claim-audit/app/scripts/mutate.mjsBoth live repositories published a 100% mutation score. Both were manufactured. Mutation testing breaks the code on purpose and records a mutant as killed the moment any gate exits nonzero — but it never checked whether that gate was ALREADY failing on unmutated code. In business #1 three of seven gates in the oracle were red before a single line was broken; one of them, check-complete.mjs, is red because the domain and the founder interviews are outstanding, which no mutation can change. In this repository two of seven read sibling checkouts that do not exist inside a mutation sandbox. Every mutant was "killed" by a gate that would have said exactly the same thing about untouched source. The honest scores are 7% and 12.5%.
Why nothing caught it. The tool whose entire job is to prove the other gates can fail had no check that it could itself fail. Worse, when the guard was finally written it did not work either: shards were spawned with stdio ignored and their exit codes never read, so the guard halted its shard, printed its explanation to a discarded stream, and the parent collected the shards that survived and reported a score. A halt nobody hears is not a halt.
What catches it now. scripts/mutate.mjs runs every oracle gate against an unmutated sandbox first and HALTS on any red, and the parent now reads each shard exit code and aborts the run with its output shown. Gates that cannot be honest oracles were removed from the oracle with the reason written beside them — they still run in npm run verify, where their red is the correct answer. The formal-methods name for this is a vacuous pass: Beer, Ben-David, Eisner and Rodeh, 2001.