testguard-cli 0.9.4__tar.gz → 0.10.1__tar.gz

{testguard_cli-0.9.4 → testguard_cli-0.10.1}/CHANGELOG.md

@@ -7,6 +7,45 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.10.1] - 2026-09-19
+
+Automated weekly release — everything merged since `v0.10.0`.
+
+### Changed
+
+- fix(probe): preserve repeated claim selections (#139)
+- chore(homebrew): sha256 for v0.10.0 (#138)
+
+
+### Fixed
+
+- Repeated `probe --claim` flags no longer collapse silently to the last value.
+  Repeated and comma-separated ids are flattened in first-seen order,
+  duplicates are collapsed, empty selections fail, and both human and JSON
+  partial-run output show requested versus probed ids and counts. Probe JSON is
+  now validated against the published status schema before it is emitted. The
+  singular `scaffold` and `admit` forms reject ambiguous repeated values.
+
+## [0.10.0] - 2026-09-19
+
+Automated weekly release — everything merged since `v0.9.4`.
+
+### Changed
+
+- feat(status): expose claimed source surface (#135)
+- chore(homebrew): sha256 for v0.9.4 (#136)
+
+
+### Added
+
+- `status` now makes the claim denominator visible: claimed versus current
+  source modules, coverage of the 20 highest-churn modules over a bounded
+  200-commit window, and specific unclaimed modules ranked by churn with
+  explicit path-risk signals. A clean project whose majority of modules are
+  still unclaimed is directed to scaffold the highest-churn gap. The existing
+  co-authorship caveat is also printed by both `status` and `probe`, rather
+  than remaining available only in JSON and the agent brief.
+
 ## [0.9.4] - 2026-09-19
 
 Automated weekly release — everything merged since `v0.9.3`.

{testguard_cli-0.9.4 → testguard_cli-0.10.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: testguard-cli
-Version: 0.9.4
+Version: 0.10.1
 Summary: Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest. Ships the Node.js CLI (requires Node.js 20+).
 Project-URL: Homepage, https://github.com/raccioly/testguard
 Project-URL: Documentation, https://github.com/raccioly/testguard#readme
@@ -151,9 +151,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.9.4` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.10.1` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.9.4/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.10.1/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -303,8 +303,12 @@ npx testguard-cli admit test/x.test.ts --claim X   # is this test green on HEAD
    because it fails when the claim is false.
 
    Practical loop: first pass `--no-escalate` (escalation re-runs the whole
-   suite N times per survivor); iterate on one claim with `--claim <ID>` and
-   either `--include-dirty` or `--in-place` (only fault target files must be
+   suite N times per survivor); iterate on one claim with `--claim <ID>`, or
+   select a batch with commas or repeated flags (`--claim A,B --claim C`).
+   Every occurrence is retained in first-seen order, duplicates are collapsed,
+   and partial human/JSON output names both the requested and probed counts, so
+   a green subset cannot masquerade as the selection the operator asked for.
+   Use either `--include-dirty` or `--in-place` (only fault target files must be
    clean there; test files may be dirty), optionally `--confirm 1` for a fast
    **provisional** signal — verdicts print with a `?`, evidence goes to
    `evidence-provisional.json`, and `baseline` refuses it; final pass with
@@ -493,12 +497,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.9.4
+- uses: raccioly/testguard@v0.10.1
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.9.4/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.10.1/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 
@@ -657,9 +661,17 @@ things make that safe:
   *should* ship with its regression test — but a repository where every kill
   is co-authored has no independent verification, whatever its claim
   verification rate says. It is a **signal**: ranking reads it, verdicts never
-  do, and the brief says it in one line. Nothing else in this category
+  do, and `probe`, `status` and the brief all say it in one line. Nothing else in this category
   measures it, and agents saturate the tests they can see
   ([SpecBench](https://arxiv.org/abs/2605.21384)).
+- **Claimed surface is visible.** A clean probe is only about claims that
+  exist. `status` therefore reports claimed source modules over the current
+  module denominator, how many of the 20 highest-churn modules are claimed,
+  and the concrete unclaimed modules worth examining next over a bounded
+  200-commit window. Churn and path-risk signals stay separate; there is no
+  synthetic health score. When most modules remain unclaimed and the existing
+  evidence is clean, the next action expands the denominator instead of
+  congratulating the same small set of claims again.
 - **Gaming is visible.** The cheapest way to make a survivor disappear is to
   weaken its fault, not to write a test. Evidence records every fault's
   content hash; `status` lists any fault edited after it survived, with its

{testguard_cli-0.9.4 → testguard_cli-0.10.1}/README.md

@@ -127,9 +127,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.9.4` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.10.1` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.9.4/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.10.1/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -279,8 +279,12 @@ npx testguard-cli admit test/x.test.ts --claim X   # is this test green on HEAD
    because it fails when the claim is false.
 
    Practical loop: first pass `--no-escalate` (escalation re-runs the whole
-   suite N times per survivor); iterate on one claim with `--claim <ID>` and
-   either `--include-dirty` or `--in-place` (only fault target files must be
+   suite N times per survivor); iterate on one claim with `--claim <ID>`, or
+   select a batch with commas or repeated flags (`--claim A,B --claim C`).
+   Every occurrence is retained in first-seen order, duplicates are collapsed,
+   and partial human/JSON output names both the requested and probed counts, so
+   a green subset cannot masquerade as the selection the operator asked for.
+   Use either `--include-dirty` or `--in-place` (only fault target files must be
    clean there; test files may be dirty), optionally `--confirm 1` for a fast
    **provisional** signal — verdicts print with a `?`, evidence goes to
    `evidence-provisional.json`, and `baseline` refuses it; final pass with
@@ -469,12 +473,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.9.4
+- uses: raccioly/testguard@v0.10.1
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.9.4/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.10.1/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 
@@ -633,9 +637,17 @@ things make that safe:
   *should* ship with its regression test — but a repository where every kill
   is co-authored has no independent verification, whatever its claim
   verification rate says. It is a **signal**: ranking reads it, verdicts never
-  do, and the brief says it in one line. Nothing else in this category
+  do, and `probe`, `status` and the brief all say it in one line. Nothing else in this category
   measures it, and agents saturate the tests they can see
   ([SpecBench](https://arxiv.org/abs/2605.21384)).
+- **Claimed surface is visible.** A clean probe is only about claims that
+  exist. `status` therefore reports claimed source modules over the current
+  module denominator, how many of the 20 highest-churn modules are claimed,
+  and the concrete unclaimed modules worth examining next over a bounded
+  200-commit window. Churn and path-risk signals stay separate; there is no
+  synthetic health score. When most modules remain unclaimed and the existing
+  evidence is clean, the next action expands the denominator instead of
+  congratulating the same small set of claims again.
 - **Gaming is visible.** The cheapest way to make a survivor disappear is to
   weaken its fault, not to write a test. Evidence records every fault's
   content hash; `status` lists any fault edited after it survived, with its

{testguard_cli-0.9.4 → testguard_cli-0.10.1}/action.yml

@@ -46,7 +46,7 @@ inputs:
   version:
     description: 'testguard-cli version to run'
     required: false
-    default: '0.9.4'
+    default: '0.10.1'
   node-version:
     description: 'Node.js version (20+)'
     required: false

{testguard_cli-0.9.4 → testguard_cli-0.10.1}/docs/testguard-explained.html

@@ -144,7 +144,7 @@
 <div class="page">
   <div class="masthead">
     <div class="wordmark">Test<span class="mark">Guard</span></div>
-    <div class="meta">Technical Brief · v0.9.4 · MIT</div>
+    <div class="meta">Technical Brief · v0.10.1 · MIT</div>
   </div>
 
   <h1>Your tests pass. That is not the same as your tests working.</h1>

{testguard_cli-0.9.4 → testguard_cli-0.10.1}/docs-canonical/REQUIREMENTS.md

@@ -1,6 +1,6 @@
 # Requirements
 
-<!-- docguard:version 1.0.0 -->
+<!-- docguard:version 1.1.0 -->
 <!-- docguard:status approved -->
 <!-- docguard:last-reviewed 2026-09-19 -->
 <!-- docguard:owner @raccioly -->
@@ -27,6 +27,7 @@
 | FR-13 | Replay historical fix commits to measure whether the suite would have caught them, and calibrate by fault class | P3 |
 | FR-14 | Serve the read-only operating loop over MCP so the loop survives a change of agent harness | P3 |
 | FR-15 | Validate every exact fault anchor and the syntax of supported in-memory replacements before starting a test runner (`claims --check-anchors`), without guessing repairs | P1 |
+| FR-16 | Preserve every repeated or comma-separated `probe --claim` selection in first-seen order, collapse duplicates, and report requested versus probed scope without allowing an empty selection to pass | P1 |
 
 ## Non-Functional Requirements
 
@@ -101,6 +102,7 @@ fails the pull request naming the unclaimed file, and `status` reports
 | FR-13 | `src/replay/` | `test/replay.test.mjs`, `test/calibration.test.mjs`, `TG-REPLAY-FLAKY-IS-NEVER-CAUGHT`, `TG-CALIBRATION-COUNTS-NOCOVER-AS-A-MISS`, `TG-CALIBRATION-COUNTS-ONLY-BUGS` |
 | FR-14 | `src/mcp/` | `test/mcp.test.mjs` |
 | FR-15 | `src/claims/anchors.mjs`, `src/commands/claims.mjs`, `src/status/status.mjs` | `test/claims-anchors.test.mjs`, `test/status.test.mjs`, `TG-ANCHOR-PREFLIGHT-FAILS-FAST` |
+| FR-16 | `src/cli.mjs`, `src/commands/probe.mjs`, `src/probe/probe.mjs`, `src/commands/scaffold.mjs`, `src/commands/admit.mjs` | `test/claim-selection.test.mjs`, `test/probe.fixture.test.mjs`, `TG-REPEATED-CLAIMS-ARE-ALL-PROBED` |
 | NFR-01 | `src/init/init.mjs`, runner resolution | `TG-INIT-HOOK-NO-NETWORK`, `TG-README-HOOK-MATCHES-THE-CODE` (every surface, not only the README), `TG-GITIGNORE-ADVICE-IS-ONE-LIST` |
 | NFR-02 | `package.json` | `npm run test:install` in CI |
 | NFR-03 | `src/probe/inject.mjs`, `src/probe/probe.mjs` | `TG-DIRTY-DEFENDERS-REFUSED`, `TG-IGNORED-DIRTY-RECORDED`, `TG-IN-PLACE-STILL-RAISES-A-MISSING-TARGET`, `TG-CONTROL-RESTORES-THE-SUBJECT` |
@@ -114,4 +116,5 @@ fails the pull request naming the unclaimed file, and `status` reports
 
 | Version | Date | Change | Author |
 |---|---|---|---|
+| 1.1.0 | 2026-09-19 | Require lossless, visible partial claim selection | @raccioly |
 | 1.0.0 | 2026-09-18 | First canonical requirements, written against v0.6.0 | @raccioly |

{testguard_cli-0.9.4 → testguard_cli-0.10.1}/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "testguard-cli",
-  "version": "0.9.4",
+  "version": "0.10.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "testguard-cli",
-      "version": "0.9.4",
+      "version": "0.10.1",
       "license": "MIT",
       "dependencies": {
         "ajv": "8.20.0"

{testguard_cli-0.9.4 → testguard_cli-0.10.1}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "testguard-cli",
-  "version": "0.9.4",
+  "version": "0.10.1",
   "description": "Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest.",
   "type": "module",
   "license": "MIT",

{testguard_cli-0.9.4 → testguard_cli-0.10.1}/packaging/gitlab/testguard.gitlab-ci.yml

@@ -3,7 +3,7 @@
 # Include it from a project's .gitlab-ci.yml, pinned to a release:
 #
 #   include:
-#     - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.9.4/packaging/gitlab/testguard.gitlab-ci.yml'
+#     - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.10.1/packaging/gitlab/testguard.gitlab-ci.yml'
 #       inputs:
 #         dir: backend            # where testguard.claims.json lives (default ".")
 #         post_note: true         # post the brief as a merge-request note (needs TESTGUARD_GITLAB_TOKEN, api scope)
@@ -29,7 +29,7 @@ spec:
   inputs:
     version:
       description: testguard-cli version to run
-      default: "0.9.4"
+      default: "0.10.1"
     dir:
       description: directory whose test runner is invoked (where testguard.claims.json lives)
       default: "."

{testguard_cli-0.9.4 → testguard_cli-0.10.1}/packaging/homebrew/testguard.rb

@@ -15,8 +15,8 @@
 class Testguard < Formula
   desc "Proves a test suite defends the claims a project makes"
   homepage "https://github.com/raccioly/testguard"
-  url "https://registry.npmjs.org/testguard-cli/-/testguard-cli-0.9.4.tgz"
-  sha256 "3ab202d339b014ea5d8a11cc143bd1bdef6ea08120a513029f7537c288ba3195"
+  url "https://registry.npmjs.org/testguard-cli/-/testguard-cli-0.10.1.tgz"
+  sha256 "ebb9e4ac0370e0b2cbc52b3e5f24e8426020fd3b5ff9db6b2776ab2744874dab"
   license "MIT"
 
   depends_on "node"

{testguard_cli-0.9.4 → testguard_cli-0.10.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "testguard-cli"
-version = "0.9.4"
+version = "0.10.1"
 description = "Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest. Ships the Node.js CLI (requires Node.js 20+)."
 readme = "README.md"
 license = { text = "MIT" }

{testguard_cli-0.9.4 → testguard_cli-0.10.1}/spec/GATE-SEMANTICS.md

@@ -344,6 +344,27 @@ the suppress-up-to-count semantics are identical.
   hidden. A file that mocks the subject is never a discovered defender: a
   mock cannot detect a fault in what it replaced.
 
+## Claimed source surface
+
+`status` reports the denominator that `probe` cannot: current, non-test source
+modules with a supported extension and outside the change gate's documented
+default exclusions. A module is claimed when at least one fault anchors to it.
+The document carries the claimed, unclaimed and total module counts.
+
+The report also names concrete unclaimed modules. It counts touches over at
+most the latest 200 commits, reports how many of the 20 highest-churn modules
+are claimed, and lists up to ten unclaimed modules in descending churn order.
+Security- and money-shaped path names are explicit tie-breaking signals, never
+semantic claims about a file. Churn, path risk and claim coverage remain raw
+facts: they are never collapsed into one health score.
+
+When existing evidence is clean but more source modules are unclaimed than
+claimed, the next action is to scaffold the highest-churn unclaimed module.
+Earlier correctness states still win: invalid anchors, stale evidence and
+unproven faults are repaired before expanding the denominator. Without git
+history the counts and concrete files remain available, while the document
+says history is unavailable and reports zero commits read.
+
 ## Claim coverage of a change
 
 `probe` asks whether the tests defend the claims that exist. It says nothing
@@ -415,6 +436,16 @@ new anchor is a semantic edit to the claim and must be reviewed and re-probed.
 `unclaimed-changes`, when a change reference is known). Its next action is
 `repair-fault`, naming the first fault and `testguard claims --check-anchors`.
 
+## Partial probe scope
+
+Every `--claim` occurrence contributes to the selection. Comma-separated ids
+inside each occurrence are flattened in first-seen order and duplicates are
+collapsed. An explicitly empty selection is a usage error, never a successful
+zero-record probe. Partial human output and the `probe --json` run wrapper name
+the requested and actually probed claim ids and counts. Commands whose
+`--claim` is singular (`scaffold` and `admit`) reject repeated or comma-separated
+values instead of silently choosing one.
+
 ## Severity floor
 
 `--severity <level>` gates only findings whose claim severity is at or above

{testguard_cli-0.9.4 → testguard_cli-0.10.1}/spec/conformance/examples/status.json

@@ -18,6 +18,41 @@
     }
   },
   "provisional": false,
+  "run": {
+    "id": "run-20260917T020000",
+    "evidence": ".testguard/evidence-partial.json",
+    "provisional": false,
+    "records": 4,
+    "newSinceBaseline": 1,
+    "exitCode": 1,
+    "scope": {
+      "requestedClaims": ["REDACT-002", "REDACT-001"],
+      "requestedCount": 2,
+      "probedClaims": ["REDACT-002", "REDACT-001"],
+      "probedCount": 2
+    }
+  },
+  "surface": {
+    "sourceModules": 3,
+    "claimedModules": 2,
+    "unclaimedModules": 1,
+    "history": {
+      "available": true,
+      "maxCommits": 200,
+      "commitsRead": 40
+    },
+    "highChurn": {
+      "modules": 3,
+      "claimed": 2
+    },
+    "rankedUnclaimed": [
+      {
+        "file": "src/session.mjs",
+        "changes": 8,
+        "riskSignals": ["security"]
+      }
+    ]
+  },
   "counts": {
     "claims": 2,
     "faults": 6,

testguard_cli-0.10.1/spec/conformance/invalid/status.partial-scope-counts-disagree.json

@@ -0,0 +1,31 @@
+{
+  "schemaVersion": 1,
+  "tool": { "name": "testguard", "version": "0.10.0" },
+  "generatedAt": "2026-09-19T22:00:00Z",
+  "state": "unprobed",
+  "next": {
+    "action": "probe",
+    "command": "testguard probe",
+    "why": "Claims have not been probed."
+  },
+  "counts": { "claims": 2, "faults": 2 },
+  "stale": [],
+  "invalidFaults": [],
+  "changedFaults": [],
+  "findings": [],
+  "paths": {},
+  "run": {
+    "id": "run-20260919T220000",
+    "evidence": ".testguard/evidence-partial.json",
+    "provisional": false,
+    "records": 1,
+    "newSinceBaseline": 0,
+    "exitCode": 0,
+    "scope": {
+      "requestedClaims": ["A", "B"],
+      "requestedCount": 1,
+      "probedClaims": ["A"],
+      "probedCount": 1
+    }
+  }
+}

testguard_cli-0.10.1/spec/conformance/invalid/status.surface-counts-disagree.json

@@ -0,0 +1,28 @@
+{
+  "schemaVersion": 1,
+  "tool": { "name": "testguard", "version": "0.10.0" },
+  "generatedAt": "2026-09-19T21:00:00Z",
+  "state": "no-claims",
+  "next": {
+    "action": "scaffold",
+    "command": "testguard scaffold src/a.mjs",
+    "why": "No claims yet.",
+    "file": "src/a.mjs"
+  },
+  "provisional": false,
+  "surface": {
+    "sourceModules": 2,
+    "claimedModules": 1,
+    "unclaimedModules": 0,
+    "history": { "available": true, "maxCommits": 200, "commitsRead": 12 },
+    "highChurn": { "modules": 2, "claimed": 1 },
+    "rankedUnclaimed": []
+  },
+  "counts": { "claims": 0, "faults": 0 },
+  "stale": [],
+  "invalidFaults": [],
+  "changedFaults": [],
+  "findings": [],
+  "notes": [],
+  "paths": {}
+}

{testguard_cli-0.9.4 → testguard_cli-0.10.1}/spec/lib/validate.mjs

@@ -244,6 +244,19 @@ const semantic = {
     if (doc.invalidFaults?.length > 0 && doc.state !== 'invalid-anchors') errors.push({ path: '/state', message: 'invalid fault anchors are hidden behind a later state; invalid-anchors precedes every evidence state' });
     if (doc.evidenceSource && !doc.evidenceHead) errors.push({ path: '/evidenceHead', message: 'evidence was read, so the commit it describes must be recorded' });
     if (doc.changes && doc.changes.uncovered.length > 0 && !['no-claims', 'unclaimed-changes'].includes(doc.state)) errors.push({ path: '/state', message: 'uncovered changed files are hidden behind a later state; unclaimed-changes precedes every evidence state' });
+    if (doc.surface) {
+      if (doc.surface.claimedModules + doc.surface.unclaimedModules !== doc.surface.sourceModules) errors.push({ path: '/surface', message: 'claimedModules + unclaimedModules must equal sourceModules' });
+      if (doc.surface.highChurn.claimed > doc.surface.highChurn.modules) errors.push({ path: '/surface/highChurn/claimed', message: 'claimed high-churn modules cannot exceed the high-churn window' });
+      if (!doc.surface.history.available && doc.surface.history.commitsRead !== 0) errors.push({ path: '/surface/history/commitsRead', message: 'unavailable history must report zero commits read' });
+      if (new Set(doc.surface.rankedUnclaimed.map((item) => item.file)).size !== doc.surface.rankedUnclaimed.length) errors.push({ path: '/surface/rankedUnclaimed', message: 'ranked unclaimed modules must be unique' });
+    }
+    if (doc.run?.scope) {
+      const scope = doc.run.scope;
+      if (scope.requestedCount !== scope.requestedClaims.length) errors.push({ path: '/run/scope/requestedCount', message: 'requestedCount must equal requestedClaims.length' });
+      if (scope.probedCount !== scope.probedClaims.length) errors.push({ path: '/run/scope/probedCount', message: 'probedCount must equal probedClaims.length' });
+      const requested = new Set(scope.requestedClaims);
+      if (scope.probedClaims.some((id) => !requested.has(id))) errors.push({ path: '/run/scope/probedClaims', message: 'every probed claim must have been requested' });
+    }
     return errors;
   },
 

{testguard_cli-0.9.4 → testguard_cli-0.10.1}/spec/schemas/status.schema.json

@@ -102,6 +102,130 @@
     "provisional": {
       "type": "boolean"
     },
+    "surface": {
+      "description": "The current claim denominator. A source module is a non-test file with a supported source extension that is not covered by the documented default exclusions. Churn is bounded recent git history and remains separate from path-risk signals; neither is collapsed into a score.",
+      "type": "object",
+      "required": ["sourceModules", "claimedModules", "unclaimedModules", "history", "highChurn", "rankedUnclaimed"],
+      "properties": {
+        "sourceModules": { "type": "integer", "minimum": 0 },
+        "claimedModules": { "type": "integer", "minimum": 0 },
+        "unclaimedModules": { "type": "integer", "minimum": 0 },
+        "history": {
+          "type": "object",
+          "required": ["available", "maxCommits", "commitsRead"],
+          "properties": {
+            "available": { "type": "boolean" },
+            "maxCommits": { "type": "integer", "minimum": 1 },
+            "commitsRead": { "type": "integer", "minimum": 0 }
+          },
+          "additionalProperties": false
+        },
+        "highChurn": {
+          "description": "How many of the up-to-20 most changed source modules carry a claim.",
+          "type": "object",
+          "required": ["modules", "claimed"],
+          "properties": {
+            "modules": { "type": "integer", "minimum": 0, "maximum": 20 },
+            "claimed": { "type": "integer", "minimum": 0, "maximum": 20 }
+          },
+          "additionalProperties": false
+        },
+        "rankedUnclaimed": {
+          "description": "Up to ten concrete unclaimed modules, ordered by changes in the bounded history window; path-risk signals break ties and are reported explicitly.",
+          "type": "array",
+          "maxItems": 10,
+          "items": {
+            "type": "object",
+            "required": ["file", "changes", "riskSignals"],
+            "properties": {
+              "file": { "$ref": "urn:claimspec:v1:common#/$defs/repoPath" },
+              "changes": { "type": "integer", "minimum": 0 },
+              "riskSignals": {
+                "type": "array",
+                "uniqueItems": true,
+                "items": { "enum": ["security", "money"] }
+              }
+            },
+            "additionalProperties": false
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "run": {
+      "description": "Present on probe --json: the validated status document plus the completed invocation's result. scope is present only for a partial --claim run.",
+      "type": "object",
+      "required": ["id", "evidence", "provisional", "records", "newSinceBaseline", "exitCode"],
+      "properties": {
+        "id": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "evidence": { "type": "string", "minLength": 1, "maxLength": 4096 },
+        "provisional": { "type": "boolean" },
+        "records": { "type": "integer", "minimum": 0 },
+        "newSinceBaseline": { "type": "integer", "minimum": 0 },
+        "exitCode": { "enum": [0, 1] },
+        "scope": {
+          "type": "object",
+          "required": ["requestedClaims", "requestedCount", "probedClaims", "probedCount"],
+          "properties": {
+            "requestedClaims": {
+              "type": "array",
+              "minItems": 1,
+              "uniqueItems": true,
+              "items": { "$ref": "urn:claimspec:v1:common#/$defs/identifier" }
+            },
+            "requestedCount": { "type": "integer", "minimum": 1 },
+            "probedClaims": {
+              "type": "array",
+              "uniqueItems": true,
+              "items": { "$ref": "urn:claimspec:v1:common#/$defs/identifier" }
+            },
+            "probedCount": { "type": "integer", "minimum": 0 }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    "cost": {
+      "description": "Present when probe --json --cost is requested; derived only from the runs in the emitted evidence.",
+      "type": "object",
+      "required": ["totalMs", "totalRuns", "reusedRecords", "records", "claims", "defenders", "sharedDefenders"],
+      "properties": {
+        "totalMs": { "type": "number", "minimum": 0 },
+        "totalRuns": { "type": "integer", "minimum": 0 },
+        "reusedRecords": { "type": "integer", "minimum": 0 },
+        "records": { "type": "integer", "minimum": 0 },
+        "claims": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["claimId", "ms", "runs", "faults", "reused", "defenders"],
+            "properties": {
+              "claimId": { "$ref": "urn:claimspec:v1:common#/$defs/identifier" },
+              "ms": { "type": "number", "minimum": 0 },
+              "runs": { "type": "integer", "minimum": 0 },
+              "faults": { "type": "integer", "minimum": 0 },
+              "reused": { "type": "integer", "minimum": 0 },
+              "defenders": {
+                "type": "array",
+                "uniqueItems": true,
+                "items": { "$ref": "urn:claimspec:v1:common#/$defs/repoPath" }
+              }
+            },
+            "additionalProperties": false
+          }
+        },
+        "defenders": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/costDefender" }
+        },
+        "sharedDefenders": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/costDefender" }
+        }
+      },
+      "additionalProperties": false
+    },
     "counts": {
       "type": "object",
       "required": [
@@ -349,5 +473,23 @@
       "$ref": "urn:claimspec:v1:common#/$defs/gitSha"
     }
   },
-  "additionalProperties": false
+  "additionalProperties": false,
+  "$defs": {
+    "costDefender": {
+      "type": "object",
+      "required": ["file", "ms", "runs", "claims"],
+      "properties": {
+        "file": { "$ref": "urn:claimspec:v1:common#/$defs/repoPath" },
+        "ms": { "type": "number", "minimum": 0 },
+        "runs": { "type": "integer", "minimum": 0 },
+        "claims": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "$ref": "urn:claimspec:v1:common#/$defs/identifier" }
+        }
+      },
+      "additionalProperties": false
+    }
+  }
 }

{testguard_cli-0.9.4 → testguard_cli-0.10.1}/src/brief/brief.mjs

@@ -1,5 +1,5 @@
 import { gate } from '../baseline/baseline.mjs';
-import { summarize, formatVerdict } from '../render.mjs';
+import { coAuthorshipWarning, summarize, formatVerdict } from '../render.mjs';
 
 export const HEADING = '## TEST BLINDSPOT CONTEXT';
 /** First line of every markdown brief, so a poster can find and update its own note instead of adding another. */
@@ -98,7 +98,7 @@ export function renderBriefText(brief, { hasBaseline, total, independence }) {
   }
   // L3: a kill written in the same change as the code it guards is not
   // independent evidence. One line, no per-item noise.
-  if (independence?.coAuthored) lines.push('', `${independence.coAuthored} of ${independence.kills} kills are co-authored with the code they defend — the test and the code were written in the same change, so those kills are not independent evidence.`);
+  if (independence?.coAuthored) lines.push('', coAuthorshipWarning(independence.coAuthored, independence.kills));
   if (brief.next) lines.push('', `NEXT [${brief.next.action}]: ${brief.next.command}`, `  why: ${brief.next.why}`);
   if (brief.items.length === 0) {
     lines.push('', 'Every probed claim is defended. Keep it that way: new claims need a fault and a test that fails on it.');