tewip-ai 0.26.0 → 0.27.0

package/README.md

@@ -71,6 +71,13 @@ On every run, the action:
 - **Developers:** posts one diagnosis comment on the pull request and keeps it updated. For each failure it says whether the change likely caused it, why, and what to do next.
 - **SDETs:** writes the triage board into the job summary.
 - **DevOps:** collects environment failures (server errors, connection resets, outages) in **one** GitHub issue, and each new run adds a single grouped comment to it.
+- **The tests in the pull request:** on a PR it reads the test files the change touched and says which
+  of them could never fail - an unfinished expectation, a value compared with itself, a test that
+  discards its own failure, one that never runs. It says nothing when they are all sound, and it says
+  it **even on a green run**, because "all tests passed" is the exact sentence that needs qualifying
+  when one of them cannot fail. Needs `fetch-depth: 0` on `actions/checkout` so the diff can be read;
+  without it the section is skipped rather than guessed at. Any such test also enters the attestation
+  as a refusal, so a release decision taken from the bundle cannot rest on a test that proves nothing.
 - **Evidence, every run:** the Action writes an attestation into its artifact - the claims with
   their evidence and which layer decided each, what Tewip **refused** to decide, and what it did
   not check at all. Nothing enters it that Tewip did not verify itself, so a release decision can
@@ -496,6 +503,54 @@ Joins the test plans Tewip wrote to the tests that cover them and the runs that
 scenario counts as covered only when a real test can be named, and passing only when a real run
 attempted it; everything else says what is missing. No model, no cost.
 
+## Would your tests catch a bug? (Phase 23)
+
+```bash
+tewip prove src/pricing.js              # or --diff main...HEAD for what a change touched
+tewip prove src/pricing.js --strict     # exits non-zero when something goes unnoticed
+```
+
+Coverage says a line ran. It does not say anybody checked it. `prove` settles that by **execution**:
+it breaks your code in small, deliberate ways - a boundary moved by one, a condition inverted, an
+`and` that became an `or`, a returned flag flipped, a pattern loosened - runs the tests that reach
+that file, and reports every change **none of them noticed**.
+
+```
+4 change(s) were made to your code and the covering tests were run against each. 3 went unnoticed.
+
+- line 2: a boundary moved by one
+  - was:    if (total >= 100 && isMember) return 0.2;
+  - became: if (total > 100 && isMember) return 0.2;
+- line 9: a sign reversed
+  - was:    return total - total * off;
+  - became: return total + total * off;
+```
+
+Both of those are real: the tests used 150 and 10 and never the boundary itself, and the test calling
+`finalPrice` asserted nothing at all. Neither gap is visible in a coverage report, because both lines
+were covered.
+
+It refuses more often than it reports, and the refusals are the reason the reports are worth reading:
+
+- **Your file is put back exactly as it was**, byte for byte, line endings included, in a `finally` -
+  and the restore is verified, not assumed. A restore that did not work is an error, not a shrug.
+- **Nothing that can hang is touched.** Loop headers are never changed: a flipped comparison in a
+  `while` does not fail a test, it runs forever.
+- **A red suite proves nothing.** Every covering test is run untouched first. Ones that do not pass are
+  set aside by name, and if none pass, it says so and stops - a test that was already failing would
+  otherwise appear to "catch" every change.
+- **It checks that your tests actually load the file.** If breaking the file outright does not fail a
+  single test, they are reading an installed copy or a build output, and it says that instead of
+  reporting a page of holes that do not exist. This caught a real case on the first Python project it
+  met, where `import humanize` resolved to a different checkout entirely.
+- **Strings and comments are never changed**, because changing a message is not a bug a test should be
+  expected to catch.
+
+It follows imports, so a file reached *through* another module is still proved - in a layered codebase
+that is most of them. It needs a unit test framework (jest, vitest, mocha, `node --test`, pytest, go
+test, maven, gradle, dotnet), calls no model, and costs nothing but time. It is also an MCP tool, so a
+coding agent can ask whether the tests it is relying on would have stopped its own mistake.
+
 ## Could these tests ever fail? (Phase 22)
 
 ```bash
@@ -540,8 +595,9 @@ tewip pursue "keep the checkout flow green" --act
 
 Give Tewip a goal and it says what it would do next, and why, from what it can actually see. The
 order is fixed, published and testable - **not chosen by a model**: a real bug first, then the
-environment, then flakiness, then anything failing it cannot explain, then a coverage gap, and only
-then is the goal worth attesting. Deciding the same state twice gives the same answer.
+environment, then flakiness, then anything failing it cannot explain, then a test that cannot fail,
+then a coverage gap, and only then is the goal worth attesting. Deciding the same state twice gives
+the same answer.
 
 With `--act` it carries the decision out, and this is where the refusals matter most:
 

package/dist/cli/help.js

@@ -105,11 +105,20 @@ Usage:
                                     green" - and it says what it would do next and why, from what
                                     it can actually see. The order is fixed and written down: a
                                     real bug first, then the environment, then flakiness, then a
-                                    coverage gap. It decides; it does not act unless you ask. With
+                                    test that cannot fail, then a coverage gap. It decides; it does
+                                    not act unless you ask. With
                                     --act it carries out the two safe ones - writing a missing test,
                                     or attesting a green goal - by running the command that already
                                     proves them. It will not touch a real bug, and it writes what it
                                     did or refused to .tewip/actions.jsonl.
+  tewip prove <file> [--diff main...HEAD] [--limit 6] [--budget 600] [--strict]
+                                    What would your tests NOT catch? Breaks your code in small,
+                                    deliberate ways - a boundary moved by one, a condition inverted,
+                                    an and that became an or - runs the tests that import that file,
+                                    and reports every change nobody noticed. The line was covered; it
+                                    was not checked, and no coverage number can tell you that. Every
+                                    file is put back exactly as it was. Slow by nature, and it needs
+                                    a unit test framework. No model, no cost.
   tewip vouch [<paths>] [--strict] [--out vouch.md] [--json vouch.json]
                                     Could these tests ever fail? Reads tests somebody else wrote -
                                     an agent, a contractor, last year's team - and names the ones

package/dist/cli/tewip.js

@@ -185,6 +185,20 @@ async function main() {
             runPursue({ root: process.cwd(), goal, act: args.includes('--act'), name: flag(args, 'name'), out: flag(args, 'out') });
             return;
         }
+        case 'prove': {
+            const paths = args.filter((a, i) => !a.startsWith('--') && !['--out', '--diff', '--limit', '--budget'].includes(args[i - 1] ?? ''));
+            const { runProve } = await import('../engine/prove/prove-command.js');
+            runProve({
+                root: process.cwd(),
+                files: paths,
+                diff: flag(args, 'diff'),
+                limit: Number(flag(args, 'limit') ?? '6'),
+                budgetSeconds: Number(flag(args, 'budget') ?? '600'),
+                out: flag(args, 'out'),
+                strict: args.includes('--strict'),
+            });
+            return;
+        }
         case 'vouch': {
             const paths = args.filter((a, i) => !a.startsWith('--') && !['--out', '--json'].includes(args[i - 1] ?? ''));
             const { runVouch } = await import('../engine/vouch/run-vouch.js');

package/dist/engine/attest/attest.js

@@ -11,9 +11,12 @@ function evidenceOf(record) {
  * The bundle for one run. `records` and `run` are what Tewip itself wrote when it read the report,
  * so everything here is traceable; nothing is inferred and nothing is re-judged.
  */
-export function attestRun(project, run, records, { checked, notChecked, tool, engine }) {
+export function attestRun(project, run, records, { checked, notChecked, tool, engine, refusals: given = [], }) {
     const claims = [];
-    const refusals = [];
+    // Refusals the caller already established - a test in this change that cannot fail, for instance -
+    // belong here beside the ones the records produce. They are the same kind of statement: something
+    // this bundle will not vouch for.
+    const refusals = [...given];
     for (const record of records) {
         const diagnosis = record.diagnosis;
         const category = diagnosis?.category ?? 'UNKNOWN';

package/dist/engine/prove/mutants.js

@@ -0,0 +1,148 @@
+// Phase 23: small, deliberate breakages of real code, to find out what the tests would not notice.
+//
+// `vouch` reads a test and says whether it *could* fail. This asks the harder question, and answers
+// it by execution rather than by reading: break the code the test covers, run the test, and see. A
+// change nobody notices is a hole in the suite that no coverage percentage will ever show, because
+// the line was covered - it just was not checked.
+//
+// Three rules shape what may be changed, and all three exist to keep the answer trustworthy:
+//
+// 1. **Only code.** Strings and comments are skipped, reusing the same mask `vouch` uses. Changing a
+//    word in a message is not a bug a test should be expected to catch.
+// 2. **Nothing that can hang.** Loop headers are never touched. A flipped comparison in a `while`
+//    condition does not fail a test, it runs forever, and a tool that hangs a developer's machine
+//    gets uninstalled. This is the same lesson as the fork bomb in Phase 21, learned once.
+// 3. **One change at a time**, always restored. A mutant is a question, not an edit.
+import { textRanges } from '../vouch/tests-in.js';
+/** A line that could loop: never touched, because a wrong comparison there hangs instead of failing. */
+const COULD_LOOP = /\b(for|while|do|loop|repeat|until)\b\s*[({:]|\bfor\b.*\bin\b|\.\s*(forEach|map|filter|reduce|while)\s*\(/;
+/** A line that only reports, logs or types: changing it says nothing about behaviour. */
+const NOT_BEHAVIOUR = /^\s*(\/\/|#|\*|\/\*|@|import\b|from\b|export\s+(type|interface)\b|use\s|package\b|using\b|require\b|const\s+\w+\s*=\s*require)|console\s*\.|print\s*\(|println|log(ger)?\s*\.|process\.(stdout|stderr)|fmt\s*\.\s*Print/;
+/**
+ * The changes worth making, in the order they are worth making them. Each is a mistake a person or an
+ * agent really makes: a boundary off by one, a condition inverted, an `and` that should be an `or`, a
+ * sign the wrong way round, a flag returned the wrong way.
+ */
+const OPERATORS = [
+    { kind: 'a boundary moved by one', find: /(?<![<>=!])<=(?!=)/, swap: () => '<' },
+    { kind: 'a boundary moved by one', find: /(?<![<>=!])>=(?!=)/, swap: () => '>' },
+    { kind: 'a boundary moved by one', find: /(?<![<>=!+-])<(?![<=])/, swap: () => '<=' },
+    { kind: 'a boundary moved by one', find: /(?<![<>=!+-])>(?![>=])/, swap: () => '>=' },
+    { kind: 'a comparison inverted', find: /===/, swap: () => '!==' },
+    { kind: 'a comparison inverted', find: /(?<![!=<>])==(?!=)/, swap: () => '!=' },
+    { kind: 'a comparison inverted', find: /!==/, swap: () => '===' },
+    { kind: 'a comparison inverted', find: /(?<![!=<>])!=(?!=)/, swap: () => '==' },
+    { kind: 'an "and" that became an "or"', find: /&&/, swap: () => '||' },
+    { kind: 'an "or" that became an "and"', find: /\|\|/, swap: () => '&&' },
+    { kind: 'a condition inverted', find: /\bif\s*\(\s*!/, swap: (m) => m.replace('!', '') },
+    { kind: 'a sign reversed', find: /(?<=[\w)\]]\s?)\+(?=\s?[\w(])/, swap: () => '-' },
+    { kind: 'a sign reversed', find: /(?<=[\w)\]]\s?)-(?=\s?[\w(])/, swap: () => '+' },
+    { kind: 'a returned flag flipped', find: /\breturn\s+true\b/, swap: () => 'return false' },
+    { kind: 'a returned flag flipped', find: /\breturn\s+false\b/, swap: () => 'return true' },
+    { kind: 'a returned value emptied', find: /\breturn\s+(?!null|undefined|None|nil|true|false|;|$)[\w.[\]]+\s*;?\s*$/, swap: (m) => (m.trimEnd().endsWith(';') ? 'return null;' : 'return null') },
+];
+/**
+ * Is this position inside a regular expression literal?
+ *
+ * Only a rough reading, and it only decides what a change is *called*, never whether it is safe: a
+ * slash that opens a pattern follows an operator, a bracket or a keyword, never a value, which is what
+ * separates `/re/` from division.
+ */
+function inPattern(line, at) {
+    let i = 0;
+    while (i < line.length) {
+        if (line[i] !== '/') {
+            i += 1;
+            continue;
+        }
+        const before = line.slice(0, i).trimEnd();
+        const opens = before === '' || /[=(,:[!&|?{;]$|\b(return|typeof|case|of|in|and|or|not)$/.test(before);
+        if (!opens) {
+            i += 1;
+            continue;
+        }
+        // Find the closing slash, ignoring one escaped by a backslash and one inside a character class.
+        let cls = false;
+        for (let j = i + 1; j < line.length; j += 1) {
+            const ch = line[j];
+            if (ch === String.fromCharCode(92)) {
+                j += 1;
+                continue;
+            }
+            if (ch === '[')
+                cls = true;
+            else if (ch === ']')
+                cls = false;
+            else if (ch === '/' && !cls) {
+                if (at > i && at < j)
+                    return true;
+                i = j + 1;
+                break;
+            }
+            if (j === line.length - 1)
+                return false; // never closed on this line
+        }
+        if (i < line.length && line[i] === '/')
+            i += 1;
+    }
+    return false;
+}
+/**
+ * The mutants worth trying for this file, spread over the file rather than taken from the top: five
+ * changes to one function say much less about a suite than five changes in five places.
+ */
+export function mutantsFor(text, limit = 6) {
+    const ranges = textRanges(text);
+    const lines = text.split(String.fromCharCode(10));
+    const offsets = [];
+    let seen = 0;
+    for (const line of lines) {
+        offsets.push(seen);
+        seen += line.length + 1;
+    }
+    const found = [];
+    for (let i = 0; i < lines.length; i += 1) {
+        const line = lines[i];
+        if (line.trim().length < 3 || COULD_LOOP.test(line) || NOT_BEHAVIOUR.test(line))
+            continue;
+        for (const operator of OPERATORS) {
+            const hit = operator.find.exec(line);
+            if (!hit)
+                continue;
+            const at = offsets[i] + (hit.index ?? 0);
+            // Inside a string or a comment: not behaviour, and often not even syntax once changed.
+            if (ranges.some(([from, to]) => at > from && at < to))
+                continue;
+            const now = line.slice(0, hit.index) + operator.swap(hit[0]) + line.slice((hit.index ?? 0) + hit[0].length);
+            if (now === line)
+                continue;
+            // A change inside a regular expression is worth making - loosening a pattern is exactly how one
+            // silently stops matching what it was written for - but it is not a boundary or a comparison, and
+            // calling it one makes an otherwise good finding look like a bug in the tool.
+            const kind = inPattern(line, hit.index ?? 0) ? 'a pattern loosened' : operator.kind;
+            found.push({ line: i + 1, was: line.trim(), now: now.trim(), kind });
+            break; // one change per line keeps each answer about one thing
+        }
+    }
+    return spread(found, limit);
+}
+/**
+ * Takes at most `limit`, as far apart in the file as they can be. A suite that catches everything in
+ * one function and nothing in the rest of the file should not look like a suite that catches
+ * everything, and taking the first six mutants in order is how that happens.
+ */
+function spread(all, limit) {
+    if (all.length <= limit)
+        return all;
+    const step = all.length / limit;
+    return Array.from({ length: limit }, (unused, i) => all[Math.floor(i * step)]);
+}
+/** The file with this one mutant applied, ready to be written and then put back. */
+export function applyMutant(text, mutant) {
+    const lines = text.split(String.fromCharCode(10));
+    const line = lines[mutant.line - 1];
+    if (line === undefined || line.trim() !== mutant.was)
+        throw new Error(`line ${mutant.line} is not what the mutant was made from, so nothing was written`);
+    lines[mutant.line - 1] = line.replace(mutant.was, mutant.now);
+    return lines.join(String.fromCharCode(10));
+}

package/dist/engine/prove/prove-command.js

@@ -0,0 +1,152 @@
+// `tewip prove <file>`: what your tests would not catch, shown by breaking the code and watching.
+//
+// The report is written for the reader who has to decide whether to trust a suite. It leads with what
+// went unnoticed, quotes the exact change, names the test that caught each one that was caught, and
+// says what the answer cost in seconds - because this is the one command here that is slow, and a
+// number somebody waited four minutes for should say how long it took.
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, relative, resolve } from 'node:path';
+import { changeSummary } from '../quality/grounding.js';
+import { chooseFramework, detectFrameworks } from '../quality/frameworks.js';
+import { coverageFor, testFiles } from '../review/coverage.js';
+import { importingTests, proveFile } from './prove.js';
+import { testsReaching } from './reaches.js';
+const SOURCE = /\.(js|jsx|mjs|cjs|ts|tsx|mts|cts|py|java|kt|go|cs|rb|php)$/i;
+const IS_TEST = /(^|[\\/])(tests?|spec|specs|__tests__|e2e)[\\/]|[._-](test|tests|spec|specs)\.[a-z]+$|(^|[\\/])test_[^\\/]+\.py$|_test\.(go|py|rb)$|Tests?\.(java|kt|cs)$/i;
+/** The source files to prove: the ones named, or the ones a change touched. */
+export function filesToProve(cmd) {
+    if (cmd.files.length > 0)
+        return cmd.files.map((f) => f.split('\\').join('/'));
+    if (!cmd.diff)
+        return [];
+    const change = changeSummary(cmd.root, cmd.diff);
+    if (!change)
+        return [];
+    return change.files.map((f) => f.split('\\').join('/')).filter((f) => SOURCE.test(f) && !IS_TEST.test(f) && existsSync(resolve(cmd.root, f)));
+}
+export function renderProof(proofs) {
+    const tried = proofs.flatMap((p) => p.tried);
+    const unnoticed = tried.filter((t) => t.fate === 'unnoticed');
+    const noticed = tried.filter((t) => t.fate === 'noticed');
+    const invalid = tried.filter((t) => t.fate === 'did-not-compile');
+    const broke = tried.filter((t) => t.fate === 'runner-broke');
+    const seconds = proofs.reduce((total, p) => total + p.seconds, 0);
+    const lines = [
+        '# What your tests would not catch',
+        '',
+        tried.length === 0
+            ? 'Nothing was tried. See below for why.'
+            : `${tried.length} change(s) were made to your code and the covering tests were run against each. **${unnoticed.length} went unnoticed.** ${noticed.length} were caught. Took ${seconds}s.`,
+        '',
+    ];
+    if (unnoticed.length > 0) {
+        lines.push(`## Unnoticed (${unnoticed.length})`, '', 'Each of these is a change to your code that every test covering it still passed. The line was', 'covered; it was not checked.', '');
+        for (const proof of proofs) {
+            const gaps = proof.tried.filter((t) => t.fate === 'unnoticed');
+            if (gaps.length === 0)
+                continue;
+            lines.push(`### ${proof.file}`, '');
+            for (const gap of gaps) {
+                lines.push(`- **line ${gap.mutant.line}: ${gap.mutant.kind}**`);
+                lines.push(`  - was: \`${gap.mutant.was.slice(0, 120)}\``);
+                lines.push(`  - became: \`${gap.mutant.now.slice(0, 120)}\``);
+            }
+            lines.push('', `Run by: ${proof.covering.join(', ')}`, '');
+        }
+    }
+    if (noticed.length > 0) {
+        lines.push(`## Caught (${noticed.length})`, '', 'These your tests would have stopped.', '');
+        for (const good of noticed)
+            lines.push(`- line ${good.mutant.line}: ${good.mutant.kind} — caught by \`${good.noticedBy}\``);
+        lines.push('');
+    }
+    const blocked = proofs.filter((p) => p.blocked);
+    if (blocked.length > 0) {
+        lines.push(`## Nothing could be proved here (${blocked.length})`, '');
+        for (const p of blocked)
+            lines.push(`- **${p.file}**: ${p.blocked}`);
+        lines.push('');
+    }
+    if (invalid.length > 0 || broke.length > 0 || proofs.some((p) => p.notTried > 0 || p.setAside.length > 0)) {
+        lines.push('## Not counted', '');
+        if (invalid.length > 0)
+            lines.push(`- ${invalid.length} change(s) did not compile, so they say nothing about the tests. That is Tewip's fault, not yours.`);
+        for (const p of proofs)
+            for (const aside of p.setAside)
+                lines.push(`- \`${aside.test}\` was set aside: ${aside.why}. It covers ${p.file}, so it may well notice things the tests above did not.`);
+        if (broke.length > 0)
+            lines.push(`- ${broke.length} run(s) broke in the environment rather than the tests.`);
+        const left = proofs.reduce((total, p) => total + p.notTried, 0);
+        if (left > 0)
+            lines.push(`- ${left} change(s) were never tried: the time budget ran out. Raise it with \`--budget <seconds>\`.`);
+        lines.push('');
+    }
+    lines.push('---', '', 'Every line above was proved by running your own tests against your own code, one small change at', 'a time, and every file was put back exactly as it was. No model was called.', '', 'What this does not say: that the unnoticed changes are bugs, or that the caught ones mean the', 'suite is good. It says only which of these particular mistakes your tests would have stopped -', 'which is more than a coverage percentage can tell you, and less than a proof that the code works.');
+    return lines.join(String.fromCharCode(10));
+}
+/**
+ * One file, proved, with nothing printed: what the MCP server and any other caller use. `runProve`
+ * prints as it goes because a person waiting minutes deserves to see progress; over a protocol that
+ * speaks on stdout, printing would corrupt the stream.
+ */
+export function proveOne(root, file, opts = {}) {
+    const framework = chooseFramework(detectFrameworks(root), undefined, false);
+    if (!framework)
+        return 'No unit test framework was found here (jest, vitest, mocha, node --test, pytest, go test, maven, gradle, dotnet). Proving works by running your tests, so it needs one.';
+    if (!existsSync(resolve(root, file)))
+        return `No such file here: ${file}`;
+    const covering = coveringTests(root, file, testFiles(root));
+    return renderProof([proveFile(root, file, covering.tests, framework, { limit: opts.limit, budgetSeconds: opts.budgetSeconds })]);
+}
+/** The tests that could notice a change here: the ones that import the file, else the ones that reach it. */
+function coveringTests(root, file, known) {
+    const direct = importingTests(root, coverageFor(root, [file], known), file);
+    if (direct.length > 0)
+        return { tests: direct, how: 'import it directly' };
+    const reached = testsReaching(root, file, known.map((t) => t.split(String.fromCharCode(92)).join('/')));
+    return { tests: reached.map((r) => r.testFile), how: reached.length > 0 ? `reach it through ${reached[0].steps} import(s), via ${reached[0].via}` : 'import it' };
+}
+export function runProve(cmd) {
+    const files = filesToProve(cmd);
+    if (files.length === 0) {
+        throw new Error('name a source file to prove, or pass --diff main...HEAD to prove what a change touched');
+    }
+    // A unit framework, never a browser one: proving needs dozens of runs, and a browser run costs
+    // minutes. Browser tests are where `tewip fix` and the drift lab work instead.
+    const framework = chooseFramework(detectFrameworks(cmd.root), undefined, false);
+    if (!framework) {
+        throw new Error('no unit test framework was found here (jest, vitest, mocha, pytest, go test, maven, gradle, dotnet). Proving needs one, because it works by running your tests.');
+    }
+    const known = testFiles(cmd.root);
+    const proofs = [];
+    for (const file of files) {
+        if (!existsSync(resolve(cmd.root, file))) {
+            proofs.push({ file, covering: [], tried: [], blocked: 'no such file here', setAside: [], notTried: 0, seconds: 0 });
+            continue;
+        }
+        // Nothing importing it by name is the normal case in a layered codebase, not the absence of
+        // tests, so the import chain is followed outwards before anything is concluded.
+        const { tests: covering, how } = coveringTests(cmd.root, file, known);
+        console.error(`${file}: ${covering.length} test file(s) ${how}`);
+        proofs.push(proveFile(cmd.root, file, covering, framework, {
+            limit: cmd.limit,
+            budgetSeconds: cmd.budgetSeconds,
+            onStep: (message) => console.error(`  ${message}`),
+        }));
+    }
+    const report = renderProof(proofs);
+    console.log(report);
+    if (cmd.out) {
+        mkdirSync(dirname(resolve(cmd.out)), { recursive: true });
+        writeFileSync(resolve(cmd.out), report + String.fromCharCode(10), 'utf8');
+    }
+    const unnoticed = proofs.flatMap((p) => p.tried).filter((t) => t.fate === 'unnoticed').length;
+    if (cmd.strict && unnoticed > 0) {
+        console.error(String.fromCharCode(10) + `${unnoticed} change(s) to your code went unnoticed by the tests covering it.`);
+        process.exitCode = 1;
+    }
+    return { proofs, unnoticed };
+}
+/** Kept so a caller that only wants the numbers does not have to parse the report. */
+export const readSource = (root, file) => readFileSync(resolve(root, file), 'utf8');
+export const shortName = (root, file) => relative(root, resolve(root, file)).split('\\').join('/');

package/dist/engine/prove/prove.js

@@ -0,0 +1,179 @@
+// Running the mutants: break one thing, run the tests that cover it, put the file back.
+//
+// This is the only part of Tewip that writes to a file the developer did not ask it to touch, so the
+// restoring is not a detail, it is the feature. The rules:
+//
+//   - the original bytes are held in memory before anything is written;
+//   - the file is put back in a `finally`, whatever happened, including a crash or a timeout;
+//   - after putting it back, the bytes are compared, and a mismatch is reported loudly rather than
+//     shrugged off, because the alternative is leaving somebody's code broken on disk;
+//   - the tests are run unmutated first. If they do not pass as they are, nothing is proved and
+//     nothing is mutated at all.
+import { spawnSync } from 'node:child_process';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join, relative, resolve } from 'node:path';
+import { runTest } from '../quality/write-verify.js';
+import { applyMutant, mutantsFor } from './mutants.js';
+/**
+ * Does this mutated file still parse?
+ *
+ * The first version judged this by looking for words like "SyntaxError" or "no such file" in the test
+ * output, and it was wrong on the first real project it met: express's own static-file tests print
+ * ENOENT messages when they pass, so four valid mutants in `lib/utils.js` were thrown away as "did
+ * not compile" and the report claimed nothing could be shown. Reading a test's output to guess why it
+ * failed is precisely the habit this project exists to replace.
+ *
+ * Every operator here is syntax-preserving by construction, so a parse failure should be impossible.
+ * Where the language has a cheap exact check, it is used anyway - being sure costs 40 milliseconds.
+ */
+function stillParses(full) {
+    if (!/\.(js|cjs|mjs)$/i.test(full))
+        return true;
+    const checked = spawnSync(process.execPath, ['--check', full], { encoding: 'utf8', timeout: 20_000 });
+    return checked.status === 0;
+}
+/**
+ * Proves what the tests covering `file` would and would not catch.
+ *
+ * `covering` is decided by the caller, from which tests really import the file: a test matched only
+ * by its name might not exercise the code at all, and running it would produce a confident answer
+ * about nothing.
+ */
+/**
+ * Do the tests actually load this file?
+ *
+ * They may not, and the first Python project this met proved it: in a src-layout repository `import
+ * humanize` resolved to a different checkout entirely, so editing `src/humanize/filesize.py` changed
+ * nothing the tests ran. Every mutant survived and the report said five changes went unnoticed - a
+ * confident, completely false accusation against a suite that is in fact thorough.
+ *
+ * So before any survival is believed, the file is broken on purpose in a way nothing can survive, and
+ * a covering test is run. If it still passes, the tests are reading some other copy - an installed
+ * package, a build output, a stale bundle - and the honest answer is to say so and stop. This is the
+ * same control the write gate uses: a check that cannot fail proves nothing, and neither does a test
+ * that cannot see the code.
+ */
+function testsLoadIt(root, full, original, test, framework, runMs) {
+    const control = /\.py$/i.test(full)
+        ? `raise RuntimeError("tewip control")${String.fromCharCode(10)}${original}`
+        : /\.(js|cjs|mjs|ts|tsx|mts|cts|jsx)$/i.test(full)
+            ? `throw new Error("tewip control");${String.fromCharCode(10)}${original}`
+            : `!!tewip-control!!${String.fromCharCode(10)}${original}`;
+    try {
+        writeFileSync(full, control, 'utf8');
+        return !runTest(framework, resolve(root, test), runMs).passed;
+    }
+    finally {
+        restore(full, original);
+    }
+}
+export function proveFile(root, file, covering, framework, opts = {}) {
+    const started = Date.now();
+    const limit = opts.limit ?? 6;
+    const budget = (opts.budgetSeconds ?? 600) * 1000;
+    const runMs = (opts.runSeconds ?? 180) * 1000;
+    const say = opts.onStep ?? (() => { });
+    const full = resolve(root, file);
+    const proof = { file, covering, tried: [], blocked: '', setAside: [], notTried: 0, seconds: 0 };
+    if (covering.length === 0) {
+        proof.blocked = 'no test imports this file, so no test could notice any change to it. That is the finding: this code is not covered by anything Tewip can name.';
+        return finish(proof, started);
+    }
+    const original = readFileSync(full, 'utf8');
+    const mutants = mutantsFor(original, limit);
+    if (mutants.length === 0) {
+        proof.blocked = 'nothing in this file could be changed in a way a test should be expected to catch - no comparison, no condition, no returned value outside of strings and comments';
+        return finish(proof, started);
+    }
+    // A test has to pass before it can be asked to notice anything, or a red suite turns into "your
+    // tests catch nothing", which is the worst kind of lie this command could tell.
+    //
+    // One bad file does not stop the answer, though. In python-humanize six test files cover
+    // filesize.py and one of them needs a pytest plugin that is not installed - refusing the whole
+    // question over that told the developer nothing, while the other five were ready to answer it. So
+    // the ones that cannot run are set aside by name, and only an empty list blocks.
+    const usable = [];
+    for (const test of covering) {
+        say(`checking ${test} passes as it is`);
+        const before = runTest(framework, resolve(root, test), runMs);
+        if (before.passed)
+            usable.push(test);
+        else
+            proof.setAside.push({ test, why: before.environment ? `the runner broke: ${firstLine(before.output)}` : before.skipped ? 'every test in it was skipped' : 'it does not pass as it is' });
+    }
+    if (usable.length === 0) {
+        proof.blocked = `none of the ${covering.length} test file(s) covering this pass as they are, so none can be asked whether they would notice a change. Fix the run first.`;
+        return finish(proof, started);
+    }
+    proof.covering = usable;
+    // The control: break the file outright and check that a covering test notices. Without this, a file
+    // the tests never load would produce a full report of things they "failed to catch".
+    say('checking the tests really load this file');
+    if (!testsLoadIt(root, full, original, usable[0], framework, runMs)) {
+        proof.blocked = `${usable[0]} passes even when this file is made unusable, so the tests are not loading the file that was edited - they are reading an installed copy or a build output. Nothing here can be proved until they run against this source (for a Python src layout, install it in editable mode: pip install -e .).`;
+        return finish(proof, started);
+    }
+    // Only the tests that pass may judge a mutant. A test that is already failing fails for every
+    // change too, which would have it "catch" everything - the exact false confidence this command
+    // exists to remove. It reported five catches by a set-aside file once; never again.
+    for (const mutant of mutants) {
+        if (Date.now() - started > budget) {
+            proof.notTried = mutants.length - proof.tried.length;
+            break;
+        }
+        const at = Date.now();
+        say(`${mutant.kind}, line ${mutant.line}`);
+        let fate = 'unnoticed';
+        let noticedBy = '';
+        try {
+            writeFileSync(full, applyMutant(original, mutant), 'utf8');
+            if (!stillParses(full)) {
+                fate = 'did-not-compile';
+            }
+            else {
+                for (const test of usable) {
+                    const result = runTest(framework, resolve(root, test), runMs);
+                    if (result.environment) {
+                        fate = 'runner-broke';
+                        break;
+                    }
+                    // A failing test is a test that noticed, whatever it printed. An exception thrown by the
+                    // changed code is the suite catching the change, not an excuse to discard the mutant.
+                    if (!result.passed) {
+                        fate = 'noticed';
+                        noticedBy = test;
+                        break;
+                    }
+                }
+            }
+        }
+        catch (error) {
+            fate = 'did-not-compile';
+            noticedBy = error instanceof Error ? error.message.slice(0, 120) : '';
+        }
+        finally {
+            restore(full, original);
+        }
+        proof.tried.push({ mutant, fate, noticedBy, seconds: Math.round((Date.now() - at) / 100) / 10 });
+    }
+    return finish(proof, started);
+}
+/**
+ * Puts the file back and checks that it really went back. Anything less would mean this command can
+ * leave somebody's source broken, which would make it unusable however good its answers were.
+ */
+function restore(full, original) {
+    writeFileSync(full, original, 'utf8');
+    if (readFileSync(full, 'utf8') !== original) {
+        throw new Error(`${full} could not be put back as it was. Check it before doing anything else: git checkout -- "${full}"`);
+    }
+}
+const finish = (proof, started) => ({ ...proof, seconds: Math.round((Date.now() - started) / 1000) });
+const firstLine = (output) => output.split(String.fromCharCode(10)).map((l) => l.trim()).find(Boolean)?.slice(0, 160) ?? '';
+/** Which of the tests that cover a file really import it, and so could notice a change. */
+export function importingTests(root, coverage, file) {
+    const wanted = file.split('\\').join('/');
+    return coverage
+        .filter((c) => c.how !== 'name' && c.covers.some((covered) => covered.split('\\').join('/') === wanted))
+        .map((c) => relative(root, join(root, c.testFile)).split('\\').join('/'));
+}

package/dist/engine/prove/reaches.js

@@ -0,0 +1,102 @@
+// Which tests reach a file, following imports further than one step.
+//
+// This exists because the first honest run of `tewip prove` on Tewip's own code answered "no test
+// imports this file, so nothing could notice a change" - about a file with 25 tests behind it. They
+// import `vouch.ts`, which imports `assertions.ts`, and one step of import-following cannot see that.
+// In any codebase with layers, most files are reached through another module, so a prover that only
+// understands direct imports says "not covered" about nearly everything and is worthless.
+//
+// The chain is followed outwards from the file, not inwards from the tests, because the answer needed
+// is "who would notice if this changed" and that is what a reverse import graph gives.
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { join, relative, resolve } from 'node:path';
+import { importNames, importsIt } from '../review/coverage.js';
+const SKIP_DIR = new Set(['node_modules', '.git', 'dist', 'build', 'out', 'coverage', 'target', 'vendor', '__pycache__', '.venv', 'venv', '.tewip', '.next']);
+const SOURCE = /\.(?:[cm]?[jt]sx?|py|go|java|kt|cs|rb)$/i;
+/** Every source file here, so "who imports this" can be answered without a build system. */
+function sourceFiles(root, limit = 6000) {
+    const out = [];
+    const walk = (dir) => {
+        if (out.length >= limit)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(dir);
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const path = join(dir, entry);
+            let info;
+            try {
+                info = statSync(path);
+            }
+            catch {
+                continue;
+            }
+            if (info.isDirectory()) {
+                if (!SKIP_DIR.has(entry))
+                    walk(path);
+            }
+            else if (SOURCE.test(entry))
+                out.push(path);
+        }
+    };
+    walk(root);
+    return out;
+}
+/**
+ * The tests that reach `file`, directly or through up to `depth` modules.
+ *
+ * Every hop is a real import found in the source, so this stays a fact rather than a guess - the
+ * distinction the rest of Tewip keeps. It stops at the first depth that finds anything: a test one
+ * step away is a better witness than fifty tests four steps away, and running fifty test files to
+ * answer one question is how a command becomes too slow to use.
+ */
+export function testsReaching(root, file, tests, depth = 3) {
+    const all = sourceFiles(root);
+    const text = new Map();
+    const read = (path) => {
+        if (!text.has(path)) {
+            try {
+                text.set(path, readFileSync(path, 'utf8'));
+            }
+            catch {
+                text.set(path, '');
+            }
+        }
+        return text.get(path);
+    };
+    const rel = (path) => relative(root, path).split(String.fromCharCode(92)).join('/');
+    const testSet = new Set(tests.map((t) => rel(resolve(root, t))));
+    const seen = new Set([rel(resolve(root, file))]);
+    // What the chain is: layer 0 is the file, layer 1 the modules importing it, and so on.
+    let layer = [file];
+    for (let step = 1; step <= depth; step += 1) {
+        const names = layer.flatMap((f) => (existsSync(resolve(root, f)) ? importNames(root, f) : []));
+        if (names.length === 0)
+            break;
+        const found = [];
+        const next = [];
+        for (const path of all) {
+            const where = rel(path);
+            if (seen.has(where))
+                continue;
+            if (!importsIt(read(path), names))
+                continue;
+            seen.add(where);
+            if (testSet.has(where))
+                found.push({ testFile: where, steps: step, via: layer.length === 1 ? layer[0] : `${layer[0]} and ${layer.length - 1} more` });
+            else
+                next.push(where);
+        }
+        // Something at this distance can see the change: stop, rather than dragging in the whole tree.
+        if (found.length > 0)
+            return found;
+        if (next.length === 0)
+            break;
+        layer = next;
+    }
+    return [];
+}

package/dist/engine/pursue/act.js

@@ -23,6 +23,7 @@ export const cannotAct = {
     'rerun-environment': 'a re-run belongs to whatever runs the tests, not to Tewip',
     'settle-flaky': 'settling a flaky test changes a test file, which Tewip does only when asked directly with `tewip fix`',
     'triage-undecided': 'Tewip cannot say why these failed, so it has nothing it could safely do about them',
+    'triage-vacuous-test': 'a test that cannot fail is for a person to decide about: making it check something changes what the test means, and guessing at what it was meant to check is how a suite quietly stops testing anything',
     'cover-gap': '',
     attest: '',
     'stand-down': 'there is nothing here that matches the goal',

package/dist/engine/pursue/policy.js

@@ -62,6 +62,20 @@ export function decide(goal, seen) {
             changesFiles: false,
         };
     }
+    // Nothing is failing, so the goal looks met. Before believing that, ask whether the tests that
+    // say so could ever have said otherwise. This comes before the coverage gap on purpose: a missing
+    // test is honest about being missing, while a test that cannot fail reads as coverage and is
+    // counted as coverage, so it is the more misleading of the two.
+    const vacuous = seen.vacuous ?? [];
+    if (vacuous.length > 0) {
+        return {
+            act: 'triage-vacuous-test',
+            next: `put ${vacuous.length} test(s) that cannot fail in front of a person: ${list(vacuous.map((v) => v.name))}`,
+            why: `nothing the goal depends on is failing, but ${vacuous.length === 1 ? 'one of the tests saying so could never have said otherwise' : `${vacuous.length} of the tests saying so could never have said otherwise`}, so the green result does not mean what it looks like`,
+            evidence: vacuous.slice(0, 5).map((v) => `${v.name} (${v.file}:${v.line}): ${v.why}`),
+            changesFiles: false,
+        };
+    }
     if (seen.uncovered.length > 0) {
         const first = seen.uncovered[0];
         return {

package/dist/engine/pursue/pursue-command.js

@@ -10,6 +10,8 @@ import { dirname, join, resolve } from 'node:path';
 import { datasetFiles, readJsonl, readTriageRecords } from '../../reporters/store.js';
 import { alreadyTried, cannotAct, planFor } from './act.js';
 import { decide } from './policy.js';
+import { CANNOT_FAIL } from '../vouch/vouch.js';
+import { vouchAll } from '../vouch/vouch-command.js';
 const words = (text) => (text.toLowerCase().match(/[a-z][a-z0-9]{2,}/g) ?? []).filter((w) => !['the', 'and', 'for', 'this', 'that', 'with', 'keep', 'green', 'sprint', 'flow', 'test', 'tests'].includes(w));
 /** Does this test or scenario belong to the goal? Deterministic, so a person can predict it. */
 function about(goal, text) {
@@ -56,8 +58,28 @@ export function observe(root, goal, only) {
         passing: attempted.length - failing.length,
         noHistory: runs.length === 0,
         runId: newest?.runId ?? '',
+        vacuous: vacuousTests(root, wanted),
     };
 }
+/**
+ * Tests covering this goal that could never fail, read from the files themselves.
+ *
+ * Only the verdicts that mean a test truly cannot fail are collected. A test that compares no value
+ * is left out here on purpose: it fails when the code throws, it is often meant to, and stopping an
+ * agent's whole goal over one would make this branch something people route around.
+ */
+function vacuousTests(root, goal) {
+    try {
+        const found = vouchAll(root, ['.']);
+        return found
+            .flatMap((file) => file.judgements)
+            .filter((j) => CANNOT_FAIL.includes(j.verdict) && about(goal, `${j.file} ${j.name}`))
+            .map((j) => ({ name: j.name, file: j.file, line: j.line, why: j.why }));
+    }
+    catch {
+        return []; // an unreadable tree is not a tree full of worthless tests
+    }
+}
 /** Scenarios of a kept plan that no attempted test can be matched to, worst priority first. */
 function uncoveredScenarios(root, goal, attempted) {
     const dir = join(root, '.tewip', 'plans');
@@ -108,7 +130,7 @@ export function renderPursuit(goal, seen, decision, acting) {
         ? acting
             ? 'This changes files, so it runs through the gate that proves a change before keeping it: anything unproved is thrown away.'
             : 'This would change files, so Tewip has not done it. Run the command it names, or pass `--act`.'
-        : 'Tewip has not done anything: this is a decision, and the action is yours.', '', 'The order of these decisions is fixed and written down, not chosen by a model: a real bug first,', 'then the environment, then flakiness, then a coverage gap, and only then is a goal worth attesting.');
+        : 'Tewip has not done anything: this is a decision, and the action is yours.', '', 'The order of these decisions is fixed and written down, not chosen by a model: a real bug first,', 'then the environment, then flakiness, then anything failing it cannot explain, then a test that', 'cannot fail, then a coverage gap, and only then is a goal worth attesting.');
     return lines.join('\n');
 }
 /** The audit file the team owns: every action Tewip took on its own, and every one it refused. */

package/dist/engine/quality/frameworks.js

@@ -116,8 +116,41 @@ function jsFrameworks(dir, deps) {
         out.push({ id, label, browser, cwd: dir, testDir: example ? dirname(example) : join(dir, 'test'), example, fileFor: sameSuffix(example, '.test.ts', /\.(spec|test)\.[mc]?[jt]sx?$/), command: (f) => `${run} ${q(relative(dir, f).replaceAll('\\', '/'))}`, suite: run });
         break;
     }
+    // Mocha, and Node's own test runner. Both were missing, and their absence was not a small gap:
+    // express and a great deal of the JavaScript world run on Mocha, `node --test` needs no dependency
+    // at all and is what this project's own suite uses - so Tewip could not write, fix or prove a test
+    // in its own repository. A runner is only "supported" if it is detected.
+    if (out.length === 0) {
+        const anyTest = testFiles(dir, /\.(spec|test)\.[mc]?[jt]sx?$|[\/]test[\/].*\.[mc]?js$/)[0] ?? null;
+        const mocha = /"mocha"\s*:/.test(deps);
+        const nodeTest = !mocha && (/node\s+--test/.test(deps) || (anyTest !== null && /require\(['"]node:test['"]\)|from\s+['"]node:test['"]/.test(readIfThere(anyTest))));
+        if (mocha || nodeTest) {
+            const id = mocha ? 'mocha' : 'node';
+            const run = mocha ? 'npx mocha' : 'node --test';
+            out.push({
+                id,
+                label: mocha ? 'Mocha (JavaScript/TypeScript)' : "Node's own test runner (JavaScript/TypeScript)",
+                browser: false,
+                cwd: dir,
+                testDir: anyTest ? dirname(anyTest) : join(dir, 'test'),
+                example: anyTest,
+                fileFor: sameSuffix(anyTest, '.test.js', /\.(spec|test)\.[mc]?[jt]sx?$/),
+                command: (f) => `${run} ${q(relative(dir, f).split(String.fromCharCode(92)).join('/'))}`,
+                suite: run,
+            });
+        }
+    }
     return out;
 }
+/** A file's text, or nothing: used only to recognise a runner from how a test imports it. */
+function readIfThere(file) {
+    try {
+        return readFileSync(file, 'utf8').slice(0, 4000);
+    }
+    catch {
+        return '';
+    }
+}
 /** The project's own Python (its virtual environment) when it has one, else the one on the PATH. */
 function pythonOf(dir) {
     for (const env of ['.venv', 'venv', 'env']) {

package/dist/engine/quality/write-verify.js

@@ -34,6 +34,17 @@ function pageAtFailure(output, cwd) {
  * run is tried again, and if it keeps breaking, the environment is named, never the test.
  */
 const RUNNER_BROKE = /has not captured in \d+ ?ms|failed \d+ times \(timeout\)\. Giving up|Disconnected[, ].{0,40}because no message|No captured browser|EADDRINUSE|Timed out waiting \d+ms from config\.webServer|webServer.{0,60}(?:exited|timed out)|ENOSPC|spawnSync .* ETIMEDOUT/i;
+/**
+ * The environment for a test run. NODE_TEST_CONTEXT is removed: a `node --test` child that inherits
+ * it reports as a subtest of whatever spawned it instead of by its own exit code, so a failing run
+ * looks like a passing one. That has already cost this project once, in the auto-fix gate, and it
+ * matters wherever Tewip runs a test runner from inside one.
+ */
+function childEnv(extra) {
+    const env = { ...process.env, ...extra };
+    delete env.NODE_TEST_CONTEXT;
+    return env;
+}
 export function runTest(framework, file, timeoutMs = 180_000) {
     let result = runOnce(framework, file, timeoutMs);
     for (let retry = 0; retry < 2 && !result.passed && RUNNER_BROKE.test(result.output); retry++)
@@ -43,7 +54,7 @@ export function runTest(framework, file, timeoutMs = 180_000) {
     return result;
 }
 function runOnce(framework, file, timeoutMs) {
-    const r = spawnSync(framework.command(file), { cwd: framework.cwd, env: { ...process.env, ...framework.env }, shell: true, encoding: 'utf8', timeout: timeoutMs, maxBuffer: 20 * 1024 * 1024 });
+    const r = spawnSync(framework.command(file), { cwd: framework.cwd, env: childEnv(framework.env), shell: true, encoding: 'utf8', timeout: timeoutMs, maxBuffer: 20 * 1024 * 1024 });
     // Colour codes are noise to a reader and would stop a quoted line from matching.
     const output = `${r.stdout ?? ''}\n${r.stderr ?? ''}${r.error ? `\n${r.error.message}` : ''}`.replace(/\u001b\[[0-9;]*[A-Za-z]/g, '').trim();
     if (r.status === 0 && onlySkipped(output))

package/dist/engine/review/coverage.js

@@ -8,6 +8,29 @@ import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { basename, dirname, extname, join, relative, resolve, sep } from 'node:path';
 const TEST_FILE = /(?:\.|_)(?:spec|test)\.[cm]?[jt]sx?$|(?:^|[\\/])test_[^\\/]+\.py$|_test\.py$|_test\.go$|Test(?:s)?\.(?:java|kt|cs)$|\.cy\.[jt]sx?$|\.feature$|\.robot$/i;
 const SKIP_DIR = new Set(['node_modules', '.git', 'dist', 'build', 'out', 'coverage', 'target', 'vendor', '__pycache__', '.venv', 'venv', '.tewip', '.next']);
+/**
+ * A test file that does not say so in its name.
+ *
+ * Mocha's convention - and most of the JavaScript world before ~2018 - is `test/utils.js`, with no
+ * suffix at all. Requiring `.test.js` meant every Mocha project looked like a project with no tests:
+ * express has 88 of them, and Tewip reported that nothing covered any file in it. The name is checked
+ * first because it is free; only a file already sitting in a test folder is opened to be sure.
+ */
+function declaresTests(dir, path) {
+    const where = dir.split(String.fromCharCode(92)).join('/');
+    if (!/(?:^|\/)(?:tests?|spec|specs|__tests__)(?:\/|$)/i.test(where))
+        return false;
+    if (/(?:^|\/)(?:fixtures?|support|helpers?|mocks?|__mocks__|data|snapshots?)(?:\/|$)/i.test(where))
+        return false;
+    if (!/\.(?:[cm]?[jt]sx?|py)$/i.test(path))
+        return false;
+    try {
+        return /\b(?:describe|it|test|context|suite)\s*\(|^\s*def\s+test_/m.test(readFileSync(path, 'utf8').slice(0, 8000));
+    }
+    catch {
+        return false;
+    }
+}
 /** Every test file in the project. */
 export function testFiles(root, limit = 4000) {
     const out = [];
@@ -34,7 +57,7 @@ export function testFiles(root, limit = 4000) {
                 if (!SKIP_DIR.has(entry))
                     walk(path);
             }
-            else if (TEST_FILE.test(entry))
+            else if (TEST_FILE.test(entry) || declaresTests(dir, path))
                 out.push(path);
         }
     };
@@ -47,7 +70,7 @@ export function testFiles(root, limit = 4000) {
  */
 export const isCode = (file) => /\.(?:[cm]?[jt]sx?|py|rb|go|java|kt|cs|php|rs|vue|svelte|scala|swift|sql)$/i.test(file) && !/(?:^|[\/])(?:package-lock\.json|yarn\.lock)$/i.test(file);
 /** The module names a file can be imported by: its path, its name, and its folder's front door. */
-function importNames(root, changed) {
+export function importNames(root, changed) {
     const full = resolve(root, changed);
     const noExt = full.slice(0, full.length - extname(full).length);
     const names = new Set([basename(noExt), relative(root, noExt).split(sep).join('/')]);
@@ -94,8 +117,8 @@ function packageNames(root, changed) {
     }
     return [...new Set(out)].filter(Boolean);
 }
-/** Does this test's source import that changed file? */
-function importsIt(source, names) {
+/** Does this source import that file? Exported so the prover can follow imports further. */
+export function importsIt(source, names) {
     for (const name of names) {
         const quoted = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
         const patterns = [

package/dist/engine/review/review-command.js

@@ -8,6 +8,7 @@ import { coverageFor, uncovered } from './coverage.js';
 import { renderReview, reviewChange } from './review.js';
 import { changedExpectations } from './expectations.js';
 import { changedAgreements } from './agreements.js';
+import { changedTestLines, vouchChanged } from '../vouch/changed.js';
 /** Every failure Tewip has diagnosed in this project, from the history it keeps. */
 function history(root, only) {
     const dir = join(root, '.tewip', 'history');
@@ -33,7 +34,10 @@ export async function runReview(cmd) {
     const framework = chooseFramework(detectFrameworks(cmd.root), undefined, false) ?? detectFrameworks(cmd.root)[0] ?? null;
     const ownsThem = framework ? review.runFirst.some((f) => resolve(cmd.root, f).startsWith(resolve(framework.testDir))) : false;
     const runCommand = framework && ownsThem ? (chosen) => chosen.map((f) => framework.command(resolve(cmd.root, f))).join(' && ') : undefined;
-    const report = renderReview(review, runCommand);
+    // Whether the tests in this change could ever fail. Costs nothing, calls no model, and is the one
+    // question an agent-written diff most needs asked of it.
+    const vouched = changedTestLines(vouchChanged(cmd.root, files));
+    const report = [renderReview(review, runCommand), ...(vouched.length > 0 ? ['', ...vouched] : [])].join(String.fromCharCode(10));
     console.log(report);
     if (past.length === 0) {
         console.log('\nNo failure history yet, so the "what has gone wrong here before" part is empty. It fills itself: run `tewip explain` or `tewip report` on your CI reports and every later review knows more.');

package/dist/engine/vouch/changed.js

@@ -0,0 +1,58 @@
+// Vouching for the tests a change touched, rather than for a whole repository.
+//
+// This is where the question actually pays off. Nobody runs a checker over 5,000 existing tests, but
+// every pull request now arrives with tests an agent wrote, and the reviewer has minutes. So the
+// review and the CI comment ask only about the test files in the diff, and say nothing at all when
+// there is nothing to say - a section that appears on every PR to report "all fine" is a section
+// people learn to scroll past.
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { CANNOT_FAIL, vouchFile } from './vouch.js';
+export function vouchChanged(root, changed) {
+    const out = { files: 0, read: 0, cannotFail: [], crashOnly: [] };
+    for (const file of changed) {
+        const full = join(root, file);
+        if (!existsSync(full))
+            continue; // deleted in this change, so there is nothing to read
+        let text;
+        try {
+            text = readFileSync(full, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        const vouched = vouchFile(file.split('\\').join('/'), text);
+        if (vouched.judgements.length === 0)
+            continue;
+        out.files += 1;
+        out.read += vouched.judgements.length;
+        out.cannotFail.push(...vouched.judgements.filter((j) => CANNOT_FAIL.includes(j.verdict)));
+        out.crashOnly.push(...vouched.judgements.filter((j) => j.verdict === 'crash-only'));
+    }
+    return out;
+}
+/**
+ * The section for a review or a PR comment. Empty when every test in the change can fail: silence is
+ * the right report, and it keeps the finding worth reading when it does appear.
+ */
+export function changedTestLines(seen) {
+    if (seen.cannotFail.length === 0 && seen.crashOnly.length === 0)
+        return [];
+    const lines = [`## Tests in this change that cannot fail (${seen.cannotFail.length} of ${seen.read})`, ''];
+    if (seen.cannotFail.length === 0)
+        lines.length = 0;
+    for (const j of seen.cannotFail.slice(0, 10)) {
+        lines.push(`- **${j.name}** — \`${j.file}:${j.line}\``);
+        if (j.evidence)
+            lines.push(`  - \`${j.evidence.replace(/`/g, "'")}\``);
+        lines.push(`  - ${j.why}`);
+    }
+    if (seen.cannotFail.length > 10)
+        lines.push(`- …and ${seen.cannotFail.length - 10} more`);
+    if (seen.cannotFail.length > 0)
+        lines.push('', 'A test that cannot fail still passes and still counts as coverage.', '');
+    if (seen.crashOnly.length > 0) {
+        lines.push(`## Tests in this change that compare no value (${seen.crashOnly.length})`, '', 'These fail if the code throws and pass whatever it returns. Sometimes that is the intention.', '', ...seen.crashOnly.slice(0, 8).map((j) => `- ${j.name} — \`${j.file}:${j.line}\``), ...(seen.crashOnly.length > 8 ? [`- …and ${seen.crashOnly.length - 8} more`] : []), '');
+    }
+    return lines;
+}

package/dist/mcp/server.js

@@ -137,4 +137,22 @@ server.registerTool('vouch_tests', {
     const { vouchReport } = await import('../engine/vouch/run-vouch.js');
     return vouchReport(root, paths && paths.length > 0 ? paths : ['.']).report;
 }));
+server.registerTool('prove_tests_catch_bugs', {
+    title: 'Would the tests catch a bug here?',
+    description: "Breaks one source file in small, deliberate ways - a boundary moved by one, a condition inverted, an and that became an or, a returned flag flipped - runs the tests that reach that file, and reports every change none of them noticed. This is execution, not opinion: the line was covered, it just was not checked. Slow by nature (each change means a real test run, so expect minutes) and it needs a unit test framework. The file is always put back exactly as it was, and if the tests turn out not to load the file at all it says so instead of reporting false holes. Use it after writing or changing code, to find out whether the tests you are relying on would have stopped a mistake.",
+    inputSchema: {
+        project,
+        file: z.string().describe('One source file, relative to the project, e.g. src/pricing.js'),
+        limit: z.number().optional().describe('How many changes to try (default 6). More is a better answer and a longer wait.'),
+        budgetSeconds: z.number().optional().describe('Total seconds to spend before stopping and saying how many were left (default 600)'),
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+}, ({ project: root, file, limit, budgetSeconds }) => answer(async () => {
+    if (!isAbsolute(root) || !existsSync(root))
+        throw new Error(`project must be an existing absolute path, got "${root}"`);
+    // runProve prints its report; over MCP the report is the return value and printing would corrupt
+    // the protocol, so the pieces are called directly.
+    const { proveOne } = await import('../engine/prove/prove-command.js');
+    return proveOne(root, file, { limit, budgetSeconds });
+}));
 await server.connect(new StdioServerTransport());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [
     "test-failures",