Found while adding the first-contact floor for REQ-FIRSTCONTACT-001.
What is true today
crates/varve-core/src/linestatus.rs is not in the required cargo mutants gate, and running it over the file leaves 18 surviving mutants:
132 mutants tested: 18 missed, 78 caught, 36 unviable
All 18 are pre-existing — none are in code added for the floor — and they cluster in two functions:
known_layers_in_layout_dirs — += → -= / *=, and a doc.line == line match guard replaceable with trueLineStatus::check_layer_refs_against — + → *, a referenced == 0 guard replaceable with false, += → *=
A guard replaceable with true is the one worth looking at first: doc.line == line is what stops a validly-signed status for one line being counted for another, and nothing currently distinguishes it from the constant.
Why this file now deserves the gate
When the gate list was drawn, this file carried advisories and yank markers. It now carries two fields that are load-bearing for security decisions, both read from a DSSE-signed document:
support-until — the horizon varve status reports and warns on (REQ-SUPPORTUNTIL-001)min-counter — the per-line floor that closes the first-contact rollback window (REQ-FIRSTCONTACT-001)
Both are consumed by code that is gated (rollback.rs, install.rs, both at zero survivors), which makes the current arrangement lopsided: the decision is mutation-tested, and the document the decision is read from is not.
Suggested scope
- Kill the 18 survivors — the two match guards first, since those are the ones that make a check vacuous rather than merely arithmetic.
- Add
-f crates/varve-core/src/linestatus.rs to the varve-core shard in .github/workflows/ci.yml.
Not urgent and nothing is known to be broken. Filed rather than fixed inline because it is a bounded piece of test work with no bearing on the v0.32.0 requirements, and folding it in would have meant the release carrying an unrelated 18-survivor cleanup.
Found while adding the first-contact floor for
REQ-FIRSTCONTACT-001.What is true today
crates/varve-core/src/linestatus.rsis not in the requiredcargo mutantsgate, and running it over the file leaves 18 surviving mutants:All 18 are pre-existing — none are in code added for the floor — and they cluster in two functions:
known_layers_in_layout_dirs—+=→-=/*=, and adoc.line == linematch guard replaceable withtrueLineStatus::check_layer_refs_against—+→*, areferenced == 0guard replaceable withfalse,+=→*=A guard replaceable with
trueis the one worth looking at first:doc.line == lineis what stops a validly-signed status for one line being counted for another, and nothing currently distinguishes it from the constant.Why this file now deserves the gate
When the gate list was drawn, this file carried advisories and yank markers. It now carries two fields that are load-bearing for security decisions, both read from a DSSE-signed document:
support-until— the horizonvarve statusreports and warns on (REQ-SUPPORTUNTIL-001)min-counter— the per-line floor that closes the first-contact rollback window (REQ-FIRSTCONTACT-001)Both are consumed by code that is gated (
rollback.rs,install.rs, both at zero survivors), which makes the current arrangement lopsided: the decision is mutation-tested, and the document the decision is read from is not.Suggested scope
-f crates/varve-core/src/linestatus.rsto thevarve-coreshard in.github/workflows/ci.yml.Not urgent and nothing is known to be broken. Filed rather than fixed inline because it is a bounded piece of test work with no bearing on the v0.32.0 requirements, and folding it in would have meant the release carrying an unrelated 18-survivor cleanup.