feat(mcp): the findings list carries the rung, and leads with what was decided

The stated final objective is the rung plus an LLM way of diving in
without being forced to rethink the code. The second half is largely
plumbing, because the material already exists: the witness
(`username -> db.session.execute(...) in models/user_model.py (line 73, 8
steps)`) is the reasoning, already written down and already attached to
the finding.

So this session's recurring shape was worth checking rather than assuming,
and it was there. `openultrasast.get_finding` returns the whole record
including the witness, but `openultrasast.findings` dropped the rung: an
LLM listing libpng's 198 rows could not tell the one the graph decided
from the 197 an enumerator proposed without fetching all 198 one at a
time. That is exactly the re-derivation the list exists to spare it.

The list now carries the rung, orders strongest first, and returns a
per-rung tally so a caller can triage before it fetches anything.

The brief records what still stands between here and the objective: the
witness is one line and the query already walks the path elements before
discarding all but the first; the suspicion band will be reasoned about at
length by an LLM, which is worse than a human ignoring it; and a family
that cannot decide its class must say so, or the model will confidently
explain a silence.

Gates byte-identical.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

src/openultrasast/mcp.py

@@ -91,6 +91,13 @@ def _status(args: dict[str, Any]) -> dict[str, Any]:
     }
 
 
+# Strongest first. A caller listing a real repository's findings gets hundreds of rows, and without the
+# rung it cannot tell the one the graph decided from the ones an enumerator proposed -- libpng returned 198
+# rows of which one was entailed. It would have to fetch each finding individually to find out, which is the
+# re-derivation this list exists to spare it.
+_RUNG_ORDER = {"execution_confirmed": 0, "model_entailed": 1, "model_corroborated": 2, "suspicion": 3}
+
+
 def _findings(args: dict[str, Any]) -> dict[str, Any]:
     payload = _read_json(Path(_require(args, "run_dir")) / "findings.json")
     items = [
@@ -100,10 +107,15 @@ def _findings(args: dict[str, Any]) -> dict[str, Any]:
             "line": finding.get("line"),
             "severity": finding["severity"],
             "title": finding["title"],
+            "rung": finding.get("rung", "suspicion"),
         }
         for finding in payload.get("findings", [])
     ]
-    return {"findings": items, "count": len(items)}
+    items.sort(key=lambda item: (_RUNG_ORDER.get(str(item["rung"]), len(_RUNG_ORDER)), str(item["path"]), item["line"] or 0))
+    by_rung: dict[str, int] = {}
+    for item in items:
+        by_rung[str(item["rung"])] = by_rung.get(str(item["rung"]), 0) + 1
+    return {"findings": items, "count": len(items), "by_rung": by_rung}
 
 
 def _load_finding(run_dir: Path, finding_id: str) -> dict[str, Any]: