@junghanacs/entwurf 0.22.0 → 0.23.1

package/scripts/mutants/herdr-plugin-build.json

@@ -0,0 +1,160 @@
+{
+	"schemaVersion": 1,
+	"lane": "herdr-plugin-build",
+	"mutants": [
+		{
+			"claim": "HPB-MANIFEST-ONE-RUNNER",
+			"title": "handing the build to a shell instead of one argv reintroduces a quoting surface this plugin does not need, and a manifest that can grow a second command is a build order nobody reviewed",
+			"subject": "plugins/herdr/herdr-plugin.toml",
+			"find": ["command = [\"node\", \"lib/build.mjs\"]"],
+			"replace": ["command = [\"bash\", \"-c\", \"node lib/build.mjs\"]"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-MANIFEST-ONE-RUNNER]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-BINARY-REQUIRED",
+			"title": "collapsing 'there is no herdr here' into 'herdr could not answer' loses the distinction an operator acts on, and both must stay refusals rather than an invented empty listing that reads as 'nothing is integrated'",
+			"subject": "plugins/herdr/lib/build.mjs",
+			"find": ["\t\t\t\"herdr-build-binary-missing\","],
+			"replace": ["\t\t\t\"herdr-build-status-unavailable\","],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-BINARY-REQUIRED]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-SELECTED-FAIL-BEFORE-BOOTSTRAP",
+			"title": "proceeding past a selected atom herdr calls outdated or needs-repair installs a runtime for a harness whose integration cannot run it — and `outdated (legacy < vN)` is the measured catch-all for empty and unreadable integration files",
+			"subject": "plugins/herdr/lib/build.mjs",
+			"find": ["\tif (profile.fail.length > 0) {"],
+			"replace": ["\tif (false && profile.fail.length > 0) {"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-SELECTED-FAIL-BEFORE-BOOTSTRAP]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-EMPTY-A-ZERO-WRITE",
+			"title": "installing a runtime on a host where nothing is integrated writes megabytes for nobody and leaves this plugin's state on a machine that asked for none of it",
+			"subject": "plugins/herdr/lib/build.mjs",
+			"find": ["\tif (profile.activate.length === 0) {"],
+			"replace": ["\tif (false && profile.activate.length === 0) {"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-EMPTY-A-ZERO-WRITE]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-INSTALLED-ENTRY-ONLY",
+			"title": "skipping the capability probe lets a file that exits 0 on an empty request stand in for the activation verb — the shape that already bit this package once, when a main-module guard made every call a silent success",
+			"subject": "plugins/herdr/lib/build.mjs",
+			"find": ["\tcertifyActivationCapability(entry, env, { spawn, nodeBin });"],
+			"replace": ["\tvoid certifyActivationCapability;"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-INSTALLED-ENTRY-ONLY]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-SEQUENTIAL-TWO-STAGE",
+			"title": "handing down only the first backend of A leaves the widened set half-activated on exactly the reinstall Herdr's refresh trigger is built on — the operator installs Claude Code, reinstalls the plugin, and nothing points at it",
+			"subject": "plugins/herdr/lib/build.mjs",
+			"find": ["\tconst activated = spawn(nodeBin, [entry, ...profile.activate], {"],
+			"replace": ["\tconst activated = spawn(nodeBin, [entry, profile.activate[0]], {"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-SEQUENTIAL-TWO-STAGE]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-POST-BUILD-GAP",
+			"title": "claiming Herdr's registration in this runner's own receipt states a step that has not run: herdr commits its checkout and registry only AFTER the build returns, so the next reconcile would be arguing with a lie",
+			"subject": "plugins/herdr/lib/build.mjs",
+			"find": ["\t\t`[herdr-plugin-build] activated ${profile.activate.join(\",\")} through the INSTALLED package` +"],
+			"replace": [
+				"\t\t`[herdr-plugin-build] activated ${profile.activate.join(\",\")} and registered with the herdr registry` +"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-POST-BUILD-GAP]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-PRE-BOOTSTRAP-AUTHORITY",
+			"title": "asking the activation authority AFTER the bootstrap is the state the first cut actually produced: the stable root already holds the new artifact, the ledger still names the old one, the run reports failure — and the harness wiring, which names the root and not the version, resolves to bytes no record accounts for",
+			"subject": "plugins/herdr/lib/build.mjs",
+			"find": ["\tconst disposition = certifyArtifactForForward(ledger, requested, requestedBackends);"],
+			"replace": ["\tconst disposition = ledger === null ? \"fresh\" : \"match\";"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-PRE-BOOTSTRAP-AUTHORITY]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-BOOTSTRAP-IDENTITY-EXACT",
+			"title": "skipping the post-bootstrap identity comparison hands the installed activation verb a different artifact than the one this build was admitted for, so it re-judges and passes or fails on a question nobody asked",
+			"subject": "plugins/herdr/lib/build.mjs",
+			"find": ["\tif (!sameArtifactRequest(result.journal.artifactIdentity, plan.requested)) {"],
+			"replace": ["\tif (false && !sameArtifactRequest(result.journal.artifactIdentity, plan.requested)) {"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-BOOTSTRAP-IDENTITY-EXACT]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-PROGRESS-NAMED-SEQUENCE",
+			"title": "narrating the acquisition without saying what it is reaching for or that silence is expected leaves the operator in front of a terminal that says nothing for minutes while `npm pack` runs — herdr discards this process's streams on success, so a bland step is the same as no step on the one phase that legitimately takes the longest and reads exactly like a hang",
+			"subject": "plugins/herdr/lib/build.mjs",
+			"find": [
+				"\tprogress.step(",
+				"\t\t`fetching and installing the Entwurf runtime from ${describeRequest(plan.requested)} — this is the long step ` +",
+				"\t\t\t\"(npm acquires the locked artifact; expect minutes of silence)\",",
+				"\t);"
+			],
+			"replace": ["\tprogress.step(\"working\");"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-PROGRESS-NAMED-SEQUENCE]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-PROGRESS-TTY-OPTIONAL",
+			"title": "mirroring only when a terminal was opened throws the failure trail away on exactly the hosts that cannot watch it happen — CI and any piped run then report the error with nothing in front of it, and the stderr herdr prints on failure is the only place those steps could still have been read",
+			"subject": "plugins/herdr/lib/build-progress.mjs",
+			"find": ["\t\t}", "\t\tmirror(line);", "\t};"],
+			"replace": ["\t\t\tmirror(line);", "\t\t}", "\t};"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-PROGRESS-TTY-OPTIONAL]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-USAGE-NOTE-NAMES-A-MODEL",
+			"title": "the install names a model id in the wrong harness's grammar, so the first fresh call an operator copies is refused",
+			"subject": "plugins/herdr/lib/build.mjs",
+			"find": [
+				"\t\tnotes.push(\"claude-code: a model id looks like `claude-sonnet-5` — the vendor id, not a provider path.\");"
+			],
+			"replace": [
+				"\t\tnotes.push(\"claude-code: a model id looks like `anthropic/claude-sonnet-5` — provider-qualified.\");"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPB-USAGE-NOTE-NAMES-A-MODEL]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-INSTALL-USAGE-NOTE",
+			"title": "dropping the pi line leaves the one backend whose wiring is invisible from the operator's chair unexplained: claude-code picks the tools up through MCP with nothing added, while a plain pi loads the extension on every session of the host and is still not a citizen — a green install followed by a silent, tool-less pi is indistinguishable from an install that did nothing",
+			"subject": "plugins/herdr/lib/build.mjs",
+			"find": ["\tif (activated.includes(\"pi\")) {"],
+			"replace": ["\tif (false && activated.includes(\"pi\")) {"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-INSTALL-USAGE-NOTE]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		}
+	]
+}

package/scripts/mutants/herdr-plugin-profile.json

@@ -0,0 +1,202 @@
+{
+	"schemaVersion": 1,
+	"lane": "herdr-plugin-profile",
+	"mutants": [
+		{
+			"claim": "HIP-CLOSED-MAP",
+			"title": "widening the table by one atom is how an unsupported backend becomes supported without a decision: OpenCode is installed and `current` on real hosts, GLG froze P at {pi, claude-code} (#116 issuecomment-5690300559), and the plugin that admits it writes Entwurf state into a harness this lane never agreed to own",
+			"subject": "plugins/herdr/lib/integration-profile.mjs",
+			"find": ["export const SELECTED_ATOMS = Object.freeze({ pi: \"pi\", claude: \"claude-code\" });"],
+			"replace": [
+				"export const SELECTED_ATOMS = Object.freeze({ pi: \"pi\", claude: \"claude-code\", opencode: \"opencode\" });"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-profile"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HIP-CLOSED-MAP]",
+			"signatureSource": "scripts/check-herdr-plugin-profile.ts"
+		},
+		{
+			"claim": "HIP-ROW-MISSING-REFUSED",
+			"title": "an absent selected row that is not refused by name leaves the caller holding whatever the next line of code makes of `declared[0]` — an unnamed crash, or worse a default, for a question herdr never answered (#116 M3-a)",
+			"subject": "plugins/herdr/lib/integration-profile.mjs",
+			"find": ["\tif (declared.length === 0) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-profile"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HIP-ROW-MISSING-REFUSED]",
+			"signatureSource": "scripts/check-herdr-plugin-profile.ts"
+		},
+		{
+			"claim": "HIP-ROW-DUPLICATE-REFUSED",
+			"title": "taking the first match when a selected atom has two rows resolves a contradiction into a guess — the listing that says both `current` and `not installed` for pi is not a listing we understand, and the quiet winner decides whether an integration gets installed over (#116 M3-a)",
+			"subject": "plugins/herdr/lib/integration-profile.mjs",
+			"find": ["\tif (declared.length > 1) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-profile"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HIP-ROW-DUPLICATE-REFUSED]",
+			"signatureSource": "scripts/check-herdr-plugin-profile.ts"
+		},
+		{
+			"claim": "HIP-SELECTED-DELIMITER-FRAMED",
+			"title": "claiming a line only at `<atom>: ` lets a broken declaration by the SAME atom pass as unrelated text: `pi:current (v1) …` sitting beside a valid `pi: ` row contradicts it and changes nothing, and standing alone it reads as a missing row rather than the malformed one it is (#116 M3-a cross-review defect 3)",
+			"subject": "plugins/herdr/lib/integration-profile.mjs",
+			"find": ["\tconst declared = lines.filter((line) => line.startsWith(`${atom}:`));"],
+			"replace": ["\tconst declared = lines.filter((line) => line.startsWith(prefix));"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-profile"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HIP-SELECTED-DELIMITER-FRAMED]",
+			"signatureSource": "scripts/check-herdr-plugin-profile.ts"
+		},
+		{
+			"claim": "HIP-ROW-MALFORMED-REFUSED",
+			"title": "defaulting an unreadable state to `not installed` turns a phrase nobody has interpreted into a clean zero-write SKIP — the next state herdr ships would be walked past and reported as success (#116 M3-a)",
+			"subject": "plugins/herdr/lib/integration-profile.mjs",
+			"find": [
+				"\tthrow new IntegrationProfileError(",
+				"\t\t\"herdr-status-row-malformed\",",
+				"\t\t`unreadable \\`${prefix}\\` row: ${JSON.stringify(remainder)}`,",
+				"\t);"
+			],
+			"replace": [
+				"\treturn Object.freeze({ atom, backend: SELECTED_ATOMS[atom], state: \"not-installed\", installedVersion: null, floorVersion: null });"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-profile"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HIP-ROW-MALFORMED-REFUSED]",
+			"signatureSource": "scripts/check-herdr-plugin-profile.ts"
+		},
+		{
+			"claim": "HIP-SUFFIX-FRAMING",
+			"title": "reading only the head of a row and trusting the rest is the hole cross-review found (Terra, reproduced by the coordinator 2026-09-16): `current (v8)` with no suffix, with a relative path, with the closing paren missing, with `()`, and with trailing bytes after the `)` ALL activated — a row nobody finished reading decided that a harness was installed (#116 M3-a blocker 1)",
+			"subject": "plugins/herdr/lib/integration-profile.mjs",
+			"find": [
+				"\t{ state: \"current\", re: /^current \\(v(\\d+)\\) \\(\\/.*\\)$/, installed: (m) => Number(m[1]), floor: () => null },"
+			],
+			"replace": [
+				"\t{ state: \"current\", re: /^current \\(v(\\d+)\\)(?: \\(|$)/, installed: (m) => Number(m[1]), floor: () => null },"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-profile"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HIP-SUFFIX-FRAMING]",
+			"signatureSource": "scripts/check-herdr-plugin-profile.ts"
+		},
+		{
+			"claim": "HIP-VERSION-U32",
+			"title": "herdr's integration version is a Rust u32, so a 400-digit capture becomes Infinity and serialises to null: the plan would carry 'no version' for a row that loudly stated one, and every downstream comparison against it is then made against a value the listing never contained (#116 M3-a observation 4)",
+			"subject": "plugins/herdr/lib/integration-profile.mjs",
+			"find": ["\t\tif (m.slice(1).some((captured) => !isU32(captured))) break;"],
+			"replace": ["\t\tif (false) break;"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-profile"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HIP-VERSION-U32]",
+			"signatureSource": "scripts/check-herdr-plugin-profile.ts"
+		},
+		{
+			"claim": "HIP-STATE-FRONT-ANCHORED",
+			"title": "dropping the `^` anchor lets the operator's own directory name answer the question: with an unanchored pattern `pi: outdated (legacy < v8) (/srv/current (v9) (/x)/…)` reads as CURRENT, so a broken integration is activated because someone named a folder `current (v9)` (#116 M3-a)",
+			"subject": "plugins/herdr/lib/integration-profile.mjs",
+			"find": [
+				"\t{ state: \"current\", re: /^current \\(v(\\d+)\\) \\(\\/.*\\)$/, installed: (m) => Number(m[1]), floor: () => null },"
+			],
+			"replace": [
+				"\t{ state: \"current\", re: /current \\(v(\\d+)\\) \\(\\/.*\\)$/, installed: (m) => Number(m[1]), floor: () => null },"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-profile"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HIP-STATE-FRONT-ANCHORED]",
+			"signatureSource": "scripts/check-herdr-plugin-profile.ts"
+		},
+		{
+			"claim": "HIP-PATH-IS-NOT-AUTHORITY",
+			"title": "recovering the display path into the plan puts an address in the one module that must not carry one — the same bytes read `current` or `not installed` depending only on PI_CODING_AGENT_DIR (measured 2026-09-16), so a path resolved HERE and a path installed against THERE are two answers nobody reconciles (#116 M3-a)",
+			"subject": "plugins/herdr/lib/integration-profile.mjs",
+			"find": [
+				"\t\treturn Object.freeze({",
+				"\t\t\tatom,",
+				"\t\t\tbackend: SELECTED_ATOMS[atom],",
+				"\t\t\tstate: entry.state,",
+				"\t\t\tinstalledVersion: entry.installed(m),",
+				"\t\t\tfloorVersion: entry.floor(m),",
+				"\t\t});"
+			],
+			"replace": [
+				"\t\treturn Object.freeze({",
+				"\t\t\tatom,",
+				"\t\t\tbackend: SELECTED_ATOMS[atom],",
+				"\t\t\tstate: entry.state,",
+				"\t\t\tinstalledVersion: entry.installed(m),",
+				"\t\t\tfloorVersion: entry.floor(m),",
+				"\t\t\tdisplayPath: /\\(([^)]*)\\)\\s*$/.exec(row)?.[1] ?? null,",
+				"\t\t});"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-profile"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HIP-PATH-IS-NOT-AUTHORITY]",
+			"signatureSource": "scripts/check-herdr-plugin-profile.ts"
+		},
+		{
+			"claim": "HIP-OUTDATED-IS-FAIL",
+			"title": "classifying `outdated` as a skip hides the exact case the M3 contract exists to stop: measured, an empty file, a chmod-000 file and a marker-less hand-written file ALL print `outdated (legacy < vN)`, so a skip there walks past a broken integration and reports a clean run (#116 issuecomment-5689767140)",
+			"subject": "plugins/herdr/lib/integration-profile.mjs",
+			"find": ["\toutdated: \"fail\","],
+			"replace": ["\toutdated: \"skip\","],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-profile"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HIP-OUTDATED-IS-FAIL]",
+			"signatureSource": "scripts/check-herdr-plugin-profile.ts"
+		},
+		{
+			"claim": "HIP-ABSENT-IS-SKIP-ZERO-WRITE",
+			"title": "turning `not installed` into a failure makes every host that simply has not added that Herdr integration look broken, and a red is the pressure that invites the plugin to go install the harness it must never install (AGENTS.md Hard Rule 17, #116 M3-a)",
+			"subject": "plugins/herdr/lib/integration-profile.mjs",
+			"find": ["\t\"not-installed\": \"skip\","],
+			"replace": ["\t\"not-installed\": \"fail\","],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-profile"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HIP-ABSENT-IS-SKIP-ZERO-WRITE]",
+			"signatureSource": "scripts/check-herdr-plugin-profile.ts"
+		},
+		{
+			"claim": "HIP-CURRENT-IS-ADMISSION-ONLY",
+			"title": "inventing a second version floor rejects hosts herdr already admitted while proving nothing about the bytes — `current` is one marker line (measured: bytes appended after it still read current, and v999 reads current), so a floor here is a check that looks like integrity and is not (#116 M3-a)",
+			"subject": "plugins/herdr/lib/integration-profile.mjs",
+			"find": ["\t\tconst verdict = VERDICT[fact.state];"],
+			"replace": [
+				"\t\tconst verdict = fact.state === \"current\" && (fact.installedVersion ?? 0) < 8 ? \"fail\" : VERDICT[fact.state];"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-profile"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HIP-CURRENT-IS-ADMISSION-ONLY]",
+			"signatureSource": "scripts/check-herdr-plugin-profile.ts"
+		},
+		{
+			"claim": "HIP-UNSELECTED-NEVER-ACTIVATES",
+			"title": "building the plan from whatever atoms the listing happens to contain makes set P the listing instead of our decision: OpenCode enters the plan, and one unreadable row for an atom nobody supports refuses the whole listing and blocks Pi and Claude Code with it (#116 issuecomment-5690300559)",
+			"subject": "plugins/herdr/lib/integration-profile.mjs",
+			"find": ["\tconst selected = Object.keys(SELECTED_ATOMS).map((atom) => readSelectedRow(lines, atom));"],
+			"replace": [
+				"\tconst selected = observeOtherAtoms(lines)\n\t\t.concat(Object.keys(SELECTED_ATOMS))\n\t\t.map((atom) => readSelectedRow(lines, atom));"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-profile"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HIP-UNSELECTED-NEVER-ACTIVATES]",
+			"signatureSource": "scripts/check-herdr-plugin-profile.ts"
+		},
+		{
+			"claim": "HIP-PURE-LEAF",
+			"title": "one import is all it takes for the plan to stop being a property of the listing — a leaf that can reach the filesystem or the environment can disagree with the bootstrap that acts on its answer about which host they are both standing on, and that disagreement is unobservable from the plan (#116 M3-a)",
+			"subject": "plugins/herdr/lib/integration-profile.mjs",
+			"find": ["export const SELECTED_ATOMS = Object.freeze({ pi: \"pi\", claude: \"claude-code\" });"],
+			"replace": [
+				"import fs from \"node:fs\";",
+				"",
+				"export const SELECTED_ATOMS = Object.freeze({ pi: \"pi\", claude: \"claude-code\" });"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-profile"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HIP-PURE-LEAF]",
+			"signatureSource": "scripts/check-herdr-plugin-profile.ts"
+		}
+	]
+}

package/scripts/mutants/herdr-plugin.json

@@ -0,0 +1,133 @@
+{
+	"schemaVersion": 1,
+	"lane": "herdr-plugin",
+	"mutants": [
+		{
+			"claim": "HPL-ONE-OPEN-ONE-READ",
+			"title": "re-reading either listing turns one answered question into a poll — peer-facts observes every citizen unbounded (measured 4.1s on a 1,150-record store) and herdr publishes no 'the session reference landed' event, so a second read is both the slow path and the discovery watcher docs/mux-launch-rail.md §7 refuses by name (#116 M2-b)",
+			"subject": "plugins/herdr/lib/status.mjs",
+			"find": ["\t\t\tconst agents = readJson(herdrBin, [\"agent\", \"list\"], {"],
+			"replace": [
+				"\t\t\treadJson(herdrBin, [\"agent\", \"list\"], { failed: \"x\", unparsable: \"y\" });\n\t\t\tconst agents = readJson(herdrBin, [\"agent\", \"list\"], {"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-ONE-OPEN-ONE-READ]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-SKIP-NOT-FAILURE",
+			"title": "turning a missing Entwurf into a red makes every host that simply has not installed it look broken, and invites the plugin to 'fix' it — installing Entwurf is not a plugin's business (AGENTS.md Hard Rule 17, #116 M2-b)",
+			"subject": "plugins/herdr/lib/status.mjs",
+			"find": ["\tfinish([\"entwurf-not-found\"], OK);"],
+			"replace": ["\tfinish([\"entwurf-not-found\"], RED);"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-SKIP-NOT-FAILURE]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-FAILED-READ-IS-RED",
+			"title": "treating a nonzero listing exit as success renders an empty table for a listing that was never read — a host whose store could not be opened becomes indistinguishable from a host with no citizens (#116 M2-b)",
+			"subject": "plugins/herdr/lib/status.mjs",
+			"find": [
+				"\tif (run.status !== 0) return { error: names.failed, detail: `exit ${run.status}: ${(run.stderr ?? \"\").trim()}` };"
+			],
+			"replace": ["\tif (false) return { error: names.failed, detail: `exit ${run.status}` };"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-FAILED-READ-IS-RED]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-AMBIGUOUS-NOT-GUESSED",
+			"title": "resolving two agent rows on one pane to whichever came first is a guess wearing a value's clothes — the only worth of this column is that it never guesses (#116 M2-b)",
+			"subject": "plugins/herdr/lib/status.mjs",
+			"find": ["\t\tbyPane.set(paneId, byPane.has(paneId) ? \"ambiguous\" : status);"],
+			"replace": ["\t\tif (!byPane.has(paneId)) byPane.set(paneId, status);"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-AMBIGUOUS-NOT-GUESSED]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-ACTIVITY-IS-SEPARATE",
+			"title": "labelling herdr's agent_status as anything but herdr's own report starts the drift that ends with a screen judgement being read as Entwurf delivery liveness (docs/herdr-launch-rail.md §9, #116 M2-b)",
+			"subject": "plugins/herdr/lib/status.mjs",
+			"find": ["\tconst head = [\"garden id\", \"backend\", \"cwd\", \"placement\", \"herdr-reported activity\"];"],
+			"replace": ["\tconst head = [\"garden id\", \"backend\", \"cwd\", \"placement\", \"liveness\"];"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-ACTIVITY-IS-SEPARATE]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-DIAGNOSTICS-SHOWN",
+			"title": "dropping the provider's diagnostics shows a store carrying hazards as a clean listing — the one lie a status pane can tell while looking green (#116 M2-b)",
+			"subject": "plugins/herdr/lib/status.mjs",
+			"find": ["\t\t\t\t\t\t...renderDiagnostics(diagnostics),"],
+			"replace": ["\t\t\t\t\t\t...renderDiagnostics([]),"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-DIAGNOSTICS-SHOWN]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-JOIN-PANE-ID-ONLY",
+			"title": "joining on a native session id forks the vendor floor Entwurf owns in pi-extensions/lib/herdr-placement.ts into a file no gate and no document covers — the whole join a plugin may make is one opaque pane-id string equality (#116 M2-b)",
+			"subject": "plugins/herdr/lib/status.mjs",
+			"find": ["\t\tconst paneId = kind === \"herdr-pane\" ? placement.paneId : null;"],
+			"replace": ["\t\tconst paneId = typeof peer?.nativeSessionId === \"string\" ? peer.nativeSessionId : null;"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-JOIN-PANE-ID-ONLY]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-NO-WRITE",
+			"title": "keeping state in HERDR_PLUGIN_STATE_DIR gives a status pane something that can be stale — this one is only ever as old as the keypress that opened it, and that is the whole guarantee (#116 M2-b)",
+			"subject": "plugins/herdr/lib/status.mjs",
+			"find": ["\tholdOpen().then(() => process.exit(code));"],
+			"replace": [
+				"\tif (process.env.HERDR_PLUGIN_STATE_DIR) fs.writeFileSync(path.join(process.env.HERDR_PLUGIN_STATE_DIR, \"last.json\"), lines.join(\"\\n\"));\n\tholdOpen().then(() => process.exit(code));"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-NO-WRITE]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-MANIFEST-NO-FORBIDDEN-SECTIONS",
+			"title": "[[build]] became this plugin's ONE door in #116 M3-b3 and left the forbidden list, so the defect this claim must still catch is the volunteering kind: a [[startup]] hook runs on every herdr server start, in the operator's real HOME, without anyone asking — which is exactly the watcher-shaped growth this lane refuses (#116 M2-b, M3-b3)",
+			"subject": "plugins/herdr/herdr-plugin.toml",
+			"find": ["[[panes]]"],
+			"replace": ["[[startup]]\ncommand = [\"node\", \"lib/status.mjs\"]\n\n[[panes]]"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-MANIFEST-NO-FORBIDDEN-SECTIONS]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-RENDER-IS-THE-VISIBLE-ONES",
+			"title": "drawing every retained citizen turns the status pane into the whole store — measured 2026-09-15 the operator's own store is 1,162 records, all unobserved, 17,437 lines of peer-facts output, so finding the two citizens actually in this Herdr session becomes a scrolling exercise and a status surface you must search has already failed (#116 M2-b)",
+			"subject": "plugins/herdr/lib/status.mjs",
+			"find": ["\t\tif (kind !== \"herdr-pane\" && kind !== \"ambiguous\") {"],
+			"replace": ["\t\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-RENDER-IS-THE-VISIBLE-ONES]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-DIAGNOSTIC-SUBJECTS",
+			"title": "printing a diagnostic's kind and prose without its subject tells an operator that a hazard exists and not where — `record-less-socket` without its garden id and `meta-record-read-error` without its filename are lines nobody can act on (#116 M2-b)",
+			"subject": "plugins/herdr/lib/status.mjs",
+			"find": ["\t\t\tconst fields = Object.keys(d ?? {})"],
+			"replace": ["\t\t\tconst fields = [] || Object.keys(d ?? {})"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-DIAGNOSTIC-SUBJECTS]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		}
+	]
+}