mutations.toml

# Costly safety and wire guards, generated by ckdev-mutate prove (0.8.0).
# The pinned runner's default build/test deadlines stop hangs; they are not
# performance budgets. Set budgets only after measuring on clean CI runners.
# With --broad, these quota-module rows also run the skeleton_e2e tests, which
# spawn the built ck-insula binary:
#   route-identity-module-id, route-identity-launch-nonce, wire-list-scoped-type,
#   manifest-trust-tier, manifest-bindings-absent, manifest-consumes-vault,
#   manifest-provides-routed, manifest-self-signals-mutator.
# Without rebuilding ck-insula after a source edit, those tests would exercise
# an old binary instead of the mutant. The prebuild command below refreshes it:
#   cargo build -p quota-module --bins --locked
# ckdev-mutate runs it before baselines, after mutant builds and on restoration.
prebuild = [
  { name = "module-fixture", command = ["cargo", "build", "-p", "quota-module", "--bins", "--locked"] },
]


[[control]]
id = "codex-unknown-sibling"
guards = "Unknown enumerated siblings withhold exhaustion, including the real Codex provider and registry refresh path"
file = "crates/quota-core/src/codex_resets.rs"
old = "let unknown_sibling = self.unknown_sibling(account_id, coordinator_started);"
new = "let unknown_sibling: Option<String> = None; // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/tests.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["tests::restart_unknown_sibling_then_roomy_sibling_never_consumes", "tests::real_codex_restart_waits_for_delayed_sibling_then_consumes_latest_wall_lift"]
expect_message = "/restart must not spend before (the enumerated )?sibling is read/"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "codex-expiry-ungated"
guards = "Expiry still spends a credit before it lapses when a sibling is unknown"
file = "crates/quota-core/src/codex_resets.rs"
old = "let expiry_trigger = input.any_used_floor"
new = "let expiry_trigger = !input.exhaustion_deferred && input.any_used_floor // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/tests.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["tests::expiry_consumes_even_while_sibling_is_unknown"]
expect_message = "expiry must remain ungated by unknown siblings"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "codex-durable-spend-bound"
guards = "The thirty-minute same-account bound outlives the provider floor on scheduled and real Codex lanes"
file = "crates/quota-core/src/codex_resets.rs"
old = "now.signed_duration_since(latest).num_seconds() < SPEND_BOUND_SECS"
new = "now.signed_duration_since(latest).num_seconds() < 0 /* NON-VACUITY BREAK */"
edits = []
test_file = "crates/quota-core/src/tests.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["tests::registry_scheduler_two_codex_units_same_account_send_one_consume_post", "tests::i9_real_codex_provider_two_units_same_account_send_one_consume_post"]
expect_message = "/the thirty-minute bound must outlive the provider floor on (real|scheduled) Codex lanes/"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "codex-provider-floor"
guards = "The ten-minute floor survives restart independently of exhaustion policy"
file = "crates/quota-core/src/codex_resets.rs"
old = "now.signed_duration_since(at).num_seconds() < PROVIDER_REDEMPTION_FLOOR_SECS;"
new = "now.signed_duration_since(at).num_seconds() < 0; // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/tests.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["tests::the_provider_floor_survives_a_restart_and_names_the_last_redemption"]
expect_message = "after a restart B redeemed inside the provider-wide floor"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "codex-cross-account-fence"
guards = "A restart does not reopen another account exhaustion spend inside the durable cross-account bound"
file = "crates/quota-core/src/codex_resets.rs"
old = "if now.signed_duration_since(at).num_seconds() < CROSS_ACCOUNT_BOUND_SECS {"
new = "if false { // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/tests.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["tests::the_cross_account_bound_survives_a_restart"]
expect_message = "after a restart B redeemed while A's redemption was still inside the bound"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "codex-latest-wall-lift"
guards = "Only the account whose natural wall lifts latest should spend a banked reset"
file = "crates/quota-core/src/codex_resets.rs"
old = "(Some(left_lift), Some(right_lift)) => right_lift.cmp(&left_lift),"
new = "(Some(left_lift), Some(right_lift)) => left_lift.cmp(&right_lift), // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/tests.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["tests::real_codex_restart_waits_for_delayed_sibling_then_consumes_latest_wall_lift"]
expect_message = "/fresh wall readings from both registered handles must allow exhaustion|B's natural reset is later, so only B should spend its credit/"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "codex-wall-is-reported-limit"
guards = "A usage percent near 100 never puts a Codex account at its wall; only a reported limit_reached spends a banked reset"
file = "crates/quota-core/src/codex_resets.rs"
old = "let at_wall = limit_reached == Some(true);"
new = "let at_wall = limit_reached == Some(true) || raw_percents.iter().any(|percent| *percent >= RELAX_CEILING_PERCENT); // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/tests.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["tests::an_account_near_its_limit_without_a_reported_limit_keeps_its_reset", "tests::real_codex_account_spends_its_reset_only_once_its_limit_is_reported"]
expect_message = "/whose limit is not reported as reached must keep its banked reset|a banked reset is spent only once the limit is reported/"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "codex-sibling-room-is-reported-limit"
guards = "A sibling has room unless its fresh reading reports limit_reached, whatever its percent"
file = "crates/quota-core/src/codex_resets.rs"
old = """
                    at_wall: facts.at_wall,
                    wall_lifts_at: facts.wall_lifts_at,"""
new = """
                    at_wall: facts.raw_percents.iter().any(|percent| *percent >= RELAX_CEILING_PERCENT), // NON-VACUITY BREAK
                    wall_lifts_at: facts.wall_lifts_at,"""
edits = []
test_file = "crates/quota-core/src/tests.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["tests::a_sibling_near_its_limit_without_a_reported_limit_still_has_room", "tests::a_sibling_with_an_absent_limit_reached_counts_as_room"]
expect_message = "/whose limit is not reported as reached has room|does not state limit_reached may have room/"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "codex-absent-limit-is-not-the-wall"
guards = "A usage response without limit_reached is not at its wall, and such a sibling counts as room"
file = "crates/quota-core/src/codex_resets.rs"
old = "let at_wall = limit_reached == Some(true);"
new = "let at_wall = limit_reached != Some(false); // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/tests.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["tests::an_absent_limit_reached_is_not_the_wall", "tests::a_sibling_with_an_absent_limit_reached_counts_as_room", "tests::real_codex_account_spends_its_reset_only_once_its_limit_is_reported"]
expect_message = "/does not state limit_reached (is not at its wall|may have room)|a banked reset is spent only once the limit is reported/"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "codex-relax-ceiling-percent"
guards = "A window at 99% or more is never relaxed to zero even when the upstream reports the limit not reached"
file = "crates/quota-core/src/codex_resets.rs"
old = ".all(|percent| *percent < RELAX_CEILING_PERCENT)"
new = ".all(|percent| *percent < 1000.0) // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/codex_resets.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["codex_resets::tests::a_window_at_its_limit_blocks_relaxation_even_when_the_upstream_reports_clear"]
expect_message = "a spent window must block relaxation even when the upstream reports clear"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "codex-pending-never-pruned"
guards = "A pending journal record retains the original retry request id regardless of age"
file = "crates/quota-core/src/codex_resets.rs"
old = "if record.status == JournalStatus::Resolved && age > RESOLVED_RETENTION_SECS {"
new = "if age > RESOLVED_RETENTION_SECS { // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/codex_resets.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["codex_resets::tests::a_pending_record_survives_the_resolved_retention_horizon"]
expect_message = "an unconfirmed redemption must keep its request id past the retention"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "codex-adoption-unreadable-fails-closed"
guards = "Adoption must not overwrite an unreadable authoritative journal or delete its legacy pending records"
file = "crates/quota-core/src/codex_resets.rs"
old = '''
let current = self.load().map_err(|error| {
            JournalError::new(format!(
                "{} exists and {} could not be read ({error}), so adoption was refused \
                 rather than risk overwriting records that may still be pending",
                legacy.display(),
                self.path.display()
            ))
        })?;'''
new = "let current = self.load().unwrap_or_default(); // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/codex_resets.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["codex_resets::tests::an_unreadable_current_journal_refuses_adoption_rather_than_being_overwritten"]
expect_message = "an unreadable current journal must refuse adoption"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "vault-auth-report-only-401"
guards = "HTTP 403 entitlement refusals must not invalidate healthy vault credentials"
file = "crates/quota-core/src/credential_source.rs"
old = "FetchError::ProviderStatus(status @ 401, _) = error else {"
new = "FetchError::ProviderStatus(status @ (401 | 403), _) = error else { // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/credential_source.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["credential_source::tests::a_403_is_not_reported_because_it_can_mean_a_live_credential"]
expect_message = "a 403 can be an entitlement refusal against a live credential"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "cookie-auth-fence-planted-call"
guards = "The cookie-provider source fence must recognize a planted forbidden auth-failure report"
file = "crates/quota-core/src/tests.rs"
old = 'production_body(source).contains("report_auth_failure")'
new = 'production_body(source).contains("never_a_report_call") // NON-VACUITY BREAK'
edits = []
test_file = "crates/quota-core/src/tests.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["tests::no_cookie_provider_reports_an_auth_failure_to_the_vault"]
expect_message = "the cookie fence must flag a planted auth-failure call"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "route-identity-module-id"
guards = "route.open consumer identity uses the daemon wire key module_id rather than silently demoting to Direct"
file = "crates/quota-module/src/vault_client.rs"
old = '"module_id": module_id,'
new = '"module_id_typo": module_id, // NON-VACUITY BREAK'
edits = []
test_file = "crates/quota-module/src/vault_client.rs"
runner = "cargo"
package = "quota-module"
target = "--lib"
expect_red = ["vault_client::tests::consumer_identity_fields_match_the_daemons_wire_names"]
expect_message = "route.open must emit module_id"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "route-identity-launch-nonce"
guards = "route.open consumer identity uses the daemon wire key launch_nonce rather than silently demoting to Direct"
file = "crates/quota-module/src/vault_client.rs"
old = '"launch_nonce": launch_nonce,'
new = '"launch_nonce_typo": launch_nonce, // NON-VACUITY BREAK'
edits = []
test_file = "crates/quota-module/src/vault_client.rs"
runner = "cargo"
package = "quota-module"
target = "--lib"
expect_red = ["vault_client::tests::consumer_identity_fields_match_the_daemons_wire_names"]
expect_message = "route.open must emit launch_nonce"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "c1-unobserved-success"
guards = "Unattributable successful fetches must not inherit the previous account or authorize its replacement"
file = "crates/quota-core/src/refresh.rs"
old = "let cannot_confirm_this_reading = prev.label_in_flux || prev.observation.is_some();"
new = "let cannot_confirm_this_reading = prev.label_in_flux; // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/refresh.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["refresh::tests::a_success_that_resolves_no_identity_does_not_inherit_the_previous_one"]
expect_message = "usage from an unidentified fetch must not be published under the"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "c1-antigravity-known-paid-unmatched"
guards = "A credential that cannot match a known paid account must not publish the standard-tier pool"
file = "crates/quota-core/src/antigravity.rs"
old = """
plugin_account.is_none()
        && accounts
            .iter()
            .any(|account| account_holds_paid_tier(Some(account)))"""
new = "false // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/antigravity.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["antigravity::plugin_lane_tests::an_unidentifiable_credential_withholds_only_when_a_paid_account_is_known"]
expect_message = "an unidentifiable credential beside a known paid account must withhold"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "c1-vault-unanswered-withholds"
guards = "An unanswered vault is unfinished, not an authoritative empty account inventory permitting Claude collapse"
file = "crates/quota-core/src/vault_handles.rs"
old = """
VaultHandleState::Awaiting => Err(HandlesError::new(
                "credential vault has not answered an enumeration yet",
            )),"""
new = "VaultHandleState::Awaiting => Ok(Vec::new()), // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/tests.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["tests::a_cold_start_whose_first_list_fails_publishes_no_local_fallback"]
expect_message = "an unanswered vault must leave the provider unfinished, not serve its local lane"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "c1-local-source-unreadable"
guards = "A source that could not be read is local_source_unavailable, never credential_absent"
file = "crates/quota-core/src/antigravity.rs"
old = 'FetchError::LocalSourceUnavailable(format!("could not {what}: {error}"))'
new = 'FetchError::NoSession(format!("could not {what}: {error}")) // NON-VACUITY BREAK'
edits = []
test_file = "crates/quota-core/src/antigravity.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["antigravity::plugin_lane_tests::a_scan_that_could_not_look_is_never_reported_as_no_server_running"]
expect_message = "expected LocalSourceUnavailable"
only = false
platforms = ["linux", "macos"]
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "wire-account-info-missing-key"
guards = "The populated AccountInfo serialization specimen must emit exactly the pinned key set, including email"
file = "crates/quota-core/src/model.rs"
old = 'email: Some("a@example.test".into()),'
new = "email: None, // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/model.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["model::tests::the_account_info_key_set_is_closed"]
expect_message = "accountInfo gained or lost a key"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "wire-account-info-extra-key"
guards = "An independently added identifying key in the AccountInfo wire specimen must fail the closed emitted-key pin"
file = "crates/quota-core/src/model.rs"
old = 'let value = serde_json::to_value(&info).expect("serialises");'
new = """
let mut value = serde_json::to_value(&info).expect("serialises");
        value.as_object_mut().unwrap().insert("displayName".into(), "planted-person".into()); // NON-VACUITY BREAK"""
edits = []
test_file = "crates/quota-core/src/model.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["model::tests::the_account_info_key_set_is_closed"]
expect_message = "accountInfo gained or lost a key"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "wire-claude-saved-resets-absent"
guards = "Absent Claude reset inventory must remain absent rather than emit an availableCount zero claim"
file = "crates/quota-core/src/anthropic.rs"
old = "let Some(raw) = raw else { return Ok(None) };"
new = "let Some(raw) = raw else { return Ok(Some(SavedResets { available_count: 0, soonest_expires_at: None, credits: Vec::new() })) }; // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/anthropic.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["anthropic::tests::absent_inventory_publishes_no_saved_resets_not_zero"]
expect_message = "assertion failed: attempt.saved_resets.is_none()"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "wire-list-scoped-type"
hub = "The producer's list_scoped credential type key must decode both the golden reply and scoped inventory served through the real module binary; rejecting it withholds every vault-backed account."
hub_targets = ["it"]
guards = "The real list_scoped decoder reads type from the producer golden reply, never a hand-fixture kind key"
file = "crates/quota-module/src/vault_client.rs"
old = """
#[serde(rename = "type")]
    kind: String,"""
new = """
#[serde(rename = "kind")] // mutant: decode the credential type from "kind", which the vault never sends
    kind: String,"""
edits = []
test_file = "crates/quota-module/src/vault_client.rs"
runner = "cargo"
package = "quota-module"
target = "--lib"
expect_red = ["vault_client::drop_counter_tests::the_producers_own_golden_reply_decodes"]
expect_message = "the producer's golden reply must decode through the real decoder"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "wire-sibling-fold-0"
guards = "Sibling quota-drop observations must fold to one event"
file = "crates/quota-core/src/store.rs"
old = "const SIBLING_FOLD_SECS: i64 = 60;"
new = "const SIBLING_FOLD_SECS: i64 = 0; // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/store.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["store::tests::the_fold_window_folds_siblings_and_spares_a_later_reset"]
expect_message = "siblings fold"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "wire-sibling-fold-3600"
guards = "Real quota drops outside the sibling window must not be swallowed"
file = "crates/quota-core/src/store.rs"
old = "const SIBLING_FOLD_SECS: i64 = 60;"
new = "const SIBLING_FOLD_SECS: i64 = 3600; // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/store.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["store::tests::the_fold_window_folds_siblings_and_spares_a_later_reset"]
expect_message = "a decrease past the window is a new reset and must survive"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "manifest-trust-tier"
guards = "The module manifest retains its true FirstParty trust tier across optional-builder migrations"
file = "crates/quota-module/src/main.rs"
old = ".trust_tier(Some(TrustTier::FirstParty))"
new = ".trust_tier(None) // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-module/src/main.rs"
runner = "cargo"
package = "quota-module"
target = "--bin ck-insula"
expect_red = ["tests::manifest_states_a_true_trust_tier_and_no_storage_it_does_not_own"]
expect_message = "this module ships in the CortexKit fleet"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "manifest-bindings-absent"
guards = "The module must not fabricate ownership of a SQLite store in its manifest"
file = "crates/quota-module/src/main.rs"
old = ".protocol_ver(PROTOCOL_VERSION)"
new = """
.protocol_ver(PROTOCOL_VERSION)
        .bindings(Some(subc_protocol::manifest::Bindings {
            storage: subc_protocol::manifest::StorageBinding { kind: subc_protocol::manifest::StorageKind::Sqlite, scope: subc_protocol::manifest::StorageScope::Project, owns_schema: true },
            vault_grants: Vec::new(),
            identity: subc_protocol::manifest::IdentityBinding { requires: Vec::new(), optional: Vec::new() },
        })) // NON-VACUITY BREAK"""
edits = []
test_file = "crates/quota-module/src/main.rs"
runner = "cargo"
package = "quota-module"
target = "--bin ck-insula"
expect_red = ["tests::manifest_states_a_true_trust_tier_and_no_storage_it_does_not_own"]
expect_message = "insula owns no SQLite database"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "manifest-consumes-vault"
guards = "The manifest must declare the credential vault its production client actually dials"
file = "crates/quota-module/src/main.rs"
old = """
.consumes(vec![ConsumerRole::ServiceClient {
        of: vec![ids::CREDENTIALS_MODULE_ID.to_string()],
    }])"""
new = ".consumes(Vec::new()) // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-module/src/main.rs"
runner = "cargo"
package = "quota-module"
target = "--bin ck-insula"
expect_red = ["tests::manifest_declares_the_credential_vault_it_actually_dials"]
expect_message = "this module calls credential.get on the vault"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "manifest-provides-routed"
guards = "Every advertised management operation must be one the production router answers"
file = "crates/quota-module/src/main.rs"
old = "name: USAGE_DROPS_OP.to_string(),"
new = 'name: "usage.not-routed".to_string(), // NON-VACUITY BREAK'
edits = []
test_file = "crates/quota-module/src/main.rs"
runner = "cargo"
package = "quota-module"
target = "--bin ck-insula"
expect_red = ["tests::every_advertised_operation_is_one_the_router_answers"]
expect_message = "the manifest advertises what catalog.list shows a consumer"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "manifest-self-signals-mutator"
guards = "Spending a Codex banked reset must be declared as mutation rather than observation"
file = "crates/quota-module/src/main.rs"
old = """
name: "codex_banked_reset_consume".to_string(),
            kind: SelfSignalKind::Other("mutation".to_string()),
            effect: SelfSignalEffect::Mutate,"""
new = """
name: "codex_banked_reset_consume".to_string(),
            kind: SelfSignalKind::Other("mutation".to_string()),
            effect: SelfSignalEffect::Observe, // NON-VACUITY BREAK"""
edits = []
test_file = "crates/quota-module/src/main.rs"
runner = "cargo"
package = "quota-module"
target = "--bin ck-insula"
expect_red = ["tests::manifest_declares_every_self_signal_including_the_mutators"]
expect_message = "each mutator must be declared as one"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "scan-launch-nonce-planted-reads"
guards = "The launch-nonce source walk must catch planted direct environment and constant reads"
file = "crates/quota-core/src/tests.rs"
old = "names_a_constant || LITERALS.iter().any(|literal| line.contains(literal))"
new = "false && (names_a_constant || LITERALS.iter().any(|literal| line.contains(literal))) // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/tests.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["tests::the_launch_nonce_matcher_flags_planted_reads_and_nothing_else"]
expect_message = "the matcher misses these planted reads"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "scan-browser-store-planted-reader"
guards = "The source fence must recognize every planted browser-cookie-store reader mark"
file = "crates/quota-core/src/tests.rs"
old = ".filter(|(mark, _)| production.contains(mark))"
new = ".filter(|(mark, _)| false && production.contains(mark)) // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/tests.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["tests::no_production_source_reads_a_browser_cookie_store"]
expect_message = "the fence must flag"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "scan-rust-production-stripping"
guards = "The Rust source walker strips planted test violations but preserves later production items"
file = "crates/quota-core/src/tests.rs"
old = "if opens_test_module {"
new = "if opens_test_module && false { // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/tests.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["tests::the_production_boundary_removes_test_modules"]
expect_message = "planted test code must be stripped"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "scan-path-dependency-containment"
guards = "Outside repository Cargo paths are refused even when the real dependency inventory is clean"
file = "scripts/path-dependencies.py"
old = "return not path.resolve().is_relative_to(root.resolve())"
new = "return False  # NON-VACUITY BREAK"
edits = []
test_file = "scripts/mutation-scan-tests.py"
runner = "command"
command = ["bash", "scripts/mutation-scans.sh", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ["ScanControls.test_path_dependency_planted_violation"]
expect_message = "planted outside dependencies must be refused"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "scan-path-dependency-unused-patches"
guards = "Unused Cargo patch declarations must not evade the repository path dependency fence"
file = "scripts/path-dependencies.py"
old = 'elif section == "patch":'
new = 'elif section == "unused-section":  # NON-VACUITY BREAK'
edits = []
test_file = "scripts/mutation-scan-tests.py"
runner = "command"
command = ["bash", "scripts/mutation-scans.sh", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ["ScanControls.test_path_dependency_planted_violation"]
expect_message = "planted outside dependencies must be refused"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "scan-python-production-stripping"
guards = "The Python source stripper catches planted test leakage and preserves later production"
file = "scripts/prod_body.py"
old = "if TEST_MODULE.match(window):"
new = "if False:  # NON-VACUITY BREAK"
edits = []
test_file = "scripts/mutation-scan-tests.py"
runner = "command"
command = ["bash", "scripts/mutation-scans.sh", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ["ScanControls.test_production_body_planted_violation"]
expect_message = "planted test code must be stripped"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "scan-train-preconditions-self-test"
guards = "The train workflow scanner proves its trigger rule on a planted missing train trigger every pass"
file = "scripts/check-train-preconditions.sh"
old = 'if not any("train/" in str(b) for b in branches):'
new = "if False:  # NON-VACUITY BREAK"
edits = []
test_file = "scripts/mutation-scan-tests.py"
runner = "command"
command = ["bash", "scripts/mutation-scans.sh", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ["ScanControls.test_train_preconditions_planted_violations"]
expect_message = "planted train-trigger drift was reported as clean"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "scan-broad-report-refuses-unreviewed"
guards = "An unreviewed cross-target broad catch must not silently pass the CI report gate"
file = "scripts/mutation-report.py"
old = '"CAUGHT", "HUB", "EQUIVALENT",'
new = """
"CAUGHT", "CAUGHT_BROADLY", "HUB", "EQUIVALENT",  # mutant: accept unreviewed catches from other test targets
"""
edits = []
test_file = "scripts/mutation-scan-tests.py"
runner = "command"
command = ["bash", "scripts/mutation-scans.sh", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ["ScanControls.test_broad_report_planted_violation"]
expect_message = "unreviewed broad catch must be refused"
only = false
timeout_s = 600
build_timeout_s = 1800

[[control]]
id = "refresher-overdue-reauth-sleep"
guards = "An overdue needs_reauth handle cannot spin the refresher; bounded discovery continues without fetching or changing the degraded slot"
file = "crates/quota-core/src/lib.rs"
old = """
            .filter(|(key, _)| {
                !key.handle
                    .vault_credential_id()
                    .is_some_and(|id| latched_ids.contains(id))
            })"""
new = "            .filter(|_| true) // NON-VACUITY BREAK: all slots wake the loop"
edits = []
test_file = "crates/quota-core/src/tests.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["tests::refresh_loop_overdue_needs_reauth_is_bounded_by_discovery_interval"]
expect_message = "an overdue needs_reauth slot must not spin"
only = false
timeout_s = 600
build_timeout_s = 1800

[[control]]
id = "kimi-coding-reset-tolerance"
guards = "Kimi coding ratio pools must not borrow more-exhausted counters from a different reset period"
file = "crates/quota-core/src/kimi_for_coding.rs"
old = "chrono::Duration::seconds(2)"
new = "chrono::Duration::seconds(3600) /* NON-VACUITY BREAK */"
edits = []
test_file = "crates/quota-core/src/kimi_for_coding.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["kimi_for_coding::tests::same_duration_resets_three_seconds_apart_do_not_merge"]
expect_message = "different reset periods must retain the ratio"
only = true
timeout_s = 600
build_timeout_s = 1800

[[control]]
id = "antigravity-consumer-client-placeholder"
guards = "Projectless consumer-client refusals withhold placeholder quota and surface reauthentication before any quota request"
file = "crates/quota-core/src/antigravity.rs"
old = "if code_assist.rejects_client_for_consumer_tier() {"
new = "if false && code_assist.rejects_client_for_consumer_tier() { // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/antigravity.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["antigravity::tests::consumer_client_refusal_rejects_credentials_without_requesting_quota"]
expect_message = "consumer-client refusal must withhold placeholder quota"
only = false
timeout_s = 600
build_timeout_s = 1800

[[control]]
id = "antigravity-consumer-client-current-tier"
guards = "An existing currentTier keeps working accounts serving quota despite a consumer-client ineligible reason"
file = "crates/quota-core/src/antigravity.rs"
old = "self.current_tier.is_none()"
new = "true /* NON-VACUITY BREAK: ignore currentTier */"
edits = []
test_file = "crates/quota-core/src/antigravity.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["antigravity::tests::consumer_client_refusal_with_a_current_tier_still_requests_quota"]
expect_message = "a preflight without an affirmative consumer-client refusal must serve quota"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "claude-subscription-owner"
guards = "A suffix-matched cookie with another authenticated owner must never attach billing dates to the OAuth row"
file = "crates/quota-core/src/claude_subscription.rs"
old = "Owner::new(uuid, Some(email), Some(id)).as_ref() == Some(owner)"
new = "Owner::new(uuid, Some(email), Some(id)).as_ref() == Some(owner) || true /* NON-VACUITY BREAK */"
edits = []
test_file = "crates/quota-core/src/claude_subscription.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["claude_subscription::tests::mismatched_owner_attaches_nothing"]
expect_message = "a mismatched web owner must not attach billing dates"
# Other tests also read this value and fail on the same mutant; the named
# test is the one whose message proves the property.
only = false
timeout_s = 600
build_timeout_s = 1800

[[control]]
id = "jetbrains-junie-parser"
guards = "Junie quota updates supersede older legacy readings after the Air migration"
file = "crates/quota-core/src/jetbrains.rs"
old = "parse_junie_log_quota(line)"
new = "None /* NON-VACUITY BREAK: drop Junie quota updates */"
edits = []
test_file = "crates/quota-core/src/jetbrains.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["jetbrains::tests::a_newer_junie_quota_wins_over_legacy_records"]
only = true
timeout_s = 600
build_timeout_s = 1800

[control.select]
tests = ["jetbrains::tests::a_newer_junie_quota_wins_over_legacy_records", "jetbrains::tests::jbai_quota_and_refill_keep_tariff_and_top_up_separate"]

[[control]]
id = "jetbrains-forbidden-exception-boundary"
guards = "Only the disabled AI Assistant exception is skipped; other forbidden states invalidate older quota"
file = "crates/quota-core/src/jetbrains.rs"
old = "line.contains(DISABLED_ASSISTANT_MARKER)"
new = 'line.contains("ForbiddenException") /* NON-VACUITY BREAK */'
edits = []
test_file = "crates/quota-core/src/jetbrains.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["jetbrains::tests::other_forbidden_exceptions_invalidate_older_quota"]
only = true
timeout_s = 600
build_timeout_s = 1800

[control.select]
tests = ["jetbrains::tests::other_forbidden_exceptions_invalidate_older_quota", "jetbrains::tests::disabled_assistant_errors_do_not_hide_junie_quota"]

[[control]]
id = "claude-subscription-end-precedence"
guards = "A scheduled subscription end suppresses leftover renewal data, including canceled subscriptions"
file = "crates/quota-core/src/claude_subscription.rs"
old = 'let renews = if ends.is_none() && ["active", "trialing"].contains(&status) {'
new = 'let renews = if ["active", "trialing", "canceled"].contains(&status) { // NON-VACUITY BREAK'
edits = []
test_file = "crates/quota-core/src/claude_subscription.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["claude_subscription::tests::canceled_scheduled_end_wins_over_leftover_renewal"]
expect_message = "a scheduled end must suppress a leftover next charge"
# Other tests read the same value and also fail on this mutant; the named
# test is the one whose message proves the property.
only = false
timeout_s = 600
build_timeout_s = 1800

[[control]]
id = "claude-subscription-date-only"
guards = "A full billing date is a day and must not be converted into a midnight timestamp"
file = "crates/quota-core/src/claude_subscription.rs"
old = "Ok(Some(raw.clone()))"
new = 'Ok(Some(format!("{raw}T00:00:00Z"))) // NON-VACUITY BREAK'
edits = []
test_file = "crates/quota-core/src/claude_subscription.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["claude_subscription::tests::date_only_renewal_stays_a_full_date"]
expect_message = "a date-only value must remain a day, not an invented timestamp"
# Other tests read the same value and also fail on this mutant; the named
# test is the one whose message proves the property.
only = false
timeout_s = 600
build_timeout_s = 1800

[[control]]
id = "claude-subscription-failure-isolation"
guards = "An optional billing failure never changes OAuth windows or the Claude row's errorClass"
file = "crates/quota-core/src/claude_subscription.rs"
old = """let Some(dates) = &cached.good else {
            return;
        };"""
new = """let Some(dates) = &cached.good else {
            attempt.usage = Err(crate::provider::FetchError::Unauthorized("billing failed".into())); // NON-VACUITY BREAK
            return;
        };"""
edits = []
test_file = "crates/quota-core/src/claude_subscription.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["claude_subscription::tests::dates_failure_leaves_windows_and_error_class_unchanged"]
expect_message = "a dates failure must never set the Claude row's errorClass"
# Other tests read the same value and also fail on this mutant; the named
# test is the one whose message proves the property.
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "codex-journal-atomic-replace"
guards = "Journal saves atomically replace a destination rather than overwriting a live reader's inode"
file = "crates/quota-core/src/codex_resets.rs"
old = "replace_journal(&temp_path, &self.path).map_err"
new = "fs::write(&self.path, &body) /* NON-VACUITY BREAK */.map_err"
edits = []
test_file = "crates/quota-core/src/codex_resets.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["codex_resets::tests::journal_save_atomically_replaces_the_open_destination"]
expect_message = "atomic replacement must not overwrite the open destination inode"
only = false
platforms = ["linux", "macos"]
timeout_s = 600
build_timeout_s = 1800

[[control]]
id = "codex-journal-sharing-safe-replace"
guards = "A Windows reader denying delete sharing blocks replacement without altering pending records"
file = "crates/quota-core/src/codex_resets.rs"
old = "replace_journal(&temp_path, &self.path).map_err"
new = "fs::write(&self.path, &body) /* NON-VACUITY BREAK */.map_err"
edits = []
test_file = "crates/quota-core/src/codex_resets.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["codex_resets::tests::journal_save_refuses_a_non_delete_sharing_reader_then_recovers"]
expect_message = "persistent sharing denial must fail the save"
only = false
platforms = ["windows"]
timeout_s = 600
build_timeout_s = 1800

[[control]]
id = "codex-journal-state-override"
guards = "An explicit state directory remains authoritative and never migrates default journal records"
file = "crates/quota-core/src/codex_resets.rs"
old = '''if let Some(path) = env
        .var_os("CK_QUOTA_STATE_DIR")
        .filter(|value| !value.is_empty())
    {'''
new = '''if let Some(path) = env
        .var_os("CK_QUOTA_STATE_DIR")
        .filter(|_| false) // NON-VACUITY BREAK
    {'''
edits = []
test_file = "crates/quota-core/src/codex_resets.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["codex_resets::tests::journal_override_is_verbatim_and_never_adopts_default_records"]
expect_message = "CK_QUOTA_STATE_DIR must remain authoritative"
only = false
timeout_s = 600
build_timeout_s = 1800

[[control]]
id = "codex-journal-adoption-full-readback"
guards = "Migration cannot remove its source after a same-count substitution of pending records"
file = "crates/quota-core/src/codex_resets.rs"
old = "if readback == carried {"
new = "if readback.len() == carried.len() { // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/codex_resets.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["codex_resets::tests::adoption_readback_rejects_same_count_different_records"]
expect_message = "same-count substituted records must refuse adoption"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "codex-journal-competing-windows-sources"
guards = "Two distinct old Windows journals cannot silently choose an authoritative source"
file = "crates/quota-core/src/codex_resets.rs"
old = "refuse_competing_legacy_journals(old, profile)?;"
new = "let _ = (old, profile); // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/codex_resets.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["codex_resets::tests::windows_two_distinct_old_journals_refuse_adoption_and_keep_every_file"]
expect_message = "two old journals must not choose an authoritative source"
only = false
timeout_s = 600
build_timeout_s = 1800

[[control]]
id = "antigravity-linux-real-proc-empty"
guards = "Linux local discovery must enumerate the real procfs process table, not silently report no editor"
file = "crates/quota-core/src/antigravity.rs"
old = 'linux_processes(std::path::Path::new("/proc"), deadline)'
new = 'Ok(Vec::new()) // NON-VACUITY BREAK'
edits = []
test_file = "crates/quota-core/src/antigravity.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["antigravity::tests::linux_real_enumerator_sees_own_pid_and_listener"]
expect_message = "real procfs scan must see current test pid"
only = false
platforms = ["linux"]
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "antigravity-sidebar-version"
guards = "Unknown sidebar major versions including v1 require a plugin update"
file = "crates/quota-core/src/antigravity.rs"
old = "if file.version.as_u64() != Some(2) {"
new = "if false { // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/antigravity.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["antigravity::plugin_lane_tests::unsupported_sidebar_versions_require_a_plugin_update"]
expect_message = "only integer major 2 is supported"
only = true
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "antigravity-sidebar-installed-missing"
guards = "An absent sidebar with plugin installation evidence is unavailable, never an empty roster"
file = "crates/quota-core/src/antigravity.rs"
old = '''return Err("Antigravity plugin is installed but its sidebar state is absent; update the plugin and let it publish quota".to_string());'''
new = "return Ok(Vec::new()); // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/antigravity.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["antigravity::plugin_lane_tests::an_absent_sidebar_with_plugin_evidence_is_unavailable_not_empty"]
expect_message = "installed plugin is not an empty roster"
only = true
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "antigravity-sidebar-undated"
guards = "Undated quota groups cannot borrow publication or window clocks to appear current"
file = "crates/quota-core/src/antigravity.rs"
old = """let Some(checked_at) = pool
            .checked_at
            .and_then(DateTime::<Utc>::from_timestamp_millis)
        else {
            continue;
        };"""
new = "let checked_at = pool.checked_at.and_then(DateTime::<Utc>::from_timestamp_millis).unwrap_or(now); // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/antigravity.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["antigravity::plugin_lane_tests::undated_sidebar_groups_are_not_served_even_with_fresh_publication"]
expect_message = "publication and window clocks cannot date a group"
only = true
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "antigravity-sidebar-oldest-observation"
guards = "Sidebar value time is the oldest observation among groups actually served"
file = "crates/quota-core/src/antigravity.rs"
old = "oldest = Some(oldest.map_or(checked_at, |previous| previous.min(checked_at)));"
new = "oldest = Some(oldest.map_or(checked_at, |previous| previous.max(checked_at))); // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/antigravity.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["antigravity::plugin_lane_tests::sidebar_value_time_is_the_oldest_served_group_observation"]
expect_message = "assertion `left == right` failed"
only = true
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "antigravity-sidebar-fraction-precision"
guards = "Used percent preserves source fraction precision, never the rounded display percent"
file = "crates/quota-core/src/antigravity.rs"
old = "let remaining = window.remaining_fraction?;"
new = "let remaining = window.remaining_percent? / 100.0; // NON-VACUITY BREAK"
edits = []
test_file = "crates/quota-core/src/antigravity.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
expect_red = ["antigravity::plugin_lane_tests::sidebar_fraction_precision_is_preserved_not_the_rounded_percent"]
expect_message = "55.149424"
# Other tests also read this value and fail on the same mutant; the named
# test is the one whose message proves the property.
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "claude-console-no-double-count"
guards = "Grant pools exclude the aggregate balance so money is counted once"
file = "crates/quota-core/src/claude_console.rs"
old = "if !has_grants {"
new = "if true /* NON-VACUITY BREAK: double-count aggregate beside grants */ {"
edits = []
test_file = "crates/quota-core/src/claude_console.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
select = "expected"
expect_red = ["claude_console::tests::grants_publish_no_aggregate_pool"]
expect_message = "aggregate must not accompany grants"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "cookie-multihandle-exception-is-console-only"
guards = "Only identity-resolving Console cookies may enumerate multiple usage handles"
file = "crates/quota-core/src/vault_handles.rs"
old = '.filter(|(prefix, _)| *prefix != "cookie:platform.claude.com")'
new = '.filter(|(prefix, _)| !prefix.starts_with("cookie:")) // NON-VACUITY BREAK'
edits = []
test_file = "crates/quota-core/src/claude_console.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
select = "expected"
expect_red = ["claude_console::tests::no_deposit_has_no_lane_and_other_cookie_families_still_refuse_two"]
expect_message = "identity-less cookie families must still refuse two deposits"
only = false
timeout_s = 600
build_timeout_s = 1800


[[control]]
id = "claude-console-billing-is-not-session-expiry"
guards = "Billing 403 requires permission repair, not session recapture"
file = "crates/quota-core/src/claude_console.rs"
old = "Err(FetchError::ProviderStatus(403, _)) if billing => Err(billing_denied()),"
new = 'Err(FetchError::ProviderStatus(403, _)) if billing => Err(FetchError::Unauthorized("Claude Console session expired".to_string())), // NON-VACUITY BREAK'
edits = []
test_file = "crates/quota-core/src/claude_console.rs"
runner = "cargo"
package = "quota-core"
target = "--lib"
select = "expected"
expect_red = ["claude_console::tests::all_billing_403_is_unusable_not_expired"]
expect_message = "billing denial is not session expiry"
only = false
timeout_s = 600
build_timeout_s = 1800