[ty-everett]

Program and scope

PR #1093 merged as 0a43b7e45d4405a77276b6d725a910a294256ba8. Its protected release qualification failed before publication. This repairs the test evidence, supported mutation runner and bounded execution plan needed to qualify all pending main releases.

• Supported Stryker 10.1.1 corrects Vitest 5 test identity; all prior canonical sites remain.
• Native negative and boundary assertions cover SDK validation, revenue, runtime, publication/acquisition custody and authenticated HTTP.
• Whole-function LCH partitions and measured finite qualification allowances retain every source range, score floor, property setting and individual deadline.
• Current head: a63d7671ab980fcd02a2d6d4a95abf9466992401.
• Out of scope: production promotion, PR Wallet interoperability: bounded sync and portable recovery (#544) #569 merge/private-version publication, runtime/API/schema changes and quality waivers.

Impact

• No public package source or manifest changed
• Security-sensitive boundary changed: qualification controls and negative evidence
• Documentation changed

Excluded tests/fixtures, root development dependencies and CI/governance only. Published package bytes, public APIs, BRC-100 behavior and consumer migration remain unchanged; no cosmetic version bump.

Verification

• All four root gates pass: pnpm health:check, pnpm lint, pnpm format:check, pnpm typecheck.
• CI integration: 120 cases; actual-engine inventory integration: five; refreshed workflow integration: eight.
• Integrity-verified published SDK 4.0.1 oracle: 26,878 independent observations; deterministic regeneration retains archive/budget hashes. SDK protocol selection passes 290 cases.
• Native selections pass: lookup 39, coordinator 68, acquisition 22, alias coordinator 13 and LCH seller 11. The complete seven-file HTTP selection passes 68 cases with 300 property runs, seed 3242026 and no replay; its route boundary suite passes 37 cases, including the new lifecycle and exact-byte assertions. WebRTC passes 127 unchanged native cases locally.
• Complete local diagnostics meet configured floors: SDK 90.049140%/2,442 sites, EQC 92.25%/142, projection 91.049086%/1,039, runtime 90.811966%/468, revenue 90.546218%/952. Revenue parts span byte-identical declared inputs on two commits and are not single-commit qualification.
• Serial lookup replay: 306 killed, 32 survived of 338 sites (90.532544%); zero timeouts, uncovered, invalid or unexecuted sites. Official receipt/aggregation helpers verify actual partition configuration, runtime bytes, report digests and exact canonical union; both parts retain 300 property runs, seed 3242026 and no partial replay. This is local base-4f9663c51 plus the exact committed lookup-test snapshot, not hosted qualification.
• Complete hosted coordination 41805973304 passes its canonical global gate: 1,086 killed, one timeout, 112 survived / 1,199 sites, 90.658882%, zero uncovered/invalid/unexecuted sites. All nine artifact ZIP digests and aggregate report/execution digests verify; properties remain 300/3242026/no replay. This is diagnostic source 4f9663c, not publication qualification. Hosted HTTP 41808294150 is terminal FAILURE on that source: 431 detected / 501 sites (86.027944%). Its three verified artifact archives remain retained. The new lifecycle batch's complete HTTP diagnostic 41817206607 passes its canonical global gate on a63d767: 454 killed / 501 sites, 47 survivors (90.618762%), zero timeouts, uncovered, invalid or unexecuted sites. All four archive digests and aggregate report/execution digests verify; properties remain 300/3242026/no replay.
• Exact-head a63d767 CI 41817193497 is terminal: 58 successful checks and four expected scope skips, validated by the merge gate. Source-bound Sonar reports newFindings=0 and unreviewedHotspots=0; PR CodeQL has zero open alerts. Both analyses bind virtual merge 0ed379f, whose parents and tree verify against this exact head. No review threads remain.
• Established compatibility contracts remain intact
• Complete diff self-reviewed
• All applicable checks terminal and successful on the exact head

The review record preserves failed samples and evidence limits. The parallel local lookup result with 81 timeouts is rejected; an unchanged isolated control correctly survives after competing owned work stops. Earlier failed CI, native timeout and cancelled executions remain failed evidence.

Security and dependencies

• Upstream release necessity, runtime/peer compatibility, lockfile graph and audit reviewed
• Negative tests cover changed boundaries
• No new override, advisory dismissal, suppression or skipped test
• Permissions and denied lifecycle scripts remain least privilege
• Exact-head CodeQL has no new alert
• Exact-head Sonar has zero new findings and unreviewed hotspots

Stryker 10.1.1 includes Vitest 5 fix #6214. Its Node ≥22 requirement is satisfied by pinned Node 24.22.1; all three engine/runner peers are exactly 10.1.1. Frozen pnpm 10.33.2 installation denies lifecycle scripts. High/critical audit passes; 16 pre-existing low/moderate findings remain. Development tools do not enter public bundles. No application Vitest version changed; the separate two-package hold retains its own acceptance criteria.

Release and operations

• No workstation npm publication
• No public package bump or consumer migration required for this repair
• Operator guidance, inventory transition and execution evidence documented
• Complete exact merged-source protected qualification before publication

The unchanged 156-target inventory has 606 execution units in serial batches of 256/256/94. Actual old/new-engine replay retains all old sites across 20 semantic targets plus SDK. LCH acquisition retains all 222 old-engine and 223 current-engine sites; a rejected split that omitted a parent block is recorded. No score floor, zero-uncovered/invalid rule, property minimum/seed, source inclusion, individual test deadline, mutation timeout/factor or worker count is weakened. Only measured setup/qualification outer allowances and bounded worker reuse change.

All pending public packages and official images remain unpublished. Release still requires protected qualification, pack-once OIDC publication and signed/scanned downstream images. Production remains excluded.

Completion evidence

• All applicable exact-head checks pass and review conversations are resolved
• Exact head reviewed after CI/security completion
• Complete protected final-source qualification passes before publication
• One qualified maintainer approval is sufficient under repository policy

The latest lifecycle assertions use real Node transport objects, real authentication and unchanged native protected storage/disclosure. Explicit transport metadata and disclosure-port faults are unit boundary checks, not native backend conformance claims. Every injected fault asserts that it reached the intended point. Root gates pass and all 68 selected HTTP cases pass. A first malformed authenticated BOM attempt reached client retry refusal; the corrected native handshake test proves strict parser refusal before authentication. Failed samples remain retained.

Complete hosted SDK diagnostic 41818958178 passes its 2,442-site canonical gate on a63d767: 2,173 killed, 30 timeouts, 239 survived (90.212940%), zero uncovered/invalid/unexecuted sites. All 12 archive digests verify. Exact-site/runtime comparison finds four local survivors that time out hosted; treating all four as undetected still leaves 2,199 sites detected on both platforms (90.049140%). The floor does not depend on those extra timing outcomes. This diagnostic cannot qualify publication. The complete HTTP diagnostic is passing. Full protected qualification remains required on the final merged source.

Merged as 9bdeb5f, with the exact reviewed tree. Merged-main CI 41820758846 passes 47 jobs and six expected skips; CodeQL, code generation, docs and Scorecard also pass. Protected all-pending Release 41823811793 is approved and running complete 156-target/606-execution qualification on that merged SHA. Publication still requires every automated gate; no production promotion is included.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​stryker-mutator/​vitest-runner@​9.6.1 ⏵ 10.1.1	+1		+1	+1
	npm/​@​stryker-mutator/​jest-runner@​9.6.1 ⏵ 10.1.1	+1		+1	+5
	npm/​@​stryker-mutator/​core@​9.6.1 ⏵ 10.1.1	+1		+1	+1

View full report

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.1% Duplication on New Code

See analysis details on SonarQube Cloud