INDEPENDENCE v0.5.0 — The Gremlin Breeding Laboratory 👹

#RELEASE NOTES#

INDEPENDENCE v0.5.0 — THE GREMLIN BREEDING LABORATORY 👹

Breed the Bugs. Test the Tests.

Release date: 30 October 2026
Organisation: QSOL-IMC
Release type: Feature Release / Mutation Testing Research
Previous version: v0.4.0
Licence: Apache-2.0

THE GREMLINS HAVE ESCAPED THE MUSEUM.

THIS TIME, WE BRED THEM ON PURPOSE.

Overview

INDEPENDENCE v0.5.0 introduces THE GREMLIN BREEDING LABORATORY, a deterministic mutation-testing environment designed to investigate a fundamental question in software engineering:

Do our tests actually detect defects, or do they merely pass?

Following the Declaration of Independence, Evidence Ledger, Dependency Tribunal, and Gremlin Museum, this release advances the project's evidence-first engineering philosophy by deliberately introducing harmless behavioural defects into isolated functions and measuring whether regression tests identify them.

The laboratory includes 15 predefined software mutants, five independently testable function families, deterministic execution ordering, two test-suite configurations, and reproducible evidence receipts.

Everything operates locally using vanilla HTML, CSS, JavaScript, and the Python standard library.

No npm. No Node.js build pipeline. No Docker. No Kubernetes. No third-party application packages.

Live laboratory: https://qsolkcb.github.io/INDEPENDENCE/#breeding

Repository: https://github.com/QSOLKCB/INDEPENDENCE

---

New Features

1. The Gremlin Breeding Laboratory — GREMLIN-BREEDING/1

Introduced a dedicated interactive mutation-testing laboratory within the INDEPENDENCE website.

Unlike the Gremlin Museum, which preserves previously identified defects, the Breeding Laboratory deliberately introduces controlled behavioural changes to evaluate test effectiveness.

Users can select a deterministic seed, choose a test-suite strength, execute the mutation experiments, inspect individual results, and export verification receipts.

Every mutation is predefined and operates exclusively on isolated, first-party functions and inert test data.

No application source files are modified or dynamically executed.

2. Fifteen Deliberately Bred Gremlins

Introduced five mutation-testing targets, each containing three intentionally defective implementations.

Target	Mutants	Research focus
SHA-256 Receipt Validation	3	Identifier and boundary validation
HTML Output Encoding	3	Missing character escaping
Finite JSON Validation	3	Numeric and recursive validation
Repository Path Scoping	3	Dependency-directory detection
Remote Module Import Detection	3	Incomplete static import recognition
Total	15	Five independent target families

The mutations include relaxed validation boundaries, missing escaping rules, incomplete recursive checks, incorrect filesystem scope, and omitted JavaScript import forms.

Every mutant has at least one known divergence from its corresponding reference implementation.

3. Two Test-Suite Configurations

Introduced two selectable testing configurations to demonstrate how test coverage influences defect detection.

Smoke Suite — Deliberately Incomplete

A minimal set of test cases intended to demonstrate how software defects can escape insufficient regression coverage.

Full Fixture Suite — Expanded Verification

An expanded test collection designed to detect the known behavioural differences introduced by all 15 predefined mutants.

The laboratory produces actual results from executing the fixed functions against the selected tests.

4. Mutation Detection Results

The frozen v0.5.0 fixture catalogue produced the following deterministic outcomes:

Metric	Smoke Suite	Full Fixture Suite
Mutants evaluated	15	15
Mutants killed	2	15
Mutants survived	13	0
Mutation score	13.3%	100%

A mutant is classified as KILLED when at least one selected test detects a difference from the expected behaviour.

A mutant SURVIVES when the selected test suite does not detect its known behavioural defect.

These results describe only the curated mutation catalogue.

A 100% score does not demonstrate complete application correctness, repository-wide test coverage, or the absence of vulnerabilities.

5. Baseline Oracle Verification

Introduced mandatory reference-behaviour verification before mutation testing begins.

The engine validates all 26 baseline oracle cases, regardless of the selected test suite.

Mutation testing cannot proceed successfully if a baseline produces an unexpected result.

Every mutant must also demonstrate at least one known difference from its reference implementation.

Equivalent or unproven mutants cause the experiment to fail rather than inflate or distort the mutation score.

CORRECTNESS BEFORE CLASSIFICATION.

6. Deterministic Mutation Ordering

Implemented reproducible mutation ordering using seeded xorshift32 and Fisher–Yates shuffling.

Features include:

• Configurable nonzero 32-bit seed.
• Stable mutation identifiers.
• Reproducible execution order.
• Fixed input fixtures.
• Explicit divergence witnesses.
• Deterministic kill/survival classifications.
• Reproducible mutation scores.

Changing the seed changes the evaluation order without changing the predefined behavioural differences or expected total scores.

7. Interactive Mutation Results

Introduced a responsive browser dashboard displaying:

• Mutation target and identifier.
• Mutation operator description.
• KILLED or SURVIVED classification.
• Selected tests that detected the mutation.
• Known divergence witnesses.
• Total mutants evaluated.
• Total killed and surviving mutants.
• Mutation detection score.

The interface distinguishes actual detected failures from known defects the selected tests missed.

All output is presented using native DOM text rendering.

No external visualisation library or application framework is required.

8. SHA-256 Mutation Evidence Receipts

Introduced downloadable evidence receipts using native browser WebCrypto.

Each receipt includes the experimental protocol, seed, suite selection, baseline verification count, deterministic mutation order, mutant identifiers, selected-suite failures, known divergence witnesses, classification results, aggregate mutation score, and explicit limitations.

The report's exact UTF-8 JSON payload is hashed using SHA-256.

Receipts are generated locally and are not uploaded to an external service.

The hash supports payload-integrity verification but does not authenticate the person or environment that produced the report.

9. Independent Python Receipt Verification

Introduced scripts/verify_breeding.py, a Python standard-library-only verifier.

The verifier independently encodes the expected mutation catalogue and validates:

• Exact SHA-256 payload integrity.
• Protocol and schema identities.
• Valid experimental parameters.
• Recognised mutation operators.
• Deterministic seeded ordering.
• Expected divergence witnesses.
• Correct KILLED/SURVIVED classifications.
• Accurate aggregate mutation scores.
• Explicit evidence limitations.
• Strict JSON structure and numeric validity.

The verifier rejects altered receipts even when the manipulated JSON has been resealed with a valid SHA-256 digest.

A valid receipt demonstrates consistency with the published fixed-fixture protocol, not independently authenticated browser execution.

10. Expanded Regression Testing

Added 18 Python regression-test methods covering valid smoke/full receipts, deterministic ordering, invalid seeds, unsupported suites, receipt tampering, forged classifications, altered mutation scores, fabricated witnesses, duplicate JSON properties, non-finite numeric values, and deployment invariants.

Eight additional browser self-checks cover mutation outcomes, deterministic replay, mutation witnesses, configuration validation, and catalogue integrity.

Development verification: 33/33 JavaScript self-checks passed in an isolated JavaScript environment using a minimal DOM model.

The complete Python test suite was committed for independent execution through the GitHub Pages deployment workflow. No independently observed full-suite passing result is asserted here.

11. GitHub Pages Deployment Integration

Extended the existing manually triggered GitHub Pages workflow to include:

• breeding/core.js
• breeding/ui.js
• breeding/breeding.css

The source audit now includes the new web assets, and deployment retains the project's existing Python verification requirements.

No package installation, application bundling, or container build is required.

---

Reproducibility

Run the complete Python regression suite:

python3 -m unittest discover -s tests -v

Run the repository static audit:

python3 scripts/audit.py --json

Start a local development server:

python3 -m http.server 8000

Open:

http://localhost:8000/#breeding

Select the Smoke or Full Fixture Suite, execute the experiment, and download the resulting SHA-256 evidence receipt.

Verify an exported receipt:

python3 scripts/verify_breeding.py gremlin-breeding-<hash>.json --json

The commands require Python's standard library only.

---

Engineering Governance

v0.5.0 introduces additional formal engineering invariants covering mutation safety, deterministic execution, evidence integrity, and scientific scope.

The laboratory must not modify deployed source files, execute dynamically generated code, install third-party packages, interact with external systems, or interpret inert test strings as executable instructions.

Every mutant requires a demonstrable behavioural difference. Every baseline must pass its oracle checks. Every reported result must be reproducible under the fixed fixture contract.

Updated documentation includes:

• docs/BREEDING.md — Mutation-testing protocol and limitations.
• docs/INVARIANTS.md — Determinism, safety, and evidence requirements.
• docs/EVIDENCE.md — Mutation-result interpretation.
• docs/ROADMAP.md — Completed v0.5.0 development phase.
• README.md — Usage and reproducibility instructions.

---

👹 GREMLIN NOTES™ — v0.5.0

The Museum was getting overcrowded, so QSOL-IMC built a breeding facility.

GREMLIN-007 — The Mutation Nursery

Classification: Deliberate Test Specimens
Severity: N/A — Controlled Research Fixtures
Status: 15 MUTANTS SUCCESSFULLY CULTIVATED

The experiment

Fifteen deliberately defective variants were introduced into isolated functions.

The mutants were not accidental production bugs or newly discovered vulnerabilities.

They were intentionally constructed to examine the effectiveness of different test selections.

The initial smoke suite detected only two of the fifteen mutations.

Thirteen Gremlins survived.

The expanded fixture suite detected all fifteen.

Root cause of the survivors

The smoke suite did not exercise the particular input boundaries and behavioural conditions required to expose thirteen known differences.

The tests passed their selected assertions, but that did not imply they were capable of detecting every deliberately introduced defect.

Eradication

Expanded fixture coverage exposed the missing behaviours.

Additional tests addressed validation boundaries, character escaping, nested non-finite values, directory scoping, and JavaScript import syntax.

Gremlin verdict: ALL FIFTEEN CULTIVATED SPECIMENS DETECTED BY THE FULL SUITE.

The smoke tests told thirteen Gremlins they were free to go. The full suite checked their paperwork.

---

GREMLIN-008 — The Forbidden Word in the Safety Check

Classification: Development-Time Test False Positive
Severity: Minor / Internal
Status: CORRECTED BEFORE REVIEW

The incident

During development, a source-safety regression check searched for prohibited dynamic-execution API patterns.

An explanatory source comment contained the literal spelling of one of those prohibited APIs.

The test could therefore mistake documentation mentioning an unsafe operation for executable code using that operation.

Root cause

A deliberately simple source-level string check did not distinguish a comment from executable JavaScript.

Correction

Updated the explanatory comment to avoid triggering the restricted-token check while preserving the documented safety requirement.

No executable mutation behaviour was changed.

Gremlin verdict: FALSE POSITIVE EXTERMINATED.

Apparently you can't even mention a forbidden function without the security department filing a complaint.

---

Final Gremlin Breeding Report

Classification	Count
Deliberately cultivated mutants	15
Baseline oracle cases	26
Mutants killed by Smoke Suite	2
Mutants surviving Smoke Suite	13
Mutants killed by Full Suite	15
Mutants surviving Full Suite	0
New Python regression-test methods	18
New browser self-checks	8

Adversarial review outcome: No issues reported by the maintainer before merge.

Final PR HEAD: 5a4732578e9261e6d1f1f2e72c4350860db74626

Merge commit: 0fe47eace157715cb4ee920bf00ed04757a4d8cf

Merged pull request: #5

No third-party application dependencies were introduced.

---

Release Progression

v0.1.0 — The Declaration of Independence

Established the philosophy of software sovereignty and demonstrated dependency-free browser engineering.

v0.2.0 — The Evidence Ledger

Introduced public repository inventories, source-linked indicators, and reproducible evidence snapshots.

v0.3.0 — The Dependency Tribunal

Introduced paired local experiments, correctness gates, and transparent statistical evidence.

v0.4.0 — The Gremlin Museum

Preserved documented and illustrative software failure modes alongside corrected behaviours and reproducible assertions.

v0.5.0 — The Gremlin Breeding Laboratory

Introduced deterministic mutation testing to evaluate whether tests can detect deliberately introduced defects.

---

Final Declaration

We do not measure engineering quality by the number of passing tests alone.

We demand to know what those tests can actually detect.

We do not mistake mutation scores for universal correctness.

We do not mistake passing fixtures for software security.

We build the experiments.

We introduce controlled defects.

We test the tests.

We preserve the evidence.

AND WHEN THE GREMLINS SURVIVE, WE WRITE BETTER FUCKING TESTS.

NO FRAMEWORK SHALL BECOME OUR MASTER.

CORRECTNESS OUTRANKS COMPLEXITY.

THIS IS NOT WAR. THIS IS A DIVORCE.

Signed,

QSOL-IMC
Independent Software Sovereignty Initiative

THE REVOLUTION WILL NOT BE CONTAINERISED.