rigortype 0.3.1 → 0.3.2

data/lib/rigor/protection/closure_kill_oracle.rb

@@ -0,0 +1,171 @@
+# frozen_string_literal: true
+
+require "tempfile"
+
+require_relative "../analysis/buffer_binding"
+require_relative "../analysis/runner"
+require_relative "diagnostic_oracle"
+require_relative "discovery_seed"
+require_relative "kill_signature"
+
+module Rigor
+  module Protection
+    # Issue #254 — the ADR-69 Seam 1 kill oracle that judges a mutant by the WHOLE dependent closure.
+    #
+    # {DiagnosticOracle} re-analyses the mutated file alone, so the most valuable catch Rigor delivers is
+    # scored as a miss: change what a method returns and the diagnostic lands in its *callers*, which is
+    # exactly the cross-file reach the analyzer exists for. This oracle counts a kill when a new diagnostic
+    # (against the clean baseline of the same file set) appears anywhere in `{mutated} ∪ dependents[mutated]`
+    # — the ADR-46 reverse edge, supplied by {DependencyClosure}.
+    #
+    # **It is strictly additive, by construction.** The mutated file's verdict is delegated to a real
+    # {DiagnosticOracle}, built with exactly the knowledge the shipped oracle would have had (the
+    # `discovery-seeded-mutation-sites` seed when that feature is adopted, nothing when it is not), and only
+    # when that says "survived" is the closure consulted. So this feature moves `killed` in ONE direction and
+    # cannot silently re-decide a mutant the current oracle already kills. That separation is deliberate: what
+    # the oracle KNOWS is #253/#260's axis, and mixing the two here made the measurement uninterpretable —
+    # on redmine `app/models` an early build lost 11 kills to the richer knowledge while gaining none from the
+    # closure, and the two effects were indistinguishable in the total.
+    #
+    # **The mutant's bytes are never on the measured file's disk.** For the closure half they are written to a
+    # process-private temp file and bound to the measured path through {Analysis::BufferBinding} — the #146
+    # editor seam, whose whole purpose is "analyse THESE bytes at THAT logical path". The binding reaches three
+    # places that would otherwise read the file as it sits on disk:
+    #
+    # 1. the per-file parse (`Runner#parse_source` resolves through the binding);
+    # 2. the discovery tables the dependents resolve the mutated `def`s through
+    #    ({DiscoverySeed.tables_for_buffer} — the change-detection half: the mutated path's digest is the
+    #    mutant's, so its bundle is invalidated and re-walked);
+    # 3. diagnostic locations, which stay on the LOGICAL path, so a signature computed against a mutant is
+    #    comparable with the baseline's.
+    #
+    # Miss any of them and every dependent reads the clean bytes, no diagnostic ever appears outside the
+    # mutated file, and the run reports a plausible number that measured nothing new.
+    #
+    # Cost. The closure is consulted only for the mutants the mutated file did not already kill (≈30% of them
+    # on Rigor's own `lib`), and each costs one analysis per dependent (mean 1.85 there) plus a ≈15ms seed
+    # re-fold. Every per-mutant analysis keeps `cache_store: nil`: a `--threshold` CI gate must never be
+    # handed a stale clean hit.
+    class ClosureKillOracle
+      # The clean baseline of one measured file, kept as TWO sets rather than their union. The mutated file's
+      # half must be compared against exactly what the single-file oracle would compare against — a diagnostic
+      # the closure baseline happens to carry at the mutated path (it analyses that file under cross-file
+      # knowledge the single-file run does not have) must not mask a kill the shipped oracle would report.
+      Baseline = Data.define(:own, :dependents)
+
+      # @param configuration [Rigor::Configuration]
+      # @param environment [Rigor::Environment] built once by the caller.
+      # @param project_scan [Rigor::Analysis::ProjectScan] built once by the caller; adopted per analysis
+      #   through `prebuilt:`, exactly as {DiagnosticOracle} does.
+      # @param paths [Array<String>] the measured file set, in canonical order (the seed's span: a class
+      #   declared outside it stays unknown, as it does for Tier 1's seed and for {DiscoverySeed}).
+      # @param dependents [Hash{String => Array<String>}] {DependencyClosure} map, restricted to `paths`.
+      # @param seed_bundles [Hash{String => Hash}] {DiscoverySeed.bundles} over the same `paths`.
+      # @param discovery_seed [Hash, nil] the `discovery-seeded-mutation-sites` seed when that feature is also
+      #   adopted, nil otherwise. It goes to the delegated {DiagnosticOracle} verbatim, so the mutated file's
+      #   verdict is byte-for-byte the verdict that feature combination produces without this one; its
+      #   `param_inferred_types` slot additionally rides the per-mutant closure seed, so an admitted site is
+      #   judged with the knowledge that admitted it (issue #260's amended decision). The table is not
+      #   refreshed per mutant — the collector is a whole-project pre-pass, and one mutated method body does
+      #   not justify re-running it thousands of times.
+      def initialize(configuration:, environment:, project_scan:, paths:, dependents:, seed_bundles:,
+                     discovery_seed: nil)
+        @configuration = configuration
+        @environment = environment
+        @project_scan = project_scan
+        @paths = paths
+        @dependents = dependents
+        @seed_bundles = seed_bundles
+        @discovery_seed = discovery_seed
+        @param_inferred_types = discovery_seed && discovery_seed[:param_inferred_types]
+        @single = DiagnosticOracle.new(
+          configuration: configuration, environment: environment, project_scan: project_scan,
+          discovery_seed: discovery_seed
+        )
+      end
+
+      # The clean baselines a mutant must add a diagnostic to: the mutated file's (the shipped oracle's own,
+      # unchanged) and the dependents'. Computed once per measured file by the caller ({MutationScanner}),
+      # never per mutant. The dependents' half is bound through the same buffer machinery a mutant is, so the
+      # clean and mutant runs of the closure differ in exactly one input — the bytes.
+      def baseline(source:, path:)
+        Baseline.new(
+          own: @single.baseline(source: source, path: path),
+          dependents: dependents_signatures(source, path)
+        )
+      end
+
+      # Killed iff the mutant introduces a diagnostic the baseline did not carry — in the mutated file (the
+      # shipped verdict), or, failing that, in any dependent of it (what this feature adds).
+      def killed?(mutant_source:, path:, baseline:)
+        return true if @single.killed?(mutant_source: mutant_source, path: path, baseline: baseline.own)
+
+        dependents = @dependents[path] || []
+        return false if dependents.empty?
+
+        dependents_signatures(mutant_source, path).any? { |sig| !baseline.dependents.include?(sig) }
+      end
+
+      # The file set a kill is looked for in: the mutated file plus its measured dependents.
+      def closure_for(path)
+        [path, *(@dependents[path] || [])]
+      end
+
+      private
+
+      # The diagnostic signatures the dependents of `path` report while `source` stands in for it. Empty (and
+      # analysis-free) when nothing depends on the file — 120 of Rigor's own 349 `lib` files.
+      def dependents_signatures(source, path)
+        dependents = @dependents[path] || []
+        return Set.new if dependents.empty?
+
+        with_mutant(source, path) do |buffer, seed|
+          KillSignature.signatures_of(analyse(dependents, buffer, seed))
+        end
+      end
+
+      # Binds `source` to `path` for the duration of the block, yielding the binding and the seed tables
+      # rebuilt against it. One temp file per process (never per mutant): the digest that invalidates the
+      # mutated file's bundle is taken over the file's CONTENT, and the per-run digest memo is not installed
+      # out here, so rewriting one path in place cannot serve a stale answer.
+      def with_mutant(source, path)
+        File.binwrite(mutant_file.path, source)
+        buffer = Analysis::BufferBinding.new(logical_path: path, physical_path: mutant_file.path)
+        yield(buffer, seed_for(buffer))
+      end
+
+      # The process-private mutant file. Created lazily, and re-created after a fork ({CLI::MutationForkScan}
+      # workers must not share one path), which the pid guard detects.
+      def mutant_file
+        return @mutant_file if @mutant_file && @mutant_pid == Process.pid
+
+        @mutant_pid = Process.pid
+        @mutant_file = Tempfile.new(["rigor-mutant-", ".rb"])
+      end
+
+      def seed_for(buffer)
+        tables = DiscoverySeed.tables_for_buffer(paths: @paths, bundles: @seed_bundles, buffer: buffer)
+        return tables if @param_inferred_types.nil? || @param_inferred_types.empty?
+
+        tables.merge(param_inferred_types: @param_inferred_types).freeze
+      end
+
+      # One analysis of `paths` with the mutant bound. `prebuilt:` keeps the RBS environment + whole-project
+      # pre-pass the caller paid for once; `discovery_seed:` (issue #260's runner seam) is what carries the
+      # cross-file knowledge into a prebuilt run, and here it is the MUTANT-refreshed table set — without it a
+      # dependent resolves the `def` still on disk and no mutation could ever be visible to it.
+      #
+      # `analyze_only:` is load-bearing, not an optimisation. A `buffer:` alone selects editor-mode option A,
+      # whose analysed set IS the buffer's single logical path — every other file is read by the pre-passes
+      # and emits nothing. A closure oracle built that way would report zero cross-file kills and look
+      # entirely plausible doing it. Passing both selects option B (#146), where the closure wins and the
+      # buffer is one member of it.
+      def analyse(paths, buffer, seed)
+        Analysis::Runner.new(
+          configuration: @configuration, environment: @environment, prebuilt: @project_scan,
+          cache_store: nil, collect_stats: false, buffer: buffer, discovery_seed: seed, analyze_only: paths
+        ).run(paths).diagnostics
+      end
+    end
+  end
+end

data/lib/rigor/protection/dependency_closure.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require_relative "../analysis/runner"
+
+module Rigor
+  module Protection
+    # Issue #254 — the **dependent closure** the Tier-2 kill oracle re-analyses: for each measured file, the
+    # measured files that read a declaration or a method body from it.
+    #
+    # ADR-46 already records exactly this edge, but only under `record_dependencies: true` — an ordinary
+    # analysis (and every per-mutant analysis) records nothing. So the map is built ONCE, by one recording
+    # pass over the measured paths, and then read for every mutant. This is the one place ADR-46's REVERSE
+    # index is the right tool (the forward edge is a cache-key input; #134 needs that one).
+    #
+    # Cost, measured on Rigor's own `lib` (349 files, 8 workers, warm cache): ≈4.3s for the recording pass —
+    # roughly one extra `rigor check` next to a multi-minute mutation run, paid once. The pass CANNOT reuse
+    # the caller's `prebuilt:` {Analysis::ProjectScan}: `Runner#ensure_project_discovery` is a no-op under
+    # `prebuilt:`, so a prebuilt recording run would resolve nothing cross-file and record an empty graph —
+    # a silently empty closure, which is precisely the failure mode this feature exists to remove. It
+    # therefore runs its own pre-passes, sharing only the environment and the (read-only) cache store.
+    #
+    # Not fail-soft on purpose: an exception here aborts the run rather than degrading the measurement to
+    # "no dependents", which would look exactly like a plausible effectiveness number.
+    module DependencyClosure
+      module_function
+
+      # @param paths [Array<String>] the measured file set, in caller order.
+      # @param configuration [Rigor::Configuration]
+      # @param environment [Rigor::Environment] built once by the caller.
+      # @param cache_store [Rigor::Cache::Store, nil] threaded to the recording run only (its RBS-env and
+      #   plugin-producer tiers); the per-mutant analyses stay `cache_store: nil` regardless.
+      # @param workers [Integer] fork-pool workers for the recording pass (the pool records per worker and
+      #   marshals the records back, so a pooled graph equals the sequential one).
+      # @return [Hash{String => Array<String>}] frozen `path => sorted dependents`, restricted to `paths`.
+      def build(paths:, configuration:, environment:, cache_store: nil, workers: 0)
+        runner = Analysis::Runner.new(
+          configuration: configuration, environment: environment, cache_store: cache_store,
+          collect_stats: false, record_dependencies: true, workers: workers
+        )
+        runner.run(paths)
+        index(runner.file_dependents, paths)
+      end
+
+      # Restricts a raw {Analysis::Runner#file_dependents} map to the measured set: a dependent outside it is
+      # not being measured, so re-analysing it would report a diagnostic against a file the run never
+      # baselined. Self-edges are dropped (the mutated file is the closure's own head), and each list is
+      # sorted so a `--threshold` gate reads the same number whatever order the recording pass finished in.
+      #
+      # @return [Hash{String => Array<String>}]
+      def index(dependents, paths)
+        measured = Set.new(paths)
+        paths.to_h do |path|
+          list = (dependents[path] || []).select { |dep| measured.include?(dep) && dep != path }
+          [path, list.sort.freeze]
+        end.freeze
+      end
+    end
+  end
+end

data/lib/rigor/protection/diagnostic_oracle.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../analysis/runner"
+require_relative "kill_signature"
 
 module Rigor
   module Protection
@@ -15,21 +16,28 @@ module Rigor
     # disk write). Passing `prebuilt:` disables the run-result cache (whose key digests the *disk* file), so a
     # mutant is never served a stale clean hit.
     class DiagnosticOracle
-      def initialize(configuration:, environment:, project_scan:)
+      # @param discovery_seed [Hash, nil] issue #260 — the cross-file discovery tables (see {DiscoverySeed})
+      #   the per-mutant analysis is seeded with, threaded through to `Runner.new(discovery_seed:)`. Without
+      #   it the runner's `prebuilt:` path carries frozen-empty discovery tables, so a receiver whose class is
+      #   declared in a *sibling* file reads `Dynamic` and NO mutation at that site can produce a diagnostic —
+      #   a site the caller's site filter may nonetheless have admitted, and then measured as an unkillable
+      #   survivor. nil (the default) keeps the shipped single-file oracle.
+      def initialize(configuration:, environment:, project_scan:, discovery_seed: nil)
         @configuration = configuration
         @environment = environment
         @project_scan = project_scan
+        @discovery_seed = discovery_seed
       end
 
       # The clean per-file baseline: the diagnostic signatures a mutant must add to count as killed. Computed
       # once per file by the caller.
       def baseline(source:, path:)
-        analyse(source, path).to_set { |d| sig(d) }
+        KillSignature.signatures_of(analyse(source, path))
       end
 
       # Killed iff the mutant introduces a diagnostic not in `baseline`.
       def killed?(mutant_source:, path:, baseline:)
-        analyse(mutant_source, path).any? { |d| !baseline.include?(sig(d)) }
+        analyse(mutant_source, path).any? { |d| !baseline.include?(KillSignature.of(d)) }
       end
 
       private
@@ -37,13 +45,9 @@ module Rigor
       def analyse(source, path)
         Rigor::Analysis::Runner.new(
           configuration: @configuration, environment: @environment, prebuilt: @project_scan,
-          cache_store: nil, collect_stats: false
+          cache_store: nil, collect_stats: false, discovery_seed: @discovery_seed
         ).run_source(source: source, path: path).diagnostics
       end
-
-      def sig(diagnostic)
-        [diagnostic.rule, diagnostic.path, diagnostic.line, diagnostic.column, diagnostic.message]
-      end
     end
   end
 end

data/lib/rigor/protection/discovery_seed.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require_relative "../inference/parameter_inference_collector"
+require_relative "../inference/scope_indexer"
+
+module Rigor
+  module Protection
+    # Issue #260 — the cross-file knowledge Tier 2 hands to BOTH halves of a mutation measurement.
+    #
+    # Site selection and the kill oracle used to disagree by construction: the site filter judged a receiver
+    # against a scope seeded with `discovered_classes`, so `Account.find` (with `Account` declared in a sibling
+    # file) entered the denominator — while the oracle re-analysed each mutant through
+    # `Runner.new(prebuilt:)#run_source`, whose cross-file discovery tables stay frozen-empty, so the same
+    # receiver read `Dynamic` and NO mutation at that site could ever produce a diagnostic. Every admitted
+    # cross-file site was therefore a guaranteed survivor: on Rigor's own `lib`, +2,183 sites bought +2,187
+    # survivors and moved `killed` by −4.
+    #
+    # The answer (issue #260's recorded decision) is one table set, built once, threaded to both sides: the
+    # {Mutator} base scope and {DiagnosticOracle}'s runner seam. This module builds that table set — the FULL
+    # discovery bundle (`discovered_def_nodes`, `discovered_methods`, superclasses, includes, …), not just the
+    # class-identity slice site selection needed, because resolving `find` on `singleton(Account)` is what makes
+    # the site killable.
+    #
+    # The shape is a plain Hash of {Scope::DiscoveryIndex} slot names, which is exactly what both consumers take:
+    # `scope.discovery.with(**tables)` on one side, `Runner#project_scope_seed_tables` on the other.
+    #
+    # Built ONCE on the parent, before {CLI::MutationForkScan} forks, so children copy-on-write inherit it.
+    # Nothing here crosses the marshal boundary (only per-file results do) — which matters, because the def-node
+    # tables hold live `Prism::Node`s.
+    module DiscoverySeed
+      module_function
+
+      # @param paths [Array<String>] the measured file set; the seed spans these files only, exactly as Tier 1's
+      #   seed does. A class declared outside them stays unknown.
+      # @param environment [Rigor::Environment] the plugin-aware environment, built once by the caller.
+      # @param target_ruby [String] Prism parse version for the parameter-inference pre-pass.
+      # @param workers [Integer] worker count for that pre-pass (0 keeps it sequential).
+      # @return [Hash{Symbol => Object}] frozen seed tables; empty when the paths yield nothing.
+      def build(paths:, environment:, target_ruby:, workers: 0)
+        tables = discovery_tables(paths)
+        params = Inference::ParameterInferenceCollector.collect(
+          files: paths, environment: environment, target_ruby: target_ruby, workers: workers
+        )
+        tables[:param_inferred_types] = params unless params.empty?
+        tables.freeze
+      end
+
+      # Issue #254 — the per-file discovery *bundles* (ADR-85 WD2) the closure kill oracle re-folds once per
+      # mutant. A bundle is one file's isolated contribution to the tables above, plus the content digest that
+      # decides whether it is still valid; folding the whole set reconstructs exactly what {#discovery_tables}
+      # builds. Built ONCE on the parent (before {CLI::MutationForkScan} forks, so children copy-on-write
+      # inherit it), and cheap: ≈0.36s over Rigor's own 349-file `lib`.
+      #
+      # @param paths [Array<String>] the measured file set, in canonical (caller) order.
+      # @return [Hash{String => Hash}] per-path bundles, the input {#tables_for_buffer} re-folds.
+      def bundles(paths:)
+        Inference::ScopeIndexer.discovered_project_index_incremental(paths, seed_bundles: {}).fetch(:bundles)
+      end
+
+      # Issue #254 — the seed tables for ONE mutant: every measured file's bundle folded back unchanged
+      # EXCEPT the file `buffer` binds, which is re-walked from the buffer's bytes.
+      #
+      # This is where the substitution reaches change detection rather than only the analysis. The
+      # incremental pass digests each path through the binding, so the mutated file's digest is the MUTANT's
+      # and never matches its cached bundle — it is re-walked, and every dependent then reads the mutated
+      # `def` bodies out of the seed instead of the ones still on disk. Without it a closure re-analysis
+      # would resolve the clean method, produce no new diagnostic anywhere but the mutated file itself, and
+      # report a plausible-looking effectiveness number that measured nothing new.
+      #
+      # ≈15ms over 349 files (one re-walk plus a whole-set fold), against ≈210ms for one mutant's analysis.
+      #
+      # @param paths [Array<String>] the measured file set, in the same order {#bundles} was built from.
+      # @param bundles [Hash{String => Hash}] that bundle set.
+      # @param buffer [Rigor::Analysis::BufferBinding] the mutant binding (logical path → mutant bytes).
+      # @return [Hash{Symbol => Object}] frozen seed tables.
+      def tables_for_buffer(paths:, bundles:, buffer:)
+        index = Inference::ScopeIndexer.discovered_project_index_incremental(
+          paths, seed_bundles: bundles, buffer: buffer
+        )
+        seed_tables(index).freeze
+      end
+
+      # The whole-project discovery tables, from the single-walk combined pass (one parse per file, both
+      # collectors driven over the same tree) that {Analysis::Runner::ProjectPrePasses#discover} uses. Empty
+      # tables are dropped so an empty seed stays `{}` and every consumer's "seed nothing" branch keeps working.
+      #
+      # `discovered_class_sources` is deliberately NOT carried: the runner itself seeds it only under dependency
+      # recording (it is read by the ancestry accessors solely to record cross-file edges), and Tier 2 never
+      # records.
+      def discovery_tables(paths)
+        seed_tables(Inference::ScopeIndexer.discovered_project_index_for_paths(paths))
+      end
+
+      # Maps a `{ classes:, def_index: }` discovery index onto the {Scope::DiscoveryIndex} slot names both
+      # consumers take. Shared by the whole-walk ({#discovery_tables}) and bundle-fold ({#tables_for_buffer})
+      # producers so a mutant's seed and the parent's seed can never disagree about shape.
+      def seed_tables(index)
+        def_index = index.fetch(:def_index)
+        tables = { discovered_classes: index.fetch(:classes) }
+        %i[
+          def_nodes singleton_def_nodes def_sources singleton_def_sources superclasses includes
+          method_visibilities methods data_member_layouts struct_member_layouts
+        ].each do |slot|
+          tables[seed_key(slot)] = def_index.fetch(slot)
+        end
+        tables.reject { |_, table| table.nil? || table.empty? }
+      end
+
+      # The def-index slot names match the {Scope::DiscoveryIndex} ones under a `discovered_` prefix, except the
+      # two member-layout tables, which carry the same name on both sides.
+      def seed_key(slot)
+        slot.to_s.end_with?("member_layouts") ? slot : :"discovered_#{slot}"
+      end
+    end
+  end
+end

data/lib/rigor/protection/kill_signature.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Protection
+    # ADR-69 Seam 1 — the identity a *kill* is judged by, shared by every diagnostic-based oracle.
+    #
+    # A mutant is killed when re-analysis produces a diagnostic the clean baseline did not carry, so the
+    # comparison needs an identity that is stable across two runs of the same code and distinct for two
+    # genuinely different reports. `path` is part of it deliberately: the closure oracle (issue #254) pools
+    # the baseline of several files into one set, and the same rule firing at the same line of a *different*
+    # file must not be mistaken for the baseline's.
+    #
+    # Lifted out of {DiagnosticOracle} when {ClosureKillOracle} arrived: two oracles disagreeing about what
+    # "the same diagnostic" means would show up only as an unexplained kill-count delta between them.
+    module KillSignature
+      module_function
+
+      # @param diagnostic [Rigor::Analysis::Diagnostic]
+      # @return [Array] the comparison key.
+      def of(diagnostic)
+        [diagnostic.rule, diagnostic.path, diagnostic.line, diagnostic.column, diagnostic.message]
+      end
+
+      # @param diagnostics [Enumerable<Rigor::Analysis::Diagnostic>]
+      # @return [Set<Array>] the signature set of `diagnostics`.
+      def signatures_of(diagnostics)
+        diagnostics.to_set { |diagnostic| of(diagnostic) }
+      end
+    end
+  end
+end