rigortype 0.2.7 → 0.2.8

data/lib/rigor/plugin/source_rbs_synthesis_reporter.rb

@@ -2,27 +2,19 @@
 
 module Rigor
   module Plugin
-    # ADR-32 WD6 — per-run accumulator for failures encountered by
-    # a plugin's `Manifest#source_rbs_synthesizer` callable. The
-    # synthesizer returns `[:error, message]` on parse failure
-    # (per its contract); `Environment.for_project` routes the
-    # tuple through `#record` here. `Analysis::Runner` queries
-    # `#entries` after analysis and emits one
-    # `source-rbs-synthesis-failed` `:info` diagnostic per
-    # entry so the user sees which files contributed nothing
-    # and why.
+    # ADR-32 WD6 — per-run accumulator for failures encountered by a plugin's
+    # `Manifest#source_rbs_synthesizer` callable. The synthesizer returns `[:error, message]` on parse failure
+    # (per its contract); `Environment.for_project` routes the tuple through `#record` here.
+    # `Analysis::Runner` queries `#entries` after analysis and emits one `source-rbs-synthesis-failed` `:info`
+    # diagnostic per entry so the user sees which files contributed nothing and why.
     #
-    # Empty by default. The Runner only emits diagnostics when
-    # at least one entry is recorded — projects without
-    # synthesizer-emitting plugins pay zero cost.
+    # Empty by default. The Runner only emits diagnostics when at least one entry is recorded — projects
+    # without synthesizer-emitting plugins pay zero cost.
     #
-    # Thread-/Ractor-safety: this reporter is per-`WorkerSession`
-    # in pool mode, so concurrent writes from one Ractor's
-    # `collect_virtual_rbs` loop are serialised by the worker
-    # body itself. The sequential path shares a single reporter
-    # across the run; entries are appended one at a time during
-    # env build (before any per-file analysis runs), so no
-    # locking is needed.
+    # Thread-/Ractor-safety: this reporter is per-`WorkerSession` in pool mode, so concurrent writes from one
+    # Ractor's `collect_virtual_rbs` loop are serialised by the worker body itself. The sequential path shares a
+    # single reporter across the run; entries are appended one at a time during env build (before any per-file
+    # analysis runs), so no locking is needed.
     class SourceRbsSynthesisReporter
       Entry = Data.define(:plugin_id, :path, :message)
 

data/lib/rigor/plugin/trust_policy.rb

@@ -2,42 +2,30 @@
 
 module Rigor
   module Plugin
-    # Declarative trust / I/O policy for the active plugin set.
-    # Pinned by [ADR-2 § "Plugin Trust and I/O Policy"](../../../docs/adr/2-extension-api.md):
-    # plugins are *trusted Ruby gems selected by the user, their
-    # Gemfile, or project configuration*; this class is the
-    # programmatic surface that documents that trust and lets the
-    # analyzer enforce read scope + network disablement at the
+    # Declarative trust / I/O policy for the active plugin set. Pinned by
+    # [ADR-2 § "Plugin Trust and I/O Policy"](../../../docs/adr/2-extension-api.md): plugins are *trusted Ruby
+    # gems selected by the user, their Gemfile, or project configuration*; this class is the programmatic
+    # surface that documents that trust and lets the analyzer enforce read scope + network disablement at the
     # documented edges.
     #
-    # The policy is **not a sandbox.** A plugin that uses raw
-    # `File.read` or `Net::HTTP` bypasses the policy — ADR-2
-    # explicitly chooses documentation over forced isolation. The
-    # contract is: when plugins go through {Rigor::Plugin::IoBoundary}
-    # (the analyzer-side helper service slice 2 introduces), the
-    # boundary checks against this policy and feeds compliant reads
-    # into the cache descriptor for invalidation. Slices 3-6 wire
-    # plugin contributions through the boundary so the policy is
-    # the actual mechanism, not just paperwork.
+    # The policy is **not a sandbox.** A plugin that uses raw `File.read` or `Net::HTTP` bypasses the policy —
+    # ADR-2 explicitly chooses documentation over forced isolation. The contract is: when plugins go through
+    # {Rigor::Plugin::IoBoundary} (the analyzer-side helper service slice 2 introduces), the boundary checks
+    # against this policy and feeds compliant reads into the cache descriptor for invalidation. Slices 3-6 wire
+    # plugin contributions through the boundary so the policy is the actual mechanism, not just paperwork.
     #
     # ## Fields
     #
-    # - `trusted_gems`: gem names the user has authorised. Derived
-    #   from the `plugins:` section of `.rigor.yml` plus any gems
-    #   they reach transitively. Used today for documentation and
-    #   future trust diagnostics.
-    # - `allowed_read_roots`: absolute paths plugin code may read
-    #   from through the {IoBoundary}. The default set covers the
-    #   project root, the project's `signature_paths`, the active
-    #   `Gemfile.lock`, and each trusted gem's
-    #   `Gem::Specification#full_gem_path`. The user extends this
-    #   with `.rigor.yml`'s `plugins_io.allowed_paths:`.
-    # - `network_policy`: one of {VALID_NETWORK_POLICIES}.
-    #   `:disabled` (default) makes {IoBoundary#open_url} always
-    #   raise. `:allowlist` (v0.1.2) consults `allowed_url_hosts`
-    #   on every fetch — the hostname must be on the list and
-    #   the URL scheme MUST be `https`. The list of allowed hosts
-    #   is exact-match (no wildcards in v0.1.2).
+    # - `trusted_gems`: gem names the user has authorised. Derived from the `plugins:` section of `.rigor.yml`
+    #   plus any gems they reach transitively. Used today for documentation and future trust diagnostics.
+    # - `allowed_read_roots`: absolute paths plugin code may read from through the {IoBoundary}. The default
+    #   set covers the project root, the project's `signature_paths`, the active `Gemfile.lock`, and each
+    #   trusted gem's `Gem::Specification#full_gem_path`. The user extends this with `.rigor.yml`'s
+    #   `plugins_io.allowed_paths:`.
+    # - `network_policy`: one of {VALID_NETWORK_POLICIES}. `:disabled` (default) makes
+    #   {IoBoundary#open_url} always raise. `:allowlist` (v0.1.2) consults `allowed_url_hosts` on every fetch —
+    #   the hostname must be on the list and the URL scheme MUST be `https`. The list of allowed hosts is
+    #   exact-match (no wildcards in v0.1.2).
     class TrustPolicy
       VALID_NETWORK_POLICIES = %i[disabled allowlist].freeze
 
@@ -58,10 +46,9 @@ module Rigor
       end
 
       # @param path [String]
-      # @return [Boolean] true when the absolute path falls inside
-      #   any allowed read root. Symlinks are resolved through
-      #   `File.expand_path` only (no `realpath`); plugins with
-      #   adversarial intent are out of scope per ADR-2.
+      # @return [Boolean] true when the absolute path falls inside any allowed read root. Symlinks are
+      #   resolved through `File.expand_path` only (no `realpath`); plugins with adversarial intent are out of
+      #   scope per ADR-2.
       def allow_read?(path)
         absolute = File.expand_path(path.to_s)
         @allowed_read_roots.any? { |root| inside?(absolute, root) }
@@ -72,9 +59,8 @@ module Rigor
       end
 
       # @param url [String, URI]
-      # @return [Boolean] true when the URL scheme is `https` and
-      #   the parsed hostname is in `allowed_url_hosts`. Always
-      #   `false` while `network_policy` is `:disabled`.
+      # @return [Boolean] true when the URL scheme is `https` and the parsed hostname is in
+      #   `allowed_url_hosts`. Always `false` while `network_policy` is `:disabled`.
       def allow_url?(url)
         return false if @network_policy == :disabled
         return false if @allowed_url_hosts.empty?

data/lib/rigor/plugin/type_node_resolver.rb

@@ -2,18 +2,14 @@
 
 module Rigor
   module Plugin
-    # Plugin-supplied resolver for custom named / generic type
-    # vocabulary in RBS::Extended payloads. ADR-13 § "Decision".
+    # Plugin-supplied resolver for custom named / generic type vocabulary in RBS::Extended payloads. ADR-13 §
+    # "Decision".
     #
-    # Subclasses override {#resolve} to return a
-    # {Rigor::Type::Base} when the node matches the vocabulary
-    # the resolver covers, or `nil` to fall through to the next
-    # resolver in the chain (and finally to the built-in / RBS
-    # fallback). The base implementation returns `nil` so an
-    # unimplemented subclass is a safe no-op.
+    # Subclasses override {#resolve} to return a {Rigor::Type::Base} when the node matches the vocabulary the
+    # resolver covers, or `nil` to fall through to the next resolver in the chain (and finally to the built-in /
+    # RBS fallback). The base implementation returns `nil` so an unimplemented subclass is a safe no-op.
     #
-    # Resolvers are registered through their plugin's manifest
-    # under the `type_node_resolvers:` slot:
+    # Resolvers are registered through their plugin's manifest under the `type_node_resolvers:` slot:
     #
     #   class RigorTypescriptUtilityTypes < Rigor::Plugin::Base
     #     manifest(
@@ -24,24 +20,19 @@ module Rigor
     #     )
     #   end
     #
-    # ADR-13 — base class, manifest hook, and registry aggregation
-    # for plugin-contributed type-node resolvers. Resolvers declared
-    # via `manifest(type_node_resolvers:)` run for every real
-    # `%a{rigor:v1:...}` payload through `TypeNode::ResolverChain`
-    # (built by `Environment#build_name_scope` from
+    # ADR-13 — base class, manifest hook, and registry aggregation for plugin-contributed type-node resolvers.
+    # Resolvers declared via `manifest(type_node_resolvers:)` run for every real `%a{rigor:v1:...}` payload
+    # through `TypeNode::ResolverChain` (built by `Environment#build_name_scope` from
     # `Plugin::Registry#type_node_resolvers`).
     #
-    # Resolvers SHOULD be stateless and re-entrant; the registry
-    # builds the chain once per `Analysis::Runner.run` and may
-    # consult any resolver multiple times for the same node.
+    # Resolvers SHOULD be stateless and re-entrant; the registry builds the chain once per
+    # `Analysis::Runner.run` and may consult any resolver multiple times for the same node.
     class TypeNodeResolver
-      # @param node [Rigor::TypeNode::Identifier, Rigor::TypeNode::Generic]
-      #   the parser-emitted node the chain is asking about.
-      # @param scope [Rigor::TypeNode::NameScope] companion
-      #   value object (slice 3); slice 2 invocations MAY pass
+      # @param node [Rigor::TypeNode::Identifier, Rigor::TypeNode::Generic] the parser-emitted node the chain is
+      #   asking about.
+      # @param scope [Rigor::TypeNode::NameScope] companion value object (slice 3); slice 2 invocations MAY pass
       #   `nil` because the chain doesn't exist yet.
-      # @return [Rigor::Type::Base, nil] resolved type, or `nil`
-      #   to fall through.
+      # @return [Rigor::Type::Base, nil] resolved type, or `nil` to fall through.
       def resolve(node, scope) # rubocop:disable Lint/UnusedMethodArgument
         nil
       end

data/lib/rigor/protection/diagnostic_oracle.rb

@@ -4,18 +4,16 @@ require_relative "../analysis/runner"
 
 module Rigor
   module Protection
-    # ADR-69 Seam 1 — the **kill oracle** Rigor's analyzer-teeth measurement uses:
-    # a mutant is killed iff re-analysing it introduces a diagnostic absent from
-    # the clean baseline. This is exactly the behaviour ADR-62/63 shipped, lifted
-    # out of {MutationScanner} so a {TestSuiteOracle} (ADR-70) — which kills by
-    # *running tests* rather than by re-analysis — can sit beside it without the
-    # scanner baking in either assumption.
+    # ADR-69 Seam 1 — the **kill oracle** Rigor's analyzer-teeth measurement uses: a mutant is killed iff
+    # re-analysing it introduces a diagnostic absent from the clean baseline. This is exactly the behaviour
+    # ADR-62/63 shipped, lifted out of {MutationScanner} so a {TestSuiteOracle} (ADR-70) — which kills by
+    # *running tests* rather than by re-analysis — can sit beside it without the scanner baking in either
+    # assumption.
     #
-    # The expensive builds (RBS environment + the whole-project pre-pass scan) are
-    # paid once by the caller and threaded in; each mutant reuses them through
-    # `Runner.new(prebuilt:)#run_source` (in-memory overlay, no disk write).
-    # Passing `prebuilt:` disables the run-result cache (whose key digests the
-    # *disk* file), so a mutant is never served a stale clean hit.
+    # The expensive builds (RBS environment + the whole-project pre-pass scan) are paid once by the caller and
+    # threaded in; each mutant reuses them through `Runner.new(prebuilt:)#run_source` (in-memory overlay, no
+    # disk write). Passing `prebuilt:` disables the run-result cache (whose key digests the *disk* file), so a
+    # mutant is never served a stale clean hit.
     class DiagnosticOracle
       def initialize(configuration:, environment:, project_scan:)
         @configuration = configuration
@@ -23,8 +21,8 @@ module Rigor
         @project_scan = project_scan
       end
 
-      # The clean per-file baseline: the diagnostic signatures a mutant must add
-      # to count as killed. Computed once per file by the caller.
+      # The clean per-file baseline: the diagnostic signatures a mutant must add to count as killed. Computed
+      # once per file by the caller.
       def baseline(source:, path:)
         analyse(source, path).to_set { |d| sig(d) }
       end

data/lib/rigor/protection/mutation_scanner.rb

@@ -7,24 +7,20 @@ require_relative "diagnostic_oracle"
 
 module Rigor
   module Protection
-    # ADR-63 Tier 2 — the mutation *effectiveness* tier (the truth tier behind
-    # Tier 1's static {Inference::ProtectionScanner} proxy). For one file it
-    # answers the question Tier 1 only bounds: when a type-visible bug is
-    # introduced at a dispatch site, does Rigor actually catch it?
+    # ADR-63 Tier 2 — the mutation *effectiveness* tier (the truth tier behind Tier 1's static
+    # {Inference::ProtectionScanner} proxy). For one file it answers the question Tier 1 only bounds: when a
+    # type-visible bug is introduced at a dispatch site, does Rigor actually catch it?
     #
-    # Mechanism (the ADR-62 warm loop, narrowed to per-file measurement):
-    # generate the type-visible mutations ({Mutator}), keep only those whose
-    # receiver Rigor holds a concrete type for (the type-aware filter — the
-    # FP-safe meaning-maker; an unresolved receiver is kept), then for each ask
-    # the **kill oracle** whether the mutant is caught. The oracle is the ADR-69
-    # seam: {#scan_file} uses the {DiagnosticOracle} (a *new Rigor diagnostic* =
-    # a kill); {#scan_file_fused} additionally consults a {TestSuiteOracle} on the
-    # type-survivors (ADR-70 — the dynamic protection axis).
+    # Mechanism (the ADR-62 warm loop, narrowed to per-file measurement): generate the type-visible mutations
+    # ({Mutator}), keep only those whose receiver Rigor holds a concrete type for (the type-aware filter — the
+    # FP-safe meaning-maker; an unresolved receiver is kept), then for each ask the **kill oracle** whether the
+    # mutant is caught. The oracle is the ADR-69 seam: {#scan_file} uses the {DiagnosticOracle} (a *new Rigor
+    # diagnostic* = a kill); {#scan_file_fused} additionally consults a {TestSuiteOracle} on the type-survivors
+    # (ADR-70 — the dynamic protection axis).
     #
-    # The expensive builds (RBS environment + the whole-project pre-pass scan)
-    # are paid ONCE by the caller and threaded into the {DiagnosticOracle}; each
-    # mutant reuses them through `Runner.new(prebuilt:)#run_source` (in-memory
-    # overlay, no disk write).
+    # The expensive builds (RBS environment + the whole-project pre-pass scan) are paid ONCE by the caller and
+    # threaded into the {DiagnosticOracle}; each mutant reuses them through `Runner.new(prebuilt:)#run_source`
+    # (in-memory overlay, no disk write).
     class MutationScanner
       # A surviving mutation site — a breakage Rigor did not catch.
       SurvivingSite = Data.define(:line, :receiver, :method_name, :operator)
@@ -33,21 +29,19 @@ module Rigor
         # Mutations actually analysed (parse-invalid mutants are not counted).
         def total = killed + survived
 
-        # Effectiveness ratio; a file with no type-relevant mutation is
-        # vacuously fully effective (no breakage was available to miss).
+        # Effectiveness ratio; a file with no type-relevant mutation is vacuously fully effective (no breakage
+        # was available to miss).
         def ratio = total.zero? ? 1.0 : killed.to_f / total
       end
 
-      # ADR-70 — one type-survivor classified by the dynamic (test) axis.
-      # `protection` is `:test` (a test caught it) or `:none` (unprotected — the
-      # "add a type OR a test here" sites).
+      # ADR-70 — one type-survivor classified by the dynamic (test) axis. `protection` is `:test` (a test caught
+      # it) or `:none` (unprotected — the "add a type OR a test here" sites).
       FusedSite = Data.define(:line, :receiver, :method_name, :operator, :protection)
 
-      # ADR-70 — the per-file fused classification. The gradual short-circuit
-      # collapses the conceptual "doubly-protected" bucket into `type_killed`:
-      # a mutant the type checker already kills never reaches the suite, because
-      # the static net already suffices and re-running the suite to learn a test
-      # *would also* catch it is wasted work. So the observed buckets are three.
+      # ADR-70 — the per-file fused classification. The gradual short-circuit collapses the conceptual
+      # "doubly-protected" bucket into `type_killed`: a mutant the type checker already kills never reaches the
+      # suite, because the static net already suffices and re-running the suite to learn a test *would also*
+      # catch it is wasted work. So the observed buckets are three.
       FusedFileResult = Data.define(:path, :type_killed, :test_killed, :sites) do
         # The unprotected sites (neither a type nor a test caught the breakage).
         def unprotected = sites.size
@@ -101,11 +95,10 @@ module Rigor
         FileResult.new(path: path, killed: killed, survived: sites.size, sites: sites)
       end
 
-      # ADR-70 — the fused static∪dynamic measurement. Runs the type pass
-      # (the {DiagnosticOracle}); for every mutant the type checker did **not**
-      # kill, asks `test_oracle` whether the project's test suite catches it.
-      # The expensive suite run is paid only for type-survivors (the gradual
-      # short-circuit), so the cost is proportional to the protection hole.
+      # ADR-70 — the fused static∪dynamic measurement. Runs the type pass (the {DiagnosticOracle}); for every
+      # mutant the type checker did **not** kill, asks `test_oracle` whether the project's test suite catches it.
+      # The expensive suite run is paid only for type-survivors (the gradual short-circuit), so the cost is
+      # proportional to the protection hole.
       # @param test_oracle [TestSuiteOracle]
       # @return [FusedFileResult]
       def scan_file_fused(path, test_oracle:, source: nil)
@@ -134,10 +127,9 @@ module Rigor
 
       private
 
-      # The mutations to measure: the biteable filter (concrete-type sites only;
-      # the FP-safe default — an unresolved receiver is kept) or, under the
-      # `:all` selector (ADR-69 Seam 2), every dispatch site including Dynamic
-      # receivers. Optionally sampled.
+      # The mutations to measure: the biteable filter (concrete-type sites only; the FP-safe default — an
+      # unresolved receiver is kept) or, under the `:all` selector (ADR-69 Seam 2), every dispatch site including
+      # Dynamic receivers. Optionally sampled.
       def kept_mutations(source, path)
         mutator = Mutator.new(source)
         muts = mutator.mutations

data/lib/rigor/protection/mutator.rb

@@ -6,19 +6,15 @@ require_relative "../scope"
 require_relative "../inference/scope_indexer"
 
 module Rigor
-  # ADR-63 Tier 2 — the productized subset of the dev-only mutation-testing
-  # harness (`tool/mutation/`, ADR-62). Only the *per-file effectiveness
-  # measurement* lives here — the type-visible {Mutator} and the warm-loop
-  # {MutationScanner} kill-rate measurement. The dev sweep / fuzz / survivor
-  # clustering stay off the frozen surface in `tool/mutation/mutate.rb`
-  # (which now reuses this {Mutator} so there is one source of truth).
+  # ADR-63 Tier 2 — the productized subset of the dev-only mutation-testing harness (`tool/mutation/`, ADR-62).
+  # Only the *per-file effectiveness measurement* lives here — the type-visible {Mutator} and the warm-loop
+  # {MutationScanner} kill-rate measurement. The dev sweep / fuzz / survivor clustering stay off the frozen
+  # surface in `tool/mutation/mutate.rb` (which now reuses this {Mutator} so there is one source of truth).
   module Protection
-    # One concrete edit: replace source bytes [start, stop) with `replacement`.
-    # `anchor` is the Prism node whose inferred type decides type-relevance —
-    # the call receiver whose contract the mutation could violate, or nil when
-    # there is no concrete receiver (implicit-self call, literal outside a call).
-    # `anchor_type` (the rendered receiver type) and `method_name` are filled in
-    # for reporting a surviving site; both may stay nil.
+    # One concrete edit: replace source bytes [start, stop) with `replacement`. `anchor` is the Prism node whose
+    # inferred type decides type-relevance — the call receiver whose contract the mutation could violate, or nil
+    # when there is no concrete receiver (implicit-self call, literal outside a call). `anchor_type` (the
+    # rendered receiver type) and `method_name` are filled in for reporting a surviving site; both may stay nil.
     Mutation = Struct.new(
       :operator, :expected_rule, :start, :stop, :replacement, :line, :label, :anchor,
       :anchor_type, :method_name,
@@ -31,35 +27,29 @@ module Rigor
       end
     end
 
-    # Generates type-visible mutations of a Ruby source string by walking the
-    # Prism AST and recording byte-range splices (no unparser needed — Prism
-    # hands us exact offsets, and the analyzer re-parses the spliced source).
+    # Generates type-visible mutations of a Ruby source string by walking the Prism AST and recording byte-range
+    # splices (no unparser needed — Prism hands us exact offsets, and the analyzer re-parses the spliced source).
     #
-    # A mutation is "type-visible" when it should trip a diagnostic rule *if*
-    # Rigor holds a type at the site: a call-argument literal dropped to `nil`
-    # or type-swapped (→ `call.argument-type-mismatch`), or a call site renamed
-    # to a missing method (→ `call.undefined-method`). Only call sites and
-    # bodies are mutated, never `def` signatures, so a reused project scan stays
-    # valid.
+    # A mutation is "type-visible" when it should trip a diagnostic rule *if* Rigor holds a type at the site: a
+    # call-argument literal dropped to `nil` or type-swapped (→ `call.argument-type-mismatch`), or a call site
+    # renamed to a missing method (→ `call.undefined-method`). Only call sites and bodies are mutated, never
+    # `def` signatures, so a reused project scan stays valid.
     class Mutator
       IDENT = /\A[a-z_][A-Za-z0-9_]*\z/
       QUOTES = ['"', "'"].freeze
-      # Mutating an argument to a universal-equality method is always an
-      # equivalent mutant: Ruby's `==` / `<=>` family returns false / nil on a
-      # type mismatch rather than raising, so the engine exempts them
+      # Mutating an argument to a universal-equality method is always an equivalent mutant: Ruby's `==` / `<=>`
+      # family returns false / nil on a type mismatch rather than raising, so the engine exempts them
       # (`UNIVERSAL_EQUALITY_METHODS`). Skip them to keep survivors meaningful.
       UNIVERSAL_EQUALITY = %w[== != eql? equal? <=>].freeze
 
-      # Every operator the mutator knows. Each maps to the diagnostic rule
-      # family it is *engineered* to trip when the mutated value/call sits in a
-      # context where Rigor has type knowledge.
+      # Every operator the mutator knows. Each maps to the diagnostic rule family it is *engineered* to trip when
+      # the mutated value/call sits in a context where Rigor has type knowledge.
       ALL_OPERATORS = %i[nil_inject type_swap undefined_method arity_extra].freeze
 
-      # The default set. `arity_extra` is excluded: most Ruby methods accept an
-      # extra argument (splat / optional), so appending one is usually an
-      # equivalent mutant — it contributes almost only noise. Re-enable it
-      # explicitly via `operators:` to measure arity teeth. (A signature-arity
-      # guard would make it default-worthy — a follow-up.)
+      # The default set. `arity_extra` is excluded: most Ruby methods accept an extra argument (splat / optional),
+      # so appending one is usually an equivalent mutant — it contributes almost only noise. Re-enable it
+      # explicitly via `operators:` to measure arity teeth. (A signature-arity guard would make it
+      # default-worthy — a follow-up.)
       OPERATORS = %i[nil_inject type_swap undefined_method].freeze
 
       def initialize(source, operators: OPERATORS)
@@ -78,14 +68,12 @@ module Rigor
         out
       end
 
-      # Phase 1.5 — keep only mutations whose anchor types to a concrete,
-      # non-Dynamic type, i.e. a site where Rigor actually holds a contract the
-      # mutation could violate. Drops implicit-self calls and literals outside a
-      # typed call (no contract → guaranteed survival → noise). FP-safe
-      # direction: an unresolved/probe-failed type KEEPS the mutation, so the
-      # filter never hides a kill it is unsure about — it only removes
-      # provably-Dynamic sites. Returns [kept, dropped_count]. Builds the scope
-      # index from THIS mutator's parse so anchor node identity matches the keys.
+      # Phase 1.5 — keep only mutations whose anchor types to a concrete, non-Dynamic type, i.e. a site where
+      # Rigor actually holds a contract the mutation could violate. Drops implicit-self calls and literals
+      # outside a typed call (no contract → guaranteed survival → noise). FP-safe direction: an
+      # unresolved/probe-failed type KEEPS the mutation, so the filter never hides a kill it is unsure about — it
+      # only removes provably-Dynamic sites. Returns [kept, dropped_count]. Builds the scope index from THIS
+      # mutator's parse so anchor node identity matches the keys.
       def filter_by_type(mutations, environment:, path:)
         base = Rigor::Scope.empty(environment: environment, source_path: path)
         index = Rigor::Inference::ScopeIndexer.index(@parse.value, default_scope: base)
@@ -98,13 +86,11 @@ module Rigor
         [kept, mutations.size - kept.size]
       end
 
-      # ADR-69 Seam 2 (AllSites) — keep every *dispatch-site* mutation (a method
-      # call or a call-argument literal), Dynamic receiver included, annotating
-      # the anchor type where Rigor holds one. Drops only non-dispatch literals
-      # (a literal outside any call — no receiver contract to violate). The
-      # biteable {#filter_by_type} hides exactly the Dynamic sites a test-suite
-      # consumer most wants to probe: where Rigor cannot bite, a test is the only
-      # protection. Use only with a {TestSuiteOracle} — at a Dynamic site the
+      # ADR-69 Seam 2 (AllSites) — keep every *dispatch-site* mutation (a method call or a call-argument
+      # literal), Dynamic receiver included, annotating the anchor type where Rigor holds one. Drops only
+      # non-dispatch literals (a literal outside any call — no receiver contract to violate). The biteable
+      # {#filter_by_type} hides exactly the Dynamic sites a test-suite consumer most wants to probe: where Rigor
+      # cannot bite, a test is the only protection. Use only with a {TestSuiteOracle} — at a Dynamic site the
       # type pass can never kill, so without the test axis these are all noise.
       def dispatch_site_mutations(mutations, environment:, path:)
         base = Rigor::Scope.empty(environment: environment, source_path: path)
@@ -139,10 +125,9 @@ module Rigor
         end
       end
 
-      # Record, for each literal that is a direct call argument, the receiver of
-      # the enclosing call — the anchor whose param contract a literal mutation
-      # could violate. Literals elsewhere get a nil anchor (filtered out under
-      # the type filter).
+      # Record, for each literal that is a direct call argument, the receiver of the enclosing call — the anchor
+      # whose param contract a literal mutation could violate. Literals elsewhere get a nil anchor (filtered out
+      # under the type filter).
       def index_literal_anchors(node)
         return if node.nil?
 
@@ -158,9 +143,8 @@ module Rigor
         node.is_a?(Prism::IntegerNode) || node.is_a?(Prism::FloatNode) || node.is_a?(Prism::StringNode)
       end
 
-      # Returns [keep?, rendered_type]. Keep when `anchor` is a site where Rigor
-      # holds a concrete (non-Dynamic/Top) type. FP-safe: an unresolved or
-      # probe-failed type keeps the mutation (with a nil rendered type).
+      # Returns [keep?, rendered_type]. Keep when `anchor` is a site where Rigor holds a concrete (non-Dynamic/Top)
+      # type. FP-safe: an unresolved or probe-failed type keeps the mutation (with a nil rendered type).
       def anchor_decision(anchor, index, cache)
         return [false, nil] if anchor.nil?
         return cache[anchor] if cache.key?(anchor)
@@ -181,11 +165,10 @@ module Rigor
         [true, nil] # never let a probe failure hide a candidate
       end
 
-      # A receiver type Rigor cannot bite on, so a mutation anchored to it would
-      # survive as noise: `Dynamic` / `Top` / `bot`, or a union with any such arm
-      # (gradually valid — `Array | Dynamic[top]`.whatever never fires). A union
-      # of fully-concrete arms (`String | Symbol`) stays concrete — it now has
-      # undefined-method teeth.
+      # A receiver type Rigor cannot bite on, so a mutation anchored to it would survive as noise: `Dynamic` /
+      # `Top` / `bot`, or a union with any such arm (gradually valid — `Array | Dynamic[top]`.whatever never
+      # fires). A union of fully-concrete arms (`String | Symbol`) stays concrete — it now has undefined-method
+      # teeth.
       def non_concrete_type?(type)
         return true if type.is_a?(Rigor::Type::Dynamic) || type.is_a?(Rigor::Type::Top) ||
                        type.is_a?(Rigor::Type::Bot)
@@ -200,9 +183,8 @@ module Rigor
         type.class.name
       end
 
-      # Mutate a literal: drop it to nil (possible-nil channel) and swap its
-      # type (type-mismatch channel). String literals are only touched when the
-      # node is a real quoted string, so we never corrupt `%w[...]` words.
+      # Mutate a literal: drop it to nil (possible-nil channel) and swap its type (type-mismatch channel). String
+      # literals are only touched when the node is a real quoted string, so we never corrupt `%w[...]` words.
       def literal_mutations(node, out, numeric:)
         return if !numeric && !QUOTES.include?(node.opening_loc&.slice)
 
@@ -222,12 +204,10 @@ module Rigor
         extend_arity(node, out)
       end
 
-      # Rename the *call site* (not the def) to a method that cannot exist, so a
-      # typed receiver trips call.undefined-method. We leave `def` signatures
-      # untouched on purpose: the prebuilt ProjectScan still carries the file's
-      # original declarations, so mutating only bodies/call-sites keeps it valid.
-      # Anchor is the explicit receiver (nil ⇒ implicit self ⇒ filtered out, as
-      # call.self-undefined-method ships `:off`).
+      # Rename the *call site* (not the def) to a method that cannot exist, so a typed receiver trips
+      # call.undefined-method. We leave `def` signatures untouched on purpose: the prebuilt ProjectScan still
+      # carries the file's original declarations, so mutating only bodies/call-sites keeps it valid. Anchor is
+      # the explicit receiver (nil ⇒ implicit self ⇒ filtered out, as call.self-undefined-method ships `:off`).
       def rename_call(node, out)
         name = node.name.to_s
         mloc = node.message_loc
@@ -237,8 +217,8 @@ module Rigor
             "#{name}__rigor_absent", mloc.start_line, "call ##{name} → missing method", node.receiver, name)
       end
 
-      # Append a trailing argument inside explicit `(...)` parens to trip an
-      # arity diagnostic against a known fixed-arity signature.
+      # Append a trailing argument inside explicit `(...)` parens to trip an arity diagnostic against a known
+      # fixed-arity signature.
       def extend_arity(node, out)
         open = node.opening_loc
         close = node.closing_loc

data/lib/rigor/protection/test_suite_oracle.rb

@@ -2,23 +2,19 @@
 
 module Rigor
   module Protection
-    # ADR-70 — the **test-suite** kill oracle, the dynamic sibling of
-    # {DiagnosticOracle} on the ADR-69 seam. A mutant is killed iff applying its
-    # bytes to the file under test turns the project's test suite **red**. This is
-    # the dynamic half of the fused static∪dynamic protection map: a `Dynamic`
-    # site Rigor cannot bite (a type survivor) may still be fully guarded by a
-    # test.
+    # ADR-70 — the **test-suite** kill oracle, the dynamic sibling of {DiagnosticOracle} on the ADR-69 seam. A
+    # mutant is killed iff applying its bytes to the file under test turns the project's test suite **red**. This
+    # is the dynamic half of the fused static∪dynamic protection map: a `Dynamic` site Rigor cannot bite (a type
+    # survivor) may still be fully guarded by a test.
     #
-    # The suite command is the **runner hook** (`--test-command`, e.g.
-    # `bundle exec rake`). The runner is injectable so the decision logic is
-    # unit-testable without shelling out; the default shells out and reads the
-    # process exit status (0 = green / passed).
+    # The suite command is the **runner hook** (`--test-command`, e.g. `bundle exec rake`). The runner is
+    # injectable so the decision logic is unit-testable without shelling out; the default shells out and reads
+    # the process exit status (0 = green / passed).
     #
-    # I/O policy: {#killed?} writes the mutant to disk, runs the suite, and
-    # **always restores** the original bytes in an `ensure` — a normal exception
-    # never leaves a mutant on disk. (A hard interrupt mid-suite is the standard
-    # mutation-testing hazard the `ensure` cannot cover; callers running this in
-    # CI accept that, as `mutant` / Stryker do.)
+    # I/O policy: {#killed?} writes the mutant to disk, runs the suite, and **always restores** the original
+    # bytes in an `ensure` — a normal exception never leaves a mutant on disk. (A hard interrupt mid-suite is the
+    # standard mutation-testing hazard the `ensure` cannot cover; callers running this in CI accept that, as
+    # `mutant` / Stryker do.)
     class TestSuiteOracle
       # @param command [Array<String>] the test command (the runner hook)
       # @param runner [#call, nil] `runner.call(command) -> true iff the suite
@@ -28,9 +24,8 @@ module Rigor
         @runner = runner || method(:shell_run)
       end
 
-      # The baseline: the suite must pass on clean code, else "a mutant survived"
-      # is meaningless (every mutant would look killed, or none would). Run once
-      # before measuring.
+      # The baseline: the suite must pass on clean code, else "a mutant survived" is meaningless (every mutant
+      # would look killed, or none would). Run once before measuring.
       def green?
         @runner.call(@command)
       end
@@ -48,15 +43,13 @@ module Rigor
 
       private
 
-      # Run the suite with Bundler's environment stripped, so a `bundle exec`
-      # test command resolves the **target** project's Gemfile — not whatever
-      # bundle Rigor itself was launched under. Running Rigor via `bundle exec`
-      # leaks `RUBYOPT=-rbundler/setup` + `GEM_HOME` / `BUNDLE_*` into a plain
-      # `system` subprocess, which then resolves the target's Gemfile against
-      # Rigor's gems and fails — so a green suite looks red and the run aborts.
-      # `with_unbundled_env` restores the pre-bundler env (a bare `env -u
-      # BUNDLE_GEMFILE` is not enough — the `BUNDLER_ORIG_*` preservers defeat
-      # it). Found validating ADR-70 on real projects (2026-06-17).
+      # Run the suite with Bundler's environment stripped, so a `bundle exec` test command resolves the
+      # **target** project's Gemfile — not whatever bundle Rigor itself was launched under. Running Rigor via
+      # `bundle exec` leaks `RUBYOPT=-rbundler/setup` + `GEM_HOME` / `BUNDLE_*` into a plain `system` subprocess,
+      # which then resolves the target's Gemfile against Rigor's gems and fails — so a green suite looks red and
+      # the run aborts. `with_unbundled_env` restores the pre-bundler env (a bare `env -u BUNDLE_GEMFILE` is not
+      # enough — the `BUNDLER_ORIG_*` preservers defeat it). Found validating ADR-70 on real projects
+      # (2026-06-17).
       def shell_run(command)
         run = -> { system(*command, out: File::NULL, err: File::NULL) }
         return run.call unless defined?(Bundler) && Bundler.respond_to?(:with_unbundled_env)