# Risk-based testing
Tests protect contracts and risks, not raw counts. P0 blocks release; P1 protects important behavior; P2 samples boundaries and failure modes.
## Decision rubric
Keep a test when it uses the lowest useful layer, asserts an observable contract, models a realistic regression, has one unique canonical owner, is deterministic, and has a justified runtime cost. Move or rewrite it when any check fails.
**Tiers:** P0 covers release-blocking data, safety, and protocol invariants; P1 covers important user-facing behavior and failure handling; P2 covers representative boundaries and unusual inputs; diagnostic tests measure performance without claiming correctness.
## Applied inventory
| Sampled area | Risk | Classification | Canonical owner | Decision |
| --- | --- | --- | --- | --- |
| Picker helper | Clamp/scroll arguments could be ignored | misleading | `src/tui/state/tests/pickers.rs` | rewrite; keep helper and state coverage distinct |
| Modal secret test | Fixture had no secret; preview redaction could regress unnoticed | tautological | `src/tui/sessions/commands.rs` test | rewrite; canonical preview redaction owner |
| Title waits | Busy yield and speed ceilings are scheduler-dependent | timing-sensitive | `src/agent/tests/titles_herdr.rs` | rewrite with completion channels and bounded deadlock guard |
| Filesystem cache | Directory mtime and zero elapsed are platform/timing races | timing-sensitive | `src/tools/fs_cache.rs` | rewrite with private keys and aged entries |
| CLI hook cleanup | Immediate marker absence does not prove descendant cleanup | tautological | `tests/cli_smoke.rs` | rewrite with PID publication and `ESRCH` |
| ast-grep timeout | 30-second test is costly and obscures timeout contract | timing-sensitive | `src/tools/ast_grep.rs` | rewrite with test-only short context timeout; production remains 30s |
| Auth concurrency duplicate | Same duplicate contract existed in facade and auth module | duplicate contract | `src/config/auth.rs` | consolidate; retain lower-level canonical test |
| Settings unknown fields | Parser rejection and facade wiring are distinct risks | unique contracts | `src/config/settings.rs`, `src/config/mod.rs` | keep both; distinct owners |
| Resume/continue integration | Resume identity and continue selection are separate CLI contracts | unique contracts | `tests/cli_smoke.rs` | keep both |
| Responsiveness timing gate | Draw latency is a performance diagnostic, not a general correctness claim | benchmark/diagnostic | TUI render tests | keep as explicit timing gate |
| SSE partitions | Chunk boundaries must not change complete events or metadata | P2 boundary | `src/mcp/sse.rs` | keep oracle comparison including `finish()` |
| Append durability | Write, flush, sync, and rollback failures affect durable state | P0 fault injection | `src/sessions/write.rs` | keep one table-driven stage matrix plus distinct happy path |
| Unicode editor | Grapheme-safe mutation must preserve valid UTF-8 cursor boundaries | P2 boundary | `src/tui/prompt_editor/tests.rs` | representative mutation coverage is now kept; broader operations are follow-up |
P2 claims are limited to these representative samples; they do not claim exhaustive platform, Unicode, PTY, or fault-matrix coverage.
Direct helper redaction assertions live under `src/output/redaction.rs`, and session duplicate coverage lives in `src/sessions/write.rs`. Legacy plain renderer coverage was removed with that renderer. The metadata failure case explicitly asserts `SessionAppendOutcome::DurableJsonlMetadataUpdateFailed` while checking readable JSONL and the metadata path's directory boundary.
## Local checks
Run focused checks while working, then the full suite before merging:
```sh
cargo test --locked --lib agent::
cargo test --locked --lib providers::
cargo test --locked --lib tools::
cargo test --locked --lib tui::
cargo test --locked --lib mcp::
cargo test --locked --lib config::
cargo test --locked --lib sessions::
cargo test --locked --lib context::
cargo test --locked --bin magi-code
cargo test --locked --test foundation
cargo test --locked --test cli_smoke
cargo test --locked --doc
cargo test --locked --quiet
```
CI checks public Rust API compatibility with `cargo semver-checks` against the pull request's base branch. New public exports need an intended external use, covered by `tests/foundation.rs` or equivalent evidence.
## Test health and CI
`cargo test --quiet` is the canonical full-suite command. CI runs root library, binary, foundation, CLI smoke, and doctest partitions in named failure-isolated steps. Each step appends one TSV row with status, duration, run id, attempt, and SHA; the combined per-attempt artifact is named `test-health-${{ github.run_attempt }}`, so failed workflow reruns remain available for flake comparison. Artifacts across run history expose these fields for later analysis, but the workflow does not create an automatic historical graph. A flake means fail then pass on an explicit workflow rerun; there are no automatic retries.
## Maintenance rules
Keep unique P0/P1 contracts and representative P2 boundaries. Rewrite misleading tests, consolidate obvious duplicates, use bounded deterministic signals instead of sleeps/yields, and label diagnostics honestly.