* feat(#1950): broken-windows ledger — cross-phase defect register gating ship Adds a new capability (#1950) that operationalizes GSD's no-defer discipline as a tracked, enforced artifact: accumulates stubs, TODOs, skipped tests, unrun verifies, and unmet truths across phases, and /gsd-ship blocks while any entry is open. Implementation: - src/broken-windows.cts → gsd-core/bin/lib/broken-windows.cjs: typed IR + I/O entry points (parseLedger/renderLedger/appendWindow/markWaived/markFixed + cmdWindowsStatus/Append/Waive/MarkFixed). Frozen REASON enum for typed error assertions. Windows-safe atomic rename with retry on transient EPERM/EBUSY/EACCES. - gsd-tools.cjs: new subcommand (status | append | waive | fixed), wired via routeWindows + HOST_COMMAND_ROUTERS.windows. - capabilities/broken-windows/capability.json: one ship:pre gate with artifact-frontmatter-equals predicate on WINDOWS.md open_count == 0. activationKey windows.enabled (default true) + sibling windows.enforce (default true, separate so tracking can precede enforcement). - gsd-core/workflows/ship.md: capId==broken-windows branch in preflight, sibling to security — reads gsd_run windows status --raw, fails closed on open_count > 0 or unreadable ledger. - agents/gsd-executor.md: extends the existing ## Known Stubs instruction to also append to WINDOWS.md via gsd_run windows append (best-effort, never blocks execution). - agents/gsd-verifier.md: new Step 8b — record unmet truths + human-verify items in WINDOWS.md. - gsd-core/workflows/progress.md: surfaces open + waived counts. - docs/COMMANDS.md + CONTEXT.md glossary entry + docs/INVENTORY.md: document the gate, waiver mechanism, and new module. - tests/broken-windows.test.cjs: pure + CLI behavioral coverage + fast-check roundtrip property; fail-closed on malformed ledger; security boundary on path traversal in --file. Backward-compatible: a project with no .planning/WINDOWS.md reports open_count: 0 and ships cleanly. Disable enforcement per-project with gsd config-set windows.enforce false (tracking continues, gate stays open). * chore(#1950): ratchet size baselines, defer verifier integration - Workflow size baseline: ship.md 25575→27928, progress.md 31789→32632 (broken-windows preflight branch + open-windows surface). - Agent size baseline: gsd-executor.md 46644→47951 (Known Stubs → also appends to WINDOWS.md). gsd-verifier.md unchanged. - LARGE_CAP (49152) preempted the planned verifier integration (gsd-verifier.md was at 49140 pre-PR — 12 bytes of headroom, not the documented 'real headroom'). Verifier integration deferred to a follow-up PR that extracts the VERIFICATION.md template (lines 739-859) to gsd-core/references/ — a pre-existing cap-tightness defect this PR exposed but does not expand scope to fix. Verifier integration is not in the issue's acceptance criteria (executor writes is; unmet-truths recording was an enhancement, not a gate). * fix(#1950): gate default-off, rename to workflow.windows_enforce, regen goldens Test-failure-driven fixes after first gsd-test run on db8733c8f failed 44 cases (pre-existing structural tests encoded 'ship:pre has 1 gate' / 'all caps off → empty hooks'): - capability manifest: rename windows.enabled+windows.enforce (default true) → single federated key workflow.windows_enforce (default FALSE, opt-in). Matches security's workflow.security_enforce convention and makes the adr857 all-caps-off test pass without modification (the test's buildAllFalseConfig handles workflow.* out of the box). Default-OFF keeps the gate out of the registry's default ship:pre resolution so existing loop-hooks-ship-pre-e2e structural assertions (exactly 1 gate, capId 'security') stay valid; users opt in via gsd config-set workflow.windows_enforce true. - drop activationKey (security doesn't have one either; workflow.* key doubles as the activation toggle). - regenerate docs/reference/capability-matrix.md to include broken-windows (capability-matrix-sync test). - regenerate tests/fixtures/golden-install-parity/*.json (18 runtimes) — installer now emits the new capability + lib file. - update CONTEXT.md, docs/COMMANDS.md, docs/FEATURES.md, ship.md, agents/gsd-executor.md to use the new key name and /gsd:colon slash syntax (slash-command-namespace test). - restore accidentally-regressed /gsd:capture in progress.md. Tracking-only by default; enforcement is opt-in. Acceptance criterion '/gsd-ship fails while any ledger entry is open' is met when workflow.windows_enforce=true (test fixture enables it). * test(#1950): update ship:pre structural invariants for 2-gate registry - loop-hooks-ship-pre-e2e: the registry now declares 2 gates at ship:pre (security + broken-windows), regardless of activation. Activation tests above still pin security-only or empty behavior via fixtures; these structural tests pin the REGISTRY shape, which has 2 gates as of #1950. - workflow-size-baseline: ship.md 27928→27945 (workflow.windows_enforce rename added 17 bytes). * fix(#1950): review H1+H2+M1+M2+M3 — fence-injection, EACCES fail-closed, cleanup, strict line, stryker Adversarial isolated review (Step 6.3) found 2 HIGH findings that block the PR and 3 mediums. All addressed: H1 (HIGH): description containing the markdown 3-backtick fence would terminate the ledger's JSON code block early inside JSON.stringify output (JSON doesn't escape backticks), corrupting the file and bricking the next parse. Fix: use a 4-backtick fence (json ... ) which JSON.stringify cannot produce on its own, AND validate that no entry text field contains a 4-backtick run (reject at append time with new WINDOWS_INVALID_TEXT reason code). Locked by a regression test. H2 (HIGH): readLedgerOrNull swallowed ALL fs errors as 'no ledger', silently returning open_count:0 on EACCES/EPERM/EIO. The ship gate would then pass on an unreadable ledger — the precise vector the workflow doc claims is impossible. Fix: only ENOENT returns null; every other fs error propagates as WINDOWS_LEDGER_MALFORMED so the gate blocks and the operator sees a real diagnostic. Locked by a regression test that chmod 000s a ledger with open_count=1 and asserts the result is never a false-green 0. M1: writeLedgerAtomic left an orphaned .tmp file on rename failure. Wrapped renameWithRetry in try/catch with best-effort unlink. M2: validateLine silently coerced 'abc' → NaN → null, hiding type drift. Removed the line === 0 special case (was undocumented) and made the error message match the strict check. Now any non-positive- integer line value throws, including strings. M3: tests/broken-windows.test.cjs (with its fast-check property test) was not in stryker.config.mjs DEFAULT_TEST_CMD — Stryker would mutate src/broken-windows.cts but no test would catch the mutations, producing false surviving-mutant scores. Added to the list. L1 (dead throw e after error()), L7 (line boundary tests, H1/H2 regression tests, 4-backtick CLI test) also addressed. * docs(#1950): inline concurrency + busy-wait notes (review L2+L3) * fix(#1950): regen goldens against latest gsd-tools; correct --line 0 boundary test gsd-test v4 caught two issues: - goldens I regenerated earlier (commit 526682084) predated the L1 routeWindows catch-block cleanup (commit dd844d565). Regenerated via 'npm run gen:golden' against current HEAD so the install parity hash for gsd-tools.cjs matches. - 'append --line boundary' test expected --line 0 to succeed with null entry.line, but the M2 fix correctly rejects 0 (lines are 1-indexed; 0 is not a valid source line). Updated the boundary test to assert --line 0 fails alongside -1 and 'abc'. * chore(#1950): regen goldens after rebase onto next * chore(#1950): quick.md baseline 50699→50993 (correct resolution from next rebase) * chore(changeset): backfill pr:2441 in .changeset/broken-windows-ledger.md * fix(#1950): renderTable escapes backslash before pipe (CodeQL incomplete-sanitization) CodeQL flagged the markdown-table cell escaper: String(s ?? '').replace(/\|/g, '\\|') — it escapes pipe but not backslash first. A description containing '\|' would render as '\\|' which markdown parses as 'literal backslash' + 'cell separator', splitting the column. Fix: escape backslash FIRST (each \ → \\), then pipe (each | → \|). Now a description with '\|' renders as '\\\\|' (literal '\\' + escaped pipe), which markdown renders as a single '\|' inside the cell. The JSON code block (the parse source-of-truth) was already correctly escaped via JSON.stringify; only the display-only table was affected. Locked by a regression test that: 1. Verifies the JSON block reparses with the description intact. 2. Walks the rendered table row counting unescaped pipes — must be exactly 11 (the row separators for 10 cells), proving no in-cell pipe added a split.
129 lines
6.9 KiB
JavaScript
129 lines
6.9 KiB
JavaScript
/**
|
|
* stryker.config.mjs
|
|
*
|
|
* Mutation testing configuration for gsd-core.
|
|
*
|
|
* Test runner: 'command' (built into @stryker-mutator/core)
|
|
* Runs: node --test over the lib test files via the repo's run-tests invocation.
|
|
*
|
|
* Mutate scope: bin/lib/**\/*.cjs, excluding generated files and test files.
|
|
*
|
|
* coverageAnalysis: 'off' — command runner does not support per-mutant coverage
|
|
* thresholds: high=80, low=60, break=50
|
|
* incremental: true — caches results; PR-scoped runs pass --mutate <changed-files>
|
|
*
|
|
* Reports:
|
|
* - html: reports/mutation/mutation.html
|
|
* - clear-text (console)
|
|
* - progress (spinner)
|
|
*
|
|
* NOTE: This is incremental / changed-files-only in CI (--mutate <changed-files>)
|
|
* to stay bounded. Full runs are for local exploration only.
|
|
*/
|
|
|
|
import { createRequire } from 'node:module';
|
|
const _require = createRequire(import.meta.url);
|
|
// resolveMutationBreak: fail-closed resolver for MUTATION_BREAK env var.
|
|
// undefined → 60 (local backstop); set-but-empty or non-numeric → throws.
|
|
const { resolveMutationBreak } = _require('./scripts/mutation-matrix.cjs');
|
|
|
|
// ADR-457: bin/lib/*.cjs are gitignored build artifacts (compiled from
|
|
// src/*.cts by `npm run build:lib`, which the mutation CI job runs via `npm ci`
|
|
// → prepare before Stryker). Stryker mutates the *built* .cjs directly — the
|
|
// command runner runs the tests with NO rebuild, so each mutation to the
|
|
// shipped artifact is seen by the tests. (Mutating src/*.cts instead would
|
|
// force a full tsc rebuild per mutant — far too slow for the 30-min CI budget.)
|
|
// Large/low-coverage modules are excluded (the command's test set does not
|
|
// exercise them, so they would only ever produce survived mutants).
|
|
//
|
|
// KNOWN BLIND SPOT (2026-06 CI audit): this list excludes ~14.2k of ~29.8k
|
|
// lib lines (~48%), including the most central modules (state, core,
|
|
// commands, phase, verify). Mutation results therefore speak only for the
|
|
// well-tested half of the lib. Shrinking the list is deliberate tracked work:
|
|
// bring one module into scope per release by first giving it per-module
|
|
// *.unit.test.cjs / *.property.test.cjs coverage, then deleting its entry —
|
|
// never delete an entry without that coverage (it will only produce survived
|
|
// mutants and trip the break threshold).
|
|
const UNMUTATED = [
|
|
'!gsd-core/bin/lib/command-aliases.cjs',
|
|
'!gsd-core/bin/lib/commands.cjs',
|
|
'!gsd-core/bin/lib/core.cjs',
|
|
'!gsd-core/bin/lib/install-profiles.cjs',
|
|
'!gsd-core/bin/lib/installer-migrations.cjs',
|
|
'!gsd-core/bin/lib/phase.cjs',
|
|
'!gsd-core/bin/lib/profile-output.cjs',
|
|
'!gsd-core/bin/lib/state.cjs',
|
|
'!gsd-core/bin/lib/verify.cjs',
|
|
'!gsd-core/bin/lib/init.cjs',
|
|
'!gsd-core/bin/lib/audit.cjs',
|
|
'!gsd-core/bin/lib/gsd2-import.cjs',
|
|
];
|
|
|
|
// Full test command used by local runs and as the fallback when CI does not
|
|
// inject a per-shard command via MUTATION_TEST_CMD.
|
|
// Keep this list in sync with the tests arrays in scripts/mutation-matrix.cjs COVERED.
|
|
const DEFAULT_TEST_CMD = 'node --test tests/context-utilization.property.test.cjs tests/prompt-budget.property.test.cjs tests/frontmatter.property.test.cjs tests/adr-parser.property.test.cjs tests/config-schema.property.test.cjs tests/adr-parser.test.cjs tests/active-workstream-store.test.cjs tests/active-workstream-store.unit.test.cjs tests/prompt-budget.unit.test.cjs tests/adr-parser.unit.test.cjs tests/frontmatter.unit.test.cjs tests/core-utils.test.cjs tests/broken-windows.test.cjs';
|
|
|
|
/** @type {import('@stryker-mutator/core').PartialStrykerOptions} */
|
|
export default {
|
|
// ── Test runner ──────────────────────────────────────────────────────────────
|
|
testRunner: 'command',
|
|
commandRunner: {
|
|
// Run property + unit tests over lib only (avoids the slow integration
|
|
// suite). NO build step here: Stryker mutates the already-built .cjs and the
|
|
// tests load it directly — adding a build would rebuild over the mutation.
|
|
// In CI each matrix shard injects MUTATION_TEST_CMD with only its own tests.
|
|
command: process.env.MUTATION_TEST_CMD || DEFAULT_TEST_CMD,
|
|
},
|
|
|
|
// ── Files to mutate ──────────────────────────────────────────────────────────
|
|
// The built bin/lib/*.cjs artifacts (ADR-457). CI overrides this with
|
|
// --mutate <changed, covered modules> computed in mutation.yml.
|
|
mutate: [
|
|
'gsd-core/bin/lib/**/*.cjs',
|
|
'!gsd-core/bin/lib/**/*.test.cjs',
|
|
...UNMUTATED,
|
|
],
|
|
|
|
// ── Coverage ─────────────────────────────────────────────────────────────────
|
|
// 'off' is required for the command test runner — it cannot instrument per-mutant.
|
|
coverageAnalysis: 'off',
|
|
|
|
// ── Thresholds ───────────────────────────────────────────────────────────────
|
|
// ADR-456 / issue #1187: CI passes the per-module minScore (from
|
|
// scripts/mutation-matrix.cjs) via the MUTATION_BREAK environment variable.
|
|
// Each CI shard sets MUTATION_BREAK to its module's floor so Stryker enforces
|
|
// the ratchet. Local runs without MUTATION_BREAK fall back to 60 (backstop).
|
|
// Do NOT raise the fallback here; raise individual minScore values in
|
|
// mutation-matrix.cjs instead.
|
|
thresholds: {
|
|
high: 80,
|
|
low: 60,
|
|
break: resolveMutationBreak(process.env.MUTATION_BREAK),
|
|
},
|
|
|
|
// ── Incremental mode ─────────────────────────────────────────────────────────
|
|
// Cache mutation results; re-run only changed mutants on subsequent calls.
|
|
// In CI the workflow computes changed files and passes: stryker run --incremental --mutate <list>
|
|
incremental: true,
|
|
incrementalFile: '.stryker-incremental.json',
|
|
|
|
// ── Reporters ────────────────────────────────────────────────────────────────
|
|
reporters: ['html', 'clear-text', 'progress'],
|
|
htmlReporter: {
|
|
fileName: 'reports/mutation/mutation.html',
|
|
},
|
|
|
|
// ── Temp directory ───────────────────────────────────────────────────────────
|
|
tempDirName: '.stryker-tmp',
|
|
|
|
// ── Ignore patterns ──────────────────────────────────────────────────────────
|
|
ignorePatterns: [
|
|
'node_modules',
|
|
'reports',
|
|
'.stryker-tmp',
|
|
'coverage',
|
|
'hooks/dist',
|
|
],
|
|
};
|