testguard-cli 0.9.3__tar.gz → 0.10.0__tar.gz

{testguard_cli-0.9.3 → testguard_cli-0.10.0}/CHANGELOG.md

@@ -7,6 +7,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.10.0] - 2026-09-19
+
+Automated weekly release — everything merged since `v0.9.4`.
+
+### Changed
+
+- feat(status): expose claimed source surface (#135)
+- chore(homebrew): sha256 for v0.9.4 (#136)
+
+
+### Added
+
+- `status` now makes the claim denominator visible: claimed versus current
+  source modules, coverage of the 20 highest-churn modules over a bounded
+  200-commit window, and specific unclaimed modules ranked by churn with
+  explicit path-risk signals. A clean project whose majority of modules are
+  still unclaimed is directed to scaffold the highest-churn gap. The existing
+  co-authorship caveat is also printed by both `status` and `probe`, rather
+  than remaining available only in JSON and the agent brief.
+
+## [0.9.4] - 2026-09-19
+
+Automated weekly release — everything merged since `v0.9.3`.
+
+### Changed
+
+- fix(test): ignore nested agent worktrees (#133)
+- chore(homebrew): sha256 for v0.9.3 (#131)
+
+
+### Fixed
+
+- The canonical `npm test` command no longer collects suites from live nested
+  worktrees under `.claude/`. A parked checkout can remain safely available
+  without its unfinished tests or fixtures contaminating the main tree's gate.
+
 ## [0.9.3] - 2026-09-19
 
 Automated weekly release — everything merged since `v0.9.2`.

{testguard_cli-0.9.3 → testguard_cli-0.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: testguard-cli
-Version: 0.9.3
+Version: 0.10.0
 Summary: Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest. Ships the Node.js CLI (requires Node.js 20+).
 Project-URL: Homepage, https://github.com/raccioly/testguard
 Project-URL: Documentation, https://github.com/raccioly/testguard#readme
@@ -151,9 +151,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.9.3` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.10.0` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.9.3/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.10.0/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -493,12 +493,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.9.3
+- uses: raccioly/testguard@v0.10.0
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.9.3/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.10.0/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 
@@ -657,9 +657,17 @@ things make that safe:
   *should* ship with its regression test — but a repository where every kill
   is co-authored has no independent verification, whatever its claim
   verification rate says. It is a **signal**: ranking reads it, verdicts never
-  do, and the brief says it in one line. Nothing else in this category
+  do, and `probe`, `status` and the brief all say it in one line. Nothing else in this category
   measures it, and agents saturate the tests they can see
   ([SpecBench](https://arxiv.org/abs/2605.21384)).
+- **Claimed surface is visible.** A clean probe is only about claims that
+  exist. `status` therefore reports claimed source modules over the current
+  module denominator, how many of the 20 highest-churn modules are claimed,
+  and the concrete unclaimed modules worth examining next over a bounded
+  200-commit window. Churn and path-risk signals stay separate; there is no
+  synthetic health score. When most modules remain unclaimed and the existing
+  evidence is clean, the next action expands the denominator instead of
+  congratulating the same small set of claims again.
 - **Gaming is visible.** The cheapest way to make a survivor disappear is to
   weaken its fault, not to write a test. Evidence records every fault's
   content hash; `status` lists any fault edited after it survived, with its

{testguard_cli-0.9.3 → testguard_cli-0.10.0}/README.md

@@ -127,9 +127,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.9.3` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.10.0` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.9.3/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.10.0/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -469,12 +469,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.9.3
+- uses: raccioly/testguard@v0.10.0
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.9.3/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.10.0/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 
@@ -633,9 +633,17 @@ things make that safe:
   *should* ship with its regression test — but a repository where every kill
   is co-authored has no independent verification, whatever its claim
   verification rate says. It is a **signal**: ranking reads it, verdicts never
-  do, and the brief says it in one line. Nothing else in this category
+  do, and `probe`, `status` and the brief all say it in one line. Nothing else in this category
   measures it, and agents saturate the tests they can see
   ([SpecBench](https://arxiv.org/abs/2605.21384)).
+- **Claimed surface is visible.** A clean probe is only about claims that
+  exist. `status` therefore reports claimed source modules over the current
+  module denominator, how many of the 20 highest-churn modules are claimed,
+  and the concrete unclaimed modules worth examining next over a bounded
+  200-commit window. Churn and path-risk signals stay separate; there is no
+  synthetic health score. When most modules remain unclaimed and the existing
+  evidence is clean, the next action expands the denominator instead of
+  congratulating the same small set of claims again.
 - **Gaming is visible.** The cheapest way to make a survivor disappear is to
   weaken its fault, not to write a test. Evidence records every fault's
   content hash; `status` lists any fault edited after it survived, with its

{testguard_cli-0.9.3 → testguard_cli-0.10.0}/action.yml

@@ -46,7 +46,7 @@ inputs:
   version:
     description: 'testguard-cli version to run'
     required: false
-    default: '0.9.3'
+    default: '0.10.0'
   node-version:
     description: 'Node.js version (20+)'
     required: false

{testguard_cli-0.9.3 → testguard_cli-0.10.0}/docs/testguard-explained.html

@@ -144,7 +144,7 @@
 <div class="page">
   <div class="masthead">
     <div class="wordmark">Test<span class="mark">Guard</span></div>
-    <div class="meta">Technical Brief · v0.9.3 · MIT</div>
+    <div class="meta">Technical Brief · v0.10.0 · MIT</div>
   </div>
 
   <h1>Your tests pass. That is not the same as your tests working.</h1>

{testguard_cli-0.9.3 → testguard_cli-0.10.0}/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "testguard-cli",
-  "version": "0.9.3",
+  "version": "0.10.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "testguard-cli",
-      "version": "0.9.3",
+      "version": "0.10.0",
       "license": "MIT",
       "dependencies": {
         "ajv": "8.20.0"

{testguard_cli-0.9.3 → testguard_cli-0.10.0}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "testguard-cli",
-  "version": "0.9.3",
+  "version": "0.10.0",
   "description": "Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest.",
   "type": "module",
   "license": "MIT",

{testguard_cli-0.9.3 → testguard_cli-0.10.0}/packaging/gitlab/testguard.gitlab-ci.yml

@@ -3,7 +3,7 @@
 # Include it from a project's .gitlab-ci.yml, pinned to a release:
 #
 #   include:
-#     - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.9.3/packaging/gitlab/testguard.gitlab-ci.yml'
+#     - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.10.0/packaging/gitlab/testguard.gitlab-ci.yml'
 #       inputs:
 #         dir: backend            # where testguard.claims.json lives (default ".")
 #         post_note: true         # post the brief as a merge-request note (needs TESTGUARD_GITLAB_TOKEN, api scope)
@@ -29,7 +29,7 @@ spec:
   inputs:
     version:
       description: testguard-cli version to run
-      default: "0.9.3"
+      default: "0.10.0"
     dir:
       description: directory whose test runner is invoked (where testguard.claims.json lives)
       default: "."

{testguard_cli-0.9.3 → testguard_cli-0.10.0}/packaging/homebrew/testguard.rb

@@ -15,8 +15,8 @@
 class Testguard < Formula
   desc "Proves a test suite defends the claims a project makes"
   homepage "https://github.com/raccioly/testguard"
-  url "https://registry.npmjs.org/testguard-cli/-/testguard-cli-0.9.3.tgz"
-  sha256 "33e88eaa37c34744c08c581a64b4939472e22e898ce1dabf15507fd77229d4e0"
+  url "https://registry.npmjs.org/testguard-cli/-/testguard-cli-0.10.0.tgz"
+  sha256 "ab42501d45ba0a71b534e12aa86da2a9fc2f664a1da4f38a4e436dfd30c02c3c"
   license "MIT"
 
   depends_on "node"

{testguard_cli-0.9.3 → testguard_cli-0.10.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "testguard-cli"
-version = "0.9.3"
+version = "0.10.0"
 description = "Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest. Ships the Node.js CLI (requires Node.js 20+)."
 readme = "README.md"
 license = { text = "MIT" }

{testguard_cli-0.9.3 → testguard_cli-0.10.0}/spec/GATE-SEMANTICS.md

@@ -344,6 +344,27 @@ the suppress-up-to-count semantics are identical.
   hidden. A file that mocks the subject is never a discovered defender: a
   mock cannot detect a fault in what it replaced.
 
+## Claimed source surface
+
+`status` reports the denominator that `probe` cannot: current, non-test source
+modules with a supported extension and outside the change gate's documented
+default exclusions. A module is claimed when at least one fault anchors to it.
+The document carries the claimed, unclaimed and total module counts.
+
+The report also names concrete unclaimed modules. It counts touches over at
+most the latest 200 commits, reports how many of the 20 highest-churn modules
+are claimed, and lists up to ten unclaimed modules in descending churn order.
+Security- and money-shaped path names are explicit tie-breaking signals, never
+semantic claims about a file. Churn, path risk and claim coverage remain raw
+facts: they are never collapsed into one health score.
+
+When existing evidence is clean but more source modules are unclaimed than
+claimed, the next action is to scaffold the highest-churn unclaimed module.
+Earlier correctness states still win: invalid anchors, stale evidence and
+unproven faults are repaired before expanding the denominator. Without git
+history the counts and concrete files remain available, while the document
+says history is unavailable and reports zero commits read.
+
 ## Claim coverage of a change
 
 `probe` asks whether the tests defend the claims that exist. It says nothing

{testguard_cli-0.9.3 → testguard_cli-0.10.0}/spec/conformance/examples/status.json

@@ -18,6 +18,27 @@
     }
   },
   "provisional": false,
+  "surface": {
+    "sourceModules": 3,
+    "claimedModules": 2,
+    "unclaimedModules": 1,
+    "history": {
+      "available": true,
+      "maxCommits": 200,
+      "commitsRead": 40
+    },
+    "highChurn": {
+      "modules": 3,
+      "claimed": 2
+    },
+    "rankedUnclaimed": [
+      {
+        "file": "src/session.mjs",
+        "changes": 8,
+        "riskSignals": ["security"]
+      }
+    ]
+  },
   "counts": {
     "claims": 2,
     "faults": 6,

testguard_cli-0.10.0/spec/conformance/invalid/status.surface-counts-disagree.json

@@ -0,0 +1,28 @@
+{
+  "schemaVersion": 1,
+  "tool": { "name": "testguard", "version": "0.10.0" },
+  "generatedAt": "2026-09-19T21:00:00Z",
+  "state": "no-claims",
+  "next": {
+    "action": "scaffold",
+    "command": "testguard scaffold src/a.mjs",
+    "why": "No claims yet.",
+    "file": "src/a.mjs"
+  },
+  "provisional": false,
+  "surface": {
+    "sourceModules": 2,
+    "claimedModules": 1,
+    "unclaimedModules": 0,
+    "history": { "available": true, "maxCommits": 200, "commitsRead": 12 },
+    "highChurn": { "modules": 2, "claimed": 1 },
+    "rankedUnclaimed": []
+  },
+  "counts": { "claims": 0, "faults": 0 },
+  "stale": [],
+  "invalidFaults": [],
+  "changedFaults": [],
+  "findings": [],
+  "notes": [],
+  "paths": {}
+}

{testguard_cli-0.9.3 → testguard_cli-0.10.0}/spec/lib/validate.mjs

@@ -244,6 +244,12 @@ const semantic = {
     if (doc.invalidFaults?.length > 0 && doc.state !== 'invalid-anchors') errors.push({ path: '/state', message: 'invalid fault anchors are hidden behind a later state; invalid-anchors precedes every evidence state' });
     if (doc.evidenceSource && !doc.evidenceHead) errors.push({ path: '/evidenceHead', message: 'evidence was read, so the commit it describes must be recorded' });
     if (doc.changes && doc.changes.uncovered.length > 0 && !['no-claims', 'unclaimed-changes'].includes(doc.state)) errors.push({ path: '/state', message: 'uncovered changed files are hidden behind a later state; unclaimed-changes precedes every evidence state' });
+    if (doc.surface) {
+      if (doc.surface.claimedModules + doc.surface.unclaimedModules !== doc.surface.sourceModules) errors.push({ path: '/surface', message: 'claimedModules + unclaimedModules must equal sourceModules' });
+      if (doc.surface.highChurn.claimed > doc.surface.highChurn.modules) errors.push({ path: '/surface/highChurn/claimed', message: 'claimed high-churn modules cannot exceed the high-churn window' });
+      if (!doc.surface.history.available && doc.surface.history.commitsRead !== 0) errors.push({ path: '/surface/history/commitsRead', message: 'unavailable history must report zero commits read' });
+      if (new Set(doc.surface.rankedUnclaimed.map((item) => item.file)).size !== doc.surface.rankedUnclaimed.length) errors.push({ path: '/surface/rankedUnclaimed', message: 'ranked unclaimed modules must be unique' });
+    }
     return errors;
   },
 

{testguard_cli-0.9.3 → testguard_cli-0.10.0}/spec/schemas/status.schema.json

@@ -102,6 +102,56 @@
     "provisional": {
       "type": "boolean"
     },
+    "surface": {
+      "description": "The current claim denominator. A source module is a non-test file with a supported source extension that is not covered by the documented default exclusions. Churn is bounded recent git history and remains separate from path-risk signals; neither is collapsed into a score.",
+      "type": "object",
+      "required": ["sourceModules", "claimedModules", "unclaimedModules", "history", "highChurn", "rankedUnclaimed"],
+      "properties": {
+        "sourceModules": { "type": "integer", "minimum": 0 },
+        "claimedModules": { "type": "integer", "minimum": 0 },
+        "unclaimedModules": { "type": "integer", "minimum": 0 },
+        "history": {
+          "type": "object",
+          "required": ["available", "maxCommits", "commitsRead"],
+          "properties": {
+            "available": { "type": "boolean" },
+            "maxCommits": { "type": "integer", "minimum": 1 },
+            "commitsRead": { "type": "integer", "minimum": 0 }
+          },
+          "additionalProperties": false
+        },
+        "highChurn": {
+          "description": "How many of the up-to-20 most changed source modules carry a claim.",
+          "type": "object",
+          "required": ["modules", "claimed"],
+          "properties": {
+            "modules": { "type": "integer", "minimum": 0, "maximum": 20 },
+            "claimed": { "type": "integer", "minimum": 0, "maximum": 20 }
+          },
+          "additionalProperties": false
+        },
+        "rankedUnclaimed": {
+          "description": "Up to ten concrete unclaimed modules, ordered by changes in the bounded history window; path-risk signals break ties and are reported explicitly.",
+          "type": "array",
+          "maxItems": 10,
+          "items": {
+            "type": "object",
+            "required": ["file", "changes", "riskSignals"],
+            "properties": {
+              "file": { "$ref": "urn:claimspec:v1:common#/$defs/repoPath" },
+              "changes": { "type": "integer", "minimum": 0 },
+              "riskSignals": {
+                "type": "array",
+                "uniqueItems": true,
+                "items": { "enum": ["security", "money"] }
+              }
+            },
+            "additionalProperties": false
+          }
+        }
+      },
+      "additionalProperties": false
+    },
     "counts": {
       "type": "object",
       "required": [

{testguard_cli-0.9.3 → testguard_cli-0.10.0}/src/brief/brief.mjs

@@ -1,5 +1,5 @@
 import { gate } from '../baseline/baseline.mjs';
-import { summarize, formatVerdict } from '../render.mjs';
+import { coAuthorshipWarning, summarize, formatVerdict } from '../render.mjs';
 
 export const HEADING = '## TEST BLINDSPOT CONTEXT';
 /** First line of every markdown brief, so a poster can find and update its own note instead of adding another. */
@@ -98,7 +98,7 @@ export function renderBriefText(brief, { hasBaseline, total, independence }) {
   }
   // L3: a kill written in the same change as the code it guards is not
   // independent evidence. One line, no per-item noise.
-  if (independence?.coAuthored) lines.push('', `${independence.coAuthored} of ${independence.kills} kills are co-authored with the code they defend — the test and the code were written in the same change, so those kills are not independent evidence.`);
+  if (independence?.coAuthored) lines.push('', coAuthorshipWarning(independence.coAuthored, independence.kills));
   if (brief.next) lines.push('', `NEXT [${brief.next.action}]: ${brief.next.command}`, `  why: ${brief.next.why}`);
   if (brief.items.length === 0) {
     lines.push('', 'Every probed claim is defended. Keep it that way: new claims need a fault and a test that fails on it.');

{testguard_cli-0.9.3 → testguard_cli-0.10.0}/src/gate/changed.mjs

@@ -28,7 +28,7 @@ import { globToRegExp } from '../util/glob.mjs';
 export const SOURCE_EXT = new Set(['.js', '.mjs', '.cjs', '.ts', '.mts', '.cts', '.jsx', '.tsx', '.py']);
 const TEST_RE = /\.(test|spec)\.[cm]?[jt]sx?$/;
 // Python names tests by file, not by a dotted suffix: `test_foo.py`, `foo_test.py`.
-const isTestFile = (f) => TEST_RE.test(f) || IS_PY_TEST.test(f);
+export const isTestFile = (f) => TEST_RE.test(f) || IS_PY_TEST.test(f);
 
 /** Files that are source by extension but never carry claims. Printed by --explain. */
 export const DEFAULT_EXCLUDES = Object.freeze([
@@ -42,6 +42,10 @@ export const DEFAULT_EXCLUDES = Object.freeze([
   '**/__snapshots__/**',
   '.testguard/**',
 ]);
+const DEFAULT_EXCLUDE_RES = DEFAULT_EXCLUDES.map(globToRegExp);
+
+/** Whether a source-shaped path is outside TestGuard's claimable module surface. */
+export const isDefaultExcluded = (file) => DEFAULT_EXCLUDE_RES.some((re) => re.test(file));
 
 export const defaultIgnorePath = (projectDir) => join(projectDir, 'testguard.ignore.json');
 
@@ -158,7 +162,7 @@ export function computeChangedGate({ projectDir, ref, includeDirty = false, excl
 
   const pathEntries = ignore.entries.filter((e) => e.kind === 'path').map((e) => ({ entry: e, re: globToRegExp(e.pattern), expired: isExpired(e, now), files: [] }));
   const userExcludes = exclude.map((g) => ({ glob: g, re: globToRegExp(g) }));
-  const defaultExcludes = DEFAULT_EXCLUDES.map((g) => ({ glob: g, re: globToRegExp(g) }));
+  const defaultExcludes = DEFAULT_EXCLUDES.map((g, i) => ({ glob: g, re: DEFAULT_EXCLUDE_RES[i] }));
 
   const excluded = [];
   const covered = [];

{testguard_cli-0.9.3 → testguard_cli-0.10.0}/src/render.mjs

@@ -5,6 +5,8 @@ export const formatVerdict = (v, provisional = false) => (v === 'killed' ? 'kill
 
 export const PROVISIONAL_WARNING = (n) => `PROVISIONAL — confirmRuns ${n} (< 3): nothing below is confirmed. Verdicts carry a "?"; this evidence cannot be frozen into a baseline. Re-run with --confirm 3 before trusting it.`;
 
+export const coAuthorshipWarning = (coAuthored, kills) => `${coAuthored} of ${kills} kills are co-authored with the code they defend — the test and the code were written in the same change, so those kills are not independent evidence.`;
+
 export function renderRecord(r, { provisional = false, showDiscovered = true } = {}) {
   const head = `${formatVerdict(r.verdict, provisional).padEnd(15)} ${r.claim.id}/${r.subject.id}`.padEnd(38);
   let why = '';
@@ -32,7 +34,10 @@ export function renderSummary(records, run) {
   const unproven = records.filter((r) => r.verdict !== 'killed');
   const claims = new Set(unproven.map((r) => r.claim.id)).size;
   const where = run ? ` Probed ${run.repo.snapshot ? `working tree (snapshot ${run.repo.snapshot.slice(0, 7)} of ${run.repo.head.slice(0, 7)})` : run.mode === 'in-place' ? `in place at ${run.repo.head.slice(0, 7)}${run.repo.dirty ? ' (dirty)' : ''}` : run.repo.head.slice(0, 7)}.` : '';
-  return `${run?.provisional ? 'PROVISIONAL: ' : ''}${records.length} faults probed: ${parts.join(', ')}. ${unproven.length} unproven fault${unproven.length === 1 ? '' : 's'} across ${claims} claim${claims === 1 ? '' : 's'}.${where}`;
+  const kills = records.filter((r) => r.verdict === 'killed');
+  const coAuthored = kills.filter((r) => r.detail.independence?.class === 'co-authored').length;
+  const quality = coAuthored ? `\n${coAuthorshipWarning(coAuthored, kills.length)}` : '';
+  return `${run?.provisional ? 'PROVISIONAL: ' : ''}${records.length} faults probed: ${parts.join(', ')}. ${unproven.length} unproven fault${unproven.length === 1 ? '' : 's'} across ${claims} claim${claims === 1 ? '' : 's'}.${where}${quality}`;
 }
 
 /** Survivors first, then by rank score; killed last. */

{testguard_cli-0.9.3 → testguard_cli-0.10.0}/src/status/status.mjs

@@ -6,13 +6,18 @@ import { gate } from '../baseline/baseline.mjs';
 import { hashFile, sha256 } from '../util/hash.mjs';
 import { resolveDefenders } from '../probe/runners/shared.mjs';
 import { discoverDefenders } from '../probe/discover.mjs';
-import { sortForReport } from '../render.mjs';
+import { coAuthorshipWarning, sortForReport } from '../render.mjs';
 import { computeChangedGate, defaultIgnorePath } from '../gate/changed.mjs';
 import { headSha, isAncestor } from '../git.mjs';
 import { checkAnchorLocations } from '../claims/anchors.mjs';
+import { computeClaimedSurface, needsClaimExpansion } from './surface.mjs';
 
 export const faultContentHash = (fault) => sha256(`${fault.find}\n${fault.replace}`);
 
+const candidateReason = (surface, candidate) => surface.history.available
+  ? `${candidate.file}, the highest-churn unclaimed module in the last ${surface.history.commitsRead} commit${surface.history.commitsRead === 1 ? '' : 's'}`
+  : `${candidate.file}, the first unclaimed module by path because git history is unavailable`;
+
 const P = (projectDir) => ({
   claims: defaultClaimsPath(projectDir),
   evidence: join(projectDir, '.testguard', 'evidence.json'),
@@ -68,6 +73,11 @@ export function computeStatus({ projectDir, toolVersion = '0.0.0', generatedAt =
   };
 
   if (!existsSync(paths.claims)) {
+    doc.surface = computeClaimedSurface({ projectDir });
+    const candidate = doc.surface.rankedUnclaimed[0];
+    if (candidate && !changes?.uncovered.length) {
+      doc.next = { action: 'scaffold', command: `testguard scaffold ${candidate.file}`, why: `${doc.surface.sourceModules} source module${doc.surface.sourceModules === 1 ? '' : 's'} exist and none carries a claim. Start with ${candidateReason(doc.surface, candidate)}.`, file: candidate.file };
+    }
     if (changes?.uncovered.length) {
       const u = changes.uncovered[0];
       doc.next = { action: 'scaffold', command: `testguard scaffold ${u.file}`, why: `No testguard.claims.json in this project, and ${unclaimedWhy()}`, file: u.file };
@@ -79,6 +89,7 @@ export function computeStatus({ projectDir, toolVersion = '0.0.0', generatedAt =
   const claims = loadClaims(paths.claims);
   doc.counts.claims = claims.claims.length;
   doc.counts.faults = claims.claims.reduce((n, c) => n + c.faults.length, 0);
+  doc.surface = computeClaimedSurface({ projectDir, claims });
   const faultIndex = new Map();
   for (const c of claims.claims) for (const f of c.faults) faultIndex.set(`${c.id}/${f.id}`, { claim: c, fault: f });
 
@@ -236,6 +247,15 @@ export function computeStatus({ projectDir, toolVersion = '0.0.0', generatedAt =
   } else {
     doc.next = { action: 'none', command: 'testguard probe', why: unprovenTotal ? `${unprovenTotal} baselined finding${unprovenTotal === 1 ? '' : 's'} remain; nothing new. Re-probe after changing code, tests or claims.` : 'Every claim is defended. Re-probe after changing code, tests or claims; add a claim for every new invariant.' };
   }
+  if (needsClaimExpansion(doc.surface)) {
+    const candidate = doc.surface.rankedUnclaimed[0];
+    doc.next = {
+      action: 'claim',
+      command: `testguard scaffold ${candidate.file}`,
+      why: `The existing claims are defended, but only ${doc.surface.claimedModules} of ${doc.surface.sourceModules} source modules carry a claim. Expand the denominator at ${candidateReason(doc.surface, candidate)}.`,
+      file: candidate.file,
+    };
+  }
   return doc;
 }
 
@@ -246,6 +266,15 @@ export function renderStatus(doc) {
   }
   lines.push(`state: ${doc.state}${doc.provisional ? ' (provisional)' : ''} — ${doc.counts.claims} claims / ${doc.counts.faults} faults` + (doc.counts.byVerdict ? `; ${Object.entries(doc.counts.byVerdict).map(([k, v]) => `${v} ${k}`).join(', ')}; ${doc.counts.new ?? 0} new, ${doc.counts.baselined ?? 0} baselined` : '')
   );
+  if (doc.surface) {
+    const s = doc.surface;
+    const history = s.history.available ? `last ${s.history.commitsRead} commit${s.history.commitsRead === 1 ? '' : 's'}` : 'git history unavailable';
+    lines.push(`surface:  ${s.claimedModules} of ${s.sourceModules} source modules carry a claim; ${s.highChurn.claimed} of ${s.highChurn.modules} highest-churn modules claimed (${history})`);
+    for (const item of s.rankedUnclaimed.slice(0, 3)) lines.push(`UNCLAIMED ${item.file} — ${item.changes} change${item.changes === 1 ? '' : 's'} in history window${item.riskSignals.length ? `; path risk: ${item.riskSignals.join(', ')}` : ''}`);
+  }
+  const coAuthored = doc.counts.killedCoAuthored ?? 0;
+  const kills = doc.counts.byVerdict?.killed ?? 0;
+  if (coAuthored) lines.push(`evidence: ${coAuthorshipWarning(coAuthored, kills)}`);
   if (doc.changes) {
     const c = doc.changes;
     lines.push(`changes:  ${c.changed} file${c.changed === 1 ? '' : 's'} since ${c.ref}; ${c.evaluated} evaluated, ${c.excluded} excluded, ${c.uncovered.length} unclaimed`);

testguard_cli-0.10.0/src/status/surface.mjs

@@ -0,0 +1,72 @@
+import { existsSync } from 'node:fs';
+import { extname, join } from 'node:path';
+import { git } from '../git.mjs';
+import { SOURCE_EXT, isDefaultExcluded, isTestFile } from '../gate/changed.mjs';
+import { walk } from '../util/glob.mjs';
+
+export const HISTORY_COMMITS = 200;
+export const HIGH_CHURN_MODULES = 20;
+export const RANKED_UNCLAIMED = 10;
+
+const RISK_SIGNALS = Object.freeze([
+  ['security', /(^|[._/-])(auth|authn|authz|authorization|credential|crypto|login|password|permission|rbac|secret|security|session|token)([._/-]|$)/i],
+  ['money', /(^|[._/-])(billing|checkout|invoice|money|payment|payout|price|pricing|refund)([._/-]|$)/i],
+]);
+
+const pathRiskSignals = (file) => RISK_SIGNALS.filter(([, re]) => re.test(file)).map(([name]) => name);
+
+function listedFiles(projectDir) {
+  try {
+    return git(['ls-files', '-co', '--exclude-standard', '-z', '--', '.'], projectDir).split('\0').filter(Boolean);
+  } catch {
+    return walk(projectDir);
+  }
+}
+
+function claimableModules(projectDir) {
+  return listedFiles(projectDir).filter((file) =>
+    existsSync(join(projectDir, file)) &&
+    SOURCE_EXT.has(extname(file)) &&
+    !isTestFile(file) &&
+    !isDefaultExcluded(file));
+}
+
+function recentChanges(projectDir, sourceModules) {
+  const counts = new Map();
+  try {
+    const commitsRead = Number(git(['rev-list', '--count', `--max-count=${HISTORY_COMMITS}`, 'HEAD', '--', '.'], projectDir));
+    const paths = git(['log', '--relative', '-n', String(HISTORY_COMMITS), '--pretty=format:', '--name-only', '-z', '--', '.'], projectDir).split('\0').filter(Boolean);
+    for (const file of paths) if (sourceModules.has(file)) counts.set(file, (counts.get(file) ?? 0) + 1);
+    return { available: true, commitsRead, counts };
+  } catch {
+    return { available: false, commitsRead: 0, counts };
+  }
+}
+
+/**
+ * The denominator `probe` cannot provide: current source modules carrying at
+ * least one fault, plus concrete unclaimed modules ranked by bounded git
+ * history. Churn and path-risk remain separate facts; there is no score.
+ */
+export function computeClaimedSurface({ projectDir, claims }) {
+  const modules = new Set(claimableModules(projectDir));
+  const claimedFiles = new Set((claims?.claims ?? []).flatMap((claim) => claim.faults.map((fault) => fault.file)));
+  const claimed = new Set([...modules].filter((file) => claimedFiles.has(file)));
+  const history = recentChanges(projectDir, modules);
+  const describe = (file) => ({ file, changes: history.counts.get(file) ?? 0, riskSignals: pathRiskSignals(file) });
+  const ranked = [...modules].map(describe).sort((a, b) =>
+    b.changes - a.changes || b.riskSignals.length - a.riskSignals.length || a.file.localeCompare(b.file));
+  const highChurn = ranked.slice(0, Math.min(HIGH_CHURN_MODULES, ranked.length));
+  const rankedUnclaimed = ranked.filter((item) => !claimed.has(item.file)).slice(0, RANKED_UNCLAIMED);
+  return {
+    sourceModules: modules.size,
+    claimedModules: claimed.size,
+    unclaimedModules: modules.size - claimed.size,
+    history: { available: history.available, maxCommits: HISTORY_COMMITS, commitsRead: history.commitsRead },
+    highChurn: { modules: highChurn.length, claimed: highChurn.filter((item) => claimed.has(item.file)).length },
+    rankedUnclaimed,
+  };
+}
+
+/** Expand the claim surface only when most current source modules are unseen. */
+export const needsClaimExpansion = (surface) => surface.unclaimedModules > surface.claimedModules && surface.rankedUnclaimed.length > 0;

{testguard_cli-0.9.3 → testguard_cli-0.10.0}/test/brief.test.mjs

@@ -58,6 +58,11 @@ describe('renderSummary', () => {
     expect(line).toContain(`${unproven.length} unproven fault`);
     expect(line).toContain(`across ${new Set(unproven.map((r) => r.claim.id)).size} claim`);
   });
+  it('prints the co-authorship caveat on the human probe surface', () => {
+    const records = structuredClone(evidence.records.filter((r) => r.verdict === 'killed'));
+    records[0].detail.independence = { class: 'co-authored', defenderCommit: 'a'.repeat(40), targetCommit: 'a'.repeat(40), sameAuthor: true };
+    expect(renderSummary(records)).toContain(`1 of ${records.length} kills are co-authored with the code they defend`);
+  });
 });
 
 describe('renderRecord', () => {