testguard-cli 0.8.1__tar.gz → 0.9.0__tar.gz

{testguard_cli-0.8.1 → testguard_cli-0.9.0}/.github/workflows/release.yml

@@ -118,15 +118,43 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          set -o pipefail
           TAG="v${{ needs.detect-version.outputs.version }}"
           if git ls-remote --tags origin | grep -q "refs/tags/$TAG$"; then
             echo "✅ Tag $TAG already exists on remote"
-          else
-            git config user.name "github-actions[bot]"
-            git config user.email "github-actions[bot]@users.noreply.github.com"
-            git tag -a "$TAG" -m "Release $TAG"
-            git push origin "$TAG"
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag -a "$TAG" -m "Release $TAG"
+          if git push origin "$TAG" 2>/tmp/tag-err; then
+            echo "✅ Pushed $TAG"
+            exit 0
+          fi
+          cat /tmp/tag-err
+          # A GitHub App may not PUSH a ref whose .github/workflows differ from
+          # the CURRENT default branch. That is not a property of this release:
+          # it becomes true the moment any workflow change merges to main while
+          # the release is in flight, which is exactly how v0.8.1 lost its tag
+          # ("refusing to allow a GitHub App to create or update workflow
+          # .github/workflows/release.yml without `workflows` permission")
+          # seven minutes after an unrelated workflow PR merged.
+          #
+          # So fall back to the API. It adds a ref to a commit that is ALREADY
+          # in the repository and creates no file content, so the restriction
+          # does not apply. The push is tried first on purpose: it is the path
+          # every previous release took, and this fallback only has to cover
+          # the case that currently fails outright.
+          if ! grep -q 'workflows. permission' /tmp/tag-err; then
+            echo "::error::git push of $TAG failed for a reason other than the workflow-permission restriction — see above."
+            exit 1
           fi
+          echo "::warning::Pushing $TAG was refused because main's workflows moved during this release; creating the tag through the API instead."
+          TAG_SHA=$(gh api -X POST "repos/${GITHUB_REPOSITORY}/git/tags" -f tag="$TAG" -f message="Release $TAG" -f object="$GITHUB_SHA" -f type=commit --jq .sha) || {
+            echo "::error::Could not create the tag object for $TAG. Create it by hand: git tag -a $TAG $GITHUB_SHA -m 'Release $TAG' && git push origin $TAG"; exit 1; }
+          gh api -X POST "repos/${GITHUB_REPOSITORY}/git/refs" -f ref="refs/tags/$TAG" -f sha="$TAG_SHA" --jq .ref || {
+            echo "::error::Could not create refs/tags/$TAG from tag object $TAG_SHA. Create it by hand: git tag -a $TAG $GITHUB_SHA -m 'Release $TAG' && git push origin $TAG"; exit 1; }
+          echo "✅ Created $TAG through the API at $GITHUB_SHA"
       - name: Release notes from CHANGELOG
         run: |
           VERSION="${{ needs.detect-version.outputs.version }}"

{testguard_cli-0.8.1 → testguard_cli-0.9.0}/.github/workflows/scheduled-release.yml

@@ -5,10 +5,11 @@ name: Scheduled Release
 # tree is green, and open a release PR with auto-merge armed. Once merged, the
 # hourly sweep in release.yml tags and publishes.
 #
-# GITHUB_TOKEN-created PRs do not trigger `pull_request` workflows, so CI on
-# the release PR must be started by the maintainer:
-#     gh workflow run ci.yml --ref release/vX.Y.Z
-# After it goes green, auto-merge completes.
+# GITHUB_TOKEN-created PRs do not trigger `pull_request` workflows, so nothing
+# would ever start the required checks and auto-merge would wait forever. This
+# workflow therefore dispatches ci.yml on the release branch itself:
+# `workflow_dispatch` is the one event GITHUB_TOKEN may trigger. After the
+# three Node legs go green, auto-merge completes. No human step remains.
 
 on:
   schedule:
@@ -133,13 +134,27 @@ jobs:
           git add -A
           git commit -m "release: v${NEW_VERSION} — automated weekly batch"
           git push origin "$BRANCH"
-          printf 'Automated weekly release. Version bump + CHANGELOG entry + synced version surfaces. Merging tags and publishes to npm and PyPI via release.yml.\n\nCI does not start automatically on PRs opened by GITHUB_TOKEN. Run:\n\n    gh workflow run ci.yml --ref %s\n\nAuto-merge is armed; it completes once the required checks pass.\n' "$BRANCH" > /tmp/pr-body.md
+          printf 'Automated weekly release. Version bump + CHANGELOG entry + synced version surfaces. Merging tags and publishes to npm and PyPI via release.yml.\n\nA PR opened by GITHUB_TOKEN gets no `pull_request` run, so this workflow dispatched ci.yml on `%s` itself. Auto-merge is armed; it completes once the three Node legs pass. If the checks never appear: `gh workflow run ci.yml --ref %s`.\n' "$BRANCH" "$BRANCH" > /tmp/pr-body.md
           # A bare `gh pr create` failure here reads as a GraphQL error with no
           # hint of the cause, which is how v0.8.1 lost its release PR after
           # everything else in the release had succeeded.
           if PR=$(gh pr create --base main --head "$BRANCH" --title "release: v${NEW_VERSION} — automated weekly batch" --body-file /tmp/pr-body.md 2>/tmp/pr-err); then
             gh pr merge --auto --squash "$PR"
             echo "Release PR: $PR"
+            # Nothing else will start the required checks: a PR opened by
+            # GITHUB_TOKEN raises no `pull_request` event, so auto-merge would
+            # sit on three checks that never run. `workflow_dispatch` is the
+            # one event GITHUB_TOKEN may trigger, and this job already holds
+            # the `actions: write` it needs. Guarded so a re-run of an
+            # already-tested branch does not queue a second identical run.
+            HEAD_SHA=$(git rev-parse HEAD)
+            RUNS=$(gh api "repos/${GITHUB_REPOSITORY}/commits/${HEAD_SHA}/check-runs" --jq '.total_count')
+            if [ "${RUNS:-0}" = "0" ]; then
+              gh workflow run ci.yml --ref "$BRANCH"
+              echo "Dispatched ci.yml on $BRANCH ($HEAD_SHA)"
+            else
+              echo "✅ $HEAD_SHA already has $RUNS check run(s)"
+            fi
           else
             cat /tmp/pr-err
             if grep -q 'not permitted to create or approve pull requests' /tmp/pr-err; then

{testguard_cli-0.8.1 → testguard_cli-0.9.0}/CHANGELOG.md

@@ -7,7 +7,71 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-09-18
+
+Automated weekly release — everything merged since `v0.8.1`.
+
+### Changed
+
+- fix: the five findings from the 0.8.1 pocket-archive field report (#107)
+- chore(deps): jest 30.5.1 -> 30.5.2 (#106)
+- feat(release): the release PR starts its own CI (#105)
+- fix(release): tag through the API when the push is refused (#104)
+- chore(homebrew): sha256 for v0.8.1, from the published tarball (#103)
+- fix(release): a blocked pull request says which setting blocks it (#102)
+
+
 ### Fixed
+- **`scaffold` no longer dies on a zero-valued window literal, and proposes a
+  real fault for one.** The window producer weakened a literal by ×1000, and
+  ×1000 of `0` is `0` — the replacement equalled its find, which the schema
+  rejects outright, so a single `expired: 0` aborted the whole file and printed
+  a raw Node stack. A 725-line source was unscaffoldable for this reason. The
+  same defect sat in the work-factor producer, where `rounds = 1` collapsed to
+  `1`, and in both Python producers, where `timeout=0` is PEP 8 spacing and so
+  the common form. The two cases are not the same, and are not fixed the same
+  way: a zero window is exactly the window worth widening, so it now widens to
+  a real value; a work factor already at 1 has nothing weaker to become, so it
+  proposes nothing rather than proposing itself. `usableProposal()` refuses a
+  no-op whatever a producer hands it, which makes the rule structural instead
+  of remembered.
+- **`if (…) continue;` and `if (…) break;` are guards.** Only `return` and
+  `throw` were read as guard bodies, so pure selection-over-rows — the shape
+  the "pure logic, caller does the IO" advice produces — got no proposals at
+  all. Two fully-claimed files of seven such guards each returned nothing,
+  while the hand-written faults on those same lines all killed: the shape
+  `scaffold` skipped was the one demonstrably worth proposing. Both the
+  single-line and the block form, in JavaScript and Python.
+- **An unexpected exception is named as our bug and keeps its trace.** Four
+  error classes became `error: …`; everything else reached the user as a Node
+  stack trace ending in `Node.js v24.18.0`, which reads as "your repository
+  broke the tool" and gives the operator nothing to do. It now says whose
+  defect it is and where to report it, and still prints the trace — a framed
+  error without one cannot be reported.
+- **Every surface that describes the session-start hook is held to the code,
+  not just the README.** 0.6.0 banned "falls back to npx" in README.md and
+  added a mechanical check there. The same sentence lived in the line `init`
+  prints as it installs the hook and in the `--help` entry, and both went on
+  promising an `npx --no-install` fallback that `hookCommand()` had stopped
+  emitting — the sentence the user reads at the moment the hook is installed
+  described the network-reaching mechanism that was removed for reaching the
+  network. `TG-README-HOOK-MATCHES-THE-CODE` is now a claim about the
+  property, over all four surfaces. The fourth, `docs-canonical/SECURITY.md`,
+  was found by DocGuard while this claim was being widened from one to
+  three; it is correct today, and is checked because that is where the
+  sentence lives, not because a defect had been found there.
+- **A test runner that has already exited is not reported as contention.**
+  `ps` is a snapshot, and a suite that finished between the snapshot and the
+  warning produced "1 test runner is already running (pid 65751)" for a process
+  the operator could not find. Liveness is re-checked immediately before
+  reporting. Detection stays best-effort: `EPERM` means running, not gone.
+- **A release can tag itself even when `main` moves underneath it.** A GitHub
+  App may not *push* a ref whose `.github/workflows` differ from the current
+  default branch, so v0.8.1's tag was refused seven minutes after an unrelated
+  workflow PR merged — a release that was otherwise complete. `create-release`
+  still pushes first, and now falls back to creating the tag through the API,
+  which adds a ref to a commit already in the repository and so is not subject
+  to that restriction. Any other push failure is still fatal and says so.
 - **A release that cannot open its pull request says why.** `GITHUB_TOKEN`
   cannot call `createPullRequest` unless "Allow GitHub Actions to create and
   approve pull requests" is enabled, and v0.8.1 hit exactly that: the branch,
@@ -19,6 +83,79 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   The failure is still a failure: the branch exists without a PR, and for the
   formula `detect-version` keeps reporting the hash owed on every sweep.
 
+### Changed
+- **The calibration counts escaped bugs, not every commit that changed source
+  and a test together.** `p` is P(the suite misses it | a *bug* of this class
+  escapes), but the corpus was every commit with a source-and-test pair — which
+  in a conventional-commits repository is every feature, since a feature ships
+  with its tests as a matter of course. One run reported "12 of 12 measurable
+  bugs invisible — 100%" over five `feat:`, a `refactor:`, a `style:` and a
+  commit whose entire purpose was adding a test; only four were `fix:`. The
+  finding survived the correction — all four real fixes came back `blind` — and
+  is stronger stated over the four honestly than over the twelve loosely.
+
+  Selection is unchanged: the source-and-test pairing is still all that can be
+  judged without reading a subject line, and replaying a feature still measures
+  something. What narrows is the estimator. Where a majority of replayed
+  subjects carry a conventional type, `p` is computed over the `fix:`/`revert:`
+  records; `replay` prints both rates and the type breakdown so the narrowing
+  can be checked; and `calibration.json` records which rule produced it in
+  `source.detail`, so two calibrations from two populations can never be
+  compared by accident. A conventional repository with no `fix:` in range
+  calibrates nothing and says to widen the range, rather than silently counting
+  features as bugs.
+- **`baseline` stops printing advice that rots, and stops repeating it.** It
+  named `.testguard/evidence.json` and `.testguard/brief.json` long after the
+  tool had grown to ten regenerated outputs, and printed them every run whether
+  or not the project already ignored them. The list now lives in one place,
+  owned by `init`, and only the outputs a project does not yet ignore are
+  printed — asked of git, so `.testguard/*` with negated exceptions, a global
+  ignore file and `.git/info/exclude` all answer correctly. `replay.json`,
+  `calibration.json`, `ci-self-evidence.json` and `.testguard/ci/` were missing
+  from the list `init` writes and have been added.
+- **The weekly release starts its own CI, so no human step is left.** A pull
+  request opened by `GITHUB_TOKEN` raises no `pull_request` event, so the three
+  required Node legs never started and auto-merge sat on checks that would
+  never run — the workflow simply printed `gh workflow run ci.yml --ref
+  release/vX.Y.Z` and waited for someone to read it. It now dispatches that
+  run itself, as `release.yml`'s `homebrew-sha` job already did, guarded so a
+  re-run does not queue a second identical run. With
+  "Allow GitHub Actions to create and approve pull requests" enabled, a
+  release now needs no manual step at all.
+- **The cost budget records a from-scratch release measurement.** 999 s for
+  115 faults on the v0.8.1 release commit, corroborated at 988 s on the
+  commit before it, against the unchanged 1100 s ceiling. The previous record
+  was 962 s at 96 faults.
+
+### Performance
+- **The self-probe cost budget is 1350 s, from 1100.** Six new claims and 14
+  new faults took the gate from 115 to 129 faults and 690 to 774 runs, and CI
+  measured 1123 s against the 1100 ceiling. The budget exists to make exactly
+  this visible rather than let it pass, so the raise is recorded with its
+  measurement and its reason in `testguard.cost-budget.json`. Two caveats are
+  written down there: the 1123 s run restored a cache under the fallback key
+  and so reused some verdicts, which makes it a floor rather than the
+  from-scratch figure this budget is defined against; and the number is
+  expected to come back down, because 44% of the gate is two shared defender
+  files re-run once per claim that names them. A third is recorded too: the
+  reported total is modelled rather than wall clock, because a reused record
+  contributes what it cost when it was last probed, so the same commit
+  measured 1123 s and then 1025 s depending on what the cache restored.
+- **The new calibration claim costs 4.9 s instead of 51 s.** Its tests are
+  pure — no git, no fixture corpus, no scratch worktree — but they were added
+  to `replay.test.mjs`, whose scripted-corpus setup costs tens of seconds a
+  run, and a claim pays for every test in the file it names. Moved to
+  `calibration.test.mjs`, which exists for exactly this, and the claim
+  re-pointed. Same two faults, still killed 2/2.
+
+### Documentation
+- The README shows an ignore-file entry. It was mentioned twice without one,
+  so the field name (`pattern`, not `value`) and the fact that `expires` is a
+  full timestamp rather than a date had to be discovered from a validator
+  refusal.
+- `--help` shows `gate --changed HEAD --include-dirty`. `--include-dirty` needs
+  a reference, and that combination is the one form a pre-commit hook wants.
+
 ## [0.8.1] - 2026-09-18
 
 Automated weekly release — everything merged since `v0.8.0`.

{testguard_cli-0.8.1 → testguard_cli-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: testguard-cli
-Version: 0.8.1
+Version: 0.9.0
 Summary: Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest. Ships the Node.js CLI (requires Node.js 20+).
 Project-URL: Homepage, https://github.com/raccioly/testguard
 Project-URL: Documentation, https://github.com/raccioly/testguard#readme
@@ -150,9 +150,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.8.1` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.9.0` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.8.1/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.9.0/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -434,6 +434,37 @@ excuses nothing. Non-source files and documented never-claimed patterns
 (`*.d.ts`, `*.config.*`, fixtures, mocks; `--explain` lists them) are
 excluded and said so; `--strict` fails a change that evaluated nothing.
 
+An ignore file is a list of `entries`. The field is `pattern`, and `reason` is
+not optional — it is the whole point of the mechanism:
+
+```json
+{
+  "$schema": "./node_modules/testguard-cli/spec/schemas/ignore.schema.json",
+  "schemaVersion": 1,
+  "entries": [
+    {
+      "kind": "path",
+      "pattern": "src/commands/**",
+      "reason": "Thin wrappers: read flags, call the module, print. The logic is claimed in the modules they call.",
+      "by": "maintainer",
+      "at": "2026-09-17T00:00:00Z"
+    },
+    {
+      "kind": "path",
+      "pattern": "src/legacy/billing.ts",
+      "reason": "Scheduled for deletion in Q4; claims would outlive the file.",
+      "by": "maintainer",
+      "at": "2026-09-17T00:00:00Z",
+      "expires": "2026-12-31T00:00:00Z"
+    }
+  ]
+}
+```
+
+`kind: "claim"` entries take the same shape and excuse a *removed claim*
+instead of an unclaimed file. An entry past its `expires` excuses nothing and
+is reported as `EXPIRED`.
+
 With a reference known, `status --changed <ref>` reports `unclaimed-changes`
 **before** any evidence state and makes the claim the next action; the brief
 lists the unclaimed files first. The claim is written before more code.
@@ -451,12 +482,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.8.1
+- uses: raccioly/testguard@v0.9.0
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.8.1/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.9.0/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 

{testguard_cli-0.8.1 → testguard_cli-0.9.0}/README.md

@@ -126,9 +126,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.8.1` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.9.0` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.8.1/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.9.0/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -410,6 +410,37 @@ excuses nothing. Non-source files and documented never-claimed patterns
 (`*.d.ts`, `*.config.*`, fixtures, mocks; `--explain` lists them) are
 excluded and said so; `--strict` fails a change that evaluated nothing.
 
+An ignore file is a list of `entries`. The field is `pattern`, and `reason` is
+not optional — it is the whole point of the mechanism:
+
+```json
+{
+  "$schema": "./node_modules/testguard-cli/spec/schemas/ignore.schema.json",
+  "schemaVersion": 1,
+  "entries": [
+    {
+      "kind": "path",
+      "pattern": "src/commands/**",
+      "reason": "Thin wrappers: read flags, call the module, print. The logic is claimed in the modules they call.",
+      "by": "maintainer",
+      "at": "2026-09-17T00:00:00Z"
+    },
+    {
+      "kind": "path",
+      "pattern": "src/legacy/billing.ts",
+      "reason": "Scheduled for deletion in Q4; claims would outlive the file.",
+      "by": "maintainer",
+      "at": "2026-09-17T00:00:00Z",
+      "expires": "2026-12-31T00:00:00Z"
+    }
+  ]
+}
+```
+
+`kind: "claim"` entries take the same shape and excuse a *removed claim*
+instead of an unclaimed file. An entry past its `expires` excuses nothing and
+is reported as `EXPIRED`.
+
 With a reference known, `status --changed <ref>` reports `unclaimed-changes`
 **before** any evidence state and makes the claim the next action; the brief
 lists the unclaimed files first. The claim is written before more code.
@@ -427,12 +458,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.8.1
+- uses: raccioly/testguard@v0.9.0
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.8.1/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.9.0/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 

{testguard_cli-0.8.1 → testguard_cli-0.9.0}/action.yml

@@ -46,7 +46,7 @@ inputs:
   version:
     description: 'testguard-cli version to run'
     required: false
-    default: '0.8.1'
+    default: '0.9.0'
   node-version:
     description: 'Node.js version (20+)'
     required: false

{testguard_cli-0.8.1 → testguard_cli-0.9.0}/docs-canonical/REQUIREMENTS.md

@@ -36,7 +36,7 @@
 | NFR-03 | The user's working tree is never damaged | scratch worktree by default; restore on signal, exception and exit; refusal to run in place over a dirty target; a restore failure is raised in every case but a scratch target that has already been deleted |
 | NFR-04 | Every emitted document conforms to the published schema before it is written | `writeSpecDoc` refuses non-conforming output |
 | NFR-05 | Verdicts are reproducible and attributable to a commit | evidence records `repo.head`, the snapshot when the working tree was probed, and the runner and its source |
-| NFR-06 | A verdict is never optimistic under uncertainty | contention recorded; flaky and timeout verdicts gate; escalation cannot upgrade a verdict; a survivor is unverifiable until the defenders are shown to fail because of the subject |
+| NFR-06 | A verdict is never optimistic under uncertainty | contention recorded and re-checked for liveness before it is reported; flaky and timeout verdicts gate; escalation cannot upgrade a verdict; a survivor is unverifiable until the defenders are shown to fail because of the subject; an unexpected exception is named as the tool's own defect rather than shown as a bare stack |
 | NFR-07 | Cost grows with what changed, not with the size of the project | verdict reuse on unchanged inputs; blast-radius-targeted escalation; a committed cost budget gated in CI, so growth is signed for rather than discovered |
 | NFR-08 | Portable contract | schemas are JSON Schema 2020-12, readable and implementable without this codebase |
 
@@ -95,16 +95,16 @@ fails the pull request naming the unclaimed file, and `status` reports
 | FR-08 | `src/gate/changed.mjs` | `test/gate.test.mjs`, `TG-GATE-UNCLAIMED-EXITS-1` |
 | FR-09 | `src/probe/mocks.mjs` | `test/mocks.test.mjs`, `TG-MOCKING-FILE-IS-NOT-A-DEFENDER` |
 | FR-10 | `src/probe/runners/` | fixture acceptance per runner, `TG-RUNNER-FROM-PROJECT-FIRST` |
-| FR-11 | `src/scaffold/producers.mjs` | `test/scaffold.test.mjs`, `TG-SCAFFOLD-ANCHORS-HIT` |
+| FR-11 | `src/scaffold/producers.mjs` | `test/scaffold.test.mjs`, `test/scaffold.python.test.mjs`, `TG-SCAFFOLD-ANCHORS-HIT`, `TG-SCAFFOLD-NEVER-PROPOSES-A-NO-OP`, `TG-SCAFFOLD-LOOP-GUARD-IS-A-GUARD` |
 | FR-12 | `src/admit/admit.mjs` | `test/admit.test.mjs`, `TG-ADMIT-NEEDS-ALL-KILLED` |
-| FR-13 | `src/replay/` | `test/replay.test.mjs`, `test/calibration.test.mjs`, `TG-REPLAY-FLAKY-IS-NEVER-CAUGHT`, `TG-CALIBRATION-COUNTS-NOCOVER-AS-A-MISS` |
+| FR-13 | `src/replay/` | `test/replay.test.mjs`, `test/calibration.test.mjs`, `TG-REPLAY-FLAKY-IS-NEVER-CAUGHT`, `TG-CALIBRATION-COUNTS-NOCOVER-AS-A-MISS`, `TG-CALIBRATION-COUNTS-ONLY-BUGS` |
 | FR-14 | `src/mcp/` | `test/mcp.test.mjs` |
-| NFR-01 | `src/init/init.mjs`, runner resolution | `TG-INIT-HOOK-NO-NETWORK`, `TG-README-HOOK-MATCHES-THE-CODE` |
+| NFR-01 | `src/init/init.mjs`, runner resolution | `TG-INIT-HOOK-NO-NETWORK`, `TG-README-HOOK-MATCHES-THE-CODE` (every surface, not only the README), `TG-GITIGNORE-ADVICE-IS-ONE-LIST` |
 | NFR-02 | `package.json` | `npm run test:install` in CI |
 | NFR-03 | `src/probe/inject.mjs`, `src/probe/probe.mjs` | `TG-DIRTY-DEFENDERS-REFUSED`, `TG-IGNORED-DIRTY-RECORDED`, `TG-IN-PLACE-STILL-RAISES-A-MISSING-TARGET`, `TG-CONTROL-RESTORES-THE-SUBJECT` |
 | NFR-04 | `src/evidence/writer.mjs` | `test/writer.test.mjs` |
 | NFR-05 | `src/probe/probe.mjs` | `TG-FINGERPRINT-VERDICT`, `TG-FAULT-EDIT-VISIBLE` |
-| NFR-06 | `src/probe/contention.mjs`, `classify.mjs` | `TG-CONTENTION-NEVER-FAILS-A-PROBE`, `TG-ESCALATION-N-RUNS`, `TG-ONE-BAD-FAULT-KEEPS-THE-EVIDENCE`, `TG-A-PRECONDITION-STILL-REFUSES-THE-RUN`, `TG-A-PROBE-ERROR-IS-NEVER-REUSED`, `TG-SURVIVOR-PROVES-THE-SUBJECT-RUNS`, `TG-CONTROL-READS-ANY-RED-AS-REACHED`, `TG-FATAL-EDIT-CANNOT-COMPILE` |
+| NFR-06 | `src/probe/contention.mjs`, `classify.mjs` | `TG-CONTENTION-NEVER-FAILS-A-PROBE`, `TG-ESCALATION-N-RUNS`, `TG-ONE-BAD-FAULT-KEEPS-THE-EVIDENCE`, `TG-A-PRECONDITION-STILL-REFUSES-THE-RUN`, `TG-A-PROBE-ERROR-IS-NEVER-REUSED`, `TG-SURVIVOR-PROVES-THE-SUBJECT-RUNS`, `TG-CONTROL-READS-ANY-RED-AS-REACHED`, `TG-FATAL-EDIT-CANNOT-COMPILE`, `TG-CONTENTION-IGNORES-A-DEAD-PID`, `TG-CLI-NAMES-ITS-OWN-BUGS` |
 | NFR-07 | verdict reuse, `src/probe/rank.mjs`, `src/probe/cost.mjs` | `test/probe.fixture.test.mjs` reuse case, `test/cost.test.mjs`, `TG-COST-BUDGET-ACTUALLY-GATES` |
 | NFR-08 | `spec/` | `spec/conformance/schemas.test.mjs`, `TG-WILSON-REPRODUCES-AT-THE-DOCUMENTS-PRECISION` |