@intentic/sandbox-contract 1.233.0 → 1.235.0

package/src/agent-catalog.test.ts

@@ -88,9 +88,10 @@ describe("the pi provider", () => {
         expect(pi.steering).toBe(true);
         expect(pi.effort).toBe(true);
         expect(pi.commands).toBe(true);
+        expect(pi.mcp).toBe("none");
+        expect(pi.terminals).toBe(false);
         const limitations = limitationsOf(pi);
-        expect(limitations).toContain("no MCP tools or plugins");
-        expect(limitations).toContain("no terminal panel");
+        expect(limitations.length).toBeGreaterThan(0);
         expect(limitations).not.toContain("no mid-turn steering");
         expect(limitations).not.toContain("no effort control");
         expect(limitations).not.toContain("no slash commands");
@@ -152,22 +153,23 @@ test("a mode the runtime can't hold falls back to the one it runs; one it can ho
 test("the ceiling has nothing to disclose; a floor names what it lacks", () => {
     expect(limitationsOf(capabilitiesOf("claude", "native"))).toEqual([]);
 
-    const grok = limitationsOf(capabilitiesOf("grok", "native"));
-    expect(grok).toContain("no per-tool approvals");
-    expect(grok).toContain("no mid-turn steering");
-    expect(grok).toContain("no effort control");
-    expect(grok).toContain("worktree by working directory only");
-
-    // ACP takes our http MCP tools when it advertises them, so its line is a narrowing rather than an absence:
-    // and it publishes commands and terminals, which must NOT be listed as missing.
-    const acp = limitationsOf(capabilitiesOf("some-installed-agent", "native"));
-    expect(acp).toContain("MCP tools only: no plugins or browser");
-    expect(acp).not.toContain("no slash commands");
-    expect(acp).not.toContain("no terminal panel");
-
-    const codex = limitationsOf(capabilitiesOf("codex", "native"));
-    expect(codex).toContain("browser tools only: no plugins or other MCP tools");
-    expect(codex).not.toContain("no MCP tools or plugins");
+    const grokCaps = capabilitiesOf("grok", "native");
+    expect(grokCaps.permissions).toBe("plan");
+    expect(grokCaps.steering).toBe(false);
+    expect(grokCaps.isolation).toBe("cwd");
+    expect(limitationsOf(grokCaps).length).toBeGreaterThan(0);
+
+    const acpCaps = capabilitiesOf("some-installed-agent", "native");
+    expect(acpCaps.mcp).toBe("http");
+    const acp = limitationsOf(acpCaps);
+    expect(acp.some((line) => line.includes("MCP"))).toBe(true);
+    expect(acpCaps.commands).toBe(true);
+    expect(acpCaps.terminals).toBe(true);
+
+    const codexCaps = capabilitiesOf("codex", "native");
+    expect(codexCaps.mcp).toBe("browser");
+    expect(limitationsOf(codexCaps).some((line) => line.includes("browser"))).toBe(true);
+    expect(limitationsOf(codexCaps).length).toBeLessThan(limitationsOf({ ...grokCaps, mcp: "none" }).length + 5);
 });
 
 test("every axis a record can lack has words for it", () => {
@@ -185,6 +187,7 @@ test("every axis a record can lack has words for it", () => {
         terminals: false,
         recovery: false,
         instructions: "none",
+        skillDiscovery: "prompt",
         rulebook: "none",
         secrets: "none",
     };
@@ -201,33 +204,27 @@ test("every axis a record can lack has words for it", () => {
  * has a middle value, and disclosing the floor's words for it would tell a Codex user their rules are ignored
  * when they are in fact being applied to everything Codex asks about. */
 test("the safety axes disclose the middle answer differently from the floor", () => {
-    const claude = limitationsOf(capabilitiesOf("claude", "native")).join(" ");
-    const codex = limitationsOf(capabilitiesOf("codex", "native")).join(" ");
-    const pi = limitationsOf(capabilitiesOf("pi", "native")).join(" ");
-
-    // The ceiling says nothing about either axis.
-    expect(claude).not.toContain("command rules");
-    expect(claude).not.toContain("stored secrets");
-
-    // The middle: rules DO apply, to what the vendor raises. Never the floor's flat "aren't applied".
-    expect(codex).toContain("only to calls this agent asks about");
-    expect(codex).not.toContain("aren't applied");
-
-    // The floor: no seam at all, said plainly.
-    expect(pi).toContain("your command rules aren't applied");
-
-    /* The third answer, which exists because OpenCode's watchdog aborts a turn that pauses. Its sentence must
-     * say the rules DO bite (unlike Pi's) and that a hold cannot ask (unlike Codex's). */
-    const grok = limitationsOf(capabilitiesOf("grok", "native")).join(" ");
-    expect(grok).toContain("a rule set to hold refuses instead");
-    expect(grok).not.toContain("aren't applied");
-    expect(grok).not.toContain("only to calls this agent asks about");
-    // Gemini rides the same loop, so it must read the same way.
-    expect(limitationsOf(capabilitiesOf("gemini", "native")).join(" ")).toBe(grok);
-
-    // Masking is binary and structural, so every non-Claude runtime says the same thing.
+    const claudeCaps = capabilitiesOf("claude", "native");
+    const codexCaps = capabilitiesOf("codex", "native");
+    const piCaps = capabilitiesOf("pi", "native");
+    const grokCaps = capabilitiesOf("grok", "native");
+
+    expect(claudeCaps.rulebook).toBe("hooks");
+    expect(claudeCaps.secrets).toBe("masked");
+
+    expect(codexCaps.rulebook).toBe("approval");
+    expect(piCaps.rulebook).toBe("none");
+    expect(grokCaps.rulebook).toBe("refuse-only");
+
+    expect(limitationsOf(claudeCaps).join(" ")).not.toContain("command rules");
+    expect(limitationsOf(claudeCaps).join(" ")).not.toContain("stored secrets");
+
+    expect(limitationsOf(codexCaps).length).toBeGreaterThan(limitationsOf(claudeCaps).length);
+    expect(limitationsOf(piCaps).length).toBeGreaterThan(limitationsOf(claudeCaps).length);
+    expect(limitationsOf(grokCaps).join(" ")).toBe(limitationsOf(capabilitiesOf("gemini", "native")).join(" "));
+
     for (const provider of ["codex", "grok", "gemini", "pi", "some-installed-agent"] as const) {
-        expect(limitationsOf(capabilitiesOf(provider, "native")).join(" ")).toContain("stored secrets reach the model unmasked");
+        expect(capabilitiesOf(provider, "native").secrets).toBe("none");
     }
 });
 
@@ -235,14 +232,16 @@ test("the safety axes disclose the middle answer differently from the floor", ()
  * count above cannot check: a middle value that discloses the same words as the floor would tell a Grok user
  * their prompt is ignored when it is in fact being sent. */
 test("the instruction axis discloses its two weaker answers, differently", () => {
-    const grok = limitationsOf(capabilitiesOf("grok", "native")).join(" ");
-    const acp = limitationsOf(capabilitiesOf("some-installed-agent", "native")).join(" ");
-
-    expect(grok).toContain("added to theirs");
-    expect(grok).not.toContain("isn't applied");
-    expect(acp).toContain("isn't applied");
-    // Codex on its own runtime replaces, like the Claude Code loop, so it has nothing to disclose here.
-    expect(limitationsOf(capabilitiesOf("codex", "native")).join(" ")).not.toContain("system prompt");
+    const grokCaps = capabilitiesOf("grok", "native");
+    const acpCaps = capabilitiesOf("some-installed-agent", "native");
+    const codexCaps = capabilitiesOf("codex", "native");
+
+    expect(grokCaps.instructions).toBe("append");
+    expect(acpCaps.instructions).toBe("none");
+    expect(codexCaps.instructions).toBe("replace");
+
+    expect(limitationsOf(grokCaps).length).toBeGreaterThan(limitationsOf(codexCaps).length);
+    expect(limitationsOf(acpCaps).length).toBeGreaterThan(limitationsOf(codexCaps).length);
 });
 
 /* The JS backend is hosted by the one loop the daemon can put its own execution seam through. Pinned as a test
@@ -366,8 +365,10 @@ describe("the free providers", () => {
         // empty headline or a dangling sentence in front of the user who has connected nothing.
         for (const provider of FREE_PROVIDERS) {
             const access = accessFor(provider);
-            expect(access?.requirement).toBeTruthy();
-            expect(access?.runs).toBeTruthy();
+            // Both are sentences the gate PUTS ON SCREEN, so what they have to be is text with something in
+            // it. Truthiness passes a whitespace-only string, which renders as the empty headline this is about.
+            expect(access?.requirement).toEqual(expect.stringMatching(/\S/));
+            expect(access?.runs).toEqual(expect.stringMatching(/\S/));
         }
     });
 });

package/src/agent-catalog.ts

@@ -140,7 +140,7 @@ export const TRIAL_MODEL_ID = "auto";
 // What the picker calls it, and the sentence the surfaces put underneath. One wording, so the composer's notice
 // and the picker's row cannot end up describing different bargains.
 export const TRIAL_LABEL = "Free trial";
-export const TRIAL_NOTICE = "Trial messages pass through intentic's servers. Connect an account to chat directly.";
+export const TRIAL_NOTICE = "Trial messages pass through intentic. Connect an account to chat directly.";
 
 export const ENDPOINT_PROVIDER_PREFIX = "endpoint/";
 export const endpointProvider = (id: string): AgentProvider => `${ENDPOINT_PROVIDER_PREFIX}${id}`;
@@ -300,6 +300,16 @@ export interface AgentCapabilities {
      * only the Claude Code loop's: Codex's own base describes Codex's own tools, so swapping it for a prompt
      * written about another harness is the owner's deliberate act (their custom text), never ours. */
     readonly instructions: "replace" | "append" | "none";
+    /* HOW THIS RUNTIME DISCOVERS THE WORKSPACE'S LOADED SKILLS.
+     *
+     *   "native", the runtime scans one of the filesystem projections itself: `.agents/skills/` for Codex,
+     *               `.claude/skills/` for the Claude Code loop. Its own loader injects the catalogue and reads
+     *               the matching SKILL.md on demand, so adding our own note would duplicate it.
+     *   "prompt", the runtime has no loader the daemon can rely on. turn-plan.ts puts the same name,
+     *               description and absolute SKILL.md path into the opening user-message preamble. This is a
+     *               separate axis from `instructions`: Pi and ACP take no system prompt at all, while OpenCode
+     *               and Cursor take an append, but all four still need skill discovery. */
+    readonly skillDiscovery: "native" | "prompt";
     /* WHETHER THE OWNER'S COMMAND RULEBOOK REACHES THIS RUNTIME (SandboxSettings.commandRules, decided by
      * guard/actions.ts commandRun, delivered by guard/command-gate.ts).
      *
@@ -364,6 +374,7 @@ const CLAUDE_CODE: AgentCapabilities = {
     terminals: true,
     recovery: true,
     instructions: "replace",
+    skillDiscovery: "native",
     // The only runtime with a pre-execution hook of its own, which is why it is the only one where a HOLD can
     // park the call and wait for a card rather than having to refuse it.
     rulebook: "hooks",
@@ -397,6 +408,7 @@ const CODEX: AgentCapabilities = {
      * message ahead of its skills and team blocks. Verified against codex-cli 0.147 by reading what actually
      * reached the wire, the keys are undocumented, and a strings dump proves only that they parse. */
     instructions: "replace",
+    skillDiscovery: "native",
     /* App-server publishes `item/commandExecution/requestApproval`, whose params carry the command text, and
      * takes `accept`/`decline` back (codex-cli 0.147's own generated JSON Schema, read with
      * `codex app-server generate-json-schema`). The daemon only asks Codex to raise those requests when the
@@ -425,6 +437,7 @@ const OPENCODE: AgentCapabilities = {
     // replacing that, so a custom prompt lands here as extra instructions, and the settings page says so
     // rather than letting "replaces everything" quietly mean something else on two providers.
     instructions: "append",
+    skillDiscovery: "prompt",
     /* OpenCode asks over its own permission channel (`permission.updated`, replied on
      * `/session/{id}/permissions/{permissionID}`, vocabulary once/always/reject), and the daemon judges what it
      * raises with the same decide fn every other runtime uses.
@@ -474,6 +487,7 @@ const ACP: AgentCapabilities = {
     // ACP's `session/new` and `session/prompt` carry no system field: the agent owns its own instructions the
     // same way it owns its model and its permission posture. The persona note takes the user message instead.
     instructions: "none",
+    skillDiscovery: "prompt",
     /* `session/request_permission` is in the protocol floor, so every conforming agent has the channel and the
      * daemon answers it from the rulebook (acp/acp-permissions.ts). The caveat the "approval" value already
      * carries is at its widest here: WHICH calls an agent asks about is entirely the agent's choice, and one
@@ -510,6 +524,7 @@ const PI: AgentCapabilities = {
     // Pi's RPC opens a session with a prompt and steers it; nothing in that protocol sets standing
     // instructions, so like ACP it hears the persona note through the user message.
     instructions: "none",
+    skillDiscovery: "prompt",
     /* THE ONE RUNTIME WITH NO SEAM AT ALL. Pi runs bash in-process and its RPC publishes no approval request,
      * so there is nothing to consult before a command runs and no rule the owner writes can apply here. Said
      * out loud rather than left to be discovered: limitationsOf renders it, and the taint floor treats a "none"
@@ -582,6 +597,7 @@ const CURSOR: AgentCapabilities = {
      * `additional_context` that is folded into the request. So the owner's prompt and the persona note DO reach
      * the model, on top of Cursor's own base prompt, and nothing can replace that base. */
     instructions: "append",
+    skillDiscovery: "prompt",
     /* THE FULL HOOK TIER, the only foreign runtime that reaches it. Cursor reads `.cursor/hooks.json` in its
      * local runtime, and `beforeShellExecution` answers with `allow` / `deny` / `ask` plus the messages that
      * explain it, with `failClosed` available so a crashed gate blocks instead of waving the command through.
@@ -663,35 +679,26 @@ export const limitationsOf = (capabilities: AgentCapabilities): string[] => [
     ...(capabilities.mcp === "none"
         ? ["no MCP tools or plugins"]
         : capabilities.mcp === "http"
-          ? ["MCP tools only: no plugins or browser"]
+          ? ["MCP tools only, no plugins or browser"]
           : capabilities.mcp === "browser"
-            ? ["browser tools only: no plugins or other MCP tools"]
+            ? ["browser tools only, no other MCP"]
             : capabilities.mcp === "tools"
-              ? ["no plugins: every other tool reaches it"]
+              ? ["no plugins"]
               : []),
-    ...(capabilities.execution.includes("js") ? [] : ["no code runs, its shell is the one way to execute"]),
+    ...(capabilities.execution.includes("js") ? [] : ["no code runs, shell only"]),
     ...(capabilities.effort ? [] : ["no effort control"]),
     ...(capabilities.commands ? [] : ["no slash commands"]),
     ...(capabilities.terminals ? [] : ["no terminal panel"]),
-    ...(capabilities.isolation === "namespace" ? [] : ["worktree by working directory only"]),
-    ...(capabilities.recovery ? [] : ["no auto-resume after an outage"]),
-    /* The two weaker answers on the instruction axis, and only those: "replace" is the ceiling this list
-     * measures against, so it has nothing to disclose. Both phrasings name the OWNER'S prompt rather than the
-     * mechanism, because that is the thing they wrote and the thing that will or will not be in force. */
-    ...(capabilities.instructions === "append" ? ["your system prompt is added to theirs, not replacing it"] : []),
-    ...(capabilities.instructions === "none" ? ["your system prompt isn't applied"] : []),
-    /* THE TWO SAFETY AXES, phrased as what the OWNER loses rather than as which seam is missing, because both
-     * describe something they configured on a settings page and would otherwise assume was in force everywhere.
-     *
-     * "hooks" and "masked" are the ceiling and disclose nothing. The "approval" middle answer discloses the one
-     * thing that genuinely differs from a hook: the vendor picks which calls it asks about, so a rule can only
-     * reach what it chose to raise. */
-    ...(capabilities.rulebook === "approval" ? ["your command rules apply only to calls this agent asks about"] : []),
+    ...(capabilities.isolation === "namespace" ? [] : ["worktree by cwd only"]),
+    ...(capabilities.recovery ? [] : ["no auto-resume after outage"]),
+    ...(capabilities.instructions === "append" ? ["system prompt appended, not replaced"] : []),
+    ...(capabilities.instructions === "none" ? ["system prompt not applied"] : []),
+    ...(capabilities.rulebook === "approval" ? ["command rules apply only to calls this agent raises"] : []),
     ...(capabilities.rulebook === "refuse-only"
-        ? ["your command rules can stop a command here but not pause to ask: a rule set to hold refuses instead"]
+        ? ["command rules can refuse but not hold"]
         : []),
-    ...(capabilities.rulebook === "none" ? ["your command rules aren't applied"] : []),
-    ...(capabilities.secrets === "none" ? ["stored secrets reach the model unmasked, and `{{secret:name}}` isn't substituted"] : []),
+    ...(capabilities.rulebook === "none" ? ["command rules not applied"] : []),
+    ...(capabilities.secrets === "none" ? ["secrets reach the model unmasked"] : []),
 ];
 
 // Claude's compile-time model floor, shared by the daemon's catalog (claude-models.ts, its last rung, reached

package/src/capability-ledger.test.ts

@@ -54,6 +54,9 @@ const LEDGER: Record<keyof AgentCapabilities, Backing> = {
      * that produced it: before the field existed, every runtime was composed for as though it were the Claude
      * Code loop, and five of the six silently dropped the owner's prompt. */
     instructions: "enforced",
+    // turn-plan.ts reads this before an opening turn: a "prompt" runtime receives the generated catalogue as
+    // a typed note, while a "native" runtime is left to its own loader so the same list never arrives twice.
+    skillDiscovery: "enforced",
     // turn-plan.ts (honoured) plans the JS backend only where "js" is declared, so a runtime without it is
     // handed no `jsExecution` and mounts no Code tool: the same drop-what-you-can't-honour rule as `effort`.
     execution: "enforced",
@@ -111,8 +114,14 @@ describe("a descriptive claim reaches the user", () => {
     const DIMINISHED: Partial<Record<keyof AgentCapabilities, unknown>> = { secrets: "none" };
 
     it.each(fieldsWhere("descriptive"))("%s puts its own sentence in the picker when the runtime lacks it", (field) => {
-        const floor = typeof CEILING[field] === "boolean" ? false : DIMINISHED[field];
-        expect(floor, `${field} is descriptive and not a boolean: add its weakest value to DIMINISHED above`).toBeDefined();
+        const boolean = typeof CEILING[field] === "boolean";
+        // A boolean's floor is `false` and needs no entry; every other descriptive field has to name its own.
+        // Asserted against the KEYS of DIMINISHED so the failure prints the floors that do exist, which is what
+        // tells "this field was never added" apart from "this field was renamed and its entry left behind".
+        expect(boolean ? [field] : Object.keys(DIMINISHED), `${field} is descriptive and not a boolean: add its weakest value to DIMINISHED above`).toContain(
+            field,
+        );
+        const floor = boolean ? false : DIMINISHED[field];
 
         const lacking: AgentCapabilities = { ...CEILING, [field]: floor };
 

package/src/chores/chores.test.ts

@@ -19,7 +19,7 @@ describe(`the chore book's order`, () => {
         // The sort cannot drop an entry, but a future refactor to a filter-into-groups could, so the count is
         // pinned to the ids rather than to a number, which says which one went missing.
         expect(new Set(CHORES.map((chore) => chore.id)).size).toBe(CHORES.length);
-        expect(CHORES.length).toBe(17);
+        expect(CHORES.length).toBe(18);
     });
 
     it(`says "surveying" exactly when a chore is a survey`, () => {

package/src/chores/chores.ts

@@ -430,6 +430,70 @@ const duplication: Chore = {
     done: `Done when every clone in the report has either a named extraction or a one-line reason it should stay.`,
 };
 
+/* TEST STRENGTH. The one chore whose evidence is about the tests rather than the code, and it exists because
+ * nothing else in this workspace can produce it.
+ *
+ * A green suite is not evidence that the code is checked. Coverage says a line RAN; it cannot say an assertion
+ * depended on what the line produced. The gap between those two is where a model's tests live: they execute
+ * everything and assert almost nothing, and every gate here says yes to them — they type-check, they lint, they
+ * pass.
+ *
+ * MEASURED IN THIS REPOSITORY, on sandbox-contract's own chore module: 109 hand-written tests, and 16 of 58
+ * injected faults survived. The one worth reading is in `bucketOf`, whose comment in digest.ts argues at length
+ * that the zero boundary is load-bearing. Move that boundary and the suite stays green, because the test holding
+ * it is written relationally — `expect(bucketOf(0)).not.toBe(bucketOf(1))` — and with the boundary moved the two
+ * values are still different. The careful, un-brittle assertion is precisely the one that cannot see the change.
+ *
+ * THE FLOOR IS LOW ON PURPOSE. 60% is where Stryker's own default report turns red, and it is far under what a
+ * well-tested module scores, because this chore is looking for suites that are decorative rather than suites that
+ * are imperfect. A threshold near the good number would badge every honest package in the repo, which is how a
+ * maintenance surface teaches people to ignore it. */
+const MUTATION_FLOOR = 60;
+
+const testStrength: Chore = {
+    id: `test-strength`,
+    title: `Strengthen tests that would not notice a bug`,
+    icon: `list-check`,
+    description: `Whether the suite would actually fail if the code broke, which is a different question from whether it passes.`,
+    kind: `accruing`,
+    criterion: `Stryker's mutation score for the repo is under ${MUTATION_FLOOR}%.`,
+    stance: `act`,
+    needs: [`mutation`],
+    // Quarterly rather than monthly: a mutation score moves when tests are rewritten, which is not a weekly event,
+    // and the probe behind it is the most expensive one here.
+    cadenceMs: 90 * DAY_MS,
+    assess: (context) => {
+        const facts = factsOf(context, `mutation`);
+        if (facts === undefined || facts.mutation.score >= MUTATION_FLOOR) {
+            return undefined;
+        }
+        const { score, killed, survived, survivors } = facts.mutation;
+        return {
+            headline: `${survived} injected faults went unnoticed, ${score}% of them caught`,
+            // The survivors themselves, not the score. A percentage is a mood; a named line with the change that
+            // nothing objected to is a morning's work with the answer already in it.
+            detail: survivors.map((one) => `${one.file}:${one.line} · ${one.mutator} → ${one.replacement} · survived`),
+            /* Bucketed, via the same helper the other counting chores use, so ordinary drift does not read as
+             * news: a score moving 54 → 55 is not a thing to interrupt anyone about. The survivors' IDENTITIES
+             * ride along, so a NEW weak spot appearing speaks even while the number holds steady — which is the
+             * case that matters, because that is a test somebody just wrote. */
+            digest: digestOf(`bucket:${bucketOf(100 - score)}`, ...survivors.map((one) => `${one.file}:${one.line}`).toSorted()),
+            severity: `info`,
+            why:
+                `Stryker caught ${killed} of ${killed + survived} injected faults in ${repoLabel(context.repo)} (${score}%), under the ${MUTATION_FLOOR}% floor. ` +
+                `Code that can be changed with every test still green: ${survivors.map((one) => `${one.file}:${one.line} (${one.mutator} → ${one.replacement})`).join(`; `)}.`,
+        };
+    },
+    diagnosis: `Tests that run the code without checking what it produced pass whether or not the code is right, and no other check in this repository can tell the difference.`,
+    goal:
+        `Take the survivors one at a time and, for each, decide which of two things it is. Either the mutation changes behaviour somebody ` +
+        `depends on, in which case add the assertion that would have failed — usually at a BOUNDARY, and usually exact where the existing ` +
+        `test was relational: pinning \`bucketOf(0)\` to its value catches what \`not.toBe(bucketOf(1))\` cannot. Or it is an equivalent ` +
+        `mutant, code whose change genuinely cannot be observed, in which case say so and leave it. Do not chase the percentage: adding an ` +
+        `assertion nobody needs to satisfy a number is exactly the ceremony this is meant to detect.`,
+    done: `Done when every named survivor has either a new assertion that fails without the change, or a one-line note saying why it cannot be observed.`,
+};
+
 /* DOCUMENTATION. The evidence is a package with no README, which IS its architecture document in this
  * workspace, so this is a stat on the package directory rather than a lookup in a parallel tree. It sounds like
  * a coverage statistic
@@ -597,7 +661,7 @@ const runtime: Chore = {
     },
     diagnosis: `An unsupported runtime stops receiving security patches, so every advisory against it stays open permanently.`,
     goal:
-        `Establish what actually pins this runtime: the image's own base, the workspace's useNodeVersion, and each package's engines ` +
+        `Establish what actually pins this runtime: the image's own base, the workspace's nodeVersion, and each package's engines ` +
         `range. Propose the smallest move to a supported LTS, which of those pins have to change, in what order, and what is likely to ` +
         `break at that boundary. Make the pin changes that are mechanical; do NOT attempt the image rebuild itself.`,
     done: `Done when the pins name a supported release, the repository's type-check and tests pass on it, and anything needing a rebuild is named as such.`,
@@ -1205,6 +1269,7 @@ const BOOK: readonly Chore[] = [
     dependencies,
     deadCode,
     complexity,
+    testStrength,
     bundleWeight,
     frameworkIdiom,
     documentation,

package/src/chores/probes.test.ts

@@ -179,6 +179,71 @@ describe(`jscpd`, () => {
     });
 });
 
+/* The mutation report is the cross-tool "mutation testing report schema", and the whole risk in this parser is
+ * the arithmetic rather than the shape: two of the eight statuses land on the counter-intuitive side, and getting
+ * either one backwards produces a number that looks plausible and is wrong. So the statuses are tested by name. */
+describe(`mutation`, () => {
+    const report = (...mutants: readonly Record<string, unknown>[]) =>
+        JSON.stringify({
+            schemaVersion: `2.0`,
+            files: { "src/digest.ts": { language: `typescript`, source: `…`, mutants } },
+        });
+    const mutant = (status: string, line = 1) => ({
+        id: `${status}-${line}`,
+        mutatorName: `ConditionalExpression`,
+        replacement: `false`,
+        location: { start: { line, column: 1 }, end: { line, column: 9 } },
+        status,
+    });
+
+    test(`counts Killed and Timeout as caught, Survived and NoCoverage as missed`, () => {
+        // Stryker's own arithmetic, restated as a test because both halves read backwards at a glance: a mutant
+        // that HANGS the suite was noticed by it, and a mutant nothing ran cannot have been.
+        const facts = parse(`mutation`, report(mutant(`Killed`), mutant(`Timeout`), mutant(`Survived`), mutant(`NoCoverage`)));
+        expect(facts).toMatchObject({ id: `mutation`, mutation: { killed: 2, survived: 2, score: 50 } });
+    });
+
+    test(`leaves mutants that never got a verdict out of the score entirely`, () => {
+        // One caught, one missed, and three with no answer: the score is 50%, not 20% and not 80%. Folding the
+        // undecided into either column is the mistake this pins.
+        const facts = parse(`mutation`, report(mutant(`Killed`), mutant(`Survived`), mutant(`CompileError`), mutant(`RuntimeError`), mutant(`Ignored`)));
+        expect(facts).toMatchObject({ id: `mutation`, mutation: { killed: 1, survived: 1, inconclusive: 3, score: 50 } });
+    });
+
+    test(`names each survivor with the change that went unnoticed`, () => {
+        const facts = parse(`mutation`, report(mutant(`Survived`, 43)));
+        expect(facts).toMatchObject({
+            mutation: { survivors: [{ file: `src/digest.ts`, line: 43, mutator: `ConditionalExpression`, replacement: `false` }] },
+        });
+    });
+
+    // A mutator that DELETES an expression reports an empty replacement, which would otherwise render as a blank
+    // in the panel and read as a missing field rather than as the removal it is.
+    test(`renders a deleted expression as a removal rather than as nothing`, () => {
+        const facts = parse(`mutation`, report({ ...mutant(`Survived`), replacement: `` }));
+        expect(facts).toMatchObject({ mutation: { survivors: [{ replacement: `(removed)` }] } });
+    });
+
+    test(`a run with nothing to mutate is 100%, not a division by zero`, () => {
+        expect(parse(`mutation`, JSON.stringify({ schemaVersion: `2.0`, files: {} }))).toMatchObject({
+            mutation: { score: 100, killed: 0, survived: 0 },
+        });
+    });
+
+    // The distinction the runner depends on: an empty `files` map is a real measurement, a MISSING one is output
+    // this parser did not understand, and reporting the second as a clean 100% is the one answer it must never give.
+    test(`output without a files map is a failure, not a clean repository`, () => {
+        expect(parse(`mutation`, JSON.stringify({ schemaVersion: `2.0` }))).toBeUndefined();
+        expect(parse(`mutation`, ``)).toBeUndefined();
+        expect(parse(`mutation`, JSON.stringify({ files: [] }))).toBeUndefined();
+    });
+
+    test(`survives a malformed mutant without losing the rest of the file's numbers`, () => {
+        const facts = parse(`mutation`, report(mutant(`Killed`), { nonsense: true }, mutant(`Survived`)));
+        expect(facts).toMatchObject({ mutation: { killed: 1, survived: 1, inconclusive: 1 } });
+    });
+});
+
 /* The UI sweep is the one probe whose output we produce ourselves, which removes the "their JSON moved" failure
  * and replaces it with a worse one: a command of eleven piped ripgreps in which any single stage can silently
  * contribute nothing. The marker line is what tells those two apart, and most of what is below is about it. */

package/src/chores/probes.ts

@@ -1,4 +1,4 @@
-import type { Advisory, Bundle, DeadCode, Duplication, OutdatedPackage, ProbeFacts, ProbeId, UiScan } from "../schemas/maintenance.js";
+import type { Advisory, Bundle, DeadCode, Duplication, MutationScore, OutdatedPackage, ProbeFacts, ProbeId, UiScan } from "../schemas/maintenance.js";
 import type { IdiomRule } from "./stack.js";
 import {
     BYPASS_PATTERN,
@@ -227,6 +227,103 @@ const parseJscpd = (stdout: string): ProbeFacts | undefined => {
     return { id: `jscpd`, duplication };
 };
 
+/* WHAT THE SUITE WOULD NOTICE IF THE CODE BROKE, from Stryker's report.
+ *
+ * The report is the cross-tool "mutation testing report schema": `files` maps a path to `{ mutants: [{ mutatorName,
+ * replacement, location.start.line, status }] }`. Statuses are Killed, Survived, NoCoverage, Timeout, CompileError,
+ * RuntimeError, Ignored, Pending.
+ *
+ * THE ARITHMETIC IS STRYKER'S, NOT OURS, and that is a deliberate constraint rather than laziness. A timeout counts
+ * as DETECTED (a mutant that hangs the suite is one the suite noticed) and NoCoverage counts as UNDETECTED (nothing
+ * ran, so nothing could have caught it). Both are counter-intuitive enough to be worth restating here, and both are
+ * what the tool's own score means — a row that recomputed them differently would be quietly arguing with the
+ * evidence printed underneath it.
+ *
+ * `Pending` is treated as inconclusive rather than dropped: an interrupted incremental run leaves them, and
+ * counting them either way would move the score for a reason that has nothing to do with the tests. */
+const SURVIVOR_SAMPLE = 8;
+const DETECTED = new Set([`Killed`, `Timeout`]);
+const UNDETECTED = new Set([`Survived`, `NoCoverage`]);
+
+type Survivor = MutationScore["survivors"][number];
+
+// One file's mutant list, or nothing. Every shape this cannot recognise reads as "no mutants here" rather than
+// throwing: a report with one malformed entry is still worth the rest of its numbers.
+const mutantsOf = (raw: unknown): readonly Record<string, unknown>[] => {
+    if (typeof raw !== `object` || raw === null) {
+        return [];
+    }
+    const mutants = (raw as Record<string, unknown>)[`mutants`];
+    return Array.isArray(mutants) ? mutants.filter((entry): entry is Record<string, unknown> => typeof entry === `object` && entry !== null) : [];
+};
+
+const lineOf = (mutant: Record<string, unknown>): number => {
+    const location = mutant[`location`];
+    const start = typeof location === `object` && location !== null ? (location as Record<string, unknown>)[`start`] : undefined;
+    const line = typeof start === `object` && start !== null ? (start as Record<string, unknown>)[`line`] : undefined;
+    return typeof line === `number` ? line : 0;
+};
+
+const survivorOf = (file: string, mutant: Record<string, unknown>): Survivor => ({
+    file,
+    line: lineOf(mutant),
+    mutator: asString(mutant[`mutatorName`]) ?? `?`,
+    // An empty replacement is meaningful — the mutator deleted the expression — so it is rendered as the removal
+    // it is rather than left blank for a reader to puzzle over.
+    replacement: asString(mutant[`replacement`]) ?? `(removed)`,
+});
+
+interface Tally {
+    killed: number;
+    survived: number;
+    inconclusive: number;
+    readonly survivors: Survivor[];
+}
+
+const tallyMutants = (files: Record<string, unknown>): Tally => {
+    const tally: Tally = { killed: 0, survived: 0, inconclusive: 0, survivors: [] };
+    for (const [file, raw] of Object.entries(files)) {
+        for (const mutant of mutantsOf(raw)) {
+            const status = asString(mutant[`status`]) ?? ``;
+            if (DETECTED.has(status)) {
+                tally.killed++;
+                continue;
+            }
+            // Anything that is neither detected nor undetected never got a verdict — it would not compile, or the
+            // configuration ignored it. Counting it either way would move the score for a reason that has nothing
+            // to do with the tests.
+            if (!UNDETECTED.has(status)) {
+                tally.inconclusive++;
+                continue;
+            }
+            tally.survived++;
+            tally.survivors.push(survivorOf(file, mutant));
+        }
+    }
+    return tally;
+};
+
+const parseMutation = (stdout: string): ProbeFacts | undefined => {
+    const files = asObject(stdout)?.[`files`];
+    // No `files` key at all means this is not a mutation report. An EMPTY one is a real answer (nothing was
+    // mutated) and a missing one is a parse failure, and the runner has to be able to tell them apart.
+    if (typeof files !== `object` || files === null || Array.isArray(files)) {
+        return undefined;
+    }
+    const tally = tallyMutants(files as Record<string, unknown>);
+    const valid = tally.killed + tally.survived;
+    const mutation: MutationScore = {
+        // Nothing to mutate scores 100 rather than NaN: there is no undetected fault in it, which is the honest
+        // reading and the one that keeps the chore quiet instead of dividing by zero.
+        score: valid === 0 ? 100 : Math.round((tally.killed / valid) * 100),
+        killed: tally.killed,
+        survived: tally.survived,
+        inconclusive: tally.inconclusive,
+        survivors: tally.survivors.slice(0, SURVIVOR_SAMPLE),
+    };
+    return { id: `mutation`, mutation };
+};
+
 /* THE UI SWEEP. The only probe here whose command is COMPOSED rather than written out, because its subject is a
  * table (stack.ts) that will grow and a hand-written command would be a second copy of it going stale.
  *
@@ -370,6 +467,9 @@ const parseBundle = (stdout: string): ProbeFacts | undefined => {
 // immediately after, never something to keep, the cached ProbeResult is the artefact that survives. The same
 // path the scheduled form of this chore uses (chores.ts), so a workspace running both keeps one copy.
 const JSCPD_DIR = `/tmp/intentic-chore-jscpd`;
+// Where Stryker's json reporter writes, which is its own default and not configurable per run on the CLI. Read
+// from the repo directory the probe runs in, like jscpd's report above.
+const MUTATION_REPORT = `reports/mutation/mutation.json`;
 
 export const PROBES: readonly ProbeSpec[] = [
     {
@@ -430,6 +530,38 @@ export const PROBES: readonly ProbeSpec[] = [
             `cat ${JSCPD_DIR}/jscpd-report.json 2>/dev/null`,
         parse: parseJscpd,
     },
+    {
+        id: `mutation`,
+        title: `Test strength`,
+        measures: `how much of the code could break with every test still green`,
+        /* THE MOST EXPENSIVE PROBE HERE, and the tier does not really capture it: this runs the suite once per
+         * injected fault. `--incremental` is what makes it liveable — Stryker keeps a result file and re-runs only
+         * the mutants whose code or tests changed, so the first run costs what a full run costs and every one
+         * after it costs the diff. The monthly TTL is set against the FIRST run, not the incremental ones.
+         *
+         * Opt-in per repository, by the presence of a `stryker.conf.json`, and that is the load-bearing part of
+         * the design rather than a convenience. This monorepo has 65 packages with their own vitest configs and no
+         * root suite; mutating all of them unasked would be hours of CPU nobody agreed to spend. A repo says which
+         * code is worth the measurement by writing that file, which is also where `mutate` narrows the scope. */
+        tier: 2,
+        ttlMs: 30 * DAY_MS,
+        timeoutMs: 90 * 60_000,
+        /* Two conditions, and the config is the one that matters: Stryker being installed says the tool COULD run,
+         * the config says somebody decided it should. Without the second this would report "unavailable" on every
+         * repo that merely shares this monorepo's lockfile.
+         *
+         * The repo's OWN Stryker, never a floating one, for a reason measured rather than assumed: under
+         * `pnpm dlx` the plugin loader resolves from the working directory and finds nothing — "Cannot find
+         * TestRunner plugin \"vitest\". In fact, no TestRunner plugins were loaded" — and the runner has to agree
+         * with the vitest the repo actually runs. Same argument as knip above. */
+        available: `{ test -f stryker.conf.mjs || test -f stryker.conf.json; } && pnpm exec stryker --version >/dev/null 2>&1`,
+        unavailable: `no stryker config in this repo`,
+        // `|| true` for the same reason the others carry it: Stryker exits non-zero when the score is under its
+        // own threshold, which is an opinion about the number, not a failure to produce one. The judgement is the
+        // chore's, made from the score, and the runner decides by whether the parser recognised the report.
+        command: `pnpm exec stryker run --reporters json --incremental >/dev/null 2>&1 || true; cat ${MUTATION_REPORT} 2>/dev/null`,
+        parse: parseMutation,
+    },
     {
         id: `ui`,
         title: `Front-end source`,