weavatrix 0.2.15 → 0.2.18

package/src/graph/builder/lang-rust.js

@@ -113,7 +113,7 @@ export default {
   ],
 
   pass1(ctx) {
-    const { grammar, tree, fileRel, caps, field, addSym, addImportEdge, imports, resolveRustMod, resolveRustPath, links, nameToId } = ctx;
+    const { grammar, tree, fileRel, caps, field, addSym, addImportEdge, addExternalImport, imports, resolveRustMod, resolveRustPath, links, nameToId } = ctx;
     const owned = [];
     for (const src of [SYMS_CORE, ...SYMS_OPTIONAL]) {
       for (const cap of caps(grammar, src, tree.rootNode)) {
@@ -175,7 +175,13 @@ export default {
       const ancestors = inlineAncestors(use);
       for (const leaf of useLeaves(use)) {
         const resolved = resolveRustPath(fileRel, leaf.segments, { inlineModules: ancestors, unqualified: true });
-        if (!resolved) continue;
+        if (!resolved) {
+          const crate = cleanSegment(leaf.segments[0]);
+          if (crate && !["crate", "self", "super", "std", "core", "alloc"].includes(crate) && /^[a-z_][\w]*$/.test(crate)) {
+            addExternalImport({ spec: leaf.segments.join("::"), pkg: crate.replace(/_/g, "-"), builtin: false, ecosystem: "crates.io", kind: "rust-use", line: use.startPosition.row + 1 });
+          }
+          continue;
+        }
         emit(resolved.targetFile, { relation, line: use.startPosition.row + 1, specifier: use.text.replace(/;\s*$/, "") });
         if (!leaf.wildcard && leaf.local && leaf.local !== "_") {
           const imported = resolved.remaining.length ? cleanSegment(resolved.remaining.at(-1)) : "*";
@@ -192,7 +198,13 @@ export default {
       if (under(node, "use_declaration")) continue;
       if (["scoped_identifier", "scoped_type_identifier"].includes(node.parent?.type)) continue;
       const segments = pathParts(node);
-      if (!["crate", "self", "super"].includes(segments[0])) continue;
+      if (!["crate", "self", "super"].includes(segments[0])) {
+        const crate = cleanSegment(segments[0]);
+        if (crate && !["std", "core", "alloc"].includes(crate) && /^[a-z_][\w]*$/.test(crate)) {
+          addExternalImport({ spec: segments.join("::"), pkg: crate.replace(/_/g, "-"), builtin: false, ecosystem: "crates.io", kind: "rust-path", line: node.startPosition.row + 1 });
+        }
+        continue;
+      }
       const resolved = resolveRustPath(fileRel, segments, { inlineModules: inlineAncestors(node), unqualified: false });
       if (!resolved) continue;
       emit(resolved.targetFile, { line: node.startPosition.row + 1, specifier: node.text });
@@ -201,5 +213,12 @@ export default {
         imports.set(finalName, { imported: finalName, targetFile: resolved.targetFile, rustQualified: true });
       }
     }
+
+    for (const cap of caps(grammar, `(extern_crate_declaration name: (identifier) @crate)`, tree.rootNode)) {
+      const crate = cleanSegment(cap.node.text);
+      if (crate && !["std", "core", "alloc"].includes(crate)) {
+        addExternalImport({ spec: crate, pkg: crate.replace(/_/g, "-"), builtin: false, ecosystem: "crates.io", kind: "rust-extern-crate", line: cap.node.startPosition.row + 1 });
+      }
+    }
   },
 };

package/src/graph/freshness-probe.js

@@ -19,7 +19,7 @@ export const GRAPH_BUILDER_VERSION = (() => {
 // version invalidates stamps across releases; the explicit schema requirements also fail closed when
 // a saved graph is hand-edited or a development build bumps a structural schema without a version bump.
 const CURRENT_GRAPH_SCHEMA = Object.freeze({
-    extImportsV: 2,
+    extImportsV: 3,
     edgeTypesV: 2,
     edgeProvenanceV: 1,
     complexityV: 2,

package/src/graph/internal-builder.build.js

@@ -248,7 +248,7 @@ export async function buildInternalGraph(repoDir, opts = {}) {
   assignDeterministicCommunities(nodes);
   stampEdgeProvenance(links);
 
-  // extImportsV: bump when the externalImports schema/coverage changes (v2 = go/python ecosystems) —
+  // extImportsV: bump when the externalImports schema/coverage changes (v3 = Java/Rust ecosystems) —
   // deps-engine rebuilds in memory when a saved graph is older than this.
   // edgeTypesV 2 adds language-neutral compile-only edges (currently Rust mod/use/re-export) on top
   // of v1's TypeScript typeOnly classification.
@@ -256,7 +256,7 @@ export async function buildInternalGraph(repoDir, opts = {}) {
     nodes,
     links,
     externalImports,
-    extImportsV: 2,
+    extImportsV: 3,
     edgeTypesV: 2,
     edgeProvenanceV: EDGE_PROVENANCE_V,
     complexityV: 2,

package/src/graph/internal-builder.langs.js

@@ -115,6 +115,25 @@ function gitFileUniverse(dir) {
     });
   } catch { return null; }
 
+  // `git -C <dir>` also succeeds when <dir> is merely nested under some parent repository. If that
+  // nested directory is ignored by the parent, `ls-files` is empty even though <dir> can be a valid
+  // standalone repository root selected by the user (or a repository staged by a test/tool). In
+  // that one ambiguous case, fall back to the boundary-safe walker. Preserve an empty universe for
+  // an actual Git root so ignored files do not leak back into its graph.
+  if (!raw) {
+    try {
+      const top = execFileSync("git", ["-C", dir, "rev-parse", "--show-toplevel"], {
+        encoding: "utf8",
+        windowsHide: true,
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 15_000,
+        maxBuffer: 1024 * 1024,
+        env: childProcessEnv(),
+      }).trim();
+      if (realpathSync.native(top) !== realpathSync.native(dir)) return null;
+    } catch { return null; }
+  }
+
   let rootReal;
   try { rootReal = realpathSync.native(dir); } catch { return null; }
   const files = [];

package/src/graph/internal-builder.resolvers.js

@@ -6,6 +6,7 @@ import { readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { parseGoMod } from "../analysis/manifests.js";
 import { createRepoBoundary } from "../repo-path.js";
+import { listRepoFiles } from "../analysis/internal-audit/repo-files.js";
 import { createRustResolvers } from "./resolvers/rust.js";
 
 export function buildResolvers(repoDir, fileSet) {
@@ -19,11 +20,18 @@ export function buildResolvers(repoDir, fileSet) {
   // go.mod requires also feed goSpecToPkg so external Go imports map to their declared module.
   let goModule = "";
   let goRequires = [];
-  try {
-    const gomod = parseGoMod(readLocal("go.mod"));
-    goModule = gomod.module;
-    goRequires = gomod.requires.map((r) => r.path);
-  } catch { /* no go.mod */ }
+  const goModules = [];
+  for (const manifest of listRepoFiles(repoDir).filter((file) => /(^|\/)go\.mod$/i.test(file))) {
+    try {
+      const gomod = parseGoMod(readLocal(manifest));
+      if (!gomod.module) continue;
+      const root = manifest.includes("/") ? manifest.slice(0, manifest.lastIndexOf("/")) : "";
+      goModules.push({ root, module: gomod.module, requires: gomod.requires.map((item) => item.path) });
+    } catch { /* unreadable module */ }
+  }
+  goModules.sort((left, right) => right.module.length - left.module.length);
+  goModule = goModules.find((item) => !item.root)?.module || goModules[0]?.module || "";
+  goRequires = [...new Set(goModules.flatMap((item) => item.requires))];
   const dirFiles = new Map();
   const filesByBase = new Map();
   for (const fr of fileSet) {
@@ -32,8 +40,10 @@ export function buildResolvers(repoDir, fileSet) {
     if (fr.endsWith(".go")) { const d = fr.includes("/") ? fr.slice(0, fr.lastIndexOf("/")) : ""; (dirFiles.get(d) || dirFiles.set(d, []).get(d)).push(fr); }
   }
   const resolveGoImport = (importPath) => {
-    if (goModule && (importPath === goModule || importPath.startsWith(goModule + "/"))) {
-      const d = importPath === goModule ? "" : importPath.slice(goModule.length + 1);
+    for (const own of goModules) {
+      if (importPath !== own.module && !importPath.startsWith(own.module + "/")) continue;
+      const subpath = importPath === own.module ? "" : importPath.slice(own.module.length + 1);
+      const d = [own.root, subpath].filter(Boolean).join("/");
       if (dirFiles.has(d)) return d;
     }
     // a module DECLARED in go.mod is external by definition — never let the suffix fallback hijack it
@@ -207,5 +217,5 @@ export function buildResolvers(repoDir, fileSet) {
     return fileSet.has(cand) ? cand : null;
   };
 
-  return { resolveJsImport, resolveAlias, resolvePyPath, pyBaseDir, pyTopDirs, resolveGoImport, dirFiles, resolveRustMod, resolveRustPath, resolveJavaImport, resolveHref, selectorIndex, htmlUsages, goModule, goRequires };
+  return { resolveJsImport, resolveAlias, resolvePyPath, pyBaseDir, pyTopDirs, resolveGoImport, dirFiles, resolveRustMod, resolveRustPath, resolveJavaImport, resolveHref, selectorIndex, htmlUsages, goModule, goModules, goRequires };
 }

package/src/graph/node-id.js

@@ -0,0 +1,7 @@
+export const graphEndpointId = (value) => String(value && typeof value === "object" ? value.id : value);
+
+export const fileOfId = (value) => {
+  const id = String(value || "");
+  const hash = id.indexOf("#");
+  return hash < 0 ? id : id.slice(0, hash);
+};

package/src/mcp/actions/advisories.mjs

@@ -4,15 +4,14 @@ import {collectInstalled} from '../../security/installed.js'
 export async function tRefreshAdvisories(g, args, ctx) {
     if (!ctx.repoRoot) return 'No repo root — cannot collect installed packages.'
     const {installed} = collectInstalled(ctx.repoRoot)
-    if (!installed.length) return 'No pinned packages found in lockfiles (npm/yarn/pip/poetry/uv/go) — nothing to query.'
+    if (!installed.length) return 'No pinned packages found in supported manifests/lockfiles (npm/yarn/pip/poetry/uv/go/Maven/Gradle/Cargo) — nothing to query.'
     const res = await refreshAdvisories({installed, repoKey: ctx.repoRoot, timeoutMs: Number(args.timeout_ms) || undefined})
     if (res.ok === false) return `Advisory refresh failed: ${res.error}`
     const meta = storeMeta()
     return [
         `Advisory store ${res.status === 'PARTIAL' ? 'partially refreshed' : 'refreshed'} from OSV.dev: ${res.queriedOk ?? res.queried}/${res.queried} package versions queried successfully, ${res.vulnerable} with known advisories (${res.fetched} advisory records fetched).`,
-        res.unsupported ? `${res.unsupported} packages skipped (ecosystem not OSV-queryable — npm/PyPI/Go only).` : null,
+        res.unsupported ? `${res.unsupported} packages skipped (ecosystem not OSV-queryable — supported: npm/PyPI/Go/Maven/crates.io).` : null,
         res.errors?.length ? `Partial: ${res.errors.length} request error(s), first: ${res.errors[0]}` : null,
         `Store: ${DEFAULT_STORE} (${meta.advisoryCount} advisories, fetched ${meta.fetchedAt}). run_audit now reflects it — offline.`,
     ].filter(Boolean).join('\n')
 }
-

package/src/mcp/architecture-bootstrap.mjs

@@ -49,13 +49,13 @@ function materializeCandidate(candidate, verification, baselineMode) {
     })
 }
 
-function activeContract(ctx) {
+export function activeArchitectureContract(ctx) {
     if (!ctx?.repoRoot) return {contract: null, source: null, error: 'no repository root is active'}
     return loadArchitectureContract(ctx.repoRoot, ctx.graphPath)
 }
 
 function preview(g, args, ctx) {
-    const active = activeContract(ctx)
+    const active = activeArchitectureContract(ctx)
     if (active.contract) return toolResult(
         `Architecture bootstrap refused: an active contract already exists at ${active.source}.`,
         {state: 'ALREADY_CONFIGURED', source: active.source, contractHash: active.contract.contractHash},
@@ -122,7 +122,7 @@ function approve(g, args, ctx) {
             state: 'REPOSITORY_CHANGED', wrote: false,
         })
     }
-    const active = activeContract(ctx)
+    const active = activeArchitectureContract(ctx)
     if (active.contract || active.error) return toolResult(
         `Architecture approval refused: ${active.source || 'a contract'} appeared or changed after preview.`,
         {state: active.error ? 'ERROR' : 'ALREADY_CONFIGURED', wrote: false, source: active.source, error: active.error || undefined},

package/src/mcp/catalog.mjs

@@ -39,6 +39,7 @@ const HOT_OWNERS = [
     'actions/graph-lifecycle.mjs', 'actions/advisories.mjs',
     'actions/hosted-architecture.mjs', 'actions/graph-sync.mjs',
     'architecture-starter.mjs', 'architecture-bootstrap.mjs',
+    'company-contract-verdict.mjs',
 ]
 export const HOT_FILES = [...HOT_FACADES, ...HOT_OWNERS, 'catalog.mjs']
 
@@ -50,8 +51,8 @@ function buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps}) {
         {cap: 'graph', name: 'query_graph', description: 'Explore a focused production-first graph around a concept or exact symbols (BFS/DFS). Exact seed files/symbols stay pinned; relation_filter and flow_direction support bounded event/data-flow views without a separate tool. Classified paths and unreferenced constant/field leaves stay suppressed unless explicitly requested.', inputSchema: {type: 'object', properties: {question: {type: 'string', description: 'Optional natural-language question or keyword search when exact seeds are not sufficient'}, mode: {type: 'string', enum: ['bfs', 'dfs'], default: 'bfs'}, depth: {type: 'integer', default: 3}, context_filter: {type: 'array', items: {type: 'string'}}, seed_files: {type: 'array', items: {type: 'string'}, maxItems: 12, description: 'Exact repo-relative file paths. Resolved exact seeds remain pinned unless augment_seeds is true'}, seed_symbols: {type: 'array', items: {type: 'string'}, maxItems: 12, description: 'Exact node IDs or unambiguous symbol labels; enables focused flows without fuzzy query seeds'}, relation_filter: {oneOf: [{type: 'array', items: {type: 'string'}}, {type: 'string'}], description: 'Optional relation allow-list, e.g. calls,references,imports'}, flow_direction: {type: 'string', enum: ['forward', 'backward', 'both'], default: 'both', description: 'Traverse outgoing, incoming, or both directions'}, augment_seeds: {type: 'boolean', default: false, description: 'With exact seeds, also add fuzzy question-derived seeds; false keeps traversal strictly pinned'}, include_classified: {type: 'boolean', default: false, description: 'Allow traversal through tests/e2e/generated/mocks/stories/docs/benchmarks/temp and explicitly excluded paths. An explicit class term in the question enables only that class.'}, include_low_signal: {type: 'boolean', default: false, description: 'Include unreferenced constant/field leaf symbols that do not match a query term'}, token_budget: {type: 'integer', description: 'Higher budget shows more nodes/edges', default: 2000}}, anyOf: [{required: ['question']}, {required: ['seed_files']}, {required: ['seed_symbols']}]}, run: (g, a, ctx) => tg.tQueryGraph(g, a, ctx)},
         {cap: 'graph', name: 'god_nodes', description: 'Rank production-code connectivity hubs by unique call/import/reference neighbors, with class/method ownership reported separately from runtime connectivity. Repeated call sites do not inflate the rank; classified tests, generated/build output and other non-product paths are excluded by default.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', default: 10}, include_classified: {type: 'boolean', default: false, description: 'Include tests/e2e/generated/build output/mocks/stories/docs/benchmarks/temp and paths explicitly excluded by repository classification'}}}, run: (g, a, ctx) => tg.tGodNodes(g, a, ctx)},
         {cap: 'graph', name: 'shortest_path', description: 'Find the shortest path between two concepts in the knowledge graph.', inputSchema: {type: 'object', properties: {source: {type: 'string'}, target: {type: 'string'}, max_hops: {type: 'integer', default: 8}}, required: ['source', 'target']}, run: (g, a) => tg.tShortestPath(g, a)},
-        {cap: 'graph', name: 'get_dependents', description: 'Transitive blast-radius of ONE node: everything that calls/imports/inherits it, directly or through intermediaries (reverse edges, ranked by proximity then connectivity). Symbol queries stay symbol-precise by default; set include_container_importers only for a conservative module-wide radius. Use before refactoring; get_neighbors shows only 1 hop, change_impact covers your whole current diff at once.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Node label or ID'}, depth: {type: 'integer', description: 'Max reverse hops, default 3', default: 3}, max_nodes: {type: 'integer', description: 'Max dependents to list, default 40', default: 40}, include_container_importers: {type: 'boolean', description: 'Also seed importers of the symbol containing file (broader, conservative; default false)', default: false}}, required: ['label']}, run: (g, a) => ti.tGetDependents(g, a)},
-        {cap: 'graph', name: 'change_impact', description: 'Verdict-first, symbol-aware blast radius. Parses a zero-context git diff, distinguishes additive exports from signature/body/removal risk, and reverse-traverses only exact changed seeds so a new API does not inherit every legacy importer of its file. Measured coverage is used when present; otherwise static test reachability is labelled actualCoverage=NOT_AVAILABLE. Pass `diff` for a not-checked-out PR; `files` without a diff remains a conservative fallback.', inputSchema: {type: 'object', properties: {base: {type: 'string', description: 'Base ref, e.g. origin/main or HEAD~1 (default: first existing of origin/HEAD, origin/main, origin/master, main, master)'}, diff: {type: 'string', maxLength: 2097152, description: 'Optional unified diff (prefer --unified=0) for a PR/change that is not checked out; enables symbol-level classification'}, files: {type: 'array', items: {type: 'string'}, maxItems: 500, description: 'Optional repo-relative changed-file hints. Without diff evidence these are classified conservatively rather than guessed additive'}, depth: {type: 'integer', description: 'Max reverse hops, default 2'}, max_nodes: {type: 'integer', description: 'Max impacted nodes to list, default 40'}}}, run: (g, a, ctx) => ti.tChangeImpact(g, a, ctx)},
+        {cap: 'graph', name: 'get_dependents', description: 'Transitive blast-radius of ONE node. JavaScript/TypeScript symbols use a cached on-demand EXACT_LSP point query by default, then traverse exact direct callers through the wider graph; incomplete precision is labelled and never silently presented as exact. Set precision=graph to skip LSP or include_container_importers for a conservative module-wide radius.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Node label or ID'}, depth: {type: 'integer', description: 'Max reverse hops, default 3', default: 3}, max_nodes: {type: 'integer', description: 'Max dependents to list, default 40', default: 40}, precision: {type: 'string', enum: ['auto', 'graph', 'lsp'], default: 'auto', description: 'auto uses exact JS/TS point queries when precision is enabled; graph skips LSP; lsp forces an attempt'}, max_references: {type: 'integer', minimum: 1, maximum: 5000, default: 1000}, timeout_ms: {type: 'integer', minimum: 1000, maximum: 60000, default: 30000}, include_container_importers: {type: 'boolean', description: 'Also seed importers of the symbol containing file (broader, conservative; default false)', default: false}}, required: ['label']}, run: (g, a, ctx) => ti.tGetDependents(g, a, ctx)},
+        {cap: 'graph', name: 'change_impact', description: 'Verdict-first, symbol-aware blast radius. Parses a zero-context git diff and uses one bounded EXACT_LSP batch query for direct references to changed JavaScript/TypeScript symbols; transitive hops stay explicitly graph-backed. Additive exports do not inherit legacy file importers. Measured coverage is used when present; otherwise static reachability is labelled, not treated as coverage.', inputSchema: {type: 'object', properties: {base: {type: 'string', description: 'Base ref, e.g. origin/main or HEAD~1 (default: first existing of origin/HEAD, origin/main, origin/master, main, master)'}, diff: {type: 'string', maxLength: 2097152, description: 'Optional unified diff (prefer --unified=0) for a PR/change that is not checked out; enables symbol-level classification'}, files: {type: 'array', items: {type: 'string'}, maxItems: 500, description: 'Optional repo-relative changed-file hints. Without diff evidence these are classified conservatively rather than guessed additive'}, depth: {type: 'integer', description: 'Max reverse hops, default 2'}, max_nodes: {type: 'integer', description: 'Max impacted nodes to list, default 40'}, precision: {type: 'string', enum: ['auto', 'graph', 'lsp'], default: 'auto'}, max_references: {type: 'integer', minimum: 1, maximum: 16384, default: 5000}, timeout_ms: {type: 'integer', minimum: 1000, maximum: 60000, default: 45000}}}, run: (g, a, ctx) => ti.tChangeImpact(g, a, ctx)},
         {cap: 'graph', name: 'git_history', description: 'Behavioral architecture evidence from bounded local git history: churn × connectivity hotspots, hidden co-change coupling, and expected test/source coupling. Reads numstat only — never commit messages, authors, or source bodies.', inputSchema: {type: 'object', properties: {months: {type: 'integer', enum: [3, 6, 12], default: 6}, max_commits: {type: 'integer', minimum: 1, maximum: 5000, default: 1000}, min_pair_count: {type: 'integer', minimum: 2, maximum: 100, default: 3}, max_pairs: {type: 'integer', minimum: 1, maximum: 500, default: 100}, top_n: {type: 'integer', minimum: 1, maximum: 50, default: 10}}}, run: (g, a, ctx) => thi.tGitHistory(g, a, ctx)},
         {
             cap: 'graph', refreshGraph: true, name: 'verified_change',
@@ -75,12 +76,13 @@ function buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps}) {
         {
             cap: 'crossrepo',
             name: 'trace_api_contract',
-            description: 'Cross-repository HTTP contract, handler-liveness and blast-radius evidence. Select a registered backend and one or more registered clients; joins backend endpoints to built-in, configured, or conservatively auto-discovered HTTP wrappers. Medium/high-confidence external matches mark a handler NOT_DEAD_EXTERNAL_USE; no match remains UNKNOWN. Repository paths stay local and cannot be supplied through this tool.',
+            description: 'Cross-repository HTTP, GraphQL, gRPC and event/topic contract, handler-liveness and blast-radius evidence. Joins static backend contracts to registered client repositories; dynamic URLs/topics, reflection and unresolved runtime configuration remain explicit UNKNOWN evidence. Medium/high-confidence external matches mark a handler/contract NOT_DEAD_EXTERNAL_USE. Repository paths stay local and cannot be supplied through this tool.',
             inputSchema: {
                 type: 'object',
                 properties: {
                     backend: {type: 'string', description: 'Backend repository UUID or exact unambiguous registry label'},
                     clients: {type: 'array', items: {type: 'string'}, minItems: 1, maxItems: 20, description: 'Client repository UUIDs or exact unambiguous registry labels'},
+                    transport: {type: 'string', enum: ['all', 'http', 'graphql', 'grpc', 'event'], default: 'all', description: 'Contract family to trace; all runs every supported static detector'},
                     method: {type: 'string', enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS']},
                     path: {type: 'string', maxLength: 2048, description: 'Optional full route or segment-aligned route fragment; /query matches /edgeAnalytics/query/... and {id}, :id and concrete parameter values are normalized'},
                     changed_files: {type: 'array', items: {type: 'string'}, maxItems: 500, description: 'Optional backend repo-relative changed files; only endpoints declared in those files are traced'},
@@ -104,6 +106,7 @@ function buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps}) {
                         },
                     },
                     auto_discover_wrappers: {type: 'boolean', default: true, description: 'Discover only simple unambiguous functions that forward a URL parameter directly to a known object-style HTTP client'},
+                    runtime_config: {type: 'object', maxProperties: 50, additionalProperties: {type: 'string', maxLength: 2048}, description: 'Optional non-secret static bindings for runtime URL prefixes, e.g. process.env.API_BASE. Values are used locally for this call and are not returned.'},
                     include_tests: {type: 'boolean', default: false},
                     max_impact_depth: {type: 'integer', minimum: 0, maximum: 5, default: 2},
                     max_endpoints: {type: 'integer', minimum: 1, maximum: 500, default: 250},
@@ -138,7 +141,7 @@ function buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps}) {
         {cap: 'health', name: 'propose_architecture_exception', description: 'Prepare, but never apply, a bounded exception proposal for human review.', inputSchema: {type: 'object', properties: {fingerprint: {type: 'string'}, reason: {type: 'string'}, expires: {type: 'string', description: 'Optional YYYY-MM-DD'}}, required: ['fingerprint', 'reason']}, run: (g, a, ctx) => tar.tProposeArchitectureException(g, a, ctx)},
         {cap: 'retarget', name: 'open_repo', description: 'OFFLINE RETARGET: switch this server to another local Git repository, building its graph when missing. This explicit tool call changes the active repository boundary; pass build:false to probe without building. Omitted mode/precision preserve an existing graph; a new graph uses full and the startup precision setting (lsp unless WEAVATRIX_PRECISION=off). Omit the retarget capability at registration to pin one repository.', inputSchema: {type: 'object', properties: {path: {type: 'string', description: 'Absolute path to a Git working tree'}, build: {type: 'boolean', description: 'Build the graph when missing (default true)', default: true}, mode: {type: 'string', enum: ['full', 'no-tests', 'tests-only'], description: 'Optional build mode override; omit to preserve an existing graph'}, precision: {type: 'string', enum: ['lsp', 'off'], description: 'Optional semantic precision override; omit to preserve an existing graph or use the startup setting for a new graph'}} , required: ['path']}, run: (g, a, ctx) => ta.tOpenRepo(g, a, ctx)},
         {cap: 'retarget', name: 'list_known_repos', description: 'OFFLINE RETARGET: list every registered local repository graph from the global per-user registry, regardless of parent folder.', inputSchema: {type: 'object', properties: {}}, run: (g, a, ctx) => ta.tListKnownRepos(g, a, ctx)},
-        {cap: 'advisories', name: 'refresh_advisories', description: "NETWORK / explicit advisories profile: refresh the local OSV advisory store for this repo's lockfile-pinned packages (npm/PyPI/Go). Sends package names + versions to OSV.dev — never automatic, never source code. Afterwards run_audit reads the refreshed store fully offline (~/.weavatrix/advisories.json).", inputSchema: {type: 'object', properties: {timeout_ms: {type: 'integer', description: 'Per-request timeout, default 20000'}}}, run: (g, a, ctx) => ta.tRefreshAdvisories(g, a, ctx)},
+        {cap: 'advisories', name: 'refresh_advisories', description: "NETWORK / explicit advisories profile: refresh the local OSV advisory store for this repo's concrete npm/PyPI/Go/Maven/Gradle/Cargo package versions. Sends package names + versions to OSV.dev — never automatic, never source code. Afterwards run_audit reads the refreshed store fully offline (~/.weavatrix/advisories.json).", inputSchema: {type: 'object', properties: {timeout_ms: {type: 'integer', description: 'Per-request timeout, default 20000'}}}, run: (g, a, ctx) => ta.tRefreshAdvisories(g, a, ctx)},
         {cap: 'hosted', name: 'pull_architecture_contract', description: 'NETWORK / explicit hosted profile: fetch the owner-approved target architecture for the active stable repository UUID, validate it and cache it locally. Sends only the opaque UUID with bearer auth; never source or paths. HTTP failures are returned as actionable AUTH_REQUIRED/FORBIDDEN/NOT_FOUND/REPOSITORY_NOT_READY states.', inputSchema: {type: 'object', properties: {timeout_ms: {type: 'integer', minimum: 1000, maximum: 120000, default: 30000}}}, run: (g, a, ctx) => ta.tPullArchitectureContract(g, a, ctx)},
         {cap: 'hosted', name: 'preview_sync', description: 'LOCAL SAFETY PREVIEW / no network: serialize the exact bounded hosted payload, validate the HTTPS destination, and show hostname/path, repository UUID, fields, sections, node/edge counts, bytes and body hash. Returns a five-minute confirmation token for sync_graph. Source bodies, snippets, absolute paths, environment values, credentials, Git remotes and unknown fields are excluded.', inputSchema: {type: 'object', properties: {payload_version: {type: 'integer', enum: [2, 3], default: 3, description: '3 includes bounded architecture/health/stack/package evidence; 2 is explicit graph-only compatibility'}}}, run: (g, a, ctx) => ta.tPreviewSyncGraph(g, a, ctx)},
         {cap: 'hosted', name: 'sync_graph', description: 'NETWORK / explicit hosted profile. Uploads only the exact payload created by preview_sync and requires dry_run:false plus its short-lived confirm_token after user approval. Calling without dry_run:false remains a no-network preview compatibility alias. Source bodies, snippets, absolute paths and unknown fields are never uploaded.', inputSchema: {type: 'object', properties: {payload_version: {type: 'integer', enum: [2, 3], default: 3, description: 'Used only when producing a compatibility preview; the approved token pins the exact serialized payload'}, dry_run: {type: 'boolean', default: true, description: 'Compatibility safety switch. Must be explicitly false to send.'}, confirm_token: {type: 'string', maxLength: 64, description: 'Short-lived token returned by preview_sync for the exact destination and payload'}, timeout_ms: {type: 'integer', minimum: 1000, maximum: 120000, default: 30000, description: 'Network timeout in milliseconds'}}}, run: (g, a, ctx) => ta.tSyncGraph(g, a, ctx)},

package/src/mcp/company-contract-verdict.mjs

@@ -0,0 +1,42 @@
+export function contractVerdict(analysis, transportAnalysis) {
+    const endpointsWithCallers = analysis.endpoints.filter((endpoint) => endpoint.callsites.length > 0)
+    const transportWithCallers = (transportAnalysis.contracts || []).filter((contract) => contract.callsites.length > 0)
+    const affectedFiles = new Set(), affectedScreens = new Set()
+    for (const contract of [...endpointsWithCallers, ...transportWithCallers]) {
+        for (const item of contract.affected.files || []) affectedFiles.add(`${item.client}\0${item.file}`)
+        for (const item of contract.affected.screens || []) affectedScreens.add(`${item.client}\0${item.file}`)
+    }
+    const totalContracts = analysis.totals.endpoints + transportAnalysis.totals.contracts
+    const totalMatches = analysis.totals.matches + transportAnalysis.totals.matches
+    let code = 'NO_ENDPOINTS_MATCHED', risk = 'unknown'
+    if (totalContracts > 0 && totalMatches === 0) {
+        code = analysis.totals.methodMismatches > 0 ? 'HTTP_METHOD_MISMATCH' : 'NO_STATIC_CLIENT_CALLERS'
+        risk = analysis.totals.methodMismatches > 0 ? 'high' : 'unknown'
+    } else if (totalMatches > 0 && analysis.totals.methodMismatches > 0) {
+        code = 'CLIENTS_AT_RISK_WITH_METHOD_MISMATCHES'; risk = 'high'
+    } else if (totalMatches > 0) {
+        code = 'CLIENTS_AT_RISK'; risk = 'medium'
+    }
+    return {
+        code, risk,
+        endpointsWithCallers: endpointsWithCallers.length + transportWithCallers.length,
+        callsites: totalMatches,
+        affectedFiles: affectedFiles.size,
+        affectedScreens: affectedScreens.size,
+        methodMismatches: analysis.totals.methodMismatches,
+        uncertainCalls: analysis.totals.uncertainCalls + transportAnalysis.totals.uncertain,
+        transportContracts: transportAnalysis.totals.contracts,
+        transportMatches: transportAnalysis.totals.matches,
+        notDeadExternalUse: analysis.totals.notDeadExternalUse,
+        notDeadExternalHandlers: analysis.totals.notDeadExternalHandlers,
+        possibleExternalUse: analysis.totals.possibleExternalUse,
+        unknownLiveness: analysis.totals.unknownLiveness,
+    }
+}
+
+export function contractVerdictLine(verdict, contracts) {
+    if (verdict.code === 'NO_ENDPOINTS_MATCHED') return 'VERDICT NO_ENDPOINTS_MATCHED — no backend contract satisfied the requested transport/method/path/change filter.'
+    if (verdict.code === 'NO_STATIC_CLIENT_CALLERS') return `VERDICT NO_STATIC_CLIENT_CALLERS — ${contracts} backend contract(s) matched, but no bounded static client call was proven; this is unknown, not proof of no consumers.`
+    if (verdict.code === 'HTTP_METHOD_MISMATCH') return `VERDICT HTTP_METHOD_MISMATCH — ${verdict.methodMismatches} client call(s) match the route shape with a different method.`
+    return `VERDICT ${verdict.code} — ${verdict.callsites} callsite(s) reach ${verdict.endpointsWithCallers} contract(s); ${verdict.affectedScreens} screen(s) and ${verdict.affectedFiles} file(s) are in the bounded blast radius.`
+}

package/src/mcp/evidence-snapshot.common.mjs

@@ -83,9 +83,7 @@ export function moduleId(value) {
 }
 
 export function nonNegativeInteger(value) {
-    return typeof value === 'number' && Number.isFinite(value) && value >= 0
-        ? Math.trunc(value)
-        : 0
+    return optionalNonNegativeInteger(value) ?? 0
 }
 
 export function optionalNonNegativeInteger(value) {

package/src/mcp/evidence-snapshot.health.mjs

@@ -3,6 +3,8 @@ import {
     normalizeCheckState, numericRecord, optionalNonNegativeInteger, privacySafeText, repoRelativePath,
     sanitizeFinding,
 } from './evidence-snapshot.common.mjs'
+import {summarizeFindings} from '../analysis/findings.js'
+import {auditFindingPathScope} from './health/audit-format.mjs'
 
 function buildHotspots(graph) {
     let analyzed = 0
@@ -40,7 +42,7 @@ function buildHotspots(graph) {
     return {analyzed, ...bounded(facts, CAPS.hotspots)}
 }
 
-export function buildHealthSection(graph, audit) {
+export function buildHealthSection(graph, audit, repoRoot = null) {
     if (!audit?.ok) {
         return {
             state: STATE.ERROR,
@@ -52,7 +54,12 @@ export function buildHealthSection(graph, audit) {
             complexity: {thresholds: COMPLEXITY_THRESHOLDS, analyzed: 0, hotspots: []},
         }
     }
-    const findings = bounded((audit.findings || []).map(sanitizeFinding).filter(Boolean)
+    // Public/private hosted evidence follows the same production-first path policy as
+    // run_audit. Classified-only findings remain available locally through
+    // include_classified:true, but must not turn a hosted production snapshot red.
+    const scopedFindings = auditFindingPathScope(audit.findings, {repoRoot}).findings
+    const scopedSummary = summarizeFindings(scopedFindings)
+    const findings = bounded(scopedFindings.map(sanitizeFinding).filter(Boolean)
         .sort((a, b) => compareText(a.severity, b.severity) || compareText(a.category, b.category) ||
             compareText(a.rule, b.rule) || compareText(a.file || a.package || '', b.file || b.package || '') || compareText(a.id, b.id)),
     CAPS.findings)
@@ -76,8 +83,8 @@ export function buildHealthSection(graph, audit) {
             reasons: state === STATE.PARTIAL ? ['OPTIONAL_CHECKS_INCOMPLETE'] : [],
         },
         summary: {
-            bySeverity: numericRecord(audit.summary?.bySeverity, ['critical', 'high', 'medium', 'low', 'info']),
-            byCategory: numericRecord(audit.summary?.byCategory, ['unused', 'structure', 'vulnerability', 'malware']),
+            bySeverity: numericRecord(scopedSummary.bySeverity, ['critical', 'high', 'medium', 'low', 'info']),
+            byCategory: numericRecord(scopedSummary.byCategory, ['unused', 'structure', 'vulnerability', 'malware']),
             dead: numericRecord(audit.deadReport, ['deadSymbols', 'deadFiles', 'unusedExports']),
             structure: numericRecord(audit.structureReport, [
                 'runtimeImportEdges', 'typeOnlyImportEdges', 'compileOnlyImportEdges', 'runtimeCycles',

package/src/mcp/evidence-snapshot.mjs

@@ -35,7 +35,7 @@ export async function createEvidenceSnapshot({repoRoot, graph}) {
     const sections = {
         architecture: buildArchitectureSection(inputGraph, aggregate, audit, structure),
         duplicates: buildDuplicatesSection(repoRoot, inputGraph),
-        health: buildHealthSection(inputGraph, audit),
+        health: buildHealthSection(inputGraph, audit, repoRoot),
         technologies: buildTechnologiesSection(stack, stackError),
         packages: buildPackagesSection(installedResult, installedError, inputGraph, audit, repoRoot),
     }

package/src/mcp/graph-diff.mjs

@@ -2,6 +2,7 @@
 import {buildFileImportGraph, findSccs} from '../analysis/dep-rules.js'
 import {folderModuleOf} from '../analysis/graph-analysis.aggregate.js'
 import {isStructuralRelation} from '../graph/relations.js'
+import {fileOfId} from '../graph/node-id.js'
 
 // ---- graph diff ----------------------------------------------------------------------------------
 // One previous state is enough (4-13 MB per repo — cheap): rebuild_graph snapshots the outgoing
@@ -10,7 +11,7 @@ import {isStructuralRelation} from '../graph/relations.js'
 // the signal is aggregated: module-dependency drift, cycle count changes, newly orphaned symbols.
 export const prevGraphPathFor = (graphPath) => String(graphPath).replace(/\.json$/, '.prev.json')
 export const edgeEndpoint = (v) => String(v && typeof v === 'object' ? v.id : v)
-export const fileOfId = (id) => { const s = String(id); const h = s.indexOf('#'); return h < 0 ? s : s.slice(0, h) }
+export {fileOfId}
 const folderOfFile = folderModuleOf
 
 const terminalLineSuffix = (id) => {

package/src/mcp/tools-architecture.mjs

@@ -1,6 +1,6 @@
 // Executable target architecture for agents: read the active contract before a change, then run the
 // same deterministic verifier after it. No tool silently edits policy or accepts debt.
-import {contractForChange, loadArchitectureContract, normalizeArchitectureContract, verifyArchitecture} from '../analysis/architecture-contract.js'
+import {contractForChange, normalizeArchitectureContract, verifyArchitecture} from '../analysis/architecture-contract.js'
 import {createPathClassifier, hasPathClass} from '../path-classification.js'
 import {detectRepoStack} from '../scan/discover.js'
 import {toolResult} from './tool-result.mjs'
@@ -13,6 +13,7 @@ const [starter, bootstrap] = await Promise.all([
 ])
 const {createArchitectureStarter, PROVISIONAL_BUDGETS} = starter
 export const tBootstrapArchitecture = bootstrap.tBootstrapArchitecture
+const activeContract = bootstrap.activeArchitectureContract
 
 const remediation = () => ({
     offlinePath: '.weavatrix/architecture.json',
@@ -29,11 +30,6 @@ const stackIds = (repoRoot) => {
     } catch { return [] }
 }
 
-function activeContract(ctx) {
-    if (!ctx?.repoRoot) return {contract: null, source: null, error: 'no repository root is active'}
-    return loadArchitectureContract(ctx.repoRoot, ctx.graphPath)
-}
-
 function notConfiguredResult(g, action, {includeStarter = false, repoRoot = null} = {}) {
     const proposal = includeStarter ? createArchitectureStarter(g, repoRoot) : null
     const starter = proposal?.contract || null

package/src/mcp/tools-company.mjs

@@ -3,13 +3,15 @@
 // can never pass an arbitrary filesystem path through this tool.
 import {join} from 'node:path'
 import {analyzeHttpContracts} from '../analysis/http-contracts.js'
+import {analyzeTransportContracts} from '../analysis/transport-contracts.js'
 import {buildGraphForRepo} from '../build-graph.js'
 import {graphHomeDir} from '../graph/layout.js'
 import {liveRepositoryRecords} from '../graph/repo-registry.js'
 import {loadGraph} from './graph-context.mjs'
 import {toolResult} from './tool-result.mjs'
+import {contractVerdict, contractVerdictLine} from './company-contract-verdict.mjs'
 
-const CROSS_REPO_HTTP_CONTRACT_V = 2
+const CROSS_REPO_HTTP_CONTRACT_V = 3
 const selectorText = (value) => String(value ?? '').trim()
 
 function selectRecord(records, selector) {
@@ -103,52 +105,6 @@ async function reconcileGraph(record, alias, role, graphHome) {
     }
 }
 
-function verdictFor(analysis) {
-    const endpointsWithCallers = analysis.endpoints.filter((endpoint) => endpoint.callsites.length > 0)
-    const affectedFiles = new Set()
-    const affectedScreens = new Set()
-    for (const endpoint of endpointsWithCallers) {
-        for (const item of endpoint.affected.files || []) affectedFiles.add(`${item.client}\0${item.file}`)
-        for (const item of endpoint.affected.screens || []) affectedScreens.add(`${item.client}\0${item.file}`)
-    }
-    let code = 'NO_ENDPOINTS_MATCHED', risk = 'unknown'
-    if (analysis.totals.endpoints > 0 && analysis.totals.matches === 0) {
-        code = analysis.totals.methodMismatches > 0 ? 'HTTP_METHOD_MISMATCH' : 'NO_STATIC_CLIENT_CALLERS'
-        risk = analysis.totals.methodMismatches > 0 ? 'high' : 'unknown'
-    } else if (analysis.totals.matches > 0 && analysis.totals.methodMismatches > 0) {
-        code = 'CLIENTS_AT_RISK_WITH_METHOD_MISMATCHES'; risk = 'high'
-    } else if (analysis.totals.matches > 0) {
-        code = 'CLIENTS_AT_RISK'; risk = 'medium'
-    }
-    return {
-        code,
-        risk,
-        endpointsWithCallers: endpointsWithCallers.length,
-        callsites: analysis.totals.matches,
-        affectedFiles: affectedFiles.size,
-        affectedScreens: affectedScreens.size,
-        methodMismatches: analysis.totals.methodMismatches,
-        uncertainCalls: analysis.totals.uncertainCalls,
-        notDeadExternalUse: analysis.totals.notDeadExternalUse,
-        notDeadExternalHandlers: analysis.totals.notDeadExternalHandlers,
-        possibleExternalUse: analysis.totals.possibleExternalUse,
-        unknownLiveness: analysis.totals.unknownLiveness,
-    }
-}
-
-function verdictLine(verdict, endpoints) {
-    if (verdict.code === 'NO_ENDPOINTS_MATCHED') {
-        return 'VERDICT NO_ENDPOINTS_MATCHED — no backend endpoint satisfied the requested method/path/change filter.'
-    }
-    if (verdict.code === 'NO_STATIC_CLIENT_CALLERS') {
-        return `VERDICT NO_STATIC_CLIENT_CALLERS — ${endpoints} backend endpoint(s) matched, but no bounded literal/template client call was proven; this is unknown, not proof of no consumers.`
-    }
-    if (verdict.code === 'HTTP_METHOD_MISMATCH') {
-        return `VERDICT HTTP_METHOD_MISMATCH — ${verdict.methodMismatches} client call(s) match the route shape with a different method.`
-    }
-    return `VERDICT ${verdict.code} — ${verdict.callsites} callsite(s) reach ${verdict.endpointsWithCallers} endpoint(s); ${verdict.affectedScreens} screen(s) and ${verdict.affectedFiles} file(s) are in the bounded blast radius.`
-}
-
 export async function tTraceApiContract(_g, args = {}, ctx = {}) {
     const graphHome = ctx.graphHome || graphHomeDir()
     const records = liveRepositoryRecords(graphHome)
@@ -215,7 +171,7 @@ export async function tTraceApiContract(_g, args = {}, ctx = {}) {
     }
 
     try {
-        const analysis = analyzeHttpContracts({
+        let analysis = analyzeHttpContracts({
             backend: {id: backendAlias, repoRoot: backend.repoPath, graph: backendGraph.graph},
             clients: clientGraphs.map((item) => ({id: item.alias, repoRoot: item.record.repoPath, graph: item.graph})),
             method: args.method,
@@ -229,9 +185,25 @@ export async function tTraceApiContract(_g, args = {}, ctx = {}) {
             maxEndpoints: args.max_endpoints,
             maxMatches: args.max_matches,
             maxAffectedFiles: args.max_affected_files,
+            runtimeValues: args.runtime_config,
         })
-        const verdict = verdictFor(analysis)
-        const reasons = [...new Set([...reconciliationReasons, ...(analysis.completeness?.reasons || [])])]
+        const selectedTransport = ['all', 'http', 'graphql', 'grpc', 'event'].includes(args.transport) ? args.transport : 'all'
+        if (!['all', 'http'].includes(selectedTransport)) analysis = {
+            ...analysis, status: 'complete', completeness: {complete: true, reasons: []}, endpoints: [], uncertain: [],
+            totals: {...analysis.totals, endpoints: 0, clientCalls: 0, matches: 0, methodMismatches: 0, uncertainCalls: 0, notDeadExternalUse: 0, notDeadExternalHandlers: 0, possibleExternalUse: 0, unknownLiveness: 0},
+        }
+        const transportAnalysis = selectedTransport === 'http'
+            ? {transportContractsV: 1, transport: 'http', status: 'COMPLETE', completeness: {complete: true, reasons: []}, totals: {contracts: 0, matches: 0, uncertain: 0, filesScanned: 0}, contracts: [], uncertain: []}
+            : analyzeTransportContracts({
+                backend: {id: backendAlias, repoRoot: backend.repoPath, graph: backendGraph.graph},
+                clients: clientGraphs.map((item) => ({id: item.alias, repoRoot: item.record.repoPath, graph: item.graph})),
+                transport: selectedTransport === 'all' ? 'all' : selectedTransport,
+                includeTests: args.include_tests === true,
+                maxImpactDepth: args.max_impact_depth,
+                maxAffectedFiles: args.max_affected_files,
+            })
+        const verdict = contractVerdict(analysis, transportAnalysis)
+        const reasons = [...new Set([...reconciliationReasons, ...(analysis.completeness?.reasons || []), ...(transportAnalysis.completeness?.reasons || [])])]
         const completeness = {
             complete: reasons.length === 0 && analysis.completeness?.complete === true,
             status: reasons.length === 0 && analysis.completeness?.complete === true ? 'COMPLETE' : 'PARTIAL',
@@ -243,8 +215,8 @@ export async function tTraceApiContract(_g, args = {}, ctx = {}) {
             right.affected.files.length - left.affected.files.length ||
             left.path.localeCompare(right.path))
         const lines = [
-            verdictLine(verdict, analysis.totals.endpoints),
-            `Scope: ${backend.label} → ${clients.map(({record}) => record.label).join(', ')}; ${analysis.totals.endpoints} endpoint(s), ${analysis.totals.clientCalls} inspected client call(s), ${analysis.totals.uncertainCalls} uncertain.`,
+            contractVerdictLine(verdict, analysis.totals.endpoints + transportAnalysis.totals.contracts),
+            `Scope: ${backend.label} → ${clients.map(({record}) => record.label).join(', ')}; ${analysis.totals.endpoints} HTTP endpoint(s), ${transportAnalysis.totals.contracts} GraphQL/gRPC/event contract(s), ${analysis.totals.clientCalls} inspected HTTP call(s), ${verdict.uncertainCalls} uncertain.`,
             ...ranked.slice(0, topN).flatMap((endpoint) => {
                 const location = endpoint.file ? ` (${endpoint.backend}:${endpoint.file}${endpoint.line ? `:${endpoint.line}` : ''})` : ''
                 const callsites = endpoint.callsites.slice(0, 3)
@@ -257,8 +229,10 @@ export async function tTraceApiContract(_g, args = {}, ctx = {}) {
                     ...screens,
                 ]
             }),
+            ...transportAnalysis.contracts.filter((contract) => contract.callsites.length).slice(0, topN).map((contract) =>
+                `  ${contract.transport.toUpperCase()} ${contract.service ? `${contract.service}.` : contract.operation ? `${contract.operation} ` : ''}${contract.name} (${contract.file}:${contract.line}) [${contract.liveness}] → ${contract.callsites.length} callsite(s), ${contract.affected.files.length} affected file(s)`),
             completeness.complete
-                ? 'Completeness: complete within the declared repository graphs and static HTTP-call model.'
+                ? 'Completeness: complete within the declared repository graphs and supported static HTTP/GraphQL/gRPC/event models.'
                 : `Completeness: partial — ${completeness.reasons.join('; ')}.`,
         ]
         const result = {
@@ -269,6 +243,7 @@ export async function tTraceApiContract(_g, args = {}, ctx = {}) {
                 clients: clients.map(({record, alias}) => publicRecord(record, alias)),
             },
             ...analysis,
+            transportContracts: transportAnalysis,
             status: completeness.status,
             graphReconciliation,
             completeness,