Monogram Semantics

Monogram Semantics builds a local libSQL Store of per-function or per-config-unit structural IR. Its default extractor is Tree-sitter plus libSQL, except for the Dockerfile line parser. It can also run explicit compiler-facts probes, but those facts are review output only: they are not persisted into the Store and do not become ranking signals. Published contract: monogram-semantics 0.6.0, OpenCLIs build 2026-07-12-191804. The executing binary, OpenCLIs registry, and public CDN metadata agree on this release. The dispatcher exposes 74 operational root commands. help, --help, and -h are root-only guide forms; an operational command followed by --help returns exit 1 instead of a command-specific guide. version, --version, and -V are identity forms rather than operational commands. The installed 0.6.0 no-argument guide predates 15 dispatcher roots even though the binary recognizes them. This page and repository HEAD enumerate the complete surface; the missing embedded-guide entries are called out in the tables below rather than being hidden.

Quick Start

openclis install monogram-semantics

monogram-semantics --version
monogram-semantics index /path/to/project
monogram-semantics stats --db /path/to/project/.monogram-semantics.db --json
monogram-semantics fn resolve_calls --db /path/to/project/.monogram-semantics.db --pretty

Index the full module or repository root when cross-file resolution matters. A subdirectory-only index cannot prove edges to definitions outside that slice.

Complete Command Inventory

Entry, traversal, and module graph

Command	What it does	Important controls
`fn`	Finds functions/config units by exact or qualified-suffix name.	`<name>`, `--db`, `--pretty`, `--json`
`implementors`	Finds trait, parent, base, or interface implementation edges.	`<trait-or-type>`, `--by-type`, `--pretty`, `--json`
`cross-lang`	Joins literal TS/JS Tauri invokes with Rust command handlers.	`--target`, `--unresolved`, `--dead-handlers`, `--pretty`, `--json`
`callers`	Finds functions that call a name; optionally restricts to resolved or external caller evidence.	`<name>`, `--resolved`, `--external`, `--db`, `--json`
`callees`	Lists direct lexical or resolved callees of a function.	`<name>`, `--resolved`, `--db`, `--json`
`importers`	Finds files that import, re-export, or dynamically import a module.	`<module>`, `--json`
`imports`	Lists import/re-export edges originating from matching files.	`<file>`, `--json`
`exports`	Locates export and re-export sites for a symbol.	`<symbol>`, `--json`
`orphan-modules`	Lists TS/TSX/JS files with no resolved inbound module edge.	`--limit`, `--json`; candidates, not automatic dead-code verdicts.
`types`	Reads TypeScript alias/enum surface by name.	`<name>`, `--json`
`chain`	Executes the composable entry/traversal DSL.	Quoted pipeline, `--db`, `--explain`, `--json`

Aggregate audits and possibility bands

Command	What it does	Important controls
`audit`	Produces a one-shot structure, resolution, complexity, Tauri, and module-graph health card.	`--db`, `--json`
`module-stats`	Reports module-edge kinds, import hubs, exports, and dead-export candidates.	`--top`, `--json`
`complexity`	Ranks functions by decision-point and nesting proxies.	`--top`, `--json`
`hubs`	Ranks resolved call-graph fan-in/fan-out or unreferenced candidates.	`--fanout`, `--unreferenced`, `--top`, `--json`
`metrics`	Emits HIS-style complexity/LOC/parameter/fan-out threshold coverage.	`--over`, `--top`, `--json`
`smell`	Names severity-ranked god-function, complexity, length, parameter, and hub candidates.	`--top`, `--json`
`effects`	Summarizes or lists effect flags and selected transitive effects.	Effect name, `--transitive`, `--limit`, `--json`
`unsafe-reach`	Compares lexical and confidently resolved reachability into unsafe code.	`--limit`, `--json`
`blocking-in-async`	Finds known blocking calls inside async Rust or Python functions.	`—lang rust	python`,` —limit`,` —json`; possibility band.
`lock-across-await`	Finds Rust lock guards or C# acquire/release pairs spanning await.	`—lang rust	csharp`,` —limit`,` —json`; structural over-approximation.
`select-sites`	Lists every `tokio::select!` site and highlights loop contexts for cancel-safety review.	`--limit`, `--json`; complete worklist, not bug verdict.
`worklist`	Runs a named fixed-predicate Tier-0 worklist band.	`<name>`, `--limit`, `--json`
`taint-candidates`	Lists path, XSS, SQL, and XPath sinks whose first argument is function-parameter-derived within one function.	`--limit`, `--db`, `--json`; flow-insensitive candidate list, not attacker-control or sanitizer proof.
`inter-proc-taint`	Extends the arg-0 taint lane through confidently resolved helper calls.	`--depth`, `--limit`, `--db`, `--json`; unresolved/ambiguous edges break chains.
`xss-candidates`	Lists parameter-derived TS/JS `innerHTML`/`outerHTML` assignments.	`--limit`, `--db`, `--json`; recognized escapers are annotated and demoted, not dropped.
`provenance`	Navigates from a stored field/getter to writer functions, RHS identifiers, and writer callees.	`<field-or-getter>`, `--db`; answers where, not whether the value is correct.
`mutable-defaults`	Finds Python list/dict/set literal parameter defaults.	`--lang python`, `--limit`, `--json`
`panic-reach`	Finds Rust Tauri commands that transitively reach panic/abort effects.	`--limit`, `--json`
`goto-fail`	Finds code after definite divergence, the CWE-561/705 double-transfer family.	`--limit`, `--db`, `--json`; preprocessor-dead rows are subtracted where captured.
`empty-catch`	Finds empty catch/except bodies that swallow an exception.	`--limit`, `--db`, `--json`; intentional ignores still need explicit review.
`comparator-overflow`	Finds comparator methods that return bare subtraction and can overflow/invert ordering.	`--limit`, `--db`, `--json`; CWE-128/190 candidate band.
`force-unwrap`	Finds Kotlin `!!`, Dart `!`, and Swift force unwraps.	`--limit`, `--db`, `--json`; CWE-476 review surface, including deliberate assertions.
`toctou`	Finds same-function path check plus path use pairs.	`--limit`, `--db`, `--json`; CWE-367 structural co-occurrence, not raceability proof.
`lock-no-unlock`	Finds lock acquisition without a same-function unlock.	`--limit`, `--db`, `--json`; paired helper release is the main false-positive class.
`resource-leak`	Finds C allocation without a same-function free.	`--limit`, `--db`, `--json`; ownership transfer to the caller is the main caveat.
`unsafe-send`	Lists hand-written Rust `unsafe impl Send/Sync` audit sites.	`--limit`, `--json`
`async-void`	Lists C# `async void` functions.	`--limit`, `--json`
`is-literal`	Finds Python value literals compared with identity rather than equality.	`--limit`, `--db`, `--json`
`bitwise-precedence`	Finds C bitwise/comparison precedence candidates such as `a & 1 == 2`.	`--limit`, `--db`, `--json`; CWE-783 possibility band.
`rescue-exception`	Lists Ruby `rescue Exception` sites.	`--limit`, `--json`
`throwing-dtor`	Lists C++ destructors that can throw.	`--limit`, `--json`
`floating-promise`	Finds resolved TS/JS async calls without await/then/catch handling.	`--limit`, `--json`
`contract-pair`	Finds incomplete equality/hash contract pairs.	Positional contract `java-eq` or `py-eq`; `--limit`, `--json`
`injection-surface`	Traces Tauri commands to unsafe, FFI, process, or SQL sinks; optional value lane.	`--value`, `--lexical`, `--depth`, `--json`
`audit-commands`	Reports each Tauri command’s confident reachability into a selected target class/function.	`--reaches`, `--depth`, `--all`, `--json`
`impact`	Computes confident or lexical forward/reverse transitive closure for one function.	`<fn>`, `--forward`, `--depth`, `--lexical`, `--json`

Index, lifecycle, schema, configuration, and utilities

Command	What it does	Important controls
`index`	Recursively extracts supported files and persists incremental Store state.	Paths, `--db`, `--verbose`, `--full-resolve`, `--timing`
`stats`	Reports files/functions/calls, resolution tiers, effects, and bridge aggregates.	`--db`, `--json`
`emit-anchors`	Emits structural owner-setup/owner-teardown labels for Monogram Language induction.	`--db`, `--json`
`teardown-reach`	Traverses confident callees reachable from structural destructors.	`--db`, `--depth`, `--json`
`lifecycle-flow`	Shows source-order acquire/use/release/transfer call labels for one function.	`<fn-name>`, `--db`, `--json`; not execution-order/dataflow proof.
`find-like`	Fuzzy-finds a function when the exact name is unknown.	`<name>`, `--db`, `--pretty`, `--json`
`exceptions`	Finds handlers, declarations, or transitive throws for an exception type.	`<type>`, `--handles`, `--declares`, `--throws`, `--db`, `--json`
`references`	Reads typed non-call reference edges beneath a path prefix.	`<prefix>`, `--db`, `--json`
`reference-census`	Reports total reference edges and highest fan-in paths.	`--top`, `--db`, `--json`
`contract-drift`	Diffs Rust struct, TypeScript type, and JSON Schema field sets.	Any two of `--rust`, `--ts`, `--schema`; `--db`, `--json`
`schema-bands`	Finds dangling, dead, and recursive JSON Schema `$ref` candidates.	`--db`, `--json`
`schema-metrics`	Ranks schemas by `$ref` fan-in and validator-edge profile.	`--db`, `--json`
`env-surface`	Groups literal environment-variable reads and highlights single readers.	`--db`, `--json`
`command-surface`	Groups external process spawns and flags dynamic executable selection.	`--db`, `--json`
`css-bands`	Reports dangling custom-property reads and dead-token candidates, excluding captured JS `getPropertyValue`/`setProperty` references.	`--db`, `--json`; dynamic token-name construction remains outside the scan.
`css-token`	Shows one CSS custom property’s definitions, CSS/JS consumers, and token dependencies.	`<name>`, `--db`, `--json`; name may be bare or `--`-prefixed.
`cargo-unused`	Joins Cargo normal dependencies with indexed Rust imports to find unused candidates.	`--db`, `--json`
`cargo-deps`	Builds reverse path-dependency fan-in for indexed Cargo workspace manifests.	`--db`, `--json`
`npm-unused`	Finds package dependencies whose names appear nowhere in indexed package source.	`--db`, `--json`; dev dependencies excluded.
`wrangler-dead-bindings`	Finds D1/KV/R2 bindings never referenced as `env.<name>` in indexed Worker source.	`--db`, `--json`
`audit-resolutions`	Reports resolution kinds and honesty-floor invariant violations.	`--db`, `--json`
`dead-code`	Finds intra-function statements/cases after terminal control flow.	`--limit`, `--db`, `--json`
`mutation-surface`	Finds C# out/ref and Rust `&mut` argument mutation through calls.	`--db`, `--json`
`release-fns`	Lists structural release/teardown seed functions.	`--db`, `--json`
`extract`	Extracts one file without persistence.	`<file>`, `--pretty`, `--summary`
`compiler-facts`	Runs explicit compiler/parser review probes over files or directories.	Paths, `--recursive`/`--no-recursive`, `--limit`, `--json`, `--pretty`
`debug-tree`	Dumps the Tree-sitter parse tree for extractor development.	`<file>`
`version`	Prints the executing version.	Read-only.
`help`	Prints the installed full reference.	No arguments also print it.

Language and Proof Levels

The default Store covers Rust, TypeScript/TSX, JavaScript, Python, Go, Java, C, C++, C#, Swift, Kotlin, Dart, Scala, Zig, PHP, Ruby, Lua, Bash, HCL, CSS, HTML, Dockerfile, TOML, YAML, and JSON.

default extract/index
  source structure, names, calls, effects, module/type/config edges
                         ↓
compiler-facts (explicit opt-in)
  compiler/parser diagnostics and summaries for review only
                         ↓
runtime or language-server proof
  still separate when behavior, binding, type flow, or lifetime is claimed

The structural Store does not silently claim type inference, macro expansion, borrow checking, overload/trait resolution, runtime scheduling, package-manager semantics, browser cascade/layout, JSON Schema validation, or host-application config semantics.

Incremental Store Contract

index skips unchanged files by modification time. Body-only edits with an unchanged exported surface can use scoped call re-resolution; signature, implementation, field, config, file-add/remove, or other surface changes fall back to a full resolve. --full-resolve and MONOGRAM_SEMANTICS_FORCE_FULL_RESOLVE=1 are explicit kill switches. The default database is <first-path>/.monogram-semantics.db. Pin --db in reproducible reviews and use stats to state exactly which Store supplied the result.

Release Platforms

The 0.6.0 CDN metadata publishes five artifacts. Intel macOS is not present; do not infer it from source portability.

Platform key	Binary
`darwin-aarch64`	`monogram-semantics`
`linux-aarch64`	`monogram-semantics`
`linux-x86_64`	`monogram-semantics`
`windows-aarch64`	`monogram-semantics.exe`
`windows-x86_64`	`monogram-semantics.exe`

The installed macOS ARM payload is Developer ID signed. Source checkout, installed immutable payload, CDN metadata, and public documentation are separate proof layers; this page’s release stamp identifies the shipped layer.

Relationships

Tool	Ownership
Monogram	Everyday code navigation, product ranking, and score-debug
Monogram Logos	Possibility-band foundry review over this Store
Monogram Language	Corpus-derived lexical/language priors and gated review artifacts
Monograph	Mechanism and fix-shape knowledge attached after detector bands fire
Monobench	External behavior/lift evaluation, not an in-tool verdict command

Get Started

Articles

So Anthropic

User Guide

Philosophy

Applied Philosophy

Architecture

Gestalt Color

Transparency

Terminal Core

Features

VariableMD

Research

CodexMono

OpenCLIs

vpncli

MonoSurf

AI-CLIs

Quick Start

Complete Command Inventory

Entry, traversal, and module graph

Aggregate audits and possibility bands

Index, lifecycle, schema, configuration, and utilities

Language and Proof Levels

Incremental Store Contract

Release Platforms

Relationships

​Quick Start

​Complete Command Inventory

​Entry, traversal, and module graph

​Aggregate audits and possibility bands

​Index, lifecycle, schema, configuration, and utilities

​Language and Proof Levels

​Incremental Store Contract

​Release Platforms

​Relationships

Quick Start

Complete Command Inventory

Entry, traversal, and module graph

Aggregate audits and possibility bands

Index, lifecycle, schema, configuration, and utilities

Language and Proof Levels

Incremental Store Contract

Release Platforms

Relationships