evilution 0.30.4 → 0.31.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2bd9eaca72cb973c6e11841144b8bae68d2a838aef1ff64c429e18b4090505f1
-  data.tar.gz: bbdedbc5ef66ca367deeec89a53399ce83a235616fe2ac179ed98bf880f8be9b
+  metadata.gz: 923190b1b1b35a2e5bad46d1866a0a001bcd6afa48d208f962e73d73af6e7577
+  data.tar.gz: 76edef4423129342ce415bead32545894927070d042f615294d5b04df2c6b5ec
 SHA512:
-  metadata.gz: b7cf12d8381e05d66b1a2ffcf1c243e3e18d66f8f073de892d40ff139bb6952214ac5c6bdcff3ab026dd475601629790e7c4d5f86f8315a8baf989bcb5b4aa7b
-  data.tar.gz: 21a523a1f2753c5e70b9fb2d53262d28b169661b75c2bd2ca44ce5f9e5c6234591f6d8dcc935fea8c49a79689d7be5a2883cae6ff4517b711379b80b8d8315bf
+  metadata.gz: ff3ec8345986e7ad9b51e7a7ec75ed3b2acbb95eb00c11d1edd3ca0c41163b7a24fa8ba68e82e941608644c4075f50a2734c1c1ee6787ac48f794ae47bfda8ae
+  data.tar.gz: 826763c5a82048db39a81a9343f586aac488ecf1910d56bc086456cb5dbe7ee975a6c4de9651ee87f7210a9f26635599db347ee02c6d6ec43623caa151cd5e14

data/.beads/interactions.jsonl

@@ -387,3 +387,9 @@
 {"id":"int-011584d4","kind":"field_change","created_at":"2026-05-15T15:55:27.437673072Z","actor":"Denis Kiselev","issue_id":"EV-vxgl","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Fixed PR (merged). MutationApplier#mark_feature_loaded registers realpath in $LOADED_FEATURES post-eval — spec require() no longer reloads original. pagy jobs=4: 0% -> 82.81%. Residual gap vs jobs=1 is separate (EV-wu8w in_process inflation)."}}
 {"id":"int-c44e7652","kind":"field_change","created_at":"2026-05-16T12:45:46.793709029Z","actor":"Denis Kiselev","issue_id":"EV-xfaj","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Fixed in PR #1260 — run_minitest counts test methods from Minitest::Runnable.runnables registry instead of an evictable reporter"}}
 {"id":"int-eea19850","kind":"field_change","created_at":"2026-05-16T14:22:49.671269232Z","actor":"Denis Kiselev","issue_id":"EV-wu8w","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Fixed in PR #1264 — run_minitest reads verdict from evilution's own per-run SummaryReporter attached after plugin init"}}
+{"id":"int-cf85d538","kind":"field_change","created_at":"2026-05-16T15:40:28.573223389Z","actor":"Denis Kiselev","issue_id":"EV-5dxk","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Part A (required guard: 0 dispatched test methods -> :error) shipped in 0.30.3 PR #1257. Acceptance met. Part B (test-unit integration) split into its own epic."}}
+{"id":"int-6efa8613","kind":"field_change","created_at":"2026-05-16T15:55:20.799858411Z","actor":"Denis Kiselev","issue_id":"EV-174x","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Fixed and merged 2026-05-12; GH #1194 / #1195 closed. RedefinitionRecovery widened (already registered/initialized/exists); splice approach reverted for memory leak. Bead-close missed at merge time — syncing now."}}
+{"id":"int-ddb8370f","kind":"field_change","created_at":"2026-05-16T15:55:21.07310729Z","actor":"Denis Kiselev","issue_id":"EV-wwx3","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Fixed and merged 2026-05-12; GH #1194 / #1195 closed. RedefinitionRecovery widened (already registered/initialized/exists); splice approach reverted for memory leak. Bead-close missed at merge time — syncing now."}}
+{"id":"int-4ea24fb5","kind":"field_change","created_at":"2026-05-16T16:04:54.395246914Z","actor":"Denis Kiselev","issue_id":"EV-s24s","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Already fixed — both named specs (unparseable_short_circuit_spec.rb, neutralization_integration_spec.rb) pass and destructure via execution.results. Stale in_progress; syncing."}}
+{"id":"int-8b699158","kind":"field_change","created_at":"2026-05-16T17:22:07.345408768Z","actor":"Denis Kiselev","issue_id":"EV-kcuf","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Proof-of-life canary implemented + merged. Runner::Canary runs a synthetic unobservable mutation at session start; aborts if not scored :survived. --[no-]canary flag, config.canary default true."}}
+{"id":"int-e4dcc2b3","kind":"field_change","created_at":"2026-05-27T04:19:00.738936734Z","actor":"Denis Kiselev","issue_id":"EV-qbd6","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Fix landed on master in commit 0f1781f (require 'bundler/setup' at bin/evilution-self:16). Verified 2026-05-27: crash dir lib/evilution/result/*.rb scores 91.11% (744 muts, 656 killed, 64 survived, 24 equivalent, 0 errors); canary passes; dual-runtime harness measures crash dirs again."}}

data/.rubocop_todo.yml

@@ -8,7 +8,13 @@ Metrics/AbcSize:
 
 Metrics/ClassLength:
   Exclude:
+    - "lib/evilution/config.rb"
     - "lib/evilution/isolation/fork.rb"
     - "lib/evilution/integration/minitest.rb"
     - "lib/evilution/mcp/mutate_tool.rb"
+    - "lib/evilution/runner.rb"
     - "lib/evilution/runner/isolation_resolver.rb"
+
+Metrics/MethodLength:
+  Exclude:
+    - "lib/evilution/runner.rb"

data/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 Versioning policy: see [docs/versioning.md](docs/versioning.md).
 
+## [0.31.0] - 2026-05-27
+
+### Added
+
+- **Proof-of-life canary at session start** — before any real mutation runs, `Evilution::Runner::Canary` evals a synthetic, guaranteed-unobservable mutation through the configured integration + isolation. A healthy pipeline must score it `:survived`; any other status aborts the run with a diagnostic, so the user never sees a score that was produced by a broken pipeline (autoload mismatch, reporter-plugin eviction, isolation defect, `fail_if_no_examples` config drift, etc.). On by default; toggle with `--[no-]canary` or `canary: true|false` in `.evilution.yml`. Mirrors the configured `--isolation` so isolation-specific defects are caught too (EV-kcuf, PR #1268, GH #1233)
+
+### Fixed
+
+- **Mutation children no longer pollute the working tree with files written to relative paths** — every isolator (fork and in_process) now `Dir.chdir`s into a per-mutation sandbox directory for the duration of `test_command.call`, and removes the sandbox on the way out. Any mutation that turns an absolute path into a relative one — `argument_removal` on `File.join(dir, name)`, `method_call_removal` on `File.expand_path(rel, base)`, etc. — used to write `File.write(name, …)` into the parent process's CWD (typically the repo root) and leak past the run; baselining `lib/evilution/runner/canary.rb` deposited 43 stray files (`canary_<pid>_<hex>_spec.rb`, `evilutioncanary_<pid>_<hex>.rb`) before this fix. Spec resolution and source eval anchor project-relative paths to `Evilution::PROJECT_ROOT` (captured at load), so the sandbox CWD does not break `SpecResolver`, `SpecSelector`, `MutationApplier`, `SourceEvaluator`, or the `RSpec::Core::Runner` / `Minitest.load` invocation sites (EV-wqxu, PR #1281, GH #1278)
+- **`MutationApplier` registers the mutation in `$LOADED_FEATURES` BEFORE evaluating the source, not after** — a sibling `require_relative` chain that loops back to the mutated file during the eval itself (e.g. `lib/evilution/mcp/*.rb` tools whose body requires a peer that requires this file back) re-read the *original* source from disk and clobbered the mutation mid-eval. Every such mutation silently survived. The feature-loaded marker now runs immediately before `@source_evaluator.call`, so the in-progress eval is the canonical source any concurrent require sees. Without this, fork workers started from the same pre-`require` snapshot and the whole file scored 0% (EV-ekax, PR #1272, GH #1269)
+
 ## [0.30.4] - 2026-05-16
 
 ### Fixed

data/README.md

@@ -101,6 +101,7 @@ Every command, subcommand, and flag listed in this section is part of evilution'
 | `--example-targeting-fallback MODE` | String | `full_file` | Behavior when no example matches: `full_file` (run the whole spec file) or `unresolved` (skip the mutation as `:unresolved`). |
 | `-j`, `--jobs N`             | Integer | 1            | Number of parallel workers. Uses demand-driven work distribution with pipe-based IPC. |
 | `--no-baseline`              | Boolean | _(enabled)_  | Skip baseline test suite check. By default, a baseline run detects pre-existing failures and marks those mutations as `neutral`. |
+| `--[no-]canary`              | Boolean | _(enabled)_  | Run a proof-of-life synthetic mutation at session start; abort the run if the pipeline misreports it. Catches misconfigured isolation, broken autoload, and reporter-plugin eviction before any real score is produced. Pass `--no-canary` to skip (e.g. CI speed, or when the canary itself is the thing under test). |
 | `--fail-fast [N]`            | Integer | _(none)_     | Stop after N surviving mutants (default 1 if no value given). |
 | `-v`, `--verbose`            | Boolean | false        | Verbose output with RSS memory and GC stats per phase and per mutation; also prints error class, message, and first 5 backtrace lines for errored mutations. |
 | `--suggest-tests`            | Boolean | false        | Generate concrete test code in suggestions (RSpec or Minitest, based on `--integration`). |
@@ -172,6 +173,7 @@ schema_version: 1            # opts into strict validation (rejects unknown keys
 # suggest_tests: false     # concrete test code in suggestions (matches integration)
 # save_session: false      # persist results under .evilution/results/
 # isolation: auto          # auto | fork | in_process (auto selects fork for Rails)
+# canary: true             # proof-of-life synthetic mutation at session start (false to skip)
 # preload: null            # path to preload before forking; false to disable; auto-detects for Rails
 # skip_heredoc_literals: false  # skip string literal mutations inside heredocs (recommended for Rails: heredoc SQL/templates rarely have test coverage)
 # show_disabled: false     # report mutations skipped by disable comments

data/docs/isolation.md

@@ -103,6 +103,33 @@ the MCP server is a long-lived process that handles runs from different
 projects — preloading one project's Rails stack into a shared process would
 poison subsequent runs.
 
+## Sandboxed working directory
+
+Every isolator runs `test_command.call` inside a per-mutation scratch
+directory (`Dir.mktmpdir("evilution-run")`) that is removed on the way out.
+Mutations that turn an absolute path into a relative one — for example
+`argument_removal` on `File.join(dir, name)` collapsing to `File.write(name,
+…)` — would otherwise drop files into the parent process's CWD (typically
+the repo root) and leak past the run.
+
+Project-relative paths used by `SpecResolver`, `SpecSelector`, the
+`RSpec::Core::Runner` / `Minitest.load` invocation sites, and the mutated
+file's `__FILE__` in `SourceEvaluator` are anchored at
+`Evilution::PROJECT_ROOT` (captured at load time), so the sandbox CWD does
+not break spec lookup or `require_relative` chains inside the mutant.
+
+## Proof-of-life canary
+
+Before any real mutation runs, `Evilution::Runner::Canary` evals a
+synthetic, guaranteed-unobservable mutation through the configured
+integration + isolation. A healthy pipeline must score it `:survived`; any
+other status aborts the run with a diagnostic so the user never sees a
+score produced by a broken pipeline (autoload mismatch, reporter-plugin
+eviction, isolation defect, `fail_if_no_examples` config drift, etc.).
+On by default; toggle with `--[no-]canary` or `canary: true|false` in
+`.evilution.yml`. The canary mirrors the configured `--isolation` so
+isolation-specific defects are caught too.
+
 ## Related flags
 
 - `--timeout N` sets the per-mutation time limit. Under `fork`, this drives
@@ -111,5 +138,6 @@ poison subsequent runs.
 - `--jobs N` runs N workers in parallel. The parallel pool respects the
   configured isolation strategy, so `--jobs 4 --isolation fork` uses fork
   isolation per-mutation inside each worker.
+- `--[no-]canary` toggles the proof-of-life pre-flight check (see above).
 
 [rails-handle-interrupt]: https://github.com/rails/rails/blob/main/activesupport/lib/active_support/concurrency/thread_monitor.rb

data/lib/evilution/cli/parser/options_builder.rb

@@ -86,6 +86,11 @@ class Evilution::CLI::Parser::OptionsBuilder
             "Use --no-incremental to override `incremental: true` from the config file for one run.") do |v|
       @options[:incremental] = v
     end
+    opts.on("--[no-]canary",
+            "Run a proof-of-life synthetic mutation at session start; abort if " \
+            "the pipeline misreports it (default: enabled). Use --no-canary to skip.") do |v|
+      @options[:canary] = v
+    end
     opts.on("--stdin", "Read target file paths from stdin (one per line)") { @options[:stdin] = true }
   end
 

data/lib/evilution/config.rb

@@ -20,7 +20,7 @@ class Evilution::Config
     example_targeting_fallback: :full_file,
     example_targeting_cache: { max_files: 50, max_blocks: 10_000 },
     quiet_children: false, quiet_children_dir: "tmp/evilution_children",
-    profile: :default
+    profile: :default, canary: true
   }.freeze
 
   attr_reader :target_files, :schema_version, :timeout, :format,
@@ -31,7 +31,7 @@ class Evilution::Config
               :skip_heredoc_literals, :related_specs_heuristic,
               :fallback_to_full_suite, :preload, :spec_mappings, :spec_pattern,
               :example_targeting, :example_targeting_fallback, :example_targeting_cache,
-              :spec_selector, :quiet_children, :quiet_children_dir, :profile
+              :spec_selector, :quiet_children, :quiet_children_dir, :profile, :canary
 
   def initialize(**options)
     skip_file = options.delete(:skip_config_file) ? true : false
@@ -68,6 +68,10 @@ class Evilution::Config
     baseline
   end
 
+  def canary?
+    canary
+  end
+
   def incremental?
     incremental
   end
@@ -130,6 +134,11 @@ class Evilution::Config
       # Minimum mutation score to pass (0.0 to 1.0, default: 0.0)
       # min_score: 0.0
 
+      # Proof-of-life canary: run a synthetic, guaranteed-unobservable
+      # mutation at session start and abort if the pipeline misreports it
+      # (default: true). Set false to skip (e.g. for CI speed).
+      # canary: true
+
       # Test integration: rspec, minitest (default: rspec)
       # integration: rspec
 
@@ -237,7 +246,8 @@ class Evilution::Config
     related_specs_heuristic: nil,
     fallback_to_full_suite: nil,
     quiet_children: nil,
-    quiet_children_dir: nil
+    quiet_children_dir: nil,
+    canary: nil
   }.freeze
   private_constant :SIMPLE_ATTR_TRANSFORMS
 

data/lib/evilution/integration/loading/mutation_applier.rb

@@ -56,21 +56,30 @@ class Evilution::Integration::Loading::MutationApplier
   def apply(mutation, eval_target)
     @constant_pinner.call(mutation.original_source)
     @concern_state_cleaner.call(mutation.file_path)
+    mark_feature_loaded(mutation.file_path)
     @redefinition_recovery.call(mutation.original_source) do
       @source_evaluator.call(eval_target, mutation.file_path)
     end
-    mark_feature_loaded(mutation.file_path)
   end
 
   # The mutated source is eval'd straight into the VM — `eval` does not register
-  # a `$LOADED_FEATURES` entry. If the spec then `require`s the same file (common
-  # when the project lazy-loads it and only the test references it), `require`
-  # reloads the ORIGINAL from disk and clobbers the mutation, so every mutation
-  # silently survives. Under fork isolation each worker starts from the same
-  # pre-`require` snapshot, so the whole file scores 0%. Registering the
-  # canonical path makes a later `require`/`require_relative` a no-op.
+  # a `$LOADED_FEATURES` entry. Any later `require`/`require_relative` of the
+  # same file then reloads the ORIGINAL from disk and clobbers the mutation, so
+  # every mutation silently survives. Two paths trigger that reload:
+  #   - the spec `require`s the file (it lazy-loads it and only the test
+  #     references it);
+  #   - the mutated source's OWN body `require_relative`s a sibling whose body
+  #     `require_relative`s this file back (e.g. lib/evilution/mcp/*.rb tools).
+  # The second reload happens DURING the eval, so registration must precede it:
+  # `mark_feature_loaded` runs before `@source_evaluator.call`, not after. Under
+  # fork isolation each worker starts from the same pre-`require` snapshot, so
+  # without this the whole file scores 0%.
   def mark_feature_loaded(file_path)
-    absolute = File.realpath(File.expand_path(file_path))
+    # When the isolator has chdir'd into a per-mutation sandbox (EV-wqxu /
+    # GH #1278), anchor against PROJECT_ROOT so File.realpath does not chase
+    # file_path into a non-existent /tmp path.
+    base = Evilution.in_isolated_worker? ? Evilution::PROJECT_ROOT : Dir.pwd
+    absolute = File.realpath(File.expand_path(file_path, base))
     $LOADED_FEATURES << absolute unless $LOADED_FEATURES.include?(absolute)
   rescue Errno::ENOENT
     nil

data/lib/evilution/integration/loading/source_evaluator.rb

@@ -13,7 +13,11 @@ require_relative "../loading"
 # substitute the mutated bytes — the privilege level is identical.
 class Evilution::Integration::Loading::SourceEvaluator
   def call(source, file_path)
-    absolute = File.expand_path(file_path)
+    # When the isolator has chdir'd into a per-mutation sandbox (EV-wqxu /
+    # GH #1278), anchor the eval __FILE__ against PROJECT_ROOT so siblings
+    # `require_relative` can find each other from the real source tree.
+    base = Evilution.in_isolated_worker? ? Evilution::PROJECT_ROOT : Dir.pwd
+    absolute = File.expand_path(file_path, base)
     eval(source, TOPLEVEL_BINDING, absolute, 1)
   end
 end

data/lib/evilution/integration/minitest.rb

@@ -128,7 +128,8 @@ class Evilution::Integration::Minitest < Evilution::Integration::Base
   end
 
   def execute_minitest(mutation, files, command)
-    files.each { |f| load(File.expand_path(f)) }
+    base = Evilution.in_isolated_worker? ? Evilution::PROJECT_ROOT : Dir.pwd
+    files.each { |f| load(File.expand_path(f, base)) }
 
     detector = reset_crash_detector
     run = run_minitest(build_args(mutation), detector)

data/lib/evilution/integration/rspec.rb

@@ -70,13 +70,50 @@ class Evilution::Integration::RSpec < Evilution::Integration::Base
     targets = @example_filter_applier.call(mutation, files)
     return @result_builder.unresolved_example(mutation) if targets.nil?
 
-    args = ["--format", "progress", "--no-color", "--order", "defined", *targets]
+    args = ["--format", "progress", "--no-color", "--order", "defined", *resolve_targets(targets)]
     command = "rspec #{args.join(" ")}"
 
     reset_examples
     execute_run(args, command)
   end
 
+  # Targets are passed straight through when they resolve against Dir.pwd,
+  # preserving the relative-path contract for callers/tests. When the CWD
+  # cannot find them — workers chdir'd into a per-mutation sandbox by the
+  # isolator (EV-wqxu / GH #1278) — the targets are expanded against
+  # Evilution::PROJECT_ROOT so RSpec::Core::Runner can still load the files.
+  def resolve_targets(targets)
+    targets.map { |target| resolve_target(target) }
+  end
+
+  # Splits a target into (path, line). RSpec example locations end in
+  # `:LINE` (or `:LINE:LINE...` for nested groups), so the suffix is
+  # anchored to the END of the string — that way path components which
+  # themselves contain colons (e.g. a Windows-style `C:/proj/spec/x.rb`)
+  # are not mis-split by a naive `partition(":")`.
+  TARGET_LINE_SUFFIX = /\A(.+?)(:\d+(?::\d+)*)\z/
+  private_constant :TARGET_LINE_SUFFIX
+
+  def resolve_target(target)
+    return target if target.start_with?("/")
+
+    if (match = TARGET_LINE_SUFFIX.match(target))
+      path = match[1]
+      line_suffix = match[2]
+    else
+      path = target
+      line_suffix = ""
+    end
+
+    return target if File.exist?(path)
+    return target unless Evilution.in_isolated_worker?
+
+    absolute = File.expand_path(path, Evilution::PROJECT_ROOT)
+    return target unless File.exist?(absolute)
+
+    "#{absolute}#{line_suffix}"
+  end
+
   def execute_run(args, command)
     detector = @crash_detector_lifecycle.current
     snapshot = @state_guard.snapshot

data/lib/evilution/isolation/fork.rb

@@ -48,6 +48,15 @@ class Evilution::Isolation::Fork
   def fork_child(read_io, write_io, sandbox_dir, mutation, test_command)
     ::Process.fork do
       ENV["TMPDIR"] = sandbox_dir
+      # Path-relativizing mutations (e.g. File.join(dir, name) -> name) would
+      # otherwise write into the parent's CWD (typically the repo root) and
+      # leak past the run. chdir here keeps such writes inside sandbox_dir,
+      # which the ensure block of #call removes. The in_isolated_worker! flag
+      # signals the rest of evilution (SpecResolver/SpecSelector/SpecAstCache/
+      # MutationApplier/SourceEvaluator/Integration) to anchor project-relative
+      # paths to Evilution::PROJECT_ROOT instead of the sandbox CWD.
+      Dir.chdir(sandbox_dir)
+      Evilution.in_isolated_worker!
       read_io.close
       suppress_child_output
       @hooks.fire(:worker_process_start, mutation:) if @hooks

data/lib/evilution/isolation/in_process.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
+require "fileutils"
 require "timeout"
+require "tmpdir"
 require_relative "../memory"
 require_relative "../result/mutation_result"
 
@@ -17,19 +19,34 @@ class Evilution::Isolation::InProcess
   def call(mutation:, test_command:, timeout:)
     start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
     rss_before = Evilution::Memory.rss_kb
-    result = execute_with_timeout(mutation, test_command, timeout)
+    sandbox_dir = Dir.mktmpdir("evilution-run")
+    result = execute_with_timeout(mutation, test_command, timeout, sandbox_dir)
     rss_after = Evilution::Memory.rss_kb
     duration = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time
     delta = compute_memory_delta(rss_before, rss_after, result)
 
     build_mutation_result(mutation, result, duration, rss_before, rss_after, delta)
+  ensure
+    FileUtils.rm_rf(sandbox_dir) if sandbox_dir
   end
 
   private
 
-  def execute_with_timeout(mutation, test_command, timeout)
+  # The Dir.chdir block is inside the Timeout.timeout block so that a
+  # Timeout::Error raised mid-call still unwinds through Dir.chdir's ensure
+  # and restores the parent CWD before the rescue clause runs. The sandbox
+  # contains any relative-path writes from path-relativizing mutations
+  # (EV-wqxu / GH #1278). Evilution.with_isolated_worker signals the rest of
+  # evilution (SpecResolver/SpecSelector/SpecAstCache/MutationApplier/
+  # SourceEvaluator/Integration) to anchor project-relative paths to
+  # PROJECT_ROOT for the duration of the call.
+  def execute_with_timeout(mutation, test_command, timeout, sandbox_dir)
     result = Timeout.timeout(timeout) do
-      suppress_output { test_command.call(mutation) }
+      Evilution.with_isolated_worker do
+        Dir.chdir(sandbox_dir) do
+          suppress_output { test_command.call(mutation) }
+        end
+      end
     end
     { timeout: false }.merge(result)
   rescue Timeout::Error

data/lib/evilution/runner/canary.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+require "tmpdir"
+require "fileutils"
+require "securerandom"
+require_relative "../runner"
+require_relative "../mutation"
+require_relative "../subject"
+
+# Runs one guaranteed-unobservable synthetic mutation through the configured
+# integration + isolation at session start. The synthetic spec never references
+# the synthetic class, so mutating the class cannot change any test outcome — a
+# healthy pipeline must score the mutation :survived. Any other status means the
+# mutation infrastructure is misreporting, so the run aborts before producing
+# numbers that would all be unreliable. Mirrors the configured --isolation so
+# isolation-specific defects are caught too.
+class Evilution::Runner::Canary
+  class Failed < Evilution::Error; end
+
+  def initialize(config:, isolator:, integration_class:, hooks: nil)
+    @config = config
+    @isolator = isolator
+    @integration_class = integration_class
+    @hooks = hooks
+  end
+
+  def call
+    dir = Dir.mktmpdir("evilution-canary")
+    class_path = write_target_class(dir)
+    spec_path = write_spec(dir)
+
+    result = @isolator.call(
+      mutation: build_mutation(class_path),
+      test_command: ->(mutation) { build_integration(spec_path).call(mutation) },
+      timeout: @config.timeout
+    )
+    raise Failed, failure_message(result.status) unless result.status == :survived
+
+    nil
+  ensure
+    FileUtils.remove_entry(dir) if dir
+  end
+
+  private
+
+  # pid + random hex keeps the synthetic class/spec names unique across
+  # concurrent sessions and across repeated re-eval into the same VM.
+  def suffix
+    @suffix ||= "#{Process.pid}_#{SecureRandom.hex(4)}"
+  end
+
+  def class_name
+    @class_name ||= "EvilutionCanary_#{suffix}"
+  end
+
+  def original_source
+    <<~RUBY
+      class #{class_name}
+        private
+
+        def __evilution_canary_probe
+          :original
+        end
+      end
+    RUBY
+  end
+
+  def mutated_source
+    original_source.sub(":original", "nil")
+  end
+
+  def write_target_class(dir)
+    path = File.join(dir, "#{class_name.downcase}.rb")
+    File.write(path, original_source)
+    path
+  end
+
+  def write_spec(dir)
+    minitest = @config.integration == :minitest
+    name = minitest ? "canary_#{suffix}_test.rb" : "canary_#{suffix}_spec.rb"
+    path = File.join(dir, name)
+    File.write(path, minitest ? minitest_spec_source : rspec_spec_source)
+    path
+  end
+
+  def rspec_spec_source
+    <<~RUBY
+      RSpec.describe("evilution proof-of-life canary") do
+        it "pipeline is alive" do
+          expect(true).to be(true)
+        end
+      end
+    RUBY
+  end
+
+  def minitest_spec_source
+    <<~RUBY
+      class EvilutionCanaryTest_#{suffix} < Minitest::Test
+        def test_pipeline_is_alive
+          assert true
+        end
+      end
+    RUBY
+  end
+
+  def build_mutation(class_path)
+    Evilution::Mutation.new(
+      subject: Evilution::Subject.new(
+        name: "#{class_name}#__evilution_canary_probe",
+        file_path: class_path, line_number: 1, source: original_source, node: nil
+      ),
+      operator_name: :canary_probe,
+      sources: Evilution::Mutation::Sources.new(original: original_source, mutated: mutated_source),
+      location: Evilution::Mutation::Location.new(file_path: class_path, line: 5, column: 4)
+    )
+  end
+
+  def build_integration(spec_path)
+    @integration_class.new(test_files: [spec_path], hooks: @hooks)
+  end
+
+  def failure_message(status)
+    "evilution proof-of-life canary failed: a guaranteed-unobservable synthetic " \
+      "mutation was scored #{status.inspect} instead of :survived. The mutation " \
+      "pipeline is misreporting — every score this run would produce is unreliable. " \
+      "Likely causes: Rails/Zeitwerk autoloading breaking child eval; an env-specific " \
+      "RSpec config (e.g. fail_if_no_examples); a classify_status fallback defect; or " \
+      "an isolation-mode defect. Re-run with --no-canary to bypass this check."
+  end
+end

data/lib/evilution/runner.rb

@@ -4,6 +4,11 @@ require "fileutils"
 require_relative "../evilution"
 
 class Evilution::Runner
+  # Autoloaded: canary.rb subclasses Evilution::Error at class-body eval
+  # time, which is not yet defined while evilution.rb is mid-load. Deferring
+  # the load until first reference lets evilution.rb finish defining Error.
+  autoload :Canary, File.expand_path("runner/canary", __dir__)
+
   attr_reader :config
 
   def initialize(config: Evilution::Config.new, on_result: nil, hooks: nil)
@@ -27,6 +32,8 @@ class Evilution::Runner
     perform_preload
     log_memory("after preload") if rails_root_detected?
 
+    run_canary
+
     baseline_result = run_baseline(subjects)
 
     plan = mutation_planner.call(subjects)
@@ -122,6 +129,17 @@ class Evilution::Runner
     baseline_runner.call(subjects)
   end
 
+  def run_canary
+    return unless config.canary?
+
+    Evilution::Runner::Canary.new(
+      config: config,
+      isolator: isolator,
+      integration_class: baseline_runner.integration_class,
+      hooks: @hooks
+    ).call
+  end
+
   def run_mutations(mutations, baseline_result = nil)
     mutation_executor.call(mutations, baseline_result)
   end

data/lib/evilution/spec_ast_cache.rb

@@ -59,13 +59,30 @@ class Evilution::SpecAstCache
   end
 
   def parse(path)
-    raise Evilution::ParseError.new("file not found: #{path}", file: path) unless File.exist?(path)
+    resolved = resolve_path(path)
+    raise Evilution::ParseError.new("file not found: #{path}", file: path) unless resolved
 
-    source = read_source(path)
-    result = parse_source(path, source)
+    source = read_source(resolved)
+    result = parse_source(resolved, source)
     collect_blocks(source, result, extract_comment_ranges(result))
   end
 
+  # Accept either a CWD-relative path (historical) or one resolvable against
+  # Evilution::PROJECT_ROOT — needed for isolators chdir'd into a per-mutation
+  # sandbox (EV-wqxu / GH #1278). The PROJECT_ROOT fallback is gated on the
+  # isolated-worker flag so unrelated callers that chdir intentionally (e.g.
+  # tests using a fixture project layout) do not accidentally resolve into
+  # the evilution dev tree.
+  def resolve_path(path)
+    return path if File.exist?(path)
+    return nil unless Evilution.in_isolated_worker?
+
+    expanded = File.expand_path(path, Evilution::PROJECT_ROOT)
+    return expanded if File.exist?(expanded)
+
+    nil
+  end
+
   def parse_source(path, source)
     result = Prism.parse(source)
     return result unless result.failure?

data/lib/evilution/spec_resolver.rb

@@ -16,7 +16,7 @@ class Evilution::SpecResolver
     normalized = normalize_path(source_path)
     candidates = candidate_test_paths(normalized)
     candidates = filter_by_pattern(candidates, spec_pattern) if spec_pattern
-    candidates.find { |path| File.exist?(path) }
+    candidates.find { |path| project_relative_exists?(path) }
   end
 
   def resolve_all(source_paths)
@@ -25,13 +25,27 @@ class Evilution::SpecResolver
 
   private
 
+  # Existence check that succeeds against the current CWD. When the caller
+  # is an isolated worker that chdir'd into a per-mutation sandbox (Evilution
+  # signals this via in_isolated_worker?), also try PROJECT_ROOT so the
+  # sandbox CWD does not break spec resolution (EV-wqxu / GH #1278).
+  def project_relative_exists?(path)
+    return true if File.exist?(path)
+    return false unless Evilution.in_isolated_worker?
+
+    File.exist?(File.expand_path(path, Evilution::PROJECT_ROOT))
+  end
+
   def filter_by_pattern(candidates, pattern)
     candidates.select { |path| File.fnmatch?(pattern, path, File::FNM_PATHNAME | File::FNM_EXTGLOB) }
   end
 
   def normalize_path(path)
     path = path.delete_prefix("./")
-    path = path.delete_prefix("#{Dir.pwd}/") if path.start_with?("/")
+    if path.start_with?("/")
+      path = path.delete_prefix("#{Dir.pwd}/")
+      path = path.delete_prefix("#{Evilution::PROJECT_ROOT}/") if Evilution.in_isolated_worker?
+    end
     path
   end
 

data/lib/evilution/spec_selector.rb

@@ -15,7 +15,7 @@ class Evilution::SpecSelector
 
     mapped = mapping_for(source_path)
     if mapped
-      existing = mapped.select { |path| File.exist?(path) }
+      existing = mapped.select { |path| project_relative_exists?(path) }
       return existing unless existing.empty?
     end
 
@@ -33,7 +33,19 @@ class Evilution::SpecSelector
     return path if path.nil?
 
     normalized = path.to_s
-    normalized = normalized.delete_prefix("#{Dir.pwd}/") if normalized.start_with?("/")
+    if normalized.start_with?("/")
+      normalized = normalized.delete_prefix("#{Dir.pwd}/")
+      normalized = normalized.delete_prefix("#{Evilution::PROJECT_ROOT}/") if Evilution.in_isolated_worker?
+    end
     normalized.delete_prefix("./")
   end
+
+  # Same semantics as Evilution::SpecResolver#project_relative_exists? — see
+  # that method for the EV-wqxu / GH #1278 rationale.
+  def project_relative_exists?(path)
+    return true if File.exist?(path)
+    return false unless Evilution.in_isolated_worker?
+
+    File.exist?(File.expand_path(path, Evilution::PROJECT_ROOT))
+  end
 end

data/lib/evilution/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Evilution
-  VERSION = "0.30.4"
+  VERSION = "0.31.0"
 end

data/lib/evilution.rb

@@ -129,6 +129,34 @@ require_relative "evilution/disable_comment"
 require_relative "evilution/runner"
 
 module Evilution
+  # Captured at load time, before any isolator can chdir into a per-mutation
+  # sandbox. Used as the anchor for resolving project-relative paths (spec
+  # files, source files for eval) from inside a chdir'd child so the CWD
+  # sandbox (EV-wqxu / GH #1278) cannot break spec resolution or eval __FILE__.
+  PROJECT_ROOT = Dir.pwd.freeze unless defined?(PROJECT_ROOT)
+
+  # Flag set by isolators (Evilution::Isolation::Fork in the forked child,
+  # Evilution::Isolation::InProcess around the test_command) so spec
+  # resolution and source eval anchor relative paths to PROJECT_ROOT instead
+  # of Dir.pwd. Without this gate, a caller that intentionally chdirs to a
+  # different project (e.g. a fixture layout in tests) would have its lookups
+  # inadvertently fall back to the evilution dev tree.
+  def self.in_isolated_worker!
+    @in_isolated_worker = true
+  end
+
+  def self.in_isolated_worker?
+    @in_isolated_worker == true
+  end
+
+  def self.with_isolated_worker
+    previous = @in_isolated_worker
+    @in_isolated_worker = true
+    yield
+  ensure
+    @in_isolated_worker = previous
+  end
+
   class Error < StandardError
     attr_reader :file
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: evilution
 version: !ruby/object:Gem::Version
-  version: 0.30.4
+  version: 0.31.0
 platform: ruby
 authors:
 - Denis Kiselev
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-05-16 00:00:00.000000000 Z
+date: 2026-05-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: diff-lcs
@@ -446,6 +446,7 @@ files:
 - lib/evilution/result/summary.rb
 - lib/evilution/runner.rb
 - lib/evilution/runner/baseline_runner.rb
+- lib/evilution/runner/canary.rb
 - lib/evilution/runner/diagnostics.rb
 - lib/evilution/runner/isolation_resolver.rb
 - lib/evilution/runner/mutation_executor.rb