testguard-cli 0.2.0__tar.gz → 0.2.1__tar.gz

testguard_cli-0.2.1/.codex/hooks.json

@@ -0,0 +1,71 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Read",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.wolf/hooks/pre-read.js\"",
+            "timeout": 5
+          }
+        ]
+      },
+      {
+        "matcher": "Write|Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.wolf/hooks/pre-write.js\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Read",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.wolf/hooks/post-read.js\"",
+            "timeout": 5
+          }
+        ]
+      },
+      {
+        "matcher": "Write|Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.wolf/hooks/post-write.js\"",
+            "timeout": 10
+          }
+        ]
+      }
+    ],
+    "SessionStart": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.wolf/hooks/session-start.js\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.wolf/hooks/stop.js\"",
+            "timeout": 10
+          }
+        ]
+      }
+    ]
+  }
+}

{testguard_cli-0.2.0 → testguard_cli-0.2.1}/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.1] - 2026-09-17
+
+### Added
+
+- **Provisional verdicts** (#5). A run with `--confirm` below 3 declares
+  `run.provisional: true` — a spec field whose equivalence with
+  `confirmRuns < 3` the validator enforces both ways. Provisional verdicts
+  print with a `?`, the summary is prefixed `PROVISIONAL`, a warning is
+  printed on stderr, evidence is written to `.testguard/evidence-provisional.json`
+  so the canonical file only ever holds confirmed runs, `brief` warns at the
+  top, and `baseline` refuses provisional evidence unless
+  `--allow-provisional`. A confirmed prior verdict is never reused by a
+  provisional run, nor the reverse.
+
 ## [0.2.0] - 2026-09-17
 
 ### Added

{testguard_cli-0.2.0 → testguard_cli-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: testguard-cli
-Version: 0.2.0
+Version: 0.2.1
 Summary: Proves a test suite actually defends the claims a project makes: injects the faults those claims forbid and reports every one the tests miss. Python wrapper for the Node.js CLI (requires Node.js 20+).
 Project-URL: Homepage, https://github.com/raccioly/testguard
 Project-URL: Documentation, https://github.com/raccioly/testguard#readme
@@ -76,7 +76,7 @@ tests were written against the survivors, 39/39 were killed.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.2.0` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.2.1` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
@@ -136,7 +136,10 @@ npx testguard-cli scaffold src/x.ts   # propose faults for a file, as a draft to
    Practical loop: first pass `--no-escalate` (escalation re-runs the whole
    suite N times per survivor); iterate on one claim with `--claim <ID>` and
    either `--include-dirty` or `--in-place` (only fault target files must be
-   clean there; test files may be dirty); final pass with defaults. By default
+   clean there; test files may be dirty), optionally `--confirm 1` for a fast
+   **provisional** signal — verdicts print with a `?`, evidence goes to
+   `evidence-provisional.json`, and `baseline` refuses it; final pass with
+   defaults. By default
    the stream shows only unproven faults plus a killed count — `--verbose`
    shows every fault. A custom
    runner (`pnpm --filter`, a specific config) goes in

{testguard_cli-0.2.0 → testguard_cli-0.2.1}/README.md

@@ -52,7 +52,7 @@ tests were written against the survivors, 39/39 were killed.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.2.0` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.2.1` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
@@ -112,7 +112,10 @@ npx testguard-cli scaffold src/x.ts   # propose faults for a file, as a draft to
    Practical loop: first pass `--no-escalate` (escalation re-runs the whole
    suite N times per survivor); iterate on one claim with `--claim <ID>` and
    either `--include-dirty` or `--in-place` (only fault target files must be
-   clean there; test files may be dirty); final pass with defaults. By default
+   clean there; test files may be dirty), optionally `--confirm 1` for a fast
+   **provisional** signal — verdicts print with a `?`, evidence goes to
+   `evidence-provisional.json`, and `baseline` refuses it; final pass with
+   defaults. By default
    the stream shows only unproven faults plus a killed count — `--verbose`
    shows every fault. A custom
    runner (`pnpm --filter`, a specific config) goes in

{testguard_cli-0.2.0 → testguard_cli-0.2.1}/action.yml

@@ -38,7 +38,7 @@ inputs:
   version:
     description: 'testguard-cli version to run'
     required: false
-    default: '0.2.0'
+    default: '0.2.1'
   node-version:
     description: 'Node.js version (20+)'
     required: false

{testguard_cli-0.2.0 → testguard_cli-0.2.1}/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "testguard-cli",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "testguard-cli",
-      "version": "0.2.0",
+      "version": "0.2.1",
       "license": "MIT",
       "dependencies": {
         "ajv": "8.20.0"

{testguard_cli-0.2.0 → testguard_cli-0.2.1}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "testguard-cli",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Proves a test suite defends the claims a project makes: injects the faults those claims forbid and reports every one the tests fail to detect.",
   "type": "module",
   "license": "MIT",

{testguard_cli-0.2.0 → testguard_cli-0.2.1}/packaging/homebrew/testguard.rb

@@ -13,7 +13,7 @@
 class Testguard < Formula
   desc "Proves a test suite defends the claims a project makes"
   homepage "https://github.com/raccioly/testguard"
-  url "https://registry.npmjs.org/testguard-cli/-/testguard-cli-0.2.0.tgz"
+  url "https://registry.npmjs.org/testguard-cli/-/testguard-cli-0.2.1.tgz"
   sha256 "385d69f9d3c153b934d9c1cb6a2c754eb9b221b0a8c0ba8b805858384d2d4678"
   license "MIT"
 

{testguard_cli-0.2.0 → testguard_cli-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "testguard-cli"
-version = "0.2.0"
+version = "0.2.1"
 description = "Proves a test suite actually defends the claims a project makes: injects the faults those claims forbid and reports every one the tests miss. Python wrapper for the Node.js CLI (requires Node.js 20+)."
 readme = "README.md"
 license = { text = "MIT" }

{testguard_cli-0.2.0 → testguard_cli-0.2.1}/spec/GATE-SEMANTICS.md

@@ -22,7 +22,11 @@ Rules that follow from the table:
 1. **Green baseline first.** Defenders run N times unmodified before any fault
    is applied. Anything short of N/N pass is `flaky-defender` and stops there.
 2. **Confirm over N runs.** `killed` and `survived` both require exactly N
-   probe runs, all agreeing. Default N is 3.
+   probe runs, all agreeing. Default N is 3. **Fewer than three runs is
+   provisional**: the evidence declares `run.provisional: true`, every
+   rendering marks the verdicts as unconfirmed, and a provisional run is
+   never frozen into a baseline. Provisional runs exist for the fix loop —
+   a fast signal while writing a test — not for a gate.
 3. **Only a test body rejecting the behaviour kills.** A test that fails by
    assertion — or by an exception the fault provoked inside it — counts. A
    timeout does not, and a suite that fails to load does not: neither is

testguard_cli-0.2.1/spec/conformance/examples/evidence-provisional.json

@@ -0,0 +1,272 @@
+{
+  "schemaVersion": 1,
+  "tool": {
+    "name": "testguard",
+    "version": "0.1.0"
+  },
+  "run": {
+    "id": "run-provisional",
+    "startedAt": "2026-09-17T02:00:00Z",
+    "finishedAt": "2026-09-17T02:00:41Z",
+    "repo": {
+      "head": "deadbeefcafe",
+      "dirty": false,
+      "snapshot": "c0ffeeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+    },
+    "runner": {
+      "name": "vitest",
+      "version": "5.0.1"
+    },
+    "confirmRuns": 1,
+    "mode": "worktree",
+    "provisional": true
+  },
+  "records": [
+    {
+      "fingerprint": "01876384493be6809da455cb1a1c4bc92e7564e9898506d790b9589200502163",
+      "claim": {
+        "id": "REDACT-001",
+        "statement": "The audit record written for a redacted message never contains the original secret.",
+        "severity": "critical",
+        "source": {
+          "kind": "spec",
+          "ref": "docs/spec.md#audit-records"
+        },
+        "producedBy": {
+          "producer": "human",
+          "by": "maintainer",
+          "at": "2026-09-17T02:00:00Z"
+        }
+      },
+      "subject": {
+        "kind": "fault",
+        "id": "F1",
+        "description": "Audit row is written with the raw input.",
+        "file": "src/redact.mjs",
+        "faultClass": "variable-swap",
+        "producedBy": {
+          "producer": "human",
+          "by": "maintainer",
+          "at": "2026-09-17T02:00:00Z"
+        }
+      },
+      "verdict": "survived",
+      "detail": {
+        "baselineRuns": [
+          {
+            "outcome": "pass",
+            "tests": {
+              "total": 4,
+              "passed": 4,
+              "failed": 0
+            },
+            "assertionFailures": 0,
+            "durationMs": 310
+          }
+        ],
+        "probeRuns": [
+          {
+            "outcome": "pass",
+            "tests": {
+              "total": 4,
+              "passed": 4,
+              "failed": 0
+            },
+            "assertionFailures": 0,
+            "durationMs": 310
+          }
+        ],
+        "escalated": true,
+        "escalationRuns": [
+          {
+            "outcome": "pass",
+            "tests": {
+              "total": 4,
+              "passed": 4,
+              "failed": 0
+            },
+            "assertionFailures": 0,
+            "durationMs": 310
+          }
+        ]
+      },
+      "defenders": {
+        "requested": [
+          "test/redact.test.mjs"
+        ],
+        "resolved": [
+          "test/redact.test.mjs"
+        ],
+        "nocover": false,
+        "discovered": false
+      },
+      "inputs": {
+        "targetHash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "defenderHashes": {
+          "test/redact.test.mjs": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+        }
+      },
+      "rank": {
+        "score": 9.5,
+        "blastRadius": 7,
+        "tier": "critical"
+      },
+      "annotations": [
+        {
+          "kind": "tracked",
+          "text": "Assertion uses objectContaining without the content key.",
+          "by": "maintainer",
+          "at": "2026-09-17T02:00:00Z",
+          "ref": "issue#12"
+        }
+      ]
+    },
+    {
+      "fingerprint": "10d526ffb9535c8d99c39dcea29a8d6fa86c3370a2a5061de5320e028ba79b1f",
+      "claim": {
+        "id": "REDACT-001",
+        "statement": "The audit record written for a redacted message never contains the original secret.",
+        "severity": "critical",
+        "source": {
+          "kind": "spec",
+          "ref": "docs/spec.md#audit-records"
+        },
+        "producedBy": {
+          "producer": "human",
+          "by": "maintainer",
+          "at": "2026-09-17T02:00:00Z"
+        }
+      },
+      "subject": {
+        "kind": "fault",
+        "id": "F2",
+        "description": "Redaction skipped.",
+        "file": "src/redact.mjs",
+        "faultClass": "statement-deleted"
+      },
+      "verdict": "killed",
+      "detail": {
+        "baselineRuns": [
+          {
+            "outcome": "pass",
+            "tests": {
+              "total": 4,
+              "passed": 4,
+              "failed": 0
+            },
+            "assertionFailures": 0,
+            "durationMs": 310
+          }
+        ],
+        "probeRuns": [
+          {
+            "outcome": "fail",
+            "tests": {
+              "total": 4,
+              "passed": 3,
+              "failed": 1
+            },
+            "assertionFailures": 1,
+            "durationMs": 322
+          }
+        ]
+      },
+      "defenders": {
+        "requested": [
+          "test/redact.test.mjs"
+        ],
+        "resolved": [
+          "test/redact.test.mjs"
+        ],
+        "nocover": false
+      },
+      "inputs": {
+        "targetHash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "defenderHashes": {
+          "test/redact.test.mjs": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+        }
+      }
+    },
+    {
+      "fingerprint": "0a0767ff8b124883e0bc042094c8494027b3d6d45bb8f4e40eda0930214a8970",
+      "claim": {
+        "id": "REDACT-002",
+        "statement": "A rule with an invalid pattern is skipped; it never aborts the scan.",
+        "severity": "high",
+        "source": {
+          "kind": "comment",
+          "ref": "src/redact.mjs:41"
+        }
+      },
+      "subject": {
+        "kind": "fault",
+        "id": "F1",
+        "description": "Invalid pattern rethrows.",
+        "file": "src/redact.mjs",
+        "faultClass": "exception-swallowed"
+      },
+      "verdict": "unverifiable",
+      "detail": {
+        "reason": "anchor-missing",
+        "baselineRuns": [],
+        "probeRuns": [],
+        "anchor": {
+          "hits": 0,
+          "expected": 1
+        }
+      },
+      "defenders": {
+        "requested": [
+          "test/redact.test.mjs"
+        ],
+        "resolved": [
+          "test/redact.test.mjs"
+        ],
+        "nocover": false
+      },
+      "inputs": {
+        "targetHash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "defenderHashes": {
+          "test/redact.test.mjs": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+        }
+      }
+    },
+    {
+      "fingerprint": "81cb777d4cba8dd856ad3f0626fe58186906e5c18a01425d82957adaa963cb28",
+      "claim": {
+        "id": "REDACT-002",
+        "statement": "A rule with an invalid pattern is skipped; it never aborts the scan.",
+        "severity": "high",
+        "source": {
+          "kind": "comment",
+          "ref": "src/redact.mjs:41"
+        }
+      },
+      "subject": {
+        "kind": "fault",
+        "id": "F1",
+        "description": "Invalid pattern rethrows.",
+        "file": "src/redact.mjs",
+        "faultClass": "exception-swallowed"
+      },
+      "verdict": "nocover",
+      "detail": {
+        "baselineRuns": [],
+        "probeRuns": []
+      },
+      "defenders": {
+        "requested": [
+          "test/rules.test.mjs"
+        ],
+        "resolved": [],
+        "nocover": true
+      },
+      "inputs": {
+        "targetHash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "defenderHashes": {
+          "test/redact.test.mjs": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+        }
+      }
+    }
+  ]
+}