git:20260428.debfb29 to git:20260914.d30ab4d

73 added, 36 removed. Audit A to A.

---

name: mutation-testing

- description: "Configures mewt or muton mutation testing campaigns — scopes targets, tunes timeouts, and optimizes long-running runs. Use when the user mentions mewt, muton, mutation testing, or wants to configure or optimize a mutation testing campaign."

+ description: "Configures mewt or muton campaigns, analyzes surviving mutants, and investigates bugs exposed by testing gaps. Use when setting up mutation testing, reviewing campaign results, identifying equivalent mutants, or finding bugs from surviving mutations."

allowed-tools: Read Write Bash Grep

---

- # Mutation Testing — Campaign Configuration (mewt/muton)

+ # Mutation Testing (mewt/muton)

- > **Note**: muton and mewt share identical interfaces but target different languages — mewt for general-purpose languages (Rust, Solidity, Go, TypeScript, JavaScript), muton for TON smart contracts (Tact, Tolk, FunC). All examples use `mewt` commands, but they work exactly the same with `muton`. File names change accordingly: `mewt.toml` → `muton.toml`, `mewt.sqlite` → `muton.sqlite`.

+ Routes to the right mutation testing workflow and loads the references that workflow needs.

+ > **Note**: muton and mewt share identical interfaces. Examples use `mewt`; substitute `muton` and its file names (`muton.toml`, `muton.sqlite`) for muton projects.

+ `mewt --help` and `mewt <subcommand> --help` are the source of truth for command-line behavior. Examples below reflect the mewt 4.x API; run `--help` when a flag looks unfamiliar or a command fails.

## When to Use

Use this skill when the user:

- Mentions "mewt", "muton", or "mutation testing"

- - Needs to configure or optimize a mutation testing campaign

- - Wants to run `mewt run` and needs help getting set up first

+ - Wants to configure, scope, or speed up a mutation testing campaign

+ - Wants to analyze mutation results — surviving/uncaught mutants, equivalent mutants, kill rate

+ - Wants to use mutation results to find bugs in the source code

## When NOT to Use

- Do not use this skill when the user:

- - Wants to analyze or report on completed campaign results

- - Asks about tests or coverage without mentioning mutation testing

+ Do not use this skill when the user asks about tests or line coverage without any mutation testing context.

---

- ## Quick Start

+ ## Routing

- Load [workflows/configuration.md](workflows/configuration.md) — a 5-phase guide from `mewt init` to a validated, ready-to-run campaign.

+ Pick the workflow, then load it together with the references listed for it. Workflows and references do not load each other — that decision belongs here.

- **General question or unfamiliar command?**

- Run `mewt --help` or `mewt <subcommand> --help`, then assist.

+ **Setting up, scoping, or speeding up a campaign**

+ → [workflows/configuration.md](workflows/configuration.md)

+ → Also load [references/optimization-strategies.md](references/optimization-strategies.md) when the campaign estimate is long enough to need trimming, or the user asks to make it faster.

- ---

+ **Campaign finished, hunting for bugs in untested code**

+ → [workflows/bug-hunter.md](workflows/bug-hunter.md)

- ## Reference Index

+ **Turning results into a formal analysis report**

+ → [workflows/analyzing-results.md](workflows/analyzing-results.md), plus:

+ - [references/equivalent-mutants.md](references/equivalent-mutants.md) — equivalence catalog and verification procedure

+ - [references/severity-classification.md](references/severity-classification.md) — severity tier criteria

+ - [references/report-template.md](references/report-template.md) — report structure

+ - [references/blockchain-patterns.md](references/blockchain-patterns.md) — **only** for Solidity, Move, FunC/Tolk, Cairo, or Solana Rust targets

+ - [references/input-formats.md](references/input-formats.md) — unless the results came from mewt or muton. Foreign tool output may not be self-describing; this covers the parsing anchors for slither-mutate, mull, and dextool-mutate

- | File | Content |

- |------|---------|

- | [workflows/configuration.md](workflows/configuration.md) | 5-phase guide: init, scope, optimize, validate, run |

- | [references/optimization-strategies.md](references/optimization-strategies.md) | Per-file targeting, two-phase campaigns, mutation type filtering |

+ **Anything else** → run `mewt --help` or `mewt <subcommand> --help`, then assist directly.

---

## Essential Commands

```bash

- # Initialize and mutate

- mewt init # Create mewt.toml and mewt.sqlite

- mewt mutate [paths] # Generate mutants without running tests

- mewt run [paths] # Run the full campaign

+ # Set up and run

+ mewt init # Create config and database

+ mewt mutate [paths] # Generate mutants without testing them

+ mewt run [paths] # Generate mutants and run the campaign

- # Inspect configuration and scope

- mewt print config # View effective configuration

- mewt print targets # Table of all targeted files

- mewt print mutations --language [lang] # Available mutation types

- mewt status # Mutant count and per-file breakdown

+ # Read results

+ mewt status # Overview with per-file breakdown

+ mewt results # Uncaught mutants (default view)

+ mewt results --all # Every outcome, not just uncaught

+ mewt results --format json # json | sarif | ids | table

- # Investigate specific mutants

- mewt print mutants --target [path] # All mutants for a file

- mewt print mutants --severity high # Filter by severity

- mewt print mutant --id [id] # View mutated code diff

- mewt test --ids [ids] # Re-test specific mutants

+ # Narrow down (these filters work on both `results` and `print mutants`)

+ mewt results --target 'src/auth/**' # Quote globs so the shell does not expand them

+ mewt results --severity high,medium

+ mewt results --mutation-types ER,CR

+ mewt results --status Uncaught # Uncaught | TestFail | Skipped | Timeout

+ mewt results --line 42

+ # Investigate and re-test

+ mewt print mutant --id [id] # View the mutated code

+ mewt test --ids [ids] # Re-test specific mutants

+ mewt test --ids-file uncaught_ids.txt # Re-test IDs from a file, or '-' for stdin

+ # Inspect configuration

+ mewt print config # Effective config

+ mewt print targets # Files actually mutated

+ mewt print mutations --language [lang] # Mutations and severities for a language

```

+ Language labels are canonical `family` or `family/dialect` values in mewt 4.x — for example `rust`, `javascript/ts`, `move/sui`, `move/iota`.

---

## What Results Mean

- - **Caught/TestFail**: Tests detected the mutation (good)

- - **Uncaught**: Mutation survived — indicates untested logic

- - **Timeout**: Tests took too long, inconclusive

- - **Skipped**: A more severe mutant already failed on the same line

+ - **Caught/TestFail**: tests detected the mutation (good)

+ - **Uncaught**: tests did not detect the change. Inspect the code to distinguish a testing gap from an equivalent mutation.

+ - **Timeout**: tests took too long — inconclusive, not evidence of coverage

+ - **Skipped**: a less severe mutant was skipped because a more severe mutant on the same line was uncaught

+ ---

+ ## Interpreting Mutation Types

+ `mewt print mutations --language [lang]` lists every mutation slug, description, and severity for a language, and is authoritative — the operator set grows with each release. What that output does not tell you is what a survivor *means*, which is where prioritization comes from:

+ | Severity | Representative slugs | What an uncaught mutant tells you |

+ |----------|---------------------|-----------------------------------|

+ | High | `ER` (Error Replacement) | Tests tolerate the injected error. Investigate whether the path executes, whether error handling masks the change, and whether assertions check the outcome. |

+ | Medium | `CR` (Comment Replacement) | Removing the statement does not fail the tests. Check whether its effects matter and whether assertions observe them. |

+ | Medium | `IF`/`IT` (If False/True), `NR` (Negation Removal) | Tests do not distinguish the changed condition. Both constant replacements surviving can indicate an unexecuted condition or weak assertions on the branch outcomes. |

+ | Low | Operator shuffles (`AOS`, `COS`, `LOS`, `BOS`, shift/assignment variants), `BL`, `AS`, `LC`, `WF` | Check boundary inputs, arithmetic assertions, and semantic equivalence. The mutation result alone does not establish whether the code executed. |

+ Severity ranks the *mutation*, not the risk. A low-severity survivor in a fee calculation matters more than a high-severity survivor in a log line — weigh what the mutated code does. Filter with `--severity` to work through the results in priority order.