testguard-cli 0.9.1__tar.gz → 0.9.2__tar.gz

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/.agents/skills/testguard/SKILL.md

@@ -21,6 +21,7 @@ which files exist. `state` is one of:
 | state | meaning | you do |
 |---|---|---|
 | `no-claims` | no `testguard.claims.json` | `testguard scaffold <file>` for a file with guards; replace every `TODO:` statement with what the code guarantees; keep or drop each proposal; move the claims into `testguard.claims.json` |
+| `invalid-anchors` | an exact fault anchor moved or became ambiguous | run `testguard claims --check-anchors`; repair `next.target` in the claims file without changing what the fault means, then re-probe. Never guess or auto-fix an anchor. |
 | `unprobed` | claims never probed | `testguard probe` |
 | `evidence-stale` | code, tests or claims changed since the evidence | `testguard probe --include-dirty` (or `--claim <ID>` for one) |
 | `provisional-only` | only `--confirm 1` evidence exists | `testguard probe --confirm 3` |
@@ -44,6 +45,8 @@ Exit codes: `0` clean · `1` unproven claims (or drift) · `2` precondition fail
 ## The fix loop
 
 1. `testguard status --json` → take `next.target`.
+   After editing guarded code, run `testguard claims --check-anchors` before
+   any probe; repair a named fault definition without weakening its meaning.
 2. Write the test. It must **fail when the fault is applied and pass on HEAD**. To check the first half by hand: apply `find` → `replace` in the target file, run the defender, restore.
 3. `testguard probe --claim <ID> --include-dirty` — probes your uncommitted test without touching the tree. `--confirm 1` gives a fast **provisional** signal; a `?` on a verdict means unconfirmed.
 4. When it is `killed` at `--confirm 3`, commit the test.

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/.github/workflows/ci.yml

@@ -185,6 +185,13 @@ jobs:
         if: github.event_name == 'pull_request'
         run: node cli/testguard.mjs gate . --changed "origin/${{ github.base_ref }}"
 
+      # Exact anchors and parseable replacements are knowable without a test
+      # runner. Fail here instead of spending the long self-probe merely to
+      # discover that a fault could never be applied.
+      - name: claims — fault anchors and replacements are valid
+        if: matrix.node-version == 22
+        run: node cli/testguard.mjs claims . --check-anchors
+
       # ── Self-verification: TestGuard is governed by the standard it defines.
       #    testguard.claims.json states invariants of the tool itself; every
       #    fault must be killed by the tool's own tests. Exit 0 = all defended. ──

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/CHANGELOG.md

@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.2] - 2026-09-19
+
+Automated weekly release — everything merged since `v0.9.1`.
+
+### Changed
+
+- feat(claims): preflight fault anchors (#126)
+- chore(homebrew): sha256 for v0.9.1 (#125)
+
+
+### Added
+
+- `claims --check-anchors` locates every exact fault anchor and syntax-checks
+  supported in-memory JavaScript and Python replacements without starting a
+  runner or touching the tree. CI runs the sub-second preflight before the
+  self-probe, while `status` reports rotted anchors as `invalid-anchors` with
+  the precise fault to repair. Repairs remain a reviewed judgement call:
+  there is deliberately no fuzzy match or `--fix`.
+
 ## [0.9.1] - 2026-09-19
 
 Automated weekly release — everything merged since `v0.9.0`.

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: testguard-cli
-Version: 0.9.1
+Version: 0.9.2
 Summary: Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest. Ships the Node.js CLI (requires Node.js 20+).
 Project-URL: Homepage, https://github.com/raccioly/testguard
 Project-URL: Documentation, https://github.com/raccioly/testguard#readme
@@ -151,9 +151,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.9.1` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.9.2` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.9.1/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.9.2/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -165,6 +165,7 @@ less than that many days ago (`ENOVERSIONS`); install that one with
 npx testguard-cli init                      # install the agent layer at the git root
 npx testguard-cli status --json             # where the project is, and the ONE next action
 npx testguard-cli claims                    # what does this project claim, and is each claim probeable?
+npx testguard-cli claims --check-anchors    # fail fast if an exact anchor moved or a replacement no longer parses
 npx testguard-cli scaffold src/auth.ts      # propose faults for a file, as a draft to keep or drop
 npx testguard-cli probe                     # try to falsify each claim; report what the tests missed
 npx testguard-cli admit test/auth.test.ts --claim AUTH-ADMIN   # does this test satisfy the two-gate rule?
@@ -175,8 +176,9 @@ npx testguard-cli replay --since v1.0..HEAD # would this suite have caught the b
 npx testguard-cli mcp                       # serve the read-only loop over MCP, on stdio
 ```
 
-Exit codes are the contract: `0` nothing new to prove, `1` unproven claims or
-unclaimed changes, `2` a precondition failed and nothing was probed, `3` usage.
+Exit codes are the contract: `0` nothing new to prove, `1` unproven claims,
+unclaimed changes or invalid fault anchors, `2` a precondition failed and
+nothing was probed, `3` usage.
 Every command accepts `--json`.
 
 ## How it works
@@ -201,6 +203,10 @@ npx testguard-cli admit test/x.test.ts --claim X   # is this test green on HEAD
    claim and every fault records who produced it. `testguard claims`
    validates the file and reports drift against `@claim <ID>` annotations in
    source. Test files are deliberately not scanned — a claim asserted by a test is the authorship trap the tool exists for — and annotation ids must contain a hyphen so prose is never mistaken for one.
+   `claims --check-anchors` additionally locates every exact anchor and parses
+   each in-memory JavaScript or Python replacement. It runs no tests, creates
+   no worktree and changes no file, so a moved anchor is reported before an
+   expensive probe. It reports and stops; it never guesses a new anchor.
 2. **Probe** confirms the defenders are green N times unmodified, applies
    each fault in a scratch git worktree (your tree is never touched), runs
    the defenders N times, re-runs survivors against the whole suite with
@@ -469,6 +475,10 @@ is reported as `EXPIRED`.
 With a reference known, `status --changed <ref>` reports `unclaimed-changes`
 **before** any evidence state and makes the claim the next action; the brief
 lists the unclaimed files first. The claim is written before more code.
+After claim coverage, `status` reports `invalid-anchors` before any evidence
+state when an exact fault anchor is missing or ambiguous, and points at the
+fault definition to repair. Repair preserves the fault's meaning and requires
+a re-probe; there is deliberately no `--fix`.
 
 **In CI the base is detected** — GitHub Actions (`GITHUB_BASE_REF`) and GitLab
 merge request pipelines (`CI_MERGE_REQUEST_DIFF_BASE_SHA`, then
@@ -483,12 +493,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.9.1
+- uses: raccioly/testguard@v0.9.2
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.9.1/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.9.2/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/README.md

@@ -127,9 +127,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.9.1` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.9.2` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.9.1/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.9.2/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -141,6 +141,7 @@ less than that many days ago (`ENOVERSIONS`); install that one with
 npx testguard-cli init                      # install the agent layer at the git root
 npx testguard-cli status --json             # where the project is, and the ONE next action
 npx testguard-cli claims                    # what does this project claim, and is each claim probeable?
+npx testguard-cli claims --check-anchors    # fail fast if an exact anchor moved or a replacement no longer parses
 npx testguard-cli scaffold src/auth.ts      # propose faults for a file, as a draft to keep or drop
 npx testguard-cli probe                     # try to falsify each claim; report what the tests missed
 npx testguard-cli admit test/auth.test.ts --claim AUTH-ADMIN   # does this test satisfy the two-gate rule?
@@ -151,8 +152,9 @@ npx testguard-cli replay --since v1.0..HEAD # would this suite have caught the b
 npx testguard-cli mcp                       # serve the read-only loop over MCP, on stdio
 ```
 
-Exit codes are the contract: `0` nothing new to prove, `1` unproven claims or
-unclaimed changes, `2` a precondition failed and nothing was probed, `3` usage.
+Exit codes are the contract: `0` nothing new to prove, `1` unproven claims,
+unclaimed changes or invalid fault anchors, `2` a precondition failed and
+nothing was probed, `3` usage.
 Every command accepts `--json`.
 
 ## How it works
@@ -177,6 +179,10 @@ npx testguard-cli admit test/x.test.ts --claim X   # is this test green on HEAD
    claim and every fault records who produced it. `testguard claims`
    validates the file and reports drift against `@claim <ID>` annotations in
    source. Test files are deliberately not scanned — a claim asserted by a test is the authorship trap the tool exists for — and annotation ids must contain a hyphen so prose is never mistaken for one.
+   `claims --check-anchors` additionally locates every exact anchor and parses
+   each in-memory JavaScript or Python replacement. It runs no tests, creates
+   no worktree and changes no file, so a moved anchor is reported before an
+   expensive probe. It reports and stops; it never guesses a new anchor.
 2. **Probe** confirms the defenders are green N times unmodified, applies
    each fault in a scratch git worktree (your tree is never touched), runs
    the defenders N times, re-runs survivors against the whole suite with
@@ -445,6 +451,10 @@ is reported as `EXPIRED`.
 With a reference known, `status --changed <ref>` reports `unclaimed-changes`
 **before** any evidence state and makes the claim the next action; the brief
 lists the unclaimed files first. The claim is written before more code.
+After claim coverage, `status` reports `invalid-anchors` before any evidence
+state when an exact fault anchor is missing or ambiguous, and points at the
+fault definition to repair. Repair preserves the fault's meaning and requires
+a re-probe; there is deliberately no `--fix`.
 
 **In CI the base is detected** — GitHub Actions (`GITHUB_BASE_REF`) and GitLab
 merge request pipelines (`CI_MERGE_REQUEST_DIFF_BASE_SHA`, then
@@ -459,12 +469,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.9.1
+- uses: raccioly/testguard@v0.9.2
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.9.1/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.9.2/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/action.yml

@@ -46,7 +46,7 @@ inputs:
   version:
     description: 'testguard-cli version to run'
     required: false
-    default: '0.9.1'
+    default: '0.9.2'
   node-version:
     description: 'Node.js version (20+)'
     required: false

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/docs/testguard-explained.html

@@ -144,7 +144,7 @@
 <div class="page">
   <div class="masthead">
     <div class="wordmark">Test<span class="mark">Guard</span></div>
-    <div class="meta">Technical Brief · v0.9.1 · MIT</div>
+    <div class="meta">Technical Brief · v0.9.2 · MIT</div>
   </div>
 
   <h1>Your tests pass. That is not the same as your tests working.</h1>

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/docs-canonical/ARCHITECTURE.md

@@ -2,7 +2,7 @@
 
 <!-- docguard:version 1.0.0 -->
 <!-- docguard:status approved -->
-<!-- docguard:last-reviewed 2026-09-18 -->
+<!-- docguard:last-reviewed 2026-09-19 -->
 <!-- docguard:owner @raccioly -->
 <!-- docguard:quality negation-load off — this tool is defined by what must not happen: no network, no telemetry, never optimistic under uncertainty. Stating those positively would misdescribe them. -->
 
@@ -35,7 +35,7 @@ code were wrong, would anything fail?*
 |---|---|---|
 | CLI dispatch | Parse argv, select a command, map errors to exit codes | `src/cli.mjs`, `cli/testguard.mjs` |
 | Commands | Thin wrappers: read flags, call a module, render output | `src/commands/*.mjs` |
-| Claims | Load and validate the claims file; reconcile `@claim` annotations; detect removed claims | `src/claims/` |
+| Claims | Load and validate the claims file; reconcile `@claim` annotations; detect removed claims; preflight exact anchors and supported replacement syntax | `src/claims/` |
 | Probe engine | Isolate, inject, run, escalate, restore, classify, rank | `src/probe/probe.mjs` |
 | Verdict function | The pure decision: runs in, verdict out | `src/probe/classify.mjs` |
 | Injector | Apply and restore a fault; anchor location | `src/probe/inject.mjs` |
@@ -131,7 +131,7 @@ to every other surface and `--check` fails the build on drift.
 
 | Stage | Where | Gate |
 |---|---|---|
-| Pull request | `ci.yml` | Suite on Node 20/22/24, syntax check of every source, install-from-tarball smoke, Python wrapper import, fixture oracles for vitest and jest, Playwright job, change gate, removed-claim check |
+| Pull request | `ci.yml` | Suite on Node 20/22/24, syntax check of every source, install-from-tarball smoke, Python wrapper import, fixture oracles for vitest and jest, Playwright job, change gate, removed-claim check, anchor/replacement preflight before self-probe |
 | Release gate | `ci.yml` | TestGuard probes its own claims; every fault must be killed |
 | Merge to main | `release.yml` | A version with no tag is tagged, released, and published to npm and PyPI over OIDC |
 | Recovery | `release.yml` | Hourly sweep; each registry is gated on its own state, so a partial publish is fixed by re-running |
@@ -141,6 +141,9 @@ to every other surface and `--check` fails the build on drift.
 ```
                     testguard.claims.json          (what must be true)
                               │
+               claims --check-anchors
+            (exact anchors + syntax, no tests)
+                              │
                               ▼
    ┌─────────── probe ────────────────────────────────────────────┐
    │  scratch git worktree  ←── isolation, never your tree        │

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/docs-canonical/DATA-MODEL.md

@@ -2,7 +2,7 @@
 
 <!-- docguard:version 1.0.0 -->
 <!-- docguard:status approved -->
-<!-- docguard:last-reviewed 2026-09-18 -->
+<!-- docguard:last-reviewed 2026-09-19 -->
 <!-- docguard:owner @raccioly -->
 <!-- docguard:quality negation-load off — the data model is largely a set of prohibitions (no database, no server state, fingerprints never derived from fault text). -->
 <!-- docguard:quality passive-voice off — this document describes what happens to documents as they flow through validation, where the artifact is the subject and the actor is irrelevant. -->
@@ -86,6 +86,11 @@ status.json ◀── derived from claims + evidence + baseline + working tree
 brief.json  ◀── derived from evidence + baseline + status
 ```
 
+Status also carries `invalidFaults`, the current exact-anchor failures with
+their observed and expected hit counts. When it is non-empty, the state is
+`invalid-anchors` and the next action is `repair-fault`; evidence cannot make a
+fault that no longer applies trustworthy.
+
 A fingerprint is `sha256(claimId \n subjectId \n file \n verdict)`. It is
 derived from identity and outcome, never from the fault's text, so repairing a
 rotted anchor does not churn the baseline, while a change of verdict does

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/docs-canonical/REQUIREMENTS.md

@@ -2,7 +2,7 @@
 
 <!-- docguard:version 1.0.0 -->
 <!-- docguard:status approved -->
-<!-- docguard:last-reviewed 2026-09-18 -->
+<!-- docguard:last-reviewed 2026-09-19 -->
 <!-- docguard:owner @raccioly -->
 <!-- docguard:quality passive-voice off — requirements are written in the standard "the system shall ..." register, where the agent is the system throughout. -->
 
@@ -26,6 +26,7 @@
 | FR-12 | Answer whether one test satisfies the two-gate rule for a claim (`admit`) | P2 |
 | FR-13 | Replay historical fix commits to measure whether the suite would have caught them, and calibrate by fault class | P3 |
 | FR-14 | Serve the read-only operating loop over MCP so the loop survives a change of agent harness | P3 |
+| FR-15 | Validate every exact fault anchor and the syntax of supported in-memory replacements before starting a test runner (`claims --check-anchors`), without guessing repairs | P1 |
 
 ## Non-Functional Requirements
 
@@ -99,6 +100,7 @@ fails the pull request naming the unclaimed file, and `status` reports
 | FR-12 | `src/admit/admit.mjs` | `test/admit.test.mjs`, `TG-ADMIT-NEEDS-ALL-KILLED` |
 | FR-13 | `src/replay/` | `test/replay.test.mjs`, `test/calibration.test.mjs`, `TG-REPLAY-FLAKY-IS-NEVER-CAUGHT`, `TG-CALIBRATION-COUNTS-NOCOVER-AS-A-MISS`, `TG-CALIBRATION-COUNTS-ONLY-BUGS` |
 | FR-14 | `src/mcp/` | `test/mcp.test.mjs` |
+| FR-15 | `src/claims/anchors.mjs`, `src/commands/claims.mjs`, `src/status/status.mjs` | `test/claims-anchors.test.mjs`, `test/status.test.mjs`, `TG-ANCHOR-PREFLIGHT-FAILS-FAST` |
 | NFR-01 | `src/init/init.mjs`, runner resolution | `TG-INIT-HOOK-NO-NETWORK`, `TG-README-HOOK-MATCHES-THE-CODE` (every surface, not only the README), `TG-GITIGNORE-ADVICE-IS-ONE-LIST` |
 | NFR-02 | `package.json` | `npm run test:install` in CI |
 | NFR-03 | `src/probe/inject.mjs`, `src/probe/probe.mjs` | `TG-DIRTY-DEFENDERS-REFUSED`, `TG-IGNORED-DIRTY-RECORDED`, `TG-IN-PLACE-STILL-RAISES-A-MISSING-TARGET`, `TG-CONTROL-RESTORES-THE-SUBJECT` |

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/docs-canonical/TEST-SPEC.md

@@ -2,7 +2,7 @@
 
 <!-- docguard:version 1.0.0 -->
 <!-- docguard:status approved -->
-<!-- docguard:last-reviewed 2026-09-18 -->
+<!-- docguard:last-reviewed 2026-09-19 -->
 <!-- docguard:owner @raccioly -->
 <!-- docguard:quality negation-load off — the governing rule is a prohibition (a test that would pass with the behaviour broken is not a test), and the verdict rules are defined by what does not count as detection. -->
 
@@ -19,6 +19,7 @@ the test that defends it, and CI fails if any injected fault survives.
 |---|---|---|---|
 | Unit | `test/*.test.mjs` | One pure function's branches, without a runner | milliseconds |
 | Conformance | `spec/conformance/` | Every valid example validates; every must-reject document is rejected for the defect its filename names | ~1 s |
+| Anchor preflight | `test/claims-anchors.test.mjs` | Exact anchors still locate, supported replacements parse, the check stays below one second, and CI reaches it before self-probe | <1 s |
 | Fixture acceptance | `test/probe.fixture.test.mjs`, `test/probe.jest.test.mjs`, `test/probe.playwright.test.mjs` | The whole pipeline reproduces a known-answer oracle, one per runner | 10–50 s each |
 | Self-verification | `testguard.claims.json`, run by `npm run self:probe` | The tool's own invariants survive fault injection | **13.4 min** cold (measured 2026-09-18 at `cf5a083`: 96 faults, 576 defender runs, 804 s, `--serial`, idle machine); seconds when verdicts are reused, which is why CI restores the previous evidence from cache. Budgeted at 950 s in `testguard.cost-budget.json` and **gated** in CI — the figure above went 9.6 → 23.6 min across one merged change while `--cost` printed it into a log nobody read |
 | Install smoke | `.github/scripts/install-smoke.mjs` | The **packed tarball** runs with production dependencies only | ~20 s |
@@ -57,6 +58,9 @@ What is gated instead:
 4. **Every spec change ships its conformance case** — schema, semantic rule,
    valid example and must-reject document, in the same pull request.
 5. **A new fault shape needs a synthetic-file test and a README row.**
+6. **Every fault must pass the cheap preflight before self-verification.** A
+   missing or ambiguous anchor, or a supported replacement that does not
+   parse, fails CI before the long self-probe starts.
 
 ## Service-to-Test Map
 
@@ -64,6 +68,7 @@ What is gated instead:
 |---|---|
 | `src/probe/classify.mjs` | `test/classify.test.mjs`, `test/negative-control.test.mjs` |
 | `src/probe/inject.mjs` | `test/inject.test.mjs` |
+| `src/claims/anchors.mjs` | `test/claims-anchors.test.mjs` |
 | `src/probe/probe.mjs` | `test/probe.fixture.test.mjs`, `test/probe-preconditions.test.mjs`, `test/probe-error.test.mjs` |
 | `src/probe/discover.mjs`, `src/probe/mocks.mjs` | `test/discover.test.mjs`, `test/mocks.test.mjs` |
 | `src/probe/rank.mjs` | `test/rank-aliases.test.mjs`, `test/discover.test.mjs` |

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "testguard-cli",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "testguard-cli",
-      "version": "0.9.1",
+      "version": "0.9.2",
       "license": "MIT",
       "dependencies": {
         "ajv": "8.20.0"

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "testguard-cli",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest.",
   "type": "module",
   "license": "MIT",

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/packaging/gitlab/testguard.gitlab-ci.yml

@@ -3,7 +3,7 @@
 # Include it from a project's .gitlab-ci.yml, pinned to a release:
 #
 #   include:
-#     - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.9.1/packaging/gitlab/testguard.gitlab-ci.yml'
+#     - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.9.2/packaging/gitlab/testguard.gitlab-ci.yml'
 #       inputs:
 #         dir: backend            # where testguard.claims.json lives (default ".")
 #         post_note: true         # post the brief as a merge-request note (needs TESTGUARD_GITLAB_TOKEN, api scope)
@@ -29,7 +29,7 @@ spec:
   inputs:
     version:
       description: testguard-cli version to run
-      default: "0.9.1"
+      default: "0.9.2"
     dir:
       description: directory whose test runner is invoked (where testguard.claims.json lives)
       default: "."

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/packaging/homebrew/testguard.rb

@@ -15,8 +15,8 @@
 class Testguard < Formula
   desc "Proves a test suite defends the claims a project makes"
   homepage "https://github.com/raccioly/testguard"
-  url "https://registry.npmjs.org/testguard-cli/-/testguard-cli-0.9.1.tgz"
-  sha256 "e8ebb4e78e1d91f21a47dee1edb63ee7fac72f96d2834b08654f89c18812ef7d"
+  url "https://registry.npmjs.org/testguard-cli/-/testguard-cli-0.9.2.tgz"
+  sha256 "118c895b89b336b919ca61d9af35915fded75c27d08feeabaf2340d6e5a9a847"
   license "MIT"
 
   depends_on "node"

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "testguard-cli"
-version = "0.9.1"
+version = "0.9.2"
 description = "Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest. Ships the Node.js CLI (requires Node.js 20+)."
 readme = "README.md"
 license = { text = "MIT" }

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/spec/GATE-SEMANTICS.md

@@ -395,6 +395,26 @@ changed); `1` at least one uncovered file (or strict mode over an
 all-excluded change); `2` the change cannot be evaluated (unresolvable
 reference, invalid claims or ignore file, no repository); `3` no reference.
 
+## Anchor preflight
+
+`claims --check-anchors` answers what is knowable before a runner starts. For
+every fault-injection fault it reads the target, applies the same exact
+`locate()` arithmetic as a probe, and reports `ok`, `anchor-missing` or
+`anchor-ambiguous` with the observed and expected hit counts. When a language
+has a cheap parser, it also parses the in-memory replacement (`node --check`
+semantics for JavaScript modules, `compile()` for Python). Unsupported
+languages are anchor-checked and otherwise skipped without inference.
+
+One non-`ok` anchor or non-parsing supported replacement exits `1`. The check
+runs no tests, creates no worktree, reads no git state and writes no source.
+It is not evidence that a defender detects the fault; the self-probe still
+runs after it. There is no automatic repair or fuzzy relocation: choosing a
+new anchor is a semantic edit to the claim and must be reviewed and re-probed.
+
+`invalid-anchors` precedes every evidence state in the status document (after
+`unclaimed-changes`, when a change reference is known). Its next action is
+`repair-fault`, naming the first fault and `testguard claims --check-anchors`.
+
 ## Severity floor
 
 `--severity <level>` gates only findings whose claim severity is at or above

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/spec/conformance/examples/status.json

@@ -32,6 +32,7 @@
     "baselined": 4
   },
   "stale": [],
+  "invalidFaults": [],
   "changedFaults": [
     {
       "claimId": "REDACT-002",

testguard_cli-0.9.2/spec/conformance/invalid/status.invalid-anchor-hidden.json

@@ -0,0 +1,27 @@
+{
+  "schemaVersion": 1,
+  "tool": { "name": "testguard", "version": "0.9.1" },
+  "generatedAt": "2026-09-19T00:00:00Z",
+  "state": "unprobed",
+  "next": {
+    "action": "probe",
+    "command": "testguard probe",
+    "why": "Claims have not been probed."
+  },
+  "provisional": false,
+  "counts": { "claims": 1, "faults": 1 },
+  "stale": [],
+  "invalidFaults": [
+    {
+      "claimId": "C-1",
+      "subjectId": "F1",
+      "file": "src/a.mjs",
+      "reason": "anchor-missing",
+      "hits": 0,
+      "expected": 1
+    }
+  ],
+  "changedFaults": [],
+  "findings": [],
+  "paths": { "claims": "testguard.claims.json" }
+}

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/spec/lib/validate.mjs

@@ -233,12 +233,15 @@ const semantic = {
 
   status(doc) {
     const errors = [];
-    if (['write-test', 'review-fault-change'].includes(doc.next.action) && !doc.next.target) errors.push({ path: '/next/target', message: `${doc.next.action} requires a target` });
+    if (['write-test', 'review-fault-change', 'repair-fault'].includes(doc.next.action) && !doc.next.target) errors.push({ path: '/next/target', message: `${doc.next.action} requires a target` });
     if (doc.next.action === 'claim' && !doc.next.file) errors.push({ path: '/next/file', message: 'claim requires the file the claim is about' });
     if (doc.state === 'no-claims' && doc.counts.claims !== 0) errors.push({ path: '/counts/claims', message: 'no-claims with a non-zero claim count' });
     if (doc.state === 'clean' && (doc.counts.new ?? 0) > 0) errors.push({ path: '/state', message: 'clean with new findings' });
     if (doc.state === 'unclaimed-changes' && !(doc.changes && doc.changes.uncovered.length > 0)) errors.push({ path: '/changes/uncovered', message: 'unclaimed-changes requires at least one uncovered changed file' });
     if (doc.state === 'unclaimed-changes' && doc.next.action !== 'claim') errors.push({ path: '/next/action', message: 'unclaimed-changes requires next.action = claim' });
+    if (doc.state === 'invalid-anchors' && !(doc.invalidFaults?.length > 0)) errors.push({ path: '/invalidFaults', message: 'invalid-anchors requires at least one invalid fault' });
+    if (doc.state === 'invalid-anchors' && doc.next.action !== 'repair-fault') errors.push({ path: '/next/action', message: 'invalid-anchors requires next.action = repair-fault' });
+    if (doc.invalidFaults?.length > 0 && doc.state !== 'invalid-anchors') errors.push({ path: '/state', message: 'invalid fault anchors are hidden behind a later state; invalid-anchors precedes every evidence state' });
     if (doc.evidenceSource && !doc.evidenceHead) errors.push({ path: '/evidenceHead', message: 'evidence was read, so the commit it describes must be recorded' });
     if (doc.changes && doc.changes.uncovered.length > 0 && !['no-claims', 'unclaimed-changes'].includes(doc.state)) errors.push({ path: '/state', message: 'uncovered changed files are hidden behind a later state; unclaimed-changes precedes every evidence state' });
     return errors;

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/spec/schemas/brief.schema.json

@@ -39,7 +39,7 @@
       "type": "object",
       "required": ["action", "command", "why"],
       "properties": {
-        "action": { "enum": ["scaffold", "claim", "probe", "write-test", "baseline", "review-fault-change", "none"] },
+        "action": { "enum": ["scaffold", "claim", "probe", "write-test", "baseline", "repair-fault", "review-fault-change", "none"] },
         "command": { "type": "string", "minLength": 1, "maxLength": 1024 },
         "why": { "type": "string", "minLength": 1, "maxLength": 2000 }
       },

{testguard_cli-0.9.1 → testguard_cli-0.9.2}/spec/schemas/status.schema.json

@@ -26,10 +26,11 @@
       "$ref": "urn:claimspec:v1:common#/$defs/isoDateTime"
     },
     "state": {
-      "description": "no-claims: no claims file. unclaimed-changes: the change measured against a reference touches source files that carry no claim and no excusing ignore entry (only computed when a reference is known; it precedes every evidence state because the claim is written before more code). unprobed: claims but no confirmed evidence. evidence-stale: evidence exists but a claim, fault, target or defender changed since. provisional-only: only sub-N evidence exists. unproven: current evidence has findings not covered by the baseline. clean: every finding is killed or baselined.",
+      "description": "no-claims: no claims file. unclaimed-changes: the change measured against a reference touches source files that carry no claim and no excusing ignore entry (only computed when a reference is known; it precedes every evidence state because the claim is written before more code). invalid-anchors: one or more exact fault anchors are missing or ambiguous, so probing would be unable to apply them. unprobed: claims but no confirmed evidence. evidence-stale: evidence exists but a claim, fault, target or defender changed since. provisional-only: only sub-N evidence exists. unproven: current evidence has findings not covered by the baseline. clean: every finding is killed or baselined.",
       "enum": [
         "no-claims",
         "unclaimed-changes",
+        "invalid-anchors",
         "unprobed",
         "evidence-stale",
         "provisional-only",
@@ -54,6 +55,7 @@
             "write-test",
             "baseline",
             "review-fault-change",
+            "repair-fault",
             "none"
           ]
         },
@@ -188,6 +190,23 @@
         "additionalProperties": false
       }
     },
+    "invalidFaults": {
+      "description": "Faults whose exact text anchor does not locate in the current target. These precede every evidence state: a probe cannot learn anything from a fault it cannot apply.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["claimId", "subjectId", "file", "reason", "hits", "expected"],
+        "properties": {
+          "claimId": { "$ref": "urn:claimspec:v1:common#/$defs/identifier" },
+          "subjectId": { "$ref": "urn:claimspec:v1:common#/$defs/identifier" },
+          "file": { "$ref": "urn:claimspec:v1:common#/$defs/repoPath" },
+          "reason": { "enum": ["anchor-missing", "anchor-ambiguous"] },
+          "hits": { "type": "integer", "minimum": 0 },
+          "expected": { "type": "integer", "minimum": 1 }
+        },
+        "additionalProperties": false
+      }
+    },
     "findings": {
       "description": "Unproven findings from the current evidence, ranked, new first, capped.",
       "type": "array",