AMT coverage: g4-dotrainsourcev1-hash-fet - #183

Adversarial mutation-test coverage for group g4-dotrainsourcev1-hash-fet (30 behaviours across 6 units), at scanned commit bba50a7.

Method: every behaviour was first probed as one or more exact-string mutants against the PRE-EXISTING suite (attribution pass, no new tests present); survivors then got new tests, or existing tests strengthened in place; everything re-probed until killed — or, for three mutants, shown to be behaviourally equivalent consequences of a filed defect (#173). Adversarial findings were filed as issues labelled audit + adversarial and are linked below; tests pin only behaviour derived from the intent oracles, never buggy output.

Behaviour matrix

Verdict legend: PRE = killed by a pre-existing test (attribution pass), NEW = killed by a test added here, STR = killed by a pre-existing test strengthened in place here, SURVIVES = equivalent mutant, unkillable until the linked issue is resolved.

DotrainSourceV1 (crates/cli/src/meta/types/dotrain/source_v1.rs)

OrderBuilderStateV1 (crates/cli/src/meta/types/dotrain/order_builder_state_v1.rs)

RaindexSignedContextOracleV1 (crates/cli/src/meta/types/raindex_signed_context_oracle/mod.rs)

Common validation newtypes (crates/cli/src/meta/types/common/v1.rs)

OpMeta v1 (crates/cli/src/meta/types/op/v1.rs)

InterpreterCallerMeta v1 (crates/cli/src/meta/types/interpreter_caller/v1.rs)

QA

• Discriminating tests: 27 tests added/strengthened across the five touched files (named per row in the matrix above) - each fails on base, verified by mutation-probe pass 2: 36/39 base-equivalent mutants KILLED with these tests as the named killers (the probe demands red-under-mutation, green-on-baseline)
• Mutations applied: 79 exact-string mutants over the six units; per-mutant line -> mutation -> killing test recorded in the behaviour matrix above (S/O/R/C/P/I ids)
• Oracle: NatSpec/doc comments, the KnownMagic envelope contract, validator/serde attribute intent, and references independent of the implementation - Keccak-256 reference vectors cross-checked with cast keccak, regex semantics cross-checked against the regex crate directly; no expected value mirrors the code under test
• Category check: group g4-dotrainsourcev1-hash-fet owns exactly the 30 listed behaviours across DotrainSourceV1, OrderBuilderStateV1, RaindexSignedContextOracleV1, common v1 newtypes, OpMeta v1, InterpreterCallerMeta v1; all 30 probed (three sub-behaviours unpinnable pending BitIntegerRange/OperandArgRange/Output validation drops all sub-validation errors (ValidationErrors::merge_all misuse) #173, recorded above); no behaviour outside the slice touched

Probe tool: nix run github:rainlanguage/adversarial-mutation-test#mutation-probe over a 79-mutant exact-string mutants file (kept outside the repo, never committed); suite command nix develop -c cargo test -p rain-metadata; pass/fail proof read from cargo's own tally; killers attributed from cargo's FAILED lines.

• Pass 1 — attribution, with NO tests from this PR present: baseline green (131 passed). 79/79 mutants probed: 40 KILLED by named pre-existing tests, 39 SURVIVED, 0 NO-RUN, 0 harness errors. (The run was split across two invocations after an external kill mid-run; the one file left mutated was restored byte-exact from git before resuming, and the resumed invocation re-verified a green baseline first.)
• Pass 2 — verification, with this PR's tests: baseline green (160 passed). All 39 pass-1 survivors re-probed: 36/39 KILLED — every kill by a test added or strengthened here (named in the matrix). The 3 survivors are exactly P03/P06/P07: mutants behaviourally equivalent under the confirmed merge_all defect (BitIntegerRange/OperandArgRange/Output validation drops all sub-validation errors (ValidationErrors::merge_all misuse) #173) — the sub-validation results they delete are dropped by the current code anyway, so no discriminating test can exist until BitIntegerRange/OperandArgRange/Output validation drops all sub-validation errors (ValidationErrors::merge_all misuse) #173 is resolved. 0 NO-RUN, 0 harness errors.
• Tests written for this PR that failed on the UNMUTATED baseline were treated as findings, never adjusted to match buggy output: they surfaced BitIntegerRange/OperandArgRange/Output validation drops all sub-validation errors (ValidationErrors::merge_all misuse) #173 (the rejection asserts were removed and replaced with NOTE comments pointing at the issue), and one wrong keccak constant in a test vector of mine (corrected against an independent cast keccak computation).

Issues filed from the adversarial pass (all carrying audit + adversarial): #155, #158, #159, #162, #165, #167, #171, #173.

Deliberately not pinned by tests:

• The two dead Ok(None) branches in fetch_by_subject (metabytes.is_empty(), decoded_items.is_empty()) are unreachable: the subgraph client maps empty result sets to Err(Empty), and cbor_decode rejects zero-item data as CorruptMeta. The guard direction is pinned (S03); the dead bodies cannot be.
• Rejection of out-of-bounds range ends in BitIntegerRange / sub-validation in Output — blocked on BitIntegerRange/OperandArgRange/Output validation drops all sub-validation errors (ValidationErrors::merge_all misuse) #173 (pinning the current Ok would encode the bug).

🤖 Generated with Claude Code