weavatrix 0.3.9 → 0.3.11

package/README.md

@@ -131,6 +131,18 @@ Every finding is review evidence, never an auto-delete verdict: `find_dead_code`
 `run_audit category=unused` always return `REVIEW_REQUIRED` with `autoDelete:false`. Typecheck, tests
 and runtime checks remain the release authority.
 
+## Always-fresh graph
+
+There is no watcher daemon to run and no manual refresh step: every graph/health call reconciles the
+graph before answering. A Git-token freshness probe (HEAD + dirty/untracked content, debounced 2 s)
+decides whether anything changed; when it did, a bounded incremental refresh reparses only the changed
+files plus their reverse importers (≤ 24 changed / ≤ 80 reparsed JS/TS files) and merges the scoped
+result into the previous graph under a file lock. Config/lockfile edits, export-surface changes,
+barrel files and non-JS/TS languages fall back to a full rebuild — correctness always wins over speed.
+Each refreshed answer carries a structured `refresh` record (`none` / `incremental` / `full`, changed
+file count), so an agent can tell exactly which repository state it is reasoning about. The same
+guarantees hold across concurrent MCP clients sharing one canonical graph.
+
 ## Benchmarks
 
 Two gates ship in the repository:
@@ -174,10 +186,23 @@ realpath escapes. Report suspected vulnerabilities privately as described in [SE
 
 ## Languages
 
-JavaScript · TypeScript · TSX · Python · Go · Java · C# · Rust · HTML · CSS — parsed with
+JavaScript · TypeScript · TSX · Python · Go · Java · C# · Rust · Solidity · HTML · CSS — parsed with
 [web-tree-sitter](https://github.com/tree-sitter/tree-sitter) WASM grammars; no Python install and no
 native compilation.
 
+SQL is indexed without a grammar: `.sql` files contribute tables, views, columns, functions, indexes
+and triggers as first-class graph symbols, and SQL found in string literals of any other language
+links the enclosing function to the table it queries. That makes schema objects visible to
+`change_impact`/`get_dependents` (who touches this table?) and lets the dead-code check flag columns
+no statement references — conservatively: verdicts require literal-SQL evidence in the repo, and
+`SELECT *`-consumed tables never have their columns judged by name (ORM-generated SQL stays invisible
+and is therefore never judged either).
+
+Test surfaces are classified per file (path conventions plus `.weavatrix.json` overrides) and, for
+Rust, per symbol: `#[cfg(test)]` modules and `#[test]`/`#[bench]` items inside production `.rs` files
+carry a node-level `test_surface` flag, so dead-code, query, hot-path and hub tools treat them as
+tests rather than production code.
+
 ## Development
 
 ```sh
@@ -187,9 +212,9 @@ npm run benchmark        # full TS/JS/Python/Go/Java/Rust + MCP lifecycle gate
 npm run benchmark:real   # locally available real repos vs source-free 0.2.1 baselines
 ```
 
-Maintained JavaScript/TypeScript under `src`, `bin`, `scripts`, `test` (and HTML/CSS/JS under `site`)
-has a hard 300-line physical ceiling enforced by the release suite; larger concerns split into
-owner-focused modules behind slim facades.
+Maintained JavaScript/TypeScript under `src`, `bin`, `scripts`, `test` has a hard 300-line physical
+ceiling enforced by the release suite; larger concerns split into owner-focused modules behind slim
+facades. The weavatrix.com landing site lives in its own repository (`weavatrix-site`).
 
 ## Release history
 

package/docs/releases/v0.3.10.md

@@ -0,0 +1,76 @@
+# Weavatrix 0.3.10
+
+0.3.10 closes the honesty gaps a production evaluation surfaced: Rust inline
+tests are no longer reported as production code, endpoint tools are
+production-first everywhere, and semantic-precision statuses say exactly how
+much was actually proven. Every fix landed with regression tests and survived
+an adversarial multi-agent review of the full changeset.
+
+## Node-level Rust test classification
+
+Rust puts unit tests inside production files, so path classification alone
+misreported them everywhere. The extractor now proves test-only compilation —
+`#[cfg(test)]` / `#[cfg(all(test, ...))]` on items, impl blocks and modules,
+`#[test]`/`#[tokio::test]`-style harness attributes and `#[bench]` functions,
+inner `#![cfg(test)]` attributes at file and module-body scope, and attributes
+separated from their item by comments — and stamps a `test_surface` flag on the
+node. Deliberately conservative: `#[cfg(any(test, ...))]` also ships in
+production builds and stays unclassified.
+
+Every consumer honors the flag like a path-classified test: `find_dead_code`
+(candidates and test-only consumer resolution), `query_graph` seeds and
+traversal, `hot_path_review`, `god_nodes`, `verified_change` task anchors,
+`no-tests`/`tests-only` build modes, hosted sync payloads and evidence
+snapshots. A test-term question or `include_tests`/`include_classified` opts
+back in. `extractorSchemaV` 5 → 6; cached graphs rebuild once, automatically.
+
+## Production-first endpoint tools
+
+- `list_endpoints` suppresses endpoints declared in classified
+  test/e2e/generated/mock/story/docs/benchmark/temp paths by default, with a
+  count note and `include_classified` opt-in (auto-enabled on tests-only
+  graphs). Opted-in rows carry `[classified:...]` tags.
+- `trace_endpoint` filters classified handler twins before its ambiguity
+  check, ranks remaining same-named candidates by the import binding at the
+  route file (below same-directory proximity — a file-level edge proves
+  coupling, not identity), and reports `importBoundAtRoute`/`pathClasses` per
+  candidate when it still fails closed.
+- New `handler_file` parameter resolves genuinely symmetric candidates: it
+  narrows the full candidate pool before scoring, prefers exact repo-relative
+  matches over path-suffix matches, and compares case-insensitively.
+
+## Honest semantic-precision statuses
+
+`COMPLETE` previously meant only "the bounded request finished", producing
+`COMPLETE (0 EXACT_LSP edges)` on Rust repositories and `COMPLETE; exact
+absence was not proven` in `get_dependents`. Now:
+
+- A new `NONE` state covers the zero-eligible-targets outcome; `UNAVAILABLE`
+  stays reserved for provider failure. `PRECISION_OVERLAY_V` 4 → 5 discards
+  old-vocabulary sidecars.
+- `COMPLETE` requires every selected target actually probed.
+- `open_repo` and the build log print the `graph_stats`-style coverage
+  fraction: `PARTIAL — 32/1373 bounded target(s) queried (truncated)`.
+- `get_dependents` never pairs a state word with a contradicting note, and
+  keeps `NONE`/`UNAVAILABLE` truthful instead of collapsing them into
+  `PARTIAL`.
+
+## Output fidelity
+
+- `trace_api_contract` records per-endpoint method mismatches with sample
+  callers and always shows a mismatch block, so `*_WITH_METHOD_MISMATCHES`
+  verdicts stay backed by visible rows under any `top_n`.
+- Structure findings and hosted evidence snapshots stop reporting idiomatic
+  Rust `mod.rs`/`lib.rs`/`main.rs` parent-child module-tree cycles as
+  compile-time coupling (counted as `rustModuleTreeCouplings`; genuine
+  cross-directory cycles still report).
+- `query_graph` edge lines and `shortest_path` hops widen repeated or generic
+  file basenames (`mod.rs`, `index.*`, `__init__.py`) to their last two path
+  segments.
+
+## Documentation
+
+The always-fresh graph contract — debounced Git freshness probe plus bounded
+incremental refresh on every graph/health call, no watcher process required —
+is now documented in the README and the agent skill, together with the Rust
+test-surface classification rules.

package/docs/releases/v0.3.11.md

@@ -0,0 +1,55 @@
+# Weavatrix 0.3.11
+
+0.3.11 teaches the graph two new surfaces. SQL schemas become first-class graph
+citizens with honest, evidence-gated dead-code verdicts, and Solidity joins the
+parsed languages at zero dependency cost. The weavatrix.com site moved to its
+own repository, so the engine repo now ships engine only.
+
+## SQL: the graph reaches the database schema
+
+No SQL grammar ships in the pinned tree-sitter-wasms, so `.sql` indexing runs
+on a dependency-free statement scanner (a new `textOnly` language-module class)
+built for the graph's needs — symbols and references, not SQL semantics.
+String literals and comments are blanked before structural scanning, so quoted
+text can never fabricate a reference.
+
+- `CREATE TABLE`/`VIEW`/`FUNCTION`/`PROCEDURE`/`INDEX`/`TRIGGER` become graph
+  symbols; table columns (including `ALTER TABLE ADD COLUMN`) are member
+  symbols with `member_of`, and tables carry their columns as `field_types`.
+- References resolve inside `.sql` files (a view's `SELECT`, an index's `ON`
+  table, a trigger's `EXECUTE FUNCTION`, foreign-key `REFERENCES`) — and, the
+  real point, from application code: literal SQL found in string literals of
+  any indexed language links the enclosing function to the table it queries.
+  `change_impact` and `get_dependents` on a table now answer "which code
+  touches this?"
+- Dead-code verdicts stay honest. Schema objects are judged only when the
+  repository demonstrably uses literal SQL the scanner can read — an
+  ORM-driven repo produces silence, not guesses. Columns of a
+  `SELECT *`-consumed table are never judged by name, and indexes/triggers
+  (DB-engine surface) are never judged at all. A flagged column reports
+  "no SQL statement in the indexed sources references it".
+
+## Solidity
+
+The tree-sitter-solidity grammar already shipped inside the pinned
+tree-sitter-wasms package — 0.3.11 registers it (and pins its SHA-256 in the
+parser-artifact allowlist), so Solidity support adds zero new dependencies.
+Contracts, interfaces, libraries, functions, constructors, modifiers, events,
+errors, structs, enums and state variables are extracted with visibility and
+membership; `is` inheritance, modifier invocations, `emit`, `new Contract()`
+and `using X for Y` all feed the call/heritage resolvers. Imports resolve
+through relative paths, Foundry remappings (`remappings.txt` / `foundry.toml`)
+and root-anchored specs; npm-style specs (`@openzeppelin/...`) are recorded as
+external dependencies. `.sol` files share directory scope like Go/C#/Rust,
+which makes Solidity's plain `import "./Base.sol"` — a statement that names no
+symbols — resolvable for siblings without guessing.
+
+`extractorSchemaV` 6 → 7; cached graphs rebuild once, automatically.
+
+## Repository
+
+The weavatrix.com landing site (pages, Cloudflare Worker config, deploy
+workflow and its asset checks) moved byte-identically to the separate
+`weavatrix-site` repository, removing ~1.2 MB of page assets from the engine
+repo. The MCPB icon the site used to own is vendored at `mcpb/icon.png`; the
+published npm package contents are unchanged.

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "weavatrix",
-  "version": "0.3.9",
+  "version": "0.3.11",
   "type": "module",
-  "description": "Local repository intelligence MCP for AI coding agents: reusable architecture graph for fast application understanding, Health, dead code, clones, history, blast radius and architecture safeguards.",
+  "description": "Local repository intelligence MCP for AI coding agents: an always-fresh architecture graph with production-first evidence — blast radius, dead code, endpoints, clones, history, Health and architecture safeguards, with honestly labeled precision.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
   "license": "MIT",
   "homepage": "https://weavatrix.com",
@@ -43,6 +43,8 @@
     "docs/releases/v0.3.7.md",
     "docs/releases/v0.3.8.md",
     "docs/releases/v0.3.9.md",
+    "docs/releases/v0.3.10.md",
+    "docs/releases/v0.3.11.md",
     "docs/releases/v0.2.19.md",
     "README.md",
     "SECURITY.md",

package/skill/SKILL.md

@@ -142,12 +142,15 @@ interface dispatch, reflection, or runtime behavior.
 - **Evidence, not verdicts**: treat audit, hub, orphan and duplicate output as hypotheses. Confirm a
   finding in source and check framework/runtime conventions before deleting, merging or redesigning
   code. A same-name/different-body pair is a divergence candidate, not proof of duplication.
-- **Freshness**: graph/health calls automatically reconcile the active graph, while cross-repository
-  tracing reconciles every selected registered graph. Read the structured `refresh` /
-  `graphReconciliation` status: `none`, `incremental`, `full`, or explicitly `PARTIAL`. Use
-  `rebuild_graph` only when automatic reconciliation reports a fallback/error or when intentionally
-  changing build mode. A normal `open_repo` builds missing graphs and upgrades legacy schemas;
-  `build:false` deliberately refuses that upgrade.
+- **Freshness**: the graph is always fresh at answer time — no watcher process and no manual refresh
+  step exists or is needed. Every graph/health call runs a debounced Git freshness probe and, when the
+  repository changed, refreshes before answering (bounded incremental reparse of changed files plus
+  reverse importers for JS/TS; full rebuild for config/export-surface/barrel changes and other
+  languages). Cross-repository tracing reconciles every selected registered graph the same way. Read
+  the structured `refresh` / `graphReconciliation` status: `none`, `incremental`, `full`, or
+  explicitly `PARTIAL`. Use `rebuild_graph` only when automatic reconciliation reports a
+  fallback/error or when intentionally changing build mode. A normal `open_repo` builds missing graphs
+  and upgrades legacy schemas; `build:false` deliberately refuses that upgrade.
 - **Ambiguity**: `get_node`/`get_neighbors`/`get_dependents` disclose `matched N nodes; using the
   best-connected` — read that note before trusting the answer; pass an exact node id to pin it.
 - **Runtime versus compile time**: keep runtime cycles separate from TypeScript type-only and
@@ -169,6 +172,10 @@ interface dispatch, reflection, or runtime behavior.
   roots. Dead-code/clone/audit review also suppresses `benchmarks/**` and `**/__temp/**` as classified
   non-production surfaces. A verified production benchmark can opt back in narrowly through
   `.weavatrix.json` `classify.product`, for example `{"classify":{"product":["benchmarks/core/**"]}}`.
+  Rust inline tests (`#[cfg(test)]` modules, `#[test]`/`#[bench]` items) are classified per symbol via
+  the node-level `test_surface` flag even though they live in production `.rs` files; dead-code,
+  query, hot-path and hub tools treat them like path-classified tests (`include_tests` /
+  `include_classified` and a test-term question opt back in).
 - **Architectural queries**: broad bootstrap/tool-execution/routing questions rank conventional
   production and graph-declared entry points ahead of classified docs, sites, benchmarks and
   fixtures. Production-first classification also applies during traversal. A class term in the

package/src/analysis/dead-check.js

@@ -6,6 +6,7 @@
 // and is fully testable with no filesystem. It only needs {nodes, links} + source text. See [[graph-builder-internalization]].
 import { posix } from "node:path";
 import { isStructuralRelation } from "../graph/relations.js";
+import { createSqlDeadVerdict } from "../graph/builder/lang-sql.js";
 import { createPathClassifier, hasPathClass } from "../path-classification.js";
 
 const IDENT_RE = /[A-Za-z_$][\w$]*/g;
@@ -198,23 +199,24 @@ export function computeDead(graph, sources, { entrySet = new Set() } = {}) {
     return isDecorated(n);                                       // framework-registered via decorator
   };
 
+  const sqlVerdict = createSqlDeadVerdict({ nodes, links, ep, bareName });   // gated SQL verdicts — ORM blindness stays silent
   const deadSymbols = [];
   for (const n of symById.values()) {
-    if (isReferenced(n)) continue;
-    const test = isTestFile(n.source_file);
-    deadSymbols.push({ id: n.id, file: n.source_file, label: n.label, test, reason: "no inbound edge and name unreferenced outside its file" });
+    if (isReferenced(n) || sqlVerdict.veto(n)) continue;
+    deadSymbols.push({ id: n.id, file: n.source_file, label: n.label, test: isTestFile(n.source_file) || n.test_surface === true, reason: sqlVerdict.reason(n) || "no inbound edge and name unreferenced outside its file" });
   }
   const deadSet = new Set(deadSymbols.map((s) => s.id));
 
   // A production declaration consumed only by tests is live to the raw graph but dead to production.
   // Keep it in a separate review class: this is useful evidence, never an automatic delete verdict.
   const testOnlySymbols = [];
+  const consumerFileOf = (id) => nodesById.get(id)?.source_file || (id.includes("#") ? id.split("#")[0] : id);
+  const isTestConsumer = (id) => nodesById.get(id)?.test_surface === true || isTestFile(consumerFileOf(id));
   for (const n of symById.values()) {
-    if (deadSet.has(n.id) || isTestFile(n.source_file) || isDecorated(n)) continue;
+    if (deadSet.has(n.id) || isTestFile(n.source_file) || n.test_surface === true || isDecorated(n)) continue;
     const sourcesForSymbol = inboundSources.get(String(n.id)) || [];
-    const sourceFiles = sourcesForSymbol.map((id) => nodesById.get(id)?.source_file || (id.includes("#") ? id.split("#")[0] : id));
-    const hasTestInbound = sourceFiles.some((file) => isTestFile(file));
-    const hasProductionInbound = sourceFiles.some((file) => file && !isTestFile(file));
+    const hasTestInbound = sourcesForSymbol.some(isTestConsumer);
+    const hasProductionInbound = sourcesForSymbol.some((id) => consumerFileOf(id) && !isTestConsumer(id));
     const name = bareName(n.label);
     const occurrenceSet = occurrenceFiles.get(name) || new Set();
     const externalOccurrences = [...occurrenceSet].filter((file) => file !== n.source_file);
@@ -232,7 +234,7 @@ export function computeDead(graph, sources, { entrySet = new Set() } = {}) {
       label: n.label,
       test: false,
       reason: "referenced only from test/e2e code; no production consumer was found",
-      testConsumerFiles: [...new Set(sourceFiles.filter((file) => file && isTestFile(file)))].sort(),
+      testConsumerFiles: [...new Set(sourcesForSymbol.filter(isTestConsumer).map(consumerFileOf).filter(Boolean))].sort(),
       evidence: hasTestInbound ? "graph" : hasExactTestInbound ? "exact-semantic" : "lexical",
       publicApi: n.exported === true || ["public", "protected"].includes(String(n.visibility || "").toLowerCase()),
     });

package/src/analysis/dead-code-review.js

@@ -51,6 +51,9 @@ export function computeDeadCodeReview(graph, sources, options = {}) {
   const suppressed = { tests: 0, classified: 0, confidence: 0, path: 0, kind: 0 };
   const candidates = [];
   for (const candidate of raw) {
+    // Node-level test surfaces (Rust #[cfg(test)] symbols in production files) follow the same
+    // include_tests policy as path-classified test files.
+    if (!includeTests && nodesById.get(String(candidate.id))?.test_surface === true) { suppressed.tests += 1; continue; }
     const info = classify(candidate.file, sources.get(candidate.file));
     const allowed = pathAllowed(info, { includeTests, includeClassified });
     if (!allowed.ok) { suppressed[allowed.bucket] += 1; continue; }

package/src/analysis/dep-rules.js

@@ -7,4 +7,4 @@ export {
     globToRe,
     representativeCycle,
 } from './structure/dependency-graph.js'
-export {computeStructureFindings} from './structure/findings.js'
+export {computeStructureFindings, isRustModuleTreeComponent} from './structure/findings.js'

package/src/analysis/hot-path-review.js

@@ -128,7 +128,7 @@ export function computeHotPathReview(graph, options = {}) {
         if (!complexity || !file || !String(node?.id || '').includes('#')) continue
         if (scope.path && file !== scope.path && !file.startsWith(`${scope.path}/`)) { excluded.outOfScope++; continue }
         const classification = classifier.explain(file)
-        const test = hasPathClass(classification, 'test', 'e2e')
+        const test = node?.test_surface === true || hasPathClass(classification, 'test', 'e2e')
         const classified = classification.excluded || hasPathClass(classification, ...NON_PRODUCT)
         if (test && options.includeTests !== true) { excluded.tests++; continue }
         if (classified && options.includeClassified !== true) { excluded.classified++; continue }

package/src/analysis/http-contracts/analysis.js

@@ -85,12 +85,18 @@ export function analyzeHttpContracts(input = {}) {
   for (const backend of backends) {
     for (const endpoint of backend.endpoints) {
       const callsites = [];
+      let endpointMismatches = 0;
+      const methodMismatchSites = [];
       for (const client of clients) {
         for (const call of client.calls) {
           if (call.path && !methodMatches(endpoint.method, call.method)) {
             const expected = pathSegments(normalizeHttpContractPath(endpoint.path));
             const actual = pathSegments(call.path);
-            if (routeShapeMatches(expected, actual) || suffixShapeMatch(expected, actual)) methodMismatches++;
+            if (routeShapeMatches(expected, actual) || suffixShapeMatch(expected, actual)) {
+              methodMismatches++;
+              endpointMismatches++;
+              if (methodMismatchSites.length < 3) methodMismatchSites.push({ clientRepo: client.id, file: call.file, line: call.line, method: call.method });
+            }
             continue;
           }
           const match = matchHttpContract(endpoint, call);
@@ -124,6 +130,8 @@ export function analyzeHttpContracts(input = {}) {
         file: normalizeContractFile(endpoint.file) || null,
         line: Number(endpoint.line) || null,
         callsites,
+        methodMismatches: endpointMismatches,
+        methodMismatchSites,
         liveness: externalUseLiveness(callsites, handlerEvidence),
         affected: affectedForEndpoint(callsites, clients, limits),
       });

package/src/analysis/structure/findings.js

@@ -63,6 +63,23 @@ function compileTimeFinding(adjacency, component, runtimeComponents, edges) {
     })
 }
 
+// Idiomatic Rust module trees close compile-time SCCs by construction: the parent (mod.rs, lib.rs,
+// main.rs, or a 2018-edition foo.rs) declares `mod child` while children reach back via super::/crate::.
+// Suppress only when every member is a .rs file sitting under one anchor's directory; genuine
+// cross-directory .rs cycles keep their findings.
+export function isRustModuleTreeComponent(component) {
+    if (!component.every((file) => String(file).endsWith('.rs'))) return false
+    return component.some((anchor) => {
+        const path = String(anchor)
+        const slash = path.lastIndexOf('/')
+        const base = path.slice(slash + 1)
+        const anchorDir = ['mod.rs', 'lib.rs', 'main.rs'].includes(base)
+            ? (slash >= 0 ? path.slice(0, slash) : '')
+            : path.slice(0, -'.rs'.length)
+        return anchorDir !== '' && component.every((member) => member === anchor || String(member).startsWith(`${anchorDir}/`))
+    })
+}
+
 export function computeStructureFindings(graph, {rules = {}, entrySet = new Set(), externalImportFiles = new Set()} = {}) {
     const imports = buildFileImportGraph(graph)
     const findings = []
@@ -73,7 +90,9 @@ export function computeStructureFindings(graph, {rules = {}, entrySet = new Set(
 
     const runtimeKeys = new Set(runtimeComponents.map((component) => [...component].sort().join('\0')))
     const allComponents = findSccs(imports.allAdj).sort((a, b) => b.length - a.length)
-    const compileTimeCouplings = allComponents.filter((component) => !runtimeKeys.has([...component].sort().join('\0')))
+    const compileTimeCandidates = allComponents.filter((component) => !runtimeKeys.has([...component].sort().join('\0')))
+    const rustModuleTreeComponents = compileTimeCandidates.filter((component) => isRustModuleTreeComponent(component))
+    const compileTimeCouplings = compileTimeCandidates.filter((component) => !isRustModuleTreeComponent(component))
     for (const component of compileTimeCouplings.slice(0, MAX_CYCLE_FINDINGS)) {
         findings.push(compileTimeFinding(imports.allAdj, component, runtimeComponents, {
             runtime: imports.edges,
@@ -135,6 +154,7 @@ export function computeStructureFindings(graph, {rules = {}, entrySet = new Set(
             largestTypeCoupling: compileTimeCouplings[0]?.length || 0,
             compileTimeCouplings: compileTimeCouplings.length,
             largestCompileTimeCoupling: compileTimeCouplings[0]?.length || 0,
+            rustModuleTreeCouplings: rustModuleTreeComponents.length,
             orphans: findings.filter((finding) => finding.rule === 'orphan-file').length,
             boundaryViolations: violations.length,
         },

package/src/analysis/task-retrieval.js

@@ -64,6 +64,8 @@ export function retrieveTaskContext(g, {
   const pathAllowed = (node) => {
     const file = fileOf(node)
     if (!file || changedFiles.has(file) || includeClassified === true) return true
+    // Node-level test surfaces (Rust #[cfg(test)]) follow the same production-first policy.
+    if (node?.test_surface === true && !requestedClasses.has('test')) return false
     if (!classificationCache.has(file)) classificationCache.set(file, classifier.explain(file, {content: ''}))
     const info = classificationCache.get(file)
     const classes = PATH_CLASS_NAMES.filter((name) => hasPathClass(info, name))

package/src/build-graph.js

@@ -31,6 +31,14 @@ export function defaultPrecisionMode(env = process.env) {
   return env?.WEAVATRIX_PRECISION === "off" ? "off" : "lsp";
 }
 
+// One-line human status for a precision summary (precisionSummary shape) — the graph_stats
+// composition, shared by the build log and open_repo so every surface reads the same fraction.
+export function precisionStatusLine(precision) {
+  const p = precision || {};
+  if (p.state === "NONE") return `Semantic precision: NONE — ${p.reason || "no eligible JavaScript/TypeScript semantic targets"}`;
+  return `Semantic precision: ${p.state || "UNAVAILABLE"} — ${p.queried || 0}/${p.candidates || 0} bounded target(s) queried${p.truncated ? " (truncated)" : ""}; ${p.verifiedEdges || 0} EXACT_LSP edge(s)${p.state !== "COMPLETE" && p.reason ? `; ${p.reason}` : ""}`;
+}
+
 function buildGraphInWorker(payload) {
   return new Promise((resolve, reject) => {
     let worker;
@@ -193,7 +201,7 @@ export async function buildGraphForRepo(repoPath, {
       hotspots: built.hotspots,
       refresh: built.refresh,
       precision: built.precision,
-      log: `built-in builder: ${built.nodes} nodes, ${built.links} static links (${built.refresh?.kind || "full"}: ${built.refresh?.reason || "build"}); semantic precision ${built.precision?.state || "UNAVAILABLE"}, ${built.precision?.verifiedEdges || 0} EXACT_LSP edge(s)`
+      log: `built-in builder: ${built.nodes} nodes, ${built.links} static links (${built.refresh?.kind || "full"}: ${built.refresh?.reason || "build"}); ${precisionStatusLine(built.precision)}`
     };
   } catch (error) {
     return { ok: false, error: `graph build failed: ${error.message}`, builder: "internal" };

package/src/graph/builder/lang-rust.js

@@ -59,6 +59,37 @@ function pathAttribute(modNode) {
   return "";
 }
 
+// Test-only classification must mean "compiled exclusively under `cargo test`": #[cfg(test)] and
+// #[cfg(all(test, ...))] guarantee that; #[cfg(any(test, ...))] also compiles into production builds
+// and deliberately stays unclassified. #[test]/#[bench] (incl. #[tokio::test]-style harness paths)
+// mark the annotated function itself.
+const CFG_TEST_RE = /#\s*!?\s*\[\s*cfg\s*\(\s*(?:test\s*\)|all\s*\(\s*test\b)/;
+const TEST_FN_ATTR_RE = /#\s*\[\s*(?:[\w]+(?:\s*::\s*[\w]+)*\s*::\s*)?(?:test|bench)\s*(?:\]|\()/;
+const CFG_TEST_CARRIERS = new Set(["mod_item", "impl_item", "trait_item", "function_item"]);
+const COMMENT_TYPES = new Set(["line_comment", "block_comment"]);
+const itemAttributeText = (item) => {
+  // Comments are NAMED siblings in tree-sitter-rust — `#[test]` + `// note` + `fn` must still classify.
+  let text = "";
+  for (let prev = item?.previousNamedSibling; prev; prev = prev.previousNamedSibling) {
+    if (COMMENT_TYPES.has(prev.type)) continue;
+    if (prev.type !== "attribute_item") break;
+    text += prev.text + "\n";
+  }
+  return text;
+};
+// `#![cfg(test)]` at the top of a file or module body gates everything below it. tree-sitter-rust
+// tokenizes a file-leading `#!...` as `shebang`; a real shebang line never matches CFG_TEST_RE.
+const innerCfgTest = (body) => (body?.namedChildren || [])
+  .some((child) => (child.type === "inner_attribute_item" || child.type === "shebang") && CFG_TEST_RE.test(child.text));
+const underCfgTest = (node) => {
+  for (let parent = node?.parent; parent; parent = parent.parent) {
+    if (parent.type === "declaration_list" && innerCfgTest(parent)) return true;
+    if (CFG_TEST_CARRIERS.has(parent.type) && CFG_TEST_RE.test(itemAttributeText(parent))) return true;
+    if (!parent.parent && innerCfgTest(parent)) return true; // source_file root
+  }
+  return false;
+};
+
 function inlineAncestors(node) {
   const result = [];
   for (let p = node?.parent; p; p = p.parent) {
@@ -129,10 +160,15 @@ export default {
         const memberOf = ownerName(owner, field);
         const symbolKind = cap.name === "function" ? (memberOf ? "method" : "function") : cap.name;
         const visibility = publicVisibility(declaration, owner);
+        const attrs = itemAttributeText(declaration);
+        const testSurface = CFG_TEST_RE.test(attrs)
+          || (cap.name === "function" && TEST_FN_ATTR_RE.test(attrs))
+          || underCfgTest(declaration);
         const id = addSym(cap.node.text, cap.node.startPosition.row + 1, cap.name === "function", {
           sourceNode: declaration,
           selectionNode: cap.node,
           symbolKind,
+          ...(testSurface ? { testSurface: true } : {}),
           ...(memberOf ? { memberOf, visibility } : { moduleDeclaration: true }),
           ...(!memberOf && visibility === "public" ? { exported: true } : {}),
         });

package/src/graph/builder/lang-solidity.js

@@ -0,0 +1,126 @@
+// Solidity extractor. Symbols: contract/interface/library (space "both" so `is Base` heritage and
+// `new Vault()` both resolve through the value-space resolver), functions/constructors/modifiers/
+// events/errors/structs/enums/state vars (members carry memberOf + visibility). Imports: relative
+// paths, Foundry remappings (remappings.txt / foundry.toml), and root-anchored specs resolve to repo
+// files; everything else (npm-style @openzeppelin/…, absent lib/ submodules) is RECORDED as an
+// external import for dependency analysis. Calls: bare `f()`, modifier invocations, `emit Event(…)`,
+// `new Contract(…)`, and `using Lib for T` all feed the calls resolver. Same-dir symbols share scope
+// (see sharesDirScope): Solidity's flat project namespace makes plain `import "./Base.sol"` — which
+// names no symbols — resolvable for siblings without guessing; cross-dir plain imports still produce
+// the file-level import edge, so blast radius stays correct even where symbol edges are unknowable.
+import { specToPkg } from "./spec-pkg.js";
+
+const CONTAINERS = new Set(["contract_declaration", "interface_declaration", "library_declaration"]);
+const KIND_BY_CONTAINER = {
+  contract_declaration: "contract",
+  interface_declaration: "interface",
+  library_declaration: "library",
+};
+// external/public functions are the deployed ABI — callable by any transaction, not just repo code.
+const VISIBILITY = { external: "public", public: "public", internal: "protected", private: "private" };
+
+function enclosingContainer(node) {
+  for (let parent = node?.parent; parent; parent = parent.parent) {
+    if (CONTAINERS.has(parent.type)) return parent;
+  }
+  return null;
+}
+
+const identifierOf = (node) => node?.namedChildren?.find((child) => child.type === "identifier") || null;
+const childOfType = (node, type) => node?.namedChildren?.find((child) => child.type === type) || null;
+const parameterCount = (node) => (node?.namedChildren || []).filter((child) => child.type === "parameter").length;
+
+export default {
+  family: "solidity",
+  grammars: ["solidity"],
+  exts: { ".sol": "solidity" },
+  isWeb: false,
+  calls: `[(call_expression (identifier) @callee) (modifier_invocation (identifier) @callee) (emit_statement (identifier) @callee) (new_expression (type_name (user_defined_type (identifier) @callee))) (using_directive (type_alias (identifier) @callee))]`,
+  heritage: [`(inheritance_specifier (user_defined_type (identifier) @base))`],
+
+  pass1(ctx) {
+    const { grammar, tree, fileRel, caps, addSym, addImportEdge, addExternalImport, imports, links, nameToId, resolveSolidityImport } = ctx;
+
+    // ---- containers (contract/interface/library) ----
+    for (const cap of caps(grammar, `[(contract_declaration (identifier) @c) (interface_declaration (identifier) @c) (library_declaration (identifier) @c)]`, tree.rootNode)) {
+      addSym(cap.node.text, cap.node.startPosition.row + 1, false, {
+        sourceNode: cap.node.parent,
+        selectionNode: cap.node,
+        symbolKind: KIND_BY_CONTAINER[cap.node.parent.type],
+        symbolSpace: "both",
+        exported: true,
+        moduleDeclaration: true,
+      });
+    }
+
+    // ---- functions (free + members), constructors, modifiers ----
+    const ownedMembers = [];
+    const addMember = (name, node, selection, extra) => {
+      const container = enclosingContainer(node);
+      const ownerName = container ? identifierOf(container)?.text || null : null;
+      const id = addSym(name, (selection || node).startPosition.row + 1, extra.callable !== false, {
+        sourceNode: node,
+        selectionNode: selection || undefined,
+        ...(ownerName ? { memberOf: ownerName } : { exported: true, moduleDeclaration: true }),
+        ...extra,
+      });
+      if (ownerName && id) ownedMembers.push({ ownerName, id });
+      return id;
+    };
+    for (const cap of caps(grammar, `(function_definition (identifier) @fn)`, tree.rootNode)) {
+      const definition = cap.node.parent;
+      const visibility = VISIBILITY[childOfType(definition, "visibility")?.text || ""];
+      addMember(cap.node.text, definition, cap.node, {
+        symbolKind: enclosingContainer(definition) ? "method" : "function",
+        ...(visibility ? { visibility } : {}),
+        parameterCount: parameterCount(definition),
+      });
+    }
+    for (const cap of caps(grammar, `(constructor_definition) @ctor`, tree.rootNode))
+      addMember("constructor", cap.node, null, { symbolKind: "constructor", parameterCount: parameterCount(cap.node) });
+    for (const cap of caps(grammar, `(modifier_definition (identifier) @m)`, tree.rootNode))
+      addMember(cap.node.text, cap.node.parent, cap.node, { symbolKind: "modifier", parameterCount: parameterCount(cap.node.parent) });
+
+    // ---- data/type declarations ----
+    for (const cap of caps(grammar, `[(event_definition (identifier) @n) (error_declaration (identifier) @n)]`, tree.rootNode))
+      addMember(cap.node.text, cap.node.parent, cap.node, { callable: false, symbolKind: cap.node.parent.type === "event_definition" ? "event" : "error" });
+    for (const cap of caps(grammar, `[(struct_declaration (identifier) @n) (enum_declaration (identifier) @n)]`, tree.rootNode))
+      addMember(cap.node.text, cap.node.parent, cap.node, { callable: false, symbolKind: cap.node.parent.type === "struct_declaration" ? "struct" : "enum", symbolSpace: "both" });
+    // capture the DECLARATION and take its first identifier child (the name): an initializer such as
+    // `uint x = OTHER_CONST;` can place a second bare identifier under the same declaration node.
+    for (const cap of caps(grammar, `(constant_variable_declaration) @d`, tree.rootNode)) {
+      const name = identifierOf(cap.node);
+      if (name) addMember(name.text, cap.node, name, { callable: false, symbolKind: "constant" });
+    }
+    for (const cap of caps(grammar, `(state_variable_declaration) @d`, tree.rootNode)) {
+      const name = identifierOf(cap.node);
+      const visibility = VISIBILITY[childOfType(cap.node, "visibility")?.text || ""] || "protected"; // Solidity default: internal
+      if (name) addMember(name.text, cap.node, name, { callable: false, symbolKind: "variable", visibility });
+    }
+    for (const member of ownedMembers) {
+      const ownerId = nameToId.get(member.ownerName);
+      if (ownerId) links.push({ source: ownerId, target: member.id, relation: "contains", confidence: "EXTRACTED" });
+    }
+
+    // ---- imports ----
+    for (const cap of caps(grammar, `(import_directive) @imp`, tree.rootNode)) {
+      const specNode = childOfType(cap.node, "string");
+      if (!specNode) continue;
+      const spec = specNode.text.replace(/^["']|["']$/g, "");
+      const line = specNode.startPosition.row + 1;
+      const target = resolveSolidityImport(fileRel, spec);
+      if (target) {
+        addImportEdge(target, { specifier: spec, line });
+        // `import {A, B} from "./x.sol"` — bind each named symbol. A lone identifier may instead be a
+        // `* as Alias` namespace name; binding it the same way is harmless (no same-named symbol → no edge).
+        for (const named of cap.node.namedChildren.filter((child) => child.type === "identifier"))
+          imports.set(named.text, { imported: named.text, targetFile: target });
+        continue;
+      }
+      if (spec.startsWith(".")) { addExternalImport({ spec, kind: "sol-import", line, unresolved: true }); continue; }
+      const r = specToPkg(spec);
+      if (r) addExternalImport({ spec, pkg: r.pkg, builtin: false, kind: "sol-import", line });
+      else addExternalImport({ spec, kind: "sol-import", line, unresolved: true });
+    }
+  },
+};