Adversarial mutation-test coverage for group g6-cli-plumbing-output-enco (30 behaviours across the CLI plumbing/dispatch, error enum, rain-metaboard-subgraph client, bindings crate, and the LibMeta / LibIMetaBoardV1_2 / LibDescribedByMeta Solidity units), at scanned commit bba50a7.

Probe tool: nix run github:rainlanguage/adversarial-mutation-test#mutation-probe over exact-string mutants; suites are the CI ground truth (nix develop -c cargo test, nix develop -c forge test). Mutants files were never committed. All kills below are proven by the probe with named killer tests; PREEXISTING kills were attributed in a first pass run before any new test was written.

Pre-existing test defect fixed (baseline)

Adding the magic literal hex"ff0a89c674ee7874" to a test file seeded forge's fuzz dictionary and immediately falsified three pre-existing fuzz oracles on UNMUTATED code (counterexample data = 0xff0a89c674ee7874): testIsRainMetaV1_2Fuzz, testCheckMetaUnhashedV1_2Fuzz and testCheckMetaHashedV1_2BadMagicGoodHash all asserted that raw fuzz data is never rain meta, which is wrong by spec whenever the data itself begins with the magic. The library is correct; the oracles are fixed in place to branch on the prefix (no assertion was weakened — the magic-prefixed branch now asserts the spec-correct expectation instead of a false one). Filed as #184.

Behaviour matrix

QA

• Discriminating tests: cli_dispatch.rs (test_dispatch_schema_ls/_schema_show/_validate/_schema_check/_magic_ls/_build/_solc_artifact/_subgraph/_generate), error::tests (test_display_fixed_strings, test_display_formatted_wrappers, test_display_invalid_meta_magic_field_order, test_from_serde_json_routes_to_serde_json_error, test_from_utf8_error_routes_to_utf8_error, test_from_from_utf8_error_routes_to_from_utf8_error), metaboard_client::tests (graphql_error, null_data_is_request_decode_error, connection_error_is_request, invalid_hex_meta x2, invalid_address, plus strengthened success/empty pins), testIsRainMetaV1_2LengthSevenMagicByteBeyond, testIsRainMetaV1_2MagicNumberLiteral — each proven to fail on base by the mutation probe: every one is the named killer of at least one mutant that SURVIVED the pre-change suite in the attribution pass (probe verdict lines below), and all are green on the unmutated branch (cargo 158 passed, forge 18 passed).

• Oracle: expected values derived independently of the implementation — the metadata-v1 spec magic literal 0xff0a89c674ee7874 (cross-pinned against crates/cli/src/meta/magic.rs), the subgraph GraphQL schema for wire-shape pins (where: {metaHash: …}, first/skip; rendering verified against cynic output, not against the client code), process-level observables of the compiled binary (exit codes, exact stdout lines), and EVM event/ABI semantics for the Solidity units; Display strings are the user-facing contract pinned verbatim.

• Category check: AMT run for group g6-cli-plumbing-output-enco — behaviours asked: cli dispatch 8 arms; error Display+From; metaboard CynicClient+client paths+fragments+build.rs; bindings codegen (excluded by design); LibMeta isRainMetaV1/checkMetaUnhashedV1/checkMetaHashedV1; LibIMetaBoardV1_2.emitMeta; LibDescribedByMeta external fetch. All covered in the matrix above; the two UNPROBED rows (compile-time build.rs, codegen-only bindings, emit-context emitter) carry their justification inline.

• Mutations applied: full mutant list in the matrix above (file → exact-string mutation → killing test). Attribution pass (no new tests present, commit bba50a7 pristine): 24 Solidity mutants → 22 KILLED by named pre-existing tests, 2 SURVIVED (S02, S07). 29 Rust mutants → 4 KILLED by pre-existing tests (E4, MB01, MB06, MB09), 25 SURVIVED. Probe outputs: batches over mutation-probe <mutants>.toml --only …, JSON reports retained in the run scratchpad.

• Final pass (this branch, full suites cargo test = 158 passed / forge test = 18 passed as baseline): all 24 Solidity mutants KILLED; 28/29 Rust mutants KILLED; MB03 SURVIVED and is recorded as an equivalent mutant — the mutated arm is dead code (cynic's GraphQlResponse deserializer rejects bodies without data or errors, so data: None with no errors is unrepresentable). Filed as CynicClientError::Empty is unreachable from CynicClient::query: missing/null data surfaces as a Request decode error #178 with a pinning test for the actual observable.

• No NO-RUN, no HARNESS-ERROR in the final pass.

Second verification pass (independent mutant derivation)

A fresh session re-derived the mutant set from the behaviour list without reusing the first pass's mutants file (28 Solidity + 42 Rust exact-string mutants) and ran the probe twice: an attribution pass on pristine bba50a7 (Solidity lane: 26/28 killed by named pre-existing tests; the two survivors — length-guard removal and the magic constant literal — are exactly the gaps the first pass's testIsRainMetaV1_2LengthSevenMagicByteBeyond / testIsRainMetaV1_2MagicNumberLiteral were written for), then a full pass against this branch.

Branch results: Solidity 28/28 KILLED. Rust 36/42 KILLED, 1 survivor is the documented equivalent (data: None dead arm, #178), and 5 survivors were real residual gaps in unit-note targets the first pass had not discriminated:

All five were killed by strengthening the existing dispatch tests in place; the second-pass re-probe with --only over these five reports all KILLED, and the full cli_dispatch suite is green on the unmutated branch.

Issues filed (audit + adversarial)

#177, #178, #179, #180, #181, #182, #184.

🤖 Generated with Claude Code