tool calls fail loudly with
 `STALE_RUNTIME` until the client reconnects; the opt-out is reserved for deliberate development.
 
+### 0.2.16 exact dependents, multi-ecosystem dependencies and transport contracts
+
+- Safe TypeScript project plugins no longer disable semantic precision. Plugin loading remains
+  suppressed, while `get_dependents` and `change_impact` can obtain exact direct JS/TS references on
+  demand and identify graph-backed transitive hops separately.
+- Dependency evidence covers nested npm/Python/Go scopes, Maven properties, Gradle catalogs/locks,
+  and Cargo workspace inheritance/renames/locks. Explicit OSV refresh accepts npm, PyPI, Go, Maven
+  and crates.io pins.
+- Cross-repository tracing adds static GraphQL, gRPC and event-topic joins alongside HTTP and keeps
+  runtime configuration, reflection and other dynamic targets explicitly `UNKNOWN`.
+- npm/MCPB metadata now calls out Codex/OpenAI Codex workflows, and Hosted distinguishes aggregate
+  folder-boundary feedback from proven file-level runtime cycles.
+
+Full patch notes: [docs/releases/v0.2.16.md](docs/releases/v0.2.16.md).
+
 ### 0.2.15 self-audit precision patch
 
 - Dependency review now scopes nested manifests correctly, recognizes framework peer packages and
@@ -658,13 +691,19 @@ Java graphs:
   agent review queue. Public/exported methods, framework entries, decorators, dynamic loading and
   reflection lower confidence; the result always says `REVIEW_REQUIRED` and `autoDelete:false`.
 
-### HTTP clients and wrappers
+### Cross-repository transports
 
 `trace_api_contract` recognizes built-in object clients such as `axios.get(...)`, explicit bare or
 object/member wrappers, and simple auto-discovered functions that forward a URL parameter directly
 to a known HTTP client. Auto-discovered wrappers are restricted to their bounded reverse-import
 scope; ambiguous same-name definitions are skipped and reported as incomplete evidence.
 
+The same tool can select GraphQL, gRPC or event evidence. It joins static GraphQL schema fields and
+operations, proto service methods and typed stub calls, and static Kafka/event-bus topic producers
+and consumers across registered repositories. Computed URLs, runtime configuration, dynamic
+GraphQL documents/topics, reflection and dynamic stubs remain `UNKNOWN`; they are not converted into
+an absence claim.
+
 Persistent per-client-repository configuration lives in `.weavatrix.json`:
 
 ```json
@@ -826,16 +865,17 @@ loader) behind the thin stdio entry `src/mcp-server.mjs`.
   cross-repository wrapper/liveness fixture, framework/convention fixture, full MCP lifecycle gate
   and a portable real-repository runner. Six source-free 0.2.1 real-repository baselines are
   recorded; edge provenance is gated end-to-end and the strict six-repository release command passes.
-- **Wrapper-aware API contracts** shipped in 0.2.2: persistent/ad-hoc configuration,
-  conservative discovery, cross-repository handler liveness and explicit unknown states. The next
-  hosted increment joins privacy-safe contract identities across separately synced services.
+- **Cross-transport contracts** cover bounded HTTP wrappers plus static GraphQL, gRPC and event-bus
+  identities across registered local repositories, with explicit runtime/dynamic unknown states.
 - **Hosted architecture workbench** at
   [app.weavatrix.com](https://app.weavatrix.com) is an access-controlled preview for
   owner-authenticated source-free evidence and revision history. Its UI and backend evolve
   independently from the public MCP release; local use remains fully optional.
 - **Semantic precision bridge** shipped for TypeScript/JavaScript in 0.2.4: a bounded, revision-bound
   local overlay validates references with the bundled language server while the parser graph remains
-  the fallback. Java and Rust providers are not bundled yet and stay explicitly `UNAVAILABLE`.
+  the fallback. 0.2.16 adds safe configured-plugin suppression plus exact on-demand point and changed-
+  symbol batch queries. Java and Rust language-server providers are not bundled and stay explicitly
+  unavailable as semantic providers; their parser/dependency evidence is still active.
 - **Git-native architecture history** — bounded tag/ref timelines and branch
   reports built outside the worktree; graph artifacts stay out of Git.
 - **Cross-repository company evidence** — endpoints, events and internal

package/docs/releases/v0.2.16.md

@@ -0,0 +1,53 @@
+# Weavatrix 0.2.16
+
+0.2.16 is a semantic-precision, dependency-coverage, and cross-transport contract release. It keeps
+the 38-tool MCP surface and local-first defaults while fixing the critical case where a safe
+TypeScript project plugin could disable every exact reference edge.
+
+## Exact dependents for real TypeScript projects
+
+- TypeScript project plugins such as Next.js are recorded and suppressed instead of making the
+  semantic overlay unavailable. Repository-local plugin code is never loaded.
+- `get_dependents` performs a bounded exact point query for JS/TS symbols by default. A complete LSP
+  result replaces heuristic direct references; an incomplete result retains graph evidence and says
+  why.
+- `change_impact` batches exact direct-reference queries for changed JS/TS symbols. Transitive hops
+  remain explicitly graph-backed instead of being presented as LSP proof.
+- Real-repository validation moved an affected Next.js repository from `UNAVAILABLE / 0 EXACT_LSP`
+  to a bounded partial overlay with 154 exact edges; a point query outside the initial budget found
+  16 exact direct references and then served the same result from cache.
+
+## Multi-ecosystem dependency and advisory evidence
+
+- Python checks nested requirements, pyproject/Poetry/Pipfile scopes; Go resolves nested modules,
+  direct/indirect requirements and replacements; both compare declarations with indexed imports.
+- Maven resolves properties and dependency declarations; Gradle resolves common Groovy/Kotlin
+  declarations, version catalogs and lock evidence. Import-to-artifact mapping uses bounded group
+  prefixes and artifact tokens and keeps reflection/generated/runtime-only cases review-only.
+- Cargo resolves workspace inheritance, renamed packages and lockfile pins, compares crate paths to
+  the nearest manifest, and reports feature/proc-macro uncertainty rather than claiming compiler
+  proof.
+- Explicit advisory refresh now includes concrete Maven and crates.io pins in addition to npm,
+  PyPI and Go. It remains opt-in and sends only package identities and versions to OSV.
+
+## Contracts beyond static HTTP
+
+- `trace_api_contract` can select HTTP, GraphQL, gRPC or event contracts. Static GraphQL
+  operations/schema fields, proto service methods/stub calls and Kafka/event topics join across
+  registered local repositories.
+- Runtime-computed URLs, operations/topics, reflection and dynamic stubs remain `UNKNOWN` with
+  bounded evidence. Runtime configuration is never converted into a false clean result.
+
+## Agent and Hosted fixes
+
+- Package metadata now names Codex/OpenAI Codex alongside other MCP and coding-agent workflows.
+- The Hosted Flow view distinguishes an aggregate folder-boundary feedback loop from a proven
+  file-level runtime import cycle. Current Weavatrix evidence has zero file-level runtime cycles.
+- The release checklist includes a fresh preview-confirmed private graph sync, so public demo history
+  and authenticated repository maps cannot silently drift apart.
+
+## Verification
+
+The release is gated by the full Node suite, six-language fixture benchmark, real-repository
+semantic checks, exact LSP dogfooding, release-manifest verification, packed npm and MCPB stdio
+checks, npm audit, Hosted tests/build/lint, explicit private sync, and live browser verification.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weavatrix",
-  "version": "0.2.15",
+  "version": "0.2.16",
   "type": "module",
   "description": "Local repository intelligence MCP for AI coding agents: reusable architecture graph for fast application understanding, Health, dead code, clones, history, blast radius and architecture safeguards.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
@@ -26,7 +26,7 @@
     "skill",
     "scripts/run-agent-task-benchmark.mjs",
     "docs/agent-task-benchmark.md",
-    "docs/releases/v0.2.15.md",
+    "docs/releases/v0.2.16.md",
     "README.md",
     "SECURITY.md",
     "LICENSE"
@@ -39,6 +39,7 @@
     "benchmark:real:release": "node scripts/run-real-benchmark.mjs --require-all",
     "benchmark:agent": "node scripts/run-agent-task-benchmark.mjs",
     "benchmark:agent:release": "node scripts/run-agent-task-benchmark.mjs --require-independent",
+    "sync:private": "node scripts/sync-private.mjs",
     "build:mcpb": "node scripts/build-mcpb.mjs",
     "verify:release": "node scripts/verify-release.mjs"
   },
@@ -56,6 +57,9 @@
     "dependency-graph",
     "tree-sitter",
     "claude",
+    "codex",
+    "openai-codex",
+    "coding-agents",
     "ai-agents"
   ],
   "dependencies": {

package/src/analysis/cargo-dependency-evidence.js

@@ -0,0 +1,111 @@
+import { dirname } from "node:path";
+import { createRepoBoundary } from "../repo-path.js";
+import { cargoName, parseCargoToml } from "./cargo-manifests.js";
+import { dependencyVerification, makeFinding } from "./findings.js";
+import { listRepoFiles, readRepoText } from "./internal-audit.collect.js";
+
+const rootOf = (file) => {
+  const root = dirname(String(file || "").replace(/\\/g, "/"));
+  return root === "." ? "" : root;
+};
+const owns = (root, file) => !root || file === root || String(file || "").replace(/\\/g, "/").startsWith(`${root}/`);
+
+export function collectCargoDependencyEvidence(repoRoot, { files = listRepoFiles(repoRoot), externalImports = [] } = {}) {
+  const boundary = createRepoBoundary(repoRoot);
+  const manifests = files.filter((file) => /(^|\/)Cargo\.toml$/i.test(file));
+  const scopes = manifests.map((file) => ({ file, root: rootOf(file), ...parseCargoToml(readRepoText(boundary, file)) }))
+    .sort((left, right) => right.root.length - left.root.length || left.root.localeCompare(right.root));
+  const workspaceDeps = new Map();
+  for (const scope of scopes) for (const dependency of scope.workspaceDependencies) workspaceDeps.set(cargoName(dependency.alias), dependency);
+  const issues = [];
+  for (const scope of scopes) {
+    scope.dependencies = scope.dependencies.map((dependency) => {
+      if (!dependency.inherited) return dependency;
+      const inherited = workspaceDeps.get(cargoName(dependency.alias));
+      if (!inherited) { issues.push(`${scope.file}: workspace dependency ${dependency.alias} is unresolved`); return dependency; }
+      return { ...dependency, name: inherited.name, version: inherited.version, inherited: true };
+    });
+  }
+  const importsByScope = new Map(scopes.map((scope) => [scope, []]));
+  for (const entry of externalImports) {
+    if (entry.ecosystem !== "crates.io" || !entry.pkg || entry.builtin || entry.unresolved) continue;
+    const owner = scopes.find((scope) => owns(scope.root, entry.file));
+    if (owner) importsByScope.get(owner).push(entry);
+  }
+  const findings = [], declared = new Set();
+  let mappedImports = 0, unmappedImports = 0;
+  if (!scopes.length) {
+    const missing = new Map();
+    for (const entry of externalImports.filter((item) => item.ecosystem === "crates.io" && item.pkg && !item.builtin && !item.unresolved)) {
+      if (!missing.has(cargoName(entry.pkg))) missing.set(cargoName(entry.pkg), entry);
+    }
+    for (const [name, entry] of missing) findings.push(makeFinding({
+      category: "unused", rule: "missing-dep", severity: "low", confidence: "high",
+      title: `Rust crate path without Cargo.toml: ${name}`,
+      reason: "An indexed external Rust crate path exists, but no Cargo.toml was discovered.",
+      detail: `"${entry.spec || name}" is used by ${entry.file}, but no Cargo manifest owns the file.`,
+      package: name, file: entry.file, line: entry.line || 0, source: "internal",
+      verification: { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "ACTION_REQUIRED", manifestDeclaration: { status: "NOT_PRESENT" }, indexedSourceImports: { status: "FOUND", count: 1, files: [entry.file] }, mapping: "Cargo crate name normalization" },
+      fixHint: "initialize or restore the owning Cargo manifest",
+    }));
+  }
+  for (const scope of scopes) {
+    const imports = importsByScope.get(scope);
+    const used = new Map(), missingSeen = new Set();
+    for (const entry of imports) {
+      const imported = cargoName(entry.pkg);
+      const dependency = scope.dependencies.find((item) => cargoName(item.alias) === imported || cargoName(item.name) === imported);
+      if (dependency) {
+        const evidence = used.get(dependency.alias) || [];
+        evidence.push(entry); used.set(dependency.alias, evidence); mappedImports++;
+        continue;
+      }
+      unmappedImports++;
+      if (missingSeen.has(imported)) continue;
+      missingSeen.add(imported);
+      findings.push(makeFinding({
+        category: "unused", rule: "missing-dep", severity: "medium", confidence: "high",
+        title: `Missing Cargo dependency: ${entry.pkg}`,
+        reason: "An indexed external Rust crate path has no matching dependency alias or package name in the nearest Cargo.toml.",
+        detail: `"${entry.spec || entry.pkg}" is used by ${entry.file}, but ${scope.file} does not declare crate "${entry.pkg}" (including workspace inheritance and renamed packages).`,
+        package: entry.pkg, file: entry.file, line: entry.line || 0, manifest: scope.file,
+        evidence: [{ file: entry.file, line: entry.line || 0, snippet: entry.spec || "" }], source: "internal",
+        verification: { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "ACTION_REQUIRED", manifestDeclaration: { status: "NOT_FOUND", file: scope.file }, indexedSourceImports: { status: "FOUND", count: 1, files: [entry.file] }, mapping: "Cargo alias/package normalization" },
+        fixHint: `cargo add ${entry.pkg}`,
+      }));
+    }
+    for (const dependency of scope.dependencies) {
+      const identity = cargoName(dependency.name);
+      if (!identity) continue;
+      declared.add(`${scope.root || "."}:${identity}`);
+      const evidence = used.get(dependency.alias) || [];
+      if (evidence.length || dependency.optional || dependency.build) continue;
+      findings.push(makeFinding({
+        category: "unused", rule: "unused-dep", severity: dependency.dev ? "info" : "low", confidence: "low",
+        title: `Unused Cargo dependency: ${dependency.name}`,
+        reason: "No indexed Rust use/path/extern-crate evidence maps to this dependency; feature-only, proc-macro, generated and reflective registration remain possible.",
+        detail: `"${dependency.name}" (${dependency.alias}) is declared in ${scope.file}, but no indexed .rs file in that Cargo scope references its crate path. Confirm with cargo check/test and feature combinations before removal.`,
+        package: dependency.name, version: dependency.version, manifest: scope.file, source: "internal",
+        verification: dependencyVerification(scope.file, [], "REVIEW_REQUIRED", "Cargo alias/package normalization"),
+        fixHint: `cargo remove ${dependency.alias} after checking all features and targets`,
+      }));
+    }
+  }
+  const present = manifests.length > 0;
+  return {
+    present,
+    status: present ? "CHECKED" : "NOT_PRESENT",
+    completeness: present ? (issues.length ? "PARTIAL" : "COMPLETE") : "NOT_APPLICABLE",
+    manifests,
+    declared,
+    mappedImports,
+    unmappedImports,
+    findings,
+    reasons: issues,
+    reason: !present
+      ? "No Cargo.toml was discovered."
+      : issues.length
+        ? `Cargo declarations and indexed crate paths were checked, but ${issues.length} workspace inheritance reference(s) remain unresolved.`
+        : `Cargo declarations from ${manifests.length} scope(s), workspace inheritance, renamed packages and every indexed external crate path were compared.`,
+  };
+}

package/src/analysis/cargo-manifests.js

@@ -0,0 +1,74 @@
+const clean = (value) => String(value || "").trim().replace(/^['"]|['"]$/g, "");
+export const cargoName = (value) => clean(value).toLowerCase().replace(/_/g, "-");
+
+function inlineTable(value) {
+  const fields = new Map();
+  for (const match of String(value || "").matchAll(/([A-Za-z][\w.-]*)\s*=\s*("(?:\\.|[^"])*"|'(?:\\.|[^'])*'|true|false)/g)) {
+    fields.set(match[1], clean(match[2]));
+  }
+  return fields;
+}
+
+// Bounded Cargo.toml parser for package/workspace dependency tables. It intentionally owns
+// dependency identity, aliases and concrete versions; feature activation is not treated as usage.
+export function parseCargoToml(text) {
+  const source = String(text || "");
+  const dependencies = [];
+  const workspaceDependencies = [];
+  let section = "", packageName = "", workspace = false;
+  for (const raw of source.split(/\r?\n/)) {
+    const line = raw.replace(/(^|\s)#.*$/, "").trim();
+    if (!line) continue;
+    const header = /^\[([^\]]+)]$/.exec(line);
+    if (header) { section = header[1].trim(); workspace ||= section === "workspace"; continue; }
+    const kv = /^([A-Za-z0-9_-]+)\s*=\s*(.+)$/.exec(line);
+    if (!kv) continue;
+    if (section === "package" && kv[1] === "name") { packageName = clean(kv[2]); continue; }
+    const dependencyTable = /^(?:target\..+\.)?(dependencies|dev-dependencies|build-dependencies)$/.exec(section);
+    const workspaceTable = section === "workspace.dependencies";
+    if (!dependencyTable && !workspaceTable) continue;
+    const alias = kv[1], value = kv[2].trim();
+    const table = value.startsWith("{") ? inlineTable(value) : new Map();
+    const version = value.startsWith("{") ? clean(table.get("version")) : clean(value);
+    const name = clean(table.get("package")) || alias;
+    const record = {
+      alias,
+      name,
+      version: /^\d/.test(version) || /^=?\s*\d/.test(version) ? version.replace(/^=\s*/, "") : "",
+      dev: dependencyTable?.[1] === "dev-dependencies",
+      build: dependencyTable?.[1] === "build-dependencies",
+      optional: table.get("optional") === "true",
+      inherited: table.get("workspace") === "true",
+    };
+    (workspaceTable ? workspaceDependencies : dependencies).push(record);
+  }
+  return { packageName, workspace, dependencies, workspaceDependencies };
+}
+
+// Cargo.lock v3/v4 [[package]] records. Registry packages are exact installed crates; workspace
+// and git packages are excluded because OSV crates.io versions must not be inferred for them.
+export function parseCargoLockPackages(text) {
+  const packages = [];
+  let current = null;
+  const flush = () => {
+    if (current?.name && current.version && /^registry\+https:\/\/github\.com\/rust-lang\/crates\.io-index|^registry\+https:\/\/index\.crates\.io\//.test(current.source)) {
+      packages.push({ ecosystem: "crates.io", name: current.name, version: current.version, dev: false, integrity: current.checksum || "", source: "cargo-lock" });
+    }
+  };
+  for (const raw of String(text || "").split(/\r?\n/)) {
+    const line = raw.trim();
+    if (line === "[[package]]") { flush(); current = { name: "", version: "", source: "", checksum: "" }; continue; }
+    if (!current) continue;
+    if (/^\[/.test(line)) { flush(); current = null; continue; }
+    const match = /^(name|version|source|checksum)\s*=\s*"([^"]+)"/.exec(line);
+    if (match) current[match[1]] = match[2];
+  }
+  flush();
+  const seen = new Set();
+  return packages.filter((pkg) => {
+    const key = `${pkg.name}@${pkg.version}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}

package/src/analysis/dep-check-ecosystems.js

@@ -194,6 +194,9 @@ export function computePyDepFindings(options = {}) {
     findings.push(...result.findings.map((finding) => ({
       ...finding,
       ...(scope.manifests?.length ? {manifest: scope.manifests[0]} : {}),
+      verification: finding.rule === "missing-dep"
+        ? { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "ACTION_REQUIRED", manifestDeclaration: { status: scope.present ? "NOT_FOUND" : "NOT_PRESENT", files: scope.manifests || [] }, indexedSourceImports: { status: "FOUND", count: finding.evidence?.length || 1, files: (finding.evidence || []).map((item) => item.file) }, mapping: "PEP 503 plus bounded import-to-distribution aliases" }
+        : { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "REVIEW_REQUIRED", manifestDeclaration: { status: "FOUND", files: scope.manifests || [] }, indexedSourceImports: { status: "ZERO_FOUND", completeness: "COMPLETE_FOR_GRAPH_SCOPE", count: 0, files: [] }, mapping: "PEP 503 plus bounded import-to-distribution aliases" },
     })));
     for (const name of result.declared) declared.add(`${scope.root || "."}:${name}`);
     for (const name of result.managed) managed.add(name);

package/src/analysis/endpoints-java.js

@@ -2,16 +2,13 @@
 // literal annotation paths: inventing values for constants would make an architecture inventory look
 // more complete than the evidence permits.
 import { maskJavaNonCode } from "./java-source.js";
+import { lineNumberAt } from "../util.js";
 
 const SPRING_MAPPING = /@(?:org\.springframework\.web\.bind\.annotation\.)?(RequestMapping|GetMapping|PostMapping|PutMapping|PatchMapping|DeleteMapping)\b/g;
 const SPRING_CONDITION = /@(?:org\.springframework\.boot\.autoconfigure\.condition\.)?(ConditionalOnExpression|ConditionalOnProperty)\b/g;
 const REQUEST_METHOD = /\bRequestMethod\s*\.\s*(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|TRACE)\b/g;
 
-const lineAt = (text, index) => {
-  let line = 1;
-  for (let i = 0; i < index && i < text.length; i++) if (text[i] === "\n") line++;
-  return line;
-};
+const lineAt = lineNumberAt;
 
 function skipTrivia(text, start) {
   let i = start;

package/src/analysis/findings.js

@@ -6,6 +6,18 @@ import { createHash } from "node:crypto";
 export const SEVERITY_ORDER = ["critical", "high", "medium", "low", "info"];
 export const FINDING_CATEGORIES = ["unused", "structure", "vulnerability", "malware"];
 
+export function dependencyVerification(manifest, imports, decision, mapping) {
+  return {
+    evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE",
+    decision,
+    manifestDeclaration: { status: "FOUND", file: manifest },
+    indexedSourceImports: imports.length
+      ? { status: "FOUND", count: imports.length, files: [...new Set(imports.map((item) => item.file))].slice(0, 10) }
+      : { status: "ZERO_FOUND", completeness: "COMPLETE_FOR_GRAPH_SCOPE", count: 0, files: [] },
+    mapping,
+  };
+}
+
 // Stable id: survives re-runs so the UI can persist expand/dismiss state per finding.
 export function makeFinding(f) {
   const cycleIdentity = Array.isArray(f.cycleMembers)

package/src/analysis/go-dependency-evidence.js

@@ -0,0 +1,68 @@
+import { dirname } from "node:path";
+import { createRepoBoundary } from "../repo-path.js";
+import { computeGoDepFindings } from "./dep-check-ecosystems.js";
+import { listRepoFiles, readRepoText } from "./internal-audit.collect.js";
+import { parseGoMod } from "./manifests.js";
+import { makeFinding } from "./findings.js";
+
+const rootOf = (file) => {
+  const root = dirname(String(file || "").replace(/\\/g, "/"));
+  return root === "." ? "" : root;
+};
+const owns = (root, file) => !root || file === root || String(file || "").replace(/\\/g, "/").startsWith(`${root}/`);
+
+export function collectGoDependencyEvidence(repoRoot, { files = listRepoFiles(repoRoot), externalImports = [], nonRuntimeRoots = [] } = {}) {
+  const boundary = createRepoBoundary(repoRoot);
+  const manifests = files.filter((file) => /(^|\/)go\.mod$/i.test(file));
+  const scopes = manifests.map((file) => ({ file, root: rootOf(file), parsed: parseGoMod(readRepoText(boundary, file)) }))
+    .sort((left, right) => right.root.length - left.root.length || left.root.localeCompare(right.root));
+  const importsByScope = new Map(scopes.map((scope) => [scope, []]));
+  for (const entry of externalImports) {
+    if (entry.ecosystem !== "Go") continue;
+    const owner = scopes.find((scope) => owns(scope.root, entry.file));
+    if (owner) importsByScope.get(owner).push(entry);
+  }
+  const findings = [], declared = new Set(), issues = [];
+  if (!scopes.length) {
+    const missing = new Map();
+    for (const entry of externalImports.filter((item) => item.ecosystem === "Go" && item.pkg && !item.builtin && !item.unresolved)) {
+      if (!missing.has(entry.pkg)) missing.set(entry.pkg, entry);
+    }
+    for (const [name, entry] of missing) findings.push(makeFinding({
+      category: "unused", rule: "missing-dep", severity: "low", confidence: "high",
+      title: `Go import without a module manifest: ${name}`,
+      reason: "An indexed external Go import exists, but no go.mod was discovered.",
+      detail: `"${entry.spec || name}" is imported by ${entry.file}, but no go.mod exists in the repository.`,
+      package: name, file: entry.file, line: entry.line || 0, source: "internal",
+      verification: { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "ACTION_REQUIRED", manifestDeclaration: { status: "NOT_PRESENT" }, indexedSourceImports: { status: "FOUND", count: 1, files: [entry.file] }, mapping: "Go module prefix" },
+      fixHint: "initialize or restore the owning Go module manifest",
+    }));
+  }
+  for (const scope of scopes) {
+    if (!scope.parsed.module) issues.push(`${scope.file}: module directive is missing or unreadable`);
+    const result = computeGoDepFindings({ externalImports: importsByScope.get(scope), goMod: scope.parsed, nonRuntimeRoots });
+    findings.push(...result.findings.map((finding) => ({
+      ...finding,
+      manifest: scope.file,
+      verification: finding.rule === "missing-dep"
+        ? { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "ACTION_REQUIRED", manifestDeclaration: { status: "NOT_FOUND", file: scope.file }, indexedSourceImports: { status: "FOUND", count: finding.evidence?.length || 1, files: (finding.evidence || []).map((item) => item.file) }, mapping: "longest go.mod module prefix" }
+        : { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "REVIEW_REQUIRED", manifestDeclaration: { status: "FOUND", file: scope.file }, indexedSourceImports: { status: "ZERO_FOUND", completeness: "COMPLETE_FOR_GRAPH_SCOPE", count: 0, files: [] }, mapping: "longest go.mod module prefix" },
+    })));
+    for (const name of result.declared) declared.add(`${scope.root || "."}:${name}`);
+  }
+  const present = manifests.length > 0;
+  return {
+    present,
+    status: present ? "CHECKED" : "NOT_PRESENT",
+    completeness: present ? (issues.length ? "PARTIAL" : "COMPLETE") : "NOT_APPLICABLE",
+    manifests,
+    declared,
+    findings,
+    reasons: issues,
+    reason: !present
+      ? "No go.mod was discovered."
+      : issues.length
+        ? `Go imports and requirements were checked across ${manifests.length} module(s), but ${issues.length} module descriptor(s) were incomplete.`
+        : `Every discovered go.mod scope (${manifests.length}) was compared with indexed Go imports, including direct/indirect requirements and replace directives.`,
+  };
+}

package/src/analysis/health-capabilities.js

@@ -38,7 +38,7 @@ export function buildHealthCapabilityMatrix({
   const unsupportedDependencyRows = ecosystemRows.filter((item) => item.status === "NOT_SUPPORTED");
   const noDependencyEvidence = ecosystemRows.length === 0;
   const onlyUnsupportedDependencies = unsupportedDependencyRows.length > 0 && supportedDependencyRows.length === 0;
-  const advisorySupported = supportedDependencyRows.some((item) => ["npm", "go", "python"].includes(item.ecosystem));
+  const advisorySupported = supportedDependencyRows.some((item) => ["npm", "go", "python", "rust", "maven", "gradle"].includes(item.ecosystem));
   const malwareSupported = supportedDependencyRows.some((item) => ["npm", "go", "python"].includes(item.ecosystem));
   const coverageSupported = [...languages].some((language) => ["javascript/typescript", "python", "go"].includes(language));
   const runtimeFiles = Number(correctnessCoverage.runtimeCorrectnessFiles || 0);

package/src/analysis/http-contracts/analysis.js

@@ -67,6 +67,7 @@ export function analyzeHttpContracts(input = {}) {
       autoDiscoverWrappers: descriptor.autoDiscoverWrappers ?? input.autoDiscoverWrappers,
       graph: descriptor.graph,
       includeTests: descriptor.includeTests ?? input.includeTests,
+      runtimeValues: descriptor.runtimeValues || input.runtimeValues,
     });
     if (detected.truncated) completeness.push(`${id}: client scan cap reached`);
     for (const reason of detected.reasons || []) completeness.push(`${id}: ${reason}`);
@@ -141,6 +142,7 @@ export function analyzeHttpContracts(input = {}) {
     })))
     .sort((left, right) => left.clientRepo.localeCompare(right.clientRepo) || left.file.localeCompare(right.file) || left.line - right.line);
   if (uncertainAll.length > limits.maxUncertain) completeness.push("uncertain callsite cap reached");
+  if (uncertainAll.length) completeness.push(`${uncertainAll.length} dynamic HTTP callsite(s) remain UNKNOWN`);
   if (results.some((endpoint) => !endpoint.affected.complete)) completeness.push("affected-file traversal cap reached");
 
   return {

package/src/analysis/http-contracts/client-call-detection.js

@@ -55,6 +55,7 @@ export function detectHttpClientCalls(repoRoot, codeFiles, options = {}) {
       clientNames,
       normalizedWrappers: [...configured, ...scopedDiscovered],
       maxCalls: remaining,
+      runtimeValues: options.runtimeValues,
     });
     calls.push(...extracted.calls);
     if (extracted.truncated) truncated = true;

package/src/analysis/http-contracts/client-call-parser.js

@@ -91,7 +91,7 @@ function templateArgument(text, start, constants = null, requireStatic = false)
     }
     if (depth !== 0) return null;
     const expression = text.slice(index + 2, cursor - 1).trim();
-    if (/^[A-Za-z_$][\w$]*$/.test(expression) && constants?.has(expression)) {
+    if (/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*$/.test(expression) && constants?.has(expression)) {
       value += constants.get(expression);
       index = cursor - 1;
       continue;
@@ -109,7 +109,7 @@ function templateArgument(text, start, constants = null, requireStatic = false)
   return null;
 }
 
-function extractStaticStringConstants(text) {
+function extractStaticStringConstants(text, runtimeValues = {}) {
   const source = String(text || "");
   const mask = maskNonCode(source);
   const declarations = [];
@@ -120,7 +120,8 @@ function extractStaticStringConstants(text) {
     while (/\s/.test(source[start] || "")) start++;
     declarations.push({ name: match[1], start });
   }
-  const constants = new Map();
+  const constants = new Map(Object.entries(runtimeValues || {})
+    .filter(([key, value]) => /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*$/.test(key) && typeof value === "string" && value.length <= 2_048));
   for (const item of declarations) {
     const quote = source[item.start];
     if (quote !== "'" && quote !== '"') continue;
@@ -138,6 +139,19 @@ function extractStaticStringConstants(text) {
     }
     if (!changed) break;
   }
+  for (const item of declarations) {
+    if (constants.has(item.name)) continue;
+    const rest = source.slice(item.start);
+    const expression = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*/.exec(rest)?.[0];
+    if (expression && constants.has(expression)) constants.set(item.name, constants.get(expression));
+    if (constants.has(item.name)) continue;
+    const fallback = /(?:\|\||\?\?)\s*(["'])/.exec(rest.slice(0, 500));
+    if (fallback) {
+      const start = item.start + fallback.index + fallback[0].lastIndexOf(fallback[1]);
+      const parsed = quotedArgument(source, start, fallback[1]);
+      if (parsed && parsed.value.length <= 2_048) constants.set(item.name, parsed.value);
+    }
+  }
   return constants;
 }
 
@@ -211,7 +225,7 @@ const escapeRegex = (value) => String(value).replace(/[|\\{}()[\]^$+*?.-]/g, "\\
 export function extractHttpClientCallsFromText(text, file, options = {}) {
   const source = String(text || "");
   const mask = maskNonCode(source);
-  const constants = extractStaticStringConstants(source);
+  const constants = extractStaticStringConstants(source, options.runtimeValues);
   const allowed = normalizedClientNames(options.clientNames);
   const wrappers = normalizeHttpWrapperDescriptors(options.wrappers, "input").concat(Array.isArray(options.normalizedWrappers) ? options.normalizedWrappers : []);
   const maxCalls = boundedInteger(options.maxCalls, HTTP_CONTRACT_DEFAULTS.maxCallsPerClient, 1, HTTP_CONTRACT_HARD_LIMITS.maxCallsPerClient);