mutations.toml

# Safety proofs replayed by the pinned ckdev-mutate runner.
# Names are full libtest paths; the named guard must fail.
# Other tests in the target may also fail: the original proofs ran
# only the named test and did not assert target-wide exclusivity.
# Build and test deadlines are separate: 3600 s for loaded-host builds,
# 600 s for test binaries unless a row extends the bound for many stalled tests.
# Reports belong in target/mutations/.
# Each proof has one CI host: worker-using packages require macOS Seatbelt;
# portable crates and offline command fixtures run only on Linux to avoid
# replaying them twice. Offline signing/debugger probes replace macOS tools
# with fixtures rather than invoking codesign or lldb.

# worker: 32 controls
[[control]]
id = "worker-leaves-inherited-descriptors-open"
hub = "Only stdio remains open at worker startup, asserted by both inherited-descriptor and confinement probes"
hub_targets = ["confinement"]
guards = "worker leaves inherited descriptors open"
test_file = "crates/basal-worker/tests/inherited_descriptors.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test inherited_descriptors"
expect_red = ["worker_closes_extra_inherited_descriptors_at_startup"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/confinement.rs"
old = "for fd in macos::open_descriptors().map_err(ConfinementError::Descriptors)? {"
new = "for fd in Vec::<i32>::new() { // NON-VACUITY BREAK"

[[control]]
id = "lockdown-forbidden-globals-are-not-removed"
guards = "lockdown: forbidden globals are not removed"
test_file = "crates/basal-worker/tests/lockdown.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test lockdown"
expect_red = ["removed_globals_are_absent"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/prelude.js"
old = "for (const key of REMOVED_GLOBALS) {"
new = "for (const key of []) {"

[[control]]
id = "lockdown-forbidden-globals-are-not-removed-inventory"
guards = "lockdown: forbidden globals are not removed (inventory)"
test_file = "crates/basal-worker/tests/lockdown.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test lockdown"
expect_red = ["global_inventory_is_exactly_the_allowlist"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/prelude.js"
old = "for (const key of REMOVED_GLOBALS) {"
new = "for (const key of []) {"

[[control]]
id = "lockdown-function-kind-constructors-are-left-in-place"
guards = "lockdown: function-kind constructors are left in place"
test_file = "crates/basal-worker/tests/lockdown.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test lockdown"
expect_red = ["code_from_strings_is_unreachable"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/prelude.js"
old = "for (const fn of [function () {}, async function () {}, function* () {}, async function* () {}]) {"
new = "for (const fn of []) {"

[[control]]
id = "lockdown-date-prototype-constructor-still-names-the-native-date"
hub = "Date.prototype.constructor must use the journaled clock rather than recover the native clock, asserted by lockdown and clock tests"
hub_targets = ["clock"]
guards = "lockdown: Date.prototype.constructor still names the native Date"
test_file = "crates/basal-worker/tests/lockdown.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test lockdown"
expect_red = ["date_constructor_cannot_be_recovered"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/prelude.js"
old = "ObjectDefineProperty(dateProto, 'constructor', { value: RunDate, writable: true, enumerable: false, configurable: true });"
new = "// constructor left native"

[[control]]
id = "lockdown-local-time-methods-are-kept"
guards = "lockdown: local-time methods are kept"
test_file = "crates/basal-worker/tests/lockdown.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test lockdown"
expect_red = ["local_time_and_locale_are_removed"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/prelude.js"
old = "for (const key of LOCAL_TIME) {"
new = "for (const key of []) {"

[[control]]
id = "values-evaluated-as-source-instead-of-parsed-as-data"
guards = "values evaluated as source instead of parsed as data"
test_file = "crates/basal-worker/tests/lockdown.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test lockdown"
expect_red = ["payloads_arrive_as_plain_data"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/prelude.js"
old = "const JSONParse = JSON.parse;"
new = "const JSONParse = ((evaluate) => (text) => evaluate('(' + text + ')'))(eval);"

[[control]]
id = "intrinsics-are-not-frozen"
guards = "intrinsics are not frozen"
test_file = "crates/basal-worker/tests/lockdown.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test lockdown"
expect_red = ["intrinsics_are_frozen"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/engine.rs"
old = "harden(&ctx, roots)?;"
new = "drop(roots);"

[[control]]
id = "recorded-clock-and-random-outcomes-are-not-served-from-the-prefix"
guards = "recorded clock and random outcomes are not served from the prefix"
test_file = "crates/basal-worker/tests/clock.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test clock"
expect_red = ["clock_and_random_are_journaled_and_replayed"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/engine.rs"
old = "match recorded.outcome.take() {"
new = "match recorded.outcome.take().filter(|_| false) {"

[[control]]
id = "math-random-is-not-a-host-call"
guards = "Math.random is not a host call"
test_file = "crates/basal-worker/tests/clock.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test clock"
expect_red = ["clock_and_random_are_journaled_and_replayed"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/prelude.js"
old = "value: function random() { return callSync(RANDOM); },"
new = "value: function random() { return 0.5; },"

[[control]]
id = "one-clock-value-reused-for-the-whole-activation"
guards = "one clock value reused for the whole activation"
test_file = "crates/basal-worker/tests/clock.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test clock"
expect_red = ["fresh_clock_read_after_a_gap_returns_the_new_time"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/prelude.js"
old = "  function readClock() {\n    return callSync(NOW);\n  }"
new = "  let cachedClock;\n  function readClock() {\n    if (cachedClock === undefined) { cachedClock = callSync(NOW); }\n    return cachedClock;\n  }"

[[control]]
id = "recorded-outcomes-released-in-issue-order-not-delivery-order-race-any"
guards = "recorded outcomes released in issue order, not delivery order (race/any)"
test_file = "crates/basal-worker/tests/replay.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test replay"
expect_red = ["race_and_any_keep_their_winner_on_replay"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/engine.rs"
old = "release.sort_by_key(|r| r.order);"
new = "release.sort_by_key(|r| r.position);"

[[control]]
id = "recorded-outcomes-released-in-issue-order-not-delivery-order"
guards = "recorded outcomes released in issue order, not delivery order"
test_file = "crates/basal-worker/tests/replay.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test replay"
expect_red = ["recorded_outcomes_are_released_in_delivery_order"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/engine.rs"
old = "release.sort_by_key(|r| r.order);"
new = "release.sort_by_key(|r| r.position);"

[[control]]
id = "recorded-rejections-replayed-as-fulfilments-caught-rejection"
guards = "recorded rejections replayed as fulfilments (caught rejection)"
test_file = "crates/basal-worker/tests/replay.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test replay"
expect_red = ["caught_rejection_replays_as_a_rejection"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/engine.rs"
old = "self.deliver(position, outcome.settlement, &outcome.value)?;"
new = "self.deliver(position, Settlement::Fulfilled, &outcome.value)?;"

[[control]]
id = "recorded-rejections-replayed-as-fulfilments-all-rejected-any"
guards = "recorded rejections replayed as fulfilments (all-rejected any)"
test_file = "crates/basal-worker/tests/replay.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test replay"
expect_red = ["all_rejected_any_replays_in_order"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/engine.rs"
old = "self.deliver(position, outcome.settlement, &outcome.value)?;"
new = "self.deliver(position, Settlement::Fulfilled, &outcome.value)?;"

[[control]]
id = "recorded-rejections-replayed-as-fulfilments-early-all-rejection"
guards = "recorded rejections replayed as fulfilments (early all rejection)"
test_file = "crates/basal-worker/tests/replay.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test replay"
expect_red = ["early_all_rejection_replays_with_calls_in_flight"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/engine.rs"
old = "self.deliver(position, outcome.settlement, &outcome.value)?;"
new = "self.deliver(position, Settlement::Fulfilled, &outcome.value)?;"

[[control]]
id = "divergence-check-disabled"
guards = "divergence check disabled"
test_file = "crates/basal-worker/tests/replay.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test replay"
expect_red = ["divergent_call_fails_with_a_typed_error"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/engine.rs"
old = "if recorded.kind != kind || recorded.args_digest != digest {"
new = "if false && (recorded.kind != kind || recorded.args_digest != digest) {"

[[control]]
id = "suspension-on-long-running-calls-disabled"
hub = "A worker blocked only on long calls suspends and can resume with a fresh clock reading, asserted by replay and clock tests"
hub_targets = ["clock"]
guards = "suspension on long-running calls disabled"
test_file = "crates/basal-worker/tests/replay.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test replay"
expect_red = ["blocked_only_on_long_calls_suspends_and_resumes"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/engine.rs"
old = "if all_long {"
new = "if false && all_long {"

[[control]]
id = "interrupt-handler-never-stops-the-engine-cpu-loop"
hub = "The JS CPU budget interrupts unbounded scripts, including loops and regex payloads, asserted by budgets and fuzz tests"
hub_targets = ["fuzz"]
guards = "interrupt handler never stops the engine (CPU loop)"
test_file = "crates/basal-worker/tests/budgets.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test budgets"
expect_red = ["cpu_bound_loop_is_stopped_by_the_js_time_budget"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/engine.rs"
old = "interrupt.halted.get() || interrupt.clock.over_budget()"
new = "false && (interrupt.halted.get() || interrupt.clock.over_budget())"

[[control]]
id = "interrupt-handler-never-stops-the-engine-catastrophic-regex"
hub = "The JS CPU budget interrupts unbounded scripts, including loops and regex payloads, asserted by fuzz and budgets tests"
hub_targets = ["budgets"]
guards = "interrupt handler never stops the engine (catastrophic regex)"
test_file = "crates/basal-worker/tests/fuzz.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test fuzz"
expect_red = ["catastrophic_regex_is_stopped_by_the_js_time_budget"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/engine.rs"
old = "interrupt.halted.get() || interrupt.clock.over_budget()"
new = "false && (interrupt.halted.get() || interrupt.clock.over_budget())"

[[control]]
id = "js-time-measured-as-wall-time-from-the-first-engine-entry"
hub = "Time spent outside the JS engine never consumes its CPU budget, asserted by the clock unit test and host-wait integration test"
hub_targets = ["basal_worker"]
guards = "JS time measured as wall time from the first engine entry"
test_file = "crates/basal-worker/tests/budgets.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test budgets"
expect_red = ["long_host_waits_do_not_consume_the_js_time_budget"]
only = false
build_timeout_s = 3600
timeout_s = 600
edits = [
  { file = "crates/basal-worker/src/clock.rs", old = "libc::CLOCK_THREAD_CPUTIME_ID", new = "libc::CLOCK_MONOTONIC" },
  { file = "crates/basal-worker/src/clock.rs", old = "    pub fn leave(&self) {\n", new = "    pub fn leave(&self) {\n        #[allow(unreachable_code)]\n        return;\n" },
]

[[control]]
id = "memory-limit-not-applied"
guards = "memory limit not applied"
test_file = "crates/basal-worker/tests/budgets.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test budgets"
expect_red = ["memory_limit_holds"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/engine/allocator.rs"
old = "if !self.permits(size, 0) {"
new = "if false && !self.permits(size, 0) { // NON-VACUITY BREAK"

[[control]]
id = "stack-limit-not-applied"
guards = "stack limit not applied"
test_file = "crates/basal-worker/tests/budgets.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test budgets"
expect_red = ["stack_limit_holds"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/engine.rs"
old = "rt.set_max_stack_size(request.budgets.stack_bytes as usize);"
new = "// stack limit skipped"

[[control]]
id = "stall-detection-disabled"
guards = "stall detection disabled"
test_file = "crates/basal-worker/tests/budgets.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test budgets"
expect_red = ["stalled_promise_is_reported_as_stalled"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/engine.rs"
old = "ScriptState::Pending if outstanding.is_empty() => {"
new = "ScriptState::Pending if false && outstanding.is_empty() => {"

[[control]]
id = "sh-installed-in-every-profile"
hub = "The flow profile exposes no shell primitive, asserted by the profile test and lockdown's exact global inventory"
hub_targets = ["lockdown"]
guards = "sh installed in every profile"
test_file = "crates/basal-worker/tests/profile.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test profile"
expect_red = ["sh_is_unreachable_in_the_flow_profile"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/prelude.js"
old = "  if (codemode) {\n    api.sh"
new = "  if (true || codemode) {\n    api.sh"

[[control]]
id = "native-bridge-accepts-sh-in-the-flow-profile"
guards = "native bridge accepts sh in the flow profile"
test_file = "crates/basal-worker/src/engine/tests.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--lib"
expect_red = ["engine::tests::raw_bridge_cannot_issue_sh_in_flow_profile"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/engine.rs"
old = "if bridge.profile == Profile::Flow && kind.is_shell() {"
new = "if false && bridge.profile == Profile::Flow && kind.is_shell() {"

[[control]]
id = "frame-size-not-checked-before-reading-the-payload"
guards = "frame size not checked before reading the payload"
test_file = "crates/basal-worker/tests/ipc.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test ipc"
expect_red = ["oversized_frame_is_refused_and_the_worker_exits_cleanly"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-proto/src/frame.rs"
old = "let len = u32::from_be_bytes(header) as usize;\n    if len > MAX_FRAME_BYTES {"
new = "let len = u32::from_be_bytes(header) as usize;\n    if false && len > MAX_FRAME_BYTES {"

[[control]]
id = "malformed-frames-break-the-channel-instead-of-being-refused"
guards = "malformed frames break the channel instead of being refused"
test_file = "crates/basal-worker/tests/ipc.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test ipc"
expect_red = ["malformed_frames_are_refused_and_the_worker_survives"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/link.rs"
old = "Err(FrameError::Decode(e)) => {"
new = "Err(FrameError::Decode(e)) if false => {"

[[control]]
id = "deliveries-for-positions-not-awaited-are-accepted"
guards = "deliveries for positions not awaited are accepted"
test_file = "crates/basal-worker/tests/ipc.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test ipc"
expect_red = ["out_of_order_frames_are_refused"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/link.rs"
old = "if !awaiting.contains(&outcome.position) {"
new = "if false && !awaiting.contains(&outcome.position) {"

[[control]]
id = "delivery-order-regressions-are-accepted"
guards = "delivery order regressions are accepted"
test_file = "crates/basal-worker/tests/ipc.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test ipc"
expect_red = ["out_of_order_frames_are_refused"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/link.rs"
old = "Some(last) if received <= last =>"
new = "Some(last) if false && received <= last =>"

[[control]]
id = "worker-depends-on-a-subc-crate"
guards = "worker depends on a subc crate"
test_file = "crates/basal-worker/tests/dependency_fence.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test dependency_fence"
expect_red = ["worker_dependency_tree_has_no_store_no_subc_and_no_core"]
only = false
build_timeout_s = 3600
timeout_s = 600
edits = [
  { file = "crates/basal-worker/Cargo.toml", old = "rquickjs.workspace = true\n", new = "rquickjs.workspace = true\nsubc-protocol = \"0.24.1\"\n" },
  { file = "Cargo.lock", old = " \"subc-client-rs\",\n \"subc-protocol\",\n \"subc-transport\",\n \"tokio\",\n \"tracing\",\n \"webpki-roots\",\n", new = " \"subc-client-rs\",\n \"subc-protocol 0.29.0\",\n \"subc-transport\",\n \"tokio\",\n \"tracing\",\n \"webpki-roots\",\n" },
  { file = "Cargo.lock", old = " \"serde\",\n \"serde_json\",\n \"sha2\",\n \"subc-client-rs\",\n \"subc-os\",\n \"subc-protocol\",\n \"subc-transport\",\n \"tokio\",\n \"tracing\",\n", new = " \"serde\",\n \"serde_json\",\n \"sha2\",\n \"subc-client-rs\",\n \"subc-os\",\n \"subc-protocol 0.29.0\",\n \"subc-transport\",\n \"tokio\",\n \"tracing\",\n" },
  { file = "Cargo.lock", old = " \"rcgen\",\n \"rusqlite\",\n \"rustls\",\n \"serde_json\",\n \"subc-protocol\",\n", new = " \"rcgen\",\n \"rusqlite\",\n \"rustls\",\n \"serde_json\",\n \"subc-protocol 0.29.0\",\n" },
  { file = "Cargo.lock", old = " \"rusqlite\",\n \"serde_json\",\n \"sha2\",\n \"subc-client-rs\",\n \"subc-protocol\",\n \"tokio\",\n]\n", new = " \"rusqlite\",\n \"serde_json\",\n \"sha2\",\n \"subc-client-rs\",\n \"subc-protocol 0.29.0\",\n \"tokio\",\n]\n" },
  { file = "Cargo.lock", old = " \"rquickjs\",\n \"seccompiler\",\n \"serde_json\",\n]\n\n[[package]]\n", new = " \"rquickjs\",\n \"seccompiler\",\n \"serde_json\",\n \"subc-protocol 0.24.1\",\n]\n\n[[package]]\n" },
  { file = "Cargo.lock", old = " \"serde_json\",\n \"subc-control\",\n \"subc-os\",\n \"subc-protocol\",\n \"subc-transport\",\n \"tokio\",\n \"tokio-util\",\n", new = " \"serde_json\",\n \"subc-control\",\n \"subc-os\",\n \"subc-protocol 0.29.0\",\n \"subc-transport\",\n \"tokio\",\n \"tokio-util\",\n" },
  { file = "Cargo.lock", old = "dependencies = [\n \"serde\",\n \"serde_json\",\n \"subc-protocol\",\n]\n", new = "dependencies = [\n \"serde\",\n \"serde_json\",\n \"subc-protocol 0.29.0\",\n]\n" },
  { file = "Cargo.lock", old = "dependencies = [\n \"libc\",\n \"rustix\",\n]\n\n[[package]]\n", new = "dependencies = [\n \"libc\",\n \"rustix\",\n]\n\n[[package]]\nname = \"subc-protocol\"\nversion = \"0.24.1\"\nsource = \"registry+https://github.com/rust-lang/crates.io-index\"\nchecksum = \"3b0fb1bc9305afe14d1202970b7e361253dba6108525b356a7e10274436bc80d\"\ndependencies = [\n \"serde\",\n \"serde_json\",\n]\n\n[[package]]\n" },
  { file = "Cargo.lock", old = " \"serde\",\n \"serde_json\",\n \"sha2\",\n \"subc-protocol\",\n \"subtle\",\n \"tokio\",\n]\n", new = " \"serde\",\n \"serde_json\",\n \"sha2\",\n \"subc-protocol 0.29.0\",\n \"subtle\",\n \"tokio\",\n]\n" },
]

[[control]]
id = "seatbelt-profile-not-applied"
guards = "Seatbelt profile not applied"
test_file = "crates/basal-worker/tests/confinement.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test confinement"
expect_red = ["sandbox_denies_files_sockets_and_exec"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/confinement.rs"
old = "    apply_seatbelt()?;\n"
new = "    // sandbox skipped\n"

# journal: 48 controls

[[control]]
id = "late-outcome-shipped-in-the-prefix-with-a-higher-order-replay-barrier-removed"
hub = "An earlier unresolved call cannot join a replay prefix after a later call has already been released; race, token and crash recovery tests assert this barrier"
hub_targets = ["dispatch_tokens", "journal_cut", "journal_kill"]
guards = "late outcome shipped in the prefix with a higher order (replay barrier removed)"
test_file = "crates/basal-testkit/tests/journal_races.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_races"
expect_red = ["race_cut_late_outcome_waits_for_the_barrier"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/journal.rs"
old = "let prefix: Vec<RecordedCall> = rows.iter().map(CallRow::recorded).collect();"
# Only unresolved calls before an already released call cross the replay barrier.
new = "let mut prefix: Vec<RecordedCall> = rows.iter().map(CallRow::recorded).collect();\n    let mut next = prefix.iter().filter_map(|c| c.outcome.as_ref().map(|o| o.delivery_order + 1)).max().unwrap_or(0);\n    let mut stmt = conn.prepare(\"SELECT m.position, m.settlement, m.value FROM mailbox m JOIN journal j ON j.run_id = m.run_id AND j.position = m.position WHERE m.run_id = ?1 AND j.settlement IS NULL AND m.position < (SELECT MAX(position) FROM journal WHERE run_id = ?1 AND delivery_order IS NOT NULL) ORDER BY m.seq\")?;\n    let late = stmt.query_map([run_id], |r| Ok((r.get::<_, i64>(0)?, r.get::<_, String>(1)?, r.get::<_, String>(2)?)))?.collect::<rusqlite::Result<Vec<_>>>()?;\n    for (p, s, v) in late { // NON-VACUITY BREAK\n        if let Some(call) = prefix.get_mut(to_u64(p, \"position\")? as usize) {\n            call.outcome = Some(basal_proto::RecordedOutcome { settlement: parse_settlement(&s)?, value: json(v, \"late value\")?, delivery_order: next });\n            next += 1;\n        }\n    }"

[[control]]
id = "suspend-transition-does-not-re-read-arrivals-lost-wakeup"
guards = "suspend transition does not re-read arrivals (lost wakeup)"
test_file = "crates/basal-testkit/tests/journal_races.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_races"
expect_red = ["completion_after_suspended_report_is_not_lost"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/runs.rs"
old = "let arrived = settled_awaited\n        || in_mailbox > 0\n        || crate::model::to_u64(readiness, \"readiness\")? != seen_readiness;"
new = "let arrived = false;"

[[control]]
id = "claim-is-not-a-compare-and-set-from-pending"
guards = "claim is not a compare-and-set from pending"
test_file = "crates/basal-testkit/tests/journal_races.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_races"
expect_red = ["concurrent_resumes_start_one_activation"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/runs.rs"
old = "awaited = NULL WHERE run_id = ?1 AND state = 'pending'\","
new = "awaited = NULL WHERE run_id = ?1 AND state IN ('pending', 'running')\","

[[control]]
id = "outcomes-arriving-during-an-activation-are-never-released-by-it"
hub = "Available mailbox outcomes are delivered during the current activation after prefix replay, rather than waiting for another activation; live-call, scoped-flow and crash recovery tests assert that delivery"
hub_targets = ["builtins_dispatch", "dispatch_authorization", "dispatch_kv", "dispatch_limits", "dispatch_tokens", "flow_scope_recovery", "flow_scopes", "global_model_scope", "journal_admin", "journal_cut", "journal_identity", "journal_kill", "journal_ownership", "journal_unknown", "package_instances"]
guards = "outcomes arriving during an activation are never released by it"
test_file = "crates/basal-testkit/tests/journal_races.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_races"
expect_red = ["completion_during_replay_is_released_after_the_prefix"]
only = false
build_timeout_s = 3600
# The broad replay withholds replies in many tests, each retaining its healthy
# 20- or 60-second activation budget. Allow their failures to finish under load.
timeout_s = 7200
file = "crates/basal-core/src/journal.rs"
old = "WHERE run_id=?1 AND position IN (SELECT value FROM json_each(?2)) ORDER BY seq LIMIT 1"
new = "WHERE run_id=?1 AND position IN (SELECT value FROM json_each(?2)) AND arrived_generation < (SELECT generation FROM runs WHERE run_id=?1) ORDER BY seq LIMIT 1"

[[control]]
id = "rejections-journaled-as-fulfilments-caught-rejection"
hub = "Journaled rejection settlements stay rejected through delivery and replay, including authorization, KV, token and provider refusals"
hub_targets = ["builtins_dispatch", "dispatch_authorization", "dispatch_kv", "dispatch_tokens", "flow_scopes", "journal_cut"]
guards = "rejections journaled as fulfilments (caught rejection)"
test_file = "crates/basal-testkit/tests/journal_races.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_races"
expect_red = ["caught_rejection_through_the_parent"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/journal.rs"
old = "            position,\n            settlement,\n            value,\n            hash\n        ],"
new = "            position,\n            { let _ = &settlement; \"fulfilled\" },\n            value,\n            hash\n        ],"

[[control]]
id = "rejections-journaled-as-fulfilments-all-rejected-any"
hub = "Journaled rejection settlements stay rejected through delivery and replay, including authorization, KV, token and provider refusals"
hub_targets = ["builtins_dispatch", "dispatch_authorization", "dispatch_kv", "dispatch_tokens", "flow_scopes", "journal_cut"]
guards = "rejections journaled as fulfilments (all-rejected any)"
test_file = "crates/basal-testkit/tests/journal_races.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_races"
expect_red = ["all_rejected_any_through_the_parent"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/journal.rs"
old = "            position,\n            settlement,\n            value,\n            hash\n        ],"
new = "            position,\n            { let _ = &settlement; \"fulfilled\" },\n            value,\n            hash\n        ],"

[[control]]
id = "rejections-journaled-as-fulfilments-early-all-rejection"
hub = "Journaled rejection settlements stay rejected through delivery and replay, including authorization, KV, token and provider refusals"
hub_targets = ["builtins_dispatch", "dispatch_authorization", "dispatch_kv", "dispatch_tokens", "flow_scopes", "journal_cut"]
guards = "rejections journaled as fulfilments (early all rejection)"
test_file = "crates/basal-testkit/tests/journal_races.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_races"
expect_red = ["early_all_rejection_through_the_parent"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/journal.rs"
old = "            position,\n            settlement,\n            value,\n            hash\n        ],"
new = "            position,\n            { let _ = &settlement; \"fulfilled\" },\n            value,\n            hash\n        ],"

[[control]]
id = "calls-of-one-run-dispatched-serially-on-the-activation-s-thread"
hub = "Calls dispatch concurrently off the activation thread, so a blocked host cannot prevent other calls, deadline enforcement or ownership loss from progressing"
hub_targets = ["dispatch_slots", "flow_scopes", "journal_ownership"]
guards = "calls of one run dispatched serially on the activation's thread"
test_file = "crates/basal-testkit/tests/journal_races.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_races"
expect_red = ["calls_of_one_run_are_dispatched_concurrently"]
only = false
build_timeout_s = 3600
# Serial dispatch also stalls gated drivers. Their bounded joins leave room for
# healthy scheduling delays, and the broad replay pays those waits under load.
timeout_s = 3600
file = "crates/basal-core/src/runtime.rs"
old = "let handle = thread::spawn(f);"
new = "f(); // NON-VACUITY BREAK\n        let handle = thread::spawn(|| {});"

[[control]]
id = "recovery-applies-a-committed-local-effect-again"
hub = "A local effect whose outcome is already waiting in the mailbox is never applied again on recovery, asserted by KV and crash recovery tests"
hub_targets = ["dispatch_kv", "journal_cut", "journal_kill"]
guards = "recovery applies a committed local effect again"
test_file = "crates/basal-testkit/tests/journal_races.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_races"
expect_red = ["local_effect_behind_unresolved_call_applies_once"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "if waiting.contains(&row.position) || self.rt.is_inflight(&run_id, row.position) {"
# Ignore a waiting outcome only for local effects, not for remote completions.
new = "if (waiting.contains(&row.position) && row.class != StoredClass::Local) || self.rt.is_inflight(&run_id, row.position) { // NON-VACUITY BREAK"

[[control]]
id = "a-synchronous-call-journaled-without-its-value-is-not-answered-again"
guards = "a synchronous call journaled without its value is not answered again"
test_file = "crates/basal-testkit/tests/journal_races.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_races"
expect_red = ["sync_call_journaled_without_value_is_answered_again"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "if row.class != StoredClass::Sync || row.outcome.is_some() {"
new = "if true || row.class != StoredClass::Sync || row.outcome.is_some() {"

[[control]]
id = "clock-reads-not-kept-monotonic-within-a-run"
guards = "clock reads not kept monotonic within a run"
test_file = "crates/basal-testkit/tests/journal_races.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_races"
expect_red = ["clock_stays_monotonic_across_activations"]
only = false
build_timeout_s = 3600
timeout_s = 600
edits = [
  { file = "crates/basal-core/src/driver.rs", old = "(Some(c), Some(last)) => Some(c.max(last)),", new = "(Some(c), Some(_)) => Some(c)," },
]

[[control]]
id = "the-activation-s-call-insert-is-not-fenced"
guards = "the activation's call insert is not fenced"
test_file = "crates/basal-testkit/tests/journal_ownership.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_ownership"
expect_red = ["owner_loss_before_call_commit_dispatches_nothing"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/journal.rs"
old = "WHERE {FENCE} AND ?4 = ?15"
new = "WHERE (1 OR {FENCE}) AND ?4 = ?15"

[[control]]
id = "recovery-resends-a-call-this-process-is-still-dispatching"
guards = "recovery resends a call this process is still dispatching"
test_file = "crates/basal-testkit/tests/journal_ownership.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_ownership"
expect_red = ["owner_loss_after_call_commit_dispatches_once"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "if waiting.contains(&row.position) || self.rt.is_inflight(&run_id, row.position) {"
new = "if waiting.contains(&row.position) {"

[[control]]
id = "delivery-order-allocation-is-not-fenced"
guards = "delivery-order allocation is not fenced"
test_file = "crates/basal-testkit/tests/journal_ownership.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_ownership"
expect_red = ["owner_loss_around_order_commit_delivers_nothing_more"]
only = false
build_timeout_s = 3600
timeout_s = 600
edits = [
  { file = "crates/basal-core/src/journal.rs", old = "    if !lease.holds(tx)? {\n        return Err(lease.lost());\n    }\n    let readiness: i64", new = "    let readiness: i64" },
  { file = "crates/basal-core/src/journal.rs", old = "payload_hash = ?7, \\\n             delivery_order = {NEXT_ORDER} \\\n             WHERE run_id = ?1 AND position = ?4 AND settlement IS NULL AND {FENCE}\"", new = "payload_hash = ?7, \\\n             delivery_order = {NEXT_ORDER} \\\n             WHERE run_id = ?1 AND position = ?4 AND settlement IS NULL AND (1 OR {FENCE})\"" },
]

[[control]]
id = "a-call-is-dispatched-before-its-row-commits"
guards = "a call is dispatched before its row commits"
test_file = "crates/basal-testkit/tests/journal_ownership.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_ownership"
expect_red = ["storage_failure_before_commit_dispatches_nothing"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
# Dispatch only on a failed commit: successful calls must not be sent twice.
old = "                    self.on_host_call(call)?"
new = "                    let flow = self.on_host_call(call.clone());\n                    if flow.is_err() && self.rt.store().read(|_| Ok(())).is_err()\n                        && matches!(self.rt.class_of(&call.kind, serde_json::from_str::<serde_json::Value>(call.args.as_str()).ok().as_ref()), StoredClass::Query | StoredClass::KeyedMutation | StoredClass::Mutation)\n                        && let Ok(prepared) = self.prepare(&call) { // NON-VACUITY BREAK\n                        let flow_id = self.run.flow_id.clone();\n                        let run_id = self.lease.run_id.clone();\n                        let _ = self.rt.shared.host.dispatch(&basal_host::CallRequest { flow_id: flow_id.clone(), run_id: run_id.clone(), position: call.position, kind: call.kind, args: prepared.request.unwrap_or(call.args), idempotency_key: crate::ids::idempotency_key(&flow_id, &run_id, call.position), attempt: 1 });\n                    }\n                    flow?"

[[control]]
id = "recovery-resends-a-mutation-that-ignores-idempotency-keys"
hub = "Recovery reconciles an unknown unkeyed mutation instead of resending it, asserted by the journal and built-in dispatch recovery tests"
hub_targets = ["builtins_dispatch"]
guards = "recovery resends a mutation that ignores idempotency keys"
test_file = "crates/basal-testkit/tests/journal_unknown.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_unknown"
expect_red = ["unknown_unkeyed_mutation_needs_reconcile"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "(class, _) if class.safe_to_resend() => resend.push(row.clone()),"
new = "(_, _) => resend.push(row.clone()),"

[[control]]
id = "a-resend-mints-a-new-idempotency-key"
hub = "Every resend preserves the committed call key across cuts, reconciliation and scope deferral, asserted by each recovery target"
hub_targets = ["flow_scope_recovery", "journal_cut", "journal_kill"]
guards = "a resend mints a new idempotency key"
test_file = "crates/basal-testkit/tests/journal_unknown.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_unknown"
expect_red = ["unknown_keyed_mutation_is_reissued_with_the_same_key"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/runtime.rs"
old = "idempotency_key: row.idempotency_key.clone(),"
new = "idempotency_key: format!(\"{}-resent\", row.idempotency_key),"

[[control]]
id = "unavailable-retried-for-every-mutation"
guards = "Unavailable retried for every mutation"
test_file = "crates/basal-testkit/tests/journal_unknown.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_unknown"
expect_red = ["unavailable_is_retried_only_when_safe"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/runtime.rs"
old = "let may_retry = class.safe_to_resend() || proven_unsent;"
new = "let may_retry = true || class.safe_to_resend() || proven_unsent;"

[[control]]
id = "a-call-reconciled-as-not-applied-is-not-sent-again"
guards = "a call reconciled as not applied is not sent again"
test_file = "crates/basal-testkit/tests/journal_unknown.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_unknown"
expect_red = ["reconcile_not_applied_reissues_with_the_same_key"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "(_, DispatchState::NotApplied) => resend.push(row.clone()),"
new = "(_, DispatchState::NotApplied) => unknown.push(row.position),"

[[control]]
id = "completions-for-a-cancelled-run-are-accepted"
guards = "completions for a cancelled run are accepted"
test_file = "crates/basal-testkit/tests/journal_unknown.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_unknown"
expect_red = ["reconcile_cancel_ends_the_run_and_refuses_later_completions"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/journal.rs"
old = "if state == \"cancelled\" {"
new = "if false && state == \"cancelled\" {"

[[control]]
id = "a-contradictory-completion-is-taken-for-a-redelivery"
guards = "a contradictory completion is taken for a redelivery"
test_file = "crates/basal-testkit/tests/journal_unknown.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_unknown"
expect_red = ["redelivered_completion_is_a_noop_and_contradictory_one_is_quarantined"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/journal.rs"
old = "if waiting == hash {"
new = "if true || waiting == hash {"

[[control]]
id = "divergence-reported-as-a-script-error"
guards = "divergence reported as a script error"
test_file = "crates/basal-testkit/tests/journal_identity.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_identity"
expect_red = ["divergence_fails_the_run_as_nondeterminism"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "self.fail(\"nondeterminism\", format!(\"{n:?}\"), true)"
new = "self.fail(\"script\", format!(\"{n:?}\"), true)"

[[control]]
id = "code-hash-not-checked-before-replay"
guards = "code hash not checked before replay"
test_file = "crates/basal-testkit/tests/journal_identity.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_identity"
expect_red = ["code_hash_mismatch_is_engine_mismatch_without_replay"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "if code_hash(&self.run.script, &self.run.manifest) != self.run.code_hash {"
new = "if false && code_hash(&self.run.script, &self.run.manifest) != self.run.code_hash {"

[[control]]
id = "runtime-fingerprint-not-checked-before-replay"
guards = "runtime fingerprint not checked before replay"
test_file = "crates/basal-testkit/tests/journal_identity.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_identity"
expect_red = ["fingerprint_mismatch_is_engine_mismatch_without_replay"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "Some(recorded) if *recorded != current => {"
new = "Some(recorded) if false && *recorded != current => {"

[[control]]
id = "admission-does-not-consult-tombstones"
guards = "admission does not consult tombstones"
test_file = "crates/basal-testkit/tests/journal_admin.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_admin"
expect_red = ["admission_deduplicates_and_tombstones_refuse_after_pruning"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/admission.rs"
old = "if let Some(run_id) = tomb {"
new = "if let Some(run_id) = tomb.filter(|_| false) {"

[[control]]
id = "admission-does-not-deduplicate"
hub = "Redelivering an admitted trigger returns its existing run without consuming another rate slot or repeating effects after a parent kill"
hub_targets = ["dispatch_limits", "journal_kill"]
guards = "admission does not deduplicate"
test_file = "crates/basal-testkit/tests/journal_admin.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_admin"
expect_red = ["admission_deduplicates_and_tombstones_refuse_after_pruning"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/admission.rs"
old = "if let Some(run_id) = existing {"
new = "if let Some(run_id) = existing.filter(|_| false) {"

[[control]]
id = "pruning-ignores-open-obligations"
guards = "pruning ignores open obligations"
test_file = "crates/basal-core/src/runtime_regressions.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["runtime::regressions::pruning_keeps_a_terminal_run_with_an_unsettled_journal_call"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/retention.rs"
old = 'const OBLIGATIONS: &str = "EXISTS (SELECT 1 FROM journal'
new = 'const OBLIGATIONS: &str = "0 AND EXISTS (SELECT 1 FROM journal'

[[control]]
id = "pruning-touches-runs-that-have-not-ended"
guards = "pruning touches runs that have not ended"
test_file = "crates/basal-testkit/tests/journal_admin.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_admin"
expect_red = ["pruning_spares_unfinished_runs_and_open_obligations"]
only = false
build_timeout_s = 3600
timeout_s = 600
edits = [
  { file = "crates/basal-core/src/retention.rs", old = "WHERE r.state IN ('succeeded','failed','engine_mismatch','cancelled') \\\n         AND r.ended_at<=?1 AND {predicate}", new = "WHERE r.state IN ('succeeded','failed','engine_mismatch','cancelled','pending','suspended') \\\n         AND (r.ended_at IS NULL OR r.ended_at<=?1) AND {predicate}" },
  { file = "crates/basal-core/src/retention.rs", old = "WHERE r.state IN ('succeeded','failed','engine_mismatch','cancelled') \\\n         AND r.ended_at<=?1 AND r.run_id=?2", new = "WHERE r.state IN ('succeeded','failed','engine_mismatch','cancelled','pending','suspended') \\\n         AND (r.ended_at IS NULL OR r.ended_at<=?1) AND r.run_id=?2" },
]

[[control]]
id = "store-runs-synchronous-normal"
guards = "store runs synchronous = NORMAL"
test_file = "crates/basal-testkit/tests/journal_admin.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_admin"
expect_red = ["store_runs_synchronous_full_and_the_chosen_fullfsync"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/store.rs"
old = "c.pragma_update(None, \"synchronous\", \"FULL\")?;"
new = "c.pragma_update(None, \"synchronous\", \"NORMAL\")?;"

[[control]]
id = "fullfsync-choice-not-applied"
guards = "fullfsync choice not applied"
test_file = "crates/basal-testkit/tests/journal_admin.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_admin"
expect_red = ["store_runs_synchronous_full_and_the_chosen_fullfsync"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/store.rs"
old = "c.pragma_update(None, \"fullfsync\", durability.fullfsync)?;"
new = "c.pragma_update(None, \"fullfsync\", false)?;"

[[control]]
id = "recovery-does-not-resend-queries-cut-harness"
hub = "Recovery resends unresolved queries so runs finish after cuts or parent kills, asserted by the crash and built-in recovery targets"
hub_targets = ["builtins_dispatch", "journal_kill"]
guards = "recovery does not resend queries (cut harness)"
test_file = "crates/basal-testkit/tests/journal_cut.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_cut"
expect_red = ["every_cut_recovers_to_the_uncut_state"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "(class, _) if class.safe_to_resend() => resend.push(row.clone()),"
new = "(StoredClass::KeyedMutation, _) => resend.push(row.clone()),"

[[control]]
id = "recovery-does-not-resend-queries-cuts-in-recovery-suffixes"
hub = "Recovery resends unresolved queries so runs finish after cuts or parent kills, asserted by the crash and built-in recovery targets"
hub_targets = ["builtins_dispatch", "journal_kill"]
guards = "recovery does not resend queries (cuts in recovery suffixes)"
test_file = "crates/basal-testkit/tests/journal_cut.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_cut"
expect_red = ["cuts_in_recovery_generated_suffixes_recover_too"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "(class, _) if class.safe_to_resend() => resend.push(row.clone()),"
new = "(StoredClass::KeyedMutation, _) => resend.push(row.clone()),"

[[control]]
id = "recovery-does-not-resend-keyed-mutations-parent-kill-9"
hub = "Recovery resends unresolved keyed mutations under their original key, asserted by built-in, KV, model and journal crash recovery tests"
hub_targets = ["builtins_dispatch", "dispatch_kv", "dispatch_tokens", "journal_cut", "journal_unknown"]
guards = "recovery does not resend keyed mutations (parent kill -9)"
test_file = "crates/basal-testkit/tests/journal_kill.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_kill"
expect_red = ["killing_the_parent_at_every_boundary_recovers_to_the_uncut_state"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "(class, _) if class.safe_to_resend() => resend.push(row.clone()),"
new = "(StoredClass::Query, _) => resend.push(row.clone()),"

[[control]]
id = "a-broken-worker-fails-the-run-instead-of-replaying-it-on-another-worker-kill-9"
guards = "a broken worker fails the run instead of replaying it on another (worker kill -9)"
test_file = "crates/basal-testkit/tests/journal_kill.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_kill"
expect_red = ["killing_the_worker_at_every_boundary_recovers_to_the_uncut_state"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "if self.run.broken + 1 >= self.rt.config.max_broken_activations {"
new = "if true || self.run.broken + 1 >= self.rt.config.max_broken_activations {"

[[control]]
id = "install-gate-an-activation-does-not-ask-core-first"
hub = "Every resumed activation revalidates the frozen install version's core status, scope selector and current package membership before running"
hub_targets = ["flow_scope_recovery", "flow_scopes", "package_instances"]
guards = "install gate: an activation does not ask core first"
test_file = "crates/basal-testkit/tests/install_gate.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test install_gate"
expect_red = ["a_resume_after_suspension_is_gated"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
# Leave first-activation scope setup intact and bypass only the resumed-run gate.
old = "if let Gate::Closed(end) = self.rt.check_install(&self.lease, &self.run)? {"
new = "if self.lease.generation == 1 && let Gate::Closed(end) = self.rt.check_install(&self.lease, &self.run)? { // NON-VACUITY BREAK"

[[control]]
id = "install-gate-core-s-code-hash-is-not-compared-with-the-run-s"
guards = "install gate: core's code hash is not compared with the run's"
test_file = "crates/basal-testkit/tests/install_gate.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test install_gate"
expect_red = ["active_with_another_code_hash_is_revoked"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/gate.rs"
old = "Ok(InstallStatus::Active { code_hash, scope }) if code_hash == run_hash => {"
new = "Ok(InstallStatus::Active { code_hash: _, scope }) => {"

[[control]]
id = "install-gate-a-revoked-version-activates"
guards = "install gate: a revoked version activates"
test_file = "crates/basal-testkit/tests/install_gate.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test install_gate"
expect_red = ["revoked_cancels_the_run_and_disables_the_flow"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/gate.rs"
old = "Ok(InstallStatus::Revoked { .. }) => ("
new = "Ok(InstallStatus::Revoked { .. }) => return Ok(Gate::Open),\n            _ if false => ("

[[control]]
id = "install-gate-a-version-core-does-not-know-activates"
guards = "install gate: a version core does not know activates"
test_file = "crates/basal-testkit/tests/install_gate.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test install_gate"
expect_red = ["unknown_cancels_the_run_and_disables_the_flow"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/gate.rs"
old = "Ok(InstallStatus::Unknown) => ("
new = "Ok(InstallStatus::Unknown) => return Ok(Gate::Open),\n            _ if false => ("

[[control]]
id = "install-gate-no-answer-from-core-fails-open"
guards = "install gate: no answer from core fails open"
test_file = "crates/basal-testkit/tests/install_gate.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test install_gate"
expect_red = ["unreachable_core_defers_the_run_with_a_doubling_backoff"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/gate.rs"
old = "            Err(e) => {\n                return self.defer("
new = "            Err(e) => {\n                if !e.to_string().is_empty() {\n                    return Ok(Gate::Open);\n                }\n                return self.defer("

[[control]]
id = "install-gate-a-run-with-no-answer-is-offered-and-asked-about-again-at-once"
guards = "install gate: a run with no answer is offered and asked about again at once"
test_file = "crates/basal-testkit/tests/install_gate.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test install_gate"
expect_red = ["unreachable_core_defers_the_run_with_a_doubling_backoff"]
only = false
build_timeout_s = 3600
timeout_s = 600
edits = [
  { file = "crates/basal-core/src/runtime.rs", old = "runs.retain(|(run_id, _)| self.gate_wait(run_id).is_none());", new = "runs.retain(|_| true);" },
  { file = "crates/basal-core/src/driver.rs", old = "if let Some(retry_in) = self.gate_wait(run_id) {", new = "if let Some(retry_in) = self.gate_wait(run_id).filter(|_| false) {" },
]

[[control]]
id = "install-gate-the-backoff-does-not-grow-while-core-stays-unreachable"
guards = "install gate: the backoff does not grow while core stays unreachable"
test_file = "crates/basal-testkit/tests/install_gate.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test install_gate"
expect_red = ["unreachable_core_defers_the_run_with_a_doubling_backoff"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/gate.rs"
old = ".saturating_mul(1u32 << (failures - 1).min(16))"
new = ".saturating_mul(1)"

[[control]]
id = "install-gate-a-deferred-run-keeps-the-deadline-its-claim-started"
guards = "install gate: a deferred run keeps the deadline its claim started"
test_file = "crates/basal-testkit/tests/install_gate.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test install_gate"
expect_red = ["unreachable_core_defers_the_run_with_a_doubling_backoff"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/runs.rs"
old = "deadline_at = CASE WHEN fingerprint IS NULL THEN NULL ELSE deadline_at END"
new = "deadline_at = deadline_at"

[[control]]
id = "install-gate-a-deferred-claim-is-counted-as-an-activation"
guards = "install gate: a deferred claim is counted as an activation"
test_file = "crates/basal-testkit/tests/install_gate.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test install_gate"
expect_red = ["unreachable_core_defers_the_run_with_a_doubling_backoff"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/runs.rs"
old = "            forget_claim(tx, lease)?;\n            (n, RunState::Pending)"
new = "            (n, RunState::Pending)"

[[control]]
id = "install-gate-a-version-basal-holds-as-revoked-is-asked-about-again"
guards = "install gate: a version basal holds as revoked is asked about again"
test_file = "crates/basal-testkit/tests/install_gate.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test install_gate"
expect_red = ["other_runs_of_a_revoked_version_are_cancelled_without_asking"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/gate.rs"
old = ".read(|c| install::revocation(c, flow_id, version))?"
new = ".read(|c| install::revocation(c, flow_id, version).map(|_| None::<String>))?"

[[control]]
id = "unknown-reasons-a-keyed-call-out-of-retries-is-recorded-with-its-last-send-s-reason"
guards = "unknown reasons: a keyed call out of retries is recorded with its last send's reason"
test_file = "crates/basal-testkit/tests/journal_unknown.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_unknown"
expect_red = ["a_keyed_call_ambiguous_through_its_retries_is_unknown_as_retries_exhausted"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/runtime.rs"
old = "                    UnknownReason::RetriesExhausted\n                } else {\n                    last\n"
new = "                    last\n                } else {\n                    last\n"

[[control]]
id = "unknown-reasons-a-call-found-sent-after-a-restart-is-recorded-as-a-lost-connection"
guards = "unknown reasons: a call found sent after a restart is recorded as a lost connection"
test_file = "crates/basal-testkit/tests/journal_unknown.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_unknown"
expect_red = ["unknown_unkeyed_mutation_needs_reconcile"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "journal::record_unknown(tx, &run_id, *p, UnknownReason::BasalRestarted)?;"
new = "journal::record_unknown(tx, &run_id, *p, UnknownReason::ConnectionLost)?;"

[[control]]
id = "unknown-reasons-the-migration-accepts-a-store-holding-unknown-calls-without-a-reason"
guards = "unknown reasons: the migration accepts a store holding unknown calls without a reason"
test_file = "crates/basal-testkit/tests/unknown_reason.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test unknown_reason"
expect_red = ["the_migration_refuses_a_store_that_already_holds_an_unknown_call"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schema.rs"
old = "    SELECT COUNT(*) FROM journal WHERE dispatch = 'unknown';"
new = "    SELECT 0;"

[[control]]
id = "unknown-reasons-the-schema-lets-a-call-be-unknown-without-a-reason"
guards = "unknown reasons: the schema lets a call be unknown without a reason"
test_file = "crates/basal-testkit/tests/unknown_reason.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test unknown_reason"
expect_red = ["a_call_marked_unknown_needs_a_reason_from_the_closed_set"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schema.rs"
# The final table is rebuilt to add deferred dispatches, so its constraint,
# rather than the superseded ALTER TABLE constraint, must be neutralized.
old = "        CHECK (dispatch <> 'unknown' OR unknown_reason IS NOT NULL),"
new = "        , -- NON-VACUITY BREAK"

# dispatch: 47 controls

[[control]]
id = "manifest-accepts-unknown-fields"
guards = "manifest accepts unknown fields"
test_file = "crates/basal-testkit/tests/dispatch_manifest.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_manifest"
expect_red = ["manifest_refuses_unknown_fields"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/manifest.rs"
old = "#[serde(deny_unknown_fields)]\npub struct Manifest {"
new = "pub struct Manifest {"

[[control]]
id = "manifest-accepts-both-trigger-kinds"
guards = "manifest accepts both trigger kinds"
test_file = "crates/basal-testkit/tests/dispatch_manifest.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_manifest"
expect_red = ["trigger_needs_exactly_one_kind"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/manifest.rs"
old = "(Some(events), None) => {"
new = "(Some(events), _) => {"

[[control]]
id = "install-accepts-undeclared-events-and-versions"
guards = "install accepts undeclared events and versions"
test_file = "crates/basal-testkit/tests/dispatch_manifest.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_manifest"
expect_red = ["install_refuses_unknown_events_and_versions"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "let Some(decl) = catalog.event(&e.module, &e.name, e.version) else {"
new = "let Some(decl) = catalog.event(&e.module, &e.name, e.version).or(Some(basal_host::EventDecl { origin: basal_host::EventOrigin::Internal, body: EventBody::Inline })) else {"

[[control]]
id = "install-accepts-ops-missing-from-the-catalog"
guards = "install accepts ops missing from the catalog"
test_file = "crates/basal-testkit/tests/dispatch_manifest.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_manifest"
expect_red = ["install_refuses_unknown_and_unmarked_ops"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "let Some(decl) = catalog.op(module, op) else {"
new = "let Some(decl) = catalog.op(module, op).or(Some(basal_host::OpDecl { kind: Some(OpKind::Query), cause_echo: false, shell_capable: false })) else {"

[[control]]
id = "install-accepts-ops-with-no-query-or-mutate-marker"
guards = "install accepts ops with no query or mutate marker"
test_file = "crates/basal-testkit/tests/dispatch_manifest.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_manifest"
expect_red = ["install_refuses_unknown_and_unmarked_ops"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "let Some(kind) = decl.kind else {"
new = "let Some(kind) = decl.kind.or(Some(OpKind::Query)) else {"

[[control]]
id = "install-ignores-the-catalog-s-shell-capable-marker"
guards = "install ignores the catalog's shell-capable marker"
test_file = "crates/basal-testkit/tests/dispatch_manifest.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_manifest"
expect_red = ["install_refuses_shell_capable_ops_listed_by_marker_or_denylist"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "if decl.shell_capable {"
new = "if false && decl.shell_capable {"

[[control]]
id = "install-ignores-the-shell-denylist"
guards = "install ignores the shell denylist"
test_file = "crates/basal-testkit/tests/dispatch_manifest.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_manifest"
expect_red = ["install_refuses_shell_capable_ops_listed_by_marker_or_denylist"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "if denylist.contains(module, op) {"
new = "if false && denylist.contains(module, op) {"

[[control]]
id = "install-accepts-unknown-agents"
guards = "install accepts unknown agents"
test_file = "crates/basal-testkit/tests/dispatch_manifest.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_manifest"
expect_red = ["install_refuses_unknown_agents"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "if !catalog.agent_known(agent) {"
new = "if false && !catalog.agent_known(agent) {"

[[control]]
id = "loop-install-rule-not-applied"
guards = "loop install rule not applied"
test_file = "crates/basal-testkit/tests/dispatch_manifest.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_manifest"
expect_red = ["loop_install_rule_needs_the_operator_override"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "if trigger_modules.contains(&module.as_str()) && !decl.cause_echo {"
new = "if false && trigger_modules.contains(&module.as_str()) && !decl.cause_echo {"

[[control]]
id = "admission-does-not-require-the-approved-version-s-exact-code"
guards = "admission does not require the approved version's exact code"
test_file = "crates/basal-testkit/tests/dispatch_manifest.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_manifest"
expect_red = ["new_version_applies_to_newly_admitted_triggers_only"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/admission.rs"
old = "if approved.code_hash != code_hash(&spec.script, &spec.manifest) {"
new = "if false && approved.code_hash != code_hash(&spec.script, &spec.manifest) {"

[[control]]
id = "ops-outside-the-manifest-are-dispatched"
hub = "An unlisted op is rejected without dispatch and its rejection replays after a cut, asserted by authorization and crash recovery tests"
hub_targets = ["journal_cut"]
guards = "ops outside the manifest are dispatched"
test_file = "crates/basal-testkit/tests/dispatch_authorization.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_authorization"
expect_red = ["unlisted_op_is_denied_journaled_and_catchable"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/authorize.rs"
old = "if !manifest.lists_op(module, op) {"
new = "if false && !manifest.lists_op(module, op) {"

[[control]]
id = "shell-denylist-not-checked-at-dispatch"
guards = "shell denylist not checked at dispatch"
test_file = "crates/basal-testkit/tests/dispatch_authorization.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_authorization"
expect_red = ["listed_op_on_the_denylist_is_refused_at_dispatch"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/authorize.rs"
old = "if denylist.contains(module, op) {"
new = "if false && denylist.contains(module, op) {"

[[control]]
id = "catalog-shell-marker-not-checked-at-dispatch"
guards = "catalog shell marker not checked at dispatch"
test_file = "crates/basal-testkit/tests/dispatch_authorization.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_authorization"
expect_red = ["listed_op_marked_shell_capable_is_refused_at_dispatch"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/authorize.rs"
old = "Some(decl) if decl.shell_capable => Some(Refusal::denied(format!("
new = "Some(decl) if false && decl.shell_capable => Some(Refusal::denied(format!("

[[control]]
id = "the-dispatcher-does-not-refuse-sh-from-the-worker"
guards = "the dispatcher does not refuse sh from the worker"
test_file = "crates/basal-testkit/tests/dispatch_authorization.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_authorization"
expect_red = ["a_compromised_worker_cannot_issue_sh"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "if call.kind.is_shell() {"
new = "if false && call.kind.is_shell() {"

[[control]]
id = "facts-of-agents-outside-the-manifest-s-targets-are-allowed"
guards = "facts of agents outside the manifest's targets are allowed"
test_file = "crates/basal-testkit/tests/dispatch_authorization.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_authorization"
expect_red = ["facts_sinks_and_model_calls_are_checked_against_the_manifest"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/authorize.rs"
old = "if !grant.targets.iter().any(|t| t == agent) {"
new = "if false && !grant.targets.iter().any(|t| t == agent) {"

[[control]]
id = "digest-actions-above-the-manifest-s-cap-are-allowed"
guards = "digest actions above the manifest's cap are allowed"
test_file = "crates/basal-testkit/tests/dispatch_authorization.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_authorization"
expect_red = ["facts_sinks_and_model_calls_are_checked_against_the_manifest"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/authorize.rs"
old = "Some(action) if action <= cap => Ok(()),"
new = "Some(_) => Ok(()),"

[[control]]
id = "audit-row-written-outside-the-transaction-that-journals-the-call-cut-harness"
hub = "The audit row commits atomically with the call intent so neither cuts nor parent kills leave an unaudited issued call"
hub_targets = ["dispatch_kv", "journal_kill"]
guards = "audit row written outside the transaction that journals the call (cut harness)"
test_file = "crates/basal-testkit/tests/journal_cut.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_cut"
expect_red = ["every_cut_recovers_to_the_uncut_state"]
only = false
build_timeout_s = 3600
timeout_s = 600
edits = [
  { file = "crates/basal-core/src/driver.rs", old = "        audit::record(\n            tx,\n            flow_id,\n            &self.lease.run_id,\n            call.position,\n            &call.kind,\n            &ArgsDigest::of(&call.args),\n            audit::ALLOWED,\n            now_ms,\n        )?;\n        Ok(Some(inserted))", new = "        Ok(Some(inserted))" },
  { file = "crates/basal-core/src/driver.rs", old = "                self.at(Boundary::CallCommitted {\n                    position: call.position,\n                })?;\n", new = "                self.at(Boundary::CallCommitted {\n                    position: call.position,\n                })?;\n                self.rt.store().write(|tx| audit::record(tx, &flow_id, &run_id, call.position, &call.kind, &ArgsDigest::of(&call.args), audit::ALLOWED, audited_at))?;\n" },
]

[[control]]
id = "token-reservation-ignores-outstanding-reservations"
guards = "token reservation ignores outstanding reservations"
test_file = "crates/basal-testkit/tests/dispatch_tokens.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_tokens"
expect_red = ["concurrent_llm_calls_cannot_spend_the_same_remainder"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/tokens.rs"
old = "\"SELECT reserved + input_tokens + cache_write_tokens + output_tokens + unreported_tokens \\"
new = "\"SELECT 0 + input_tokens + cache_write_tokens + output_tokens + unreported_tokens \\"

[[control]]
id = "a-model-call-over-the-cap-is-dispatched"
guards = "a model call over the cap is dispatched"
test_file = "crates/basal-testkit/tests/dispatch_tokens.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_tokens"
expect_red = ["llm_call_over_the_cap_is_a_journaled_rejection"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/tokens.rs"
old = "if used.saturating_add(r.amount) > r.cap {"
new = "if false && used.saturating_add(r.amount) > r.cap {"

[[control]]
id = "a-re-issued-model-call-sends-the-script-s-bytes-not-the-journaled-request"
hub = "A reissued call sends the frozen journaled request bytes, including model clamps and built-in envelopes, asserted by dispatch and crash tests"
hub_targets = ["builtins_dispatch", "journal_cut", "journal_kill"]
guards = "a re-issued model call sends the script's bytes, not the journaled request"
test_file = "crates/basal-testkit/tests/dispatch_tokens.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_tokens"
expect_red = ["reissue_after_a_cut_sends_identical_bytes_under_the_same_send_id"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/runtime.rs"
old = "args: row.dispatch_args(),"
new = "args: row.args.clone(),"

[[control]]
id = "requested-output-not-clamped-to-the-manifest-s-ceiling"
guards = "requested output not clamped to the manifest's ceiling"
test_file = "crates/basal-testkit/tests/dispatch_tokens.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_tokens"
expect_red = ["reissue_after_a_cut_sends_identical_bytes_under_the_same_send_id"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/tokens.rs"
old = "requested.min(grant.max_output)"
new = "requested"

[[control]]
id = "usage-applied-again-for-a-settled-send-id"
hub = "A settled model send charges usage exactly once despite completion redelivery, asserted by token ledger and Broca reservation tests"
hub_targets = ["broca_reservations"]
guards = "usage applied again for a settled send id"
test_file = "crates/basal-testkit/tests/dispatch_tokens.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_tokens"
expect_red = ["duplicate_usage_report_is_applied_once"]
only = false
build_timeout_s = 3600
timeout_s = 600
edits = [
  { file = "crates/basal-core/src/tokens.rs", old = "FROM token_ledger \\\n                 WHERE send_id = ?1 AND state = 'reserved'\"", new = "FROM token_ledger \\\n                 WHERE send_id = ?1\"" },
  { file = "crates/basal-core/src/tokens.rs", old = "settled_at = ?7 \\\n         WHERE send_id = ?1 AND state = 'reserved'\"", new = "settled_at = ?7 \\\n         WHERE send_id = ?1\"" },
]

[[control]]
id = "usage-settled-in-the-current-window-instead-of-the-reservation-s"
guards = "usage settled in the current window instead of the reservation's"
test_file = "crates/basal-testkit/tests/dispatch_tokens.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_tokens"
expect_red = ["usage_lands_in_the_reservation_window_across_suspension_and_rollover"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/tokens.rs"
old = "            window_ms,\n            start,\n            reserved,"
new = "            window_ms,\n            crate::tokens::window_start(now_ms, window_ms),\n            reserved,"

[[control]]
id = "kv-writes-roll-back-when-their-run-fails"
guards = "kv writes roll back when their run fails"
test_file = "crates/basal-testkit/tests/dispatch_kv.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_kv"
expect_red = ["kv_writes_survive_a_later_failure_of_their_run"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schema.rs"
old = "    revision INTEGER NOT NULL CHECK (revision >= 1),\n    PRIMARY KEY (flow_id, key)\n);"
new = "    revision INTEGER NOT NULL CHECK (revision >= 1),\n    PRIMARY KEY (flow_id, key)\n);\nCREATE TRIGGER kv_rolls_back AFTER UPDATE OF state ON runs WHEN NEW.state = 'failed' BEGIN DELETE FROM kv WHERE flow_id = NEW.flow_id; END;"

[[control]]
id = "kv-key-size-not-capped"
guards = "kv key size not capped"
test_file = "crates/basal-testkit/tests/dispatch_kv.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_kv"
expect_red = ["kv_caps_refuse_with_journaled_rejections"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/kv.rs"
old = "if key.len() > limits.max_key_bytes {"
new = "if false && key.len() > limits.max_key_bytes {"

[[control]]
id = "kv-value-size-not-capped"
guards = "kv value size not capped"
test_file = "crates/basal-testkit/tests/dispatch_kv.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_kv"
expect_red = ["kv_caps_refuse_with_journaled_rejections"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/kv.rs"
old = "if value.len() > limits.max_value_bytes {"
new = "if false && value.len() > limits.max_value_bytes {"

[[control]]
id = "kv-total-bytes-per-flow-not-capped"
guards = "kv total bytes per flow not capped"
test_file = "crates/basal-testkit/tests/dispatch_kv.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_kv"
expect_red = ["kv_caps_refuse_with_journaled_rejections"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/kv.rs"
old = "if total - previous + entry > bytes_i64(limits.max_flow_bytes)? {"
new = "if false && total - previous + entry > bytes_i64(limits.max_flow_bytes)? {"

[[control]]
id = "recovery-applies-a-committed-kv-write-again"
hub = "A local effect whose outcome is already waiting in the mailbox is never applied again on recovery, asserted by KV and crash recovery tests"
hub_targets = ["journal_cut", "journal_kill", "journal_races"]
guards = "recovery applies a committed kv write again"
test_file = "crates/basal-testkit/tests/dispatch_kv.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_kv"
expect_red = ["kv_write_is_applied_once_across_every_cut"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "if waiting.contains(&row.position) || self.rt.is_inflight(&run_id, row.position) {"
# Ignore a waiting outcome only for local effects, not for remote completions.
new = "if (waiting.contains(&row.position) && row.class != StoredClass::Local) || self.rt.is_inflight(&run_id, row.position) { // NON-VACUITY BREAK"

[[control]]
id = "a-run-starts-while-an-earlier-run-of-its-flow-holds-the-slot"
guards = "a run starts while an earlier run of its flow holds the slot"
test_file = "crates/basal-testkit/tests/dispatch_slots.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_slots"
expect_red = ["second_run_waits_for_the_first_even_while_suspended"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/runs.rs"
old = "if let Some(holder) = slot_holder(tx, run_id)? {"
new = "if let Some(holder) = slot_holder(tx, run_id)?.filter(|_| false) {"

[[control]]
id = "run-deadline-never-enforced-activation-and-expiry"
hub = "The run deadline frees its slot whether active, suspended or waiting for provider readiness, asserted by slot and flow-scope tests"
hub_targets = ["flow_scopes"]
guards = "run deadline never enforced (activation and expiry)"
test_file = "crates/basal-testkit/tests/dispatch_slots.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_slots"
expect_red = ["deadline_fails_a_stuck_run_and_frees_the_slot"]
only = false
build_timeout_s = 3600
timeout_s = 600
edits = [
  { file = "crates/basal-core/src/driver.rs", old = ".is_some_and(|d| self.rt.config.clock.now_ms() >= d)", new = ".is_some_and(|_| false)" },
  { file = "crates/basal-core/src/runs.rs", old = "deadline_at IS NOT NULL AND deadline_at <= ?1 \\", new = "deadline_at IS NOT NULL AND deadline_at <= ?1 AND 0 \\" },
]

[[control]]
id = "suspended-runs-never-expire"
hub = "Suspended runs expire at the original run deadline, including provider-readiness waits, asserted by slot and flow-scope tests"
hub_targets = ["flow_scopes"]
guards = "suspended runs never expire"
test_file = "crates/basal-testkit/tests/dispatch_slots.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_slots"
expect_red = ["deadline_fails_a_suspended_run_and_frees_the_slot"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/runs.rs"
old = "deadline_at IS NOT NULL AND deadline_at <= ?1 \\"
new = "deadline_at IS NOT NULL AND deadline_at <= ?1 AND 0 \\"

[[control]]
id = "admission-ignores-the-run-rate-limit"
hub = "Admission refuses a run past its flow's rate limit, including scheduled fires, asserted by rate-window and schedule integration tests"
hub_targets = ["schedule_flows"]
guards = "admission ignores the run rate limit"
test_file = "crates/basal-testkit/tests/dispatch_limits.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_limits"
expect_red = ["run_rate_limit_and_auto_disable_after_k_saturated_windows"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/admission.rs"
old = "        return Ok(Err(Admission::RateLimited));"
new = "        let _ = Admission::RateLimited;"

[[control]]
id = "sustained-saturation-never-disables-the-flow"
guards = "sustained saturation never disables the flow"
test_file = "crates/basal-testkit/tests/dispatch_limits.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_limits"
expect_red = ["run_rate_limit_and_auto_disable_after_k_saturated_windows"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/rate.rs"
old = "if streak < k {"
new = "if true || streak < k {"

[[control]]
id = "saturated-windows-counted-without-being-consecutive"
guards = "saturated windows counted without being consecutive"
test_file = "crates/basal-testkit/tests/dispatch_limits.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_limits"
expect_red = ["saturated_windows_that_are_not_consecutive_do_not_disable"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/rate.rs"
old = "AND saturated = 1 AND window_start BETWEEN ?3 AND ?4\","
new = "AND saturated = 1 AND window_start <= ?4\","

[[control]]
id = "admission-ignores-a-disabled-flow"
guards = "admission ignores a disabled flow"
test_file = "crates/basal-testkit/tests/dispatch_limits.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_limits"
expect_red = ["run_rate_limit_and_auto_disable_after_k_saturated_windows"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/admission.rs"
old = "Some(flow) if !flow.enabled => return Ok(Err(Admission::Disabled)),"
new = "Some(flow) if false && !flow.enabled => return Ok(Err(Admission::Disabled)),"

[[control]]
id = "dispatch-budget-not-checked"
guards = "dispatch budget not checked"
test_file = "crates/basal-testkit/tests/dispatch_limits.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_limits"
expect_red = ["dispatch_budget_refuses_beyond_the_window"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "if let Take::Refused { .. } = rate::check(tx, flow_id, rate::Kind::Dispatch, now_ms, &rate)?"
new = "if let Take::Refused { .. } = Take::Allowed"

[[control]]
id = "a-disabled-flow-s-resumed-run-still-dispatches"
guards = "a disabled flow's resumed run still dispatches"
test_file = "crates/basal-testkit/tests/dispatch_limits.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_limits"
expect_red = ["disable_fences_a_resumed_run_while_in_flight_calls_settle"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "        let rate = self.rt.config.rate;\n        if install::is_disabled(tx, flow_id)? {"
new = "        let rate = self.rt.config.rate;\n        if false && install::is_disabled(tx, flow_id)? {"

[[control]]
id = "any-agent-can-disable-any-flow"
guards = "any agent can disable any flow"
test_file = "crates/basal-testkit/tests/dispatch_limits.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_limits"
expect_red = ["only_the_operator_or_the_owning_agent_disables"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "&& record.owner.as_deref() != Some(agent.as_str())"
new = "&& false"

[[control]]
id = "per-run-host-call-limit-not-checked"
guards = "per-run host-call limit not checked"
test_file = "crates/basal-testkit/tests/dispatch_limits.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_limits"
expect_red = ["per_run_call_limit_fails_the_run"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "if calls >= limits.max_calls {"
new = "if false && calls >= limits.max_calls {"

[[control]]
id = "per-run-journal-byte-limit-not-checked"
guards = "per-run journal byte limit not checked"
test_file = "crates/basal-testkit/tests/dispatch_limits.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_limits"
expect_red = ["per_run_journal_bytes_limit_fails_the_run"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "if bytes.saturating_add(incoming) > limits.max_journal_bytes {"
new = "if false && bytes.saturating_add(incoming) > limits.max_journal_bytes {"

[[control]]
id = "argument-byte-cap-not-checked-before-parsing"
guards = "argument byte cap not checked before parsing"
test_file = "crates/basal-testkit/tests/dispatch_limits.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_limits"
expect_red = ["argument_over_the_cap_is_refused_before_it_is_parsed"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "if call.args.len() > cap {"
new = "if false && call.args.len() > cap {"

[[control]]
id = "result-byte-cap-not-checked"
guards = "result byte cap not checked"
test_file = "crates/basal-testkit/tests/dispatch_limits.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_limits"
expect_red = ["result_over_the_cap_is_recorded_as_a_rejection"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/runtime.rs"
old = "(bytes > cap).then(|| {"
new = "(false && bytes > cap).then(|| {"

[[control]]
id = "manifest-schedule-not-validated-by-the-scheduler"
hub = "Installing a schedule uses the scheduler's validation rules, asserted by manifest validation and schedule approval tests"
hub_targets = ["schedule_tick"]
guards = "manifest schedule not validated by the scheduler"
test_file = "crates/basal-testkit/tests/dispatch_manifest.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_manifest"
expect_red = ["schedule_triggers_are_typed_and_validated_by_the_scheduler"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/manifest.rs"
old = "crate::schedule::validate(schedule)\n                    .map_err(|e| ManifestError::Schedule(e.to_string()))?;"
new = "let _ = schedule;"

[[control]]
id = "core-s-revoke-of-the-approved-version-does-not-disable-the-flow"
guards = "core's revoke of the approved version does not disable the flow"
test_file = "crates/basal-testkit/tests/install_gate.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test install_gate"
expect_red = ["revoked_cancels_the_run_and_disables_the_flow"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "match disable(tx, flow_id, &Actor::Core, reason, now_ms) {"
new = "match Ok::<bool, InstallError>(false) {"

[[control]]
id = "core-s-revoke-of-the-approved-version-leaves-it-approved"
guards = "core's revoke of the approved version leaves it approved"
test_file = "crates/basal-testkit/tests/install_gate.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test install_gate"
expect_red = ["revoked_cancels_the_run_and_disables_the_flow"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "\"UPDATE flows SET approved_version = NULL WHERE flow_id = ?1\","
new = "\"UPDATE flows SET approved_version = approved_version WHERE flow_id = ?1\","

[[control]]
id = "a-version-core-revoked-can-be-approved-again"
guards = "a version core revoked can be approved again"
test_file = "crates/basal-testkit/tests/install_gate.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test install_gate"
expect_red = ["a_revoked_version_cannot_be_approved_again"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "if revoked_at.is_some() {\n        return Err(InstallError::Revoked {"
new = "if false {\n        return Err(InstallError::Revoked {"

[[control]]
id = "approving-a-new-version-through-core-does-not-lift-core-s-disable"
guards = "approving a new version through core does not lift core's disable"
test_file = "crates/basal-testkit/tests/install_gate.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test install_gate"
expect_red = ["approving_a_new_version_lifts_cores_disable"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "if flow(tx, flow_id)?.is_some_and(|f| {\n        f.disabled_by.as_deref() == Some(CORE_ACTOR)\n            && f.disabled_reason.as_deref() != Some(\"agent_retired\")\n    }) {"
new = "if false { // NON-VACUITY BREAK"

# schedule: 35 controls

[[control]]
id = "a-gap-time-fires-at-the-compatible-reading-shifted-by-the-gap-s-length-instead-of-at-the-transition"
guards = "a gap time fires at the compatible reading (shifted by the gap's length) instead of at the transition"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["spring_forward_gap_fires_once_at_the_first_valid_instant"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/due.rs"
old = "            tz.following(before_transition)\n                .next()\n                .map(|t| t.timestamp())"
new = "            ambiguous.compatible().ok()"

[[control]]
id = "an-overlap-time-fires-at-its-second-occurrence"
guards = "an overlap time fires at its second occurrence"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["fall_back_overlap_fires_once_at_the_first_occurrence"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/due.rs"
old = "AmbiguousOffset::Fold { .. } => ambiguous\n            .earlier()"
new = "AmbiguousOffset::Fold { .. } => ambiguous\n            .later()"

[[control]]
id = "matches-landing-on-an-instant-already-due-are-not-skipped"
guards = "matches landing on an instant already due are not skipped"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["half_hourly_cron_collapses_the_gap_and_skips_the_repeated_pass"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/due.rs"
old = "        if at > after {\n            return Ok(Some(at));"
# Admit an equal instant only across an offset change, not on every ordinary tick.
new = "        if at > after || (at == after && after.checked_sub(jiff::SignedDuration::from_hours(1)).ok().is_some_and(|previous| previous.to_zoned(tz.clone()).offset() != after.to_zoned(tz.clone()).offset())) { // NON-VACUITY BREAK\n            return Ok(Some(at));"

[[control]]
id = "an-interval-s-next-due-time-counts-from-the-tick-not-the-anchor"
guards = "an interval's next due time counts from the tick, not the anchor"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["interval_due_times_are_the_anchor_plus_whole_periods"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/due.rs"
old = "let next = timestamp_ms(newest_ms + every);"
new = "let next = timestamp_ms(i128::from(now.as_millisecond()) + every);"

[[control]]
id = "once-fires-every-kept-missed-due-time-instead-of-one-catch-up"
guards = "once fires every kept missed due time instead of one catch-up"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["a_sleep_gap_under_once_makes_one_catch_up_fire_with_count_and_window"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/tick.rs"
old = "MissedPolicy::Once => fires.push(fire(last_missed)),"
new = "MissedPolicy::Once => fires.extend(kept_missed.iter().map(|d| fire(*d))),"

[[control]]
id = "skip-fires-a-catch-up"
guards = "skip fires a catch-up"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["a_sleep_gap_under_skip_makes_no_fire"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/tick.rs"
old = "MissedPolicy::Skip => {}"
new = "MissedPolicy::Skip => fires.push(fire(last_missed)),"

[[control]]
id = "each-ignores-its-cap"
guards = "each ignores its cap"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["a_sleep_gap_under_each_fires_the_newest_up_to_the_cap_oldest_first"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/tick.rs"
old = "let start = kept_missed.len().saturating_sub(cap);"
new = "let start = cap.saturating_sub(cap);"

[[control]]
id = "each-admits-its-fires-newest-first"
hub = "The each catch-up policy admits kept due times oldest first, which also determines which fire gets the last rate slot"
hub_targets = ["schedule_flows"]
guards = "each admits its fires newest first"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["a_sleep_gap_under_each_fires_the_newest_up_to_the_cap_oldest_first"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/tick.rs"
old = "fires.extend(kept_missed[start..].iter().map(|d| fire(*d)));"
new = "fires.extend(kept_missed[start..].iter().rev().map(|d| fire(*d)));"

[[control]]
id = "a-due-time-is-on-time-however-late-it-is-seen-sleep-not-counted-as-missed"
guards = "a due time is on time however late it is seen (sleep not counted as missed)"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["a_single_due_time_seen_after_the_grace_period_is_missed"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/tick.rs"
old = "let on_time = now.duration_since(newest) <= config.grace();"
new = "let on_time = now.duration_since(newest) <= config.grace() || true;"

[[control]]
id = "an-on-time-due-time-does-not-fire-when-missed-ones-precede-it"
guards = "an on-time due time does not fire when missed ones precede it"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["an_on_time_due_time_fires_after_the_catch_up"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/tick.rs"
old = "    if on_time {\n        fires.push(PlannedFire {"
new = "    if on_time && missed_count == 0 {\n        fires.push(PlannedFire {"

[[control]]
id = "the-missed-count-walks-without-its-limit"
guards = "the missed count walks without its limit"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["a_missed_count_past_the_limit_is_reported_as_a_lower_bound"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/due.rs"
old = "if count == count_limit {"
new = "if count == u64::MAX {"

[[control]]
id = "the-schedule-advance-is-not-committed-with-its-planned-fires"
hub = "Planning durably advances the next due time with its fires so repeat ticks and restarted schedulers never plan the same window twice"
hub_targets = ["schedule_flows"]
guards = "the schedule advance is not committed with its planned fires"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["a_restart_after_planning_a_catch_up_mints_no_second_fire"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/tick.rs"
old = "params![flow_id, scan.next.map(to_ms), last_fired, at],"
new = "params![flow_id, row.next_due.map(to_ms), last_fired, at],"

[[control]]
id = "planned-fires-are-not-persisted-with-the-advance"
hub = "Planned fires are durably queued with the schedule advance before admission, asserted by tick and installed-flow tests reading the queue"
hub_targets = ["schedule_flows"]
guards = "planned fires are not persisted with the advance"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["a_restart_after_planning_a_catch_up_mints_no_second_fire"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/tick.rs"
old = "for fire in &fires {"
new = "for fire in fires.iter().filter(|_| false) {"

[[control]]
id = "planned-fires-are-not-persisted-restart-mid-admission"
hub = "Planned fires are durably queued with the schedule advance before admission, asserted by tick and installed-flow tests reading the queue"
hub_targets = ["schedule_flows"]
guards = "planned fires are not persisted (restart mid-admission)"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["a_restart_between_admitting_planned_fires_admits_each_once"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/tick.rs"
old = "for fire in &fires {"
new = "for fire in fires.iter().filter(|_| false) {"

[[control]]
id = "planned-fires-are-admitted-newest-first"
hub = "The durable fire queue admits oldest first, including after a restart and when a rate limit drops later fires"
hub_targets = ["schedule_flows"]
guards = "planned fires are admitted newest first"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["a_restart_between_admitting_planned_fires_admits_each_once"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/tick.rs"
old = "FROM schedule_fires ORDER BY seq LIMIT 1"
new = "FROM schedule_fires ORDER BY seq DESC LIMIT 1"

[[control]]
id = "the-schedule-is-not-advanced-and-fire-ids-are-not-derived-from-the-due-time"
hub = "Advancing the schedule and reusing each due time's fire ID prevent duplicate admission on repeat ticks, asserted by tick and flow integration tests"
hub_targets = ["schedule_flows"]
guards = "the schedule is not advanced and fire ids are not derived from the due time"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["a_repeated_tick_with_the_same_now_admits_nothing_new"]
only = false
build_timeout_s = 3600
timeout_s = 600
edits = [
  { file = "crates/basal-core/src/schedule/tick.rs", old = "params![flow_id, scan.next.map(to_ms), last_fired, at],", new = "params![flow_id, row.next_due.map(to_ms), last_fired, at]," },
  # New fires keep their IDs; only a re-planned, already admitted fire gets a new ID.
  { file = "crates/basal-core/src/schedule/tick.rs", old = "                fire.trigger_id,", new = "                { // NON-VACUITY BREAK\n                    let duplicate: bool = tx.query_row(\"SELECT EXISTS(SELECT 1 FROM trigger_inbox WHERE flow_id = ?1 AND trigger_id = ?2)\", params![flow_id, fire.trigger_id], |r| r.get(0))?;\n                    if duplicate {\n                        let count: i64 = tx.query_row(\"SELECT COUNT(*) FROM trigger_inbox WHERE flow_id = ?1\", [flow_id], |r| r.get(0))?;\n                        format!(\"{}:{count}\", fire.trigger_id)\n                    } else { fire.trigger_id.clone() }\n                }," },
]

[[control]]
id = "a-newer-version-counts-its-due-times-from-the-old-version-s-last-fire"
guards = "a newer version counts its due times from the old version's last fire"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["approving_a_newer_version_does_not_fire_for_the_gap_the_swap_creates"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/table.rs"
old = "let counted_from = now;"
new = "let counted_from = old.last_fired_due.unwrap_or(now);"

[[control]]
id = "approving-a-newer-version-drops-what-the-old-version-owed"
hub = "A version swap plans the old version's owed due times before replacing its schedule, asserted by lifecycle and installed-flow tests"
hub_targets = ["schedule_flows"]
guards = "approving a newer version drops what the old version owed"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["approving_a_newer_version_first_fires_what_the_old_version_owed"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/table.rs"
old = "if old.state == ScheduleState::Active {"
new = "if false && old.state == ScheduleState::Active {"

[[control]]
id = "a-disabled-schedule-ticks"
hub = "An inactive schedule, disabled by the operator or paused for removed package membership, plans no fires"
hub_targets = ["schedule_flows", "package_instances"]
guards = "a disabled schedule ticks"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["a_disabled_schedule_does_not_tick_and_does_not_catch_up_when_enabled"]
only = false
build_timeout_s = 3600
timeout_s = 600
edits = [
  { file = "crates/basal-core/src/schedule/tick.rs", old = "if row.state != ScheduleState::Active {", new = "if false && row.state != ScheduleState::Active {" },
  { file = "crates/basal-core/src/schedule/tick.rs", old = "WHERE state = 'active' AND next_due_ms IS NOT NULL", new = "WHERE next_due_ms IS NOT NULL" },
]

[[control]]
id = "enabling-resumes-from-the-stale-next-due-time-and-catches-up-the-disabled-hours"
hub = "Enabling a schedule starts from the enable time rather than catching up disabled hours, asserted by both lifecycle targets"
hub_targets = ["schedule_flows"]
guards = "enabling resumes from the stale next due time and catches up the disabled hours"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["a_disabled_schedule_does_not_tick_and_does_not_catch_up_when_enabled"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/table.rs"
old = "            next_due,\n            to_ms(now)\n        ],\n    )?;\n    Ok(true)"
new = "            row.next_due.map(to_ms),\n            to_ms(now)\n        ],\n    )?;\n    Ok(true)"

[[control]]
id = "removing-a-schedule-keeps-its-planned-fires"
guards = "removing a schedule keeps its planned fires"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["removing_a_schedule_stops_it_and_drops_its_planned_fires"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/table.rs"
old = "    tx.execute(\"DELETE FROM schedule_fires WHERE flow_id = ?1\", [flow_id])?;\n    let removed"
new = "    let removed"

[[control]]
id = "a-fire-refused-by-a-draining-admission-is-dropped-instead-of-kept"
guards = "a fire refused by a draining admission is dropped instead of kept"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["fires_planned_while_admission_drains_wait_and_are_admitted_after"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/tick.rs"
old = "if admission != Admission::Draining {"
new = "if admission != Admission::Draining || true {"

[[control]]
id = "unknown-spec-fields-accepted"
hub = "Unknown schedule-spec fields are refused at both direct validation and manifest installation boundaries"
hub_targets = ["dispatch_manifest"]
guards = "unknown spec fields accepted"
test_file = "crates/basal-testkit/tests/schedule_spec.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_spec"
expect_red = ["validation_refuses_unknown_fields_and_values"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/spec.rs"
old = "#[serde(deny_unknown_fields)]\npub struct ScheduleSpec"
new = "pub struct ScheduleSpec"

[[control]]
id = "each-cap-not-bounded-above"
guards = "each cap not bounded above"
test_file = "crates/basal-testkit/tests/schedule_spec.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_spec"
expect_red = ["validation_refuses_a_missed_cap_above_the_limit"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/spec.rs"
old = "if cap == 0 || cap > MAX_EACH_CAP {"
new = "if cap == 0 {"

[[control]]
id = "interval-range-not-checked"
hub = "Schedule intervals must lie within the supported range, asserted by direct validation and manifest installation tests"
hub_targets = ["dispatch_manifest"]
guards = "interval range not checked"
test_file = "crates/basal-testkit/tests/schedule_spec.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_spec"
expect_red = ["validation_refuses_zero_and_out_of_range_intervals"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/spec.rs"
old = "if !(MIN_INTERVAL_SECS..=MAX_INTERVAL_SECS).contains(&secs) {"
new = "if secs == u64::MAX {"

[[control]]
id = "an-unknown-zone-falls-back-to-utc"
hub = "An unknown schedule zone is refused rather than silently using UTC, asserted by spec, manifest and approval tests"
hub_targets = ["dispatch_manifest", "schedule_tick"]
guards = "an unknown zone falls back to UTC"
test_file = "crates/basal-testkit/tests/schedule_spec.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_spec"
expect_red = ["validation_refuses_unknown_zones"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/spec.rs"
old = "tz: zone(zone_name)?,"
new = "tz: zone(zone_name).unwrap_or(TimeZone::UTC),"

[[control]]
id = "zone-names-matched-case-insensitively"
guards = "zone names matched case-insensitively"
test_file = "crates/basal-testkit/tests/schedule_spec.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_spec"
expect_red = ["validation_refuses_unknown_zones"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/spec.rs"
old = "if tz.iana_name() != Some(name) {"
new = "if tz.iana_name().is_none() {"

[[control]]
id = "seconds-fields-accepted-in-cron-patterns"
guards = "seconds fields accepted in cron patterns"
test_file = "crates/basal-testkit/tests/schedule_spec.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_spec"
expect_red = ["validation_refuses_malformed_cron"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/spec.rs"
old = ".seconds(Seconds::Disallowed)"
new = ".seconds(Seconds::Optional)"

[[control]]
id = "a-cron-pattern-that-never-matches-is-accepted"
guards = "a cron pattern that never matches is accepted"
test_file = "crates/basal-testkit/tests/schedule_spec.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_spec"
expect_red = ["validation_refuses_a_cron_that_never_fires"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/spec.rs"
old = "if parsed.find_next_occurrence(&probe, true).is_err() {"
new = "if parsed.find_next_occurrence(&probe, true).is_err() && false {"

[[control]]
id = "approving-a-version-with-a-schedule-trigger-does-not-create-its-schedule"
hub = "Approving a scheduled version creates the schedule the tick loop reads, asserted by installed-flow and scheduler approval tests"
hub_targets = ["schedule_tick"]
guards = "approving a version with a schedule trigger does not create its schedule"
test_file = "crates/basal-testkit/tests/schedule_flows.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_flows"
expect_red = ["a_scheduled_flow_runs_from_install_through_tick_admission_and_run"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "match manifest.trigger.schedule {"
new = "match None::<crate::schedule::ScheduleSpec> {"

[[control]]
id = "a-version-swap-does-not-plan-what-the-old-version-owed-installed-flows"
hub = "A version swap plans the old version's owed due times before replacing its schedule, asserted by both lifecycle targets"
hub_targets = ["schedule_tick"]
guards = "a version swap does not plan what the old version owed (installed flows)"
test_file = "crates/basal-testkit/tests/schedule_flows.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_flows"
expect_red = ["owed_fires_after_a_version_swap_run_the_version_approved_at_admission"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/table.rs"
old = "if old.state == ScheduleState::Active {"
new = "if false && old.state == ScheduleState::Active {"

[[control]]
id = "disabling-a-flow-leaves-its-schedule-ticking"
hub = "Disabling a flow stops its schedule, asserted by installed-flow integration and scheduler lifecycle tests"
hub_targets = ["schedule_tick"]
guards = "disabling a flow leaves its schedule ticking"
test_file = "crates/basal-testkit/tests/schedule_flows.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_flows"
expect_red = ["disabling_and_enabling_a_flow_stops_and_restarts_its_schedule"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "    schedule::table::disable(tx, flow_id, timestamp(now_ms)?)?;"
new = "    let _ = timestamp(now_ms)?;"

[[control]]
id = "enabling-a-flow-leaves-its-schedule-stopped"
hub = "Enabling a flow restarts its schedule, asserted by installed-flow integration and scheduler lifecycle tests"
hub_targets = ["schedule_tick"]
guards = "enabling a flow leaves its schedule stopped"
test_file = "crates/basal-testkit/tests/schedule_flows.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_flows"
expect_red = ["disabling_and_enabling_a_flow_stops_and_restarts_its_schedule"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "        schedule::table::enable(tx, flow_id, timestamp(now_ms)?)?;"
new = "        let _ = timestamp(now_ms)?;"

[[control]]
id = "approving-a-version-without-a-schedule-trigger-keeps-the-old-schedule"
hub = "Approving a version without a schedule removes the old schedule and its queued fires, asserted by both lifecycle targets"
hub_targets = ["schedule_flows"]
guards = "approving a version without a schedule trigger keeps the old schedule"
test_file = "crates/basal-testkit/tests/schedule_tick.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_tick"
expect_red = ["removing_a_schedule_stops_it_and_drops_its_planned_fires"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "            schedule::table::remove(tx, flow_id)?;\n            Ok(None)"
new = "            Ok(None)"

[[control]]
id = "a-fire-refused-by-the-rate-limit-is-dropped-without-a-record"
guards = "a fire refused by the rate limit is dropped without a record"
test_file = "crates/basal-testkit/tests/schedule_flows.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test schedule_flows"
expect_red = ["a_rate_limited_scheduled_fire_is_dropped_and_recorded"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schedule/tick.rs"
old = "if let Some(reason) = dropped_reason(&admission) {"
new = "if let Some(reason) = dropped_reason(&admission).filter(|_| false) {"

# module: 99 controls

[[control]]
id = "pool-startup-boundary-precedes-nonce-consumption"
guards = "pool startup boundary precedes nonce consumption"
test_file = "crates/basal-module/tests/startup_order.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test startup_order"
expect_red = ["serve_connects_before_constructing_worker_pool"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/main.rs"
old = "let transport =\n        match basal_host::transport::SubcTransport::connect"
new = "let pool = PoolConfig::beside_current_exe(); drop(pool); // NON-VACUITY BREAK\n    let transport =\n        match basal_host::transport::SubcTransport::connect"

[[control]]
id = "flow-list-agent-sees-another-agent-s-flow"
guards = "flow.list agent sees another agent's flow"
test_file = "crates/basal-module/tests/list_contract.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test list_contract"
expect_red = ["list_agent_cannot_see_another_agents_flow"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "Caller::Agent { agent_id, .. } => Some(agent_id.as_str()),"
new = "Caller::Agent { .. } => None,"

[[control]]
id = "flow-list-local-caller-sees-an-agent-s-flow"
guards = "flow.list local caller sees an agent's flow"
test_file = "crates/basal-module/tests/list_contract.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test list_contract"
expect_red = ["list_local_cannot_see_an_agents_flow"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "Caller::Local => Some(LOCAL_AUTHOR),"
new = "Caller::Local => None,"

[[control]]
id = "flow-list-invisible-requested-id-appears"
guards = "flow.list invisible requested id appears"
test_file = "crates/basal-module/tests/list_contract.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test list_contract"
expect_red = ["list_invisible_requested_ids_are_absent"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "AND (?2 IS NULL OR f.owner=?2 OR (f.owner IS NULL"
new = "AND (?1 IS NOT NULL OR ?2 IS NULL OR f.owner=?2 OR (f.owner IS NULL /* NON-VACUITY BREAK */"

[[control]]
id = "flow-list-state-diverges-from-flow-health"
hub = "Flow list preserves the same approved/enabled state as health, including unapproved and core-revoked flows, asserted by list and gate tests"
hub_targets = ["install_gate"]
guards = "flow.list state diverges from flow.health"
test_file = "crates/basal-module/tests/list_contract.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test list_contract"
expect_red = ["list_reply_decodes_against_documented_shape_and_health_state"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "\"state\": flow_state(approved, r.get(2)?),"
new = "\"state\": \"enabled\", // NON-VACUITY BREAK"

[[control]]
id = "the-manifest-declares-a-capability-subc-protocol-s-grammar-refuses"
guards = "the manifest declares a capability subc-protocol's grammar refuses"
test_file = "crates/basal-module/tests/manifest_gate.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test manifest_gate"
expect_red = ["the_built_binary_prints_a_manifest_subc_protocol_accepts"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/manifest.rs"
old = ".capabilities(None)"
new = ".capabilities(Some(subc_protocol::manifest::CapabilityDeclarations { provides: vec![\"Not A Capability\".into()], requires: Vec::new(), must_never_reach: Vec::new() }))"

[[control]]
id = "the-manifest-leaves-out-an-op-the-module-serves"
guards = "the manifest leaves out an op the module serves"
test_file = "crates/basal-module/tests/manifest_gate.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test manifest_gate"
expect_red = ["the_built_binary_prints_a_manifest_subc_protocol_accepts"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/manifest.rs"
old = "operations: OPERATIONS\n                .iter()"
new = "operations: OPERATIONS\n                .iter()\n                .skip(1)"

[[control]]
id = "an-agent-id-in-a-scope-nobody-vouched-for-is-taken-as-the-caller"
hub = "An agent identity requires a core-owned, owner-authorized route stamp, asserted by the caller unit and binding tests"
hub_targets = ["caller_binding"]
guards = "an agent id in a scope nobody vouched for is taken as the caller"
test_file = "crates/basal-module/src/caller.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--lib"
expect_red = ["caller::tests::identity_comes_only_from_the_stamp"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/caller.rs"
old = "core_owned && scope.owner_authorized"
new = "core_owned"

[[control]]
id = "the-scope-stamp-on-a-route-s-bind-is-dropped"
hub = "The daemon's attested scope stamp survives route binding and supplies the agent identity and scope used by scoped model flows"
hub_targets = ["e2e"]
guards = "the scope stamp on a route's bind is dropped"
test_file = "crates/basal-module/tests/caller_binding.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test caller_binding"
expect_red = ["an_owner_authorized_core_scope_names_the_agent_and_its_scope"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/serve.rs"
old = "scope: request.scope.clone(),"
new = "scope: None,"

[[control]]
id = "flow-id-in-a-bind-scope-changes-agent-identity"
guards = "flow id in a bind scope changes agent identity"
test_file = "crates/basal-module/tests/caller_binding.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test caller_binding"
expect_red = ["a_flow_id_in_the_bind_stamp_decodes_without_changing_agent_identity"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/caller.rs"
old = "(Some(agent), true) if !agent.is_empty() => Caller::Agent {"
new = "(Some(agent), true) if !agent.is_empty() && scope.attributes.flow_id.is_none() => Caller::Agent {"

[[control]]
id = "unknown-channel-zero-control-field-ends-basal-serving"
guards = "unknown channel-0 control field ends basal serving"
test_file = "crates/basal-module/tests/unknown_control.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test unknown_control"
expect_red = ["unknown_control_field_is_refused_and_the_following_health_check_is_answered"]
only = false
build_timeout_s = 3600
timeout_s = 600
edits = [
  { file = "Cargo.toml", old = "subc-client-rs = \"0.26.1\"", new = "subc-client-rs = \"=0.26.0\"" },
  { file = "Cargo.lock", old = "name = \"subc-client-rs\"\nversion = \"0.26.1\"\nsource = \"registry+https://github.com/rust-lang/crates.io-index\"\nchecksum = \"d671a838c7777805070da19080045ef5149882636b3bd8193c5e913a590c7315\"", new = "name = \"subc-client-rs\"\nversion = \"0.26.0\"\nsource = \"registry+https://github.com/rust-lang/crates.io-index\"\nchecksum = \"22961845d10f595319b1a8fc5cb614ed95d43452b4f7c6ba24fca9662cc20665\"" },
]

[[control]]
id = "a-scope-owned-by-any-module-names-its-agent"
hub = "Only a scope owned by core can attest an agent identity, asserted by the caller unit and binding tests"
hub_targets = ["basal_module"]
guards = "a scope owned by any module names its agent"
test_file = "crates/basal-module/tests/caller_binding.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test caller_binding"
expect_red = ["a_scope_owned_by_another_module_names_no_agent"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/caller.rs"
old = "Principal::Reserved { module_id } if module_id == CORE_MODULE\n        );"
new = "Principal::Reserved { .. }\n        );"

[[control]]
id = "an-agent-id-in-a-core-scope-the-daemon-does-not-vouch-for-names-the-agent"
hub = "An agent identity requires owner authorization on its core scope, asserted by the caller unit and binding tests"
hub_targets = ["basal_module"]
guards = "an agent id in a core scope the daemon does not vouch for names the agent"
test_file = "crates/basal-module/tests/caller_binding.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test caller_binding"
expect_red = ["a_scope_without_owner_authorization_names_no_agent"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/caller.rs"
old = "core_owned && scope.owner_authorized"
new = "core_owned"

[[control]]
id = "an-unscoped-route-that-is-neither-direct-nor-core-s-is-taken-as-the-operator"
hub = "An unscoped unrelated route is not the operator, asserted by caller classification, binding and authorization tests"
hub_targets = ["basal_module", "ops"]
guards = "an unscoped route that is neither direct nor core's is taken as the operator"
test_file = "crates/basal-module/tests/caller_binding.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test caller_binding"
expect_red = ["a_route_without_a_scope_is_never_an_agent"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/caller.rs"
old = "other => Caller::Other(principal_label(other)),"
new = "_ => Caller::Operator,"

[[control]]
id = "a-route-that-has-gone-keeps-the-caller-it-was-bound-with"
guards = "a route that has gone keeps the caller it was bound with"
test_file = "crates/basal-module/tests/caller_binding.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test caller_binding"
expect_red = ["a_route_without_a_scope_is_never_an_agent"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/serve.rs"
old = "lock(&self.stamps).remove(&(handle.channel, handle.epoch));"
new = "let _ = handle;"

[[control]]
id = "a-vouched-agent-may-run-a-capture-dry-run-of-a-flow-it-does-not-own"
hub = "An agent may capture-dry-run only a flow it owns, asserted by route binding and the authorization matrix"
hub_targets = ["ops"]
guards = "a vouched agent may run a capture dry run of a flow it does not own"
test_file = "crates/basal-module/tests/caller_binding.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test caller_binding"
expect_red = ["an_agent_cannot_act_on_a_flow_it_does_not_own"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "(\n                Caller::Agent {\n                    agent_id: agent, ..\n                },\n                Mode::Capture,\n            ) if self.owns(agent, &p.flow_id)? => {}"
new = "(Caller::Agent { .. }, Mode::Capture) => {}"

[[control]]
id = "a-vouched-agent-may-enable-a-flow-it-does-not-own-the-module-s-ownership-check-and-the-core-s-both-removed"
hub = "An agent may enable only a flow it owns; both ownership checks protect the binding and authorization-matrix tests"
hub_targets = ["ops"]
guards = "a vouched agent may enable a flow it does not own (the module's ownership check and the core's both removed)"
test_file = "crates/basal-module/tests/caller_binding.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test caller_binding"
expect_red = ["an_agent_cannot_act_on_a_flow_it_does_not_own"]
only = false
build_timeout_s = 3600
timeout_s = 600
edits = [
  { file = "crates/basal-module/src/ops.rs", old = "Caller::Agent {\n                agent_id: agent, ..\n            } if self.owns(agent, &p.flow_id)? => Actor::Agent(agent.to_owned()),", new = "Caller::Agent { agent_id: agent, .. } => Actor::Agent(agent.to_owned())," },
  { file = "crates/basal-core/src/install.rs", old = "            if record.owner.as_deref() != Some(agent.as_str()) {", new = "            if false && record.owner.as_deref() != Some(agent.as_str()) {" },
]

[[control]]
id = "an-unscoped-direct-key-holder-is-the-operator"
hub = "A direct key holder is local, not an attested operator, asserted by caller classification, binding and authorization tests"
hub_targets = ["basal_module", "caller_binding"]
guards = "an unscoped direct key-holder is the operator"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["authorization_matrix"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/caller.rs"
old = "Some(Principal::Direct) => Caller::Local,"
new = "Some(Principal::Direct) => Caller::Operator,"

[[control]]
id = "any-reserved-module-is-the-operator-not-only-the-attested-callosum"
hub = "Only the attested callosum module is the operator; other reserved modules remain unrelated callers at every authorization boundary"
hub_targets = ["basal_module", "caller_binding"]
guards = "any reserved module is the operator, not only the attested callosum"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["authorization_matrix"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/caller.rs"
old = "Some(Principal::Reserved { module_id }) if module_id == OPERATOR_MODULE => Caller::Operator,"
new = "Some(Principal::Reserved { .. }) => Caller::Operator,"

[[control]]
id = "a-local-caller-refused-an-operator-action-is-told-not-permitted-not-operator-attestation-required"
hub = "A local caller refused an operator-only action receives operator_attestation_required, asserted by binding and authorization tests"
hub_targets = ["caller_binding"]
guards = "a local caller refused an operator action is told not_permitted, not operator_attestation_required"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["authorization_matrix"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "if *caller == Caller::Local {"
new = "if false {"

[[control]]
id = "a-local-caller-may-replace-a-flow-someone-else-wrote"
guards = "a local caller may replace a flow someone else wrote"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["a_local_caller_installs_only_its_own_flows_with_a_digest_sink"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "if owners.iter().any(|o| o != LOCAL_AUTHOR) {"
new = "if false {"

[[control]]
id = "a-local-caller-may-install-in-another-author-s-name"
guards = "a local caller may install in another author's name"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["a_local_caller_installs_only_its_own_flows_with_a_digest_sink"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "if p.author.as_ref().is_some_and(|a| a != LOCAL_AUTHOR) {"
new = "if false {"

[[control]]
id = "a-local-caller-may-override-the-loop-install-rule"
guards = "a local caller may override the loop install rule"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["a_local_caller_installs_only_its_own_flows_with_a_digest_sink"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "if p.loop_override {\n                    return Err(OpError::operator_attestation_required("
new = "if false {\n                    return Err(OpError::operator_attestation_required("

[[control]]
id = "a-local-caller-s-flow-without-a-digest-sink-is-installed-and-its-card-raised"
hub = "A local install requires a digest sink before any card is raised, asserted by local-install and card-author tests"
hub_targets = ["hosts"]
guards = "a local caller's flow without a digest sink is installed and its card raised"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["a_local_caller_installs_only_its_own_flows_with_a_digest_sink"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "if manifest.sinks.is_empty() {"
new = "if false {"

[[control]]
id = "a-local-caller-s-card-names-the-operator-as-its-author"
hub = "A local install card identifies its author as local, never operator, asserted by local-install and card-author tests"
hub_targets = ["hosts"]
guards = "a local caller's card names the operator as its author"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["a_local_caller_installs_only_its_own_flows_with_a_digest_sink"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "Caller::Local => Ok(json!({ \"local\": true })),"
new = "Caller::Local => Ok(json!({ \"operator\": true })),"

[[control]]
id = "the-consent-host-accepts-the-retired-agent-author-core-no-longer-takes"
guards = "the consent host accepts the retired agent author core no longer takes"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["card_author_is_scope_operator_or_local_and_nothing_else"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_consent.rs"
old = "if key == \"scope\" && !scope_ref.is_empty() => {"
new = "if (key == \"scope\" || key == \"agent\") && !scope_ref.is_empty() => {"

[[control]]
id = "the-consent-host-sends-an-author-that-is-not-one-of-core-s-three-forms"
guards = "the consent host sends an author that is not one of core's three forms"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["card_author_is_scope_operator_or_local_and_nothing_else"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_consent.rs"
old = "        _ => Err(refused()),"
new = "        _ => Ok(AuthorKind::Operator),"

[[control]]
id = "an-agent-s-scope-ref-is-taken-from-its-agent-id-instead-of-the-route-s-stamp"
hub = "The agent's scope reference comes unchanged from the route stamp rather than the agent ID, asserted by caller and install-card tests"
hub_targets = ["basal_module", "hosts"]
guards = "an agent's scope_ref is taken from its agent id instead of the route's stamp"
test_file = "crates/basal-module/tests/caller_binding.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test caller_binding"
expect_red = ["an_owner_authorized_core_scope_names_the_agent_and_its_scope"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/caller.rs"
old = "scope_ref: scope.scope_ref.clone(),"
new = "scope_ref: agent.clone(),"

[[control]]
id = "an-agent-s-card-author-names-its-agent-id-instead-of-the-scope-ref-it-was-stamped-with"
hub = "An agent's install card author names its attested scope reference, not the agent ID, asserted by card encoding and binding tests"
hub_targets = ["caller_binding"]
guards = "an agent's card author names its agent id instead of the scope_ref it was stamped with"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["install_card_is_byte_exact_and_scope_comes_from_the_route_stamp"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "Caller::Agent { scope_ref, .. } => Ok(json!({ \"scope\": scope_ref })),"
new = "Caller::Agent { agent_id, .. } => Ok(json!({ \"scope\": agent_id })),"

[[control]]
id = "core-s-refusal-of-the-author-scope-is-treated-as-an-ordinary-consent-refusal"
guards = "core's refusal of the author scope is treated as an ordinary consent refusal"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["core_refusing_the_author_scope_is_a_clear_install_error"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_consent.rs"
old = "if code == SCOPE_UNKNOWN || code == SCOPE_ENDED =>"
new = "if false && (code == SCOPE_UNKNOWN || code == SCOPE_ENDED) =>"

[[control]]
id = "a-pending-card-is-raised-again-in-the-name-of-whoever-first-installed-it"
guards = "a pending card is raised again in the name of whoever first installed it"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["core_refusing_the_author_scope_is_a_clear_install_error"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "raised_fields[\"wire_author\"] = card_author(caller)?;"
new = "let _ = card_author(caller)?;"

[[control]]
id = "an-idle-worker-bound-to-any-flow-is-reused-for-another"
guards = "an idle worker bound to any flow is reused for another"
test_file = "crates/basal-module/tests/pool.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test pool"
expect_red = ["a_worker_is_never_reused_across_flows"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/pool.rs"
old = "let reuse = state.bound.get_mut(flow).and_then(Vec::pop);"
new = "let reuse = state.bound.values_mut().find_map(Vec::pop);"

[[control]]
id = "a-killed-worker-goes-back-to-its-flow-s-idle-list-and-is-handed-out-again"
guards = "a killed worker goes back to its flow's idle list and is handed out again"
test_file = "crates/basal-module/tests/pool.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test pool"
expect_red = ["a_killed_worker_is_replaced_and_the_run_continues"]
only = false
build_timeout_s = 3600
timeout_s = 600
edits = [
  { file = "crates/basal-module/src/pool.rs", old = "let keep = match (&lease.binding, lease.killed || crashed) {", new = "let keep = match (&lease.binding, false) {" },
  { file = "crates/basal-module/src/pool.rs", old = "if let Some(mut idle) = reuse {\n                    if idle.process.has_exited() {", new = "if let Some(mut idle) = reuse {\n                    if false && idle.process.has_exited() {" },
]

[[control]]
id = "a-killed-worker-is-not-owed-a-replacement"
guards = "a killed worker is not owed a replacement"
test_file = "crates/basal-module/tests/pool.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test pool"
expect_red = ["a_killed_worker_is_replaced_and_the_run_continues"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/pool.rs"
old = "Metrics::bump(&self.shared.metrics.workers_killed);\n                    self.shared.lost(&mut state, true);"
new = "Metrics::bump(&self.shared.metrics.workers_killed);\n                    self.shared.lost(&mut state, false);"

[[control]]
id = "warm-spares-are-never-handed-out"
guards = "warm spares are never handed out"
test_file = "crates/basal-module/tests/pool.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test pool"
expect_red = ["an_activation_uses_a_warm_spare"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/pool.rs"
old = "if let Some((id, mut process)) = state.spares.pop_front() {"
new = "if let Some((id, mut process)) = None::<(u64, WorkerProcess)> {"

[[control]]
id = "a-worker-is-never-retired-for-its-activation-count"
guards = "a worker is never retired for its activation count"
test_file = "crates/basal-module/tests/pool.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test pool"
expect_red = ["a_bound_worker_is_retired_after_its_activation_count_and_its_idle_period"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/pool.rs"
old = "if activations >= self.shared.config.max_activations => None,"
new = "if activations >= u32::MAX => None,"

[[control]]
id = "a-bound-worker-is-never-retired-for-idling"
guards = "a bound worker is never retired for idling"
test_file = "crates/basal-module/tests/pool.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test pool"
expect_red = ["a_bound_worker_is_retired_after_its_activation_count_and_its_idle_period"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/pool.rs"
old = "} else if now.saturating_sub(idle.idle_since_ms) >= idle_ms {"
new = "} else if idle_ms < 0 && now.saturating_sub(idle.idle_since_ms) >= idle_ms {"

[[control]]
id = "the-run-is-claimed-before-its-worker-is-spawned-and-greeted"
guards = "the run is claimed before its worker is spawned and greeted"
test_file = "crates/basal-module/tests/pool.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test pool"
expect_red = ["the_run_deadline_starts_after_the_worker_answers_its_handshake"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/engine.rs"
# Start only the deadline early; keep pooling, flow binding and retirement intact.
old = "        let mut lease = match self.inner.pool.acquire(Binding::Flow(flow_id.to_owned())) {"
new = "        self.inner.rt.store().write(|tx| { // NON-VACUITY BREAK\n            tx.execute(\"UPDATE runs SET deadline_at = ?2 + deadline_ms WHERE run_id = ?1 AND deadline_at IS NULL AND deadline_ms IS NOT NULL\", rusqlite::params![run_id, self.inner.rt.config().clock.now_ms()])?;\n            Ok(())\n        }).expect(\"set premature deadline\");\n        let mut lease = match self.inner.pool.acquire(Binding::Flow(flow_id.to_owned())) {"

[[control]]
id = "activations-are-not-bounded"
guards = "activations are not bounded"
test_file = "crates/basal-module/tests/engine.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test engine"
expect_red = ["activations_are_bounded_across_flows"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/engine.rs"
old = "if active.runs.len() >= inner.config.max_concurrent_activations {"
new = "if active.runs.len() >= usize::MAX {"

[[control]]
id = "a-storage-error-does-not-raise-the-fatal-latch-in-process"
hub = "A storage error raises the fatal latch so the engine stops and the process exits for recovery; decision and host cut tests assert this too"
hub_targets = ["decisions", "e2e", "hosts"]
guards = "a storage error does not raise the fatal latch (in process)"
test_file = "crates/basal-module/tests/engine.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test engine"
expect_red = ["a_storage_error_stops_the_engine_and_raises_the_fatal_latch"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/fatal.rs"
old = "        if slot.is_none() {\n            *slot = Some(why);"
new = "        if false {\n            *slot = Some(why);"

[[control]]
id = "a-storage-error-does-not-end-the-process"
hub = "A storage error raises the fatal latch so the engine stops and the process exits for recovery; decision and host cut tests assert this too"
hub_targets = ["decisions", "engine", "hosts"]
guards = "a storage error does not end the process"
test_file = "crates/basal-module/tests/e2e.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test e2e"
expect_red = ["a_store_error_ends_the_process_non_zero_and_the_restart_recovers"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/fatal.rs"
old = "        if slot.is_none() {\n            *slot = Some(why);"
new = "        if false {\n            *slot = Some(why);"

[[control]]
id = "the-module-starts-without-recovering-runs-left-running"
hub = "Module startup recovers runs left running so journaled decisions, sink intents and model selections can resume after a cut"
hub_targets = ["decisions", "hosts"]
guards = "the module starts without recovering runs left running"
test_file = "crates/basal-module/tests/e2e.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test e2e"
expect_red = ["a_schedule_flow_survives_a_catch_up_a_worker_kill_and_a_module_kill_with_each_write_once"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/module.rs"
old = "let recovered = store\n            .write(basal_core::runs::requeue_orphans)\n            .map_err(|e| format!(\"recovering runs: {e}\"))?;"
new = "let recovered: Vec<String> = Vec::new();"

[[control]]
id = "a-card-s-approval-is-applied-as-a-rejection"
hub = "An approved install card approves its version, asserted both by the install test and by fixtures verifying approval before running flows"
hub_targets = ["caller_binding", "decisions", "dry_run", "e2e", "engine", "health_contract", "hosts", "install_gate", "list_contract", "pool"]
guards = "a card's approval is applied as a rejection"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["install_raises_one_card_per_version_and_its_decision_approves_or_rejects"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/module.rs"
old = "CardDecision::Approve => Decision::Approve,"
new = "CardDecision::Approve => Decision::Reject,"

[[control]]
id = "capture-mode-sends-calls-to-the-host"
hub = "Capture dry runs execute no host effects, including install previews; decision, host and end-to-end tests assert no extra effects from those previews"
hub_targets = ["decisions", "e2e", "hosts"]
guards = "capture mode sends calls to the host"
test_file = "crates/basal-module/tests/dry_run.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test dry_run"
expect_red = ["capture_mode_executes_no_host_call_and_replays_the_schedule_window"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/dryrun.rs"
old = "if !self.runs_live(request) {"
new = "if false {"

[[control]]
id = "a-delivered-captured-rejection-does-not-taint-what-follows"
guards = "a delivered captured rejection does not taint what follows"
test_file = "crates/basal-module/tests/dry_run.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test dry_run"
expect_red = ["a_captured_call_the_script_uses_marks_the_trace_partial"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/dryrun.rs"
old = "Event::Delivered(p) if captured.contains(p) => tainted = true,"
new = "Event::Delivered(p) if captured.contains(p) && false => tainted = true,"

[[control]]
id = "live-mode-runs-ops-that-are-not-marked-query"
guards = "live mode runs ops that are not marked query"
test_file = "crates/basal-module/tests/dry_run.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test dry_run"
expect_red = ["live_mode_runs_only_query_ops_and_only_for_the_operator"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/dryrun.rs"
old = ".is_some_and(|d| d.kind == Some(OpKind::Query) && !d.shell_capable)"
new = ".is_some() /* NON-VACUITY BREAK */"

[[control]]
id = "an-owning-agent-may-ask-for-a-live-dry-run"
hub = "Only the operator can request a live dry run, asserted by the dry-run target and authorization matrix"
hub_targets = ["ops"]
guards = "an owning agent may ask for a live dry run"
test_file = "crates/basal-module/tests/dry_run.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test dry_run"
expect_red = ["live_mode_runs_only_query_ops_and_only_for_the_operator"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "(\n                Caller::Agent {\n                    agent_id: agent, ..\n                },\n                Mode::Capture,\n            ) if self.owns(agent, &p.flow_id)? => {}"
new = "(Caller::Agent { agent_id: agent, .. }, _) if self.owns(agent, &p.flow_id)? => {}"

[[control]]
id = "dry-runs-share-one-scratch-store-that-is-never-removed"
guards = "dry runs share one scratch store that is never removed"
test_file = "crates/basal-module/tests/dry_run.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test dry_run"
expect_red = ["each_dry_run_has_its_own_scratch_store_and_the_real_kv_and_runs_are_untouched"]
only = false
build_timeout_s = 3600
timeout_s = 600
edits = [
  { file = "crates/basal-module/src/dryrun.rs", old = "\"dry-{}-{}-{n}\",\n            std::process::id(),\n            request.now_ms\n        ));", new = "\"dry-shared{}\",\n            n * 0\n        ));" },
  { file = "crates/basal-module/src/dryrun.rs", old = "let _ = std::fs::remove_dir_all(&dir);", new = "let _ = &dir;" },
]

[[control]]
id = "any-agent-may-run-a-capture-dry-run-of-another-s-flow"
hub = "An agent may capture-dry-run only a flow it owns, asserted by the authorization matrix and route binding tests"
hub_targets = ["caller_binding"]
guards = "any agent may run a capture dry run of another's flow"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["authorization_matrix"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "(\n                Caller::Agent {\n                    agent_id: agent, ..\n                },\n                Mode::Capture,\n            ) if self.owns(agent, &p.flow_id)? => {}"
new = "(Caller::Agent { .. }, Mode::Capture) => {}"

[[control]]
id = "agents-may-read-flow-health"
guards = "agents may read flow.health"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["authorization_matrix"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "if !matches!(caller, Caller::Operator | Caller::Core) {"
new = "if matches!(caller, Caller::Other(_)) {"

[[control]]
id = "anyone-may-reconcile"
guards = "anyone may reconcile"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["authorization_matrix"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "        if *caller != Caller::Operator {\n            return Err(OpError::not_permitted(\"flow.reconcile\", caller));"
new = "        if false {\n            return Err(OpError::not_permitted(\"flow.reconcile\", caller));"

[[control]]
id = "anyone-may-drain"
guards = "anyone may drain"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["authorization_matrix"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "        if *caller != Caller::Operator {\n            return Err(OpError::not_permitted(\"flow.drain\", caller));"
new = "        if false {\n            return Err(OpError::not_permitted(\"flow.drain\", caller));"

[[control]]
id = "any-agent-may-enable-any-flow-the-module-s-ownership-check-and-the-core-s-both-removed"
hub = "An agent may enable only a flow it owns; both ownership checks protect the authorization-matrix and binding tests"
hub_targets = ["caller_binding"]
guards = "any agent may enable any flow (the module's ownership check and the core's both removed)"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["authorization_matrix"]
only = false
build_timeout_s = 3600
timeout_s = 600
edits = [
  { file = "crates/basal-module/src/ops.rs", old = "Caller::Agent {\n                agent_id: agent, ..\n            } if self.owns(agent, &p.flow_id)? => Actor::Agent(agent.to_owned()),", new = "Caller::Agent { agent_id: agent, .. } => Actor::Agent(agent.to_owned())," },
  { file = "crates/basal-core/src/install.rs", old = "            if record.owner.as_deref() != Some(agent.as_str()) {", new = "            if false && record.owner.as_deref() != Some(agent.as_str()) {" },
]

[[control]]
id = "the-owner-may-not-re-enable-even-a-disable-it-made-itself"
hub = "The owning agent may re-enable a flow it disabled itself, asserted by owner binding tests and the authorization matrix"
hub_targets = ["caller_binding"]
guards = "the owner may not re-enable even a disable it made itself"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["authorization_matrix"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "Some(by) if by == own => {}"
new = "Some(by) if by == own && false => {}"

[[control]]
id = "the-owner-may-undo-the-operator-s-disable"
guards = "the owner may undo the operator's disable"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["authorization_matrix"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "                _ => return Err(refused()),"
new = "                _ => {}"

[[control]]
id = "the-owner-may-undo-an-auto-disable"
guards = "the owner may undo an auto-disable"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["authorization_matrix"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "match record.disabled_by.as_deref() {\n                Some(by) if by == own => {}\n                _ => return Err(refused()),\n            }"
new = "match record.disabled_by.as_deref() {\n                Some(by) if by == own => {}\n                Some(RUNTIME_ACTOR) => {} // NON-VACUITY BREAK\n                _ => return Err(refused()),\n            }"

[[control]]
id = "an-operator-disable-of-a-flow-the-owner-disabled-changes-nothing"
guards = "an operator disable of a flow the owner disabled changes nothing"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["an_operator_disable_takes_over_the_owners_disable"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "let takes_over = matches!(actor, Actor::Operator(_))"
new = "let takes_over = false && matches!(actor, Actor::Operator(_))"

[[control]]
id = "health-has-no-as-of"
guards = "health has no as_of"
test_file = "crates/basal-module/tests/health_contract.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test health_contract"
expect_red = ["flow_health_decodes_as_core_decodes_it"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "\"as_of\": as_of,\n            \"worker_confinement\": self.pool.worker_confinement(),"
new = "\"as_of_ms\": now,\n            \"worker_confinement\": self.pool.worker_confinement(),"

[[control]]
id = "health-ignores-flow-ids"
guards = "health ignores flow_ids"
test_file = "crates/basal-module/tests/health_contract.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test health_contract"
expect_red = ["flow_health_decodes_as_core_decodes_it"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = ".is_none_or(|ids| ids.iter().any(|id| id == flow_id))"
new = ".is_none_or(|ids| ids.is_empty() || flow_id.is_empty())"

[[control]]
id = "health-s-last-run-has-no-outcome"
hub = "Health's last-run object names its outcome using the documented field, asserted by strict decoding and ops health tests"
hub_targets = ["ops"]
guards = "health's last run has no outcome"
test_file = "crates/basal-module/tests/health_contract.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test health_contract"
expect_red = ["flow_health_decodes_as_core_decodes_it"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "\"outcome\": r.state,"
new = "\"state\": r.state,"

[[control]]
id = "health-s-last-run-time-is-epoch-milliseconds-not-rfc-3339"
guards = "health's last run time is epoch milliseconds, not RFC 3339"
test_file = "crates/basal-module/tests/health_contract.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test health_contract"
expect_red = ["flow_health_decodes_as_core_decodes_it"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "\"at\": rfc3339(r.ended_at)?,"
new = "\"at\": r.ended_at,"

[[control]]
id = "health-s-overdue-age-is-null-when-nothing-is-overdue"
guards = "health's overdue age is null when nothing is overdue"
test_file = "crates/basal-module/tests/health_contract.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test health_contract"
expect_red = ["flow_health_decodes_as_core_decodes_it"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "\"oldest_overdue_age_ms\": f.oldest_overdue_ms.unwrap_or(0),"
new = "\"oldest_overdue_age_ms\": f.oldest_overdue_ms,"

[[control]]
id = "health-s-needs-reconcile-is-a-list-of-runs-not-a-boolean"
hub = "Health's needs_reconcile field is a boolean, asserted by strict health decoding and the ops reconciliation test"
hub_targets = ["ops"]
guards = "health's needs_reconcile is a list of runs, not a boolean"
test_file = "crates/basal-module/tests/health_contract.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test health_contract"
expect_red = ["flow_health_decodes_as_core_decodes_it"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "\"waiting_reason\": f.waiting_reason,\n                \"needs_reconcile\": !f.needs_reconcile.is_empty(),"
new = "\"waiting_reason\": f.waiting_reason,\n                \"needs_reconcile\": f.needs_reconcile.clone(),"

[[control]]
id = "health-s-overflowed-is-left-out"
guards = "health's overflowed is left out"
test_file = "crates/basal-module/tests/health_contract.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test health_contract"
expect_red = ["flow_health_decodes_as_core_decodes_it"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "\"overflowed\": false,"
new = "\"overflow\": false,"

[[control]]
id = "health-s-auto-disabled-is-null-when-false"
hub = "Health's auto_disabled field is always a boolean, including false, asserted by strict decoding and ops health tests"
hub_targets = ["ops"]
guards = "health's auto_disabled is null when false"
test_file = "crates/basal-module/tests/health_contract.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test health_contract"
expect_red = ["flow_health_decodes_as_core_decodes_it"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "\"auto_disabled\": f.auto_disabled,"
new = "\"auto_disabled\": f.auto_disabled.then_some(true),"

[[control]]
id = "health-s-state-is-outside-the-contract-s-enum"
hub = "An approved enabled flow is reported as enabled, never active, across strict health decoding, ops, list and install-gate tests"
hub_targets = ["install_gate", "list_contract", "ops"]
guards = "health's state is outside the contract's enum"
test_file = "crates/basal-module/tests/health_contract.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test health_contract"
expect_red = ["flow_health_decodes_as_core_decodes_it"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "(Some(_), true) => \"enabled\","
new = "(Some(_), true) => \"active\","

[[control]]
id = "health-reports-a-flow-nobody-approved-by-its-enabled-switch"
hub = "A flow with no approved version is unapproved regardless of its enabled switch, asserted by health, list and revocation tests"
hub_targets = ["health_contract", "install_gate", "list_contract"]
guards = "health reports a flow nobody approved by its enabled switch"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["health_lists_a_flow_with_no_approved_version_as_unapproved"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "(None, _) => \"unapproved\","
new = "(None, _) => if enabled { \"enabled\" } else { \"disabled\" },"

[[control]]
id = "health-does-not-say-who-disabled-a-flow"
hub = "Health normalizes a disable's author to its documented operator/owner/auto/core category, asserted by ops and strict health decoding"
hub_targets = ["health_contract"]
guards = "health does not say who disabled a flow"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["health_reports_flows_runs_and_the_module"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "\"by\": disabled_kind(by),"
new = "\"by\": by,"

[[control]]
id = "an-agent-may-install-a-flow-in-another-author-s-name"
guards = "an agent may install a flow in another author's name"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["install_refuses_what_an_agent_may_not_do"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "if p.author.as_ref().is_some_and(|a| a != agent) {"
new = "if p.author.as_ref().is_some_and(|a| a == \"nobody\" && a != agent) {"

[[control]]
id = "health-reports-no-oldest-pending-run"
hub = "Health includes the oldest pending run's age when one exists, asserted by ops and strict health-contract tests"
hub_targets = ["health_contract"]
guards = "health reports no oldest pending run"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["health_reports_flows_runs_and_the_module"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/ops.rs"
old = "oldest_pending_ms: oldest(\"pending\")?,"
new = "oldest_pending_ms: oldest(\"pending\")?.filter(|_| false),"

[[control]]
id = "health-does-not-count-failed-runs-as-consecutive-failures"
hub = "Health counts failed runs in consecutive_failures, asserted by ops health and the independently decoded health contract"
hub_targets = ["health_contract"]
guards = "health does not count failed runs as consecutive failures"
test_file = "crates/basal-module/tests/ops.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test ops"
expect_red = ["health_reports_flows_runs_and_the_module"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/ops.rs"
old = "\"failed\" | \"engine_mismatch\" => consecutive_failures += 1,"
new = "\"engine_mismatch\" => consecutive_failures += 1,"

[[control]]
id = "the-unconfigured-host-s-refusal-is-not-proven-unsent"
guards = "the unconfigured host's refusal is not proven unsent"
test_file = "crates/basal-module/tests/engine.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test engine"
expect_red = ["the_unconfigured_host_refuses_every_dispatch_as_never_sent"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/unconfigured.rs"
old = "sent: Sent::Never,"
new = "sent: Sent::Maybe(basal_host::UnknownReason::ConnectionLost),"

[[control]]
id = "flow-list-reports-a-disable-by-core-as-the-owner-s"
hub = "List and health preserve core as the disable author after revocation; list-contract and install-gate failures both assert that a core disable is reported as core"
hub_targets = ["install_gate"]
guards = "flow.list reports a disable by core as the owner's"
test_file = "crates/basal-module/tests/list_contract.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test list_contract"
expect_red = ["list_reply_decodes_against_documented_shape_and_health_state"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/ops.rs"
old = "} else if by == basal_core::install::CORE_ACTOR {"
new = "} else if false && by == basal_core::install::CORE_ACTOR { // NON-VACUITY BREAK"

[[control]]
id = "the-flow-install-request-sends-an-empty-placement-when-the-manifest-states-none"
guards = "the flow_install request sends an empty placement when the manifest states none"
test_file = "crates/basal-module/tests/install_gate.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test install_gate"
expect_red = ["placement_is_sent_only_when_the_manifest_states_one"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_consent.rs"
# A valid invented placement breaks omission without making core reject the card.
old = "let placement = f[\"placement\"].as_str().filter(|p| !p.is_empty());"
new = "let placement = Some(f[\"placement\"].as_str().filter(|p| !p.is_empty()).unwrap_or(\"not stated\")); // NON-VACUITY BREAK"

[[control]]
id = "decision-cards-every-raise-goes-out-under-a-fresh-dedup-key-so-a-changed-card-is-a-second-card"
guards = "decision cards: every raise goes out under a fresh dedup key, so a changed card is a second card"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["a_changed_decision_updates_its_card_and_another_unknown_call_gets_its_own"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_consent.rs"
old = "request[\"dedup_key\"] = json!(key);"
new = "request[\"dedup_key\"] = json!(format!(\"{key}:{}\", std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_nanos()).unwrap_or(0)));"

[[control]]
id = "decision-cards-every-raise-goes-out-under-a-fresh-dedup-key-so-a-re-raise-after-a-crash-is-a-second-card"
guards = "decision cards: every raise goes out under a fresh dedup key, so a re-raise after a crash is a second card"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["a_crash_between_the_intent_and_core_accepting_still_shows_exactly_one_card"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_consent.rs"
old = "request[\"dedup_key\"] = json!(key);"
new = "request[\"dedup_key\"] = json!(format!(\"{key}:{}\", std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_nanos()).unwrap_or(0)));"

[[control]]
id = "decision-cards-a-decision-already-answered-for-this-send-of-the-call-is-written-again"
guards = "decision cards: a decision already answered for this send of the call is written again"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["each_reconcile_option_and_the_default_on_expiry_apply_through_the_journaled_path"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/decisions.rs"
old = "        if decided {"
new = "        if decided && false {"

[[control]]
id = "decision-cards-a-changed-decision-is-not-raised-again-under-its-key"
guards = "decision cards: a changed decision is not raised again under its key"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["a_changed_decision_updates_its_card_and_another_unknown_call_gets_its_own"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/decisions.rs"
old = "card = ?3, revision = revision + 1 \\"
new = "card = ?3, revision = revision \\"

[[control]]
id = "decision-cards-an-answer-to-a-decision-settled-another-way-is-applied-instead-of-recorded-stale"
guards = "decision cards: an answer to a decision settled another way is applied instead of recorded stale"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["an_answer_after_the_decision_was_settled_another_way_is_stale"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/decisions.rs"
old = "Some(_) if !stands(tx, &card)? => {"
new = "Some(_) if false && !stands(tx, &card)? => {"

[[control]]
id = "decision-cards-an-answer-delivered-twice-is-applied-twice"
guards = "decision cards: an answer delivered twice is applied twice"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["a_duplicate_answer_changes_nothing"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/decisions.rs"
old = "if card.state != CardState::Open {"
new = "if false && card.state != CardState::Open {"

[[control]]
id = "decision-cards-the-audit-row-of-a-resolution-answered-on-a-card-omits-the-elicitation-id"
guards = "decision cards: the audit row of a resolution answered on a card omits the elicitation id"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["each_reconcile_option_and_the_default_on_expiry_apply_through_the_journaled_path"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/reconcile.rs"
old = "            Some(position),\n            detail,\n            elicitation_id,\n        )"
new = "            Some(position),\n            detail,\n            elicitation_id.filter(|_| false),\n        )"

[[control]]
id = "decision-cards-a-card-whose-raise-failed-is-recorded-as-raised-so-the-intent-is-lost"
guards = "decision cards: a card whose raise failed is recorded as raised, so the intent is lost"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["a_crash_between_the_intent_and_core_accepting_still_shows_exactly_one_card"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/engine.rs"
old = "                Err(e) => {\n                    tracing::warn!(target: \"consent\", key = %record.dedup_key"
new = "                Err(e) => {\n                    inner.rt.decision_raised(record.seq, record.revision, \"lost\")?;\n                    tracing::warn!(target: \"consent\", key = %record.dedup_key"

[[control]]
id = "decision-cards-a-page-is-acknowledged-although-applying-its-answer-failed"
guards = "decision cards: a page is acknowledged although applying its answer failed"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["a_crash_between_receiving_an_answer_and_applying_it_applies_it_exactly_once"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_consent.rs"
old = "if let Err(e) = sink.answer(&answer) {"
new = "if let Some(e) = sink.answer(&answer).err().filter(|_| false) {"

[[control]]
id = "decision-cards-it-ran-releases-an-invented-null-result-instead-of-reconciled-as-applied"
guards = "decision cards: 'It ran' releases an invented null result instead of reconciled_as_applied"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["each_reconcile_option_and_the_default_on_expiry_apply_through_the_journaled_path"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/decisions.rs"
old = "APPLIED => Resolution::ReconciledAsApplied,"
new = "APPLIED => Resolution::ObservedResult(basal_host::HostOutcome::fulfilled(basal_proto::JsonText::null())),"

[[control]]
id = "decision-cards-the-reconciled-as-applied-rejection-depends-on-when-it-was-produced"
guards = "decision cards: the reconciled_as_applied rejection depends on when it was produced"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["reconciled_as_applied_is_journaled_and_replays_the_same_rejection"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/reconcile.rs"
old = "\"the operator reconciled this call as applied; its result was not observed\","
new = "&format!(\"the operator reconciled this call as applied at {}\", crate::store::now_ms()),"

[[control]]
id = "decision-cards-an-expired-card-applies-an-action-instead-of-its-default"
guards = "decision cards: an expired card applies an action instead of its default"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["each_reconcile_option_and_the_default_on_expiry_apply_through_the_journaled_path"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/decisions.rs"
old = "let state = match answer.choice.as_deref() {"
new = "let state = match answer.choice.as_deref().or(Some(APPLIED)) {"

[[control]]
id = "decision-cards-a-re-enable-answer-does-not-enable-the-flow"
guards = "decision cards: a re-enable answer does not enable the flow"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["an_auto_disabled_flow_raises_one_reenable_card_and_each_option_applies"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/decisions.rs"
old = "install::enable(tx, &card.flow_id, now_ms)"
new = "install::enable(tx, \"\", now_ms)"

[[control]]
id = "decision-cards-an-auto-disable-writes-no-re-enable-card-intent"
guards = "decision cards: an auto-disable writes no re-enable card intent"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["an_auto_disabled_flow_raises_one_reenable_card_and_each_option_applies"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/rate.rs"
old = "crate::decisions::record_auto_disable(tx, flow_id, &rule, now_ms)?;"
new = "let _ = (&rule, now_ms);"

[[control]]
id = "decision-cards-action-options-carry-an-effect-core-does-not-take"
guards = "decision cards: action options carry an effect core does not take"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["a_run_in_needs_reconcile_raises_one_card_per_unknown_call_to_the_operator_only"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_consent.rs"
old = "pub const DECISION_ACTION_EFFECT: &str = \"choose\";"
new = "pub const DECISION_ACTION_EFFECT: &str = \"grant\";"

[[control]]
id = "decision-cards-the-default-is-an-action-rather-than-the-declining-option"
guards = "decision cards: the default is an action rather than the declining option"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["the_request_builder_reproduces_core_vectors_byte_for_byte"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_consent.rs"
old = "\"default\":default,"
new = "\"default\":card.options[0].id,"

[[control]]
id = "decision-cards-basal-sends-an-op-core-s-body-check-refuses"
guards = "decision cards: basal sends an op core's body check refuses"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["decision_requests_follow_core_rules_and_the_fake_core_refuses_any_other"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_consent.rs"
old = "op.len() <= 128 && op.split('.').count() >= 2 && op.split('.').all(segment_ok);"
new = "true || op.split('.').all(segment_ok);"

[[control]]
id = "decision-cards-the-request-carries-a-field-core-s-vectors-do-not"
guards = "decision cards: the request carries a field core's vectors do not"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["the_request_builder_reproduces_core_vectors_byte_for_byte"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_consent.rs"
old = "\"scope\":{\"flow_id\":card.flow_id},"
new = "\"scope\":{\"flow_id\":card.flow_id,\"version\":card.version},"

[[control]]
id = "decision-cards-the-body-leaves-out-the-unknown-reason"
guards = "decision cards: the body leaves out the unknown reason"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["the_request_builder_reproduces_core_vectors_byte_for_byte"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_consent.rs"
old = "            body[\"unknown_reason\"] = json!(unknown_reason.as_str());\n"
new = "            let _ = unknown_reason;\n"

[[control]]
id = "decision-cards-an-expiry-naming-an-option-is-applied-as-that-option"
guards = "decision cards: an expiry naming an option is applied as that option"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["an_expiry_is_the_decline_whatever_choice_it_names"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_consent.rs"
old = "(Some(\"expired\"), _) => None,"
new = "(Some(\"expired\"), choice) => choice.map(str::to_owned),"

[[control]]
id = "decision-cards-a-run-limit-auto-disable-is-recorded-as-a-dispatch-limit-one"
guards = "decision cards: a run-limit auto-disable is recorded as a dispatch-limit one"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["an_auto_disabled_flow_raises_one_reenable_card_and_each_option_applies"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/rate.rs"
old = "Kind::Run => basal_host::DisabledReason::RunLimitSaturated,"
new = "Kind::Run => basal_host::DisabledReason::DispatchLimitSaturated,"

[[control]]
id = "decision-cards-the-re-enable-card-records-the-other-limit-than-the-one-that-tripped"
guards = "decision cards: the re-enable card records the other limit than the one that tripped"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["an_auto_disabled_flow_raises_one_reenable_card_and_each_option_applies"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/rate.rs"
old = "            limit: max,\n"
new = "            limit: limits.max_dispatches,\n"

[[control]]
id = "decision-cards-the-prompt-misstates-why-the-outcome-is-unknown"
guards = "decision cards: the prompt misstates why the outcome is unknown"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["each_unknown_site_records_its_reason_and_the_card_shows_it"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/decisions.rs"
old = "UnknownReason::BasalRestarted => \"basal restarted before the reply was saved\","
new = "UnknownReason::BasalRestarted => \"the connection closed before a reply came\","

[[control]]
id = "unknown-reasons-a-timed-out-reply-is-recorded-as-a-lost-connection"
guards = "unknown reasons: a timed-out reply is recorded as a lost connection"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["each_unknown_site_records_its_reason_and_the_card_shows_it"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/transport.rs"
old = "Self::TimedOut(_) => Some(UnknownReason::ReplyTimeout),"
new = "Self::TimedOut(_) => Some(UnknownReason::ConnectionLost),"

[[control]]
id = "unknown-reasons-an-unreadable-reply-is-recorded-as-a-lost-connection"
guards = "unknown reasons: an unreadable reply is recorded as a lost connection"
test_file = "crates/basal-module/tests/decisions.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test decisions"
expect_red = ["each_unknown_site_records_its_reason_and_the_card_shows_it"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/transport.rs"
old = "Self::Unreadable(_) => Some(UnknownReason::ReplyUnreadable),"
new = "Self::Unreadable(_) => Some(UnknownReason::ConnectionLost),"

# broca: 28 controls

[[control]]
id = "broca-absent-usage-becomes-zero"
guards = "Broca absent usage becomes zero"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["usage_absent_empty_and_zero_remain_distinct"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "input_tokens: u.input_tokens,"
new = "input_tokens: u.input_tokens.or(Some(0)),"

[[control]]
id = "broca-fake-accepts-send-id-reuse"
guards = "Broca fake accepts send id reuse"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["fake_refuses_send_id_reuse_and_restarts_with_same_run"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/fake.rs"
old = "if old.bytes != params || &old.route != route {"
new = "if false && (old.bytes != params || &old.route != route) {"

[[control]]
id = "broca-call-sessions-lose-the-position"
hub = "Each model call's session identity includes its position as well as flow and run, asserted by reservation and global model-scope tests"
hub_targets = ["global_model_scope"]
guards = "Broca call sessions lose the position"
test_file = "crates/basal-testkit/tests/broca_reservations.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test broca_reservations"
expect_red = ["broca_usage_settles_reservation_once_and_classify_returns_a_string"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/tokens.rs"
old = "basal:flow-{flow_id}:{run_id}:{position}"
new = "basal:flow-{flow_id}:{run_id}"

[[control]]
id = "broca-value-can-masquerade-as-usage-metadata"
guards = "Broca value can masquerade as usage metadata"
test_file = "crates/basal-testkit/tests/broca_reservations.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test broca_reservations"
expect_red = ["script_value_cannot_supply_usage_and_absent_ledger_fields_are_nullable"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/tokens.rs"
old = "let report = match outcome.usage {"
new = "let report = match outcome.usage.or_else(|| serde_json::from_str::<Value>(outcome.value.as_str()).ok().and_then(|value| value.get(\"usage\").cloned()).and_then(|usage| serde_json::from_value(usage).ok())) { // NON-VACUITY BREAK"

[[control]]
id = "broca-tools-are-not-explicitly-empty"
guards = "Broca tools are not explicitly empty"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["exact_send_contract_and_parallel_sessions"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "tools: vec![],"
new = "tools: vec![json!({\"name\":\"forbidden\"})],"

[[control]]
id = "broca-output-clamp-is-ignored"
guards = "Broca output clamp is ignored"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["exact_send_contract_and_parallel_sessions"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "generation.max_output_tokens = Some(e.max_output);"
new = "generation.max_output_tokens = Some(999);"

[[control]]
id = "broca-reissue-changes-bytes"
guards = "Broca reissue changes bytes"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["reissue_after_cut_is_byte_identical_and_finished_is_immediate"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "self.transport.send(&call.route, &call.params)"
new = "self.transport.send(&call.route, &[call.params.clone(), if call.handle.is_some() { vec![b' '] } else { vec![] }].concat())"

[[control]]
id = "broca-pending-handle-is-replaced"
guards = "Broca pending handle is replaced"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["pending_submission_keeps_its_handle_and_usage_is_metadata"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "if call.handle.is_none() {\n            call.handle = Some(handle);\n        }"
new = "call.handle = Some(handle); call.handle = call.broca_run_id.clone().or_else(|| Some(\"wrong\".into()));"

[[control]]
id = "broca-completed-text-is-not-the-run-result-final-message"
guards = "Broca completed text is not the run.result final message"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["every_run_result_state_maps_to_its_outcome_and_nonterminals_wait"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "let text = &message.text;"
new = "let text = &message.mid;"

[[control]]
id = "broca-completed-run-with-empty-text-is-treated-as-missing-its-message"
guards = "Broca completed run with empty text is treated as missing its message"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["a_completed_run_without_text_fulfils_with_empty_text"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "let Some(message) = &result.final_message else {"
new = "let Some(message) = result.final_message.as_ref().filter(|m| !m.text.is_empty()) else {"

[[control]]
id = "broca-error-rejection-drops-the-error-class"
guards = "Broca error rejection drops the error class"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["every_run_result_state_maps_to_its_outcome_and_nonterminals_wait"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "json!({\"code\": \"error\", \"class\": error.class, \"message\": error.message})"
new = "json!({\"code\": \"error\", \"message\": error.message})"

[[control]]
id = "broca-cancelled-interrupted-and-max-steps-lose-their-state-code"
guards = "Broca cancelled, interrupted and max_steps lose their state code"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["every_run_result_state_maps_to_its_outcome_and_nonterminals_wait"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "other => rejection(other, \"Broca run did not complete\", usage),"
new = "_ => rejection(\"error\", \"Broca run did not complete\", usage),"

[[control]]
id = "broca-active-and-paused-runs-are-given-an-outcome"
guards = "Broca active and paused runs are given an outcome"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["every_run_result_state_maps_to_its_outcome_and_nonterminals_wait"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "if !TERMINAL_STATES.contains(&state) {"
new = "if false && !TERMINAL_STATES.contains(&state) {"

[[control]]
id = "broca-unknown-run-is-not-recognised-as-an-anomaly"
guards = "Broca unknown_run is not recognised as an anomaly"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["unknown_run_for_an_accepted_call_is_reported_as_unknown_not_rejected"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "Err(BrocaError::Refused { code, detail }) if code == UNKNOWN_RUN => {"
new = "Err(BrocaError::Refused { code, detail }) if false && code == UNKNOWN_RUN => {"

[[control]]
id = "broca-unknown-run-report-omits-the-broca-run-id"
guards = "Broca unknown_run report omits the Broca run id"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["unknown_run_for_an_accepted_call_is_reported_as_unknown_not_rejected"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "\"Broca answered unknown_run for run {run_id}, which"
new = "\"Broca answered unknown_run for a run, which"

[[control]]
id = "broca-unknown-run-leaves-the-basal-run-suspended"
guards = "Broca unknown run leaves the basal run suspended"
test_file = "crates/basal-testkit/tests/broca_reservations.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test broca_reservations"
expect_red = ["an_unknown_broca_run_moves_the_run_to_needs_reconcile_naming_it"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/journal.rs"
old = "\"cancelled\" => return Ok(Some(CompletionAck::Refused)),\n        _ => {}"
new = "_ => return Ok(Some(CompletionAck::Accepted)),"

[[control]]
id = "broca-poll-does-not-read-run-result-for-pending-calls"
hub = "Polling resolves pending model calls from run.result even after missed notifications or reconnects, asserted by Broca and scoped transport tests"
hub_targets = ["basal_host"]
guards = "Broca poll does not read run.result for pending calls"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["a_missed_run_finished_is_recovered_on_reconnect_even_when_archived"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "if call.outcome.is_none() {\n                self.resolve(call)?;\n            }"
new = ""

[[control]]
id = "broca-unwatchable-session-blocks-reading-a-finished-run"
guards = "Broca unwatchable session blocks reading a finished run"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["a_missed_run_finished_is_recovered_on_reconnect_even_when_archived"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "let watched = self.transport.watch(&call.route);"
new = "self.transport.watch(&call.route)?; let watched: Result<(), BrocaError> = Ok(());"

[[control]]
id = "broca-pending-call-is-not-watched"
hub = "Every pending model call opens a watch at the live head, asserted by completion, reconnect and scoped transport recovery tests"
hub_targets = ["basal_host"]
guards = "Broca pending call is not watched"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["a_finished_run_wakes_through_the_watch_opened_at_the_live_head"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "let watched = self.transport.watch(&call.route);"
new = "let watched: Result<(), BrocaError> = Ok(());"

[[control]]
id = "broca-outcome-settles-before-run-status-reports-usage"
guards = "Broca outcome settles before run.status reports usage"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["usage_comes_from_run_status_once_and_waits_while_status_lags"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "RunStatusResponse::Active | RunStatusResponse::Paused { .. } => {"
new = "RunStatusResponse::Active | RunStatusResponse::Paused { .. } if false => {"

[[control]]
id = "broca-outcome-waits-forever-while-run-status-says-active-or-paused-after-run-result-ended"
guards = "Broca outcome waits forever while run.status says active or paused after run.result ended"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["a_status_that_never_catches_up_charges_the_reservation_after_a_bounded_wait"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "if lagged < STATUS_LAG_POLLS {"
new = "if true || lagged < STATUS_LAG_POLLS {"

[[control]]
id = "broca-saved-outcome-is-read-from-broca-again-on-redelivery"
guards = "Broca saved outcome is read from Broca again on redelivery"
test_file = "crates/basal-testkit/tests/broca_reservations.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test broca_reservations"
expect_red = ["usage_settles_once_when_an_outcome_is_redelivered_after_a_restart"]
only = false
build_timeout_s = 3600
timeout_s = 600
edits = [
  { file = "crates/basal-host/src/broca/mod.rs", old = "if call.outcome.is_none() && call.unknown.is_none() {\n            if call.handle", new = "if call.unknown.is_none() {\n            if call.handle" },
  { file = "crates/basal-host/src/broca/mod.rs", old = "if call.outcome.is_none() {\n                self.resolve(call)?;", new = "{\n                self.resolve(call)?;" },
]

[[control]]
id = "broca-acknowledged-completion-is-delivered-again"
guards = "Broca acknowledged completion is delivered again"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["a_module_restart_with_calls_in_flight_delivers_each_exactly_once"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "call.acknowledged = true;\n        self.store.save(call)?;"
new = "call.acknowledged = false; // NON-VACUITY BREAK\n        self.store.save(call)?;"

[[control]]
id = "broca-usage-metadata-is-ignored-by-the-ledger"
hub = "Model completion usage replaces the reservation in the token ledger, asserted by reservation, token-window and crash recovery tests"
hub_targets = ["dispatch_tokens", "journal_cut"]
guards = "Broca usage metadata is ignored by the ledger"
test_file = "crates/basal-testkit/tests/broca_reservations.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test broca_reservations"
expect_red = ["broca_usage_settles_reservation_once_and_classify_returns_a_string"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/tokens.rs"
old = "Some(usage) => Report::Metadata(usage),"
new = "Some(_usage) => Report::NoEffect,"

[[control]]
id = "broca-classify-accepts-outside-labels"
guards = "Broca classify accepts outside labels"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["classify_contract_is_exact_not_trimmed_or_parsed"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "if labels.contains(text) {"
new = "if true || labels.contains(text) {"

[[control]]
id = "broca-completion-is-not-delivered-after-module-restart"
hub = "A durable model completion is delivered to the journal sink after restart, asserted by end-to-end and model-selection recovery tests"
hub_targets = ["hosts"]
guards = "Broca completion is not delivered after module restart"
test_file = "crates/basal-module/tests/e2e.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test e2e"
expect_red = ["a_broca_llm_suspends_survives_module_kill_and_settles_after_restart"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "if let Some(outcome) = &call.outcome {\n            sink.complete"
new = "if let Some(outcome) = call.outcome.as_ref().filter(|_| false) { // NON-VACUITY BREAK\n            sink.complete"

[[control]]
id = "unknown-reasons-the-host-s-reported-reason-is-not-recorded"
guards = "unknown reasons: the host's reported reason is not recorded"
test_file = "crates/basal-testkit/tests/broca_reservations.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test broca_reservations"
expect_red = ["an_unknown_broca_run_moves_the_run_to_needs_reconcile_naming_it"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/journal.rs"
old = "        params![run_id, p, reason.as_str()],"
new = "        params![run_id, p, { let _ = reason; \"connection_lost\" }],"

[[control]]
id = "unknown-reasons-broca-s-unknown-run-is-reported-as-a-lost-connection"
guards = "unknown reasons: Broca's unknown_run is reported as a lost connection"
test_file = "crates/basal-testkit/tests/broca_reservations.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test broca_reservations"
expect_red = ["an_unknown_broca_run_moves_the_run_to_needs_reconcile_naming_it"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "reason: UnknownReason::ProviderLostRun,"
new = "reason: UnknownReason::ConnectionLost,"

# hosts: 74 controls

[[control]]
id = "selector-unconfigured-selector-chooses-a-default"
guards = "selector: unconfigured selector chooses a default"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["an_unconfigured_selector_has_no_default_model"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/selector.rs"
old = "fn select(&self, _: &SelectionRequest) -> Result<ModelSelection, SelectionError> {"
new = "fn select(&self, request: &SelectionRequest) -> Result<ModelSelection, SelectionError> { return FakeSelector::default().select(request);"

[[control]]
id = "selector-no-available-model-code-lost"
guards = "selector: no_available_model code lost"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["selector_refusals_are_journaled_with_each_code_and_never_send_broca"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/selector.rs"
old = "                code,\n                detail: message,"
new = "            code: if code == \"no_available_model\" {\"wrong\".into()} else {code},\n            detail: message,"

[[control]]
id = "selector-quota-or-cooldown-exhausted-code-lost"
guards = "selector: quota_or_cooldown_exhausted code lost"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["selector_refusals_are_journaled_with_each_code_and_never_send_broca"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/selector.rs"
old = "                code,\n                detail: message,"
new = "            code: if code == \"quota_or_cooldown_exhausted\" {\"wrong\".into()} else {code},\n            detail: message,"

[[control]]
id = "selector-all-routes-inadequate-code-lost"
guards = "selector: all_routes_inadequate code lost"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["selector_refusals_are_journaled_with_each_code_and_never_send_broca"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/selector.rs"
old = "                code,\n                detail: message,"
new = "            code: if code == \"all_routes_inadequate\" {\"wrong\".into()} else {code},\n            detail: message,"

[[control]]
id = "selector-no-adequate-route-code-lost"
guards = "selector: no_adequate_route code lost"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["selector_refusals_are_journaled_with_each_code_and_never_send_broca"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/selector.rs"
old = "                code,\n                detail: message,"
new = "            code: if code == \"no_adequate_route\" {\"wrong\".into()} else {code},\n            detail: message,"

[[control]]
id = "selector-missing-required-capability-code-lost"
guards = "selector: missing_required_capability code lost"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["selector_refusals_are_journaled_with_each_code_and_never_send_broca"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/selector.rs"
old = "                code,\n                detail: message,"
new = "            code: if code == \"missing_required_capability\" {\"wrong\".into()} else {code},\n            detail: message,"

[[control]]
id = "selector-context-too-small-code-lost"
guards = "selector: context_too_small code lost"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["selector_refusals_are_journaled_with_each_code_and_never_send_broca"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/selector.rs"
old = "                code,\n                detail: message,"
new = "            code: if code == \"context_too_small\" {\"wrong\".into()} else {code},\n            detail: message,"

[[control]]
id = "selector-invalid-requirements-code-lost"
guards = "selector: invalid_requirements code lost"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["selector_refusals_are_journaled_with_each_code_and_never_send_broca"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/selector.rs"
old = "                code,\n                detail: message,"
new = "            code: if code == \"invalid_requirements\" {\"wrong\".into()} else {code},\n            detail: message,"

[[control]]
id = "selector-missing-runner-falls-back-to-selected-ids"
guards = "selector: missing runner falls back to selected ids"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["routing_selection_reply_shapes_require_runner_and_preserve_both_identities"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/selector.rs"
old = "let raw = reply.get(\"runner\").ok_or_else(|| SelectionError::Refused {\n        code: \"route_runner_missing\".into(),\n        detail: \"routing did not supply a Broca runner\".into(),\n    })?;"
new = "let fallback=json!({\"provider\":reply[\"selected\"][\"model\"][\"providerID\"],\"model\":reply[\"selected\"][\"model\"][\"modelID\"]}); let raw=reply.get(\"runner\").unwrap_or(&fallback);"

[[control]]
id = "selector-selection-checkpoint-moved-after-intent"
guards = "selector: selection checkpoint moved after intent"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["selections_freeze_at_intent_commit_and_only_uncommitted_calls_reselect"]
only = false
build_timeout_s = 3600
timeout_s = 600
edits = [
  { file = "crates/basal-core/src/driver.rs", old = "        if matches!(\n            call.kind,\n            CallKind::Primitive(Primitive::Llm | Primitive::Classify)\n        ) {\n            self.at(Boundary::ModelSelected {\n                position: call.position,\n            })?;\n        }\n        let new = NewCall {", new = "        let new = NewCall {" },
  { file = "crates/basal-core/src/driver.rs", old = "                self.at(Boundary::CallCommitted {\n                    position: call.position,\n                })?;", new = "                self.at(Boundary::CallCommitted {\n                    position: call.position,\n                })?; if matches!(call.kind, CallKind::Primitive(Primitive::Llm | Primitive::Classify)) { self.at(Boundary::ModelSelected {position:call.position})?; }" },
]

[[control]]
id = "integration-model-store-initialization-omitted"
hub = "The module binds its durable model-call store before host recovery or dispatch; model-journal, restart and eager-attachment tests all require that initialized store"
hub_targets = ["e2e", "module_lifecycle"]
guards = "integration: model store initialization omitted"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["routing_host_model_selection_and_digest_sink_share_the_journal_store"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/module.rs"
old = "initialize(store.clone())?;"
new = "let _ = initialize;"

[[control]]
id = "integration-accepted-model-subscription-wake-omitted"
guards = "integration: accepted model subscription wake omitted"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["routing_host_model_selection_and_digest_sink_share_the_journal_store"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/routing.rs"
old = "self.target(&request.kind).dispatch_committed(request);"
new = "let _ = request;"

[[control]]
id = "integration-stream-wake-omitted"
guards = "integration: stream wake omitted"
test_file = "crates/basal-host/src/broca/subc.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["broca::subc::tests::only_a_finished_run_wakes_the_host_and_closes_the_stream"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/subc.rs"
old = "self.closed.store(true, Ordering::SeqCst);\n        (wake)();"
new = "self.closed.store(true, Ordering::SeqCst);\n        let _ = wake;"

[[control]]
id = "integration-reconnect-wake-omitted"
guards = "integration: reconnect wake omitted"
test_file = "crates/basal-host/src/broca/subc.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["broca::subc::tests::stream_and_reconnect_wakeups_are_coalesced_without_a_clock"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/subc.rs"
old = "lock(streams).clear();\n    (wake)();"
new = "lock(streams).clear();\n    let _ = wake;"

[[control]]
id = "integration-every-control-event-ends-the-stream"
guards = "integration: every control event ends the stream"
test_file = "crates/basal-host/src/broca/subc.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["broca::subc::tests::only_a_finished_run_wakes_the_host_and_closes_the_stream"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/subc.rs"
old = "matches!(*unit, ControlUnit::RunFinished { .. })"
new = "{ let _ = unit; true }"

[[control]]
id = "integration-frozen-management-parameters-reserialized"
guards = "integration: frozen management parameters reserialized"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["management_envelopes_preserve_frozen_parameter_bytes"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/transport.rs"
old = "body.extend(params);"
new = "body.extend(serde_json::to_vec(&value).map_err(|e|WireError::NeverSent(e.to_string()))?);"

[[control]]
id = "integration-omitted-digest-sends-silent"
guards = "integration: omitted digest sends silent"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["omitted_digest_action_uses_each_recipient_approved_cap"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "serde_json::to_value(cap)"
new = "serde_json::to_value(\"silent\")"

[[control]]
id = "integration-dry-run-defaults-digest-to-wake"
guards = "integration: dry run defaults digest to wake"
test_file = "crates/basal-module/tests/dry_run.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test dry_run"
expect_red = ["omitted_digest_action_in_dry_runs_is_the_recipient_digest_max"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/dryrun.rs"
old = "None => manifest.digest_cap(agent),"
new = "None => Some(DigestAction::Wake),"

[[control]]
id = "selector-iq-becomes-optional"
guards = "selector: iq becomes optional"
test_file = "crates/basal-testkit/tests/dispatch_manifest.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_manifest"
expect_red = ["llm_demands_are_required_bounded_and_default_eq_is_zero"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/manifest.rs"
old = "pub iq: u32,"
new = "#[serde(default)]\n    pub iq: u32,"

[[control]]
id = "selector-iq-upper-bound-omitted"
guards = "selector: iq upper bound omitted"
test_file = "crates/basal-testkit/tests/dispatch_manifest.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_manifest"
expect_red = ["llm_demands_are_required_bounded_and_default_eq_is_zero"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/manifest.rs"
old = "if llm.iq > 100 {"
new = "if false {"

[[control]]
id = "selector-eq-upper-bound-omitted"
guards = "selector: eq upper bound omitted"
test_file = "crates/basal-testkit/tests/dispatch_manifest.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_manifest"
expect_red = ["llm_demands_are_required_bounded_and_default_eq_is_zero"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/manifest.rs"
old = "if llm.eq > 100 {"
new = "if false {"

[[control]]
id = "selector-script-model-guard-omitted-before-routing"
guards = "selector: script model guard omitted before routing"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["script_model_or_provider_is_rejected_before_selection_even_if_it_matches"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "(args.get(\"model\").is_some() || args.get(\"provider\").is_some())"
new = "false"

[[control]]
id = "selector-broker-script-model-guard-omitted"
guards = "selector: broker script model guard omitted"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["broker_rejects_script_model_choices_even_with_a_valid_journaled_selection"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "e.request.get(\"model\").is_some() || e.request.get(\"provider\").is_some()"
new = "false"

[[control]]
id = "selector-flow-target-changed"
guards = "selector: flow target changed"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["routing_select_request_bytes_are_exact_without_available_models"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/selector.rs"
old = "\"targetAgent\":\"flow\""
new = "\"targetAgent\":\"operator\""

[[control]]
id = "selector-demands-swapped"
guards = "selector: demands swapped"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["routing_select_request_bytes_are_exact_without_available_models"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/selector.rs"
old = "\"iq\":request.iq,\"eq\":request.eq"
new = "\"iq\":request.eq,\"eq\":request.iq"

[[control]]
id = "selector-availablemodels-added"
guards = "selector: availableModels added"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["routing_select_request_bytes_are_exact_without_available_models"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/selector.rs"
old = "\"substrate\":\"broca\""
new = "\"substrate\":\"broca\",\"availableModels\":[]"

[[control]]
id = "selector-runner-mapped-from-registry-identities"
guards = "selector: runner mapped from registry identities"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["routing_selection_reply_shapes_require_runner_and_preserve_both_identities"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/selector.rs"
old = "pub fn decode_selection(reply: Value) -> Result<ModelSelection, SelectionError> {"
new = "pub fn decode_selection(mut reply: Value) -> Result<ModelSelection, SelectionError> { reply[\"runner\"] = json!({\"provider\":reply[\"selected\"][\"model\"][\"providerID\"],\"model\":reply[\"selected\"][\"model\"][\"modelID\"]});"

[[control]]
id = "selector-registry-variant-not-journaled"
guards = "selector: registry variant not journaled"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["routing_selection_reply_shapes_require_runner_and_preserve_both_identities"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/selector.rs"
old = "        variant,\n        decision_id:"
new = "        variant: None,\n        decision_id:"

[[control]]
id = "selector-unreachable-retry-bound-omitted"
guards = "selector: unreachable retry bound omitted"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["unreachable_selector_retries_boundedly_then_journals_route_unavailable"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "retries >= self.rt.config.unavailable_retries"
new = "retries >= u32::MAX"

[[control]]
id = "selector-provider-refusal-code-lost-in-journal"
guards = "selector: provider refusal code lost in journal"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["selector_refusals_are_journaled_with_each_code_and_never_send_broca"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "return Err(Refusal::new(code, detail));"
new = "return Err(Refusal::new(\"route_unavailable\", detail));"

[[control]]
id = "selector-reissue-changes-selected-runner"
guards = "selector: reissue changes selected runner"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["selections_freeze_at_intent_commit_and_only_uncommitted_calls_reselect"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/runtime.rs"
old = "args: row.dispatch_args(),"
new = "args: { let mut v: serde_json::Value = serde_json::from_str(row.dispatch_args().as_str()).map_err(|_| ()).unwrap_or(serde_json::Value::Null); v[\"selection\"][\"runner\"][\"model\"] = serde_json::json!(\"wrong\"); JsonText::new(v.to_string()).unwrap_or_else(|_| JsonText::null()) },"

[[control]]
id = "selector-outcome-report-omitted"
hub = "A model outcome reports the exact selected decision ID best-effort, asserted by Broca reporting and real scoped transport tests"
hub_targets = ["basal_host"]
guards = "selector: outcome report omitted"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["model_outcomes_report_the_selected_decision_best_effort"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = ".report_outcome(&call.selection.decision_id, outcome)"
new = ".report_outcome(\"wrong-decision\", outcome)"

[[control]]
id = "selector-outcome-failure-blocks-completion"
guards = "selector: outcome failure blocks completion"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["model_outcomes_report_the_selected_decision_best_effort"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "tracing::warn!(%error,\"model routing outcome report failed\");"
new = "return Err(BrocaError::Wire(error.to_string()));"

[[control]]
id = "selector-cancelled-outcome-marked-completed"
guards = "selector: cancelled outcome marked completed"
test_file = "crates/basal-host/tests/broca.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca"
expect_red = ["model_outcomes_report_the_selected_decision_best_effort"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/broca/mod.rs"
old = "Some(\"cancelled\") => ModelOutcome::Cancelled"
new = "Some(\"cancelled\") => ModelOutcome::Completed"

[[control]]
id = "selector-decision-outcome-key-changed"
guards = "selector: decision outcome key changed"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["routing_select_request_bytes_are_exact_without_available_models"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/selector.rs"
old = "\"decisionID\":decision_id,\"outcome\":outcome"
new = "\"decisionID\":\"wrong\",\"outcome\":outcome"

[[control]]
id = "hosts-facts-request-groups-discarded"
guards = "hosts: facts request groups discarded"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["core_requests_match_c3_c4_field_for_field"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_host.rs"
old = "\"fields\":args[\"options\"].get(\"fields\").cloned().unwrap_or(json!([\"identity\",\"residence\",\"activity\",\"attention\"]))"
new = "\"fields\":[]"

[[control]]
id = "hosts-facts-identity-validation-bypassed"
guards = "hosts: facts identity validation bypassed"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["fact_identity_and_clock_fields_are_required_without_normalising_leaves"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_host.rs"
old = "Primitive::Facts => {\n            value[\"agent_id\"].is_string()"
new = "Primitive::Facts => {\n            true || value[\"agent_id\"].is_string()"

[[control]]
id = "hosts-facts-unknown-activity-normalised-to-idle"
guards = "hosts: facts unknown activity normalised to idle"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["fact_identity_and_clock_fields_are_required_without_normalising_leaves"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_host.rs"
old = "if valid {\n        Ok(value)"
new = "if valid {\n        let mut value = value; if kind == Primitive::Facts { value[\"activity\"][\"state\"][\"value\"] = json!(\"idle\"); value[\"activity\"][\"state\"][\"status\"] = json!(\"ok\"); }\n        Ok(value)"

[[control]]
id = "hosts-journaled-class-not-passed-to-transport-host"
guards = "hosts: journaled class not passed to transport host"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["catalog_changes_cannot_execute_mutations_under_a_query_retry_policy"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/runtime.rs"
old = ".dispatch_classified(&request, expected_class)"
new = ".dispatch(&request)"

[[control]]
id = "hosts-routing-loses-journaled-class"
guards = "hosts: routing loses journaled class"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["catalog_changes_cannot_execute_mutations_under_a_query_retry_policy"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/routing.rs"
old = ".dispatch_classified(request, class)"
new = ".dispatch(request)"

[[control]]
id = "hosts-changed-operation-kind-accepted"
guards = "hosts: changed operation kind accepted"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["catalog_changes_cannot_execute_mutations_under_a_query_retry_policy"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/routing.rs"
old = "expected.is_some_and(|class| {\n                class.safe_to_repeat() && class != self.declared_class(module, op, &decl)\n            })"
new = "false /* NON-VACUITY BREAK */"

[[control]]
id = "hosts-consent-provider-refusal-treated-as-outage"
guards = "hosts: consent provider refusal treated as outage"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["consent_refusal_codes_and_unknown_transport_are_typed"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_consent.rs"
old = "ConsentError::Refused(format!(\"{code}: {message}\"))"
new = "ConsentError::Unavailable(format!(\"{code}: {message}\"))"

[[control]]
id = "hosts-expiry-tombstone-identity-is-not-retrieved"
guards = "hosts: expiry tombstone identity is not retrieved"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["expired_answer_tombstones_read_the_owned_record_before_ack"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_consent.rs"
old = "record.get(\"flow_install\").is_none()"
new = "false"

[[control]]
id = "hosts-keyed-tool-contract-ignored"
guards = "hosts: keyed tool contract ignored"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["operator_keyed_tools_retry_but_unfenceable_tools_do_not"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/routing.rs"
old = "self.keyed.contains(&(module.to_owned(), op.to_owned()))"
new = "false"

[[control]]
id = "hosts-status-revision-substituted"
guards = "hosts: status revision substituted"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["core_requests_match_c3_c4_field_for_field"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_host.rs"
old = "\"revision\":created_at"
new = "\"revision\":0"

[[control]]
id = "hosts-status-replay-marker-ignored"
guards = "hosts: status replay marker ignored"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["sink_reply_missing_fields_and_wrong_types_are_unknown_outcomes"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_host.rs"
old = "Primitive::SinkStatus => {\n            value[\"replayed\"].is_boolean()"
new = "Primitive::SinkStatus => {\n            true"

[[control]]
id = "hosts-missing-management-op-accepted"
guards = "hosts: missing management op accepted"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["catalog_install_refuses_missing_ops_and_events_and_marks_mutations"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/subc_catalog.rs"
# Invent a declaration only for a missing op, without changing existing ones.
old = "        Ok((found, flow_capable))"
new = "        Ok((found.or_else(|| Some(CatalogOp { // NON-VACUITY BREAK\n            declaration: OpDecl { kind: Some(OpKind::Query), cause_echo: false, shell_capable: false },\n            surface: Surface::Management, execution_mode: None,\n        })), flow_capable))"

[[control]]
id = "hosts-undeclared-events-fabricated"
guards = "hosts: undeclared events fabricated"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["catalog_install_refuses_missing_ops_and_events_and_marks_mutations"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/subc_catalog.rs"
old = "fn event(&self, _: &str, _: &str, _: u32) -> Option<EventDecl> {\n        None\n    }"
new = "fn event(&self, _: &str, _: &str, _: u32) -> Option<EventDecl> { Some(EventDecl { origin: crate::EventOrigin::Internal, body: crate::EventBody::Inline }) }"

[[control]]
id = "hosts-registry-admission-bypassed"
guards = "hosts: registry admission bypassed"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["denylist_and_paged_agent_registry_fail_closed"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/subc_catalog.rs"
old = "self.known_agent(agent).unwrap_or(false)"
new = "true"

[[control]]
id = "hosts-shell-denylist-disabled"
guards = "hosts: shell denylist disabled"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["denylist_and_paged_agent_registry_fail_closed"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/subc_catalog.rs"
old = ".any(|(m, o)| m.eq_ignore_ascii_case(module) && o.eq_ignore_ascii_case(op))"
new = ".any(|_| false)"

[[control]]
id = "hosts-declining-answer-approves"
guards = "hosts: declining answer approves"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["decline_and_expiry_are_rejections_and_unrecognised_answers_are_not_acked"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_consent.rs"
old = "(Some(\"answered\"), Some(\"decline\")) | (Some(\"expired\"), _) => CardDecision::Reject"
new = "(Some(\"answered\"), Some(\"decline\")) | (Some(\"expired\"), _) => CardDecision::Approve"

[[control]]
id = "hosts-proven-unsent-becomes-unknown"
guards = "hosts: proven unsent becomes unknown"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["transport_certainty_and_tool_key_are_explicit"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/transport.rs"
old = "CallError::NotSent(e) => WireError::NeverSent(e.to_string())"
new = "CallError::NotSent(e) => WireError::Unknown(e.to_string())"

[[control]]
id = "hosts-unknown-becomes-provably-unsent"
guards = "hosts: unknown becomes provably unsent"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["transport_certainty_and_tool_key_are_explicit"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/transport.rs"
old = "None => WireError::Unknown(message),"
new = "None => WireError::NeverSent(message),"

[[control]]
id = "hosts-subscription-backpressure-becomes-provably-unsent"
guards = "hosts: subscription backpressure becomes provably unsent"
test_file = "crates/basal-host/src/transport.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["transport::tests::every_call_error_variant_maps_to_never_sent_or_one_unknown_reason"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/transport.rs"
old = "other => WireError::Unknown(other.to_string())"
new = "other => WireError::NeverSent(other.to_string())"

[[control]]
id = "hosts-tool-key-omitted"
guards = "hosts: tool key omitted"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["transport_certainty_and_tool_key_are_explicit"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/transport.rs"
old = "request.call_key = Some(call_key.to_owned());"
new = "request.call_key = None;"

[[control]]
id = "hosts-provider-refusal-fulfilled"
guards = "hosts: provider refusal fulfilled"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["every_core_refusal_retains_its_code"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_host.rs"
old = "JsonText::new(json!({\"code\":code,\"message\":message}).to_string())\n                .map(|v| Dispatched::Completed(HostOutcome::rejected(v)))"
new = "JsonText::new(json!({\"code\":code,\"message\":message}).to_string())\n                .map(|v| Dispatched::Completed(HostOutcome::fulfilled(v)))"

[[control]]
id = "hosts-closed-sink-decoder-bypassed"
guards = "hosts: closed sink decoder bypassed"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["closed_sink_dispositions_and_unknown_facts_survive"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_host.rs"
old = "if valid {"
new = "if true {"

[[control]]
id = "hosts-sink-idempotency-disabled"
hub = "Sink writes honour the journaled idempotency key so safe retries and recovery do not duplicate an effect, asserted by host, decision and end-to-end tests"
hub_targets = ["decisions", "e2e"]
guards = "hosts: sink idempotency disabled"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["transport_failures_reach_journal_with_safe_retries_only"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_host.rs"
old = "honours_idempotency_keys: true"
new = "honours_idempotency_keys: false"

[[control]]
id = "hosts-management-mutation-marked-query"
hub = "Management mutations retain their declared mutation kind and are never retried as queries, asserted by catalog, decision and transport safety tests"
hub_targets = ["decisions"]
guards = "hosts: management mutation marked query"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["catalog_install_refuses_missing_ops_and_events_and_marks_mutations"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/subc_catalog.rs"
old = "ManagementOperationKind::Mutate => OpKind::Mutate"
new = "ManagementOperationKind::Mutate => OpKind::Query"

[[control]]
id = "hosts-unfenceable-tool-becomes-repeatable"
guards = "hosts: unfenceable tool becomes repeatable"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["operator_keyed_tools_retry_but_unfenceable_tools_do_not"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/routing.rs"
old = "!unfenceable"
new = "true"

[[control]]
id = "hosts-consent-hash-changed"
guards = "hosts: consent hash changed"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["consent_hash_matches_shared_vectors_and_full_c2_envelope"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_consent.rs"
old = "\"args_digest\":hash"
new = "\"args_digest\":\"wrong\""

[[control]]
id = "hosts-exact-manifest-bytes-trimmed"
guards = "hosts: exact manifest bytes trimmed"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["install_card_is_byte_exact_and_scope_comes_from_the_route_stamp"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_consent.rs"
old = "\"manifest_json\":manifest"
new = "\"manifest_json\":manifest.trim()"

[[control]]
id = "hosts-the-consent-request-sends-a-session-ref-with-a-scope-author"
guards = "hosts: the consent request sends a session_ref with a scope author"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["install_card_is_byte_exact_and_scope_comes_from_the_route_stamp"]
only = false
build_timeout_s = 3600
timeout_s = 600
edits = [
  { file = "crates/basal-host/src/core_consent.rs", old = "let result = json!({\"kind\":\"flow_install\"", new = "let mut result = json!({\"kind\":\"flow_install\"" },
  { file = "crates/basal-host/src/core_consent.rs", old = "    Ok(result)\n}", new = "    result[\"session_ref\"] = f.get(\"session_ref\").cloned().unwrap_or(json!(\"ses-from-the-bind\"));\n    Ok(result)\n}" },
]

[[control]]
id = "hosts-answer-acknowledged-despite-failed-decision-commit"
guards = "hosts: answer acknowledged despite failed decision commit"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["decisions_ack_only_after_sink_commit_and_survive_restart"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_consent.rs"
old = ".map_err(|e| ConsentError::Unavailable(e.to_string()))"
new = ".or(Ok(())) // NON-VACUITY BREAK"

[[control]]
id = "hosts-approval-decoded-as-rejection"
hub = "Core's answered approve choice decodes as approval, asserted by decision acknowledgements, decision recovery and install-gate tests"
hub_targets = ["decisions", "install_gate"]
guards = "hosts: approval decoded as rejection"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["decisions_ack_only_after_sink_commit_and_survive_restart"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_consent.rs"
old = "(Some(\"answered\"), Some(\"approve\")) => CardDecision::Approve"
new = "(Some(\"answered\"), Some(\"approve\")) => CardDecision::Reject"

[[control]]
id = "hosts-reissue-ignores-journaled-envelope"
hub = "Resends use the frozen journaled envelope rather than script arguments, asserted by sink, model-selection and end-to-end recovery tests"
hub_targets = ["e2e"]
guards = "hosts: reissue ignores journaled envelope"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["journaled_sink_intent_is_byte_identical_after_a_cut"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/runtime.rs"
old = "args: row.dispatch_args(),"
new = "args: row.args.clone(),"

[[control]]
id = "hosts-core-routing-bypassed"
hub = "Core primitives dispatch through the core host, including journaled sink writes, asserted by routing and decision recovery tests"
hub_targets = ["decisions"]
guards = "hosts: core routing bypassed"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["routing_host_runs_install_decision_facts_ops_and_sinks_end_to_end"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/routing.rs"
old = ") => self.core.as_ref(),"
new = ") => self.model.as_ref(),"

[[control]]
id = "hosts-an-install-status-code-hash-is-accepted-in-any-form"
guards = "hosts: an install status code hash is accepted in any form"
test_file = "crates/basal-module/tests/install_gate.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test install_gate"
expect_red = ["install_status_replies_decode_strictly"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_host.rs"
old = "Some(h) if is_code_hash(h) => Ok(h.to_owned()),"
new = "Some(h) => Ok(h.to_owned()),"

[[control]]
id = "hosts-an-unknown-install-status-carrying-a-hash-is-accepted"
guards = "hosts: an unknown install status carrying a hash is accepted"
test_file = "crates/basal-module/tests/install_gate.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test install_gate"
expect_red = ["install_status_replies_decode_strictly"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_host.rs"
old = "Some(\"unknown\") if hash.is_none_or(Value::is_null) => Ok(InstallStatus::Unknown),"
new = "Some(\"unknown\") => Ok(InstallStatus::Unknown),"

[[control]]
id = "hosts-the-routing-host-does-not-send-the-install-status-question-to-core"
hub = "The routing host asks core for install status before activation or resumed decision work, asserted by gate and decision recovery tests"
hub_targets = ["decisions"]
guards = "hosts: the routing host does not send the install status question to core"
test_file = "crates/basal-module/tests/install_gate.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test install_gate"
expect_red = ["active_with_the_runs_code_hash_activates"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/routing.rs"
old = "self.core.install_status(flow_id, version)"
new = "self.ops.install_status(flow_id, version)"

[[control]]
id = "unknown-reasons-a-reply-deadline-is-recorded-as-a-lost-connection"
guards = "unknown reasons: a reply deadline is recorded as a lost connection"
test_file = "crates/basal-host/src/transport.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["transport::tests::deadline_is_a_reply_timeout"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/transport.rs"
old = "Some(OutcomeUnknownCause::Deadline) => WireError::TimedOut(message),"
new = "Some(OutcomeUnknownCause::Deadline) => WireError::Unknown(message),"

[[control]]
id = "unknown-reasons-a-failed-completion-inside-the-client-is-recorded-as-a-lost-connection"
guards = "unknown reasons: a failed completion inside the client is recorded as a lost connection"
test_file = "crates/basal-host/src/transport.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["transport::tests::completion_failed_is_an_unreadable_reply"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/transport.rs"
old = "Some(OutcomeUnknownCause::CompletionFailed) => WireError::Unreadable(message),"
new = "Some(OutcomeUnknownCause::CompletionFailed) => WireError::Unknown(message),"

[[control]]
id = "unknown-reasons-capability-resolver-errors-count-as-maybe-sent"
guards = "unknown reasons: capability resolver errors count as maybe sent"
test_file = "crates/basal-host/src/transport.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["transport::tests::every_call_error_variant_maps_to_never_sent_or_one_unknown_reason"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/transport.rs"
old = "| CallError::InvalidCapabilityIdentifier { .. }) => WireError::NeverSent(e.to_string()),"
new = "| CallError::InvalidCapabilityIdentifier { .. }) => WireError::Unknown(e.to_string()),"

[[control]]
id = "unknown-reasons-core-s-unrecognised-reply-is-recorded-as-a-lost-connection"
guards = "unknown reasons: core's unrecognised reply is recorded as a lost connection"
test_file = "crates/basal-module/tests/hosts.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test hosts"
expect_red = ["closed_sink_dispositions_and_unknown_facts_survive"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/core_host.rs"
old = "Err(WireError::Unreadable(\"unrecognised core reply\".into()))"
new = "Err(WireError::Unknown(\"unrecognised core reply\".into()))"

# builtins: 22 controls

[[control]]
id = "fs-a-path-is-not-required-to-lie-under-a-root-symlink-out"
hub = "Every resolved filesystem path remains under a granted root, including symlink, missing-path and compromised-envelope checks in both dispatch targets"
hub_targets = ["builtins_dispatch"]
guards = "fs: a path is not required to lie under a root (symlink out)"
test_file = "crates/basal-testkit/tests/builtins_fs.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_fs"
expect_red = ["a_symlink_resolving_outside_the_root_is_refused"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/builtins/fs.rs"
old = "roots.iter().any(|root| path.starts_with(root))"
new = "!roots.is_empty() // NON-VACUITY BREAK"

[[control]]
id = "fs-a-path-is-not-required-to-lie-under-a-root-missing-path"
hub = "Every resolved filesystem path remains under a granted root, including symlink, missing-path and compromised-envelope checks in both dispatch targets"
hub_targets = ["builtins_dispatch"]
guards = "fs: a path is not required to lie under a root (missing path)"
test_file = "crates/basal-testkit/tests/builtins_fs.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_fs"
expect_red = ["stat_of_a_missing_path_is_exists_false_only_when_its_parent_is_in_scope"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/builtins/fs.rs"
old = "roots.iter().any(|root| path.starts_with(root))"
new = "!roots.is_empty() // NON-VACUITY BREAK"

[[control]]
id = "fs-the-open-follows-a-symlink-in-the-last-component"
guards = "fs: the open follows a symlink in the last component"
test_file = "crates/basal-testkit/tests/builtins_fs.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_fs"
expect_red = ["a_symlink_swapped_into_the_last_component_after_the_check_is_not_followed"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/builtins/fs.rs"
old = "let mut flags = libc::O_NOFOLLOW | libc::O_CLOEXEC | libc::O_NONBLOCK;"
new = "let mut flags = libc::O_CLOEXEC | libc::O_NONBLOCK; // NON-VACUITY BREAK"

[[control]]
id = "fs-the-opened-file-s-real-path-is-not-checked-again"
guards = "fs: the opened file's real path is not checked again"
test_file = "crates/basal-testkit/tests/builtins_fs.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_fs"
expect_red = ["a_directory_swapped_for_a_symlink_after_the_check_is_caught_after_the_open"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/builtins/fs.rs"
old = "verify(file.as_raw_fd(), None, roots)?;"
new = "// NON-VACUITY BREAK"

[[control]]
id = "git-a-repository-s-core-fsmonitor-is-honoured"
guards = "git: a repository's core.fsmonitor is honoured"
test_file = "crates/basal-testkit/tests/builtins_git.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_git"
expect_red = ["a_repository_config_cannot_make_a_built_in_run_a_program"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/builtins/git.rs"
old = "\"core.fsmonitor=false\","
new = "\"core.quotePath=true\", // NON-VACUITY BREAK"

[[control]]
id = "git-any-repository-counts-as-approved"
guards = "git: any repository counts as approved"
test_file = "crates/basal-testkit/tests/builtins_git.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_git"
expect_red = ["git_reads_only_approved_repositories"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/builtins/git.rs"
old = ".any(|r| r == real);"
new = ".any(|_| true); // NON-VACUITY BREAK"

[[control]]
id = "net-a-non-https-url-is-fetched"
guards = "net: a non-https URL is fetched"
test_file = "crates/basal-testkit/tests/builtins_net.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_net"
expect_red = ["only_https_urls_are_fetched"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/builtins/net.rs"
old = "if !text[..scheme_end].eq_ignore_ascii_case(\"https\") {"
new = "if false { // NON-VACUITY BREAK"

[[control]]
id = "net-redirect-hops-are-not-checked-against-the-allowlist"
guards = "net: redirect hops are not checked against the allowlist"
test_file = "crates/basal-testkit/tests/builtins_net.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_net"
expect_red = ["a_redirect_to_an_unapproved_host_is_refused"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/builtins/net.rs"
old = "let approval = allowed_url(rules, &url, &method);"
new = "let approval = allowed_url(rules, &url, &method).or_else(|d| if redirects == 0 || !is_query_method(&method) { Err(d) } else { Ok(()) }); // NON-VACUITY BREAK"

[[control]]
id = "net-a-redirect-not-followed-after-a-mutation-is-reported-as-refused"
guards = "net: a redirect not followed after a mutation is reported as refused"
test_file = "crates/basal-testkit/tests/builtins_net.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_net"
expect_red = ["a_post_redirected_to_an_unapproved_host_returns_the_redirect"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/builtins/net.rs"
old = "    match redirected {"
new = "    match redirected.filter(|_| false) { // NON-VACUITY BREAK"

[[control]]
id = "net-a-refused-body-after-a-mutation-refuses-the-whole-call"
guards = "net: a refused body after a mutation refuses the whole call"
test_file = "crates/basal-testkit/tests/builtins_net.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_net"
expect_red = ["a_post_whose_body_is_refused_still_answers_with_status_and_headers"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/builtins/net.rs"
old = "fn refuse_body(effect_possible: bool, refusal: Denial) -> Result<&'static str, Failure> {"
new = "fn refuse_body(_: bool, refusal: Denial) -> Result<&'static str, Failure> { let effect_possible = false; // NON-VACUITY BREAK"

[[control]]
id = "net-an-unreadable-answer-after-a-mutation-is-a-refusal"
guards = "net: an unreadable answer after a mutation is a refusal"
test_file = "crates/basal-testkit/tests/builtins_net.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_net"
expect_red = ["a_post_whose_answer_is_unreadable_has_an_unknown_outcome"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/builtins/net.rs"
old = "fn unreadable(effect_possible: bool, detail: String) -> Failure {"
new = "fn unreadable(_: bool, detail: String) -> Failure { let effect_possible = false; // NON-VACUITY BREAK"

[[control]]
id = "net-a-private-address-is-connected-to"
guards = "net: a private address is connected to"
test_file = "crates/basal-testkit/tests/builtins_net.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_net"
expect_red = ["a_host_resolving_to_loopback_is_refused_before_connecting"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/builtins/net.rs"
old = "&& let Some(bad) = addrs.iter().find(|a| !is_public(a.ip()))"
new = "&& let Some(bad) = addrs.iter().find(|_| false) // NON-VACUITY BREAK"

[[control]]
id = "net-the-connection-resolves-the-host-again-instead-of-using-the-checked-address"
guards = "net: the connection resolves the host again instead of using the checked address"
test_file = "crates/basal-testkit/tests/builtins_net.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_net"
expect_red = ["the_connection_goes_to_the_address_that_was_checked"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/builtins/net.rs"
old = "for addr in addrs.iter().take(MAX_ADDRESS_ATTEMPTS) {"
new = "let addrs = self.config.resolver.resolve(&url.host, url.port).unwrap_or_default(); // NON-VACUITY BREAK\n        for addr in addrs.iter().take(MAX_ADDRESS_ATTEMPTS) {"

[[control]]
id = "net-a-body-over-the-cap-is-read-whole"
guards = "net: a body over the cap is read whole"
test_file = "crates/basal-testkit/tests/builtins_net.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_net"
expect_red = ["an_oversized_body_is_refused"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/builtins/net.rs"
old = "if length > cap {"
new = "if false { // NON-VACUITY BREAK"

[[control]]
id = "classes-net-fetch-of-any-method-is-a-query"
guards = "classes: net.fetch of any method is a query"
test_file = "crates/basal-testkit/tests/builtins_dispatch.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_dispatch"
expect_red = ["each_built_in_is_journaled_with_its_class"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/builtins/mod.rs"
old = "Ok(m) if net::is_query_method(&m) => CallClass::Query,"
new = "Ok(_) => CallClass::Query, // NON-VACUITY BREAK"

[[control]]
id = "classes-fs-write-does-not-honour-idempotency-keys"
guards = "classes: fs.write does not honour idempotency keys"
test_file = "crates/basal-testkit/tests/builtins_dispatch.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_dispatch"
expect_red = ["recovery_reissues_queries_and_writes_and_reconciles_a_post"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/builtins/mod.rs"
old = "Primitive::FsWrite => Some(CallClass::Mutation {\n            honours_idempotency_keys: true,"
new = "Primitive::FsWrite => Some(CallClass::Mutation {\n            honours_idempotency_keys: false, // NON-VACUITY BREAK"

[[control]]
id = "authorize-a-built-in-s-scope-is-not-checked-in-the-parent"
guards = "authorize: a built-in's scope is not checked in the parent"
test_file = "crates/basal-testkit/tests/builtins_dispatch.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_dispatch"
expect_red = ["calls_outside_the_manifest_are_refused_in_the_parent_and_journaled"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/authorize.rs"
old = "basal_host::builtins::authorize(&call, &grant).map_err(|d| Refusal::new(d.code, d.message))?;"
new = "let _ = &call; // NON-VACUITY BREAK"

[[control]]
id = "install-a-root-that-does-not-exist-is-accepted"
guards = "install: a root that does not exist is accepted"
test_file = "crates/basal-testkit/tests/builtins_dispatch.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_dispatch"
expect_red = ["install_refuses_bad_roots_hosts_and_methods"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "let exists = basal_host::builtins::expand_home(root).is_some_and(|p| p.exists());"
new = "let exists = root.starts_with('/') || root.starts_with('~'); // NON-VACUITY BREAK"

[[control]]
id = "install-wildcard-and-ip-literal-hosts-are-accepted"
guards = "install: wildcard and IP-literal hosts are accepted"
test_file = "crates/basal-testkit/tests/builtins_dispatch.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_dispatch"
expect_red = ["install_refuses_bad_roots_hosts_and_methods"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/manifest.rs"
old = "if let Some(problem) = basal_host::builtins::net::host_problem(&f.host) {"
new = "if let Some(problem) = None::<&str> { // NON-VACUITY BREAK"

[[control]]
id = "install-any-method-name-is-accepted"
guards = "install: any method name is accepted"
test_file = "crates/basal-testkit/tests/builtins_dispatch.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_dispatch"
expect_red = ["install_refuses_bad_roots_hosts_and_methods"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/manifest.rs"
old = "if !basal_host::builtins::net::METHODS.contains(&m.as_str()) {"
new = "if m.is_empty() { // NON-VACUITY BREAK"

[[control]]
id = "install-private-text-with-a-fetch-grant-raises-no-warning"
guards = "install: private text with a fetch grant raises no warning"
test_file = "crates/basal-testkit/tests/builtins_dispatch.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test builtins_dispatch"
expect_red = ["private_text_with_a_fetch_grant_warns"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "if reads_text && let Some(net) = &manifest.net {"
new = "if !reads_text && let Some(net) = &manifest.net { // NON-VACUITY BREAK"

[[control]]
id = "dry-run-live-mode-runs-built-ins-that-are-not-queries"
guards = "dry run: live mode runs built-ins that are not queries"
test_file = "crates/basal-module/tests/dry_run.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test dry_run"
expect_red = ["dry_runs_capture_every_built_in_and_live_runs_only_reads_in_scope"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-module/src/dryrun.rs"
old = "                    == Some(CallClass::Query)"
new = "                    != None // NON-VACUITY BREAK"

# Flow scope controls: scoped routes, per-call model sessions, readiness
# refusals, and the identity of an uncaught host rejection.

[[control]]
id = "flow-model-sessions-collapse-to-the-flow"
guards = "each model call has its own scoped conversation, preserved on recovery"
test_file = "crates/basal-host/src/transport.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["transport::tests::scoped_model_calls_keep_per_call_sessions_across_runs_and_recovery"]
only = true
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/transport.rs"
old = "self.open_scoped_handle(flow, target, Some(&identity), identity.clone())"
new = "let identity = BindIdentity::new(\"/\", \"basal\", format!(\"basal:flow:{flow}\")); // NON-VACUITY BREAK\n        self.open_scoped_handle(flow, target, Some(&identity), identity.clone())"

[[control]]
id = "flow-readiness-rejection-identity-is-not-tracked"
guards = "only the actual uncaught host rejection carries its journal position"
test_file = "crates/basal-testkit/tests/flow_scopes.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test flow_scopes"
expect_red = ["only_the_uncaught_readiness_rejection_object_is_exempt_from_failures"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-worker/src/prelude.js"
old = "ReflectApply(weakMapSet, hostRejections, [error, position]);"
new = "if (position === 0) ReflectApply(weakMapSet, hostRejections, [error, position]); // NON-VACUITY BREAK"

[[control]]
id = "flow-scoped-open-is-not-used"
guards = "provider routes must use core's selector"
test_file = "crates/basal-host/src/transport.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["transport::tests::real_subc_transport_opens_scoped_ops_and_models_and_reuses_routes"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/transport.rs"
old = """
let handle = self
                .consumer
                .open_route_scoped(
                    target.clone(),
                    bind,
                    plan.scope.selector(),
                    CallOptions {
                        timeout: self.timeout,
                        ..Default::default()
                    },
                )
                .await
                .map_err(map_error)?;"""
new = """
let options = CallOptions { timeout:self.timeout, ..Default::default() };
            let handle = if identity.is_none() { // NON-VACUITY BREAK
                self.consumer.open_route(target.clone(), bind, options).await
            } else {
                self.consumer.open_route_scoped(target.clone(), bind, plan.scope.selector(), options).await
            }.map_err(map_error)?;"""

[[control]]
id = "flow-route-cache-is-not-reused"
hub = "An unchanged flow selector reuses its scoped route handle, asserted by route-cache unit, integration and real transport tests"
hub_targets = ["basal_host"]
guards = "one route per selector and target is reused"
test_file = "crates/basal-host/tests/flow_scope_routes.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test flow_scope_routes"
expect_red = ["route_cache_reuses_handles_and_replaces_changed_selectors"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/flow_scope.rs"
old = "if let Some((_, handle, _)) = self.routes.get(&key) {"
new = "if let Some((_, handle, _)) = self.routes.get(&key).filter(|_| false) { // NON-VACUITY BREAK"

[[control]]
id = "flow-new-selector-is-ignored"
hub = "A changed flow selector replaces the old scope and route handle, asserted by route-cache unit, integration and scoped transport tests"
hub_targets = ["basal_host"]
guards = "epoch and ref changes replace the old route"
test_file = "crates/basal-host/tests/flow_scope_routes.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test flow_scope_routes"
expect_red = ["route_cache_reuses_handles_and_replaces_changed_selectors"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/flow_scope.rs"
old = "if let Some((_, key)) = self.flows.remove(flow) {"
new = "let scope = self.flows.get(flow).map(|(registered, _)| registered.clone()).or(scope); // NON-VACUITY BREAK\n        if let Some((_, key)) = self.flows.remove(flow) {"

[[control]]
id = "flow-scope-close-is-not-recorded"
guards = "a daemon scope close never reopens the old scoped route"
test_file = "crates/basal-host/src/transport.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["transport::tests::real_subc_transport_opens_scoped_ops_and_models_and_reuses_routes"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/transport.rs"
old = "routes.control_push(&push, |handle| handle.channel);"
new = "let _ = (&mut routes, &push); // NON-VACUITY BREAK"

[[control]]
id = "flow-selector-plumbing-is-scoped"
guards = "routing selection remains unscoped while its Broca send is scoped"
test_file = "crates/basal-host/src/transport.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["transport::tests::real_subc_transport_opens_scoped_ops_and_models_and_reuses_routes"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/selector.rs"
old = ".management(\"prefrontal-routing\", \"route.select\", select_params(request))"
new = ".management_for_flow(&request.flow_id, \"prefrontal-routing\", \"route.select\", select_params(request)) // NON-VACUITY BREAK"

[[control]]
id = "flow-no-selector-is-deferred"
guards = "no_flow_scope cannot be represented as deferred state"
test_file = "crates/basal-core/src/schema_flow_deferral_tests.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["schema::flow_deferral_tests::deferred_state_requires_closed_typed_refusal_and_retry_metadata"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/schema.rs"
old = "'scope_unsupported', 'resource_busy', 'consent_unavailable'))"
new = "'scope_unsupported', 'resource_busy', 'consent_unavailable', 'no_flow_scope')) /* NON-VACUITY BREAK */"

[[control]]
id = "flow-target-readiness-preflight-is-disabled"
guards = "missing flow_scope_targets reject before forwarding while VM activation remains allowed"
test_file = "crates/basal-testkit/tests/flow_scopes.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test flow_scopes"
expect_red = ["unsupported_target_preflight_rejects_without_sending_but_run_activates"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/flow_scope.rs"
old = "if !scope.targets.contains(module) {"
new = "if false && !scope.targets.contains(module) { // NON-VACUITY BREAK"

[[control]]
id = "flow-scope-not-carrier-is-ordinary-rejection"
guards = "scope_not_carrier is a typed bounded unsent deferral"
test_file = "crates/basal-testkit/tests/flow_scopes.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test flow_scopes"
expect_red = ["scope_not_carrier_is_deferred_unsent"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/flow_refusal.rs"
old = "\"scope_not_carrier\" => RefusalReason::ScopeNotCarrier,"
new = "\"scope_not_carrier\" => return Ok(None), // NON-VACUITY BREAK"

[[control]]
id = "flow-scope-ended-is-ordinary-rejection"
guards = "scope_ended is a typed bounded unsent deferral"
test_file = "crates/basal-testkit/tests/flow_scopes.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test flow_scopes"
expect_red = ["scope_ended_is_deferred_unsent"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/flow_refusal.rs"
old = "\"scope_ended\" => RefusalReason::ScopeEnded,"
new = "\"scope_ended\" => return Ok(None), // NON-VACUITY BREAK"

[[control]]
id = "flow-stale-scope-is-ordinary-rejection"
guards = "scope_not_live is a typed bounded unsent deferral"
test_file = "crates/basal-testkit/tests/flow_scopes.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test flow_scopes"
expect_red = ["scope_not_live_is_deferred_unsent"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/flow_refusal.rs"
old = "\"scope_not_live\" => RefusalReason::ScopeNotLive,"
new = "\"scope_not_live\" => return Ok(None), // NON-VACUITY BREAK"

[[control]]
id = "flow-unsynced-scope-is-ordinary-rejection"
guards = "scope_not_synced is a typed bounded unsent deferral"
test_file = "crates/basal-testkit/tests/flow_scopes.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test flow_scopes"
expect_red = ["scope_not_synced_is_deferred_unsent"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/flow_refusal.rs"
old = "\"scope_not_synced\" => RefusalReason::ScopeNotSynced,"
new = "\"scope_not_synced\" => return Ok(None), // NON-VACUITY BREAK"

[[control]]
id = "flow-target-unsupported-is-deferred"
guards = "target_flow_unsupported ends the unsent call and refunds dispatch counting"
test_file = "crates/basal-testkit/tests/flow_scopes.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test flow_scopes"
expect_red = ["daemon_target_flow_unsupported_rejects_without_dispatch_or_failure_count"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/flow_refusal.rs"
old = "RefusalReason::NoFlowScope | RefusalReason::TargetFlowUnsupported"
new = "RefusalReason::NoFlowScope // NON-VACUITY BREAK"

[[control]]
id = "flow-busy-hint-is-not-decoded"
guards = "resource_busy reads the shared validated relative retry hint"
test_file = "crates/basal-host/src/flow_refusal.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["flow_refusal::tests::resource_busy_uses_shared_type_and_validates"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/flow_refusal.rs"
old = "refusal.retry_after_ms = Some(busy.retry_after_ms);"
new = "refusal.retry_after_ms = None; // NON-VACUITY BREAK"

[[control]]
id = "flow-consent-is-automatically-retried"
guards = "consent_unavailable awaits an explicit operator grant"
test_file = "crates/basal-testkit/tests/flow_scopes.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test flow_scopes"
expect_red = ["consent_unavailable_waits_for_explicit_grant_and_names_provider_action"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/runtime.rs"
old = "let retry = if refusal.reason == RefusalReason::ConsentUnavailable {"
new = "let retry = if false && refusal.reason == RefusalReason::ConsentUnavailable { // NON-VACUITY BREAK"

[[control]]
id = "flow-retired-agent-is-retryable"
guards = "agent_retired is permanent and disables through core"
test_file = "crates/basal-testkit/tests/flow_scopes.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test flow_scopes"
expect_red = ["agent_retired_fails_and_core_disables_without_auto_disable_count"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/flow_refusal.rs"
old = "\"agent_retired\" => RefusalReason::AgentRetired,"
new = "\"agent_retired\" => RefusalReason::ConsentUnavailable, // NON-VACUITY BREAK"

[[control]]
id = "flow-required-scope-bug-is-suspended"
guards = "flow_scope_required fails loudly for every provider without retry"
test_file = "crates/basal-testkit/tests/flow_scopes.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test flow_scopes"
expect_red = ["flow_scope_required_from_multiple_targets_fails_unsent_without_retry"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-host/src/flow_refusal.rs"
old = "\"flow_scope_required\" => RefusalReason::FlowScopeRequired,"
new = "\"flow_scope_required\" => RefusalReason::ConsentUnavailable, // NON-VACUITY BREAK"

[[control]]
id = "flow-deferred-call-resends-early"
guards = "cold-store recovery respects retry_not_before"
test_file = "crates/basal-testkit/tests/flow_scope_recovery.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test flow_scope_recovery"
expect_red = ["reopening_store_never_resends_early_and_keeps_position_and_call_key"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/driver.rs"
old = "if retry <= self.rt.config.clock.now_ms() {"
new = "if true || retry <= self.rt.config.clock.now_ms() { // NON-VACUITY BREAK"

[[control]]
id = "flow-deferred-resend-changes-call-key"
hub = "Scope-deferred and crash-recovered resends preserve the committed call key, asserted by scope, reconciliation and crash recovery tests"
hub_targets = ["journal_cut", "journal_kill", "journal_unknown"]
guards = "resend retains the original journal position and call key"
test_file = "crates/basal-testkit/tests/flow_scope_recovery.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test flow_scope_recovery"
expect_red = ["reopening_store_never_resends_early_and_keeps_position_and_call_key"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/runtime.rs"
old = "idempotency_key: row.idempotency_key.clone(),"
new = "idempotency_key: format!(\"{}-changed\", row.idempotency_key), // NON-VACUITY BREAK"

[[control]]
id = "flow-expiry-leaves-unsent-obligations-open"
guards = "expiry settles unsent deferred calls and recovery never sends them"
test_file = "crates/basal-testkit/tests/flow_scopes.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test flow_scopes"
expect_red = ["resource_busy_wait_uses_relative_hint_and_counts_against_expiry"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/runs.rs"
old = "for (run_id, _) in &expired {\n        crate::journal::expire_deferred(tx, run_id)?;"
new = "for (run_id, _) in &expired { // NON-VACUITY BREAK"

[[control]]
id = "flow-busy-wait-exceeds-run-deadline"
guards = "resource_busy wait is capped by the absolute existing deadline"
test_file = "crates/basal-testkit/tests/flow_scopes.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test flow_scopes"
expect_red = ["resource_busy_hint_is_capped_by_existing_run_deadline"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/runtime.rs"
old = "deadline.map_or(retry, |d| retry.min(d))"
new = "deadline.map_or(retry, |_| retry) // NON-VACUITY BREAK"

[[control]]
id = "flow-core-op-install-capability-check-is-disabled"
guards = "core manifest ops require catalog flow-scopes/v1"
test_file = "crates/basal-module/tests/flow_scope_capabilities.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test flow_scope_capabilities"
expect_red = ["core_op_install_requires_catalog_capability_for_every_author"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "if module == basal_host::subc_catalog::CORE && !catalog.supports_flow_scopes(module) {"
new = "if false && module == basal_host::subc_catalog::CORE && !catalog.supports_flow_scopes(module) { // NON-VACUITY BREAK"

[[control]]
id = "flow-core-op-dry-run-capability-check-is-disabled"
guards = "dry run rechecks core's catalog opt-in"
test_file = "crates/basal-module/tests/flow_scope_capabilities.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test flow_scope_capabilities"
expect_red = ["dry_run_rechecks_core_op_catalog_capability"]
only = false
build_timeout_s = 3600
timeout_s = 600
file = "crates/basal-core/src/install.rs"
old = "if module == basal_host::subc_catalog::CORE && !catalog.supports_flow_scopes(module) {"
new = "if false && module == basal_host::subc_catalog::CORE && !catalog.supports_flow_scopes(module) { // NON-VACUITY BREAK"

# A test-fixture control: the pool test harness must stop waiting at its own
# deadline and reap the workers it started, so a stalled pool test fails by
# name instead of hanging the suite.

[[control]]
id = "pool-fixture-wait-has-no-deadline"
guards = "a stalled pool fixture fails within its own deadline and reaps its workers"
test_file = "crates/basal-module/tests/pool.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test pool"
expect_red = ["a_wait_deadline_stops_and_reaps_its_workers"]
only = false
build_timeout_s = 3600
# The broad runner covers the whole package; the guard keeps its own short deadline.
timeout_s = 600
file = "crates/basal-testkit/src/harness.rs"
old = "if Instant::now() >= deadline {"
new = "if false && Instant::now() >= deadline { // NON-VACUITY BREAK"

[[control]]
id = "rig-model-send-tools-check-omitted"
guards = "Model evidence must reject attached tools"
file = "crates/basal-rig/src/models.rs"
old = 'send["tools"] == json!([]) && send["tool_choice"] == json!({"type":"none"})'
new = 'send["tool_choice"] == json!({"type":"none"}) // NON-VACUITY BREAK: ignore attached tools.'
edits = []
test_file = "crates/basal-rig/src/models.rs"
runner = "cargo"
package = "basal-rig"
platforms = ["macos"]
target = "--lib"
expect_red = ["models::tests::tools_evidence_requires_empty_tools_and_explicit_none"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "rig-model-selection-missing-decision-identity"
guards = "A Luna selection must carry a nonempty routing decision id"
file = "crates/basal-rig/src/models.rs"
old = """
        && selection["decisionID"]
            .as_str()
            .is_some_and(|s| !s.is_empty())"""
new = "        // NON-VACUITY BREAK: omit the decision identity."
edits = []
test_file = "crates/basal-rig/src/models.rs"
runner = "cargo"
package = "basal-rig"
platforms = ["macos"]
target = "--lib"
expect_red = ["models::tests::only_a_complete_luna_selection_passes"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "rig-model-usage-fabricates-zero-unreported-charge"
guards = "Missing capped usage retains the unmeasured reservation"
file = "crates/basal-rig/src/models.rs"
old = 'charge["unreported_tokens"] == unreported'
new = 'charge["unreported_tokens"] == unreported.saturating_sub(unreported) // NON-VACUITY BREAK: fabricate zero unmeasured usage.'
edits = []
test_file = "crates/basal-rig/src/models.rs"
runner = "cargo"
package = "basal-rig"
platforms = ["macos"]
target = "--lib"
expect_red = ["models::tests::usage_evidence_distinguishes_fresh_input_and_reservation"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "rig-model-result-rejects-completed-empty-text"
guards = "Completed empty visible text is valid but a missing transcript is not"
file = "crates/basal-rig/src/models.rs"
old = 'text.is_some_and(|t| result["text"] == t)'
new = 'text.is_some_and(|t| !t.is_empty() && result["text"] == t) // NON-VACUITY BREAK: reject a valid empty result.'
edits = []
test_file = "crates/basal-rig/src/models.rs"
runner = "cargo"
package = "basal-rig"
platforms = ["macos"]
target = "--lib"
expect_red = ["models::tests::completed_empty_text_is_valid_but_missing_transcript_is_not"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "rig-broca-evidence-ignores-bind-project-root"
guards = "Independent Broca run evidence must match the complete bind identity"
file = "crates/basal-rig/src/stores.rs"
old = "WHERE json_extract(session, '$.project_root') = ?1"
new = "WHERE ?1 = ?1 -- NON-VACUITY BREAK: ignore the project root."
edits = []
test_file = "crates/basal-rig/tests/stores.rs"
runner = "cargo"
package = "basal-rig"
platforms = ["macos"]
target = "--test stores"
expect_red = ["independent_broca_evidence_matches_the_entire_bind_and_counts_duplicate_runs"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "rig-model-journal-reader-discards-clamped-request"
guards = "Model journal evidence reads the durable selected request, not authored args"
file = "crates/basal-rig/src/stores.rs"
old = "COALESCE(j.request, j.args)"
new = "j.args /* NON-VACUITY BREAK: ignore journal.request */"
edits = []
test_file = "crates/basal-rig/tests/stores.rs"
runner = "cargo"
package = "basal-rig"
platforms = ["macos"]
target = "--test stores"
expect_red = ["model_journal_and_ledger_reads_are_scoped_to_the_run_and_preserve_missing_usage"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "rig-ownership-evidence-invents-principal-from-harness"
guards = "Broca ownership evidence must retain the daemon-attested principal"
file = "crates/basal-rig/src/stores.rs"
old = '"first_principal": owner["first_principal"]'
new = '"first_principal": {"kind": "reserved", "module_id": route["harness"]} /* NON-VACUITY BREAK: invent authority from a harness label */'
edits = []
test_file = "crates/basal-rig/tests/stores.rs"
runner = "cargo"
package = "basal-rig"
platforms = ["macos"]
target = "--test stores"
expect_red = ["ownership_reads_brocas_attestation_not_the_callers_harness_label"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "rig-crash-checkpoint-discards-clamped-request"
guards = "Crash-boundary evidence captures the selected request before host dispatch"
file = "crates/basal-module/src/rig_kill.rs"
old = "SELECT COALESCE(request, args), dispatch, attempts, settlement FROM journal WHERE run_id = ?1 AND position = ?2"
new = "SELECT args, dispatch, attempts, settlement FROM journal WHERE run_id = ?1 AND position = ?2 -- NON-VACUITY BREAK: discard clamped request evidence"
edits = []
test_file = "crates/basal-module/src/rig_kill.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--lib"
expect_red = ["rig_kill::tests::crash_evidence_records_the_unsent_journal_not_a_later_outcome"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "rig-routing-pin-accepts-a-catalog-without-luna"
guards = "the routing pin refuses a served catalog without openai/gpt-6-luna"
file = "script/flows-rig.sh"
old = 'if "openai/gpt-6-luna" not in models:'
new = "if False:"
edits = []
test_file = "script/tests/flows_rig.py"
runner = "command"
platforms = ["linux"]
command = ["python3", "-m", "unittest", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ["script.tests.flows_rig.RigChecks.test_pin_uses_served_providers_and_refuses_missing_luna"]
only = false
timeout_s = 120
build_timeout_s = 1800

[[control]]
id = "rig-credential-check-accepts-extra-credentials"
guards = "the rig vault must hold exactly one active apikey:openai credential"
file = "script/flows-rig.sh"
old = "if len(rows) != 1 or"
new = "if len(rows) < 1 or"
edits = []
test_file = "script/tests/flows_rig.py"
runner = "command"
platforms = ["linux"]
command = ["python3", "-m", "unittest", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ["script.tests.flows_rig.RigChecks.test_credential_inventory_requires_one_active_openai_binding"]
only = false
timeout_s = 120
build_timeout_s = 1800

[[control]]
id = "rig-grant-plan-tolerates-unexpected-grants"
guards = "the rig vault may hold no grants beyond Broca's read and routing's list"
file = "script/flows-rig.sh"
old = "if not existing <= allowed:"
new = "if False:"
edits = []
test_file = "script/tests/flows_rig.py"
runner = "command"
platforms = ["linux"]
command = ["python3", "-m", "unittest", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ["script.tests.flows_rig.RigChecks.test_grant_plan_is_exact_and_idempotent"]
only = false
timeout_s = 120
build_timeout_s = 1800

[[control]]
id = "rig-auth-omits-the-explicit-key-path"
guards = "every rig auth command names the rig's own master-key file"
file = "script/flows-rig.sh"
old = '--data-dir "$VAULT_DIR" --key-path "$VAULT_KEY" --subc "$CONN"'
new = '--data-dir "$VAULT_DIR" --subc "$CONN"'
edits = []
test_file = "script/tests/flows_rig.py"
runner = "command"
platforms = ["linux"]
command = ["python3", "-m", "unittest", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ["script.tests.flows_rig.RigChecks.test_auth_dry_runs_name_all_three_rig_paths_without_reading_payload"]
only = false
timeout_s = 120
build_timeout_s = 1800

[[control]]
id = "rig-auth-path-check-ignores-final-symlinks"
guards = "auth paths are resolved through a final symlink before the inside-the-rig check"
file = "script/flows-rig.sh"
old = "if not os.path.realpath(path).startswith(root):"
new = "if not os.path.abspath(path).startswith(root):"
edits = []
test_file = "script/tests/flows_rig.py"
runner = "command"
platforms = ["linux"]
command = ["python3", "-m", "unittest", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ["script.tests.flows_rig.RigChecks.test_auth_refuses_a_final_key_symlink_outside_the_rig"]
only = false
timeout_s = 120
build_timeout_s = 1800

[[control]]
id = "rig-scope-ref-mismatch-accepted"
guards = "Broca scope ref must equal core registration"
file = "crates/basal-rig/src/models.rs"
old = '&& scope["ref"] == registered["ref"]'
new = "&& true // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-rig/src/models.rs"
runner = "cargo"
package = "basal-rig"
platforms = ["macos"]
target = "--lib"
expect_red = ["models::tests::scope_evidence_rejects_mismatched_ref_epoch_owner_and_missing_fields"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "rig-scope-epoch-mismatch-accepted"
guards = "Broca scope epoch must equal core registration"
file = "crates/basal-rig/src/models.rs"
old = '&& scope["scope_epoch"] == registered["epoch"]'
new = "&& true // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-rig/src/models.rs"
runner = "cargo"
package = "basal-rig"
platforms = ["macos"]
target = "--lib"
expect_red = ["models::tests::scope_evidence_rejects_mismatched_ref_epoch_owner_and_missing_fields"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "rig-successful-non-carrier-open-accepted"
guards = "the direct carrier probe must be refused by the daemon"
file = "crates/basal-rig/src/models.rs"
old = 'reply["refused"]["code"] == "scope_not_carrier"'
new = "reply.is_object() // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-rig/src/models.rs"
runner = "cargo"
package = "basal-rig"
platforms = ["macos"]
target = "--lib"
expect_red = ["models::tests::carrier_evidence_requires_the_daemons_exact_non_carrier_refusal"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "rig-unrefused-unscoped-send-accepted"
guards = "the unscoped send must have been refused with flow_scope_required"
file = "crates/basal-rig/src/models.rs"
old = """
snapshot["outcome"]["rejected"] == true
        && snapshot["outcome"]["value"]
            .as_str()
            .and_then(|s| serde_json::from_str::<Value>(s).ok())
            .is_some_and(|v| v["code"] == "flow_scope_required")"""
new = "snapshot.is_object() // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-rig/src/models.rs"
runner = "cargo"
package = "basal-rig"
platforms = ["macos"]
target = "--lib"
expect_red = ["models::tests::negative_send_evidence_requires_a_rejected_flow_scope_required_outcome"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "rig-unscoped-hook-fires-for-unarmed-flow"
guards = "only the flow named by the arming file can send unscoped once"
file = "crates/basal-module/src/rig_kill.rs"
old = "armed.flow_id.is_empty() || flow_id != Some(armed.flow_id.as_str())"
new = "armed.flow_id.is_empty() || flow_id.is_none() /* NON-VACUITY BREAK */"
edits = []
test_file = "crates/basal-module/src/rig_kill.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--lib"
expect_red = ["rig_kill::tests::unscoped_send_fires_only_for_the_armed_flow_once"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "stage-schema-rise-condition"
guards = "the update requests a store backup exactly when its schema rises"
file = "script/stage.sh"
old = '  if [ "$BUILD_SCHEMA" -gt "$LIVE_SCHEMA" ]; then'
new = '  if [ "$BUILD_SCHEMA" -ge "$LIVE_SCHEMA" ]; then # NON-VACUITY BREAK'
edits = []
test_file = "script/tests/stage_card.py"
runner = "command"
platforms = ["linux"]
command = ["python3", "-m", "unittest", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ["script.tests.stage_card.StageCardChecks.test_migrates_exactly_when_schema_rises"]
only = false
timeout_s = 120
build_timeout_s = 1800

[[control]]
id = "stage-worker-first-order"
guards = "the new worker is placed before the parent restart"
file = "script/stage.sh"
old = '''
1. Worker first, without restarting the parent:
   \`place-module.sh --module basal --staged $(shell_quote "$STAGE_DIR/ck-basal-worker") --marker $(shell_quote "$WORKER_MARKER") --control $(shell_quote "$WORKER_CONTROL") --dest ~/.local/share/cortexkit/bin/ck-basal-worker --no-restart\`
2. Then ck-basal, with the default update restart:
   \`place-module.sh --module basal --staged $(shell_quote "$STAGE_DIR/ck-basal") --marker $(shell_quote "$BASAL_MARKER") --control $(shell_quote "$BASAL_CONTROL")$MIGRATES_ARG\`'''
new = '''
1. Parent first: NON-VACUITY BREAK
   \`place-module.sh --module basal --staged $(shell_quote "$STAGE_DIR/ck-basal") --marker $(shell_quote "$BASAL_MARKER") --control $(shell_quote "$BASAL_CONTROL")$MIGRATES_ARG\`
2. Worker last:
   \`place-module.sh --module basal --staged $(shell_quote "$STAGE_DIR/ck-basal-worker") --marker $(shell_quote "$WORKER_MARKER") --control $(shell_quote "$WORKER_CONTROL") --dest ~/.local/share/cortexkit/bin/ck-basal-worker --no-restart\`'''
edits = []
test_file = "script/tests/stage_card.py"
runner = "command"
platforms = ["linux"]
command = ["python3", "-m", "unittest", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ["script.tests.stage_card.StageCardChecks.test_worker_first_without_restart_then_parent_restart"]
only = false
timeout_s = 120
build_timeout_s = 1800

[[control]]
id = "stage-marker-refusal"
guards = "invalid staged or live markers refuse the update card"
file = "script/stage.sh"
old = '    [ "$staged_marker" -ge 1 ] && [ "$live_marker" -eq 0 ] \'
new = '''
    # NON-VACUITY BREAK
    [ "$staged_marker" -ge 0 ] && [ "$live_marker" -ge 0 ] \'''
edits = []
test_file = "script/tests/stage_card.py"
runner = "command"
platforms = ["linux"]
command = ["python3", "-m", "unittest", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ["script.tests.stage_card.StageCardChecks.test_marker_refusal_writes_no_card"]
only = false
timeout_s = 120
build_timeout_s = 1800

[[control]]
id = "stage-push-event-ci-filter"
guards = "the card reports the push CI run rather than a newer scheduled audit"
file = "script/stage.sh"
old = '  gh run list --repo cortexkit/basal --workflow CI --commit "$SHA" --event push --limit 1 \'
new = '''
  # NON-VACUITY BREAK
  gh run list --repo cortexkit/basal --workflow CI --commit "$SHA" --limit 1 \'''
edits = []
test_file = "script/tests/stage_card.py"
runner = "command"
platforms = ["linux"]
command = ["python3", "-m", "unittest", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ["script.tests.stage_card.StageCardChecks.test_push_event_ci_run_not_newer_nightly"]
only = false
timeout_s = 120
build_timeout_s = 1800

[[control]]
id = "dispatch-driver-wait-loses-its-short-deadline"
guards = "a deliberately stalled activation driver reaches its short wait deadline and returns its worker for reaping"
file = "crates/basal-testkit/tests/dispatch_slots.rs"
old = "const STALLED_DRIVER_WAIT: Duration = Duration::from_secs(3);"
new = "const STALLED_DRIVER_WAIT: Duration = Duration::from_secs(60); // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-testkit/tests/dispatch_slots.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test dispatch_slots"
expect_red = ["a_stuck_driver_wait_deadline_releases_and_reaps_its_worker"]
only = true
# The broad runner covers the whole package; the guard keeps its own short deadline.
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "install-agent-owned-foreign-targets"
hub = "Agent targets and install_refuses_what_an_agent_may_not_do both assert that an agent's ordinary install can grant only its own identity, never another agent"
hub_targets = ["ops"]
guards = "agent-owned flows cannot target another agent"
file = "crates/basal-core/src/install.rs"
old = 'if author != crate::decisions::OPERATOR_ACTOR && author != "local:unverified" {'
new = 'if false && author != crate::decisions::OPERATOR_ACTOR && author != "local:unverified" { // NON-VACUITY BREAK'
edits = []
test_file = "crates/basal-module/tests/agent_targets.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test agent_targets"
expect_red = ["agent_owned_manifests_reject_foreign_targets_before_install_and_dry_run"]
# Both targets intentionally assert the same self-only install restriction.
only = false
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "flow-scope-fixture-keeps-the-production-activation-deadline"
guards = "a deliberately stalled scope activation reaches its short deadline and reaps its worker"
file = "crates/basal-testkit/tests/flow_scopes.rs"
old = "const STALLED_ACTIVATION_WAIT: Duration = Duration::from_secs(3);"
new = "const STALLED_ACTIVATION_WAIT: Duration = Duration::from_secs(60); // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-testkit/tests/flow_scopes.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test flow_scopes"
expect_red = ["a_stalled_scope_activation_deadline_reaps_its_worker"]
only = true
# The broad runner covers the whole package; the guard keeps its own short deadline.
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "install-agent-owned-foreign-facts-targets"
guards = "agent ownership restriction includes facts targets"
file = "crates/basal-core/src/install.rs"
old = "if target_id != author {"
new = 'if field != "facts.targets" && target_id != author { // NON-VACUITY BREAK'
edits = []
test_file = "crates/basal-module/tests/agent_targets.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test agent_targets"
expect_red = ["agent_owned_manifests_reject_foreign_targets_before_install_and_dry_run"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "ownership-driver-wait-loses-its-short-deadline"
guards = "a deliberately stalled ownership driver reaches its short wait deadline and returns its worker for reaping"
file = "crates/basal-testkit/tests/journal_ownership.rs"
old = "const STALLED_OWNER_DRIVER_WAIT: Duration = Duration::from_secs(3);"
new = "const STALLED_OWNER_DRIVER_WAIT: Duration = Duration::from_secs(60); // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-testkit/tests/journal_ownership.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test journal_ownership"
expect_red = ["a_stuck_ownership_driver_wait_deadline_releases_and_reaps_its_worker"]
only = true
# The broad runner covers the whole package; the guard keeps its own short deadline.
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "install-reserved-package-instance-id"
guards = "plain installs cannot squat on package instance flow ids"
file = "crates/basal-module/src/ops.rs"
old = "if manifest.id.rsplit_once('_').is_some_and(|(_, suffix)| {"
new = "if false && manifest.id.rsplit_once('_').is_some_and(|(_, suffix)| { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-module/tests/agent_targets.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test agent_targets"
expect_red = ["plain_install_cannot_occupy_package_instance_ids"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "cargo-path-dependency-outside-workspace-is-accepted"
guards = "Cargo path dependencies outside the workspace are refused"
file = "script/check-path-deps.py"
old = "if manifest_path != root and root not in manifest_path.parents:"
new = "if False and manifest_path != root and root not in manifest_path.parents: # NON-VACUITY BREAK"
edits = []
test_file = "script/tests/check_path_deps.py"
runner = "command"
platforms = ["linux"]
command = ["python3", "-m", "unittest", "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ["script.tests.check_path_deps.PathDependencyChecks.test_outside_path_dependency_is_refused_and_named"]
only = false
timeout_s = 120
build_timeout_s = 1800

[[control]]
id = "package-self-only"
guards = "package agent fields must name only self"
file = "crates/basal-core/src/packages.rs"
old = 'if manifest.agents().iter().any(|(_, agent)| *agent != "$self") {'
new = 'if false && manifest.agents().iter().any(|(_, agent)| *agent != "$self") { // NON-VACUITY BREAK'
edits = []
test_file = "crates/basal-module/tests/packages.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test packages"
expect_red = ["packages_require_self_in_every_agent_field"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "install-self-requires-package"
guards = "ordinary installs explicitly refuse self agent fields"
file = "crates/basal-core/src/install.rs"
old = 'if manifest.agents().iter().any(|(_, agent)| *agent == "$self") {'
new = 'if false && manifest.agents().iter().any(|(_, agent)| *agent == "$self") { // NON-VACUITY BREAK'
edits = []
test_file = "crates/basal-module/tests/packages.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test packages"
expect_red = ["ordinary_installs_refuse_self_in_every_agent_field"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "instance-stale-generation"
guards = "lower generations cannot change an instance"
file = "crates/basal-core/src/packages.rs"
old = "if incoming < current {"
new = "if false && incoming < current { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-module/tests/packages.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test packages"
expect_red = ["generations_fence_stale_calls_and_record_absent_removals"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "instance-absent-removal-generation"
guards = "removal records ordering even when no instance exists"
file = "crates/basal-core/src/packages.rs"
old = 'record_generation(tx, package, agent, incoming, "remove", None, &reply)?;'
new = 'if changed != 0 { record_generation(tx, package, agent, incoming, "remove", None, &reply)?; } // NON-VACUITY BREAK'
edits = []
test_file = "crates/basal-module/tests/packages.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test packages"
expect_red = ["generations_fence_stale_calls_and_record_absent_removals"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "instance-removal-preserves-enable"
guards = "instance removal never changes enable state or disable actor"
file = "crates/basal-core/src/packages.rs"
old = '"UPDATE flows SET removed=1 WHERE flow_id=?1 AND package IS NOT NULL AND removed=0",'
new = """"UPDATE flows SET removed=1,state='disabled',disabled_by='core' WHERE flow_id=?1 AND package IS NOT NULL AND removed=0", // NON-VACUITY BREAK"""
edits = []
test_file = "crates/basal-module/tests/packages.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test packages"
expect_red = ["removal_and_reensure_never_change_enable_state_or_actor"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "package-core-only-callers"
guards = "package get and instance management admit only unscoped core"
file = "crates/basal-module/src/ops.rs"
old = "if !permitted {"
new = "if false && !permitted { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-module/tests/packages.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test packages"
expect_red = ["package_callers_are_core_only_except_operator_registration"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "package-version-immutable"
guards = "a registered version refuses different code bytes"
file = "crates/basal-core/src/packages.rs"
old = "if existing.as_ref().is_some_and(|p| p.code_hash != hash) {"
new = "if false && existing.as_ref().is_some_and(|p| p.code_hash != hash) { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-module/tests/packages.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test packages"
expect_red = ["registered_versions_are_immutable_and_get_returns_exact_bytes"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "instance-self-owner-resolution"
guards = "self grants resolve to the stable instance owner before dispatch"
file = "crates/basal-core/src/authorize.rs"
old = 'if agent == "$self" {'
new = 'if false && agent == "$self" { // NON-VACUITY BREAK'
edits = []
test_file = "crates/basal-testkit/tests/package_instances.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test package_instances"
expect_red = ["self_grants_resolve_to_the_owner_and_sink_calls_carry_stable_id"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "instance-agent-lookup-outside-writer"
guards = "core agent lookup must happen before the SQLite writer is held"
file = "crates/basal-core/src/packages.rs"
old = """
let known_agent = self.catalog().agent_id(agent).as_deref() == Some(agent);
        decide(self, |tx| {"""
new = """
decide(self, |tx| {
            let known_agent = self.catalog().agent_id(agent).as_deref() == Some(agent); // NON-VACUITY BREAK"""
edits = []
test_file = "crates/basal-testkit/tests/package_instances.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test package_instances"
expect_red = ["instance_agent_lookup_leaves_the_sqlite_writer_available"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "instance-removal-pauses-schedule"
guards = "removed instances must neither plan fires nor accumulate rejection rows"
file = "crates/basal-core/src/packages.rs"
old = "if changed != 0 {"
new = "if false && changed != 0 { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-testkit/tests/package_instances.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test package_instances"
expect_red = ["removed_instance_schedule_pauses_and_resumes_without_catch_up"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "instance-reensure-resumes-schedule"
guards = "re-ensure must resume enabled removed instances after now without catch-up"
file = "crates/basal-core/src/packages.rs"
old = "if was_removed && !install::is_disabled(tx, &id)? {"
new = "if false && was_removed && !install::is_disabled(tx, &id)? { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-testkit/tests/package_instances.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test package_instances"
expect_red = ["removed_instance_schedule_pauses_and_resumes_without_catch_up"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "instance-revocation-preserves-enable"
guards = "instance revocation must not disable a flow that can select a newer package version"
file = "crates/basal-core/src/install.rs"
old = "if package.is_some() {"
new = """
if package.is_some() {
        disable(tx, flow_id, &Actor::Core, reason, now_ms).map_err(|e| CoreError::Corrupt(e.to_string()))?; // NON-VACUITY BREAK"""
edits = []
test_file = "crates/basal-testkit/tests/package_instances.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test package_instances"
expect_red = ["instance_core_revocation_does_not_mutate_package_bytes"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "instance-removal-cancellation-recheck"
guards = "a stale removal observation must be rechecked in the cancellation transaction"
file = "crates/basal-core/src/gate.rs"
old = "if !crate::packages::removed(tx, flow_id)? {"
new = "if false && !crate::packages::removed(tx, flow_id)? { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-core/src/gate.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["gate::removal_tests::removed_cancellation_rechecks_mark_in_its_write_transaction"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "fixture-git-helper-clears-inherited-environment"
guards = "fixture git commands ignore injected caller git configuration"
file = "crates/basal-testkit/src/git.rs"
old = "command.env_clear();"
new = "// command.env_clear(); // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-testkit/src/git.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--lib"
expect_red = ["git::tests::fixture_git_commands_ignore_injected_global_hooks"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "production-worker-inherits-parent-privacy-identity"
hub = "Production workers disclaim the module's privacy identity, asserted by the live responsible-process probe and production trampoline configuration"
hub_targets = ["privacy_launch"]
guards = "production workers must be their own macOS responsible processes, not borrow the module privacy grants"
file = "crates/basal-module/src/pool.rs"
old = "let launch = WorkerLaunch::Disclaimed {\n            trampoline: exe.clone(),\n        };"
new = "let launch = WorkerLaunch::Plain; // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-module/tests/e2e.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test e2e"
expect_red = ["privacy::production_worker_is_its_own_responsible_process"]
only = false
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "disclaimed-worker-leaves-inherited-descriptors-open"
guards = "workers close every inherited descriptor above stdio even after the privacy trampoline preserves non-close-on-exec descriptors"
file = "crates/basal-worker/src/confinement.rs"
old = "for fd in macos::open_descriptors().map_err(ConfinementError::Descriptors)? {"
new = "for fd in Vec::<i32>::new() { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-module/tests/privacy_launch.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test privacy_launch"
expect_red = ["disclaimed_worker_closes_extra_inherited_descriptors_at_startup"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "worker-file-name-follows-parent"
guards = "sibling worker lookup follows the parent executable file name without changing the production path"
file = "crates/basal-module/src/pool.rs"
old = 'name.push("-worker");'
new = 'name = std::ffi::OsString::from("ck-basal-worker"); // NON-VACUITY BREAK'
edits = []
test_file = "crates/basal-module/src/pool.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--lib"
expect_red = ["pool::names::worker_file_name_follows_parent_in_production_and_development"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "stale-connection-handle-becomes-scope-tombstone"
guards = "Only a daemon scope close blocks reopening under the same selector"
file = "crates/basal-host/src/transport.rs"
old = """
// Only a daemon scope-close push may leave a tombstone.
                    self.routes
                        .lock()
                        .unwrap_or_else(|p| p.into_inner())
                        .closed(handle, false);"""
new = """
// Only a daemon scope-close push may leave a tombstone.
                    self.routes
                        .lock()
                        .unwrap_or_else(|p| p.into_inner())
                        .closed(handle, true); // NON-VACUITY BREAK"""
edits = []
test_file = "crates/basal-host/src/transport.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["transport::tests::stale_handle_does_not_leave_a_scope_tombstone"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "manifest-duration-splits-multibyte-unit"
guards = "untrusted duration units must not panic at a UTF-8 byte boundary"
file = "crates/basal-core/src/manifest.rs"
old = "let (unit_at, _) = text.char_indices().last()?;"
new = "let unit_at = text.len().checked_sub(1)?; // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-core/src/manifest.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["manifest::tests::multibyte_durations_are_refused_without_panicking"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "ambiguous-send-is-not-a-scope-refusal"
guards = "An ambiguous mutation send stays unknown when its resend is scope-refused"
file = "crates/basal-core/src/runtime.rs"
old = "if let Some(reason) = maybe_sent {"
new = "if let Some(reason) = maybe_sent.filter(|_| refusal.reason != RefusalReason::FlowScopeRequired) { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-core/src/runtime_regressions.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["runtime::regressions::scope_refusal_after_an_ambiguous_send_stays_unknown"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "worker-stack-trace-hook-exposes-private-functions"
guards = "worker stack trace hook exposes private functions"
file = "crates/basal-worker/src/prelude.js"
old = "for (const key of ['prepareStackTrace', 'stackTraceLimit']) {"
new = "for (const key of ['stackTraceLimit']) { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-worker/tests/sandbox_integrity.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test sandbox_integrity"
expect_red = ["stack_trace_hooks_cannot_recover_private_prelude_functions"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "worker-replay-sync-orders-regress"
guards = "worker replay sync orders regress"
file = "crates/basal-worker/src/engine.rs"
old = "if last_sync_order.is_some_and(|last| outcome.delivery_order <= last) {"
new = "if false && last_sync_order.is_some_and(|last| outcome.delivery_order <= last) { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-worker/src/engine/tests.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--lib"
expect_red = ["engine::tests::replayed_sync_delivery_orders_must_increase"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "facts-non-array-include-is-allowed"
guards = "facts include shape must fail closed before private text can reach core"
file = "crates/basal-core/src/authorize.rs"
old = "if include.is_some_and(|v| !v.is_array()) {"
new = "if false && include.is_some_and(|v| !v.is_array()) { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-core/src/runtime_authorization_regressions.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["runtime_authorization_regressions::facts_include_must_be_an_array"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "terminal-deferred-settlement"
guards = "terminal transitions settle every deferred call"
file = "crates/basal-core/src/runs.rs"
old = "if state.is_terminal() {"
new = "if state.is_terminal() && state != RunState::EngineMismatch { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-core/src/runtime_regressions.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["runtime::regressions::terminal_transitions_settle_every_deferred_call"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "stage-strings-inspection-fails-open"
guards = "failed strings inspection is never evidence that a production binary lacks the kill hook"
file = "script/stage.sh"
old = 'hook_table=$(strings "$TARGET/release/ck-basal") || die "cannot inspect the built ck-basal; nothing staged"'
new = 'hook_table=$(strings "$TARGET/release/ck-basal" || true) # NON-VACUITY BREAK'
edits = []
test_file = "script/tests/stage_card.py"
runner = "command"
platforms = ["linux"]
command = ["python3", "-c", 'import subprocess,sys; print("mutation diff stat:\n" + subprocess.run(["git","diff","--stat"], capture_output=True,text=True,check=True).stdout, flush=True); sys.exit(subprocess.run(["python3","-m","unittest",sys.argv[1]]).returncode)', "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ["script.tests.stage_card.StageBinaryChecks.test_binary_inspection_fails_closed"]
only = false
timeout_s = 120
build_timeout_s = 1800

[[control]]
id = "stage-symbol-inspection-fails-open"
guards = "failed nm inspection is never evidence that a production binary has no debug map"
file = "script/stage.sh"
old = 'symbols=$(nm -a "$TARGET/release/$bin")'
new = 'symbols=$(nm -a "$TARGET/release/$bin" || true) # NON-VACUITY BREAK'
edits = []
test_file = "script/tests/stage_card.py"
runner = "command"
platforms = ["linux"]
command = ["python3", "-c", 'import subprocess,sys; print("mutation diff stat:\n" + subprocess.run(["git","diff","--stat"], capture_output=True,text=True,check=True).stdout, flush=True); sys.exit(subprocess.run(["python3","-m","unittest",sys.argv[1]]).returncode)', "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ["script.tests.stage_card.StageBinaryChecks.test_binary_inspection_fails_closed"]
only = false
timeout_s = 120
build_timeout_s = 1800

[[control]]
id = "rig-dangling-symlinks-escape-the-root"
guards = "a dangling final symlink is resolved before allowing writes under the rig root"
file = "script/flows-rig.sh"
old = "print(Path(sys.argv[1]).resolve())"
new = "print(Path(sys.argv[1]).absolute()) # NON-VACUITY BREAK"
edits = []
test_file = "script/tests/flows_rig.py"
runner = "command"
platforms = ["linux"]
command = ["python3", "-c", 'import subprocess,sys; print("mutation diff stat:\n" + subprocess.run(["git","diff","--stat"], capture_output=True,text=True,check=True).stdout, flush=True); sys.exit(subprocess.run(["python3","-m","unittest",sys.argv[1]]).returncode)', "{test}"]
test_count_pattern = "Ran {count} test"
expect_red = ["script.tests.flows_rig.RigChecks.test_dangling_symlink_cannot_redirect_a_rig_write"]
only = false
timeout_s = 120
build_timeout_s = 1800

[[control]]
id = "rig-required-store-read-is-treated-as-empty"
guards = "required journal and receipt reads cannot turn storage errors into evidence of absence"
file = "crates/basal-rig/src/bin/basal-rig-contract.rs"
old = 'case.check(what, false, json!({"error": error}));'
new = "let _ = (case, what, error); // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-rig/src/bin/basal-rig-contract/tests.rs"
runner = "cargo"
package = "basal-rig"
platforms = ["macos"]
target = "--bin basal-rig-contract"
expect_red = ["tests::failed_store_read_is_not_empty_evidence"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "rig-status-receipts-ignore-agent-and-revision"
guards = "status receipts must match the exact agent and requested revision journaled by basal"
file = "crates/basal-rig/src/bin/basal-rig-contract.rs"
old = """
&& r.key
                                == json!([
                                    "sink.status",
                                    flow.id,
                                    request["agent"],
                                    request["revision"]
                                ])"""
new = '&& r.key[0] == "sink.status" // NON-VACUITY BREAK'
edits = []
test_file = "crates/basal-rig/src/bin/basal-rig-contract/tests.rs"
runner = "cargo"
package = "basal-rig"
platforms = ["macos"]
target = "--bin basal-rig-contract"
expect_red = ["tests::status_receipts_must_match_the_agent_and_revision"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "catalog-outage-finalizes-conservative-call-class"
guards = "A transient catalog outage cannot finalize a conservative classification as op_kind_changed"
file = "crates/basal-host/src/routing.rs"
old = "class.safe_to_repeat() && class != self.declared_class(module, op, &decl)"
new = "class != self.declared_class(module, op, &decl) // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-host/tests/host_boundary_regressions.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test host_boundary_regressions"
expect_red = ["transient_classification_failure_does_not_finalize_a_query"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "catalog-transport-failure-is-final-scope-refusal"
guards = "A failed catalog fetch is not proof of missing core scope support"
file = "crates/basal-host/src/routing.rs"
old = 'WireError::NeverSent(format!("catalog lookup before dispatch: {e:?}"))'
new = """
if module == crate::subc_catalog::CORE { // NON-VACUITY BREAK
                        WireError::Refused {code:"basal_scope_bug".into(), message:format!("catalog lookup before dispatch: {e:?}")}
                    } else { WireError::NeverSent(format!("catalog lookup before dispatch: {e:?}")) }"""
edits = []
test_file = "crates/basal-host/tests/host_boundary_regressions.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test host_boundary_regressions"
expect_red = ["catalog_unavailability_does_not_become_a_final_core_scope_refusal"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "worker-memory-budget-classified-from-script-text"
guards = "worker memory budget classified from script text"
file = "crates/basal-worker/src/engine.rs"
old = """
if self.shared.memory_exhausted.get() {
                        return Ok(ActivationResult::BudgetExhausted(BudgetKind::Memory));"""
new = """
if self.shared.memory_exhausted.get() || text.contains("out of memory") { // NON-VACUITY BREAK
                        return Ok(ActivationResult::BudgetExhausted(BudgetKind::Memory));"""
edits = []
test_file = "crates/basal-worker/tests/sandbox_integrity.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test sandbox_integrity"
expect_red = ["forged_memory_errors_are_script_failures_and_description_does_not_invoke_getters"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "absent-catalog-provider-is-definite-op-removal"
guards = "A disconnected provider is not proof its operation was removed"
file = "crates/basal-host/src/subc_catalog.rs"
old = """
return Err(WireError::NeverSent(format!(
                "provider {module} is not currently catalogued"
            )));"""
new = "return Ok((None, false)); // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-host/tests/host_boundary_regressions.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test host_boundary_regressions"
expect_red = ["temporarily_absent_module_is_retryable"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "poison-consent-answer-blocks-valid-decisions"
guards = "Malformed consent answers are retained without blocking independent valid records in the page"
file = "crates/basal-host/src/core_consent.rs"
old = "problem.get_or_insert(error);"
new = "return Err(error); // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-host/tests/host_boundary_regressions.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test host_boundary_regressions"
expect_red = ["bad_answer_does_not_block_later_valid_decisions_or_acknowledge_the_bad_one"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "production-random-restarts-a-predictable-counter"
guards = "Fresh production processes draw unpredictable random values while replay uses the journal"
file = "crates/basal-host/src/core_host.rs"
old = """
let mut x = 0u64;
    // Live draws use OS entropy, not shared predictable process state. The
    // runtime journals each draw and replay serves that saved value instead.
    // There is deliberately no fallback when the OS cannot supply entropy.
    let rc = unsafe { libc::getentropy((&mut x as *mut u64).cast(), std::mem::size_of::<u64>()) };
    assert_eq!(
        rc,
        0,
        "OS entropy unavailable: {}",
        std::io::Error::last_os_error()
    );"""
new = """
// NON-VACUITY BREAK
    use std::sync::atomic::{AtomicU64, Ordering};
    static SEQUENCE: AtomicU64 = AtomicU64::new(1);
    let x = SEQUENCE.fetch_add(1, Ordering::Relaxed).wrapping_mul(0x9e3779b97f4a7c15);"""
edits = []
test_file = "crates/basal-host/tests/host_boundary_regressions.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test host_boundary_regressions"
expect_red = ["production_random_is_not_the_same_first_draw_after_restart"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "worker-exception-description-invokes-getters"
guards = "worker exception description invokes getters"
file = "crates/basal-worker/src/prelude.js"
old = """
const desc = ObjectGetOwnPropertyDescriptor(object, key);
    return desc !== undefined"""
new = """
const desc = {value: object[key]}; // NON-VACUITY BREAK
    return desc !== undefined"""
edits = []
test_file = "crates/basal-worker/tests/sandbox_integrity.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test sandbox_integrity"
expect_red = ["forged_memory_errors_are_script_failures_and_description_does_not_invoke_getters"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "model-envelope-refusal-loses-provider-context"
guards = "Typed model refusals decoded from envelopes retain the provider and action"
file = "crates/basal-host/src/transport.rs"
old = """
.and_then(|bytes| decode_response(&bytes, true))
            .map_err(|e| contextual(e, module, op))"""
new = """
.map_err(|e| contextual(e, module, op))
            .and_then(|bytes| decode_response(&bytes, true)) // NON-VACUITY BREAK"""
edits = []
test_file = "crates/basal-host/src/transport.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["transport::tests::model_refusal_has_provider_and_action_after_envelope_decoding"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "package-instance-overwrites-regular-flow"
guards = "ensure_instance must preserve a non-instance flow with the deterministic instance id"
file = "crates/basal-core/src/packages.rs"
old = "if identity.is_some_and(|(p, owner)| {"
new = "if false && identity.is_some_and(|(p, owner)| { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-core/src/runtime_authorization_regressions.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["runtime_authorization_regressions::instance_collision_cannot_change_a_regular_flow"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "claim-flushes-refusal-intents"
guards = "claim expiry acknowledges the deferred snapshot after commit"
file = "crates/basal-core/src/driver.rs"
old = """
Ok(Err(end)) => {
                self.flush_refusals()?;"""
new = "Ok(Err(end)) => { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-core/src/runtime_regressions.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["runtime::regressions::claim_expiry_acknowledges_the_deferred_snapshot_after_commit"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "worker-rejection-orphans-outstanding-outcomes"
guards = "worker rejection orphans outstanding outcomes"
file = "crates/basal-worker/src/engine.rs"
old = """
} if outstanding.is_empty() => {
                    if self.shared.memory_exhausted.get()"""
new = """
} => { // NON-VACUITY BREAK
                    if self.shared.memory_exhausted.get()"""
edits = []
test_file = "crates/basal-worker/src/engine/tests.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--lib"
expect_red = ["engine::tests::script_rejection_drains_outstanding_calls_before_finishing"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "huge-token-usage-aborts-settlement"
guards = "provider usage above signed storage range must not prevent an outcome from settling"
file = "crates/basal-core/src/tokens.rs"
old = "usage.input_tokens.map(saturate_usage),"
new = "usage.input_tokens.map(to_i64).transpose()?, // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-core/src/runtime_authorization_regressions.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["runtime_authorization_regressions::huge_usage_settles_and_keeps_window_totals_integral"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "mailbox-winner-prevents-reconcile"
guards = "a mailbox winner prevents a false reconcile transition"
file = "crates/basal-core/src/journal.rs"
old = """
if changed == 0 {
        return Ok(());
    }
    tx.execute(
        "UPDATE runs SET state = 'needs_reconcile'"""
new = """
if false && changed == 0 { // NON-VACUITY BREAK
        return Ok(());
    }
    tx.execute(
        "UPDATE runs SET state = 'needs_reconcile'"""
edits = []
test_file = "crates/basal-core/src/runtime_regressions.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["runtime::regressions::a_mailbox_winner_prevents_a_false_reconcile_transition"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "corrupt-schedule-stops-all-planning"
guards = "invalid persisted schedules must be isolated while healthy schedules keep ticking"
file = "crates/basal-core/src/schedule/mod.rs"
old = "let CoreError::Corrupt(detail) = error else { return Err(error); };"
new = "let CoreError::Corrupt(detail) = error else { return Err(error); }; if std::hint::black_box(true) { return Err(CoreError::Corrupt(detail.clone())); } // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-core/src/runtime_authorization_regressions.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["runtime_authorization_regressions::corrupt_schedule_does_not_block_healthy_schedules"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "domain-error-retires-claim"
guards = "a non storage driver error exits the claim and frees the slot"
file = "crates/basal-core/src/driver.rs"
old = """
Err(e)
                if !matches!("""
new = """
Err(e)
                if false && !matches!( // NON-VACUITY BREAK"""
edits = []
test_file = "crates/basal-core/src/runtime_regressions.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["runtime::regressions::a_non_storage_driver_error_exits_the_claim_and_frees_the_slot"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "corrupt-oldest-fire-stops-all-admission"
guards = "a corrupt planned fire must not indefinitely block healthy planned fires"
file = "crates/basal-core/src/schedule/tick.rs"
old = """
let CoreError::Corrupt(detail) = error else {
                    return Err(error);
                };"""
new = """
let CoreError::Corrupt(detail) = error else {
                    return Err(error);
                };
                if std::hint::black_box(true) { return Err(CoreError::Corrupt(detail.clone())); } // NON-VACUITY BREAK"""
edits = []
test_file = "crates/basal-core/src/runtime_authorization_regressions.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["runtime_authorization_regressions::corrupt_oldest_fire_does_not_block_healthy_fires"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "production-retention-prunes-runs"
guards = "retention runs from the production deadline pass"
file = "crates/basal-core/src/retention.rs"
old = "let runs = self.prune(now, millis(config.runs))?;"
new = "let runs = PruneReport::default(); // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-core/src/runtime_regressions.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["runtime::regressions::retention_runs_from_the_production_deadline_pass"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "scoped-route-open-reply-ignores-authority-generation"
guards = "An unlocked scoped open may install only under unchanged scope and connection authority"
file = "crates/basal-host/src/flow_scope.rs"
old = """
if self.connection_generation != plan.generation
            || self
                .flows
                .get(flow)
                .is_none_or(|(_, key)| key != &plan.key.scope)
        {"""
new = "if false { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-host/src/flow_scope.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["flow_scope::tests::an_open_reply_cannot_install_after_scope_or_connection_changes"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "protocol-list-count-ignores-element-wire-size"
guards = "protocol list count ignores element wire size"
file = "crates/basal-proto/src/codec.rs"
old = "let needed = len.saturating_mul(minimum_bytes);"
new = "let needed = len; let _ = minimum_bytes; // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-proto/src/codec.rs"
runner = "cargo"
package = "basal-proto"
platforms = ["linux"]
target = "--lib"
expect_red = ["codec::tests::list_counts_require_the_complete_minimum_wire_size"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "stale-model-subscription-keeps-dead-handle"
guards = "A stale scoped model subscription evicts its dead connection handle"
file = "crates/basal-host/src/transport.rs"
old = """
.block_on(self.consumer.subscribe_route(&handle, bytes, opts));
        if let Err(CallError::StaleRouteHandle(_)) = &result {"""
new = """
.block_on(self.consumer.subscribe_route(&handle, bytes, opts));
        if false { // NON-VACUITY BREAK"""
edits = []
test_file = "crates/basal-host/src/transport.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["transport::tests::stale_model_subscription_evicts_its_dead_handle"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "health-index-migration-deletes-existing-rows"
guards = "additive health and decision indexes must preserve populated stores in every existing state"
file = "crates/basal-core/src/schema.rs"
old = 'const HEALTH_INDEXES: &str = r#"'
new = """
const HEALTH_INDEXES: &str = r#"
DELETE FROM meta; -- NON-VACUITY BREAK"""
edits = []
test_file = "crates/basal-core/src/schema_health_tests.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["schema::health_tests::additive_health_indexes_preserve_populated_tables_in_every_state"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "malformed-optional-refusal-is-tolerated"
guards = "malformed optional refusal detail does not halt deadline enforcement"
file = "crates/basal-core/src/journal.rs"
old = 'value["retry_after_ms"] = serde_json::Value::Null;'
new = '// NON-VACUITY BREAK: value["retry_after_ms"] = serde_json::Value::Null;'
edits = []
test_file = "crates/basal-core/src/runtime_regressions.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["runtime::regressions::malformed_optional_refusal_detail_does_not_halt_deadline_enforcement"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "malformed-management-error-claims-connection-loss"
guards = "An unreadable management error envelope is recorded as reply_unreadable"
file = "crates/basal-host/src/transport.rs"
old = '.map_err(|e| WireError::Unreadable(format!("invalid error envelope: {e}")))?;'
new = '.map_err(|e| WireError::Unknown(format!("invalid error envelope: {e}")))?; // NON-VACUITY BREAK'
edits = []
test_file = "crates/basal-host/src/transport.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["transport::tests::malformed_management_errors_are_unreadable_not_connection_loss"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "nullable-routing-model-variant-is-refused"
guards = "A routing reply with a null optional model variant decodes as no variant"
file = "crates/basal-host/src/selector.rs"
old = ".filter(|v| !v.is_null())"
new = "// NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-host/tests/host_boundary_regressions.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test host_boundary_regressions"
expect_red = ["nullable_model_variant_is_the_absent_variant"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "agent-display-name-shadows-stable-id"
guards = "A display name on an earlier registry page cannot shadow an exact stable agent ID"
file = "crates/basal-host/src/subc_catalog.rs"
old = "named.insert(id.to_owned());"
new = "return Ok(Some(id.to_owned())); // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-host/tests/host_boundary_regressions.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test host_boundary_regressions"
expect_red = ["stable_agent_id_wins_over_a_display_name_even_on_a_later_page"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "rig-model-abort-drops-unreached-case-reports"
guards = "a model-suite abort records every named case and retains already completed evidence"
file = "crates/basal-rig/src/bin/basal-rig-contract.rs"
old = "if !cases.iter().any(|case| case.name == name) {"
new = "if false && !cases.iter().any(|case| case.name == name) { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-rig/src/bin/basal-rig-contract/tests.rs"
runner = "cargo"
package = "basal-rig"
platforms = ["macos"]
target = "--bin basal-rig-contract"
expect_red = ["tests::model_abort_records_every_named_case_without_losing_completed_evidence"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "protocol-encoder-allows-empty-names"
guards = "protocol encoder allows empty names"
file = "crates/basal-proto/src/codec.rs"
old = "if value.is_empty() {"
new = "if false && value.is_empty() { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-worker/tests/shutdown.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test shutdown"
expect_red = ["encoder_rejects_fields_that_its_decoder_would_refuse"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "worker-shutdown-is-an-unexpected-frame-during-activation"
guards = "worker shutdown is an unexpected frame during activation"
file = "crates/basal-worker/src/link.rs"
old = "Received::Message(ParentMessage::Shutdown) => {"
new = "Received::Message(ParentMessage::Shutdown) if false => { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-worker/tests/shutdown.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test shutdown"
expect_red = ["shutdown_ends_sync_and_async_activations_without_refusal"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "worker-prelude-primitive-code-diverges"
guards = "worker prelude primitive code diverges"
file = "crates/basal-worker/src/prelude.js"
old = "FACTS = 3, CLASSIFY = 4"
new = "FACTS = 4, CLASSIFY = 4 /* NON-VACUITY BREAK */"
edits = []
test_file = "crates/basal-worker/src/engine/tests.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--lib"
expect_red = ["engine::tests::prelude_primitive_calls_match_the_rust_wire_codes"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "worker-top-level-evaluation-skips-js-time-metering"
guards = "worker top level evaluation skips js time metering"
file = "crates/basal-worker/src/engine.rs"
old = """
self.shared.clock.enter();
        let result = self.ctx.with(|ctx| f(&ctx));"""
new = """
// NON-VACUITY BREAK: engine entry is not metered
        let result = self.ctx.with(|ctx| f(&ctx));"""
edits = []
test_file = "crates/basal-worker/tests/sandbox_integrity.rs"
runner = "cargo"
package = "basal-worker"
platforms = ["macos"]
target = "--test sandbox_integrity"
expect_red = ["top_level_wrapper_code_has_activation_budgets"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "dry-run-multibyte-window-panics"
guards = "flow.dry_run must reject multibyte windows through the public operation rather than panic"
file = "crates/basal-core/src/manifest.rs"
old = "let (unit_at, _) = text.char_indices().last()?;"
new = "let unit_at = text.len().checked_sub(1)?; // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-module/tests/unicode_dry_run.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test unicode_dry_run"
expect_red = ["dry_run_multibyte_windows_are_typed_refusals"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "module-worker-frames-unbounded"
guards = "worker frames back-pressure their stdout reader instead of growing parent memory"
file = "crates/basal-module/src/process.rs"
old = "mpsc::sync_channel(2)"
new = "mpsc::channel() // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-module/src/process.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--lib"
expect_red = ["process::buffer_tests::incoming_frames_have_bounded_capacity"]
only = false
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "health-index-predicate-selects-deferred"
guards = "migration 11 must retain the exact pending Broca predicate on populated stores"
file = "crates/basal-core/src/schema.rs"
old = "CREATE INDEX broca_calls_pending ON broca_calls(send_id) WHERE json_extract(snapshot, '$.acknowledged') = 0 AND COALESCE(json_extract(snapshot, '$.deferred'), 0) = 0;"
new = "CREATE INDEX broca_calls_pending ON broca_calls(send_id) WHERE json_extract(snapshot, '$.acknowledged') = 0 AND COALESCE(json_extract(snapshot, '$.deferred'), 0) = 1; -- NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-core/src/schema_health_tests.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["schema::health_tests::additive_health_indexes_preserve_populated_tables_in_every_state"]
only = true
timeout_s = 600
build_timeout_s = 7200

[[control]]
id = "builtin-encoded-result-becomes-null"
guards = "builtin encoded result becomes null"
file = "crates/basal-host/src/builtins/mod.rs"
old = "    JsonText::new(value.to_string()).map_err(|_| {"
new = "    JsonText::new(value.to_string()).or_else(|_| Ok(JsonText::null())).map_err(|_: basal_proto::ValueTooLarge| { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-host/src/builtins/mod.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["builtins::tests::encoded_result_limit_never_fulfills_null"]
only = true
timeout_s = 600
build_timeout_s = 7200

[[control]]
id = "module-panic-retains-activation-slot"
guards = "unwinding an activation releases both its run and flow reservations"
file = "crates/basal-module/src/engine.rs"
old = """
active.runs.remove(self.run_id);
        active.flows.remove(self.flow_id);"""
new = """
// NON-VACUITY BREAK: retain reservations when unwinding.
        if !thread::panicking() {
            active.runs.remove(self.run_id);
            active.flows.remove(self.flow_id);
        }"""
edits = []
test_file = "crates/basal-module/src/engine_tests.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--lib"
expect_red = ["engine::lifecycle_tests::panicking_activation_releases_run_and_flow_slots"]
only = false
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "retirement-is-not-version-disapproval"
guards = "retirement fails through the terminal transition and blocks approval reenable"
file = "crates/basal-core/src/install.rs"
old = '&& f.disabled_reason.as_deref() != Some("agent_retired")'
new = "&& true // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-core/src/runtime_regressions.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["runtime::regressions::retirement_fails_through_the_terminal_transition_and_blocks_approval_reenable"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "module-kill-signals-reaped-worker-pid"
guards = "a reaped worker pid is never signalled after its lease is gone"
file = "crates/basal-module/src/process.rs"
old = "if !matches!(child.try_wait(), Ok(None)) {"
new = "if false && !matches!(child.try_wait(), Ok(None)) { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-module/src/process.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--lib"
expect_red = ["process::buffer_tests::a_reaped_worker_handle_never_signals_a_recycled_pid"]
only = false
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "retention-keeps-unacknowledged-broca"
guards = "pruning keeps unacknowledged broca snapshots and open cards"
file = "crates/basal-core/src/retention.rs"
old = "b.run_id=r.run_id AND COALESCE(json_extract(b.snapshot,'$.acknowledged'),0)=0"
new = "b.run_id=r.run_id AND COALESCE(json_extract(b.snapshot,'$.acknowledged'),0)=0 AND 0 /* NON-VACUITY BREAK */"
edits = []
test_file = "crates/basal-core/src/runtime_regressions.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["runtime::regressions::pruning_keeps_unacknowledged_broca_snapshots_and_open_cards"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "module-invalid-descriptor-does-not-exit"
guards = "invalid store descriptors terminate the module for supervised restart"
file = "crates/basal-module/src/serve.rs"
old = """
// by serving more requests. Let supervision retry startup.
                std::process::exit(crate::fatal::EXIT_STORE_FAILURE);"""
new = """
// by serving more requests. Let supervision retry startup.
                // NON-VACUITY BREAK: keep serving after descriptor refusal."""
edits = []
test_file = "crates/basal-module/tests/startup_descriptor.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test startup_descriptor"
expect_red = ["invalid_store_descriptor_exits_for_supervised_restart"]
only = false
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "retention-keeps-refusal-intents"
guards = "pruning preserves a terminal run until its refusal acknowledgement is delivered"
file = "crates/basal-core/src/retention.rs"
old = "o.kind='refusal_committed' AND CAST(json_extract(o.body,'$.run_id') AS TEXT)=r.run_id"
new = "o.kind='refusal_committed' AND CAST(json_extract(o.body,'$.run_id') AS TEXT)=r.run_id AND 0 /* NON-VACUITY BREAK */"
edits = []
test_file = "crates/basal-core/src/runtime_regressions.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
# Constant false also removes the indexed lookup from the shared query plan.
expect_red = ["runtime::regressions::pruning_preserves_a_terminal_run_until_its_refusal_acknowledgement_is_delivered", "schema::retention_tests::outbox_refusal_run_plan"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "module-replay-count-masks-store-failure"
guards = "reading the replay count cannot turn a storage failure into zero calls"
file = "crates/basal-module/src/engine.rs"
old = "let replayed = match journal_rows(&inner.rt, &run_id) {"
new = "let replayed = match Ok::<u64, CoreError>(journal_rows(&inner.rt, &run_id).unwrap_or(0)) { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-module/src/engine_tests.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--lib"
expect_red = ["engine::lifecycle_tests::journal_count_failure_is_fatal_not_zero_replayed_calls"]
only = false
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "production-retention-prunes-history"
guards = "retention prunes old history but keeps live obligations and card episodes"
file = "crates/basal-core/src/retention.rs"
old = "let history_full = self.prune_history(now, now.saturating_sub(millis(config.history)))?;"
new = "let history_full = false; // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-core/src/runtime_regressions.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["runtime::regressions::retention_prunes_old_history_but_keeps_live_obligations_and_card_episodes"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "module-owner-disable-leaks-raw-actor-kind"
guards = "health and list encode owner disables with the same closed owner kind"
file = "crates/basal-module/src/ops.rs"
old = """
} else {
        "owner"
    }"""
new = """
} else {
        by // NON-VACUITY BREAK
    }"""
edits = []
test_file = "crates/basal-module/tests/module_lifecycle.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test module_lifecycle"
expect_red = ["health_uses_the_same_owner_disable_kind_as_list"]
only = false
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "wait-timeout-is-not-success"
guards = "wait for reports unsatisfied predicates as timeouts"
file = "crates/basal-core/src/runtime.rs"
old = """
return Err(CoreError::Timeout {
                    run_id: run_id.to_owned(),
                    state,
                });"""
new = "return Ok(state); // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-core/src/runtime_regressions.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["runtime::regressions::wait_for_reports_unsatisfied_predicates_as_timeouts"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "module-start-binds-before-preparation"
guards = "failed module preparation never binds or retains the writer lease"
file = "crates/basal-module/src/module.rs"
old = """
std::fs::create_dir_all(&config.dry_run.scratch_root).map_err(|e| {
            format!(
                "creating the dry-run directory {}: {e}",
                config.dry_run.scratch_root.display()
            )
        })?;
        initialize(store.clone())?;"""
new = """
initialize(store.clone())?; // NON-VACUITY BREAK
        std::fs::create_dir_all(&config.dry_run.scratch_root).map_err(|e| {
            format!(
                "creating the dry-run directory {}: {e}",
                config.dry_run.scratch_root.display()
            )
        })?;"""
edits = []
test_file = "crates/basal-module/tests/module_lifecycle.rs"
runner = "cargo"
package = "basal-module"
platforms = ["macos"]
target = "--test module_lifecycle"
expect_red = ["failed_start_does_not_bind_or_retain_the_store"]
only = false
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "spawn-reaps-completed-handles"
guards = "completed thread handles are reaped during normal spawning"
file = "crates/basal-core/src/runtime.rs"
old = "threads.retain(|h| !h.is_finished());"
new = "// NON-VACUITY BREAK: threads.retain(|h| !h.is_finished());"
edits = []
test_file = "crates/basal-core/src/runtime_regressions.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--lib"
expect_red = ["runtime::regressions::completed_thread_handles_are_reaped_during_normal_spawning"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "builtin-outside-path-leaks-resolved-target"
guards = "builtin outside path leaks resolved target"
file = "crates/basal-host/src/builtins/fs.rs"
old = """    Denial::denied("path is outside the manifest's roots or missing")"""
new = '    Denial::denied(format!("{} is outside the manifest roots", _path.display())) // NON-VACUITY BREAK'
edits = []
test_file = "crates/basal-host/tests/builtin_host_regressions.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test builtin_host_regressions"
expect_red = ["outside_missing_and_symlink_targets_have_identical_refusals"]
only = true
timeout_s = 600
build_timeout_s = 7200

[[control]]
id = "builtin-method-override-header-is-admitted"
guards = "builtin method override header is admitted"
file = "crates/basal-host/src/builtins/net.rs"
old = '    "x-http-method-override",'
new = '    "disabled-method-override", // NON-VACUITY BREAK'
edits = []
test_file = "crates/basal-host/tests/builtin_host_regressions.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test builtin_host_regressions"
expect_red = ["method_override_and_compression_headers_are_denied"]
only = true
timeout_s = 600
build_timeout_s = 7200

[[control]]
id = "broca-initial-store-failure-is-maybe-sent"
guards = "broca initial store failure is maybe sent"
file = "crates/basal-host/src/broca/mod.rs"
old = """
                    .map_err(|error| BrocaError::Unavailable {
                        proven_unsent: true,"""
new = """
                    .map_err(|error| BrocaError::Unavailable {
                        proven_unsent: false, // NON-VACUITY BREAK"""
edits = []
test_file = "crates/basal-host/tests/broca_dispatch_regressions.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca_dispatch_regressions"
expect_red = ["first_snapshot_failure_is_provably_unsent"]
only = true
timeout_s = 600
build_timeout_s = 7200

[[control]]
id = "broca-one-corrupt-snapshot-aborts-the-poll"
guards = "broca one corrupt snapshot aborts the poll"
file = "crates/basal-host/src/broca/mod.rs"
old = """
                Err(error) => {
                    first_error.get_or_insert(error);
                    continue;
                }
            };"""
new = """
                Err(error) => {
                    return Err(error); // NON-VACUITY BREAK
                }
            };"""
edits = []
test_file = "crates/basal-host/tests/broca_dispatch_regressions.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca_dispatch_regressions"
expect_red = ["one_corrupt_snapshot_does_not_block_healthy_completions"]
only = true
timeout_s = 600
build_timeout_s = 7200

[[control]]
id = "builtin-nonstandard-redirect-port-is-approved"
guards = "builtin nonstandard redirect port is approved"
file = "crates/basal-host/src/builtins/net.rs"
old = "    if url.port != 443 {"
new = "    if url.port == 0 { // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-testkit/tests/net_fetch_regressions.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test net_fetch_regressions"
expect_red = ["nonstandard_redirect_port_is_refused_before_a_second_connection"]
only = true
timeout_s = 600
build_timeout_s = 7200

[[control]]
id = "builtin-unclean-tls-eof-is-clean"
guards = "builtin unclean tls eof is clean"
file = "crates/basal-host/src/builtins/net.rs"
old = "        self.stream.read(buf)"
new = """
        match self.stream.read(buf) { // NON-VACUITY BREAK
            Err(e) if e.kind() == std::io::ErrorKind::UnexpectedEof => Ok(0),
            other => other,
        }"""
edits = []
test_file = "crates/basal-testkit/tests/net_fetch_regressions.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test net_fetch_regressions"
expect_red = ["unclean_tls_eof_cannot_fulfill_a_connection_framed_body"]
only = true
timeout_s = 600
build_timeout_s = 7200

[[control]]
id = "builtin-query-redirect-reads-irrelevant-body"
guards = "builtin query redirect reads irrelevant body"
file = "crates/basal-host/src/builtins/net.rs"
old = "        let skip_redirect_body = !effect_possible && matches!(status, 301 | 302 | 303 | 307 | 308);"
new = "        let skip_redirect_body = false; // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-testkit/tests/net_fetch_regressions.rs"
runner = "cargo"
package = "basal-testkit"
platforms = ["macos"]
target = "--test net_fetch_regressions"
expect_red = ["query_redirect_does_not_read_an_incomplete_body"]
only = true
timeout_s = 600
build_timeout_s = 7200

[[control]]
id = "builtin-write-carries-special-permission-bits"
guards = "builtin write carries special permission bits"
file = "crates/basal-host/src/builtins/fs.rs"
old = "    mode & 0o777"
new = "    mode & 0o7777 // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-host/src/builtins/fs/tests.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["builtins::fs::tests::replacement_mode_never_carries_setuid_or_setgid"]
only = true
timeout_s = 600
build_timeout_s = 7200

[[control]]
id = "broca-generation-accepts-unknown-keys"
guards = "broca generation accepts unknown keys"
file = "crates/basal-host/src/broca/wire.rs"
# The `old` text is Rust source, not a TOML comment. Removing the
# `deny_unknown_fields` attribute from GenerationConfig would let a misspelt
# generation setting in a flow's model request be silently ignored; the test
# checks that such a typo is refused instead.
old = """
#[serde(deny_unknown_fields)]
pub struct GenerationConfig"""
new = """
// NON-VACUITY BREAK: ignore unknown generation keys.
pub struct GenerationConfig"""
edits = []
test_file = "crates/basal-host/tests/broca_dispatch_regressions.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca_dispatch_regressions"
expect_red = ["generation_typos_are_refused"]
only = true
timeout_s = 600
build_timeout_s = 7200

[[control]]
id = "broca-unsent-refusal-penalizes-model"
guards = "broca unsent refusal penalizes model"
file = "crates/basal-host/src/broca/mod.rs"
old = "                call.report_attempted = true;"
new = "                self.report_terminal(&mut call)?; // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-host/tests/broca_dispatch_regressions.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca_dispatch_regressions"
expect_red = ["an_unsent_refusal_does_not_penalize_the_selected_model"]
only = true
timeout_s = 600
build_timeout_s = 7200

[[control]]
id = "builtin-dispatch-skips-result-encoding"
guards = "builtin dispatch skips result encoding"
file = "crates/basal-host/src/builtins/mod.rs"
old = """
            Ok(value) => Ok(Dispatched::Completed(match text(&value) {
                Ok(value) => HostOutcome::fulfilled(value),
                Err(denial) => denial.outcome(),
            })),"""
new = "            Ok(_value) => Ok(Dispatched::Completed(HostOutcome::fulfilled(JsonText::null()))), // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-host/tests/builtin_host_regressions.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test builtin_host_regressions"
expect_red = ["escaped_listing_exceeds_encoded_cap_as_a_typed_refusal"]
only = true
timeout_s = 600
build_timeout_s = 7200

[[control]]
id = "broca-legacy-snapshot-discards-frozen-bytes"
guards = "broca legacy snapshot discards frozen bytes"
file = "crates/basal-host/src/broca/mod.rs"
old = "            Bytes::Legacy(bytes) => bytes,"
new = "            Bytes::Legacy(_bytes) => Vec::new(), // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-host/tests/broca_dispatch_regressions.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca_dispatch_regressions"
expect_red = ["saved_params_are_compact_and_read_legacy_byte_arrays"]
only = true
timeout_s = 600
build_timeout_s = 7200

[[control]]
id = "broca-global-gate-blocks-independent-send"
guards = "broca global gate blocks independent send"
file = "crates/basal-host/src/broca/mod.rs"
old = """
    fn call_gate(&self, send_id: &str) -> Arc<Mutex<()>> {
        let mut gates = lock(&self.gate);"""
new = """
    fn call_gate(&self, _send_id: &str) -> Arc<Mutex<()>> {
        let send_id = "shared"; // NON-VACUITY BREAK
        let mut gates = lock(&self.gate);"""
edits = []
test_file = "crates/basal-host/tests/broca_dispatch_regressions.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca_dispatch_regressions"
expect_red = ["a_stalled_send_does_not_hold_an_unrelated_dispatch"]
only = true
timeout_s = 600
build_timeout_s = 7200

[[control]]
id = "builtin-dns-ignores-the-fetch-deadline"
guards = "builtin dns ignores the fetch deadline"
file = "crates/basal-host/src/builtins/net.rs"
old = "            .resolve_until(&url.host, url.port, deadline)"
new = "            .resolve(&url.host, url.port) // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-host/src/builtins/net/tests.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["builtins::net::tests::dns_receives_the_fetch_deadline"]
only = true
timeout_s = 600
build_timeout_s = 7200

[[control]]
id = "builtin-git-leaves-descendant-pipes-open"
guards = "builtin git leaves descendant pipes open"
file = "crates/basal-host/src/builtins/git.rs"
old = "            libc::kill(-(self.pid as i32), libc::SIGKILL);"
new = "            let _ = self.pid; // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-host/tests/builtin_host_regressions.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test builtin_host_regressions"
expect_red = ["git_reaps_descendants_that_keep_its_output_pipe_open"]
only = true
timeout_s = 600
build_timeout_s = 7200

[[control]]
id = "builtin-tags-are-truncated-only-after-reading-everything"
guards = "builtin tags are truncated only after reading everything"
file = "crates/basal-host/src/builtins/git.rs"
old = "    run_command_until(command, Some(MAX_TAGS))"
new = "    run_command_until(command, None) // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-host/src/builtins/git/tests.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--lib"
expect_red = ["builtins::git::tests::tag_output_is_bounded_while_reading_not_after_completion"]
only = true
timeout_s = 600
build_timeout_s = 7200

[[control]]
id = "broca-compact-snapshot-discards-frozen-bytes"
guards = "broca compact snapshot discards frozen bytes"
file = "crates/basal-host/src/broca/mod.rs"
old = "        serializer.serialize_str(text)"
new = '        serializer.serialize_str("") // NON-VACUITY BREAK'
edits = []
test_file = "crates/basal-host/tests/broca_dispatch_regressions.rs"
runner = "cargo"
package = "basal-host"
platforms = ["linux"]
target = "--test broca_dispatch_regressions"
expect_red = ["saved_params_are_compact_and_read_legacy_byte_arrays"]
only = true
timeout_s = 600
build_timeout_s = 7200

[[control]]
id = "retention-full-batches-catch-up"
guards = "Full retention batches prompt another bounded pass rather than impose an hourly throughput ceiling"
file = "crates/basal-core/src/retention.rs"
old = "let backlog = runs.pruned.len() == BATCH || history_full;"
new = "let backlog = false && (runs.pruned.len() == BATCH || history_full); // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-core/tests/retention_backlog.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--test retention_backlog"
expect_red = ["production_retention_catches_up_full_batches_without_waiting_a_whole_interval"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "retention-history-only-backlogs-catch-up"
guards = "A full history batch schedules catch-up even when there are no terminal runs to prune"
file = "crates/basal-core/src/retention.rs"
old = "let backlog = runs.pruned.len() == BATCH || history_full;"
new = "let backlog = runs.pruned.len() == BATCH || false; // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-core/tests/retention_backlog.rs"
runner = "cargo"
package = "basal-core"
platforms = ["linux"]
target = "--test retention_backlog"
expect_red = ["production_retention_catches_up_full_batches_without_waiting_a_whole_interval"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "retention-index-migration-omits-audit-age-index"
platforms = ["linux"]
guards = "Retention index migration preserves the exact query-backed index inventory and stored SQL"
file = "crates/basal-core/src/schema.rs"
old = "CREATE INDEX audit_retention ON audit(at);"
new = "-- NON-VACUITY BREAK: audit age index omitted."
edits = []
test_file = "crates/basal-core/src/schema_retention_tests.rs"
runner = "cargo"
package = "basal-core"
target = "--lib"
select = "expected"
expect_red = ["schema::retention_tests::additive_retention_indexes_preserve_populated_tables_in_every_state"]
only = false
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "management-fixture-default-starts-a-spare"
guards = "management fixtures start no worker unless explicitly requested"
file = "crates/basal-module/tests/common/mod.rs"
old = "warm_spares: 0,"
new = "warm_spares: 1, // NON-VACUITY BREAK"
edits = []
test_file = "crates/basal-module/tests/list_contract.rs"
runner = "cargo"
package = "basal-module"
target = "--test list_contract"
expect_red = ["management_fixture_starts_no_worker"]
only = true
platforms = ["macos"]
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "git-waiter-timeout-omits-group-cleanup"
guards = "git completion-channel timeout kills the process group and reaps the child"
file = "crates/basal-host/src/builtins/git.rs"
old = """
self.kill();
        if let Some(child) = &mut self.child"""
new = """
// NON-VACUITY BREAK: omit timeout cleanup.
        if let Some(child) = &mut self.child"""
edits = []
test_file = "crates/basal-host/src/builtins/git/tests.rs"
runner = "cargo"
package = "basal-host"
target = "--lib"
select = "expected"
expect_red = ["builtins::git::tests::git_waiter_timeout_kills_the_process_group_and_reaps_the_child"]
only = false
platforms = ["linux"]
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "admission-does-not-wake-the-idle-engine"
guards = "A newly admitted trigger wakes the sleeping engine without its ten-minute fallback"
file = "crates/basal-core/src/runtime.rs"
old = """
admission::admit_current(tx, &store_id, flow_id, trigger_id, trigger, &ctx)
        })?;
        self.shared.signal.bump();"""
new = """
admission::admit_current(tx, &store_id, flow_id, trigger_id, trigger, &ctx)
        })?;
        // NON-VACUITY BREAK: admission no longer signals the engine."""
edits = []
test_file = "crates/basal-module/src/engine_tests.rs"
runner = "cargo"
package = "basal-module"
target = "--lib"
expect_red = ["engine::lifecycle_tests::admission_wakes_the_sleeping_engine"]
only = true
platforms = ["macos"]
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "consent-polls-without-owned-open-cards"
guards = "Steady-state idle consent makes zero answer or acknowledgement RPCs"
file = "crates/basal-host/src/core_consent.rs"
old = "Ok(state.retry_page.load(Ordering::Acquire)"
new = "Ok(true || state.retry_page.load(Ordering::Acquire) /* NON-VACUITY BREAK: poll while idle */"
edits = []
test_file = "crates/basal-host/src/core_consent_tests.rs"
runner = "cargo"
package = "basal-host"
target = "--lib"
select = "expected"
expect_red = ["core_consent::polling_tests::idle_consent_makes_zero_rpcs"]
only = false
platforms = ["linux"]
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "wake-migration-omits-the-deadline-order-index"
platforms = ["linux"]
guards = "The next-wake deadline query stops at the first live deadline through an ordered index"
file = "crates/basal-core/src/schema.rs"
old = "CREATE INDEX runs_state_deadline ON runs(state,deadline_at) WHERE deadline_at IS NOT NULL;"
new = "-- NON-VACUITY BREAK: deadline order index omitted."
edits = []
test_file = "crates/basal-core/src/maintenance.rs"
runner = "cargo"
package = "basal-core"
target = "--lib"
select = "expected"
expect_red = ["maintenance::tests::timer_plans_use_the_ordered_wake_indexes"]
only = false
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "local-primitives-ask-the-model-host-for-a-scope"
platforms = ["macos"]
guards = "kv, clock and random calls need no flow scope, so a flow without a model grant can use them"
file = "crates/basal-host/src/routing.rs"
old = """
            return Ok(());
        }
        self.target(kind).provider_ready(flow_id, kind)"""
new = """
            // NON-VACUITY BREAK: local primitives fall through to the model host.
        }
        self.target(kind).provider_ready(flow_id, kind)"""
edits = []
test_file = "crates/basal-testkit/tests/global_model_scope.rs"
runner = "cargo"
package = "basal-testkit"
target = "--test global_model_scope"
expect_red = ["local_primitives_need_no_model_scope"]
only = true
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "content-addressed-copy-is-not-rewritten"
guards = "An existing executable copy is reused without changing its modification time"
file = "crates/basal-testkit/src/binaries.rs"
old = """
if destination.is_file() {
        return Ok(());
    }"""
new = """
if destination.is_file() {
        fs::remove_file(destination)?; // NON-VACUITY BREAK
    }"""
edits = []
test_file = "crates/basal-testkit/src/binaries.rs"
runner = "cargo"
package = "basal-testkit"
target = "--lib"
expect_red = ["binaries::tests::pre_existing_complete_copy_is_reused_without_rewriting"]
only = true
platforms = ["linux"]
timeout_s = 600
build_timeout_s = 3600

[[control]]
id = "content-addressed-directory-uses-path-not-bytes"
guards = "Changed executable bytes select a different content-addressed directory"
file = "crates/basal-testkit/src/binaries.rs"
old = "let digest_name = digest.to_hex().to_string()[..16].to_owned();"
new = """
let digest_name = blake3::hash(sources[0].2.as_os_str().as_encoded_bytes())
            .to_hex()
            .to_string()[..16]
            .to_owned(); // NON-VACUITY BREAK"""
edits = []
test_file = "crates/basal-testkit/src/binaries.rs"
runner = "cargo"
package = "basal-testkit"
target = "--lib"
expect_red = ["binaries::tests::changed_binary_bytes_use_a_different_directory"]
only = true
platforms = ["linux"]
timeout_s = 600
build_timeout_s = 3600