v0.2.40

• Risk-config warnings now surface on every ranking entry point: opro analyze , opro gaps, and gaps --json (previously only start), read from the analyzed repository rather than the working directory
• An unreadable .orangepro/config.json aborts analyze with the file path and a hint (JSON does not allow // comments) instead of a bare parse error
• Surface tests exercise opAnalyze and opGaps in both usage patterns (in-repo and analyze-a-path-from-elsewhere)
• No scoring or evidence changes

v0.2.39

• Config warnings are read from the analyzed repository, so 'opro start /path/to/repo' run from another directory reports an unreadable config the same way the HTML report does
• The config disclosure block now lists every ranking-changing classification setting (test_support_paths, scheduled_entry_paths, destructive_sinks, sensitivity_ignore) and names the symbols whose score sensitivity_ignore changed
• reclassify tests cover payment, auth, pii, and none; the irreversible-worklist regression test now runs through the report builder, not just the ranking function
• Scoring, evidence tiers, proof oracle, and compile gate unchanged; Temporal top-20 and input fingerprint byte-identical to 0.2.38

v0.2.38

• A risk config that fails to parse now announces itself in the CLI output and the report provenance instead of silently reverting to defaults
• Config disclosure block above the risk list: config hash, overrides active, every suppressed symbol with its reason, ranking exclusions, and switch state — a tuned report can no longer pass as clean
• reclassify overrides now implement auth / payment / pii / none (previously only none had an effect)
• The input fingerprint includes the risk config hash: same commit + version + config = same ranking, one hash
• The irreversible worklist searches the full ranking for destructive paths, not the top 200
• Scoring formula, evidence tiers, proof oracle, and compile gate unchanged; Temporal top-20 byte-identical to 0.2.37

v0.2.37

• Two risk worklists rendered above the ranked list: Change frontier (changing fast, unproven) and Irreversible (can destroy data, unproven), both derived from the one unchanged ranking; rows jump to their ranked card
• User-level risk config at ~/.orangepro/config.json applied first, overridden per key by the repo's .orangepro/config.json; the merged config is hashed into report provenance

v0.2.36

• Two risk worklists derived from one ranking, in the report data (worklists.changeFrontier: changing fast, unproven; worklists.irreversible: can destroy data, unproven). The scoring formula is unchanged — a multiplicative top-20 cannot hold both families, so both are now available; on-page rendering follows in 0.2.37
• Destructive-sink detection by call shape: delete/purge/drop/destroy through any receiver field; remove* only through a persistence-shaped field; chained calls and past participles (DeletedRuleRetentionTime) are not sinks
• Risk rows now read in plain English: the consequence, what the graph saw (naming the actual sink callee), and what would close it; the formula in words at the end
• rank_exclude_paths in .orangepro/config.json: exclude a scope (e.g. ui/**) from the ranking without touching the denominator
• TypeScript repos retain unresolved external callees by name, matching Go — no new nodes or edges
• Evidence tiers, proof oracle, compile gate, and the P×I×D formula are untouched

v0.2.35

• Go call graph: receiver-method calls (t.method()) now resolve to the receiver type's methods, same file and same package — Temporal CALLS edges 8,075 → 13,673
• Unresolved external callees retained as names on the caller (external_callees) — no new nodes or edges
• Risk: paths reaching a destructive call on an external surface (store/client/admin/db) floor impact at 5; unproven scheduled/queue-triggered entries get detection ×1.25; reasons shown on the row
• Ranking hygiene: test-support paths, one-line declarations, and trivial accessors no longer take risk slots (denominator unchanged)
• Per-repo risk config in .orangepro/config.json: classification globs, two tuning switches, and suppress/pin/reclassify overrides that require a written reason; config hash recorded in report provenance and the run delta
• Evidence tiers, the proof oracle, and the compile gate are unchanged

v0.2.31

What's Changed

• fix: report generation and coverage provenance by @coolvibh in #20
• chore(release): prepare 0.2.31 by @coolvibh in #21

Full Changelog: v0.2.30...v0.2.31

v0.2.28

• Fixed: telemetry language detection (was always 'unknown')
• Fixed: version reporting (ESM __dirname)
• Telemetry now includes: behavior count, BYOK status, scan duration
• Added: hourly Discord notification for new scans

v0.2.27

• Fixed: telemetry language detection (was always 'unknown')
• Fixed: telemetry version reporting (ESM __dirname)
• Telemetry now includes: behavior count, BYOK status, report success, scan duration
• No new data collected about code, files, or identity

v0.2.24

• Anonymous usage telemetry (opt-out via DO_NOT_TRACK=1 or ORANGEPRO_NO_TELEMETRY=1)
• Dominant language detection from graph nodes
• Silent fire-and-forget, no prompts, no PII