One-command local setup for a repo or PR: analyze sources, auto-apply weak AI candidate links and candidate flows when a real BYOK provider is configured, write behavior-coverage.html (detailed report), short_behavior-coverage.html (summary), tests.csv + rtm.md, summarize changed/gap targets, and return agent next actions. When nothing changed since the last run it returns at once with unchanged_since and reuses the reports (fresh=true forces a full run). AI lanes stay separate and never affect Proven coverage.

Build or refresh the local OrangePro evidence graph from a local checkout/path plus optional CSV/Markdown enrichers. Metadata-only by default — reads source in-process but never stores or uploads code. Optionally stages/applies AI candidate flows and refreshes the report when ai_flows=true.

Return the local graph readiness score (0-100), band, per-dimension breakdown, and plain-language missing evidence. Readiness signal, not a proof of test lift.

Show local workspace state without generating anything: whether the graph is fresh/stale/missing, source mix, score, and privacy settings (always local, no upload).

Recommend the smallest next source that would most improve generated-test quality, with expected score impact. Teaches what data improves output.

List requirements/flows with weak or missing test evidence, plus top_risk_gaps for unproven code symbols ranked by the OrangePro Risk Score (Probability × Impact × DetectionDifficulty). Risk is prioritization only; it never changes coverage/proof status.

Record an agent test-writing attempt as static diagnostics. When test_path is provided for TS/JS, OrangePro first tries scoped deterministic re-prove; otherwise it re-analyzes the repo. Static hard COVERS edges render as Associated signal; public Proven requires orangepro_prove.

Run the dynamic targeted-proof oracle for a CodeSymbol and append a metadata-only ledger certificate. Public Proven closes only when baseline green plus a valid sentinel mutation of the credited symbol fails the same test at an assertion. Static record_run is diagnostics only.

Product wrapper around orangepro_prove: run trusted-local setup_commands in the source checkout, then the UNCHANGED dynamic targeted-proof oracle, then refresh the behavior report. Setup is non-secret repo prep only (build/install/shim); a setup failure returns unrunnable, does not run the oracle, and leaves the ledger untouched (never Proven). Public Proven still closes only through the unchanged certificate.

Summarize the local gap-fill ledger: attempted, dynamic-reproven, unproven, legacy static-associated, generated-but-unverifiable, and kept rate. Metadata-only.

Write and return a deterministic Requirements Traceability Matrix. Status comes only from the local graph and gap-fill ledger: Proven, Runtime-covered, Associated signal, No integration signal, Reproven, or Generated-unverifiable. No LLM calls.

Refresh the local graph from changed files. Incremental and non-destructive by default — preserves evidence and marks affected generated tests stale.

DIFF/PR TOOL — only for real code-review situations. Summarizes what changed vs a base git ref and which local graph behaviors/tests are affected (basic changed-file impact; no deep route/API shape analysis). Requires a git repo and a real diff: returns status 'no_diff' / 'no_code_changes' (diff was docs-only) / 'missing_base_ref' / 'not_a_git_repo' with guidance instead of fabricated impact when there is nothing to analyze. For baseline (no-PR) test opportunities use orangepro_find_test_gaps.

Opt-in AI lane: propose weak MAY_RELATE_TO candidate links between existing deterministic behavior and CodeSymbol nodes. Generate writes .orangepro/ai/links.json only; apply=true explicitly merges survivors into candidate_edges. These links never affect proven coverage.

Opt-in AI lane: propose candidate behavior-flow chains over existing deterministic entry and CodeSymbol ids. Generate writes .orangepro/flows.json only; apply=true stores survivors under analysis.candidate_flows. Candidate flows are a verify-these worklist and never affect Proven, deterministic flow counts, tiers, or coverage.

Generate a small capped set (1-5) of grounded tests from local evidence using your own model key (BYOK: OpenAI-compatible, Ollama, or Anthropic). Tests are diversified across lightweight LOCAL scenario buckets (happy_path, validation_error, edge_case, integration_flow, security_privacy, regression) chosen from the evidence — unjustified buckets are skipped, never padded. By default it focuses the top-gap behavior and returns up to limit bucket-diverse tests for it; pass multiple target_ids to split the budget across them. Each test reports its bucket plus VALIDATED grounding evidence (every cited entity resolved against the local graph with its kind, evidence strength, and source_ref) and discloses weak/candidate evidence; evidence_summary reports proof coverage and any broken citations, so the grounding is verifiable rather than asserted. If evidence is too thin, returns missing-evidence guidance instead of generic tests. Returns each test's code plus run_hints (a suggested file path + run command) and an agent_workflow: YOU (the agent) write each file and run it with your shell tools, then report pass/fail + stack traces — OrangePro never writes to or runs anything in the repo. Requires the repo's test framework/deps to already be installed.

Explain why a generated test exists: which graph evidence anchors support it, source refs, and whether weak/candidate evidence was used. Exposes trust artifacts only, not internal generation logic.

Export a portable evidence pack (JSON) plus a human-readable Markdown summary for review or later hosted promotion. Includes facts, provenance, generated outputs, and high-level score metadata — never prompts, weights, traces, or raw source. Validates against the local schema.