Coverage rule: the unit suite must clear the configured floor, with test files
and the config’s exempt paths out of the denominator. Each language pairs a pure
evaluate* over a parsed report with a measure* that shells out to its tool.
e2e attest / e2e verify — the e2e decision nudge. attest records the runner’s chosen
command as a branch-keyed receipt; verify confirms a branch changing scoped source has one.
Rust unit-isolation lint: an inline #[cfg(test)] mod may call and import only into the
unit under test, its parent module reached via super::. The AST walk is the deterministic
syn heuristic; its design and precision limits live in internals/rust/isolation.md.
The Python mocking mechanism and style lints behind integration lint, plus the Python
arm of unit lint. Each test file is parsed with rustpython_parser and walked with a
Visitor; the rules themselves are documented under docs/reference/checks/.
Mutation testing (unit mutation) — the rung above coverage: a test that runs a
line still passes if you delete its assertions, and a surviving mutant proves it. Each
language drives its engine through an adapter; this module measures, the CLI layer gates.
Packaging rule — the deterministic core: given the root of an unpacked built artifact and
the test-file globs that must not appear in it, scan returns every offending file.
TypeScript isolation analysis, parsed with oxc — the counterpart to the Python
crate::lint module. Each *.test.{ts,tsx,mts,cts} file is parsed and walked, and its
specifiers are classify-ed first-party / Node-builtin / third-party.
Workflow guard — flag a workflow invocation naming a subcommand the CLI no longer
exposes. Extraction is a line-based, shell-aware scan, not a GitHub Actions parser.