testguard-cli 0.14.1__tar.gz → 0.15.0__tar.gz

{testguard_cli-0.14.1 → testguard_cli-0.15.0}/.github/scripts/install-smoke.mjs

@@ -31,9 +31,23 @@ try {
   const version = run(bin, ['--version'], consumer).trim();
   const claims = run(bin, ['claims', '.'], consumer);
   const draft = JSON.parse(run(bin, ['scaffold', 'src/redact.mjs', '--json'], consumer));
+  const installedValidator = join(consumer, 'node_modules', 'testguard-cli', 'spec', 'lib', 'validate.mjs');
+  const candidateEvidence = join(root, 'spec', 'conformance', 'examples', 'evidence.json');
+  const validatesCandidateEvidence = run(process.execPath, [
+    '--input-type=module',
+    '-e',
+    `import { pathToFileURL } from 'node:url'; import { readFileSync } from 'node:fs';
+     const { validate } = await import(pathToFileURL(process.argv[1]));
+     const result = validate('evidence', JSON.parse(readFileSync(process.argv[2], 'utf8')));
+     if (!result.ok) throw new Error(result.errors.map((error) => \`${'${error.path}: ${error.message}'}\`).join('; '));
+     process.stdout.write('ok');`,
+    installedValidator,
+    candidateEvidence,
+  ], consumer).trim();
   if (!draft.claims?.length) throw new Error('scaffold produced no claims from the installed tarball');
   if (!/^\d+\.\d+\.\d+/.test(version)) throw new Error(`unexpected --version output: ${version}`);
   if (!/^\d+ claims in /.test(claims)) throw new Error(`claims did not list the fixture:\n${claims}`);
+  if (validatesCandidateEvidence !== 'ok') throw new Error('installed package did not validate candidate-format evidence');
   const deps = Object.keys(JSON.parse(run(npm, ['ls', '--omit=dev', '--json', '--depth=0'], consumer)).dependencies ?? {});
   console.log(`install smoke OK — testguard ${version} runs from the installed tarball; consumer deps: ${deps.join(', ')}`);
 } finally {

{testguard_cli-0.14.1 → testguard_cli-0.15.0}/CHANGELOG.md

@@ -7,6 +7,52 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.15.0] - 2026-09-29
+
+Automated weekly release — everything merged since `v0.14.2`.
+
+### Changed
+
+- feat: harden discovery, replay, and command budgets (#174)
+- chore(homebrew): sha256 for v0.14.2 (#173)
+
+
+### Added
+
+- Runner-native test discovery for Vitest, Jest, and Playwright, with bounded
+  output, path validation, immutable universe manifests, exact mixed-runner
+  routing, and configuration-closure hashes (including workspace configs,
+  package helpers, setup files, and Python collection hooks) that prevent stale
+  evidence reuse.
+- Symbol-aware JavaScript/TypeScript defender discovery through named,
+  default, namespace, CommonJS, and barrel re-exports. Ambiguity and bounded
+  resolver exhaustion fail closed as `defender-discovery-indeterminate`.
+- `probe`, `sweep`, and `replay` accept `--command-budget <ms>` as a
+  cooperative measurement deadline distinct from the existing per-run
+  `--budget`. It caps asynchronous children and is checked at stage and write
+  boundaries; synchronous setup may overrun but cannot publish a partial
+  result, so an unattempted suffix can never be reported as clean.
+
+### Fixed
+
+- Runner timeouts now hard-kill the original process group and descendants
+  still attributable at timeout. Diagnostics explicitly say cleanup is
+  unverified because a previously reparented daemon requires external OS or
+  container containment.
+- Generated CommonJS export mutations and unresolved symbol/configuration
+  paths fail closed instead of allowing a false `nocover` result.
+- Dirty-tree preflight now resolves the same full primary-plus-owned runner
+  universe as measurement, including custom Playwright names and imported
+  configuration helpers; discovery failure blocks rather than hiding edits.
+
+## [0.14.2] - 2026-09-28
+
+Automated weekly release — everything merged since `v0.14.1`.
+
+### Changed
+
+- chore(homebrew): sha256 for v0.14.1 (#171)
+
 ## [0.14.1] - 2026-09-27
 
 Automated weekly release — everything merged since `v0.14.0`.

{testguard_cli-0.14.1 → testguard_cli-0.15.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: testguard-cli
-Version: 0.14.1
+Version: 0.15.0
 Summary: Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest. Ships the Node.js CLI (requires Node.js 20+).
 Project-URL: Homepage, https://github.com/raccioly/testguard
 Project-URL: Documentation, https://github.com/raccioly/testguard#readme
@@ -151,9 +151,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.14.1` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.15.0` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.14.1/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.15.0/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -687,12 +687,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.14.1
+- uses: raccioly/testguard@v0.15.0
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.14.1/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.15.0/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 
@@ -718,6 +718,18 @@ talks to the network; only the job posts, and only when told to.
 - **Never optimistic.** A timeout, a load failure, a mixed N-run result, a
   flaky defender or a missing anchor is reported as unproven, never rounded
   toward green. The one pass is `killed`; everything else gates.
+- **Per-run and whole-command time are separate.** `--budget` limits each
+  runner invocation. `--command-budget` is a cooperative deadline for the
+  complete `probe`, `sweep`, or `replay` measurement: asynchronous children
+  receive only the remaining time, and stage/write boundaries re-check it.
+  Synchronous setup may overrun the nominal deadline, but once expiry is
+  observed TestGuard exits `2` and writes no new result document; a completed
+  prefix is not presented as though the unattempted suffix were clean.
+- **Configured discovery is evidence.** Vitest, Jest, and Playwright enumerate
+  their own configured files; TestGuard validates and hashes that immutable
+  universe instead of guessing with filename globs. Automatic JavaScript and
+  TypeScript discovery follows the imported symbol through barrels. Ambiguous
+  or unbounded resolution is `unverifiable`, never a flattering `nocover`.
 - **One exact-pinned runtime dependency** (`ajv`), Node ≥ 20, MIT.
 
 ### Prior art, and what was taken from where

{testguard_cli-0.14.1 → testguard_cli-0.15.0}/README.md

@@ -127,9 +127,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.14.1` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.15.0` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.14.1/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.15.0/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -663,12 +663,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.14.1
+- uses: raccioly/testguard@v0.15.0
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.14.1/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.15.0/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 
@@ -694,6 +694,18 @@ talks to the network; only the job posts, and only when told to.
 - **Never optimistic.** A timeout, a load failure, a mixed N-run result, a
   flaky defender or a missing anchor is reported as unproven, never rounded
   toward green. The one pass is `killed`; everything else gates.
+- **Per-run and whole-command time are separate.** `--budget` limits each
+  runner invocation. `--command-budget` is a cooperative deadline for the
+  complete `probe`, `sweep`, or `replay` measurement: asynchronous children
+  receive only the remaining time, and stage/write boundaries re-check it.
+  Synchronous setup may overrun the nominal deadline, but once expiry is
+  observed TestGuard exits `2` and writes no new result document; a completed
+  prefix is not presented as though the unattempted suffix were clean.
+- **Configured discovery is evidence.** Vitest, Jest, and Playwright enumerate
+  their own configured files; TestGuard validates and hashes that immutable
+  universe instead of guessing with filename globs. Automatic JavaScript and
+  TypeScript discovery follows the imported symbol through barrels. Ambiguous
+  or unbounded resolution is `unverifiable`, never a flattering `nocover`.
 - **One exact-pinned runtime dependency** (`ajv`), Node ≥ 20, MIT.
 
 ### Prior art, and what was taken from where

{testguard_cli-0.14.1 → testguard_cli-0.15.0}/action.yml

@@ -46,7 +46,7 @@ inputs:
   version:
     description: 'testguard-cli version to run'
     required: false
-    default: '0.14.1'
+    default: '0.15.0'
   node-version:
     description: 'Node.js version (20+)'
     required: false

{testguard_cli-0.14.1 → testguard_cli-0.15.0}/docs/testguard-explained.html

@@ -144,7 +144,7 @@
 <div class="page">
   <div class="masthead">
     <div class="wordmark">Test<span class="mark">Guard</span></div>
-    <div class="meta">Technical Brief · v0.14.1 · MIT</div>
+    <div class="meta">Technical Brief · v0.15.0 · MIT</div>
   </div>
 
   <h1>Your tests pass. That is not the same as your tests working.</h1>

{testguard_cli-0.14.1 → testguard_cli-0.15.0}/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "testguard-cli",
-  "version": "0.14.1",
+  "version": "0.15.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "testguard-cli",
-      "version": "0.14.1",
+      "version": "0.15.0",
       "license": "MIT",
       "dependencies": {
         "ajv": "8.20.0"

{testguard_cli-0.14.1 → testguard_cli-0.15.0}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "testguard-cli",
-  "version": "0.14.1",
+  "version": "0.15.0",
   "description": "Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest.",
   "type": "module",
   "license": "MIT",

{testguard_cli-0.14.1 → testguard_cli-0.15.0}/packaging/gitlab/testguard.gitlab-ci.yml

@@ -3,7 +3,7 @@
 # Include it from a project's .gitlab-ci.yml, pinned to a release:
 #
 #   include:
-#     - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.14.1/packaging/gitlab/testguard.gitlab-ci.yml'
+#     - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.15.0/packaging/gitlab/testguard.gitlab-ci.yml'
 #       inputs:
 #         dir: backend            # where testguard.claims.json lives (default ".")
 #         post_note: true         # post the brief as a merge-request note (needs TESTGUARD_GITLAB_TOKEN, api scope)
@@ -29,7 +29,7 @@ spec:
   inputs:
     version:
       description: testguard-cli version to run
-      default: "0.14.1"
+      default: "0.15.0"
     dir:
       description: directory whose test runner is invoked (where testguard.claims.json lives)
       default: "."

{testguard_cli-0.14.1 → testguard_cli-0.15.0}/packaging/homebrew/testguard.rb

@@ -15,8 +15,8 @@
 class Testguard < Formula
   desc "Proves a test suite defends the claims a project makes"
   homepage "https://github.com/raccioly/testguard"
-  url "https://registry.npmjs.org/testguard-cli/-/testguard-cli-0.14.1.tgz"
-  sha256 "eb0ca2d7808338bc12db057dda87259e357d0db47a62917dbabcff08bd8c1df4"
+  url "https://registry.npmjs.org/testguard-cli/-/testguard-cli-0.15.0.tgz"
+  sha256 "89faee9b6045550c33cd75e634215c9c698e29361aa32f5cc2b896e82a894e87"
   license "MIT"
 
   depends_on "node"

{testguard_cli-0.14.1 → testguard_cli-0.15.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "testguard-cli"
-version = "0.14.1"
+version = "0.15.0"
 description = "Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest. Ships the Node.js CLI (requires Node.js 20+)."
 readme = "README.md"
 license = { text = "MIT" }

{testguard_cli-0.14.1 → testguard_cli-0.15.0}/spec/GATE-SEMANTICS.md

@@ -12,7 +12,7 @@ The verdict set is closed. Only one value is a pass.
 | `killed` | Fault applied; every one of N probe runs failed with a genuine assertion failure, on a defender set that was green N/N unmodified. | no |
 | `survived` | Fault applied; every one of N probe runs passed. The claim is **unproven**. | **yes** |
 | `nocover` | No defending test exists: the declared globs resolve to nothing, or no test imports the subject. Worse than `survived` — nothing was even tried. | **yes** |
-| `unverifiable` | The claim could not be probed: the fault's anchor is missing or ambiguous, its defenders failed to load (`defenders-failed-to-load`), probing it threw (`probe-error`), or the defenders do not execute the subject at all (`subject-not-executed`). Carries a `reason`. A loud, gating verdict — a claim that cannot be probed is not "skipped", it is undefended until someone fixes the fault or the defenders. Never confused with `flaky-defender`, which requires tests that *ran*. | **yes** |
+| `unverifiable` | The claim could not be probed: the fault's anchor is missing or ambiguous, configured or symbol-level defender discovery was indeterminate (`defender-discovery-indeterminate`), its defenders failed to load (`defenders-failed-to-load`), probing it threw (`probe-error`), or the defenders do not execute the subject at all (`subject-not-executed`). Carries a `reason`. A loud, gating verdict — a claim that cannot be probed is not "skipped", it is undefended until someone fixes the fault or the defenders. Never confused with `flaky-defender`, which requires tests that *ran*. | **yes** |
 | `timeout` | Probe run exceeded its budget. Not counted as a kill; the pessimistic reading is the safe one because flakiness biases the metric optimistically. | **yes** |
 | `fault-invalid` | The replacement does not load or compile. A bad fault, not a detection. | **yes** |
 | `flaky-defender` | Defenders were not green N/N on unmodified source (`defenders-not-green`), or the N probe runs disagreed with each other (`inconsistent-probe`). Either way no verdict about the fault can be trusted; fix the defenders first. | **yes** |
@@ -151,7 +151,43 @@ Rules that follow from the table:
    can name the file the interpreter loaded) answers the same question more
    precisely for one language; where both are present they must agree.
 
-13. **Fault injection is one method, not the definition.** A claim declares
+13. **The configured runner defines the test universe.** For JavaScript and
+   TypeScript, defender discovery, baseline runs and escalation use the exact
+   file set returned by the resolved runner's native listing protocol. A
+   resolvable runner whose configuration cannot load, whose listing times out
+   or is malformed, or whose reported paths escape the project is a
+   precondition failure. It never falls back to built-in filename globs and
+   never becomes `nocover`. An explicitly selected runner that lists zero
+   files is also a precondition failure; `auto` may continue past a successful
+   empty listing, but must fail when every eligible runner is empty.
+   `inputs.testUniverseHash` binds the normalized file set, runner identity,
+   and hashed configuration dependencies. Those dependencies include absent
+   root candidates, nested workspace configs, Python collection hooks, and the
+   bounded static closure of local or package-imported config helpers and setup
+   files; creating or editing any of them forces remeasurement. Evidence that
+   predates this hash, or whose hash
+   changed, is readable but never reusable for a current native discovery run.
+   When several configured runners list defenders, exact manifest membership
+   assigns each file. An owned runner takes precedence over the project runner;
+   competing owned runners or a declared defender absent from every manifest
+   are precondition failures, never heuristic routing decisions.
+
+14. **Barrel resolution follows symbols, not module reachability.** Automatic
+   discovery may traverse a re-export chain only for the binding the test
+   actually imports. Importing an unrelated symbol from a broad barrel does
+   not defend every file the barrel exports. Renames, explicit exports and
+   star exports are resolved deterministically; type-only paths do not count.
+   Ambiguous origins, unsupported runtime-generated exports, graph-limit
+   exhaustion, and originless cycles are `unverifiable` with reason
+   `defender-discovery-indeterminate`, never `nocover`. A declared
+   `defendedBy` remains authoritative. `inputs.discoveryHashes` binds every
+   candidate test, intermediate barrel, and resolver-configuration file
+   consulted by automatic discovery. Negative candidates are dependencies too:
+   editing a previously unrelated test so it begins importing the target must
+   invalidate an earlier `nocover`. Absent or changed dependencies force
+   remeasurement.
+
+15. **Fault injection is one method, not the definition.** A claim declares
    what must be true; a probe declares how a tool would try to make it false,
    and `method` says which way. `fault-injection` — mutate the source, run the
    claim's defenders, confirm over N runs — is the only method specified in
@@ -184,6 +220,32 @@ Rules that follow from the table:
    The verdict set stays closed and shared. What each method may legitimately
    report is part of defining it.
 
+## Per-run and whole-command budgets are different
+
+`--budget` remains the wall-clock ceiling for one runner invocation. An
+optional `--command-budget` is a cooperative deadline for the complete
+`probe`, `sweep`, or `replay` measurement. Every asynchronous child runner and
+discovery process is given no more than the command's remaining time, and the
+deadline is checked again at stage boundaries and immediately before any
+result is written. Synchronous filesystem, Git, parsing, and cleanup work is
+not preemptible in portable Node.js and may finish after the nominal deadline;
+that overrun grants no authority to publish a result.
+
+Exhausting the whole-command budget is not a test verdict and is never a
+successful partial measurement. The command exits `2` and writes no new
+result document; any previous document remains untouched. Cleanup may finish
+after the deadline, but no record from the incomplete operation becomes
+evidence. This is deliberately stricter than a per-run timeout: publishing
+the completed prefix would let the unattempted suffix look clean.
+
+Timeout cleanup is best effort, not portable process containment. TestGuard
+hard-kills the runner's original process group and every descendant still
+attributable through the process table. A daemon that detached, reparented,
+and disappeared from that ancestry before timeout may survive, so timeout
+diagnostics state `cleanup-unverified`. Such a run remains a timeout and never
+becomes evidence of detection. Daemonizing or untrusted commands require an
+OS or container boundary that TestGuard does not claim to provide.
+
 ## Replay reports; it never gates
 
 A replayed bug is history. It escaped, by definition, which means the suite
@@ -198,7 +260,7 @@ Its verdicts mirror the probe's, for the same reasons:
 | `caught` | a remaining test failed **by assertion** on the reverted source, every run. The suite knew. |
 | `blind` | the suite stayed green on known-broken code. |
 | `nocover` | no test imports the reverted files, **and at least one test file remained to ask**. Worse than `blind`: nothing was even tried. |
-| `unverifiable` | the revert did not apply, the suite failed to load, it timed out, or removing the fix's own test left **no test file at all** (`the-fix-shipped-the-only-test-file`). Carries a `reason`. |
+| `unverifiable` | the revert did not apply, configured or symbol-level defender discovery was indeterminate (`defender-discovery-indeterminate`), the suite failed to load, it timed out, or removing the fix's own test left **no test file at all** (`the-fix-shipped-the-only-test-file`). Carries a `reason`. |
 | `flaky` | the runs disagreed. A flaky failure reads as "the suite caught it", so flakiness biases this metric **optimistically** — mixed runs are never `caught`. |
 
 Two rules that follow:

{testguard_cli-0.14.1 → testguard_cli-0.15.0}/spec/README.md

@@ -39,6 +39,13 @@ Shared definitions (verdicts, fault classes, provenance, annotations) live in
 which verdicts turn CI red, baseline and delta rules, exit codes — is in
 [`GATE-SEMANTICS.md`](GATE-SEMANTICS.md).
 
+Operational completeness is contractual too. `--budget` bounds one runner
+invocation; `--command-budget` is a cooperative deadline for a complete probe,
+sweep, or replay measurement. It caps asynchronous child processes, is checked
+at stage and write boundaries, and produces no document once observed expired.
+Synchronous setup may overrun but cannot authorize a partial result. The exact
+rule is in `GATE-SEMANTICS.md`.
+
 Schemas are JSON Schema 2020-12 and identified as `urn:claimspec:v1:<kind>`.
 
 ## Conformance

{testguard_cli-0.14.1 → testguard_cli-0.15.0}/spec/conformance/examples/evidence.json

@@ -165,7 +165,9 @@
         "targetHash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
         "defenderHashes": {
           "test/redact.test.mjs": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
-        }
+        },
+        "testUniverseHash": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+        "discoveryHashes": {}
       },
       "rank": {
         "score": 9.5,

{testguard_cli-0.14.1 → testguard_cli-0.15.0}/spec/schemas/evidence.schema.json

@@ -641,6 +641,20 @@
               "additionalProperties": {
                 "$ref": "urn:claimspec:v1:common#/$defs/sha256"
               }
+            },
+            "testUniverseHash": {
+              "description": "Canonical hash of the runner-native test universe and the configuration files that produced it. Optional for backward compatibility; current probes emit it, and evidence without it is never reusable against a configured discovery run.",
+              "$ref": "urn:claimspec:v1:common#/$defs/sha256"
+            },
+            "discoveryHashes": {
+              "description": "Content hashes of candidate tests, intermediate barrels, and resolver-configuration files consulted by automatic defender discovery. This includes negative candidates: a test edited to begin importing the target must invalidate an earlier `nocover`. Optional for backward compatibility; a changed or absent dependency forces remeasurement.",
+              "type": "object",
+              "propertyNames": {
+                "$ref": "urn:claimspec:v1:common#/$defs/repoPath"
+              },
+              "additionalProperties": {
+                "$ref": "urn:claimspec:v1:common#/$defs/sha256"
+              }
             }
           },
           "additionalProperties": false

{testguard_cli-0.14.1 → testguard_cli-0.15.0}/src/cli.mjs

@@ -44,6 +44,7 @@ probe
   --claims <path>      claims file             (default: <dir>/testguard.claims.json)
   --confirm <n>        runs per verdict        (default: 3)
   --budget <ms>        wall clock per run      (default: 120000)
+  --command-budget <ms> cooperative measurement deadline for probe, sweep, or replay. Caps async children; expiry exits 2 and writes no partial result
   --out <path>         evidence file           (default: <dir>/.testguard/evidence.json)
   --baseline <path>    baseline to gate against (default: <dir>/.testguard/baseline.json if present)
   --severity <level>   gate only at or above   (default: low)
@@ -84,7 +85,7 @@ sweep      --changed <ref> (required unless --save-paths; CI bases and a safe lo
            --save-paths      sweep every file that WRITES TO STORAGE instead of the diff, and report the surface as the
                              denominator: "120 writes across 38 files, swept 12". A clean sweep over an unstated
                              denominator is a sample of unknown size, not a guarantee that saving works
-           --include-dirty  --exclude <glob>  --confirm <n>  --budget <ms>  --max <n>  --out <path>  --json
+           --include-dirty  --exclude <glob>  --confirm <n>  --budget <ms>  --command-budget <ms>  --max <n>  --out <path>  --json
            the cold start: no claim and no concern needed. Everything it proposes is a DRAFT — it never writes testguard.claims.json,
            and its evidence never replaces .testguard/evidence.json. exit 1 on a fault that survived, or a file no test imports
            shapes: if-guard → if (false) · single-line guard/mutation removed · return <check> → return true
@@ -96,6 +97,7 @@ mcp        no options. JSON-RPC 2.0 over stdio; five READ-ONLY tools (status, br
 replay     --since <range>   commit range to search for fix commits (HEAD~50..HEAD, a tag, origin/main..HEAD)
            --max <n>         replay at most n fixes (they are slow: one worktree and N runs each)
            --confirm <n>     runs per verdict (default 3); a flaky failure reads as "the suite caught it", so mixed runs are never caught
+           --command-budget <ms> cooperative measurement deadline; expiry writes neither replay nor calibration, so an unmeasured suffix cannot look clean
            --out <path>       replay document (default: <dir>/.testguard/replay.json); the calibration goes beside it
            reports, never gates: a bug that escaped is history, not a regression in this change
                    · one-line JSX element removed · on<Event> handler prop dropped
@@ -142,6 +144,7 @@ export async function main(argv, io = { out: (s) => process.stdout.write(s + '\n
         claims: { type: 'string' },
         confirm: { type: 'string', default: '3' },
         budget: { type: 'string', default: '120000' },
+        'command-budget': { type: 'string' },
         out: { type: 'string' },
         evidence: { type: 'string' },
         baseline: { type: 'string' },

testguard_cli-0.15.0/src/command-budget.mjs

@@ -0,0 +1,52 @@
+import { PreconditionError } from './probe/worktree.mjs';
+import { performance } from 'node:perf_hooks';
+
+/**
+ * A cooperative measurement deadline shared by every stage of one command.
+ *
+ * Per-run budgets answer "how long may this runner invocation take?". This
+ * deadline answers the different question "may the whole command still
+ * produce a result?". Async child processes receive no more than the
+ * remaining time; synchronous setup can overrun because JavaScript cannot
+ * preempt it, so every stage boundary and every write boundary checks again.
+ * Expiry is deliberately not a verdict: a partial result would make the
+ * unattempted suffix look clean.
+ */
+export class CommandBudget {
+  constructor(limitMs, { now = () => performance.now() } = {}) {
+    if (!Number.isInteger(limitMs) || limitMs < 1) throw new TypeError('command budget must be a positive integer');
+    this.limitMs = limitMs;
+    this.now = now;
+    this.startedAtMs = now();
+  }
+
+  elapsedMs() {
+    return Math.max(0, this.now() - this.startedAtMs);
+  }
+
+  remainingMs() {
+    return Math.max(0, this.limitMs - this.elapsedMs());
+  }
+
+  assertOpen() {
+    if (this.remainingMs() === 0) {
+      throw new PreconditionError(`command budget of ${this.limitMs}ms exhausted; no partial result was written`);
+    }
+  }
+
+  /** Never let a child process outlive the command's remaining measurement window. */
+  runBudget(perRunMs) {
+    this.assertOpen();
+    return Math.max(1, Math.min(perRunMs, Math.floor(this.remainingMs())));
+  }
+}
+
+export function createCommandBudget(limitMs, options) {
+  return limitMs === undefined ? undefined : new CommandBudget(limitMs, options);
+}
+
+export function parseCommandBudget(value) {
+  if (value === undefined) return undefined;
+  const parsed = Number(value);
+  return Number.isInteger(parsed) && parsed >= 1000 ? parsed : null;
+}

{testguard_cli-0.14.1 → testguard_cli-0.15.0}/src/commands/probe.mjs

@@ -10,6 +10,7 @@ import { resolveChangedRef, withChangedRef } from '../gate/changed.mjs';
 import { costReport, renderCost } from '../probe/cost.mjs';
 import { progressMode, stageReporter, clearStageLine, recordEvent, isProgressMode, progressStream } from '../probe/progress.mjs';
 import { validate } from '../../spec/lib/validate.mjs';
+import { createCommandBudget, parseCommandBudget } from '../command-budget.mjs';
 export const provisionalEvidencePath = (projectDir) => join(projectDir, '.testguard', 'evidence-provisional.json');
 
 export const evidencePath = (projectDir) => join(projectDir, '.testguard', 'evidence.json');
@@ -36,10 +37,16 @@ export function partialScope(only, records) {
 export async function probeCommand({ projectDir, values, version }, io) {
   const confirmRuns = Number(values.confirm);
   const budgetMs = Number(values.budget);
+  const commandBudgetMs = parseCommandBudget(values['command-budget']);
   if (!Number.isInteger(confirmRuns) || confirmRuns < 1 || !Number.isInteger(budgetMs) || budgetMs < 1000) {
     io.err('--confirm must be a positive integer and --budget at least 1000');
     return 3;
   }
+  if (commandBudgetMs === null) {
+    io.err('--command-budget must be at least 1000 milliseconds');
+    return 3;
+  }
+  const commandBudget = createCommandBudget(commandBudgetMs);
   if (values.progress && !isProgressMode(values.progress)) {
     io.err(`--progress must be one of auto, tty, plain, ndjson, none (got ${values.progress})`);
     return 3;
@@ -74,6 +81,7 @@ export async function probeCommand({ projectDir, values, version }, io) {
     previous,
     confirmRuns,
     budgetMs,
+    commandBudget,
     mode: values['in-place'] ? 'in-place' : 'worktree',
     ref: values.ref ?? 'HEAD',
     refExplicit: values.ref !== undefined,
@@ -101,6 +109,7 @@ export async function probeCommand({ projectDir, values, version }, io) {
       if (values.verbose || r.verdict !== 'killed') io.out(renderRecord(r, { provisional, showDiscovered: firstOfClaim }) + (r.reusedFrom ? '  (reused)' : ''));
     },
   });
+  commandBudget?.assertOpen();
   writeSpecDoc('evidence', outPath, evidence);
 
   const g = gate(evidence.records, baseline, { severityFloor: values.severity });

{testguard_cli-0.14.1 → testguard_cli-0.15.0}/src/commands/replay.mjs

@@ -1,6 +1,7 @@
 import { dirname, join, resolve } from 'node:path';
 import { replay, calibrationFrom, renderReplay } from '../replay/replay.mjs';
 import { writeSpecDoc } from '../evidence/writer.mjs';
+import { createCommandBudget, parseCommandBudget } from '../command-budget.mjs';
 
 export const replayPath = (projectDir) => join(projectDir, '.testguard', 'replay.json');
 export const calibrationPath = (projectDir) => join(projectDir, '.testguard', 'calibration.json');
@@ -13,17 +14,24 @@ export async function replayCommand({ projectDir, values, version }, io) {
   }
   const confirmRuns = Number(values.confirm);
   const budgetMs = Number(values.budget);
+  const commandBudgetMs = parseCommandBudget(values['command-budget']);
   const limit = values.max ? Number(values.max) : undefined;
   if (!Number.isInteger(confirmRuns) || confirmRuns < 1 || !Number.isInteger(budgetMs) || budgetMs < 1000) {
     io.err('--confirm must be a positive integer and --budget at least 1000');
     return 3;
   }
+  if (commandBudgetMs === null) {
+    io.err('--command-budget must be at least 1000 milliseconds');
+    return 3;
+  }
+  const commandBudget = createCommandBudget(commandBudgetMs);
 
   const doc = await replay({
     projectDir,
     range,
     confirmRuns,
     budgetMs,
+    commandBudget,
     runnerCommand: values['runner-cmd'],
     runnerName: values.runner,
     nodeModules: values['node-modules'] ? resolve(values['node-modules']) : process.env.TESTGUARD_NODE_MODULES,
@@ -36,12 +44,17 @@ export async function replayCommand({ projectDir, values, version }, io) {
   });
 
   const outPath = values.out ? resolve(values.out) : replayPath(projectDir);
-  writeSpecDoc('replay', outPath, doc);
   const calibration = calibrationFrom(doc, { toolVersion: version });
   // Beside the replay document, whatever --out says: the two are one result,
   // and splitting them across directories loses the pairing — and leaves a
   // file behind in a repository the run is only meant to read.
   const calPath = values.baseline ? resolve(values.baseline) : values.out ? join(dirname(outPath), 'calibration.json') : calibrationPath(projectDir);
+  // Replay and calibration are one result. Cross the deadline boundary only
+  // after both complete documents exist in memory; serialization is then the
+  // documented non-interruptible final step, so expiry can never leave half
+  // of the pair as though it were complete.
+  commandBudget?.assertOpen();
+  writeSpecDoc('replay', outPath, doc);
   writeSpecDoc('calibration', calPath, calibration);
 
   if (values.json) {