testguard-cli 0.20.0__tar.gz → 0.21.0__tar.gz

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/.agents/skills/testguard/SKILL.md

@@ -132,6 +132,7 @@ code by construction. So, for every source file you create or change:
 | `FAULT-INVALID` | the replacement does not compile | fix the fault definition |
 | `TIMEOUT` | the fault makes the code hang | write an assertion that fails on it; a hang is not a detection |
 | `FLAKY-DEFENDER` | defenders not green 3/3, or disagreed across runs | fix the flake first; no verdict is trustworthy until then |
+| `killed` with `[killed by exception only: no assertion failed]`, or "N kills are by crash, not by assertion" | the fault made the code throw and a test went red, but nothing checked a value | add an assertion on the behavior the claim states; a test that merely calls the code is reach, not proof. `probe --require-assertion-kill` fails on these |
 
 ## The fix loop
 

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/.github/scripts/benchmark-node-direct.mjs

@@ -24,6 +24,8 @@ mkdirSync(join(out, 'workers'), { mode: 0o700 }); // Refuse to overwrite a previ
 const tool = mkdtempSync(join(tmpdir(), 'tg-direct-reference-'));
 const dir = mkdtempSync(join(tmpdir(), 'tg-direct-bench-'));
 const git = (...args) => execFileSync('git', args, { cwd: dir, encoding: 'utf8', timeout: 10000 }).trim();
+// The base commit predates `exceptionFailures`; a kill there was counted wholly in `assertionFailures`. Compare the sum.
+const comparable = ({ durationMs, exceptionFailures, kindNotReported, ...run }) => ({ ...run, assertionFailures: run.assertionFailures + (exceptionFailures ?? 0) });
 const projection = (record) => ({
   id: record.claim.id + '/' + record.subject.id,
   subject: record.subject,
@@ -33,8 +35,8 @@ const projection = (record) => ({
   targetHash: record.inputs?.targetHash,
   defenderHashes: record.inputs?.defenderHashes,
   discoveryHashes: record.inputs?.discoveryHashes,
-  baseline: (record.detail.baselineRuns ?? []).map(({ durationMs, ...run }) => run),
-  probe: (record.detail.probeRuns ?? []).map(({ durationMs, ...run }) => run),
+  baseline: (record.detail.baselineRuns ?? []).map(comparable),
+  probe: (record.detail.probeRuns ?? []).map(comparable),
   negativeControl: record.detail.negativeControl ?? null,
 });
 // testUniverseHash intentionally changes: it binds the changed adapter itself.
@@ -76,7 +78,7 @@ try {
         assert.equal(record.detail.probeRuns.length, 3);
         assert.equal(record.detail.baselineRuns.length, 3);
         assert(record.detail.baselineRuns.every((run) => run.outcome === 'pass'));
-        assert(record.detail.probeRuns.every((run) => run.outcome === 'fail' && run.assertionFailures > 0));
+        assert(record.detail.probeRuns.every((run) => run.outcome === 'fail' && run.assertionFailures + (run.exceptionFailures ?? 0) > 0));
       }
     }
     const projected = evidence.records.map(projection);

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/.github/scripts/benchmark-node-runner.mjs

@@ -59,10 +59,12 @@ const corpus = rows.map(([name, changes, expected]) => [name, { ...healthy, ...c
 const sha256 = (text) => createHash('sha256').update(text).digest('hex');
 const toolSources = Object.fromEntries(['node-test.mjs', 'node/runner.mjs', 'node/entry.mjs', 'node/report.mjs', 'shared.mjs', 'discovery.mjs', 'lifecycle.mjs', 'vitest.mjs'].map((file) => [file, sha256(readFileSync(join(ROOT, 'src/probe/runners', file)))]));
 const vitestVersion = JSON.parse(readFileSync(join(ROOT, 'node_modules/vitest/package.json'), 'utf8')).version;
+// The base commit predates `exceptionFailures`; a kill there was counted wholly in `assertionFailures`. Compare the sum.
+const comparable = ({ durationMs, exceptionFailures, kindNotReported, ...run }) => ({ ...run, assertionFailures: run.assertionFailures + (exceptionFailures ?? 0) });
 const proofProjection = (evidence) => evidence.records.map((r) => ({
   id: `${r.claim.id}/${r.subject.id}`, verdict: r.verdict, reason: r.detail.reason ?? null,
-  baseline: r.detail.baselineRuns.map(({ durationMs, ...run }) => run),
-  probe: r.detail.probeRuns.map(({ durationMs, ...run }) => run),
+  baseline: r.detail.baselineRuns.map(comparable),
+  probe: r.detail.probeRuns.map(comparable),
 }));
 const results = [];
 async function measure(engine, label) {
@@ -96,7 +98,7 @@ for(const [name,input,expected] of ${JSON.stringify(corpus)}) it(name,()=>{try{$
       assert.equal(r.verdict, 'killed', `${r.claim.id} must be caught by both frameworks`);
       assert.equal(r.detail.baselineRuns.length, 3); assert.equal(r.detail.probeRuns.length, 3);
       for (const run of r.detail.baselineRuns) { assert.equal(run.outcome, 'pass'); assert.equal(run.tests.total, corpus.length); }
-      for (const run of r.detail.probeRuns) { assert.equal(run.outcome, 'fail'); assert(run.assertionFailures > 0); assert.equal(run.tests.total, corpus.length); }
+      for (const run of r.detail.probeRuns) { assert.equal(run.outcome, 'fail'); assert(run.assertionFailures + (run.exceptionFailures ?? 0) > 0); assert.equal(run.tests.total, corpus.length); }
     }
     const workers = readFileSync(receipts, 'utf8').trim().split('\n').map(JSON.parse).filter((r) => !r.collect);
     assert.equal(workers.length, 15, 'three shared baseline runs plus four faults times three confirmations');

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/.github/scripts/install-smoke.mjs

@@ -63,7 +63,7 @@ try {
        { status: 'failed', failureMessages: ['AssertionError: expected /specify timed out/'] },
        { status: 'failed', failureMessages: ['Error: Test timed out in 1000ms.'] },
      ] }] }, 1);
-     if (result.timeouts !== 1 || result.run.assertionFailures !== 1) throw new Error('installed runner confuses assertion text with timeout identity');`,
+     if (result.timeouts !== 1 || result.run.assertionFailures + (result.run.exceptionFailures ?? 0) !== 1) throw new Error('installed runner confuses assertion text with timeout identity');`,
     installedRunner,
   ], consumer);
   const claims = run(bin, ['claims', '.'], consumer);

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/.pre-commit-hooks.yaml

@@ -7,7 +7,7 @@
 #
 #     repos:
 #       - repo: https://github.com/raccioly/testguard
-#         rev: v0.20.0
+#         rev: v0.21.0
 #         hooks:
 #           - id: testguard-claims        # fast: validates the claims file + drift
 #           - id: testguard-gate          # fast: every changed source file must carry a claim

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/CHANGELOG.md

@@ -7,6 +7,80 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.21.0] - 2026-11-10
+
+Automated weekly release — everything merged since `v0.20.1`.
+
+### Changed
+
+- feat(probe): tell a kill by assertion from a kill by crash; --require-assertion-kill (#233) (#241)
+- fix(probe): bind verdict reuse to the import closure, a live baseline and the instrument (#232) (#240)
+- chore(deps-dev): bump vitest from 5.0.2 to 5.0.5 in the all-npm group (#229)
+- chore(deps): bump fast-uri from 3.1.8 to 3.1.9 (#228)
+- [jules:docs-drift] brief — remove unsupported flags from docs (#227)
+- chore(deps-dev): bump vite from 8.3.1 to 8.3.4 (#224)
+- chore(deps-dev): bump vite from 8.3.0 to 8.3.4 in /fixtures/known-answer-playwright (#223)
+- [jules:docs-drift] probe — remove removed --changed flag (#220)
+- chore(homebrew): sha256 for v0.20.1 (#218)
+
+
+### Added
+
+- `killKind` on every kill: each failed test is classified `assertion` or `exception` from structured error identity (never message wording), `testRun.exceptionFailures` sits beside `assertionFailures`, and a `killed` record carries `detail.killKind` (`assertion`, `exception-only`, `mixed`). The default verdict is unchanged: an exception the fault provokes still kills.
+- `probe --require-assertion-kill` (and `admit`): an exception-only kill fails the policy, exit 1, verdict still `killed`. `status` and `brief` count exception-only kills as a named weakness.
+
+### Changed
+
+- `assertionFailures` is now assertion-only; a kill is `assertionFailures + exceptionFailures > 0`. Evidence written earlier has no `exceptionFailures` or `killKind` and reads as before; under the policy a kill with no recorded kind fails (unknown rounds toward unproven).
+- Under `--require-assertion-kill`, an exception-only kill whose runner reported no error identity (a custom `--runner-cmd` without `failureDetails`) says so per kill: `reason: "kind-not-reported-by-runner"` (`testRun.kindNotReported`, `detail.killKindReason`).
+- vitest and Playwright runs add an injected reporter beside the JSON one (a sidecar file in the temp dir) to read error identity; a custom `--runner-cmd` without `failureDetails` classifies every failure as an exception.
+
+### Fixed
+
+- **Verdict reuse no longer carries a kill over a red suite (#232).** Reuse
+  compared only the target and defender files, so breaking a helper the target
+  imports reused the old `killed`. Evidence now records
+  `inputs.dependencyHashes` (the transitive project import closure of the
+  target and every defender, plus root lockfiles, manifests and runner config;
+  Python by module name, including ancestor `conftest.py`) and
+  `inputs.dependencyClosure`. Reuse requires equal hashes and a `complete`
+  closure; a computed `import()`/`require()`/`import_module()`, an unresolvable
+  relative import or an over-limit graph makes it `indeterminate` (reasons in
+  `inputs.dependencyIssues`) and that fault is probed every time. Before any
+  record is carried forward its defender set runs once unmodified, shared with
+  the baseline, so a red defender is probed in full; `run.measurements` gains
+  `reuseBaselineRuns`. `status` staleness and the origin-policy freshness check
+  apply the same closure and predicate. Evidence written before this change is
+  re-probed once, and until then `status` reports each of its records as
+  stale ("predates dependency hashing"). An indeterminate closure makes `--require-origin` policy
+  `unavailable`.
+- **Reuse names its instrument, and says how much it reused (#232).** Evidence
+  records `run.instrument` (TestGuard version plus a digest of resolver alias
+  sources and root runner config/lockfiles); evidence from another version or
+  digest is never reused. `run.reuse: { reused, measured }` is in the evidence
+  and in `probe --json`. `GATE-SEMANTICS.md` now states that a gate over
+  authors who can write the evidence file must run `--no-reuse`.
+- A `timeout` or `flaky-defender` record is never reused: like `probe-error`
+  it describes the run's environment, and a green live baseline today does not
+  make an old timeout the current answer. `status` reports evidence from
+  another TestGuard version or configuration digest as stale, in one line.
+- Spec documents are written atomically (exclusive temporary file, then
+  rename): a run killed mid-write no longer leaves a truncated evidence file
+  the next probe reads as prior evidence.
+- The module lexer behind defender discovery now reads regex literals,
+  numeric literals and template expressions containing quotes or nested
+  templates; before, a module with `/'/` in it was unreadable and discovery
+  through it was indeterminate.
+
+## [0.20.1] - 2026-10-12
+
+Automated weekly release — everything merged since `v0.20.0`.
+
+### Changed
+
+- chore(homebrew): sha256 for v0.20.0 (#216)
+
+
 ## [0.20.0] - 2026-10-11
 
 Automated weekly release — everything merged since `v0.19.0`.

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: testguard-cli
-Version: 0.20.0
+Version: 0.21.0
 Summary: Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest. A wrapper that runs the Node.js CLI (requires Node.js 20+): a project-local node_modules/testguard-cli when present, otherwise the npm release of this same version through npx.
 Project-URL: Homepage, https://github.com/raccioly/testguard
 Project-URL: Documentation, https://github.com/raccioly/testguard#readme
@@ -153,9 +153,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.20.0` |
+| GitHub Action | `uses: raccioly/testguard@v0.21.0` |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-gate`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.20.0/packaging/gitlab/testguard.gitlab-ci.yml` |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.21.0/packaging/gitlab/testguard.gitlab-ci.yml` |
 
 Requirements, offline installs, `ENOVERSIONS` and every CI option are in the
 [installation guide](https://github.com/raccioly/testguard/blob/main/docs/installation.md).

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/README.md

@@ -129,9 +129,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.20.0` |
+| GitHub Action | `uses: raccioly/testguard@v0.21.0` |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-gate`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.20.0/packaging/gitlab/testguard.gitlab-ci.yml` |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.21.0/packaging/gitlab/testguard.gitlab-ci.yml` |
 
 Requirements, offline installs, `ENOVERSIONS` and every CI option are in the
 [installation guide](https://github.com/raccioly/testguard/blob/main/docs/installation.md).

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/action.yml

@@ -50,7 +50,7 @@ inputs:
   version:
     description: 'testguard-cli version to run'
     required: false
-    default: '0.20.0'
+    default: '0.21.0'
   node-version:
     description: 'Node.js version (20+)'
     required: false

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/docs/guides/ci/github-actions.md

@@ -100,7 +100,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0               # the base branch must exist locally
-      - uses: raccioly/testguard@v0.20.0
+      - uses: raccioly/testguard@v0.21.0
         with:
           command: gate                # every changed source file needs a claim
 
@@ -114,7 +114,7 @@ jobs:
         with:
           node-version: 22
       - run: npm ci                    # the probe runs the project's own test runner
-      - uses: raccioly/testguard@v0.20.0
+      - uses: raccioly/testguard@v0.21.0
         with:
           command: probe
           severity: high               # fail only on new high or critical findings
@@ -162,7 +162,7 @@ jobs:
             testguard-evidence-
 
       - id: testguard
-        uses: raccioly/testguard@v0.20.0
+        uses: raccioly/testguard@v0.21.0
         with:
           command: probe
 
@@ -211,7 +211,7 @@ the probe at the interpreter if it is not one TestGuard finds on its own
         with:
           python-version: '3.12'
       - run: python -m venv .venv && .venv/bin/pip install -r requirements.txt
-      - uses: raccioly/testguard@v0.20.0
+      - uses: raccioly/testguard@v0.21.0
         with:
           command: probe
           runner: python             # pytest if .venv can import it, else unittest
@@ -227,7 +227,7 @@ Each project in a monorepo gets its own step, because a passing parent gate
 says nothing about a child project's coverage:
 
 ```yaml
-      - uses: raccioly/testguard@v0.20.0
+      - uses: raccioly/testguard@v0.21.0
         with:
           command: gate
           working-directory: services/billing
@@ -245,7 +245,7 @@ run that verified nothing must not look like a pass. During adoption set
 `allow-empty`:
 
 ```yaml
-      - uses: raccioly/testguard@v0.20.0
+      - uses: raccioly/testguard@v0.21.0
         with:
           command: probe
           allow-empty: 'true'

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/docs/guides/ci/gitlab.md

@@ -17,7 +17,7 @@ move together:
 
 ```yaml
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.20.0/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.21.0/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs:
       dir: backend          # where testguard.claims.json lives (default ".")
       post_note: true       # post the brief on the merge request; needs TESTGUARD_GITLAB_TOKEN

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/docs/guides/ci/pre-commit.md

@@ -34,7 +34,7 @@ gate that sees a commit before it exists.
 default_install_hook_types: [pre-commit, pre-push]
 repos:
   - repo: https://github.com/raccioly/testguard
-    rev: v0.20.0
+    rev: v0.21.0
     hooks:
       - id: testguard-claims
         stages: [pre-commit]

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/docs/guides/monorepo.md

@@ -215,12 +215,12 @@ jobs:
           node-version: 22
       - run: npm ci               # every workspace's dependencies, from the root
       - name: gate
-        uses: raccioly/testguard@v0.20.0
+        uses: raccioly/testguard@v0.21.0
         with:
           command: gate
           working-directory: ${{ matrix.project }}
       - name: probe
-        uses: raccioly/testguard@v0.20.0
+        uses: raccioly/testguard@v0.21.0
         with:
           command: probe
           working-directory: ${{ matrix.project }}

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/docs/guides/performance.md

@@ -141,7 +141,8 @@ npx testguard-cli probe . --progress ndjson 2>events.ndjson  # machine-readable
 {"event":"verdict","claim":"REDACT-001","fault":"F1","verdict":"survived","severity":"critical","file":"demo/redact.py","at":"…"}
 ```
 
-The stages are `baseline`, `baseline-flake` (finishing the baseline runs after
+The stages are `reuse-baseline` (the one live run that licenses carrying a
+verdict forward), `baseline`, `baseline-flake` (finishing the baseline runs after
 a red one, so "failed once in three" can be told from "fails every time"),
 `probe`, `negative-control` and `escalation`. A verdict reused from earlier
 evidence carries `"reused": true`.
@@ -203,6 +204,13 @@ changed. All of these must match the evidence at the output path:
 
 - the fault itself (its content hash) and the claim's metadata;
 - the target file's hash and every selected defender's hash;
+- everything the target and the defenders import, transitively, inside the
+  project (`inputs.dependencyHashes`), plus the lockfiles, `package.json`,
+  `pyproject.toml` and runner/compiler config at the project root. Python
+  closures include every `conftest.py` above each file. When an import cannot
+  be followed — a computed `import(name)`, `require(x)` or
+  `importlib.import_module(name)`, a relative import that resolves to no file —
+  the closure is `indeterminate` and that fault is probed every time;
 - the requested and resolved defender sets and where they came from;
 - the test universe and the discovery inputs. For built-in runners this
   binds the runner, its version and the hashes of its config files,
@@ -213,6 +221,13 @@ changed. All of these must match the evidence at the output path:
   version, and where it was resolved from (`project`, `path`, `builtin`);
 - `--confirm` and the worker policy (`--workers`, `--serial`).
 
+Then one more check that no hash can make: the defender set runs once on
+unmodified source. Green, and every fault it defends is reused; red, and each
+is probed in full. That run is the first run of the shared baseline, so it
+costs one run per defender set, never one per fault, and
+`run.measurements.reuseBaselineRuns` counts it. Evidence written before this
+rule has no `dependencyHashes` and is probed again once.
+
 A record produced by a probe error is never reused, and neither is one whose
 defenders failed to load (`defenders-failed-to-load`): that is a statement
 about the environment — a broken command, a missing dependency, a virtualenv
@@ -226,9 +241,12 @@ names. A cold run, a changed runner config or a changed worker policy probes
 from scratch even when your source has not changed.
 
 One kind of change reuse cannot see: anything outside the hashed inputs that
-changes a verdict without breaking the load, such as an environment variable,
-a package upgraded inside the same virtualenv, or a service your tests read.
-Pass `--no-reuse` after one.
+changes a verdict while the defenders stay green, such as an environment
+variable, a package upgraded inside the same virtualenv, or a service your
+tests read, a `setupFiles`/`globalSetup` file the runner config names by
+string, or a lockfile above the project directory in a monorepo. A change that
+turns the defenders red is caught by the live run.
+Pass `--no-reuse` after one that does not.
 
 In CI, restore the previous run's evidence from a cache and write to the same
 path, so only claims whose inputs changed are probed again. TestGuard's own CI

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/docs/i18n/es/README.md

@@ -147,9 +147,9 @@ falsa.
 | npm | `npm i -D testguard-cli` y luego `npx testguard probe` |
 | pip | `pip install testguard-cli` y luego `testguard probe` (requiere Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.20.0` |
+| GitHub Action | `uses: raccioly/testguard@v0.21.0` |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-gate`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.20.0/packaging/gitlab/testguard.gitlab-ci.yml` |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.21.0/packaging/gitlab/testguard.gitlab-ci.yml` |
 
 Los requisitos, las instalaciones sin conexión, `ENOVERSIONS` y todas las
 opciones de CI están en la

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/docs/i18n/pt-BR/README.md

@@ -145,9 +145,9 @@ a cobertura. O TestGuard o admite porque ele falha quando a alegação é falsa.
 | npm | `npm i -D testguard-cli` e depois `npx testguard probe` |
 | pip | `pip install testguard-cli` e depois `testguard probe` (requer Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.20.0` |
+| GitHub Action | `uses: raccioly/testguard@v0.21.0` |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-gate`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.20.0/packaging/gitlab/testguard.gitlab-ci.yml` |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.21.0/packaging/gitlab/testguard.gitlab-ci.yml` |
 
 Requisitos, instalações offline, `ENOVERSIONS` e todas as opções de CI estão
 no [guia de instalação](https://github.com/raccioly/testguard/blob/main/docs/installation.md).

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/docs/i18n/zh-CN/README.md

@@ -85,9 +85,9 @@ expect(store.writeAudit).toHaveBeenCalledWith(
 | npm | `npm i -D testguard-cli`，然后 `npx testguard probe` |
 | pip | `pip install testguard-cli`，然后 `testguard probe`（需要 Node ≥ 20） |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.20.0` |
+| GitHub Action | `uses: raccioly/testguard@v0.21.0` |
 | pre-commit | `repo: https://github.com/raccioly/testguard`，钩子 `testguard-claims`、`testguard-gate`、`testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.20.0/packaging/gitlab/testguard.gitlab-ci.yml` |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.21.0/packaging/gitlab/testguard.gitlab-ci.yml` |
 
 环境要求、离线安装、`ENOVERSIONS` 以及所有 CI 选项，见
 [安装指南](https://github.com/raccioly/testguard/blob/main/docs/installation.md)。

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/docs/installation.md

@@ -31,9 +31,9 @@ packages in total.
 | npm devDependency | `npm i -D testguard-cli` then `npx testguard probe` | a JavaScript or TypeScript project: version pinned in the lockfile, and the local install the agent layer prefers |
 | pip | `pip install testguard-cli` then `testguard probe` | a Python team that does not want to touch npm directly (still needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` | a machine-wide `testguard` on `PATH` |
-| GitHub Action | `uses: raccioly/testguard@v0.20.0` | CI on GitHub |
+| GitHub Action | `uses: raccioly/testguard@v0.21.0` | CI on GitHub |
 | pre-commit | `repo: https://github.com/raccioly/testguard` with a release tag as `rev:` ([below](#pre-commit)) | local hooks on commit and push |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.20.0/packaging/gitlab/testguard.gitlab-ci.yml` | CI on GitLab |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.21.0/packaging/gitlab/testguard.gitlab-ci.yml` | CI on GitLab |
 
 ### npx
 
@@ -114,7 +114,7 @@ tarball, checked against a `sha256` recorded at release time.
 ```yaml
 - uses: actions/checkout@v7
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.20.0
+- uses: raccioly/testguard@v0.21.0
   with: { command: gate }
 ```
 
@@ -128,7 +128,7 @@ and complete pull-request and main-branch workflows, are in
 ```yaml
 repos:
   - repo: https://github.com/raccioly/testguard
-    rev: v0.20.0
+    rev: v0.21.0
     hooks:
       - id: testguard-claims
       - id: testguard-gate
@@ -144,7 +144,7 @@ three hooks, their stages and their arguments are in
 
 ```yaml
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.20.0/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.21.0/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: . }
 ```
 

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/docs/reference/artifacts.md

@@ -85,7 +85,27 @@ complete, confirmed run writes it, which is why a provisional or partial run
 goes to its own file and can never be frozen into a baseline by accident.
 
 The next `probe` reads its own output file to reuse verdicts whose recorded
-inputs have not changed (`--no-reuse` turns that off).
+inputs have not changed (`--no-reuse` turns that off). Those inputs include
+`inputs.dependencyHashes`, the hashes of everything the target and its
+defenders import plus the root lockfiles and runner config, and
+`inputs.dependencyClosure`: `complete`, or `indeterminate` with the reasons in
+`inputs.dependencyIssues` when an import could not be followed. An
+indeterminate record, or one written before these fields existed, is never
+reused. Before any record is reused its defender set runs once, unmodified;
+`run.measurements.reuseBaselineRuns` counts those runs. `run.instrument` names
+the TestGuard version and a digest of the resolver and runner configuration;
+evidence from another version or digest is never reused. `run.reuse` counts the
+records carried forward and the records measured. Reuse trusts this file: if
+the people a gate judges can write it, run that gate with `--no-reuse`.
+
+The file is written atomically (a temporary file, then a rename), so an
+interrupted run never leaves a truncated document behind.
+
+**For tools that read this file.** `inputs.targetHash` and
+`inputs.defenderHashes` are unchanged; `inputs.dependencyHashes` was added beside
+them. A consumer judging whether a record is still fresh must compare all three
+against the current tree: the first two alone miss a changed helper that the
+target or a defender imports.
 
 ### evidence-provisional.json and evidence-partial.json
 

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/docs/reference/cli.md

@@ -204,12 +204,12 @@ spec before it is written.
 | `--no-escalate` | off | Do not re-run survivors against the whole suite. Escalation runs the whole suite up to N times per survivor. |
 | `--no-reuse` | off | Re-probe claims whose recorded inputs have not changed. |
 | `--allow-empty` | off | Adoption only: a valid claims file with zero claims exits `0` instead of `2`, writes no evidence, and says verification was skipped. Has no effect with `--claim`. |
+| `--require-assertion-kill` | off | Fail (exit 1) when any kill was made only by an uncaught exception and never by an assertion, or comes from evidence that records no kind. The verdict stays `killed`; the policy names the faults and is stored as `assertionPolicy`. Also valid on `admit`, where it refuses a test whose kills are all exception-only. A kill whose runner reported no error identity fails with `reason: "kind-not-reported-by-runner"`, per kill, in the text line and in `--json`: only a runner that reports identity can satisfy this policy. The built-in runners do. A custom `--runner-cmd` can if it writes a jest-shaped report (`testResults[].assertionResults[]`) with `failureDetails` per failed test: `matcherResult`, or `name: "AssertionError"`, or `code: "ERR_ASSERTION"`, or an `operator`. Without `failureDetails` every failure is an exception and the policy cannot pass. |
 | `--require-origin <kinds>` | none | Require every claim's declared source kind to be in this set (repeatable, comma-separated). Needs a complete confirmed run: refused with `--claim`, `--allow-empty`, `--ref`, `--ignore-dirty` or `--confirm` below 3. Labels do not authenticate independence. |
 | `--progress <mode>` | `auto` | `auto`, `tty`, `plain`, `ndjson` or `none`. Always on stderr. `--quiet` and `--json` imply `none` unless this is given explicitly. |
 | `--verbose` | off | Also print every killed fault. |
 | `--quiet` | off | Print only the summary and the evidence path. |
 | `--cost` | off | Also report what this run's defenders cost. |
-| `--changed <ref>` | detected | With `--json`: include claim coverage of the change in the status document. |
 | `--json` | off | Print the status document plus this run's result. |
 
 Where the evidence goes, unless `--out` says otherwise:
@@ -238,8 +238,9 @@ Detection, limits and per-runner behaviour are in
 [languages and runners](languages-and-runners.md).
 
 **Exit:** `0` no new gating finding at or above the severity floor; `1` at
-least one new finding, or a failed `--require-origin` policy (which baseline
-debt and severity floors cannot hide); `2` precondition (an empty claims file
+least one new finding, a failed `--require-origin` policy, or a failed
+`--require-assertion-kill` policy (which baseline debt and severity floors
+cannot hide); `2` precondition (an empty claims file
 without `--allow-empty`, a runner that does not resolve, a dirty defender or
 target with the implicit HEAD, an exhausted command budget, an unavailable
 origin policy); `3` usage (`--confirm` not a positive integer, `--budget` or
@@ -298,9 +299,6 @@ says which install answered (`local install`, `npx cache`, `pnpm dlx cache`,
 | `--max <n>` | `20` | Items in the brief, 1 to 50. |
 | `--evidence <path>` | `<dir>/.testguard/evidence.json` | Evidence to brief from. |
 | `--baseline <path>` | `<dir>/.testguard/baseline.json` if present | Baseline that marks findings as known. |
-| `--changed <ref>` | detected | Reference for the unclaimed-changes section. A detected reference that does not resolve is silent here. |
-| `--include-dirty` | off | With a reference, measure the working tree. |
-| `--out <path>` | `<dir>/.testguard/brief.json` | Where the brief document is written (ignored with `--text`/`--markdown`). |
 | `--json` | off | Print the brief document. |
 
 **Exit:** `0`; `2` when there is no evidence and neither `--text` nor

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/docs/reference/configuration.md

@@ -287,7 +287,7 @@ probe costs, use `probe --cost` or `claims --cost`; see the
 
 | Variable | Read by | Meaning |
 |---|---|---|
-| `TESTGUARD_CHANGED_REF` | `gate`, `sweep`, `status`, `brief`, `probe --json`, the MCP tools | The reference to measure a change against when `--changed` is absent. Checked before the CI variables below. |
+| `TESTGUARD_CHANGED_REF` | `gate`, `sweep`, `status`, `brief`, the MCP tools | The reference to measure a change against when `--changed` is absent. Checked before the CI variables below. |
 | `TESTGUARD_NODE_MODULES` | `probe`, `admit`, `sweep`, `replay` | A `node_modules` directory to link into the scratch worktree. `--node-modules` wins. |
 | `TESTGUARD_PYTHON` | `probe`, `claims --check-anchors`, `admit`, `sweep`, `replay` | The Python interpreter for `.py` defenders. `--python` wins when both are given; the two mean the same thing: a bare name such as `python3` is looked up on `PATH`, anything containing `/` is a path. |
 | `TESTGUARD_GITLAB_TOKEN` | the GitLab CI template only | A project or group access token with `api` scope, used when `post_note: true` to post the brief as a merge-request note. `CI_JOB_TOKEN` cannot write notes. The CLI never reads it. See the [GitLab guide](../guides/ci/gitlab.md). |

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/docs/reference/verdicts.md

@@ -19,7 +19,7 @@ is a pass. Text output prints every verdict but `killed` in capitals.
 
 | Verdict | Printed | Meaning | Gates |
 |---|---|---|---|
-| `killed` | `killed` | Every one of N probe runs failed with a genuine assertion failure, on defenders that were green N/N on unmodified code. The claim is defended. | no |
+| `killed` | `killed` | Every one of N probe runs failed in a test body, by an assertion or by an exception the fault provoked, on defenders that were green N/N on unmodified code. The claim is defended; `detail.killKind` says how (below). | no |
 | `survived` | `SURVIVED` | Every one of N probe runs passed with the fault applied. A real blind spot. | yes |
 | `nocover` | `NOCOVER` | No test defends the claim: the declared globs resolve to nothing, or no test file imports the target without mocking it. Nothing was even tried. | yes |
 | `unverifiable` | `UNVERIFIABLE` | The fault could not be probed: its anchor moved or matches more than once, the defenders failed to load, discovery was indeterminate, or the defenders never execute the target. Nothing was learned. | yes |
@@ -27,6 +27,30 @@ is a pass. Text output prints every verdict but `killed` in capitals.
 | `timeout` | `TIMEOUT` | The defenders exceeded `--budget` with the fault applied. A hang is not a detection. | yes |
 | `flaky-defender` | `FLAKY-DEFENDER` | The defenders were not green N/N on unmodified code, or the N probe runs disagreed. No verdict about the fault can be trusted until the defenders are fixed. | yes |
 
+### How a fault was killed
+
+A kill by an assertion proves the suite checks the behavior. A kill only by an
+exception proves the suite **reaches** the code: the fault made it throw and a
+test went red, but nothing rejected a value. Where tests are written by an
+agent, that second kind is exactly the hollow test that should not count as
+proof, so every `killed` record says which it was. The verdict is unchanged.
+
+| `detail.killKind` | Meaning |
+|---|---|
+| `assertion` | Every probe run had at least one assertion-classified failing test. |
+| `exception-only` | No run had one. A test with no assertion went red because the code threw. |
+| `mixed` | Some runs had one and some did not. |
+
+The runner decides from structured error identity (an `AssertionError`, a
+matcher result, a failed `expect` step, a Python exception type), never from
+message text; an error it cannot read is an exception. `expect(fn).not.toThrow()`
+and `assert.doesNotThrow` are assertions. `probe --require-assertion-kill`
+(and `admit`) turns the distinction into a gate: any `exception-only` kill, or a
+kill from evidence that predates the field, fails the run with exit 1, and the
+verdict stays `killed`. `status` and `brief` count exception-only kills as a
+weakness next to the co-authored count. The rule and its known limits are
+rule 3 of the [gate semantics](../../spec/GATE-SEMANTICS.md).
+
 "Gates" means the verdict fails `probe` (exit `1`) unless it is in the
 baseline or its claim is below `--severity`. When a baseline exists, `probe`
 tags each unproven record `[NEW]`, `[baseline]` or `[below floor]`.

{testguard_cli-0.20.0 → testguard_cli-0.21.0}/docs/testguard-explained.html

@@ -144,7 +144,7 @@
 <div class="page">
   <div class="masthead">
     <div class="wordmark">Test<span class="mark">Guard</span></div>
-    <div class="meta">Technical Brief · v0.20.0 · MIT</div>
+    <div class="meta">Technical Brief · v0.21.0 · MIT</div>
   </div>
 
   <h1>Your tests pass. That is not the same as your tests working.</h1>