Improve tests

[expede]

• Add cargo-mutants
• Convert unit tests to prop tests where possible
• Fix a couple things that showed up in the props

[Copilot]

🟡 Changes recommended

onomancy_wasm/src/verify.rs now feature-gates freshness_rank even though it is used unconditionally, which breaks compilation when building onomancy_wasm without the names feature.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR strengthens the project’s test suite and contract assertions by expanding property-based testing (bolero), adding offline transport tests for both wasm DoH and the Hickory courier, tightening error/reason-code expectations across JS/Wasm surfaces, and wiring mutation testing (cargo-mutants) into CI (scoped to PR diffs).

Changes:

• Add cargo-mutants tooling/config and a PR-diff-scoped mutation-testing job in GitHub Actions (plus Nix app wiring).
• Convert/extend many unit tests into property tests and add new offline transport tests (wasm DoH + Hickory sockets).
• Tighten and publish more explicit JS/Wasm API shapes and reason-code behaviors (e.g., WalkOutcome union + drift tests, refusal mappings).

File summaries

File	Description
onomancy_wasm/tests/verify.rs	Adds wasm tests pinning refusal codes and security-signaling vs wiring errors.
onomancy_wasm/tests/issue.rs	Tightens issuance/assembly refusal expectations and factors out reason extraction.
onomancy_wasm/tests/doh.rs	New offline DoH transport tests via a fake globalThis.fetch.
onomancy_wasm/tests/browser.rs	Strengthens Name parsing/shape assertions and partial-walk outcome field checks.
onomancy_wasm/tests/browser_live.rs	Adds stronger assertions about live-browser verdict payload fields.
onomancy_wasm/src/verify.rs	Minor import cleanup and attempts to cfg-gate freshness_rank.
onomancy_wasm/src/shapes.rs	Exposes new JsWalkOutcome extern type for TS bindings.
onomancy_wasm/src/shapes.d.ts	Adds TS WalkOutcome/WalkStatus/PartialWalkReason unions and documentation.
onomancy_wasm/src/refusal.rs	Extends refusal mapping (e.g., UnrepresentableName → invalid-hostname) and improves mapping tests.
onomancy_wasm/src/held.rs	Returns typed WalkOutcome, centralizes emitted string literals, and adds drift tests against .d.ts.
onomancy_wasm/src/clock.rs	Replaces example-based tests with stronger boundary checks + host-only property tests.
onomancy_wasm/e2e/tests/walks.spec.ts	Adjusts e2e assertions to the published union shape (WalkOutcome).
onomancy_wasm/e2e/tests/verify.spec.ts	New e2e spec asserting verify APIs work through the packaged dist build.
onomancy_wasm/e2e/tests/names.spec.ts	Strengthens e2e Name rejection assertions (real Error + no reason).
onomancy_wasm/e2e/tests/documents.spec.ts	Adds fixture-based e2e coverage for “references vs plain values” in document edges.
onomancy_wasm/e2e/fixtures/README.md	Documents e2e fixture provenance and drift expectations.
onomancy_wasm/Cargo.toml	Adds web-sys dev features for tests and host-only bolero dev-dep setup.
onomancy_publish/tests/ceremonies.rs	Adds tests for refusal-at-plan-time scenarios and oversize carriage behavior.
onomancy_protocol/src/verifier/verdict.rs	Expands verifier verdict tests to pin more extracted facts (window, doc/generation, mismatch info).
onomancy_protocol/src/verifier/state/prune.rs	Adds stronger invariant checks and new tests/properties around pruning behavior.
onomancy_protocol/src/verifier/state/diff.rs	Adds more diff behavior tests and property-based invariants (including pinned FIXME behavior).
onomancy_protocol/src/test_utils.rs	Adds multi-host utilities and generalized binding/statement factories.
onomancy_protocol/src/resolve.rs	Minor test cleanup (removes unnecessary clone/drop).
onomancy_protocol/src/ladder.rs	Adds additional property tests to pin ordering/lattice behavior.
onomancy_keyhive/tests/authority.rs	Adds extensive new authority tests covering signing bars, replay fixpoints, and more.
onomancy_keyhive/src/carriage.rs	Strengthens carriage parsing/roundtrip tests and adds property tests.
onomancy_keyhive/Cargo.toml	Adds bolero dev-dependency for property tests.
onomancy_hickory/tests/offline.rs	New offline socket-based transport tests for the Hickory courier.
onomancy_hickory/src/stub.rs	Adds StubResolver::server() accessor for testability/introspection.
onomancy_hickory/src/provider.rs	Makes resolv.conf parsing pure/testable (resolv_conf), adds with_fallback + upstream introspection.
onomancy_dnssec/tests/vectors/README.md	Fixes vector regeneration instructions and catalog path reference.
onomancy_dnssec/tests/replay.rs	Adds non-uniform window test coverage to ensure ∩-window arithmetic is pinned.
onomancy_dnssec/tests/real_world.rs	Clarifies real-world fixture provenance comment.
onomancy_dnssec/tests/golden_vectors.rs	Strengthens golden vector assertions (explicit variants) and adds more precise decode error checks.
onomancy_dnssec/tests/fixtures.rs	Tightens fixture expectations to assert exact error variants for invalid fixtures.
onomancy_dnssec/src/zone_state_key.rs	Adds test pinning zone_vouched() projection behavior.
onomancy_dnssec/src/wire/txt.rs	Adds test for legal empty TXT RDATA shape ([0]).
onomancy_dnssec/src/wire/rrsig.rs	Adds exhaustive truncation test and more signature/rrset canonicalization tests.
onomancy_dnssec/src/wire/rr_type.rs	Adds Display coverage test including RFC 3597 unknown-type formatting.
onomancy_dnssec/src/wire/record.rs	Adds test pinning oversized-RDATA write behavior (clamped corrupt frame).
onomancy_dnssec/src/wire/name.rs	Makes onomancy_owner fallible with proper wire-length checks + adds boundary tests/properties.
onomancy_dnssec/src/wire/ds.rs	Adds truncated-header and parse-vs-validate layering tests.
onomancy_dnssec/src/wire/dnskey.rs	Adds flag-shape tests and moves key-tag oracle to properties over arbitrary bodies.
onomancy_dnssec/src/wire/cname.rs	Tightens trailing-bytes error variant and adds more target-shape coverage.
onomancy_dnssec/src/validator.rs	Plumbs UnrepresentableName through validation and improves type imports.
onomancy_dnssec/src/txt/serial.rs	Adds property asserting accepted serial spellings are canonical.
onomancy_dnssec/src/txt/record.rs	Adds more precise parsing diagnostics tests (wrong key lengths, non-curve points, parse vs classify).
onomancy_dnssec/src/trust_anchor.rs	Adds cross-implementation tests against published root KSKs and more conjunctive matches tests.
onomancy_dnssec/src/test_utils/fixtures.rs	Makes invalid fixtures assert exact WalkError variants; updates fixture catalog accordingly.
onomancy_dnssec/src/test_utils.rs	Adds explicit key-tag RRSIG helper and updates TXT record owner construction to handle fallibility.
onomancy_dnssec/src/statement/successor.rs	Adds more decode-shape tests and improves property coverage with varied hostname lengths.
onomancy_dnssec/src/statement/rotation.rs	Adds non-point field tests and attached-vs-signed-region invariants.
onomancy_dnssec/src/link.rs	Expands link framing validation tests (mixed owners, signature owner mismatch, class checks, rollover).
onomancy_dnssec/src/dns_name.rs	Adds many boundary and canonicality tests plus structured generators for accept paths.
onomancy_dnssec/src/crypto.rs	Adds RFC vectors (RSA/ECDSA) and more policy tests + properties around RSA key splitting.
onomancy_dnssec/src/chain.rs	Adds hostile-count guard test and properties for framed roundtrip/trailing-bytes behavior.
onomancy_dnssec/src/certificate.rs	Adds many decode/strictness tests (lineage bounding, non-point fields, indices, duplicates, tampering invariants).
onomancy_dnssec/examples/generate_vectors.rs	Updates vector regeneration docs to point at the correct crate/catalog location.
onomancy_core/src/wire.rs	Adds boundary tests and bolero properties for truncation/length bounding and consumption behavior.
onomancy_core/src/name/segment.rs	Adds property test pinning the exact segment acceptance predicate.
onomancy_core/src/name.rs	Tightens error-variant assertions, adds anchor/segment parsing helpers tests, and serde roundtrip tests/properties.
onomancy_core/src/digest.rs	Adds BLAKE3 known-answer test and stronger manual impl property coverage (Eq/Ord/Hash).
onomancy_core/src/delegation_chain.rs	Adds hostile-count guard test and framed roundtrip/trailing-bytes properties.
onomancy_core/src/anchor/doc.rs	Adds more parse/ordering tests and improves property coverage for parse outcomes.
onomancy_core/Cargo.toml	Adds serde_json dev-dependency for serde-focused tests.
onomancy_chain/src/builder.rs	Adds hop-bound tests, unsigned-cut framing test, unrepresentable-hostname test, and cap-boundary tests/properties.
onomancy_chain/Cargo.toml	Adds bolero dev-dependency for property tests.
onomancy_automerge/tests/walk.rs	Strengthens walk landing assertions and adds greedy-matching property test.
onomancy_automerge/src/petname.rs	Makes rename-to-self a no-op and adds extensive tests/properties for divergence join and write behaviors.
onomancy_automerge/src/namestore.rs	Strengthens invariants around empty docs, replica authority grades, and adds property coverage.
onomancy_automerge/src/decisions.rs	Adds version-shape gating tests, malformed reset handling, and fuzz/property tests for total reads.
onomancy_automerge/src/change_hash.rs	Converts conversion tests to a property over all 32-byte values.
onomancy_automerge/src/certificates.rs	Strengthens certificate list semantics tests and adds more edge-case coverage (references, garbage siblings).
onomancy_automerge/Cargo.toml	Adds bolero dev-dependency for property tests.
HACKING.md	Documents mutation-testing tier and updates testing strategy table formatting.
flake.nix	Adds ci-mutants app and updates CI messaging about what local ci does not run.
Cargo.lock	Updates lockfile for new dev-deps (bolero, serde_json, etc.).
.github/workflows/ci.yml	Adds PR-only, diff-scoped cargo-mutants job with artifact upload.
.cargo/mutants.toml	New cargo-mutants configuration (features, excludes, workspace testing, timeouts).

Review details

• Files reviewed: 79/81 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.