@plainconceptsplatform/workflows 1.16.1 → 1.17.0

package/dist/workflow-catalog.d.ts

@@ -19,7 +19,7 @@ export interface MandatoryFile {
 }
 export declare const mandatoryFiles: readonly MandatoryFile[];
 export declare const generatedConsumerTargets: readonly [".github/workflows/agent-*.lock.yml", ".github/aw/actions-lock.json"];
-export declare const templateNames: readonly ["agentics-app-errors", "agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "bug-report", "dependabot-merge", "feature-request", "github-release", "opencode.ci.json", "platform-template", "quality-gates"];
+export declare const templateNames: readonly ["agentics-app-errors", "agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "bug-report", "dependabot-merge", "feature-request", "github-release", "opencode.ci.json", "platform-template", "quality-gates", "quality-mutation"];
 export type TemplateName = (typeof templateNames)[number];
 export interface CatalogTemplate {
     readonly name: TemplateName;

package/dist/workflow-catalog.js

@@ -62,6 +62,7 @@ export const templateNames = [
     "opencode.ci.json",
     "platform-template",
     "quality-gates",
+    "quality-mutation",
 ];
 export const catalogTemplates = [
     { name: "agentics-app-errors", file: "agentics-app-errors.yml", description: "Daily application error report: asks Application Insights what the deployed app threw, groups it, and files one issue per distinct problem HERE, labelled bug + refine so the belt picks it up. Deterministic, no model; the report never leaves this repository, and a leak scanner withholds anything carrying an identifier." },
@@ -76,6 +77,7 @@ export const catalogTemplates = [
     { name: "opencode.ci.json", file: "opencode.ci.json", description: "Standalone OpenCode CI config: plainconcepts provider, GLM model registration, ci-workflow-agent, and LSP defaults for consumer repositories." },
     { name: "platform-template", file: "scripts/check-platform-conformance.mjs", directory: "platform-template", bundle: true, description: "Template sync driven by the platform contract (.platform/contract.yml): a weekly workflow that runs its sync.update command and opens or updates one pull request, and a CI guard that keeps its owned paths equal to the template outside a sync. Does nothing without a contract." },
     { name: "quality-gates", file: "scripts/check-coverage.mjs", directory: "quality-gates", bundle: true, description: "Platform family quality gates: coverage, complexity, duplication and mutation gates, the Engineering Excellence facets, the Semgrep hygiene rules, jscpd and ZAP triage. Floors come from the app's quality.config.json; baselines stay app files." },
+    { name: "quality-mutation", file: "quality-mutation.yml", directory: "ci", description: "Weekly out-of-band mutation testing, the Atlas shape: one Stryker.NET job per .NET scope and one StrykerJS web job, each gated on its covered-code floor from quality.config.json, folded into the engineering-excellence-mutation facet. Never on pull requests; App: CI keeps the coverage floor as the per-change gate. Needs the quality-gates template." },
 ];
 /** Bundle templates: several package-managed files, refreshed by `update` where installed. */
 export const bundleTemplateNames = catalogTemplates

package/loops/templates/ci/app-ci-dotnet-next.yml

@@ -11,6 +11,10 @@
 # every push and through its own weekly schedule. The platform-conformance job runs the
 # platform-template guard where the app declares a platform contract.
 #
+# No mutation testing here, on purpose: a pull request's quality gate is the coverage floor, and
+# Stryker over even one changed page took longer than the rest of CI together. Mutation runs out of
+# band, weekly, in `Quality: Mutation testing (scheduled)` (`workflows add --template quality-mutation`).
+#
 # Everything that differs between apps is a top-level `env:` value below or a floor in
 # quality.config.json. Job names are required status checks on main: do not rename them.
 name: "App: CI"
@@ -279,51 +283,6 @@ jobs:
           if-no-files-found: ignore
           retention-days: 7
 
-  mutation-api:
-    name: Mutation (.NET, diff)
-    if: ${{ (github.event_name == 'pull_request') && needs.depth.outputs.full == 'true' }}
-    needs: [depth]
-    runs-on: ${{ vars.CI_RUNNER || 'agents-arc' }}
-    timeout-minutes: 25
-    defaults:
-      run:
-        working-directory: ${{ env.API_WORKING_DIRECTORY }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          # Stryker --since diffs against the PR base; it needs history, not a shallow tip.
-          fetch-depth: 0
-      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
-        with:
-          dotnet-version: ${{ env.DOTNET_VERSION }}
-        env:
-          DOTNET_INSTALL_DIR: ${{ runner.tool_cache }}/dotnet
-      - name: Detect backend changes
-        id: scope
-        working-directory: ${{ github.workspace }}
-        run: |
-          git fetch origin "$GITHUB_BASE_REF" --depth=1
-          if git diff --name-only "origin/$GITHUB_BASE_REF" HEAD | grep -qE "^${API_WORKING_DIRECTORY}/"; then
-            echo "run=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "run=false" >> "$GITHUB_OUTPUT"
-            echo "No ${API_WORKING_DIRECTORY} changes in this PR; skipping .NET mutation."
-          fi
-      - name: Restore tools and build
-        if: steps.scope.outputs.run == 'true'
-        run: |
-          dotnet tool restore
-          dotnet build "$DOTNET_SOLUTION" -c Release
-      # The project, test projects and thresholds come from the app's stryker-config.json.
-      - name: Stryker.NET (changed files only)
-        if: steps.scope.outputs.run == 'true'
-        run: |
-          export PATH="$PATH:$HOME/.dotnet/tools"
-          dotnet stryker \
-            --since:"origin/$GITHUB_BASE_REF" \
-            --concurrency 2 \
-            --reporter progress --reporter json
-
   web:
     name: Web (Next.js static export)
     needs: [depth, scope]
@@ -582,65 +541,6 @@ jobs:
             node scripts/check-platform-conformance.mjs --compare | tee -a "$GITHUB_STEP_SUMMARY"
           fi
 
-  mutation-web:
-    name: Mutation (web, diff)
-    if: ${{ (github.event_name == 'pull_request') && needs.depth.outputs.full == 'true' }}
-    needs: [depth]
-    runs-on: ${{ vars.CI_RUNNER || 'agents-arc' }}
-    timeout-minutes: 60
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-      - name: Detect web changes
-        id: scope
-        run: |
-          git fetch origin "$GITHUB_BASE_REF" --depth=1
-          if git diff --name-only "origin/$GITHUB_BASE_REF" HEAD | grep -qE "^apps/web/"; then
-            echo "run=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "run=false" >> "$GITHUB_OUTPUT"
-            echo "No apps/web changes in this PR; skipping web mutation."
-          fi
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        if: steps.scope.outputs.run == 'true'
-        with:
-          run_install: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        if: steps.scope.outputs.run == 'true'
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
-      - name: Configure optional private registry authentication
-        if: steps.scope.outputs.run == 'true'
-        env:
-          NPM_REGISTRY_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}
-        run: |
-          if [ -n "$NPM_REGISTRY_TOKEN" ]; then
-            echo "${NPM_REGISTRY_URL}:_authToken=$NPM_REGISTRY_TOKEN" >> .npmrc
-          fi
-      - name: Install and run StrykerJS (changed files only)
-        if: steps.scope.outputs.run == 'true'
-        run: |
-          pnpm install --frozen-lockfile
-          # StrykerJS v9 removed --since. Compute changed TS/TSX files and pass them to --mutate.
-          # The config already excludes test files; we only need to scope to changed source files.
-          changed_files=$(git diff --name-only "origin/$GITHUB_BASE_REF" HEAD -- 'apps/web/src/**/*.ts' 'apps/web/src/**/*.tsx' \
-            | sed 's|^apps/web/||' \
-            | grep -v '\.test\.' \
-            | grep -v '\.spec\.' \
-            | grep -v '/__mocks__/' \
-            | paste -sd, -)
-          if [ -z "$changed_files" ]; then
-            echo "No changed web source files to mutate; skipping."
-            exit 0
-          fi
-          echo "Mutating: $changed_files"
-          # StrykerJS v9 child worker cannot auto-discover @stryker-mutator/vitest-runner
-          # under pnpm hoisting. --appendPlugins forces the plugin import from the workspace.
-          cd apps/web && pnpm exec stryker run --mutate "$changed_files" --appendPlugins "@stryker-mutator/vitest-runner"
-
   secret-scan:
     name: Secret scan (TruffleHog, verified only)
     runs-on: ${{ vars.CI_RUNNER || 'agents-arc' }}
@@ -731,13 +631,31 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Generate SBOM
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        id: sbom
+        uses: anchore/sbom-action@fffec3d851af758d56fee099cf3fbf8aa8779843 # v0.24.3
+        continue-on-error: true
         with:
           format: cyclonedx-json
           artifact-name: ${{ env.SBOM_ARTIFACT_NAME }}
+          syft-version: v1.57.0
           # On a tag that already has a GitHub Release the action attaches the SBOM to it, which
           # needs contents: write this workflow does not have, and fails the run that gates deploy.
           upload-release-assets: false
+      # The action downloads the syft binary with a single non-retried GET. A transient GitHub
+      # release-CDN 504 (log: "received HTTP status=504 ... _checksums.txt") flips this step to
+      # failure and, because SBOM gates deploy, blocks PROD for no code reason. The first attempt is
+      # continue-on-error so the job stays live; this retry runs only when it actually failed. If
+      # BOTH attempts fail (a real syft/SBOM error, not a flaky download), the job still fails and
+      # SBOM stays a gate.
+      - name: Retry SBOM on transient asset 504
+        if: ${{ steps.sbom.outcome == 'failure' }}
+        uses: anchore/sbom-action@fffec3d851af758d56fee099cf3fbf8aa8779843 # v0.24.3
+        with:
+          format: cyclonedx-json
+          artifact-name: ${{ env.SBOM_ARTIFACT_NAME }}
+          syft-version: v1.57.0
+          # Same guard as above: a tag release needs contents: write, which this job lacks.
+          upload-release-assets: false
 
   # Builds the coverage, complexity and hygiene facets (uploaded from main only) and runs the
   # blocking complexity and duplication gates. The coverage floors stay with the api and web jobs.
@@ -938,7 +856,7 @@ jobs:
   # The merge train reads this job by its name to tell a full run from a light one: do not rename it.
   full-ci:
     name: Full CI
-    needs: [depth, api, web, e2e, mutation-api, mutation-web, engineering-excellence]
+    needs: [depth, api, web, e2e, engineering-excellence]
     if: ${{ always() && needs.depth.outputs.full == 'true' }}
     runs-on: ${{ vars.CI_RUNNER || 'agents-arc' }}
     timeout-minutes: 5
@@ -968,7 +886,7 @@ jobs:
   # and the router's maintenance run merges Dependabot updates instead of the train.
   dispatch-merge-gate:
     name: Dispatch merge gate
-    needs: [api, mutation-api, web, mutation-web, secret-scan, deps-and-iac-scan, sast-scan, sbom, engineering-excellence, platform-conformance, full-ci]
+    needs: [api, web, secret-scan, deps-and-iac-scan, sast-scan, sbom, engineering-excellence, platform-conformance, full-ci]
     if: >
       always() &&
       vars.AGENTIC_WORKFLOWS_DISABLED == '' &&
@@ -986,7 +904,7 @@ jobs:
       - name: Hand this run's verdict to the merge train after CI settles
         env:
           GH_TOKEN: ${{ github.token }}
-          # The jobs the apps judged before this template; the mutation runs are only waited for.
+          # The jobs the apps judged before this template.
           RESULTS: >-
             ${{ needs.api.result }} ${{ needs.web.result }} ${{ needs.secret-scan.result }}
             ${{ needs.deps-and-iac-scan.result }} ${{ needs.sast-scan.result }} ${{ needs.sbom.result }}

package/loops/templates/ci/app-ci-node-monorepo.yml

@@ -1,4 +1,7 @@
 # Managed by @plainconceptsplatform/workflows. Source: loops/templates/ci/app-ci-node-monorepo.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+# No mutation testing here, on purpose: a pull request's quality gate is the test suite, and Stryker
+# over even one changed page took longer than the rest of CI together. Mutation runs out of band,
+# weekly, in `Quality: Mutation testing (scheduled)` (`workflows add --template quality-mutation`).
 name: "App: CI (Node monorepo)"
 
 on:
@@ -27,7 +30,6 @@ env:
   TRUFFLEHOG_IMAGE: "trufflesecurity/trufflehog:latest"
   SEMGREP_IMAGE: "semgrep/semgrep:1.168.0"
   SBOM_ARTIFACT_NAME: app-sbom.cyclonedx.json
-  MUTATION_THRESHOLD: "60"
 
 permissions:
   contents: read
@@ -72,35 +74,6 @@ jobs:
           retention-days: 3
           if-no-files-found: error
 
-  mutation-web:
-    name: Mutation (web, diff)
-    if: github.event_name == 'pull_request'
-    runs-on: agents-arc
-    timeout-minutes: 25
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with: { version: "${{ env.PNPM_VERSION }}", run_install: false }
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with: { node-version: "${{ env.NODE_VERSION }}", cache: pnpm }
-      - name: Detect web changes
-        id: scope
-        run: |
-          git fetch origin "$GITHUB_BASE_REF" --depth=1
-          if git diff --name-only "origin/$GITHUB_BASE_REF" HEAD | grep -qE "^apps/web/"; then
-            echo "run=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "run=false" >> "$GITHUB_OUTPUT"
-            echo "No apps/web changes in this PR; skipping web mutation."
-          fi
-      - run: pnpm install --frozen-lockfile
-        if: steps.scope.outputs.run == 'true'
-      - name: StrykerJS (changed files only)
-        if: steps.scope.outputs.run == 'true'
-        run: pnpm --filter "$WEB_PACKAGE" exec stryker run --since="origin/$GITHUB_BASE_REF"
-
   e2e:
     name: E2E (Playwright)
     if: github.event_name != 'schedule' && (github.event_name != 'pull_request' || vars.MERGE_QUEUE != 'true')
@@ -204,13 +177,32 @@ jobs:
     runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
+      - name: Generate SBOM
+        id: sbom
+        uses: anchore/sbom-action@fffec3d851af758d56fee099cf3fbf8aa8779843 # v0.24.3
+        continue-on-error: true
         with:
           format: cyclonedx-json
           artifact-name: ${{ env.SBOM_ARTIFACT_NAME }}
+          syft-version: v1.57.0
           # On a tag that already has a GitHub Release the action attaches the SBOM to it, which
           # needs contents: write this workflow does not have, and fails the run that gates deploy.
           upload-release-assets: false
+      # The action downloads the syft binary with a single non-retried GET. A transient GitHub
+      # release-CDN 504 (log: "received HTTP status=504 ... _checksums.txt") flips this step to
+      # failure and, because SBOM gates deploy, blocks PROD for no code reason. The first attempt is
+      # continue-on-error so the job stays live; this retry runs only when it actually failed. If
+      # BOTH attempts fail (a real syft/SBOM error, not a flaky download), the job still fails and
+      # SBOM stays a gate.
+      - name: Retry SBOM on transient asset 504
+        if: ${{ steps.sbom.outcome == 'failure' }}
+        uses: anchore/sbom-action@fffec3d851af758d56fee099cf3fbf8aa8779843 # v0.24.3
+        with:
+          format: cyclonedx-json
+          artifact-name: ${{ env.SBOM_ARTIFACT_NAME }}
+          syft-version: v1.57.0
+          # Same guard as above: a tag release needs contents: write, which this job lacks.
+          upload-release-assets: false
 
   # The merge queue requires this check. On a pull request with MERGE_QUEUE on, the heavy jobs are
   # skipped and the full CI runs on the merge group instead; skipped counts as passed.
@@ -244,7 +236,7 @@ jobs:
   # and the router's maintenance run merges Dependabot updates instead of the train.
   dispatch-merge-train:
     name: Dispatch merge train
-    needs: [lint, web, mutation-web, e2e, desktop, mobile]
+    needs: [lint, web, e2e, desktop, mobile]
     if: >
       always() &&
       github.event_name == 'pull_request' &&

package/loops/templates/ci/quality-mutation.yml

@@ -0,0 +1,268 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/ci/quality-mutation.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: "Quality: Mutation testing (scheduled)"
+
+# Out-of-band mutation run, the shape PlainConceptsPlatform/Atlas runs in
+# .github/workflows/quality-mutation.yml. Deliberately NOT on pull_request: the per-change quality
+# gate is the coverage floor in App: CI, which stays fast. This measures something different,
+# whether the covered lines are actually ASSERTED, and it only needs to move weekly. Stryker over
+# one changed React page took 15 minutes on a pull request (the dry run alone reruns the whole
+# suite), which is why App: CI no longer mutates anything.
+#
+# Each scope is its own job: the .NET scopes in a matrix (Stryker.NET, one project each), the web
+# scope on its own (StrykerJS needs Node, not .NET). Each is gated on its covered-code floor from
+# quality.config.json by scripts/check-mutation.mjs, and a full run on main publishes the
+# engineering-excellence-mutation facet. Both scripts come with the quality-gates template.
+#
+# Everything that differs between apps is a top-level `env:` value below, a floor in
+# quality.config.json, or the app's own Stryker config files.
+
+on:
+  schedule:
+    # Spread the apps over the shared fleet: give each repository its own minute.
+    - cron: "0 4 * * 6" # Sat 04:00 UTC
+  workflow_dispatch:
+    inputs:
+      scope:
+        description: "Which scope to run: all, web, or one of DOTNET_SCOPES"
+        required: false
+        default: all
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: quality-mutation
+  cancel-in-progress: true
+
+env:
+  DOTNET_VERSION: "10.0.x"
+  NODE_VERSION: "22"
+  API_WORKING_DIRECTORY: apps/api
+  DOTNET_SOLUTION: App.slnx
+  # Space-separated scope=project-directory pairs, relative to API_WORKING_DIRECTORY. Each scope
+  # mutates one project with the config at stryker/<scope>.json. Empty runs no .NET scope.
+  DOTNET_SCOPES: "domain=src/App.Domain"
+  # The web scope's working directory and StrykerJS config. An empty WEB_DIRECTORY runs no web scope.
+  WEB_DIRECTORY: apps/web
+  WEB_STRYKER_CONFIG: stryker.config.json
+  NPM_REGISTRY_URL: "//npm.pkg.github.com/"
+
+jobs:
+  # A matrix context is not available to a job-level `if`, so the workflow_dispatch selection is
+  # resolved here and fed in via fromJSON.
+  plan:
+    name: Plan scopes
+    runs-on: ${{ vars.CI_RUNNER || 'agents-arc' }}
+    timeout-minutes: 5
+    outputs:
+      scopes: ${{ steps.pick.outputs.scopes }}
+      web: ${{ steps.pick.outputs.web }}
+    steps:
+      - id: pick
+        env:
+          SCOPE: ${{ inputs.scope || 'all' }}
+        run: |
+          set -euo pipefail
+          known=""
+          for pair in $DOTNET_SCOPES; do known="$known ${pair%%=*}"; done
+          to_json() { printf '%s\n' "$@" | sed '/^$/d' | jq -R . | jq -cs .; }
+          # `web` is a separate flag rather than a matrix entry: that job needs Node, not .NET, and
+          # shares none of the setup the backend scopes do.
+          # shellcheck disable=SC2086 # $known is a list of scope names.
+          case "$SCOPE" in
+            all) SCOPES=$(to_json $known); WEB=$([ -n "$WEB_DIRECTORY" ] && echo true || echo false) ;;
+            web) SCOPES='[]'; WEB=true ;;
+            *)
+              grep -qw -- "$SCOPE" <<<"$known" || { echo "unknown scope $SCOPE (known:$known web)" >&2; exit 1; }
+              SCOPES=$(to_json "$SCOPE"); WEB=false ;;
+          esac
+          echo "scopes=$SCOPES" >> "$GITHUB_OUTPUT"
+          echo "web=$WEB" >> "$GITHUB_OUTPUT"
+          echo "Scopes: $SCOPES, web: $WEB"
+
+  mutate:
+    name: Mutants (${{ matrix.scope }})
+    needs: plan
+    if: ${{ needs.plan.outputs.scopes != '[]' }}
+    runs-on: ${{ vars.CI_RUNNER || 'agents-arc' }}
+    # Atlas measured ~3.5 min per scope locally, but its application scope takes ~90 min on the
+    # runner and was cancelled at 90, which left the published report without it. 150 keeps
+    # headroom while still stopping a runaway job.
+    timeout-minutes: 150
+    strategy:
+      fail-fast: false
+      matrix:
+        scope: ${{ fromJSON(needs.plan.outputs.scopes) }}
+    defaults:
+      run:
+        working-directory: ${{ env.API_WORKING_DIRECTORY }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      # Without DOTNET_INSTALL_DIR setup-dotnet installs into /usr/share/dotnet, which the runner
+      # user does not own; GitHub-hosted runners keep the default.
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
+        env:
+          DOTNET_INSTALL_DIR: ${{ runner.environment == 'self-hosted' && format('{0}/dotnet', runner.tool_cache) || '' }}
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      # RESTORE-ONLY, and deliberately no build cache. Stryker does not sandbox: it swaps mutated
+      # assemblies straight into bin/Release. If this job ever saved a build cache App: CI restores,
+      # PR CI would test MUTATED binaries and still report green. Do not "optimise" this into one.
+      - name: Restore .NET tools
+        run: dotnet tool restore
+      - name: Restore solution
+        run: dotnet restore "$DOTNET_SOLUTION"
+
+      # Run from the mutated project's own directory, with no `solution` key in the config.
+      # Solution mode builds via --property:Platform="Any CPU"; the space splits the argument and
+      # MSBuild fails with MSB1008 before a single mutant is generated (Atlas#1531). Per-project
+      # mode uses Platform=AnyCPU and works.
+      - name: Run Stryker
+        env:
+          SCOPE: ${{ matrix.scope }}
+        run: |
+          set -euo pipefail
+          export PATH="$PATH:$HOME/.dotnet/tools"
+          PROJECT_DIR=""
+          for pair in $DOTNET_SCOPES; do
+            [ "${pair%%=*}" = "$SCOPE" ] && PROJECT_DIR="${pair#*=}"
+          done
+          [ -n "$PROJECT_DIR" ] || { echo "unknown scope $SCOPE" >&2; exit 1; }
+          root="$GITHUB_WORKSPACE/$API_WORKING_DIRECTORY"
+          cd "$PROJECT_DIR"
+          dotnet stryker \
+            --config-file "$root/stryker/$SCOPE.json" \
+            --output "$root/StrykerOutput/$SCOPE" \
+            | tee "$root/stryker-$SCOPE.log"
+
+      # perTest is the difference between minutes and hours: without it every mutant reruns the
+      # whole suite. The timeout is what actually stops that from burning a runner, so this stays a
+      # warning; its job is to say WHY, in the run where it happened. Stryker prints the mode to
+      # stdout and writes no log file, hence the tee above.
+      - name: Assert coverage analysis stayed perTest
+        if: always()
+        env:
+          SCOPE: ${{ matrix.scope }}
+        run: |
+          if ! grep -q "CoverageBasedTest" "stryker-$SCOPE.log" 2>/dev/null; then
+            echo "::warning::coverage-analysis may have degraded from perTest for $SCOPE"
+          fi
+
+      # `--output <dir>` writes <dir>/reports/ directly, with no timestamped subdirectory.
+      - name: Upload mutation report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: mutation-${{ matrix.scope }}
+          path: ${{ env.API_WORKING_DIRECTORY }}/StrykerOutput/${{ matrix.scope }}/reports/
+          if-no-files-found: error
+          retention-days: 30
+
+      # A weekly cron nobody reads is how mutation testing dies everywhere, so the scores go into
+      # the run summary whether the gate passes or fails.
+      #
+      # `set -o pipefail` is what makes this a gate at all. The Actions default shell is `bash -e`,
+      # where the exit status of a pipeline is its LAST command, so `node … | tee` reports tee's
+      # success and the step passes however low the score is. Do not remove it, and do not drop the
+      # `tee`: without pipefail the two cancel out silently.
+      - name: Mutation score floor
+        if: always()
+        working-directory: ${{ github.workspace }}
+        env:
+          SCOPE: ${{ matrix.scope }}
+        run: |
+          set -euo pipefail
+          node scripts/check-mutation.mjs "$SCOPE" \
+            "$API_WORKING_DIRECTORY/StrykerOutput/$SCOPE/reports/mutation-report.json" \
+            | tee -a "$GITHUB_STEP_SUMMARY"
+
+  mutate-web:
+    name: Mutants (web)
+    needs: plan
+    if: ${{ needs.plan.outputs.web == 'true' }}
+    runs-on: ${{ vars.CI_RUNNER || 'agents-arc' }}
+    # Atlas: 10 min locally over its allowlist but >45 on a 4-vCPU runner. jsdom rendering is the
+    # bottleneck and it does not shrink the way the .NET scopes do. Its first run was killed at 45.
+    timeout-minutes: 90
+    defaults:
+      run:
+        working-directory: ${{ env.WEB_DIRECTORY }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+        with:
+          run_install: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+      - name: Configure optional private registry authentication
+        working-directory: ${{ github.workspace }}
+        env:
+          NPM_REGISTRY_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}
+        run: |
+          if [ -n "$NPM_REGISTRY_TOKEN" ]; then
+            echo "${NPM_REGISTRY_URL}:_authToken=$NPM_REGISTRY_TOKEN" >> .npmrc
+          fi
+      - name: Install workspace
+        working-directory: ${{ github.workspace }}
+        run: pnpm install --frozen-lockfile
+      - name: Run Stryker
+        run: pnpm exec stryker run "$WEB_STRYKER_CONFIG"
+      - name: Upload mutation report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: mutation-web
+          path: ${{ env.WEB_DIRECTORY }}/reports/mutation
+          if-no-files-found: error
+          retention-days: 30
+      # See the note on the .NET floor step: without pipefail this reports tee's exit status and
+      # gates nothing.
+      - name: Mutation score floor
+        if: always()
+        working-directory: ${{ github.workspace }}
+        run: |
+          set -euo pipefail
+          node scripts/check-mutation.mjs web "$WEB_DIRECTORY/reports/mutation/mutation-report.json" \
+            | tee -a "$GITHUB_STEP_SUMMARY"
+
+  # Folds every scope's report into the `engineering-excellence-mutation` artifact Project-Health
+  # collects, with the per-module breakdown. Runs when a floor failed too: a drop is the week most
+  # worth recording. Uploads only for a full run on main: a single-scope dispatch would read as a
+  # partial week.
+  engineering-excellence:
+    name: Engineering Excellence (mutation)
+    needs: [mutate, mutate-web]
+    if: ${{ !cancelled() && (needs.mutate.result != 'skipped' || needs.mutate-web.result != 'skipped') }}
+    runs-on: ${{ vars.CI_RUNNER || 'agents-arc' }}
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+      # One subdirectory per artifact: reports/mutation-<scope>/mutation-report.json.
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: mutation-*
+          path: reports
+      - name: Build facet
+        run: |
+          set -euo pipefail
+          node scripts/engineering-excellence.mjs mutation --out mutation.json --reports reports \
+            | tee -a "$GITHUB_STEP_SUMMARY"
+      - name: Upload mutation facet
+        if: ${{ github.ref == 'refs/heads/main' && (inputs.scope || 'all') == 'all' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: engineering-excellence-mutation
+          path: mutation.json
+          if-no-files-found: error
+          retention-days: 90

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.16.1",
+  "version": "1.17.0",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",