weavatrix 0.2.19 → 0.3.1

package/src/analysis/jvm-dependency-evidence.js

@@ -1,6 +1,7 @@
 import { createRepoBoundary } from "../repo-path.js";
 import { dependencyVerification, makeFinding } from "./findings.js";
 import { parseGradleDependencies, parseGradleVersionCatalog, parseMavenPom } from "./jvm-manifests.js";
+import { collectJvmArtifactIndex } from "./jvm-artifact-index.js";
 import { listRepoFiles, readRepoText } from "./internal-audit.collect.js";
 
 const normalize = (value) => String(value || "").toLowerCase().replace(/[^a-z0-9]+/g, "");
@@ -24,12 +25,18 @@ function bestDependency(spec, dependencies) {
   return ranked[0].dependency;
 }
 
-function analyze(ecosystem, manifests, dependencies, imports, unresolvedDeclarations, mappingDependencies = dependencies, includeMissing = true) {
+function analyze(ecosystem, manifests, dependencies, imports, unresolvedDeclarations, mappingDependencies = dependencies, includeMissing = true, artifactEvidence) {
   const findings = [], used = new Map(), missing = new Map();
   const owned = new Set(dependencies.map((dependency) => dependency.name));
+  let exactMappedImports = 0, heuristicMappedImports = 0, ambiguousImports = 0;
   for (const item of imports) {
-    const dependency = bestDependency(item.spec || item.pkg, mappingDependencies);
+    const exactOwners = artifactEvidence.resolve(item.spec || item.pkg);
+    if (exactOwners.length > 1) ambiguousImports++;
+    const dependency = exactOwners.length === 1
+      ? mappingDependencies.find((candidate) => candidate.name === exactOwners[0])
+      : bestDependency(item.spec || item.pkg, mappingDependencies);
     if (dependency) {
+      if (exactOwners.length === 1) exactMappedImports++; else heuristicMappedImports++;
       if (owned.has(dependency.name)) {
         const list = used.get(dependency.name) || [];
         list.push(item); used.set(dependency.name, list);
@@ -69,21 +76,36 @@ function analyze(ecosystem, manifests, dependencies, imports, unresolvedDeclarat
     }));
   }
   const present = manifests.length > 0;
+  const exactComplete = present && unresolvedDeclarations === 0 && !artifactEvidence.truncated
+    && artifactEvidence.errors.length === 0 && artifactEvidence.artifactsMissing === 0
+    && artifactEvidence.artifactsIndexed === artifactEvidence.artifactsRequired
+    && exactMappedImports === imports.length && ambiguousImports === 0;
   return {
     present,
     status: present ? "CHECKED" : "NOT_PRESENT",
-    completeness: present ? (unresolvedDeclarations ? "PARTIAL" : "COMPLETE") : "NOT_APPLICABLE",
+    completeness: present ? (exactComplete ? "COMPLETE" : "PARTIAL") : "NOT_APPLICABLE",
     manifests,
     declared: dependencies.length,
     mappedImports: [...used.values()].reduce((sum, list) => sum + list.length, 0),
     unmappedImports: [...missing.values()].reduce((sum, list) => sum + list.length, 0),
     unresolvedDeclarations,
+    exactArtifactEvidence: {
+      artifactsRequired: artifactEvidence.artifactsRequired,
+      artifactsIndexed: artifactEvidence.artifactsIndexed,
+      artifactsMissing: artifactEvidence.artifactsMissing,
+      classesIndexed: artifactEvidence.classCount,
+      exactMappedImports,
+      heuristicMappedImports,
+      ambiguousImports,
+      truncated: artifactEvidence.truncated,
+      errors: artifactEvidence.errors.slice(0, 10),
+    },
     sample: dependencies.slice(0, 20).map(({ file, name, version }) => ({ file, identity: name, version })),
     reason: !present
       ? `No ${ecosystem === "maven" ? "pom.xml" : "Gradle build file"} was discovered.`
-      : unresolvedDeclarations
-        ? `${dependencies.length} declarations and all indexed Java imports were checked, but ${unresolvedDeclarations} dynamic/property/catalog declaration(s) could not be resolved statically.`
-        : `${dependencies.length} declarations were compared with every indexed non-JDK Java import using bounded group-prefix and artifact-token evidence. Missing and unused results remain review evidence, not compiler proof.`,
+      : exactComplete
+        ? `${dependencies.length} declarations were compared with every indexed non-JDK Java import using exact class ownership from ${artifactEvidence.artifactsIndexed} installed JAR(s).`
+        : `${dependencies.length} declarations and every indexed non-JDK Java import were checked, but exact artifact evidence is partial: ${unresolvedDeclarations} unresolved declaration(s), ${artifactEvidence.artifactsMissing} installed JAR(s) missing, ${heuristicMappedImports} heuristic mapping(s), ${ambiguousImports} ambiguous mapping(s). Heuristic missing/unused findings remain review evidence, never compiler proof.`,
     findings,
   };
 }
@@ -108,8 +130,9 @@ export function collectJvmDependencyEvidence(repoRoot, { files = listRepoFiles(r
   });
   const javaImports = externalImports.filter((entry) => entry.ecosystem === "Maven" && entry.pkg && !entry.builtin && !entry.unresolved);
   const allDependencies = [...mavenDependencies, ...gradleDependencies];
+  const artifactEvidence = collectJvmArtifactIndex(allDependencies);
   return {
-    maven: analyze("maven", mavenFiles, mavenDependencies, javaImports, mavenUnresolved, allDependencies, true),
-    gradle: analyze("gradle", [...gradleFiles, ...catalogFiles], gradleDependencies, javaImports, gradleUnresolved, allDependencies, mavenFiles.length === 0),
+    maven: analyze("maven", mavenFiles, mavenDependencies, javaImports, mavenUnresolved, allDependencies, true, artifactEvidence),
+    gradle: analyze("gradle", [...gradleFiles, ...catalogFiles], gradleDependencies, javaImports, gradleUnresolved, allDependencies, mavenFiles.length === 0, artifactEvidence),
   };
 }

package/src/analysis/transport-contracts.js

@@ -2,6 +2,7 @@ import { createRepoBoundary } from "../repo-path.js";
 import { lineNumberAt, uniqueBy } from "../util.js";
 import { listRepoFiles, readRepoText } from "./internal-audit/repo-files.js";
 import { affectedForEndpoint, reverseRuntimeImports } from "./http-contracts/graph-context.js";
+import { loadTransportRuntimeEvidence } from "./transport-runtime-evidence.js";
 
 const TEST_RE = /(^|\/)(?:test|tests|__tests__|spec|e2e|fixtures?)(\/|$)|[._-](?:test|spec)\.[a-z0-9]+$/i;
 const SOURCE_RE = /\.(?:[cm]?[jt]sx?|py|go|java|rs|cs|proto|graphql|gql)$/i;
@@ -89,6 +90,31 @@ function eventEvidence(source, role) {
   return { contracts, uncertain };
 }
 
+const contractIdentity = (item) => `${item.transport}|${item.side}|${norm(item.service)}|${item.operation || ""}|${item.name}`;
+
+function mergeRuntimeContracts(staticContracts, observations) {
+  const contracts = staticContracts.map((item) => ({ ...item, evidence: ["STATIC"] }));
+  const byIdentity = new Map(contracts.map((item) => [contractIdentity(item), item]));
+  for (const observation of observations) {
+    const key = contractIdentity(observation);
+    const existing = byIdentity.get(key);
+    if (existing) {
+      existing.runtimeObserved = true;
+      existing.observedCount = (existing.observedCount || 0) + observation.observedCount;
+      existing.evidence = ["STATIC", "RUNTIME"];
+      continue;
+    }
+    const added = { ...observation, evidence: ["RUNTIME"] };
+    contracts.push(added); byIdentity.set(key, added);
+  }
+  return contracts;
+}
+
+function sameRuntimeLocation(uncertain, observation) {
+  return observation.file && observation.line && observation.transport === uncertain.transport &&
+    observation.file === uncertain.file && observation.line === uncertain.line;
+}
+
 function detect(descriptor, role, options) {
   const loaded = sourcesFor(descriptor, options), contracts = [], uncertain = [];
   for (const source of loaded.sources) {
@@ -97,29 +123,52 @@ function detect(descriptor, role, options) {
       contracts.push(...result.contracts); uncertain.push(...result.uncertain);
     }
   }
+  const runtime = loadTransportRuntimeEvidence(descriptor, {
+    file: options.runtimeEvidenceFiles?.[descriptor.id],
+    maxAgeHours: options.runtimeEvidenceMaxAgeHours,
+    transport: options.transport,
+    now: options.now,
+  });
+  const runtimeContracts = runtime.observations.filter((item) => options.transport === "all" || item.transport === options.transport);
+  const resolvedRuntime = uncertain.filter((item) => runtimeContracts.some((observation) => sameRuntimeLocation(item, observation)));
+  const unresolved = uncertain.filter((item) => !runtimeContracts.some((observation) => sameRuntimeLocation(item, observation)));
   return {
-    contracts: uniqueBy(contracts, (item) => `${item.transport}|${item.side}|${item.service || ""}|${item.operation || ""}|${item.name}|${item.file}|${item.line}`),
-    uncertain: uniqueBy(uncertain, (item) => `${item.transport}|${item.file}|${item.line}|${item.reason}`),
-    reasons: loaded.reasons,
+    contracts: mergeRuntimeContracts(
+      uniqueBy(contracts, (item) => `${item.transport}|${item.side}|${item.service || ""}|${item.operation || ""}|${item.name}|${item.file}|${item.line}`),
+      runtimeContracts,
+    ),
+    uncertain: uniqueBy(unresolved, (item) => `${item.transport}|${item.file}|${item.line}|${item.reason}`),
+    resolvedRuntime: uniqueBy(resolvedRuntime, (item) => `${item.transport}|${item.file}|${item.line}|${item.reason}`),
+    reasons: [...loaded.reasons, ...runtime.reasons],
+    runtime,
     filesScanned: loaded.sources.length,
   };
 }
 
 function contractMatch(server, caller, backendServers) {
   if (server.transport !== caller.transport) return null;
-  if (server.transport === "graphql" && caller.side === "client" && server.operation === caller.operation && server.name === caller.name) return { confidence: "high", kind: "operation-field" };
+  const runtime = server.runtimeObserved || caller.runtimeObserved;
+  const match = (kind) => ({ confidence: "high", kind, evidence: runtime ? "RUNTIME_OBSERVED" : "STATIC" });
+  if (server.transport === "graphql" && caller.side === "client" && server.operation === caller.operation && server.name === caller.name) return match("operation-field");
   if (server.transport === "grpc" && caller.side === "client" && norm(server.name) === norm(caller.name)) {
-    if (caller.service && norm(server.service) === norm(caller.service)) return { confidence: "high", kind: "service-method" };
+    if (caller.service && norm(server.service) === norm(caller.service)) return match("service-method");
     const sameMethod = backendServers.filter((item) => item.transport === "grpc" && norm(item.name) === norm(caller.name));
-    if (!caller.service && sameMethod.length === 1) return { confidence: "medium", kind: "unique-method" };
+    if (!caller.service && sameMethod.length === 1) return { confidence: "medium", kind: "unique-method", evidence: runtime ? "RUNTIME_OBSERVED" : "STATIC" };
   }
-  if (server.transport === "event" && server.name === caller.name && server.side !== caller.side) return { confidence: "high", kind: "topic-direction" };
+  if (server.transport === "event" && server.name === caller.name && server.side !== caller.side) return match("topic-direction");
   return null;
 }
 
 export function analyzeTransportContracts(input = {}) {
   const transport = ["all", "graphql", "grpc", "event"].includes(input.transport) ? input.transport : "all";
-  const options = { includeTests: input.includeTests === true, maxFiles: Math.max(1, Math.min(10_000, Number(input.maxFiles) || 3_000)) };
+  const options = {
+    includeTests: input.includeTests === true,
+    maxFiles: Math.max(1, Math.min(10_000, Number(input.maxFiles) || 3_000)),
+    transport,
+    runtimeEvidenceFiles: input.runtimeEvidenceFiles || {},
+    runtimeEvidenceMaxAgeHours: input.runtimeEvidenceMaxAgeHours,
+    now: input.now,
+  };
   const backend = detect(input.backend, "backend", options);
   const clients = (input.clients || []).map((descriptor) => ({ descriptor, evidence: detect(descriptor, "client", options), reverse: reverseRuntimeImports(descriptor.graph) }));
   const selected = (item) => transport === "all" || item.transport === transport;
@@ -131,7 +180,7 @@ export function analyzeTransportContracts(input = {}) {
     for (const client of clients) for (const caller of client.evidence.contracts.filter(selected)) {
       const match = contractMatch(server, caller, servers);
       if (!match) continue;
-      callsites.push({ clientRepo: client.descriptor.id, file: caller.file, line: caller.line, detector: caller.detector, match });
+      callsites.push({ clientRepo: client.descriptor.id, file: caller.file, line: caller.line, detector: caller.detector, match, runtimeObserved: caller.runtimeObserved === true, observedCount: caller.observedCount });
     }
     const affected = affectedForEndpoint(callsites, clients.map((item) => ({ id: item.descriptor.id, reverse: item.reverse })), {
       maxImpactDepth: Math.max(0, Math.min(5, Number(input.maxImpactDepth) || 2)),
@@ -145,13 +194,31 @@ export function analyzeTransportContracts(input = {}) {
   ].filter(selected);
   const reasons = [...backend.reasons, ...clients.flatMap((item) => item.evidence.reasons)];
   if (uncertain.length) reasons.push(`${uncertain.length} dynamic/reflection contract expression(s) remain UNKNOWN`);
+  const runtimeReports = [
+    { repository: input.backend.id, ...backend.runtime },
+    ...clients.map((item) => ({ repository: item.descriptor.id, ...item.evidence.runtime })),
+  ];
+  const resolvedRuntime = backend.resolvedRuntime.length + clients.reduce((sum, item) => sum + item.evidence.resolvedRuntime.length, 0);
   return {
-    transportContractsV: 1,
+    transportContractsV: 2,
     transport,
     status: reasons.length ? "PARTIAL" : "COMPLETE",
     completeness: { complete: reasons.length === 0, reasons: [...new Set(reasons)] },
-    totals: { contracts: results.length, matches: results.reduce((sum, item) => sum + item.callsites.length, 0), uncertain: uncertain.length, filesScanned: backend.filesScanned + clients.reduce((sum, item) => sum + item.evidence.filesScanned, 0) },
+    totals: {
+      contracts: results.length,
+      matches: results.reduce((sum, item) => sum + item.callsites.length, 0),
+      uncertain: uncertain.length,
+      filesScanned: backend.filesScanned + clients.reduce((sum, item) => sum + item.evidence.filesScanned, 0),
+      runtimeObservations: runtimeReports.reduce((sum, item) => sum + item.observations.length, 0),
+      runtimeResolved: resolvedRuntime,
+      runtimeReportsComplete: runtimeReports.filter((item) => item.status === "COMPLETE").length,
+    },
     contracts: results,
     uncertain: uncertain.slice(0, 200),
+    runtimeEvidence: {
+      status: runtimeReports.every((item) => item.status === "COMPLETE") ? "COMPLETE" : "PARTIAL",
+      reports: runtimeReports.map(({ observations, reasons: reportReasons, ...report }) => ({ ...report, observationCount: observations.length, reasons: reportReasons })),
+      resolvedUnknowns: resolvedRuntime,
+    },
   };
 }

package/src/analysis/transport-runtime-evidence.js

@@ -0,0 +1,155 @@
+import { readFileSync, statSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+import { createRepoBoundary, isPathInside } from "../repo-path.js";
+
+const TRANSPORT_RUNTIME_SCHEMA = "weavatrix.transport-runtime.v1";
+const TRANSPORTS = ["graphql", "grpc", "event"];
+const DEFAULT_REPORTS = [
+  ".weavatrix/transport-runtime.json",
+  ".weavatrix/reports/transport-runtime.json",
+];
+const MAX_REPORT_BYTES = 2 * 1024 * 1024;
+const MAX_OBSERVATIONS = 10_000;
+
+const text = (value, max = 256) => typeof value === "string" ? value.trim().slice(0, max) : "";
+const number = (value) => Number.isFinite(Number(value)) ? Number(value) : undefined;
+
+function requestedTransports(transport) {
+  return TRANSPORTS.includes(transport) ? [transport] : TRANSPORTS;
+}
+
+function reportPath(descriptor, candidate) {
+  const boundary = createRepoBoundary(descriptor.repoRoot);
+  const resolved = boundary.resolve(candidate);
+  return resolved.ok ? { boundary, path: resolved.path } : { boundary, reason: resolved.reason };
+}
+
+function safeSourceFile(descriptor, value) {
+  const raw = text(value, 1024).replace(/\\/g, "/");
+  if (!raw || raw.includes("\0")) return undefined;
+  if (!isAbsolute(raw) && !raw.startsWith("../") && !raw.includes("/../")) return raw.replace(/^\.\//, "");
+  const root = resolve(descriptor.repoRoot);
+  const target = resolve(raw);
+  return isPathInside(root, target) ? relative(root, target).replace(/\\/g, "/") : undefined;
+}
+
+function attributeValue(attribute) {
+  const value = attribute?.value ?? attribute;
+  for (const key of ["stringValue", "intValue", "doubleValue", "boolValue"]) {
+    if (value?.[key] !== undefined) return value[key];
+  }
+  return typeof value === "string" || typeof value === "number" || typeof value === "boolean" ? value : undefined;
+}
+
+function attributes(input) {
+  const out = new Map();
+  for (const item of Array.isArray(input) ? input : []) if (typeof item?.key === "string") out.set(item.key, attributeValue(item));
+  return out;
+}
+
+function spanSide(span, transport) {
+  const kind = String(span?.kind ?? "").toUpperCase();
+  const numeric = Number(span?.kind);
+  if (transport === "event") {
+    if (kind.includes("PRODUCER") || numeric === 4) return "publisher";
+    if (kind.includes("CONSUMER") || numeric === 5) return "subscriber";
+  }
+  if (kind.includes("SERVER") || numeric === 2) return "server";
+  if (kind.includes("CLIENT") || numeric === 3) return "client";
+  return "";
+}
+
+function observationFromSpan(descriptor, span) {
+  const attrs = attributes(span?.attributes);
+  const common = {
+    file: safeSourceFile(descriptor, attrs.get("code.file.path") ?? attrs.get("code.filepath")),
+    line: number(attrs.get("code.line.number") ?? attrs.get("code.lineno")),
+    observedCount: 1,
+    detector: "otlp-span",
+  };
+  const rpcSystem = text(attrs.get("rpc.system")).toLowerCase();
+  if (rpcSystem === "grpc") {
+    const fallback = text(span?.name).split("/").filter(Boolean);
+    return { ...common, transport: "grpc", side: spanSide(span, "grpc"), service: text(attrs.get("rpc.service")) || fallback.at(-2), name: text(attrs.get("rpc.method")) || fallback.at(-1) };
+  }
+  const graphOperation = text(attrs.get("graphql.operation.type")).toUpperCase();
+  const graphField = text(attrs.get("graphql.field.name") ?? attrs.get("graphql.field"));
+  if (graphOperation || graphField) return { ...common, transport: "graphql", side: spanSide(span, "graphql"), operation: graphOperation, name: graphField };
+  const messagingSystem = text(attrs.get("messaging.system")).toLowerCase();
+  const destination = text(attrs.get("messaging.destination.name") ?? attrs.get("messaging.destination"));
+  if (messagingSystem || destination) return { ...common, transport: "event", side: spanSide(span, "event"), kind: text(attrs.get("messaging.operation.type") ?? attrs.get("messaging.operation")), name: destination };
+  return null;
+}
+
+function otlpObservations(descriptor, report) {
+  const root = report.otlp && typeof report.otlp === "object" ? report.otlp : report;
+  const out = [];
+  for (const resource of Array.isArray(root.resourceSpans) ? root.resourceSpans : []) {
+    const scopes = resource.scopeSpans ?? resource.instrumentationLibrarySpans ?? [];
+    for (const scope of scopes) for (const span of Array.isArray(scope.spans) ? scope.spans : []) {
+      const observation = observationFromSpan(descriptor, span);
+      if (observation) out.push(observation);
+    }
+  }
+  return out;
+}
+
+function normalizeObservation(descriptor, raw) {
+  const transport = text(raw?.transport).toLowerCase();
+  const side = text(raw?.side).toLowerCase();
+  const name = text(raw?.name);
+  if (!TRANSPORTS.includes(transport) || !name) return null;
+  const allowedSides = transport === "event" ? ["publisher", "subscriber"] : ["server", "client", "server-call"];
+  if (!allowedSides.includes(side)) return null;
+  const operation = text(raw?.operation).toUpperCase();
+  if (transport === "graphql" && !["QUERY", "MUTATION", "SUBSCRIPTION"].includes(operation)) return null;
+  const line = number(raw?.line);
+  return {
+    transport, side, name,
+    ...(operation ? { operation } : {}),
+    ...(text(raw?.service) ? { service: text(raw.service) } : {}),
+    ...(text(raw?.kind) ? { kind: text(raw.kind) } : {}),
+    ...(safeSourceFile(descriptor, raw?.file) ? { file: safeSourceFile(descriptor, raw.file) } : {}),
+    ...(line > 0 && line <= 10_000_000 ? { line: Math.floor(line) } : {}),
+    observedCount: Math.max(1, Math.min(1_000_000_000, Math.floor(number(raw?.observedCount) || 1))),
+    detector: text(raw?.detector) || "runtime-report",
+    runtimeObserved: true,
+  };
+}
+
+function validateReport(descriptor, report, options, file) {
+  const reasons = [];
+  let usable = true;
+  if (report?.schema !== TRANSPORT_RUNTIME_SCHEMA) { reasons.push(`${descriptor.id}: unsupported runtime evidence schema`); usable = false; }
+  if (!descriptor.graph?.graphRevision || report?.repositoryRevision !== descriptor.graph.graphRevision) { reasons.push(`${descriptor.id}: runtime evidence revision does not match the active graph`); usable = false; }
+  const generatedAt = Date.parse(report?.generatedAt);
+  const now = Number(options.now ?? Date.now());
+  const maxAgeMs = Math.max(1, Math.min(8760, Number(options.maxAgeHours) || 168)) * 3_600_000;
+  if (!Number.isFinite(generatedAt)) { reasons.push(`${descriptor.id}: runtime evidence generatedAt is invalid`); usable = false; }
+  else if (generatedAt > now + 300_000 || now - generatedAt > maxAgeMs) { reasons.push(`${descriptor.id}: runtime evidence is stale or from the future`); usable = false; }
+  const selected = requestedTransports(options.transport);
+  const coverage = Object.fromEntries(selected.map((item) => [item, String(report?.coverage?.[item] || "NOT_CHECKED").toUpperCase()]));
+  for (const [item, status] of Object.entries(coverage)) if (status !== "COMPLETE") reasons.push(`${descriptor.id}: ${item} runtime capture is ${status}`);
+  const raw = [...(Array.isArray(report?.observations) ? report.observations : []), ...otlpObservations(descriptor, report)].slice(0, MAX_OBSERVATIONS);
+  const observations = usable ? raw.map((item) => normalizeObservation(descriptor, item)).filter(Boolean) : [];
+  if (raw.length !== observations.length) reasons.push(`${descriptor.id}: ${raw.length - observations.length} invalid runtime observation(s) were ignored`);
+  return { status: reasons.length ? "PARTIAL" : "COMPLETE", file, generatedAt: report?.generatedAt, repositoryRevision: report?.repositoryRevision, coverage, observations, reasons };
+}
+
+export function loadTransportRuntimeEvidence(descriptor, options = {}) {
+  const candidates = options.file ? [String(options.file)] : DEFAULT_REPORTS;
+  for (const candidate of candidates) {
+    const resolved = reportPath(descriptor, candidate);
+    if (!resolved.path) {
+      if (options.file) return { status: "ERROR", file: candidate, coverage: {}, observations: [], reasons: [`${descriptor.id}: runtime evidence path is ${resolved.reason}`] };
+      continue;
+    }
+    try {
+      if (statSync(resolved.path).size > MAX_REPORT_BYTES) return { status: "ERROR", file: candidate, coverage: {}, observations: [], reasons: [`${descriptor.id}: runtime evidence exceeds ${MAX_REPORT_BYTES} bytes`] };
+      return validateReport(descriptor, JSON.parse(readFileSync(resolved.path, "utf8")), options, candidate);
+    } catch {
+      return { status: "ERROR", file: candidate, coverage: {}, observations: [], reasons: [`${descriptor.id}: runtime evidence is unreadable or invalid JSON`] };
+    }
+  }
+  return { status: "NOT_CHECKED", file: null, coverage: {}, observations: [], reasons: [`${descriptor.id}: no revision-bound runtime transport evidence was found`] };
+}

package/src/child-env.js

@@ -1,5 +1,5 @@
-// Child processes and worker threads do not need the hosted-sync bearer token.
-// Keep it in the MCP process so only sync_graph can attach it to an HTTP request.
+// Child processes and worker threads never need credentials owned by a composing connector.
+// Keep connector secrets in the parent MCP process and out of Git/LSP/test subprocesses.
 export function childProcessEnv(overrides = {}) {
   const env = { ...process.env, ...overrides };
   delete env.WEAVATRIX_SYNC_TOKEN;

package/src/extension/local-services.mjs

@@ -0,0 +1,75 @@
+import {readFileSync, statSync} from 'node:fs'
+import {createHash} from 'node:crypto'
+import {basename} from 'node:path'
+import {graphStaleness} from '../mcp/graph-context.mjs'
+import {createSyncPayload, createSyncPayloadV3, MAX_SYNC_BODY_BYTES} from '../mcp/sync-payload.mjs'
+import {createEvidenceSnapshot} from '../mcp/evidence-snapshot.mjs'
+import {graphHomeDir, graphOutDirForRepo} from '../graph/layout.js'
+import {registerRepository, repositoryRecord} from '../graph/repo-registry.js'
+import {writeCachedArchitectureContract} from '../analysis/architecture-contract.js'
+import {collectInstalled} from '../security/installed.js'
+import {toolResult} from '../mcp/tool-result.mjs'
+import {
+    commitAdvisoryRefresh, createAdvisoryQueryPlan, DEFAULT_STORE, storeMeta,
+} from '../security/advisory-store.js'
+
+const MAX_GRAPH_FILE_BYTES = 64 * 1024 * 1024
+
+const repositoryLabel = (repoRoot) => {
+    const safe = basename(String(repoRoot || '')).normalize('NFKC').replace(/[^a-z0-9._-]+/gi, '-').replace(/^-+|-+$/g, '')
+    return (safe || 'repo').slice(0, 128)
+}
+
+const identityFor = (repoRoot) => repositoryRecord(repoRoot, graphHomeDir())
+    || registerRepository({repoPath: repoRoot, graphDir: graphOutDirForRepo(repoRoot), graphHome: graphHomeDir()})
+
+// Produces the exact source-free wire material locally. It reads no credentials and performs no
+// network I/O; the caller owns destination policy, consent, authentication and transport.
+export async function createSourceFreeSyncMaterial(graph, {payloadVersion = 3} = {}, ctx = {}) {
+    if (!graph) throw new Error('No graph loaded — build one first (open_repo / rebuild_graph).')
+    if (!ctx.graphPath || !ctx.repoRoot) throw new Error('No active repository graph — open_repo first.')
+    const size = statSync(ctx.graphPath).size
+    if (size > MAX_GRAPH_FILE_BYTES) throw new Error(`graph.json exceeds the ${MAX_GRAPH_FILE_BYTES / 1024 / 1024} MB local safety limit`)
+    const raw = JSON.parse(readFileSync(ctx.graphPath, 'utf8'))
+    let payload
+    if (Number(payloadVersion) === 2) {
+        payload = createSyncPayload(raw)
+    } else {
+        if (graphStaleness(ctx).stale) throw new Error('Cannot produce synchronized evidence from a stale graph. Run rebuild_graph first.')
+        payload = createSyncPayloadV3(raw, await createEvidenceSnapshot({repoRoot: ctx.repoRoot, graph: raw}))
+    }
+    const body = JSON.stringify(payload)
+    const bodyBytes = Buffer.byteLength(body)
+    if (bodyBytes > MAX_SYNC_BODY_BYTES) throw new Error(`source-free payload exceeds the ${MAX_SYNC_BODY_BYTES / 1024} KB safety limit`)
+    const identity = identityFor(ctx.repoRoot)
+    return Object.freeze({
+        payload,
+        body,
+        bodyBytes,
+        bodyHash: createHash('sha256').update(body).digest('hex'),
+        repoName: repositoryLabel(ctx.repoRoot),
+        repositoryId: identity.repositoryId,
+        graphPath: ctx.graphPath,
+    })
+}
+
+export function activeRepositoryIdentity(ctx = {}) {
+    if (!ctx.repoRoot || !ctx.graphPath) throw new Error('No active repository graph — open_repo first.')
+    const identity = identityFor(ctx.repoRoot)
+    return Object.freeze({repositoryId: identity.repositoryId, repoName: repositoryLabel(ctx.repoRoot), graphPath: ctx.graphPath})
+}
+
+export const cacheArchitectureContract = (graphPath, contract) => writeCachedArchitectureContract(graphPath, contract)
+
+export function installedPackageCoordinates(repoRoot) {
+    if (!repoRoot) throw new Error('No repository root is active.')
+    return collectInstalled(repoRoot).installed
+}
+
+export const advisoryCacheMetadata = (storePath = DEFAULT_STORE) => ({
+    path: storePath,
+    ...storeMeta(storePath),
+})
+
+export {commitAdvisoryRefresh, createAdvisoryQueryPlan}
+export {toolResult}

package/src/graph/internal-builder.langs.js

@@ -50,6 +50,7 @@ const isDataFile = (p) => DATA_EXT.has(extname(p)) || INFRA_NAME.test(String(p))
 // Claude Code / Codex node. AGENT_DOTFILE lets a few AI-agent instruction dotfiles past the dotfile skip below.
 const DOC_EXT = new Set([".md", ".mdx", ".markdown", ".mdown", ".mkd", ".mkdn", ".rst", ".adoc", ".asciidoc"]);
 const AGENT_DOTFILE = /^\.(cursorrules|windsurfrules|clinerules)$/i;
+const RUNTIME_EVIDENCE = /^\.weavatrix\/(?:reports\/)?transport-runtime\.json$/i;
 const isDocFile = (p) => DOC_EXT.has(extname(p)) || AGENT_DOTFILE.test(String(p).split(/[\\/]/).pop() || "");
 const SKIP = new Set(["node_modules", ".git", "dist", "build", "coverage", "vendor", "weavatrix-graphs", "weavatrix-graphs", ".next", "out", "__pycache__", ".venv", "venv", "env", ".tox", "site-packages", ".mypy_cache", ".pytest_cache"]);
 const MAX_PARSE_BYTES = 1_500_000;   // skip parsing files above this (minified bundles / generated blobs wedge tree-sitter)
@@ -139,6 +140,7 @@ function gitFileUniverse(dir) {
   const files = [];
   for (const rel of raw.split("\0")) {
     if (!rel) continue;
+    if (RUNTIME_EVIDENCE.test(rel.replace(/\\/g, "/"))) continue; // runtime output must not change the source revision it attests
     const full = join(dir, rel);
     let real; try { real = realpathSync.native(full); } catch { continue; } // deleted index entry
     if (!isPathInside(rootReal, real)) continue; // tracked symlink/junction escaping the repo

package/src/graph/repo-registry.js

@@ -1,5 +1,5 @@
-// Global local registry for repository graphs. Absolute paths never leave the machine; hosted sync
-// uses the opaque UUID. Identity is anchored in each canonical graph folder so simultaneous MCP
+// Global local registry for repository graphs. Absolute paths never leave the machine; composing
+// extensions may use the opaque UUID. Identity is anchored in each canonical graph folder so simultaneous MCP
 // processes cannot mint different IDs for the same repository.
 import {randomUUID} from 'node:crypto'
 import {existsSync, mkdirSync, readFileSync, realpathSync, statSync, writeFileSync} from 'node:fs'