testguard-cli 0.17.0__tar.gz → 0.18.1__tar.gz

testguard_cli-0.18.1/.github/scripts/benchmark-node-runner.mjs

@@ -0,0 +1,140 @@
+#!/usr/bin/env node
+// Narrow, reproducible comparison: the same classifier inputs and four existing
+// fault recipes, through real probe() calls with fresh workers and N=3.
+// Run under each Node executable with no other test process active:
+// node .github/scripts/benchmark-node-runner.mjs --out /absolute/receipt-dir
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { dirname, join, resolve } from 'node:path';
+import { tmpdir, platform, arch } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { parseArgs } from 'node:util';
+import { performance } from 'node:perf_hooks';
+import { probe } from '../../src/probe/probe.mjs';
+import { writeSpecDoc } from '../../src/evidence/writer.mjs';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
+const { values } = parseArgs({ options: { out: { type: 'string' }, pairs: { type: 'string', default: '2' } } });
+assert(values.out, '--out is required; timings and proof receipts are retained there');
+const pairs = Number(values.pairs);
+assert(Number.isSafeInteger(pairs) && pairs >= 1 && pairs <= 10, '--pairs must be 1..10');
+const out = resolve(values.out);
+mkdirSync(out, { recursive: true });
+const classifier = readFileSync(join(ROOT, 'src/probe/classify.mjs'), 'utf8');
+const inventory = JSON.parse(readFileSync(join(ROOT, 'testguard.claims.json'), 'utf8'));
+const ids = ['TG-KILL-NEEDS-N', 'TG-TIMEOUT-NEVER-KILLS', 'TG-COMPILE-ERROR-NAMED', 'TG-SURVIVOR-PROVES-THE-SUBJECT-RUNS'];
+const claims = { ...inventory, claims: ids.map((id) => {
+  const claim = structuredClone(inventory.claims.find((c) => c.id === id));
+  assert(claim && claim.faults.length === 1, `expected one unchanged recipe for ${id}`);
+  claim.defendedBy = ['test/classify.test.mjs'];
+  return claim;
+}) };
+const pass = { outcome: 'pass', assertionFailures: 0, timeouts: 0 };
+const kill = { outcome: 'fail', assertionFailures: 1, timeouts: 0 };
+const timeout = { outcome: 'fail', assertionFailures: 0, timeouts: 1 };
+const error = { outcome: 'error', assertionFailures: 0, timeouts: 0 };
+const healthy = { defenders: ['test/classify.test.mjs'], anchor: { status: 'ok' }, baselineRuns: [pass, pass, pass], probeRuns: [pass, pass, pass], confirmRuns: 3 };
+const rows = [
+  ['nocover precedes missing anchor', { defenders: [], anchor: { status: 'anchor-missing' } }, { verdict: 'nocover' }],
+  ['missing anchor', { anchor: { status: 'anchor-missing' } }, { verdict: 'unverifiable', reason: 'anchor-missing' }],
+  ['ambiguous anchor', { anchor: { status: 'anchor-ambiguous' } }, { verdict: 'unverifiable', reason: 'anchor-ambiguous' }],
+  ['failed defender load', { anchor: { status: 'defenders-failed-to-load' }, baselineRuns: [error] }, { verdict: 'unverifiable', reason: 'defenders-failed-to-load' }],
+  ['red baseline', { baselineRuns: [pass, kill] }, { verdict: 'flaky-defender', reason: 'defenders-not-green' }],
+  ['empty baseline', { baselineRuns: [] }, { verdict: 'flaky-defender', reason: 'defenders-not-green' }],
+  ['load failure', { probeRuns: [error] }, { verdict: 'fault-invalid', reason: 'suite-failed-to-load' }],
+  ['syntax error', { probeRuns: [{ ...error, loadMessage: 'Failed to parse source: invalid JS syntax' }] }, { verdict: 'fault-invalid', reason: 'replacement-does-not-compile' }],
+  ['esbuild syntax error', { probeRuns: [{ ...error, loadMessage: 'Transform failed with 1 error: Expected ")" but found ";"' }] }, { verdict: 'fault-invalid', reason: 'replacement-does-not-compile' }],
+  ['test timeout', { probeRuns: [timeout] }, { verdict: 'timeout', reason: 'test-timed-out' }],
+  ['budget timeout', { probeRuns: [{ ...timeout, outcome: 'timeout' }] }, { verdict: 'timeout', reason: 'test-timed-out' }],
+  ['confirmed kill', { probeRuns: [kill, kill, kill] }, { verdict: 'killed' }],
+  ['confirmed survivor', {}, { verdict: 'survived' }],
+  ['mixed confirmations', { probeRuns: [kill, pass, kill] }, { verdict: 'flaky-defender', reason: 'inconsistent-probe' }],
+  ['failure without assertions', { probeRuns: [{ outcome: 'fail', assertionFailures: 0, timeouts: 0 }, pass, pass] }, { verdict: 'flaky-defender', reason: 'inconsistent-probe' }],
+  ['unreached survivor', { subjectReached: false }, { verdict: 'unverifiable', reason: 'subject-not-executed' }],
+  ['reached survivor', { subjectReached: true }, { verdict: 'survived' }],
+];
+const corpus = rows.map(([name, changes, expected]) => [name, { ...healthy, ...changes }, expected]);
+const sha256 = (text) => createHash('sha256').update(text).digest('hex');
+const toolSources = Object.fromEntries(['node-test.mjs', 'node/runner.mjs', 'node/entry.mjs', 'node/report.mjs', 'shared.mjs', 'discovery.mjs', 'lifecycle.mjs', 'vitest.mjs'].map((file) => [file, sha256(readFileSync(join(ROOT, 'src/probe/runners', file)))]));
+const vitestVersion = JSON.parse(readFileSync(join(ROOT, 'node_modules/vitest/package.json'), 'utf8')).version;
+const proofProjection = (evidence) => evidence.records.map((r) => ({
+  id: `${r.claim.id}/${r.subject.id}`, verdict: r.verdict, reason: r.detail.reason ?? null,
+  baseline: r.detail.baselineRuns.map(({ durationMs, ...run }) => run),
+  probe: r.detail.probeRuns.map(({ durationMs, ...run }) => run),
+}));
+const results = [];
+async function measure(engine, label) {
+  const dir = mkdtempSync(join(tmpdir(), 'testguard-benchmark-'));
+  const receipts = join(out, `${label}-${engine}-workers.jsonl`);
+  const outcomes = join(out, `${label}-${engine}-outcomes.jsonl`);
+  writeFileSync(receipts, '', { mode: 0o600 });
+  writeFileSync(outcomes, '', { mode: 0o600 });
+  try {
+    mkdirSync(join(dir, 'src/probe'), { recursive: true }); mkdirSync(join(dir, 'test'));
+    writeFileSync(join(dir, 'src/probe/classify.mjs'), classifier);
+    writeFileSync(join(dir, 'package.json'), JSON.stringify({ private: true, type: 'module', ...(engine === 'vitest' ? { devDependencies: { vitest: vitestVersion } } : {}) }));
+    writeFileSync(join(dir, 'testguard.claims.json'), JSON.stringify(claims));
+    const imports = engine === 'vitest' ? "import {it,expect} from 'vitest';" : "import {test as it} from 'node:test'; import assert from 'node:assert/strict';";
+    const assertion = engine === 'vitest' ? 'expect(classify(input)).toEqual(expected)' : 'assert.deepStrictEqual(classify(input),expected)';
+    writeFileSync(join(dir, 'test/classify.test.mjs'), `${imports}
+import {appendFileSync,readFileSync} from 'node:fs'; import {createHash} from 'node:crypto'; import {classify} from '../src/probe/classify.mjs';
+const sourceHash=createHash('sha256').update(readFileSync(new URL('../src/probe/classify.mjs',import.meta.url))).digest('hex');
+appendFileSync(${JSON.stringify(receipts)},JSON.stringify({pid:process.pid,execPath:process.execPath,version:process.versions.node,collect:process.env.TESTGUARD_NODE_COLLECT==='1'})+'\\n');
+const record=(name,passed)=>appendFileSync(${JSON.stringify(outcomes)},JSON.stringify({pid:process.pid,sourceHash,name,passed})+'\\n');
+for(const [name,input,expected] of ${JSON.stringify(corpus)}) it(name,()=>{try{${assertion};record(name,true);}catch(error){record(name,false);throw error;}});\n`);
+    if (engine === 'vitest') symlinkSync(join(ROOT, 'node_modules'), join(dir, 'node_modules'), 'junction');
+    writeFileSync(join(dir, '.gitignore'), 'node_modules/\n.testguard/\n');
+    for (const args of [['init', '-q'], ['add', '.'], ['-c', 'user.name=benchmark', '-c', 'user.email=benchmark@example.invalid', 'commit', '-qm', 'benchmark']]) execFileSync('git', args, { cwd: dir, timeout: 5000 });
+    const start = performance.now();
+    const evidence = await probe({ projectDir: dir, claims, runnerName: engine, confirmRuns: 3, budgetMs: 30_000, workers: 1, serial: true, escalate: false, toolVersion: 'benchmark' });
+    const wallMs = performance.now() - start;
+    writeSpecDoc('evidence', join(out, `${label}-${engine}-evidence.json`), evidence);
+    assert.equal(evidence.records.length, 4);
+    for (const r of evidence.records) {
+      assert.equal(r.verdict, 'killed', `${r.claim.id} must be caught by both frameworks`);
+      assert.equal(r.detail.baselineRuns.length, 3); assert.equal(r.detail.probeRuns.length, 3);
+      for (const run of r.detail.baselineRuns) { assert.equal(run.outcome, 'pass'); assert.equal(run.tests.total, corpus.length); }
+      for (const run of r.detail.probeRuns) { assert.equal(run.outcome, 'fail'); assert(run.assertionFailures > 0); assert.equal(run.tests.total, corpus.length); }
+    }
+    const workers = readFileSync(receipts, 'utf8').trim().split('\n').map(JSON.parse).filter((r) => !r.collect);
+    assert.equal(workers.length, 15, 'three shared baseline runs plus four faults times three confirmations');
+    assert.equal(new Set(workers.map((r) => r.pid)).size, 15, 'each confirmation must have a fresh worker');
+    for (const r of workers) { assert.equal(r.version, process.versions.node); assert.equal(r.execPath, process.execPath); }
+    const testResults = readFileSync(outcomes, 'utf8').trim().split('\n').map(JSON.parse);
+    assert.equal(testResults.length, 15 * corpus.length, 'every test must execute in every measured worker');
+    const bySource = new Map();
+    for (const worker of workers) {
+      const tests = testResults.filter((r) => r.pid === worker.pid);
+      assert.equal(tests.length, corpus.length); assert.equal(new Set(tests.map((r) => r.name)).size, corpus.length);
+      assert.equal(new Set(tests.map((r) => r.sourceHash)).size, 1);
+      const { sourceHash } = tests[0]; const projection = tests.map(({ name, passed }) => ({ name, passed }));
+      const prior = bySource.get(sourceHash);
+      if (prior) { assert.deepStrictEqual(prior.tests, projection, 'confirmations must agree per test'); prior.confirmations++; }
+      else bySource.set(sourceHash, { sourceHash, confirmations: 1, tests: projection });
+    }
+    assert.equal(bySource.size, 5, 'healthy source and four distinct mutations');
+    for (const group of bySource.values()) assert.equal(group.confirmations, 3);
+    assert.equal(execFileSync('git', ['status', '--porcelain'], { cwd: dir, encoding: 'utf8' }), '', 'probe must restore the measured tree');
+    const runnerMs = evidence.records.flatMap((r, i) => [...(i === 0 ? r.detail.baselineRuns : []), ...r.detail.probeRuns]).reduce((sum, r) => sum + r.durationMs, 0);
+    const result = { label, engine, wallMs, runnerMs, workerCount: workers.length, projection: proofProjection(evidence), testProjection: [...bySource.values()].sort((a,b) => a.sourceHash.localeCompare(b.sourceHash)) };
+    console.log(JSON.stringify({ label, engine, wallMs: Math.round(wallMs), runnerMs }));
+    return result;
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+}
+// One unmeasured warm-up per engine, then reversed-order pairs. No parallel
+// execution, evidence reuse or reduction in confirmations contributes to speed.
+await measure('vitest', 'warmup'); await measure('node-test', 'warmup');
+for (let i = 0; i < pairs; i++) {
+  const pair = [];
+  for (const engine of i % 2 ? ['node-test', 'vitest'] : ['vitest', 'node-test']) pair.push(await measure(engine, `pair-${i + 1}`));
+  assert.deepStrictEqual(pair[0].projection, pair[1].projection, 'every verdict and run count must agree');
+  assert.deepStrictEqual(pair[0].testProjection, pair[1].testProjection, 'every baseline, failed test identity and passed test must agree');
+  results.push(...pair);
+}
+const median = (numbers) => { const sorted = [...numbers].sort((a,b) => a-b); const middle = Math.floor(sorted.length/2); return sorted.length%2 ? sorted[middle] : (sorted[middle-1]+sorted[middle])/2; };
+const medians = Object.fromEntries(['vitest', 'node-test'].map((engine) => [engine, median(results.filter((r) => r.engine === engine).map((r) => r.wallMs))]));
+const receipt = { scope: 'One classifier file, 17 identical inputs, four unchanged fault recipes, N=3; no generic framework compatibility claim.', generatedAt: new Date().toISOString(), runtime: { version: process.versions.node, execPath: process.execPath, platform: platform(), arch: arch(), vitestVersion }, classifierHash: sha256(classifier), corpusHash: sha256(JSON.stringify(corpus)), claimsHash: sha256(JSON.stringify(claims)), toolSources, pairs, medians, speedup: medians.vitest/medians['node-test'], results };
+writeFileSync(join(out, 'summary.json'), JSON.stringify(receipt, null, 2)+'\n');
+console.log(JSON.stringify({ medians, speedup: receipt.speedup }));

testguard_cli-0.18.1/.github/scripts/check-node-fixture.mjs

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+// No test-framework dependencies: this also verifies the exact Node20.0.0 floor.
+import assert from 'node:assert/strict';
+import { cpSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { execFileSync, spawnSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { readSpecDoc } from '../../src/evidence/writer.mjs';
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
+const scratch = mkdtempSync(join(tmpdir(), 'tg-native-oracle-'));
+try {
+  cpSync(join(root, 'fixtures/known-answer-node'), scratch, { recursive: true });
+  for (const args of [['init', '-q'], ['add', '.'], ['-c', 'user.name=fixture', '-c', 'user.email=fixture@example.invalid', 'commit', '-qm', 'fixture']]) execFileSync('git', args, { cwd: scratch, timeout: 5000 });
+  const result = spawnSync(process.execPath, [join(root, 'cli/testguard.mjs'), 'probe', scratch, '--runner', 'node-test', '--budget', '10000', '--quiet'], { encoding: 'utf8', timeout: 60_000 });
+  assert.equal(result.status, 1, `${result.error ?? ''}\n${result.stderr}\n${result.stdout}`);
+  const evidence = readSpecDoc('evidence', join(scratch, '.testguard/evidence.json'));
+  const expected = JSON.parse(readFileSync(join(root, 'fixtures/known-answer-node/expected.json'), 'utf8')).expected;
+  assert.deepStrictEqual(evidence.run.runner, { name: 'node-test', source: 'builtin', version: process.versions.node });
+  assert.equal(evidence.records.length, Object.keys(expected).length);
+  for (const record of evidence.records) {
+    const oracle = expected[`${record.claim.id}/${record.subject.id}`];
+    assert(oracle); assert.equal(record.verdict, oracle.verdict);
+    if (oracle.reason) assert.equal(record.detail.reason, oracle.reason);
+  }
+  assert.equal(execFileSync('git', ['status', '--porcelain'], { cwd: scratch, encoding: 'utf8' }), '');
+  console.log(`native Node ${process.versions.node}: all ${evidence.records.length} independently verified verdicts match; targets restored`);
+} finally { rmSync(scratch, { recursive: true, force: true }); }

{testguard_cli-0.17.0 → testguard_cli-0.18.1}/.github/scripts/install-smoke.mjs

@@ -30,6 +30,19 @@ try {
 
   const bin = join(consumer, 'node_modules', '.bin', process.platform === 'win32' ? 'testguard.cmd' : 'testguard');
   const version = run(bin, ['--version'], consumer).trim();
+  const nativeProject = join(scratch, 'native-node');
+  mkdirSync(join(nativeProject, 'test'), { recursive: true });
+  writeFileSync(join(nativeProject, 'package.json'), '{"type":"module"}');
+  writeFileSync(join(nativeProject, 'test', 'native.test.mjs'), "import {test} from 'node:test';import assert from 'node:assert/strict';test('installed native runner',()=>assert.equal(2+2,4));");
+  const installedNodeRunner = join(consumer, 'node_modules', 'testguard-cli', 'src', 'probe', 'runners', 'node-test.mjs');
+  run(process.execPath, ['--input-type=module', '-e',
+    `import {pathToFileURL} from 'node:url'; const {discoverTests,run}=await import(pathToFileURL(process.argv[1]));
+     const projectDir=process.argv[2];const manifest=await discoverTests({projectDir,version:process.versions.node});
+     if(JSON.stringify(manifest.files)!==JSON.stringify(['test/native.test.mjs']))throw new Error('installed native entry discovery failed');
+     const result=await run({projectDir,files:manifest.files,budgetMs:5000});
+     if(result.run.outcome!=='pass'||result.run.tests.passed!==1)throw new Error('production-only native Node runner failed');`,
+    installedNodeRunner, nativeProject,
+  ], consumer);
   const emptyProject = join(scratch, 'empty-adoption');
   mkdirSync(emptyProject);
   writeFileSync(join(emptyProject, 'testguard.claims.json'), JSON.stringify({ schemaVersion: 1, claims: [] }));

{testguard_cli-0.17.0 → testguard_cli-0.18.1}/.github/workflows/ci.yml

@@ -122,6 +122,9 @@ jobs:
             console.log('jest fixture verdicts match expected.json:', ev.records.length);
           "
 
+      - name: probe the native Node fixture without test dependencies
+        run: node .github/scripts/check-node-fixture.mjs
+
       # ── The MCP server, driven as a client would: handshake, list, call.
       #    A harness-independent surface is only worth having if it actually
       #    speaks the protocol from a cold start. ──
@@ -205,7 +208,7 @@ jobs:
       #    a survivor here is a failure either way. ──
       - name: Restore previous self-probe evidence (verdict reuse)
         if: matrix.node-version == 22
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .testguard/ci-self-evidence.json
           key: self-evidence-${{ hashFiles('testguard.claims.json') }}-${{ github.sha }}
@@ -244,6 +247,20 @@ jobs:
           path: .testguard/ci-self-evidence.json
           if-no-files-found: warn
 
+  native-node-floor:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '20.0.0'
+      - name: Install production dependencies only
+        run: npm ci --omit=dev
+      - name: Verify the native Node floor against the independent oracle
+        run: node .github/scripts/check-node-fixture.mjs
+
   # ── Python: two engines, one oracle. The stdlib leg runs FIRST and with no
   #    pip install of any kind, because "a project with no test dependencies
   #    still probes" is a claim about the tool and the only way to keep it true

{testguard_cli-0.17.0 → testguard_cli-0.18.1}/CHANGELOG.md

@@ -7,6 +7,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.18.1] - 2026-10-01
+
+Automated weekly release — everything merged since `v0.18.0`.
+
+### Changed
+
+- test: consolidate native runtime acceptance checks
+- perf: isolate native admission mutation defenders
+- perf: size bounded report buffers to observed files
+- chore(homebrew): sha256 for v0.18.0 (#194)
+
+
+### Changed
+
+- Runner report and discovery-config reads reserve memory for the observed
+  file size instead of the maximum allowed size, retaining the hard byte
+  ceiling and checking file growth before parsing.
+- Native-runner admission self-probes use focused defenders, preserving the
+  fault recipes and full runner acceptance coverage while avoiding unrelated
+  timeout and process-cleanup checks for each admission confirmation.
+
+## [0.18.0] - 2026-10-01
+
+Automated weekly release — everything merged since `v0.17.0`.
+
+### Changed
+
+- Merge branch 'main' into dependabot/github_actions/all-actions-d5b8684899
+- feat: native Node probes with measured startup savings (#192)
+- chore(homebrew): sha256 for v0.17.0 (#191)
+- chore(deps): bump actions/cache
+
+
+### Added
+
+- Explicit `--runner node-test` support for plain JavaScript projects using
+  Node's built-in test framework, with native entry-file discovery, fresh
+  process confirmations and bounded structured reports. No runner is installed
+  and existing automatic runner selection is unchanged.
+
 ## [0.17.0] - 2026-10-01
 
 Automated weekly release — everything merged since `v0.16.0`.

{testguard_cli-0.17.0 → testguard_cli-0.18.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: testguard-cli
-Version: 0.17.0
+Version: 0.18.1
 Summary: Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest. Ships the Node.js CLI (requires Node.js 20+).
 Project-URL: Homepage, https://github.com/raccioly/testguard
 Project-URL: Documentation, https://github.com/raccioly/testguard#readme
@@ -151,9 +151,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.17.0` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.18.1` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.17.0/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.18.1/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -326,7 +326,23 @@ npx testguard-cli admit test/x.test.ts --claim X   # is this test green on HEAD
    version, its own bin script — and only then from an executable on PATH,
    which the evidence records as `runner.source: "path"`; `npx` is never
    asked, because its cache answers for packages a project does not have.
-   Anything else goes through `--runner-cmd`. Each runner is proven against
+   **Node's built-in framework** uses explicit `--runner node-test` with plain
+   JavaScript test files and default Node collection. It uses the Node executable
+   running TestGuard, records `runner.source: "builtin"` and its actual version,
+   and installs nothing. Discovery loads test modules with test bodies filtered
+   out, so top-level code can run. Custom loaders, `NODE_OPTIONS`, `NODE_PATH`
+   and module-mocking configurations are outside this initial adapter's scope.
+   `auto` keeps its existing runner order. Each confirmation uses fresh isolated
+   processes and the same worker, timeout and confirmation rules.
+
+   To reproduce the narrow native-runner comparison, run
+   `node .github/scripts/benchmark-node-runner.mjs --out /absolute/receipt-dir`
+   from this repository after installing its pinned development dependencies.
+   It compares 17 identical classifier inputs and four existing faults through
+   complete probes, with three confirmations, fresh worker receipts and
+   reversed execution order. Results describe that workload and runtime only.
+
+   Other frameworks go through `--runner-cmd`. Each runner is proven against
    its own copy of the known-answer fixture.
 
    **Python** runs under `pytest` when the project's interpreter can import
@@ -793,12 +809,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.17.0
+- uses: raccioly/testguard@v0.18.1
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.17.0/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.18.1/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 

{testguard_cli-0.17.0 → testguard_cli-0.18.1}/README.md

@@ -127,9 +127,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.17.0` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.18.1` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.17.0/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.18.1/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -302,7 +302,23 @@ npx testguard-cli admit test/x.test.ts --claim X   # is this test green on HEAD
    version, its own bin script — and only then from an executable on PATH,
    which the evidence records as `runner.source: "path"`; `npx` is never
    asked, because its cache answers for packages a project does not have.
-   Anything else goes through `--runner-cmd`. Each runner is proven against
+   **Node's built-in framework** uses explicit `--runner node-test` with plain
+   JavaScript test files and default Node collection. It uses the Node executable
+   running TestGuard, records `runner.source: "builtin"` and its actual version,
+   and installs nothing. Discovery loads test modules with test bodies filtered
+   out, so top-level code can run. Custom loaders, `NODE_OPTIONS`, `NODE_PATH`
+   and module-mocking configurations are outside this initial adapter's scope.
+   `auto` keeps its existing runner order. Each confirmation uses fresh isolated
+   processes and the same worker, timeout and confirmation rules.
+
+   To reproduce the narrow native-runner comparison, run
+   `node .github/scripts/benchmark-node-runner.mjs --out /absolute/receipt-dir`
+   from this repository after installing its pinned development dependencies.
+   It compares 17 identical classifier inputs and four existing faults through
+   complete probes, with three confirmations, fresh worker receipts and
+   reversed execution order. Results describe that workload and runtime only.
+
+   Other frameworks go through `--runner-cmd`. Each runner is proven against
    its own copy of the known-answer fixture.
 
    **Python** runs under `pytest` when the project's interpreter can import
@@ -769,12 +785,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.17.0
+- uses: raccioly/testguard@v0.18.1
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.17.0/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.18.1/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 

{testguard_cli-0.17.0 → testguard_cli-0.18.1}/action.yml

@@ -50,7 +50,7 @@ inputs:
   version:
     description: 'testguard-cli version to run'
     required: false
-    default: '0.17.0'
+    default: '0.18.1'
   node-version:
     description: 'Node.js version (20+)'
     required: false

{testguard_cli-0.17.0 → testguard_cli-0.18.1}/docs/testguard-explained.html

@@ -144,7 +144,7 @@
 <div class="page">
   <div class="masthead">
     <div class="wordmark">Test<span class="mark">Guard</span></div>
-    <div class="meta">Technical Brief · v0.17.0 · MIT</div>
+    <div class="meta">Technical Brief · v0.18.1 · MIT</div>
   </div>
 
   <h1>Your tests pass. That is not the same as your tests working.</h1>

{testguard_cli-0.17.0 → testguard_cli-0.18.1}/docs-canonical/ARCHITECTURE.md

@@ -85,7 +85,7 @@ other tools, and it must remain portable out of this repository.
 | Runtime | Node.js >= 20, ESM | `node:util.parseArgs` is the floor; the first target runners are JavaScript |
 | Runtime dependencies | exactly one, `ajv` 8.20.0, exact-pinned | Every document is validated before it is written; everything else is standard library |
 | Test runner (ours) | vitest | Also our first supported runner, so we dogfood it |
-| Supported runners | vitest, jest (project runners); Playwright (per file) | They share a JSON report shape; Playwright is selected per file, not per project |
+| Supported runners | vitest, jest, explicit node-test (project runners); Playwright and Python (per file) | Native Node uses an injected entry preload and bounded structured reporter, reusing shared process budgets; auto selection does not infer Node eligibility from its availability |
 | Schemas | JSON Schema 2020-12 | Readable without the tool; portable to other languages |
 | Distribution | npm, PyPI, Homebrew, GitHub Action, pre-commit, GitLab component | Meet teams in the pipeline they already run |
 | Publishing | OIDC for npm/PyPI; tap-scoped SSH deploy key for Homebrew | Registry credentials remain tokenless; the only stored publishing secret cannot access any repository except the tap |

{testguard_cli-0.17.0 → testguard_cli-0.18.1}/docs-canonical/REQUIREMENTS.md

@@ -21,7 +21,7 @@
 | FR-07 | Report where the suite is blind to an agent before it writes code (`brief`, `status`, MCP) | P1 |
 | FR-08 | Fail when a changed source file carries no claim and no excusing ignore entry (`gate --changed`) | P1 |
 | FR-09 | Exclude tests that mock the subject from defender discovery, and report them | P1 |
-| FR-10 | Support vitest and jest as project runners, and Playwright per file | P2 |
+| FR-10 | Support vitest, jest and explicit native Node as project runners, plus Playwright and Python per file; native Node initially admits default JavaScript collection without custom loaders | P2 |
 | FR-11 | Propose faults mechanically for a source file, as a draft a human keeps or drops (`scaffold`) | P2 |
 | FR-12 | Answer whether one test satisfies the two-gate rule for a claim (`admit`) | P2 |
 | FR-13 | Replay historical fix commits to measure whether the suite would have caught them, and calibrate by fault class | P3 |
@@ -47,7 +47,7 @@
 
 | Criterion | Target | Status at v0.6.0 |
 |---|---|---|
-| Reproduces a known-answer oracle for every verdict, per runner | 3 runners | met — vitest, jest, Playwright fixtures |
+| Reproduces a known-answer oracle for every verdict, per runner | Every supported engine | vitest, jest, Playwright, Python and native Node fixtures; native Node expected outcomes verified through direct Node CLI runs |
 | Self-verification gates the release | every fault killed | met — 62 faults, all killed |
 | Finds real blind spots in real code | field evidence, not synthetic | met — two independent field reports on AI-authored codebases; 8 of 9 historical bugs invisible to a 4,900-test suite; 21 of 39 faults survived a green suite on a second codebase |
 | Every field-report defect closed | 11 of 11 | met at v0.6.0 |

testguard_cli-0.18.1/fixtures/known-answer-node/.gitignore

@@ -0,0 +1,3 @@
+.baseline-counter
+.probe-counter
+.testguard/

testguard_cli-0.18.1/fixtures/known-answer-node/README.md

@@ -0,0 +1,15 @@
+# Native Node known-answer fixture
+
+This neutral project uses only Node test/assert APIs. The intended guarantees
+are recorded in its claims document. The audit defender deliberately asserts
+only the row kind, so it misses exposed content. The unused module has no
+importing defender. The two counter tests deliberately model an unstable
+baseline and a mixed response to the fault. The unused module declared against
+the policy defender tests the negative control: that test never imports it.
+
+Do not run these intentionally faulty/flaky cases as a normal project suite.
+Before accepting expected.json, apply each exact recipe manually in a scratch
+copy, run its real declared defenders with the Node test CLI, inspect baseline,
+fault and restored results, and record the interpretation independently of
+TestGuard. A timeout, syntax error and incomplete confirmation are unproven.
+The fixture requires no installed package or network access.

testguard_cli-0.18.1/fixtures/known-answer-node/expected.json

@@ -0,0 +1,51 @@
+{
+  "confirmRuns": 3,
+  "expected": {
+    "NODE-ALLOW/F1": {
+      "verdict": "killed",
+      "why": "Manually applied fault: public/private assertions fail in all three native CLI runs; baseline/restored run green three times."
+    },
+    "NODE-AUDIT/F1": {
+      "verdict": "survived",
+      "why": "Manually applied exposed content: kind-only assertion remains green in all three native runs."
+    },
+    "NODE-READY/F1": {
+      "verdict": "timeout",
+      "why": "Native CLI explicitly reports testTimeoutFailure in all three faulted runs, not assertion rejection."
+    },
+    "NODE-UNUSED/F1": {
+      "verdict": "nocover",
+      "why": "No native test entry imports the unused module; no defender is declared."
+    },
+    "NODE-ANCHOR/F1": {
+      "verdict": "unverifiable",
+      "reason": "anchor-missing",
+      "why": "Exact find has zero occurrences in independently inspected source."
+    },
+    "NODE-ANCHOR/F2": {
+      "verdict": "unverifiable",
+      "reason": "anchor-ambiguous",
+      "why": "Exact return true anchor occurs twice and expects one hit."
+    },
+    "NODE-SYNTAX/F1": {
+      "verdict": "fault-invalid",
+      "reason": "replacement-does-not-compile",
+      "why": "Manual replacement makes native CLI fail while importing, before test-body assertions."
+    },
+    "NODE-FLAKY/F1": {
+      "verdict": "flaky-defender",
+      "reason": "defenders-not-green",
+      "why": "Unmodified native baseline exits 1,0,1; fault detection cannot be confirmed on that baseline."
+    },
+    "NODE-MIXED/F1": {
+      "verdict": "flaky-defender",
+      "reason": "inconsistent-probe",
+      "why": "Three healthy native baselines pass; faulted native runs exit 1,0,1."
+    },
+    "NODE-REACH/F1": {
+      "verdict": "unverifiable",
+      "reason": "subject-not-executed",
+      "why": "Manual fatal syntax in the unused target still leaves all three declared-defender runs green."
+    }
+  }
+}

testguard_cli-0.18.1/fixtures/known-answer-node/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "testguard-known-answer-node",
+  "private": true,
+  "version": "0.0.0",
+  "type": "module",
+  "scripts": {
+    "test": "node --test"
+  }
+}

testguard_cli-0.18.1/fixtures/known-answer-node/src/policy.mjs

@@ -0,0 +1,15 @@
+export function allowed(kind) {
+  return kind === 'public';
+}
+export function audit(row) {
+  return { kind: row.kind, content: null };
+}
+export async function ready() {
+  return true;
+}
+export function duplicateAnchor() {
+  return true;
+}
+export function value() {
+  return 1;
+}

testguard_cli-0.18.1/fixtures/known-answer-node/src/unused.mjs

@@ -0,0 +1 @@
+export const unused = 7;

testguard_cli-0.18.1/fixtures/known-answer-node/test/flaky.test.mjs

@@ -0,0 +1,11 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { value } from '../src/policy.mjs';
+test('deliberately flaky baseline', () => {
+  const file = '.baseline-counter';
+  const next = (existsSync(file) ? Number(readFileSync(file, 'utf8')) : 0) + 1;
+  writeFileSync(file, String(next));
+  assert.equal(next % 2, 0);
+  assert.equal(value(), 1);
+});

testguard_cli-0.18.1/fixtures/known-answer-node/test/mixed.test.mjs

@@ -0,0 +1,11 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { value } from '../src/policy.mjs';
+test('deliberately mixed fault response', () => {
+  if (value() === 1) { assert.equal(value(), 1); return; }
+  const file = '.probe-counter';
+  const next = (existsSync(file) ? Number(readFileSync(file, 'utf8')) : 0) + 1;
+  writeFileSync(file, String(next));
+  assert.equal(next % 2, 0);
+});

testguard_cli-0.18.1/fixtures/known-answer-node/test/policy.test.mjs

@@ -0,0 +1,15 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { allowed, audit, ready } from '../src/policy.mjs';
+test('only the public kind is allowed', () => {
+  assert.equal(allowed('public'), true);
+  assert.equal(allowed('private'), false);
+});
+test('the audit row has its kind', () => {
+  assert.equal(audit({ kind: 'public', content: 'private payload' }).kind, 'public');
+});
+test('readiness resolves', { timeout: 100 }, async (t) => {
+  const hold = setInterval(() => {}, 1000);
+  t.signal.addEventListener('abort', () => clearInterval(hold), { once: true });
+  try { assert.equal(await ready(), true); } finally { clearInterval(hold); }
+});