testguard-cli 0.13.0__tar.gz → 0.14.0__tar.gz

{testguard_cli-0.13.0 → testguard_cli-0.14.0}/CHANGELOG.md

@@ -7,6 +7,93 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.14.0] - 2026-09-22
+
+Automated weekly release — everything merged since `v0.13.0`.
+
+### Changed
+
+- fix: three defects the arid measurement found, presentational JSX set aside, and the claimspec signal bump (#164)
+- docs: carry the 0.12 and 0.13 results into the brief and the prior-art record (#162)
+- chore(homebrew): sha256 for v0.13.0 (#161)
+
+
+### Added
+
+- **claimspec v1 evidence admits `persistence-payload-unasserted`** to
+  `defenders.signals`, the enum shared with every claimspec consumer. The
+  signal had lived only in the sweep document, so `probe` could not surface
+  why a save-path survivor was missed. Now a `survived` record whose fault
+  sits on the write path carries it for each resolved defender that mocks the
+  persistence layer, with the mocked `specifiers` and the file's assertion
+  `counts` (exact, partial, argument-free). The validator refuses it on any
+  other verdict, on a file that is not a resolved defender, or without its
+  reason — the same rule the sweep document already enforced on its
+  findings, and the sweep now repeats what the record says rather than
+  re-deriving it. Conformance carries a valid example and three invalid
+  cases. No consumer outside this repository validates claimspec evidence
+  today; DocGuard's adoption (docguard#420) is notified rather than broken.
+- `sweep` sets aside a purely presentational JSX element — an icon, or a
+  static wrapper with no expression and no handler — instead of spending a
+  probe run on it, and says so: `selection.presentational` in the document, a
+  line in the report, and the remainder arithmetic now proves
+  proposed = probed + deferred + set aside. Measured on a 14-file UI diff:
+  150 of 510 proposals, 29 of 30 probe slots and 7 of 10 survivors were of
+  this shape — Google's definition of an arid node, in a syntax Google never
+  mutated. Because the ordering learns from survival, those survivors were
+  also teaching it to rank the class higher; set-aside proposals never enter
+  the evidence, so they no longer can. Google's own five arid categories were
+  measured at under 1% of proposals and are not suppressed.
+
+### Fixed
+
+- Python defender discovery lost the last name on an import line that ends in
+  a comment: `from pkg import cli, demo  # noqa: E402` found only `cli`, and
+  `import pkg.demo  # noqa` found nothing. On a real suite where `# noqa` is
+  the idiom of every src-layout test, 12 of 30 probed faults were reported
+  NOCOVER for modules whose tests import them — a gating verdict in the
+  forbidden direction. Comments are now stripped before names are read.
+- File walking descended into `.claude/`, so a nested agent worktree under
+  `.claude/worktrees/` contributed another branch's tests as defenders of this
+  tree — files the scratch worktree cannot even contain, because the directory
+  is gitignored. `.claude` joins the tool-directory skip list, and the claim
+  that promised this now names it.
+- The Python `statement-deleted` producer proposed on lines inside a bracket
+  opened earlier — `help="…")` inside an `add_argument(` — and none of those
+  faults compiled: 81 of 600 proposals on a real CLI (13.5%). The producer now
+  tracks bracket depth across lines (triple-quoted strings included, so a
+  docstring's parentheses cannot leave the rest of the file "inside") and
+  refuses the `pass` shapes there; dict entries and call arguments keep their
+  own producers. Re-measured: 7 of 526 (1.3%).
+
+### Changed
+
+- The self-probe cost budget is 1650 s, from 1440. Six new claims (85 s on
+  the Node 22 PR leg, worst 22 s, all under the 100 s per-claim ceiling) took
+  that leg from 1367 s to 1457 s, over by 17 s. The v0.13.0 release job
+  measured 1113 s from scratch, but the PR leg runs the same claims 25-30%
+  slower and is where the ceiling is checked, so 1650 restores ~13% headroom
+  over the leg that binds. The per-claim ceiling is unchanged.
+- The technical brief carries the 0.12 and 0.13 results it was missing: the
+  whole-surface provability measurement (32 of 37 files that write are defended
+  only by tests that mock the database) replaces the sample-level number in
+  Fig. 7; the ladder's second rung is now a shipped verb with a real finding
+  (a five-line concern found an admin route whose owner/manager check can be
+  forced to `false` with no test failing) rather than a description of intent;
+  and the first rung says its ordering learns from the project's own runs.
+  Re-rendered; still eight sheets from eight pages.
+- `docs-canonical/PRIOR-ART.md` records the arid-node measurement instead of
+  a promise: every proposal from four sweeps over two of the maintainer's
+  repositories was classified by hand against Google's five arid categories,
+  and they account for under 1% of what the producers propose. No suppressor
+  is built for them. The same pass found what IS material — presentational
+  JSX taking 29 of 30 probe slots on a UI diff, and 13.5% of Python proposals
+  that cannot compile — and lists both as open, with numbers.
+- `docs-canonical/PRIOR-ART.md` no longer lists the feedback loop and concerns
+  as unbuilt. The two gaps that remain are restated precisely: the loop learns
+  from verdicts rather than explicit developer clicks, and concerns have no
+  model-backed producer.
+
 ## [0.13.0] - 2026-09-22
 
 Automated weekly release — everything merged since `v0.12.0`.

{testguard_cli-0.13.0 → testguard_cli-0.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: testguard-cli
-Version: 0.13.0
+Version: 0.14.0
 Summary: Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest. Ships the Node.js CLI (requires Node.js 20+).
 Project-URL: Homepage, https://github.com/raccioly/testguard
 Project-URL: Documentation, https://github.com/raccioly/testguard#readme
@@ -151,9 +151,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.13.0` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.14.0` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.13.0/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.14.0/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -258,6 +258,10 @@ npx testguard-cli admit test/x.test.ts --claim X   # is this test green on HEAD
    static signal `mocked-never-asserted` — the cheapest blind-spot signal
    there is, and the exact signature of one escaped bug in the field
    reports. Silence it, visibly, with `// unasserted: <why>` above the mock.
+   Its sibling `persistence-payload-unasserted` is attached to a **survivor
+   on a write path** whose defender mocks the database: the test can prove
+   the call shape and never that the row landed, and the signal names the
+   mocked layer and the file's assertion mix (exact, partial, argument-free).
 
    Runners: **vitest**, **jest**, **Playwright** and **Python** (`--runner
    auto` picks the first of vitest, jest, python that resolves). A JavaScript
@@ -447,8 +451,9 @@ alarming: something was deliberately broken and not one test failed.
 
 ```
 swept 13 of 14 unclaimed changed files against origin/main.
-proposed 510 faults, probed 10 (cap 10), deferred 500.
-  The 500 deferred are not a verdict: raise --cap, or sweep a smaller change.
+proposed 510 faults, probed 10 (cap 10), deferred 350.
+  The 350 deferred are not a verdict: raise --cap, or sweep a smaller change.
+  150 presentational elements (icons, static wrappers) set aside: nobody writes a test for those, and a survivor there would teach the ordering the wrong lesson.
 
 9 findings — a deliberate break that no test noticed:
 
@@ -682,12 +687,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.13.0
+- uses: raccioly/testguard@v0.14.0
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.13.0/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.14.0/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 
@@ -1005,7 +1010,8 @@ parameter-derived argument swapped for `None`, a key dropped from a payload
 `dict` or an allow-list. Two differences are deliberate. A statement is
 removed by replacing it with `pass`, never by deleting the line, because a
 block whose only statement is gone is an `IndentationError`; and a line that
-leaves a bracket open (`COLOURS = {`) is never removed at all. Both exist
+leaves a bracket open (`COLOURS = {`), or sits inside one opened on an earlier
+line (`help="…"` in an `add_argument(`), is never removed at all. Both exist
 because a fault that cannot compile is a `fault-invalid` verdict — a probe run
 spent saying nothing about the tests. The two JSX shapes (`element-removed`,
 `handler-dropped`) have no Python meaning and are absent rather than faked.

{testguard_cli-0.13.0 → testguard_cli-0.14.0}/README.md

@@ -127,9 +127,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.13.0` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.14.0` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.13.0/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.14.0/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -234,6 +234,10 @@ npx testguard-cli admit test/x.test.ts --claim X   # is this test green on HEAD
    static signal `mocked-never-asserted` — the cheapest blind-spot signal
    there is, and the exact signature of one escaped bug in the field
    reports. Silence it, visibly, with `// unasserted: <why>` above the mock.
+   Its sibling `persistence-payload-unasserted` is attached to a **survivor
+   on a write path** whose defender mocks the database: the test can prove
+   the call shape and never that the row landed, and the signal names the
+   mocked layer and the file's assertion mix (exact, partial, argument-free).
 
    Runners: **vitest**, **jest**, **Playwright** and **Python** (`--runner
    auto` picks the first of vitest, jest, python that resolves). A JavaScript
@@ -423,8 +427,9 @@ alarming: something was deliberately broken and not one test failed.
 
 ```
 swept 13 of 14 unclaimed changed files against origin/main.
-proposed 510 faults, probed 10 (cap 10), deferred 500.
-  The 500 deferred are not a verdict: raise --cap, or sweep a smaller change.
+proposed 510 faults, probed 10 (cap 10), deferred 350.
+  The 350 deferred are not a verdict: raise --cap, or sweep a smaller change.
+  150 presentational elements (icons, static wrappers) set aside: nobody writes a test for those, and a survivor there would teach the ordering the wrong lesson.
 
 9 findings — a deliberate break that no test noticed:
 
@@ -658,12 +663,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.13.0
+- uses: raccioly/testguard@v0.14.0
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.13.0/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.14.0/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 
@@ -981,7 +986,8 @@ parameter-derived argument swapped for `None`, a key dropped from a payload
 `dict` or an allow-list. Two differences are deliberate. A statement is
 removed by replacing it with `pass`, never by deleting the line, because a
 block whose only statement is gone is an `IndentationError`; and a line that
-leaves a bracket open (`COLOURS = {`) is never removed at all. Both exist
+leaves a bracket open (`COLOURS = {`), or sits inside one opened on an earlier
+line (`help="…"` in an `add_argument(`), is never removed at all. Both exist
 because a fault that cannot compile is a `fault-invalid` verdict — a probe run
 spent saying nothing about the tests. The two JSX shapes (`element-removed`,
 `handler-dropped`) have no Python meaning and are absent rather than faked.

{testguard_cli-0.13.0 → testguard_cli-0.14.0}/action.yml

@@ -46,7 +46,7 @@ inputs:
   version:
     description: 'testguard-cli version to run'
     required: false
-    default: '0.13.0'
+    default: '0.14.0'
   node-version:
     description: 'Node.js version (20+)'
     required: false

{testguard_cli-0.13.0 → testguard_cli-0.14.0}/docs/testguard-explained.html

@@ -144,7 +144,7 @@
 <div class="page">
   <div class="masthead">
     <div class="wordmark">Test<span class="mark">Guard</span></div>
-    <div class="meta">Technical Brief · v0.13.0 · MIT</div>
+    <div class="meta">Technical Brief · v0.14.0 · MIT</div>
   </div>
 
   <h1>Your tests pass. That is not the same as your tests working.</h1>
@@ -678,7 +678,7 @@
       <tr><td><code>init</code></td><td>Installs the agent layer — skill, session-start hook, AGENTS.md section — at the git root.</td></tr>
       <tr><td><code>claims</code></td><td>Lists the claims and reports drift against the <code>@claim</code> annotations in the code.</td></tr>
       <tr><td><code>scaffold</code></td><td>Proposes faults mechanically for one file, as a draft claims document. A starting point, not an answer.</td></tr>
-      <tr><td><code>sweep</code></td><td>The cold start: propose and probe faults for changed files that carry <em>no</em> claim.</td></tr>
+      <tr><td><code>sweep</code></td><td>The cold start: probe files with <em>no</em> claim — a diff, the write surface, or a one-line <code>concern</code>.</td></tr>
       <tr><td class="v-good"><code>probe</code></td><td>The engine. Inject each fault, run its defenders, report what survived.</td></tr>
       <tr><td><code>admit</code></td><td>The two-gate rule as one verb: green on HEAD <em>and</em> failing on every fault of the claim. Otherwise the test is not a defender.</td></tr>
       <tr><td><code>baseline</code></td><td>Freezes today's unproven findings so only new ones gate.</td></tr>
@@ -755,7 +755,7 @@ field-dropped  missed 4/4  p=1.00  ci [0.51, 1.00]</pre>
     <p>Twenty-six faults injected on the persistence path of seven server actions in a real
     AI-authored application: the database write itself, and the fields of the payload it carries.</p>
     <figure style="margin-top:11px">
-      <svg viewBox="0 0 760 150" role="img" aria-label="Save-path measurement: 12 of 26 faults survived, all of them a dropped payload field; 10 of 10 tests mock the database and none read back">
+      <svg viewBox="0 0 760 150" role="img" aria-label="Save-path measurement: 12 of 26 faults survived, all of them a dropped payload field; across the whole write surface, 32 of 37 files are defended only by tests that mock the database">
         <rect x="0" y="0" width="243" height="74" rx="4" fill="#ffffff" stroke="#e6e2d8"/>
         <text x="18" y="38" style="font-family:var(--sans);font-size:27px;font-weight:700;letter-spacing:-0.03em;fill:#b85636">12 of 26</text>
         <text class="s-sub" x="18" y="56" style="font-size:8px">survived a fully green suite</text>
@@ -767,9 +767,9 @@ field-dropped  missed 4/4  p=1.00  ci [0.51, 1.00]</pre>
         <text class="s-sub" x="276" y="68" style="font-size:8px">field — not one was anything else</text>
 
         <rect x="516" y="0" width="244" height="74" rx="4" fill="#ffffff" stroke="#e6e2d8"/>
-        <text x="534" y="38" style="font-family:var(--sans);font-size:27px;font-weight:700;letter-spacing:-0.03em;fill:#191917">10 of 10</text>
-        <text class="s-sub" x="534" y="56" style="font-size:8px">tests mock the database; none</text>
-        <text class="s-sub" x="534" y="68" style="font-size:8px">read the record back</text>
+        <text x="534" y="38" style="font-family:var(--sans);font-size:27px;font-weight:700;letter-spacing:-0.03em;fill:#b85636">32 of 37</text>
+        <text class="s-sub" x="534" y="56" style="font-size:8px">files that write are defended only</text>
+        <text class="s-sub" x="534" y="68" style="font-size:8px">by tests that mock the database</text>
 
         <rect x="0" y="86" width="760" height="58" rx="4" fill="#fbf1ec" stroke="#e8d5cc"/>
         <text class="s-tiny" x="16" y="104" style="fill:#b85636">The worst case — user registration</text>
@@ -778,9 +778,10 @@ field-dropped  missed 4/4  p=1.00  ci [0.51, 1.00]</pre>
       </svg>
       <p class="figcap">Fig. 7 — The save button reports success. The suite agrees. The column is empty.</p>
     </figure>
-    <p class="note">This is the page-one exhibit again, measured rather than recounted: an assertion that
-    names the call but not the payload cannot fail when a field goes missing. It is invisible to coverage,
-    invisible to a mutation score, and invisible to the test's own author.</p>
+    <p class="note">The third number is the read-back answer. A test that replaced the database proves the
+    call shape and nothing beyond it — a <code>where</code> matching no rows, a rolled-back transaction, a
+    rejected constraint all pass against a mock. On this surface a clean probe is not evidence of
+    persistence; it is evidence that nothing could have measured it, and the tool says so before any verdict.</p>
   </section>
 
   <section class="rule-top">
@@ -788,28 +789,28 @@ field-dropped  missed 4/4  p=1.00  ci [0.51, 1.00]</pre>
     <div class="cols-3">
       <div>
         <h3>Nothing written</h3>
-        <p class="note"><code>sweep</code> takes the changed files the gate just called uncovered,
-        proposes faults with the mechanical producers, probes a bounded selection, and reports what
-        nothing noticed. A fault that survives needs no claim to be alarming.</p>
+        <p class="note"><code>sweep</code> takes the files the gate just called uncovered, proposes
+        faults mechanically, probes a bounded selection, and reports what nothing noticed — ordering
+        candidates by what this project’s own runs have shown survives, the feedback that took
+        Google’s productive rate from 15% to 89%, read from evidence already on disk.</p>
       </div>
       <div>
         <h3>A sentence or ten</h3>
-        <p class="note">A <em>concern</em> — “every save persists its data” — is one sentence that applies
-        across two hundred screens. It is human-anchored and machine-instantiated, and every proposal it
-        produces still has to survive an execution gate.</p>
+        <p class="note">A <em>concern</em> names a kind of promise and where to look. Five lines of JSON
+        on the same application — “every admin route refuses a caller without the admin role” — found a
+        route whose owner/manager check can be forced to <code>false</code> with no test failing. One
+        sentence, twenty-four routes, no model.</p>
       </div>
       <div>
         <h3>A claim</h3>
         <p class="note">The survivors worth defending become the first claims: a statement, its faults,
-        and a reproducer already in hand. The ladder ends where the rest of this brief begins.</p>
+        and a reproducer already in hand.</p>
       </div>
     </div>
-    <p class="note" style="margin-top:9px">Three rules keep the bottom rung safe on a repository that has
-    never seen this tool. A sweep <strong>never writes the claims file</strong> — a sentence nobody wrote
-    is not a claim. Its evidence <strong>never replaces</strong> the canonical evidence, which is the
-    record of what the project actually claims. And it <strong>does not fail on its own bad guess</strong>:
-    only a survivor or an untested file exits non-zero, because a proposal that would not compile is the
-    tool’s mistake, and a tool that fails on its own mistakes gets switched off.</p>
+    <p class="note" style="margin-top:9px">Three rules keep the lower rungs safe. A sweep <strong>never
+    writes the claims file</strong> — a sentence nobody wrote is not a claim. Its evidence <strong>never
+    replaces</strong> the canonical record. And it <strong>does not fail on its own bad guess</strong>:
+    only a survivor or an untested file exits non-zero.</p>
   </section>
 
   <div class="pull">
@@ -843,7 +844,9 @@ field-dropped  missed 4/4  p=1.00  ci [0.51, 1.00]</pre>
         A later study found reported mutants are coupled to real faults: the bugs they analysed would
         have been caught had a mutant been surfaced.</p>
         <p class="note"><em>Taken here:</em> the diff scope, the cap, and a productivity-ordered
-        selection — measured on real probed faults rather than assumed.</p>
+        selection — measured on real probed faults rather than assumed. Their arid-node suppression
+        was measured, not copied: Google's categories are under 1% of what the producers propose;
+        the arid class here is presentational JSX, now set aside and counted.</p>
       </div>
       <div>
         <h3>Meta — making it specific</h3>

{testguard_cli-0.13.0 → testguard_cli-0.14.0}/docs-canonical/PRIOR-ART.md

@@ -2,7 +2,7 @@
 
 <!-- docguard:version 1.0.0 -->
 <!-- docguard:status approved -->
-<!-- docguard:last-reviewed 2026-09-21 -->
+<!-- docguard:last-reviewed 2026-09-22 -->
 <!-- docguard:owner @raccioly -->
 <!-- docguard:quality passive-voice off — the subject of this document is what was taken from other people's work. "Diff scoping was taken from Google" is the true sentence; rewriting every one to name us as the actor would put the borrower in the foreground of a document about the lender. -->
 <!-- docguard:quality negation-load off — half the value here is what was deliberately NOT taken: not their mutation score, not their equivalence auto-drop, not a model judging a verdict. A record of borrowings that only lists borrowings is the half that misleads. -->
@@ -49,14 +49,16 @@ numbers are the reason several of our defaults are what they are.
 | **Diff scoping** — mutate only changed lines, surfaced during code review. | `gate --changed`, and `sweep`, which proposes only for changed files. |
 | **A hard cap on what is surfaced** — at most 7 × the number of files in the change, because past that the reader stops reading. | `capFor()` in `src/supply/select.mjs`; the remainder is reported as `deferred`, never dropped. |
 | **Productivity-ordered selection** — order candidates by how often that operator produced a useful mutant in similar context. Developer feedback over six years took their productive rate from **15% to 89%**. | `MEASURED_PRODUCTIVITY` and `scoreOf()` in `src/supply/select.mjs`. Ours is measured on 56 probed faults from a real AI-authored codebase and shrunk toward a neutral prior, so one observation cannot dominate. |
-| **Arid-node suppression** — do not mutate code nobody would write a test for (logging, timeouts, config flags). | Partially: our producers are line-oriented and never propose on comments or blank lines, and `testguard.ignore.json` carries path exclusions with reasons. We have no AST-level arid heuristic. |
+| **Arid-node suppression** — do not mutate code nobody would write a test for (logging, timeouts, config flags). | **Measured, not built.** On 2026-09-22 every fault the producers proposed on two of the maintainer's repositories (`sweep --changed` and `sweep --save-paths`, cap 30, 510 + 581 proposals on a Next.js app and 600 on a Python CLI) was classified by hand against Google's five categories — logging, time/sleep/deadline, config flag, memoisation, monitoring counter. They account for **2 of 510, 0 of 581 and about 4 of 600** proposals: under 1% everywhere, against the ~10% that would have justified a suppressor. The reason is structural: the producers are already shape-targeted (a guard, a payload field, a security literal), so they rarely land on a log line in the first place. What the same measurement found instead is recorded under *Known gaps*. |
 | **Fault coupling as the justification** — their 2021 study found reported mutants are coupled to real faults: bugs they analysed would have been caught had a mutant been surfaced. | The premise behind `replay`, which calibrates fault classes against real fix commits rather than assuming the coupling. |
 
 **Not taken.** Their mutation score, their exhaustive per-line generation, and
 their AST-based arid heuristics (ours is a different scale and a different
-language surface). Their selection learns continuously from developer
-feedback; **ours does not yet** — see
-[Known gaps](#known-gaps-in-what-we-borrowed).
+language surface). Their selection learns from explicit developer feedback;
+**ours learns from the project's own probed verdicts** (v0.13.0) — every
+evidence record already carries a fault class and a verdict, so the feedback
+is a tally rather than a thing to collect. The combination is a Beta-Binomial
+posterior mean, which is strictly proper; see the Laya section.
 
 ## Meta — making it specific
 
@@ -75,7 +77,7 @@ concern, and every step is gated by execution.
 
 | Taken | Where it lives here |
 |---|---|
-| **The concern as the unit a human writes.** One plain-text sentence generates faults across a whole surface. | The planned Level 1 `testguard.concerns.json`. Not yet implemented — see [Known gaps](#known-gaps-in-what-we-borrowed). |
+| **The concern as the unit a human writes.** One plain-text sentence generates faults across a whole surface. | `testguard.concerns.json` and `sweep --concern` (v0.13.0). Taken WITHOUT the generator: a concern's core is a named scope plus a producer selection, which the mechanical producers already satisfy, so it ships offline. On a real application a five-line concern found an admin route whose owner/manager check can be forced to `false` with no test failing. |
 | **An execution gate between every model step and the record.** A drafted fault must build, must survive the existing suite, and must not be equivalent before a test is generated for it; the generated test must build, pass on the original N times, and kill the fault. | The rule that nothing a model proposes enters `testguard.claims.json` without passing `probe` and a human keep — already how `scaffold` drafts work. |
 | **Show the reviewer the fault as proof.** The engineer sees the concrete fault the test catches, so the model's output is independently checkable rather than self-referential. | Every finding names its fault, its anchor and its reproducer; `admit` reports which fault a candidate test kills. |
 | **Learned, realistic faults rather than syntactic ones** (Beller 2021: operators learned from a corpus of real Java errors and from changes that caused operational anomalies; **>50% of 15,000 generated mutants survived** their suite). | The premise behind `replay`'s fault-class calibration, and behind the planned intent-based producer. Our built-in producers remain deterministic and line-oriented. |
@@ -148,13 +150,37 @@ difference between a metric and an audit.
 
 Recorded so they are not mistaken for decisions.
 
-- **The feedback loop is not built.** Google's 15% → 89% gain came from
-  developer feedback refining suppression and selection over six years. Ours
-  ships a static measured prior. Until keep/drop decisions feed back,
-  `MEASURED_PRODUCTIVITY` is a snapshot of one repository.
-- **Concerns are not implemented.** ACH's central idea — the plain-text concern
-  as the unit a human writes — is planned, not shipped.
-- **No arid-node heuristic.** We suppress by path, not by AST shape.
-- **The persistence signal is confined to the sweep document.** It is not yet
-  in `evidence.defenders.signals`, which is a closed enum in the shared
-  claimspec contract and needs a coordinated bump.
+- **The feedback loop learns from verdicts, not from explicit developer
+  clicks.** Google's gain came from "Please fix" / "Not useful" feedback on
+  surfaced mutants. Ours reads survival per fault class from the project's own
+  evidence — the same signal, but it cannot yet distinguish a survivor the
+  developer *acted on* from one they ignored. A keep/drop record would close
+  that.
+- **Concerns have no model-backed producer.** The unit shipped; the ACH
+  generator that drafts intent-level faults for a concern did not, and is the
+  one piece of the rung that would touch the network.
+- **No arid-node heuristic, and the measurement says none is needed for
+  Google's categories** (under 1% of proposals; see the Google table). Two
+  different things ARE material, measured on the same runs:
+  - **Presentational JSX.** On a 14-file UI diff, 150 of 510 proposals (29%)
+    were `element-removed` on an icon (`<X />`, `<ChevronLeft />`) or a static
+    wrapper (`<div>`, `<span>`, `<p>` with no expression and no handler). The
+    ranker spent 29 of 30 probe slots on that class and 7 of the 10 survivors
+    were of this shape — findings nobody will write a test for, which is
+    Google's definition of arid, in a syntax Google never mutated. Because the
+    ordering learns from survival, these survivors also teach it to rank the
+    class higher. A line-oriented demotion is designed; it is not built.
+  - **Python continuation lines.** 81 of 600 proposals on a Python CLI
+    (13.5%) did not compile, 77 of them a `statement-deleted` on a line that
+    sits inside a bracket opened on an earlier line. `isIncomplete()` in
+    `src/scaffold/producers.python.mjs` checks only whether the line itself
+    leaves a bracket open. Measured with the tokenizer's exact depth, a
+    running-depth guard on that class catches 74 of the 77 and drops no
+    valid proposal. Not arid — a producer that spends probe runs saying
+    nothing — but found by the same pass.
+- **The persistence signal reached the evidence on 2026-09-22**
+  (`persistence-payload-unasserted` in `evidence.defenders.signals`, a closed
+  enum in the shared claimspec contract). No tool outside this repository
+  validated claimspec evidence at the time; DocGuard's adoption (docguard#420)
+  was notified rather than broken. Listed here because the enum is shared:
+  the next addition needs the same notice.

{testguard_cli-0.13.0 → testguard_cli-0.14.0}/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "testguard-cli",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "testguard-cli",
-      "version": "0.13.0",
+      "version": "0.14.0",
       "license": "MIT",
       "dependencies": {
         "ajv": "8.20.0"

{testguard_cli-0.13.0 → testguard_cli-0.14.0}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "testguard-cli",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest.",
   "type": "module",
   "license": "MIT",

{testguard_cli-0.13.0 → testguard_cli-0.14.0}/packaging/gitlab/testguard.gitlab-ci.yml

@@ -3,7 +3,7 @@
 # Include it from a project's .gitlab-ci.yml, pinned to a release:
 #
 #   include:
-#     - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.13.0/packaging/gitlab/testguard.gitlab-ci.yml'
+#     - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.14.0/packaging/gitlab/testguard.gitlab-ci.yml'
 #       inputs:
 #         dir: backend            # where testguard.claims.json lives (default ".")
 #         post_note: true         # post the brief as a merge-request note (needs TESTGUARD_GITLAB_TOKEN, api scope)
@@ -29,7 +29,7 @@ spec:
   inputs:
     version:
       description: testguard-cli version to run
-      default: "0.13.0"
+      default: "0.14.0"
     dir:
       description: directory whose test runner is invoked (where testguard.claims.json lives)
       default: "."

{testguard_cli-0.13.0 → testguard_cli-0.14.0}/packaging/homebrew/testguard.rb

@@ -15,8 +15,8 @@
 class Testguard < Formula
   desc "Proves a test suite defends the claims a project makes"
   homepage "https://github.com/raccioly/testguard"
-  url "https://registry.npmjs.org/testguard-cli/-/testguard-cli-0.13.0.tgz"
-  sha256 "27079e0d5870ad86ccad4df967e50898eddacd9d66b2391120da58970ce57a34"
+  url "https://registry.npmjs.org/testguard-cli/-/testguard-cli-0.14.0.tgz"
+  sha256 "7931292332345eee9a6f5deb118e3931f06396b06e98c41c227b0de99c78df1d"
   license "MIT"
 
   depends_on "node"

{testguard_cli-0.13.0 → testguard_cli-0.14.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "testguard-cli"
-version = "0.13.0"
+version = "0.14.0"
 description = "Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest. Ships the Node.js CLI (requires Node.js 20+)."
 readme = "README.md"
 license = { text = "MIT" }

{testguard_cli-0.13.0 → testguard_cli-0.14.0}/spec/GATE-SEMANTICS.md

@@ -343,6 +343,14 @@ the suppress-up-to-count semantics are identical.
   tool then records `unasserted-annotated` with the reason — silenced, never
   hidden. A file that mocks the subject is never a discovered defender: a
   mock cannot detect a fault in what it replaced.
+  `persistence-payload-unasserted`: a resolved defender mocks the persistence
+  layer, so it can prove the call shape and never that a row landed; the
+  reason names the layer and the file's assertion mix. It is attached only to
+  a **survived** record whose fault sits on the write path — a field of a
+  persisted payload or the write call itself — because there it says why the
+  survivor was missed, and anywhere else it says nothing. A conforming
+  document never carries it on another verdict, on a file that is not a
+  resolved defender, or without its reason.
 
 ## Claimed source surface