weavatrix 0.2.6 → 0.2.8

package/src/mcp/tools-graph.mjs

@@ -3,10 +3,11 @@
 // staleness probe in graph-context. Hot-reloadable (re-imported by catalog.mjs on change).
 import {
     isSymbol, degreeOf, labelOf, connList,
-    resolveNodeInfo, resolveNode, ambiguityNote, findSeeds, resolveSeedFiles, undirectedNeighbors,
+    resolveNodeInfo, resolveNode, ambiguityNote, findSeeds, resolveSeedFiles, undirectedNeighbors, requestedPathClasses,
     graphStaleness, fileStalenessNote,
 } from './graph-context.mjs'
 import {summarizeEdgeProvenance} from '../graph/edge-provenance.js'
+import {createPathClassifier, hasPathClass} from '../path-classification.js'
 
 const compileKind = (edge) => edge?.typeOnly === true ? 'type-only' : edge?.compileOnly === true ? 'compile-only' : null
 
@@ -165,7 +166,15 @@ export function tGetCommunity(g, {community_id} = {}) {
 // A plain BFS/DFS flood dumps every reached node (thousands on a real graph) at near-zero signal.
 // Instead: traverse to record reach + distance-from-seed, then show only the closest, most-connected
 // slice as a coherent subgraph (edges kept only among shown nodes). Honest about what was trimmed.
-export function tQueryGraph(g, {question, mode = 'bfs', depth = 3, context_filter, seed_files, augment_seeds = false, token_budget = 2000} = {}, toolCtx = {}) {
+const QUERY_NON_PRODUCT = Object.freeze(['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
+const LOW_SIGNAL_SYMBOL_RE = /^(?:const(?:ant)?|variable|property|field|enum_member)$/i
+const querySourceFile = (node) => String(node?.source_file || String(node?.id || '').split('#', 1)[0]).replace(/\\/g, '/').replace(/^\.\//, '').toLowerCase()
+const queryWords = (value) => new Set(String(value || '').replace(/([a-z0-9])([A-Z])/g, '$1 $2').toLowerCase().split(/[^a-z0-9_]+/).filter(Boolean))
+
+export function tQueryGraph(g, {
+    question, mode = 'bfs', depth = 3, context_filter, seed_files, augment_seeds = false,
+    include_classified = false, include_low_signal = false, token_budget = 2000,
+} = {}, toolCtx = {}) {
     const pinned = resolveSeedFiles(g, seed_files)
     // Exact seed files are a control surface, not a hint: by default they disable fuzzy keyword seeds.
     // Callers can opt back into augmentation when they explicitly want both behaviors.
@@ -177,6 +186,32 @@ export function tQueryGraph(g, {question, mode = 'bfs', depth = 3, context_filte
     const maxDepth = Math.max(1, Math.min(6, Number(depth) || 3))
     const ctx = Array.isArray(context_filter) && context_filter.length ? new Set(context_filter.map((c) => String(c).toLowerCase())) : null
     const relOk = (rel) => !ctx || ctx.has(String(rel ?? '').toLowerCase())
+    const requestedClasses = requestedPathClasses(question)
+    const classifier = createPathClassifier(toolCtx.repoRoot || null)
+    const classificationCache = new Map()
+    const pinnedFiles = new Set(pinned.seeds.map(querySourceFile))
+    const classifiedSuppressed = new Set()
+    const pathPolicy = (id) => {
+        const node = g.byId.get(String(id))
+        const file = querySourceFile(node)
+        if (!file || pinnedFiles.has(file) || include_classified === true) return {ok: true}
+        if (!classificationCache.has(file)) classificationCache.set(file, classifier.explain(file, {content: ''}))
+        const info = classificationCache.get(file)
+        const classes = QUERY_NON_PRODUCT.filter((name) => hasPathClass(info, name))
+        if (!classes.length && !info?.excluded) return {ok: true}
+        if (classes.some((name) => requestedClasses.has(name))) return {ok: true}
+        classifiedSuppressed.add(String(id))
+        return {ok: false, bucket: 'classified'}
+    }
+    const questionTerms = queryWords(question)
+    const isLowSignal = (id) => {
+        if (include_low_signal === true || start.includes(String(id))) return false
+        const node = g.byId.get(String(id))
+        if (!node || !isSymbol(node.id) || !LOW_SIGNAL_SYMBOL_RE.test(String(node.symbol_kind || ''))) return false
+        const labelTerms = queryWords(node.label || String(node.id || '').split('#').pop() || '')
+        if ([...questionTerms].some((term) => labelTerms.has(term))) return false
+        return degreeOf(g, id) === 0
+    }
     const charBudget = Math.max(400, (Number(token_budget) || 2000) * 4)
     // node budget scales gently with the token budget; edges follow the surviving nodes.
     const nodeBudget = Math.max(20, Math.min(120, Math.round((Number(token_budget) || 2000) / 40)))
@@ -193,6 +228,7 @@ export function tQueryGraph(g, {question, mode = 'bfs', depth = 3, context_filte
             if (d >= maxDepth) continue
             for (const [nid, rel] of undirectedNeighbors(g, id)) {
                 if (!relOk(rel)) continue
+                if (!pathPolicy(nid).ok) continue
                 if (!seen.has(nid)) stack.push({id: nid, d: d + 1})
             }
         }
@@ -204,6 +240,7 @@ export function tQueryGraph(g, {question, mode = 'bfs', depth = 3, context_filte
             for (const id of frontier)
                 for (const [nid, rel] of undirectedNeighbors(g, id)) {
                     if (!relOk(rel)) continue
+                    if (!pathPolicy(nid).ok) continue
                     if (!depthOf.has(nid)) {
                         depthOf.set(nid, d + 1)
                         next.push(nid)
@@ -213,7 +250,10 @@ export function tQueryGraph(g, {question, mode = 'bfs', depth = 3, context_filte
         }
     }
     // rank reached nodes: seeds first, then by proximity (depth asc), then connectivity (degree desc)
+    const reachedBeforeSignalFilter = depthOf.size
+    const lowSignalSuppressed = [...depthOf.keys()].filter(isLowSignal).length
     const ranked = [...depthOf.entries()]
+        .filter(([id]) => !isLowSignal(id))
         .map(([id, d]) => ({id, d, deg: degreeOf(g, id)}))
         .sort((a, b) => a.d - b.d || b.deg - a.deg)
     const shown = ranked.slice(0, nodeBudget)
@@ -236,7 +276,10 @@ export function tQueryGraph(g, {question, mode = 'bfs', depth = 3, context_filte
         `Query: "${question}" (${mode}, depth ${maxDepth}${ctx ? `, context ${[...ctx].join('/')}` : ''})`,
         `Seeds: ${seeds.map((s) => s.label ?? s.id).join(', ')}`,
         pinned.missing.length ? `Unresolved pinned seed files: ${pinned.missing.join(', ')}` : null,
-        `Reached ${depthOf.size} nodes; showing ${shown.length} closest by proximity + connectivity, ${shownEdges.length} edges among them.`,
+        `Reached ${reachedBeforeSignalFilter} policy-eligible nodes; showing ${shown.length} closest by proximity + connectivity, ${shownEdges.length} edges among them.`,
+        classifiedSuppressed.size ? `Suppressed ${classifiedSuppressed.size} classified/non-product traversal node(s); ask for that class or pass include_classified:true.` : null,
+        lowSignalSuppressed ? `Suppressed ${lowSignalSuppressed} unreferenced constant/field node(s) with no query-term match; pass include_low_signal:true to inspect them.` : null,
+        include_classified === true ? 'Path policy: classified/non-product traversal explicitly enabled.' : `Path policy: production-first${requestedClasses.size ? `; explicit question classes enabled: ${[...requestedClasses].join(', ')}` : ''}.`,
         ``,
         `Nodes:`,
     ]

package/src/mcp/tools-health.mjs

@@ -3,6 +3,7 @@
 import {spawnSync} from 'node:child_process'
 import {degreeOf, rawGraph, effectiveRawGraph} from './graph-context.mjs'
 import {computeDuplicates} from '../analysis/duplicates.js'
+import {analyzeDuplicateGroups} from '../analysis/duplicate-groups.js'
 import {runInternalAudit} from '../analysis/internal-audit.js'
 import {classifyChangeImpact} from '../analysis/change-classification.js'
 import {compareAuditDebt, normalizeAuditScopeFiles, scopeAuditFindings} from '../analysis/audit-debt.js'
@@ -21,6 +22,7 @@ import {toolResult} from './tool-result.mjs'
 import {createPathClassifier, hasPathClass} from '../path-classification.js'
 import {createRepoBoundary} from '../repo-path.js'
 import {filterGraphForMode} from '../graph/graph-filter.js'
+import {readCachedSymbolPrecisionEvidence} from '../precision/symbol-query.js'
 
 const NON_PRODUCT_DUPLICATE_CLASSES = new Set(['generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
 const fragmentEligible = (fragment, {tokMin, skipTests, includeClassified}) => {
@@ -31,26 +33,6 @@ const fragmentEligible = (fragment, {tokMin, skipTests, includeClassified}) => {
     return true
 }
 
-// Group clone pairs into union-find families.
-function groupClones(data, {simMin, tokMin, mode, skipTests, includeClassified}) {
-    const frags = data.frags || []
-    const elig = (i) => fragmentEligible(frags[i], {tokMin, skipTests, includeClassified})
-    const pairs = (data.modes?.[mode] || []).filter(([i, j, s]) => s >= simMin && elig(i) && elig(j))
-    const parent = new Map()
-    const find = (x) => { let r = x; while (parent.has(r) && parent.get(r) !== r) r = parent.get(r); return r }
-    for (const [i, j] of pairs) { if (!parent.has(i)) parent.set(i, i); if (!parent.has(j)) parent.set(j, j); parent.set(find(i), find(j)) }
-    const groups = new Map()
-    for (const [i, j, s] of pairs) {
-        const r = find(i)
-        if (!groups.has(r)) groups.set(r, {members: new Set(), maxSim: 0})
-        const g = groups.get(r); g.members.add(i); g.members.add(j); g.maxSim = Math.max(g.maxSim, s)
-    }
-    return [...groups.values()].map((g) => {
-        const members = [...g.members].sort((a, b) => frags[b].n - frags[a].n)
-        return {members: members.map((i) => frags[i]), maxSim: g.maxSim, tokens: members.reduce((n, i) => n + frags[i].n, 0)}
-    }).sort((a, b) => b.tokens - a.tokens)
-}
-
 export function tFindDuplicates(g, args, ctx) {
     if (!ctx.repoRoot) return 'Duplicate scan needs the repo root (not provided to this server).'
     const simMin = Math.min(100, Math.max(50, Number(args.min_similarity) || 80))
@@ -97,10 +79,10 @@ export function tFindDuplicates(g, args, ctx) {
         })
         return `Found ${candidates.length} actionable same-name pair(s) across files (semantic mode; one closest clone and/or farthest collision per name). Top ${top.length}:\n\n${lines.join('\n\n')}\n\nThese are review candidates, not automatic refactors. Use read_source on both sites before changing code.`
     }
-    const data = computeDuplicates(ctx.repoRoot, ctx.graphPath, {includeStrings, minTokens: tokMin})
-    const groups = groupClones(data, {simMin, tokMin, mode, skipTests, includeClassified})
+    const analysis = analyzeDuplicateGroups(ctx.repoRoot, ctx.graphPath, args)
+    const groups = analysis.groups
     const smallPolicy = tokMin < 30 ? ' Small fragments below 30 tokens require at least 95% similarity and two shared bounded fingerprints.' : ''
-    const suppressed = data.frags.filter((fragment) => !fragmentEligible(fragment, {tokMin, skipTests, includeClassified})).length
+    const suppressed = analysis.suppressed
     const suppressionNote = suppressed && !includeClassified
         ? ` ${suppressed} fragment(s) classified as tests/e2e/generated/mock/story/docs/benchmark/temp or matched by .weavatrix.json exclude were suppressed; pass include_classified:true (and include_tests:true for tests) to inspect them explicitly.`
         : ''
@@ -120,7 +102,27 @@ export function tFindDuplicates(g, args, ctx) {
 // candidates. It never returns an automatic-delete verdict.
 export function tFindDeadCode(g, args, ctx) {
     if (!ctx.repoRoot) return 'Dead-code review needs the repo root (not provided to this server).'
-    const graph = effectiveRawGraph(ctx)
+    const effectiveGraph = effectiveRawGraph(ctx)
+    const pointEvidence = readCachedSymbolPrecisionEvidence({repoRoot: ctx.repoRoot, graphPath: ctx.graphPath, graph: effectiveGraph})
+    const graph = {
+        ...effectiveGraph,
+        precisionReferenceSymbols: [...new Set([
+            ...(effectiveGraph.precisionReferenceSymbols || []),
+            ...pointEvidence.referenceSymbols,
+        ])],
+        precisionProductionReferenceSymbols: [...new Set([
+            ...(effectiveGraph.precisionProductionReferenceSymbols || []),
+            ...pointEvidence.productionReferenceSymbols,
+        ])],
+        precisionTestReferenceSymbols: [...new Set([
+            ...(effectiveGraph.precisionTestReferenceSymbols || []),
+            ...pointEvidence.testReferenceSymbols,
+        ])],
+        precisionNoReferenceSymbols: [...new Set([
+            ...(effectiveGraph.precisionNoReferenceSymbols || []),
+            ...pointEvidence.noReferenceSymbols,
+        ])],
+    }
     const boundary = createRepoBoundary(ctx.repoRoot)
     const pkg = readRepoJson(boundary, 'package.json') || {}
     const rules = readRepoJson(boundary, '.weavatrix-deps.json') || {}
@@ -162,13 +164,15 @@ export function tFindDeadCode(g, args, ctx) {
             : `${candidate.owner ? `${candidate.owner}.` : ''}${candidate.symbol || candidate.id}`
         const where = `${candidate.file}${candidate.line ? `:${candidate.line}` : ''}`
         return [
-            `${index + 1}. [${candidate.confidence}/${candidate.classification}] ${subject} (${where})`,
+            `${index + 1}. [${candidate.confidence}/${candidate.evidenceTier}/${candidate.classification}] ${subject} (${where})`,
             `     evidence: ${candidate.evidence.map((item) => item.fact).join(' ')}`,
             candidate.caveats.length ? `     caution: ${candidate.caveats.join(' ')}` : null,
+            `     remaining: ${candidate.remainingChecks.join(' ')}`,
         ].filter(Boolean).join('\n')
     })
     const text = [
         `Dead-code review: ${shown.length} of ${review.candidates.length} candidate(s) shown (high ${counts.high}, medium ${counts.medium}, low ${counts.low}).`,
+        `Evidence tiers: strong static ${review.totals.byEvidenceTier.strongStatic}, bounded static ${review.totals.byEvidenceTier.boundedStatic}, high uncertainty ${review.totals.byEvidenceTier.highUncertainty}.`,
         `Verdict: REVIEW_REQUIRED. This is static evidence, never permission to auto-delete or bulk-delete.`,
         suppression ? `Suppressed by current filters: ${suppression}.` : null,
         review.suppressed.confidence ? 'Use min_confidence=low only when public/framework/dynamic candidates need explicit review.' : null,
@@ -196,7 +200,10 @@ const SEVERITY_RANK = {critical: 0, high: 1, medium: 2, low: 3, info: 4}
 
 export function formatAuditFinding(f) {
     const where = f.file ? `  (${f.file}${f.symbol ? ` ${f.symbol}` : ''})` : f.package ? `  (pkg ${f.package}${f.version ? `@${f.version}` : ''}${f.manifest ? `; ${f.manifest}` : ''})` : ''
-    return `  [${f.severity}/${f.confidence || '?'}] ${f.rule}: ${f.title}${where}${f.reason ? `\n      reason: ${f.reason}` : ''}${f.cycleRoute ? `\n      route: ${f.cycleRoute}` : ''}${f.fixHint ? `\n      fix: ${f.fixHint}` : ''}`
+    const verification = f.verification?.evidenceModel
+        ? `\n      verification: ${f.verification.evidenceModel}; manifest ${f.verification.manifestDeclaration?.status || 'N/A'}; indexed imports ${f.verification.indexedSourceImports?.status || 'N/A'}; decision ${f.verification.decision || 'REVIEW_REQUIRED'}`
+        : ''
+    return `  [${f.severity}/${f.confidence || '?'}] ${f.rule}: ${f.title}${where}${f.reason ? `\n      reason: ${f.reason}` : ''}${verification}${f.cycleRoute ? `\n      route: ${f.cycleRoute}` : ''}${f.fixHint ? `\n      fix: ${f.fixHint}` : ''}`
 }
 
 const auditFilter = (audit, args, findings = audit.findings) => {
@@ -234,7 +241,7 @@ const formatOrdinaryAudit = (audit, args, findings = audit.findings, heading = n
         heading,
         `Internal audit of ${audit.repo} (${audit.scanned.files} files, ${audit.scanned.symbols} symbols, ${audit.scanned.externalImports} external imports; malware scan: ${audit.scanned.malwareScanMode}).`,
         ...auditConventionLines(audit),
-        `Dependency manifests: ${deps.status || 'UNKNOWN'} — checked ${deps.declared ?? audit.scanned.manifestDeps ?? 0} declared package(s) against ${deps.importRecords ?? audit.scanned.externalImports ?? 0} external import record(s); unused ${deps.unused ?? 'unknown'}, missing ${deps.missing ?? 'unknown'}, duplicate declarations ${deps.duplicateDeclarations ?? 'unknown'}.`,
+        `Dependency manifests: ${deps.status || 'UNKNOWN'} — checked ${deps.declared ?? audit.scanned.manifestDeps ?? 0} declared package(s) against ${deps.importRecords ?? audit.scanned.externalImports ?? 0} external import record(s); unused ${deps.unused ?? 'unknown'}, missing ${deps.missing ?? 'unknown'}, duplicate declarations ${deps.duplicateDeclarations ?? 'unknown'}. npm per-finding manifest/source/config verification: ${deps.perFindingVerification ? 'AVAILABLE' : 'UNAVAILABLE'}.`,
         `Scoped severity: critical ${sev.critical}, high ${sev.high}, medium ${sev.medium}, low ${sev.low}, info ${sev.info}. Scoped categories: unused ${bycat.unused}, structure ${bycat.structure}, vulnerability ${bycat.vulnerability}, malware ${bycat.malware}.`,
         `Repository-level ${auditChecksLine(audit)}`,
         '',
@@ -428,7 +435,7 @@ export async function tRunAudit(g, args, ctx) {
         `Internal audit of ${audit.repo} (${audit.scanned.files} files, ${audit.scanned.symbols} symbols, ${audit.scanned.externalImports} external imports; malware scan: ${audit.scanned.malwareScanMode}).`,
         `Severity: critical ${sev.critical}, high ${sev.high}, medium ${sev.medium}, low ${sev.low}, info ${sev.info}. Categories: unused ${bycat.unused}, structure ${bycat.structure}, vulnerability ${bycat.vulnerability}, malware ${bycat.malware}.`,
         `Structure: ${audit.structureReport?.runtimeCycles ?? audit.structureReport?.cycles ?? 0} runtime cycle(s), ${audit.structureReport?.compileTimeCouplings ?? audit.structureReport?.typeCouplings ?? 0} compile-time coupling group(s), ${audit.structureReport?.orphans ?? 0} orphan(s); import edges: ${audit.structureReport?.runtimeImportEdges ?? audit.structureReport?.importEdges ?? 0} runtime + ${audit.structureReport?.typeOnlyImportEdges ?? 0} type-only + ${audit.structureReport?.compileOnlyImportEdges ?? 0} compile-only. Dead: ${audit.deadReport.deadFiles} file(s), ${audit.deadReport.unusedExports} unused export(s).`,
-        `Dependency manifests: ${deps.status || 'UNKNOWN'} — checked ${deps.declared ?? audit.scanned.manifestDeps ?? 0} declared package(s) against ${deps.importRecords ?? audit.scanned.externalImports ?? 0} external import record(s); unused ${deps.unused ?? 'unknown'}, missing ${deps.missing ?? 'unknown'}, duplicate declarations ${deps.duplicateDeclarations ?? 'unknown'}.`,
+        `Dependency manifests: ${deps.status || 'UNKNOWN'} — checked ${deps.declared ?? audit.scanned.manifestDeps ?? 0} declared package(s) against ${deps.importRecords ?? audit.scanned.externalImports ?? 0} external import record(s); unused ${deps.unused ?? 'unknown'}, missing ${deps.missing ?? 'unknown'}, duplicate declarations ${deps.duplicateDeclarations ?? 'unknown'}. npm per-finding manifest/source/config verification: ${deps.perFindingVerification ? 'AVAILABLE' : 'UNAVAILABLE'}.`,
         ...auditConventionLines(audit),
         `Checks: ${check('OSV', audit.checks?.osv)}; ${check('malware', audit.checks?.malware)}. A NOT_CHECKED/PARTIAL/ERROR check is incomplete or unknown, never a clean zero.`,
         ``,
@@ -540,6 +547,7 @@ export function tHotPathReview(g, args, ctx) {
     const text = [
         `Local hot-path review: ${review.candidateSymbols} candidate(s) from ${review.analyzedSymbols} analyzed symbol(s); showing ${review.hotspots.length}.`,
         `Thresholds: time rank >=${review.thresholds.timeRank}, cyclomatic >=${review.thresholds.cyclomatic}, calls >=${review.thresholds.calls}, loop depth >=${review.thresholds.loopDepth}, score >=${review.thresholds.minScore}.`,
+        `Selection: ${review.selectionPolicy.mode}${review.selectionPolicy.strongLocalFallback ? '; strong local sort/recursion/deep-loop evidence can pass below the blended score gate' : '; strict explicit score gate'}.`,
         coverageLine,
         'Local syntax cost and graph coupling are separate. Scores are review priority, not measured runtime.',
         '',
@@ -557,7 +565,7 @@ export function tHotPathReview(g, args, ctx) {
                 `       ${item.reasons.slice(0, 5).join('; ')}${evidence}`,
             ]
         }) : ['  (none at the selected thresholds)']),
-        review.bounds.truncated ? `... +${review.bounds.totalCandidates - review.bounds.returned} more (raise top_n, min_score, or narrow path).` : null,
+        review.bounds.truncated ? `... +${review.bounds.totalCandidates - review.bounds.returned} more (raise top_n to display more, raise min_score or narrow path to tighten; lower min_score to broaden).` : null,
         '',
         'Caveat: no interprocedural Big-O, recursion-bound, CFG, dead-store or taint-flow claim is made.',
     ].filter((line) => line != null).join('\n')

package/src/mcp/tools-impact-change.mjs

@@ -244,6 +244,7 @@ export function tChangeImpactV2(g, args = {}, ctx = {}) {
         },
         testEvidence: {
             actualCoverage: hasCoverage ? 'AVAILABLE' : 'NOT_AVAILABLE',
+            changedFiles: changed.slice(0, 500).map((file) => ({file, ...testEvidenceFor(file)})),
             staticTestReachability: {
                 kind: staticTests.kind,
                 testFiles: staticTests.testFiles,

package/src/mcp/tools-verified-change.mjs

@@ -0,0 +1,185 @@
+import {findSeeds, rawGraph} from './graph-context.mjs'
+import {toolResult} from './tool-result.mjs'
+import {expandTaskQuery, retrieveTaskContext} from '../analysis/task-retrieval.js'
+import {extractCallArgumentEvidence} from '../analysis/data-flow-evidence.js'
+import {runAllowedTests, validateTestRequests} from '../analysis/allowed-test-runner.js'
+import {compareDuplicateGroups} from '../analysis/duplicate-groups.js'
+import {buildGraphAtGitRef} from '../analysis/git-ref-graph.js'
+import {diffGraphs, formatGraphDiff} from './graph-diff.mjs'
+
+const richResult = (value) => value?.__weavatrixToolResult === true ? value.result : null
+const normalizeFile = (value) => String(value || '').replace(/\\/g, '/')
+const changedFilesOf = (impact) => [...new Set((impact?.changes || []).flatMap((change) => [change.path, change.oldPath, change.newPath]).map(normalizeFile).filter((file) => file && file !== '(diff unavailable)'))]
+const targetTests = (impact) => [...new Set([
+  ...(impact?.testEvidence?.changedFiles || []).map((item) => item.staticTestReachability?.test),
+  ...(impact?.blastRadius?.nodes || []).map((node) => node.testEvidence?.staticTestReachability?.test),
+].filter(Boolean))].slice(0, 30)
+
+function testCoverage(proof, requests, suggested) {
+  if (!suggested.length) return {state: 'NOT_APPLICABLE', covered: [], missing: []}
+  if (proof.state !== 'PASS') return {state: 'PENDING', covered: [], missing: suggested}
+  if ((requests || []).some((request) => request?.script === 'test' && (!request.args || !request.args.length))) {
+    return {state: 'COMPLETE', kind: 'full-test-script', covered: suggested, missing: []}
+  }
+  const args = (requests || []).flatMap((request) => request?.args || []).map(normalizeFile)
+  const covered = suggested.filter((file) => args.some((arg) => arg === file || arg.endsWith(`/${file}`)))
+  return {state: covered.length === suggested.length ? 'COMPLETE' : 'PARTIAL', kind: 'explicit-test-paths', covered, missing: suggested.filter((file) => !covered.includes(file))}
+}
+
+function graphProof(diff) {
+  const runtimeCycles = diff?.cycles?.runtime?.introduced || []
+  return {
+    state: runtimeCycles.length ? 'BLOCKED' : diff.schemaMigration ? 'UNKNOWN' : 'PASS',
+    ...(diff.schemaMigration ? {reason: 'graph extractor/schema versions differ, so structural ratchets are not comparable'} : {}),
+    summary: formatGraphDiff(diff),
+    counts: {
+      nodesAdded: diff.nodes.added.length, nodesRemoved: diff.nodes.removed.length,
+      edgesAdded: diff.edges.added, edgesRemoved: diff.edges.removed,
+      moduleDependenciesAdded: diff.moduleEdges.added.length, orphaned: diff.orphaned.length,
+      runtimeCyclesIntroduced: runtimeCycles.length,
+    },
+    runtimeCycles: runtimeCycles.slice(0, 20), moduleDependenciesAdded: diff.moduleEdges.added.slice(0, 20),
+    orphaned: diff.orphaned.slice(0, 20), schemaMigration: diff.schemaMigration,
+  }
+}
+
+async function baselineProof(ctx, baseRef, currentGraph) {
+  const mode = ['full', 'no-tests', 'tests-only'].includes(currentGraph?.graphBuildMode) ? currentGraph.graphBuildMode : 'full'
+  const built = await buildGraphAtGitRef(ctx.repoRoot, baseRef, {mode})
+  if (!built.ok) return {state: 'UNKNOWN', reason: built.error}
+  return {...graphProof(diffGraphs(built.graph, currentGraph)), baseline: {ref: built.ref, commit: built.commit}}
+}
+
+function apiState(result) {
+  if (!result || result.status !== 'COMPLETE' || result.completeness?.complete !== true) return 'UNKNOWN'
+  if (['HTTP_METHOD_MISMATCH', 'CLIENTS_AT_RISK_WITH_METHOD_MISMATCHES'].includes(result.verdict?.code)) return 'BLOCKED'
+  return 'UNKNOWN'
+}
+
+function architectureState(result) {
+  if (!result || result.state === 'NOT_CONFIGURED' || result.state === 'ERROR') return 'UNKNOWN'
+  if (!result.verification) return result.state === 'READY' ? 'PASS' : 'UNKNOWN'
+  return result.verification.new?.length || String(result.verification.status).toUpperCase() === 'FAIL' ? 'BLOCKED' : 'PASS'
+}
+
+function exactUsageLines(contexts, g) {
+  if (!contexts.length) return []
+  return contexts.map((context) => {
+    const node = g.byId.get(String(context.symbol || context.definition?.id || ''))
+    const label = String(context.definition?.label || node?.label || context.symbol || 'symbol')
+    if (context.status !== 'OK') return `Exact usage: ${label} — unavailable (${context.status || 'UNKNOWN'}).`
+    const exact = context.evidence?.state === 'EXACT'
+    const occurrences = Number(context.references?.occurrences) || 0
+    const files = Number(context.references?.files) || 0
+    const inbound = Array.isArray(context.inbound?.shown) ? context.inbound.shown.slice(0, 3) : []
+    const callers = inbound.map((item) => `${item.label || item.id}${item.file ? ` [${item.file}]` : ''}`).join(', ')
+    return `${exact ? 'Exact usage' : 'Bounded usage'}: ${label} — ${occurrences} reference occurrence(s)${files ? ` in ${files} file(s)` : ''}; ${Number(context.inbound?.total) || 0} inbound container(s)${callers ? `: ${callers}` : ''}.`
+  })
+}
+
+function decide({phase, impact, graph, architecture, duplicates, api, tests, suggestedTests, testCoverageState}) {
+  if (phase === 'plan') return tests.state === 'BLOCKED'
+    ? {verdict: 'BLOCKED', blockers: [`targeted test plan was rejected: ${tests.reason || 'invalid request'}`], unknowns: []}
+    : {verdict: 'UNKNOWN', blockers: [], unknowns: ['verification has not run; apply the edit and call verified_change with phase=verify']}
+  if (impact.status === 'COMPLETE' && !impact.changes?.length) return {verdict: 'PASS', blockers: [], unknowns: []}
+  const blockers = [], unknowns = []
+  if (impact.status !== 'COMPLETE') unknowns.push('change impact is partial or has unmapped evidence')
+  if (graph.state === 'BLOCKED') blockers.push('the change introduces a runtime dependency cycle')
+  if (graph.state === 'UNKNOWN') unknowns.push(`Git graph baseline is unavailable: ${graph.reason || 'unknown reason'}`)
+  if (architecture.state === 'BLOCKED') blockers.push('new architecture-contract violations were found')
+  if (architecture.state === 'UNKNOWN') unknowns.push('architecture contract is not configured or verification is incomplete')
+  if (duplicates.state === 'BLOCKED') blockers.push('new duplicate groups intersect the changed files')
+  if (duplicates.state === 'UNKNOWN') unknowns.push(`duplicate ratchet is incomplete: ${duplicates.reason || 'health capability unavailable'}`)
+  if (api.state === 'BLOCKED') blockers.push('cross-repository API evidence contains HTTP method mismatches')
+  if (api.state === 'UNKNOWN') unknowns.push(`API contract evidence is incomplete: ${api.reason || 'no bounded proof'}`)
+  if (tests.state === 'FAIL' || tests.state === 'BLOCKED') {
+    const failed = (tests.results || []).filter((result) => result.status !== 'PASS').map((result) => `${result.script} (${result.status}${result.exitCode == null ? '' : `, exit ${result.exitCode}`})`)
+    blockers.push(`targeted tests failed or were rejected: ${tests.reason || failed.join(', ') || 'unknown failure'}`)
+  }
+  if (tests.state === 'DISABLED') unknowns.push('targeted test execution was requested but runtime permission is disabled')
+  if (tests.state === 'NOT_REQUESTED' && suggestedTests.length) unknowns.push('affected tests were identified but no allowlisted package test was requested')
+  if (tests.state === 'PASS' && testCoverageState.state === 'PARTIAL') unknowns.push(`targeted test run did not cover ${testCoverageState.missing.length} suggested test path(s)`)
+  return {verdict: blockers.length ? 'BLOCKED' : unknowns.length ? 'UNKNOWN' : 'PASS', blockers, unknowns}
+}
+
+export async function tVerifiedChange(g, args = {}, ctx = {}, tools = {}, permissions = {}) {
+  const phase = args.phase === 'verify' ? 'verify' : 'plan'
+  const currentGraph = rawGraph(ctx)
+  const impactValue = await tools.impact(g, {base: args.base_ref, diff: args.diff, files: args.files, depth: args.impact_depth, max_nodes: args.max_impact_nodes}, ctx)
+  const impact = richResult(impactValue) || {status: 'PARTIAL', changes: [], seeds: {ids: []}, blastRadius: {nodes: []}}
+  const changedFiles = changedFilesOf(impact)
+  const retrieval = retrieveTaskContext(g, {
+    task: args.task, semanticSeeds: findSeeds(g, expandTaskQuery(args.task), 12, {repoRoot: ctx.repoRoot}),
+    changedSeedIds: impact.seeds?.ids, maxSymbols: args.max_symbols, repoRoot: ctx.repoRoot,
+  })
+
+  let contexts = []
+  if (permissions.source) contexts = await Promise.all(retrieval.selected.map(async (symbol) => {
+    const value = await tools.context(g, {label: symbol.id, precision: args.precision, max_related: 8, max_source_files: 3, context_lines: 4}, ctx, tools.inspect)
+    const result = richResult(value)
+    return result ? {symbol: symbol.id, status: result.status, definition: result.definition, evidence: result.evidence, references: result.references, inbound: result.inbound, outbound: result.outbound, reExports: result.reExports, source: result.source} : {symbol: symbol.id, status: 'UNKNOWN'}
+  }))
+  const dataFlow = permissions.source ? extractCallArgumentEvidence({
+      graph: g, repoRoot: ctx.repoRoot, seedIds: retrieval.selected.map((item) => item.id),
+      depth: Math.max(1, Math.min(3, Number(args.data_flow_depth) || 2)),
+      maxEdges: Math.max(1, Math.min(60, Number(args.max_data_flow_edges) || 30)),
+    })
+    : {model: 'bounded call-argument-to-parameter evidence (not CFG or taint analysis)', status: 'UNAVAILABLE', reason: 'source capability is not enabled', edges: [], unsupportedEdges: 0, capped: false}
+  const suggestedTests = targetTests(impact)
+  const checkedTests = validateTestRequests(ctx.repoRoot, args.tests || [])
+  const testProof = phase === 'verify'
+    ? await runAllowedTests(ctx.repoRoot, args.tests || [], {enabled: args.run_tests === true, timeoutMs: args.test_timeout_ms})
+    : {state: checkedTests.ok ? 'PLANNED' : 'BLOCKED', reason: checkedTests.reason, plan: checkedTests.tests || [], results: []}
+  const testCoverageState = testCoverage(testProof, args.tests || [], suggestedTests)
+
+  const architectureValue = phase === 'verify'
+    ? (permissions.health ? tools.verifyArchitecture(g, {}, ctx) : null)
+    : tools.prepareChange(g, {intent: args.task, files: changedFiles}, ctx)
+  const architectureResult = richResult(architectureValue)
+  const architecture = {state: architectureState(architectureResult), evidence: architectureResult}
+  const baseRef = String(args.base_ref || 'HEAD').trim()
+  const graph = phase === 'verify' ? await baselineProof(ctx, baseRef, currentGraph) : {state: 'PLANNED', baseline: baseRef}
+
+  let duplicates = {state: 'SKIPPED', reason: 'duplicate ratchet disabled'}
+  if (phase === 'verify' && args.duplicate_ratchet !== false) duplicates = permissions.health
+    ? await compareDuplicateGroups({repoRoot: ctx.repoRoot, graphPath: ctx.graphPath, currentGraph, baseRef, changedFiles, args: {mode: 'renamed', min_similarity: 80, min_tokens: 50}})
+    : {state: 'UNKNOWN', reason: 'health capability is not enabled'}
+
+  let api = {state: 'SKIPPED', reason: 'no api_contract scope was requested'}
+  if (args.api_contract) {
+    if (!permissions.crossrepo) api = {state: 'UNKNOWN', reason: 'crossrepo capability is not enabled'}
+    else {
+      const result = richResult(await tools.traceApi(g, {
+        ...args.api_contract, changed_files: args.api_contract.changed_files || changedFiles,
+        max_endpoints: Math.min(100, Number(args.api_contract.max_endpoints) || 100),
+        max_matches: Math.min(500, Number(args.api_contract.max_matches) || 500),
+        max_affected_files: Math.min(100, Number(args.api_contract.max_affected_files) || 100),
+        top_n: Math.min(10, Number(args.api_contract.top_n) || 10),
+      }, ctx))
+      api = {state: apiState(result), evidence: result}
+    }
+  }
+
+  const decision = decide({phase, impact, graph, architecture, duplicates, api, tests: testProof, suggestedTests, testCoverageState})
+  if (!permissions.source && retrieval.selected.length) decision.unknowns.push('source capability is disabled; exact LSP/source edit contexts were not collected')
+  if (phase === 'verify' && contexts.some((item) => item.status !== 'OK' || item.evidence?.state !== 'EXACT' || item.references?.capped)) {
+    decision.unknowns.push('one or more exact edit contexts are incomplete')
+  }
+  if (phase === 'verify' && args.diff) decision.unknowns.push('a supplied diff was classified, but equivalence between that patch and the active graph is not proven; verify on a checked-out change without diff')
+  if (decision.verdict === 'PASS' && decision.unknowns.length) decision.verdict = 'UNKNOWN'
+  const result = {
+    schemaVersion: 'weavatrix.verified-change.v1', verdict: decision.verdict, phase, task: String(args.task),
+    blockers: decision.blockers, unknowns: decision.unknowns,
+    retrieval, editContexts: contexts, dataFlow, changeImpact: impact, graphBaseline: graph,
+    architecture, duplicates, apiContract: api, tests: {...testProof, suggestedFiles: suggestedTests, coverage: testCoverageState},
+  }
+  const text = [
+    `${decision.verdict} — verified_change ${phase}`, `Task: ${String(args.task).slice(0, 500)}`,
+    `Change: ${changedFiles.length} file(s), ${impact.seeds?.ids?.length || 0} exact seed(s), blast radius ${impact.blastRadius?.impacted || 0}.`,
+    `Edit context: ${retrieval.selected.length} symbol(s); ${contexts.length} exact bundle(s); data-flow ${dataFlow.status} (${dataFlow.edges.length} call edge(s)).`,
+    ...exactUsageLines(contexts, g),
+    `Ratchets: graph ${graph.state}; architecture ${architecture.state}; duplicates ${duplicates.state}; API ${api.state}; tests ${testProof.state}.`,
+    ...decision.blockers.map((item) => `BLOCKER: ${item}`), ...decision.unknowns.map((item) => `UNKNOWN: ${item}`),
+  ].join('\n')
+  return toolResult(text, result, {completeness: {status: decision.verdict === 'UNKNOWN' ? 'PARTIAL' : 'COMPLETE'}})
+}

package/src/path-classification.js

@@ -46,7 +46,7 @@ const DEFAULT_RULES = [
   {
     category: "test",
     pattern: "test/spec roots and conventional test filenames",
-    regex: /(^|\/)(?:__tests?__|tests?|spec)(\/|$)|\.(?:test|itest|spec)\.[^.\/]+$|_test\.go$|(^|\/)test_[^/]*\.py$/i,
+    regex: /(^|\/)(?:__tests?__|tests?|spec)(\/|$)|\.(?:test|itest|spec)\.[^.\/]+$|_test\.go$|(^|\/)test(?:_[^/]*)?\.py$/i,
   },
   {
     category: "generated",

package/src/precision/symbol-query.js

@@ -7,6 +7,7 @@ import {
     precisionOverlayMatches,
     precisionSemanticInputsMatch,
 } from './lsp-overlay.js'
+import {createPathClassifier, hasPathClass} from '../path-classification.js'
 
 export const SYMBOL_PRECISION_CACHE_V = 1
 export const SYMBOL_PRECISION_CACHE_FILE = 'precision-symbols.json'
@@ -79,6 +80,56 @@ function cacheable(overlay) {
         && overlay?.reason === 'semantic precision stopped at a configured safety limit'
 }
 
+// Point-query results intentionally live outside the broad precision overlay. Health tools still
+// need to consume revision-bound positive evidence: once an exact query found a reference, the
+// same symbol must not remain in a dead-code queue. This reader is synchronous and fail-closed;
+// stale, malformed, incomplete no-reference, or semantically changed entries contribute nothing.
+export function readCachedSymbolPrecisionEvidence({repoRoot, graphPath, graph} = {}) {
+    const empty = {referenceSymbols: [], productionReferenceSymbols: [], testReferenceSymbols: [], noReferenceSymbols: []}
+    if (!repoRoot || !graphPath || !graph) return empty
+    const precisionGraph = graph.graphPrecisionMode === 'off' ? {...graph, graphPrecisionMode: 'lsp'} : graph
+    const nodesById = new Map((precisionGraph.nodes || []).map((node) => [String(node.id), node]))
+    const classifier = createPathClassifier(repoRoot)
+    const referenced = new Set()
+    const production = new Set()
+    const tests = new Set()
+    const noReference = new Set()
+    const semanticMatches = new Map()
+    for (const entry of readCache(symbolPrecisionCachePath(graphPath)).entries) {
+        const overlay = entry?.overlay
+        if (!overlay || !precisionOverlayMatches(overlay, precisionGraph, {request: overlay.request})) continue
+        const fingerprint = String(overlay.semanticInputFingerprint || '')
+        if (!semanticMatches.has(fingerprint)) semanticMatches.set(
+            fingerprint,
+            precisionSemanticInputsMatch(overlay, repoRoot, precisionGraph),
+        )
+        if (!semanticMatches.get(fingerprint)) continue
+        const targetId = String(entry.targetId || '')
+        if (!nodesById.has(targetId)) continue
+        const locations = Array.isArray(overlay.locations)
+            ? overlay.locations.filter((location) => String(location?.target || '') === targetId)
+            : []
+        if (locations.length) {
+            referenced.add(targetId)
+            for (const location of locations) {
+                const file = String(location?.file || nodesById.get(String(location?.source || ''))?.source_file || '')
+                if (!file) continue
+                const info = classifier.explain(file, {content: ''})
+                if (hasPathClass(info, 'test', 'e2e')) tests.add(targetId)
+                else production.add(targetId)
+            }
+        }
+        if (overlay.state === 'COMPLETE' && Array.isArray(overlay.noReferenceSymbols)
+            && overlay.noReferenceSymbols.some((id) => String(id) === targetId)) noReference.add(targetId)
+    }
+    return {
+        referenceSymbols: [...referenced],
+        productionReferenceSymbols: [...production],
+        testReferenceSymbols: [...tests],
+        noReferenceSymbols: [...noReference],
+    }
+}
+
 export async function querySymbolPrecision({
     repoRoot,
     graphPath,

package/src/security/malware-heuristics.exclusions.js

@@ -8,7 +8,7 @@ const URL_RE = /https?:\/\/[^\s'"`)\\<>]+/gi;
 const PACKAGE_JSON_SCRIPT_RE = /["']?(preinstall|install|postinstall|prepare|prepack|postpack|prepublish|prepublishonly)["']?\s*:/i;
 const PACKAGE_JSON_METADATA_URL_RE = /["']?(bugs|homepage|repository|funding|author|contributors|maintainers|publishConfig|license)["']?\s*:|["']?url["']?\s*:/i;
 const NETWORK_CALL_RE = /\b(fetch|axios\.|XMLHttpRequest|sendBeacon|https?\.request|request\(|curl\b|wget\b|iwr\b|invoke-webrequest)\b/i;
-const LIFECYCLE_SCRIPT_HOOKS = ["preinstall", "install", "postinstall", "prepare"];
+const INSTALL_SCRIPT_HOOKS = ["preinstall", "install", "postinstall"];
 
 function cleanUrlToken(value) {
   return String(value || "").trim().replace(/[.,;:!?]+$/g, "").replace(/[)\]}]+$/g, "");
@@ -102,8 +102,8 @@ export function isManifestUrlNoise(file, signal) {
   return /(^|\/)(pkg-info|metadata)$/.test(f);
 }
 
-export function lifecycleScriptSnippet(scripts = {}) {
-  for (const hook of LIFECYCLE_SCRIPT_HOOKS) {
+export function installScriptSnippet(scripts = {}) {
+  for (const hook of INSTALL_SCRIPT_HOOKS) {
     const s = String(scripts?.[hook] || "").trim();
     if (s) return `${hook}: ${s}`.slice(0, 200);
   }

package/src/security/malware-heuristics.roots.js

@@ -109,7 +109,10 @@ export function buildContentRoots(repoPath, installed) {
   const roots = [];
   const nmDir = join(repoPath, "node_modules");
   const jsPkgDirs = existingDir(nmDir) ? listPkgDirs(nmDir) : [];
-  if (jsPkgDirs.length) roots.push({ kind: "npm", root: nmDir, packages: jsPkgDirs.length, pathToPkg: pkgOfNodeModulesPath });
+  // Scan installed package roots, not the whole node_modules container. Package-manager caches,
+  // hosted release snapshots and other hidden metadata are not installed dependencies and may
+  // legitimately contain malware-signature fixtures (including Weavatrix's own rule source).
+  for (const item of jsPkgDirs) roots.push({ kind: "npm", root: item.dir, packages: 1, pathToPkg: pkgOfNodeModulesPath });
 
   for (const sp of sitePackageRoots(repoPath)) {
     const topMap = pyTopLevelMap(sp);

package/src/security/malware-heuristics.scan.js

@@ -6,7 +6,7 @@ import { resolveRg } from "../scan/search.js";
 import { classifyInstallScript, classifyResolvedUrl, isCloudSdkMetadataUse } from "./registry-sig.js";
 import { fileHeuristicSweep } from "./malware-file-heuristics.js";
 import { buildMalwareFindings } from "./malware-scoring.js";
-import { parseMalwareExclusions, isManifestUrlNoise, isDocUrlNoise, isMalwareSignalExcluded, lifecycleScriptSnippet } from "./malware-heuristics.exclusions.js";
+import { parseMalwareExclusions, isManifestUrlNoise, isDocUrlNoise, isMalwareSignalExcluded, installScriptSnippet } from "./malware-heuristics.exclusions.js";
 import { buildContentRoots, listPkgDirs } from "./malware-heuristics.roots.js";
 import { rgSweep, nodeSweep } from "./malware-heuristics.sweep.js";
 
@@ -37,7 +37,9 @@ export async function scanMalware(repoPath, { installed = [], importedPkgs = new
   for (const { pkg, dir } of pkgDirs) {
     try {
       const pj = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
-      const scriptSnippet = lifecycleScriptSnippet(pj.scripts);
+      // package-lock hasInstallScript describes install-time hooks. Development and
+      // publication hooks such as prepare do not constitute drift from that flag.
+      const scriptSnippet = installScriptSnippet(pj.scripts);
       if (scriptSnippet && lockScriptMeta.get(`${pkg}@${pj.version || ""}`) === false) {
         add(pkg, {
           key: "install-script-drift",