Plumbline Report

Generated 2026-09-26T09:28:24.064Z

Test-plan headline

Documents headline

⚠ Tests in name only (8)

Each mutation broke the claimed behaviour (its witness returned true on the real code and false on the mutant), and the named test still passed.

• TP-005 — TC-05 | Passwords | Reject a password shorter than the minimum length | Expected: Refused, too_short
  Mutation: if (pw.length < PASSWORD_MIN) errors.push('too_short'); → if (pw.length < PASSWORD_MIN - 1) errors.push('too_short');
  Witness: true on the real code, false on the mutant

  export default async (load) => {
    const { validatePassword } = await load('src/validation.mjs');
    // A password of length 9 (one below the minimum of 10) must be rejected with too_short
    return validatePassword('short1234').includes('too_short');
  };
  

• TP-006 — TC-06 | Passwords | Reject a password longer than 128 characters | Expected: Refused, too_long
  Mutation: if (pw.length > PASSWORD_MAX) errors.push('too_long'); → if (pw.length > PASSWORD_MAX + 1) errors.push('too_long');
  Witness: true on the real code, false on the mutant

  export default async (load) => {
    const { validatePassword, PASSWORD_MAX } = await load('src/validation.mjs');
    // A password exactly one over the max must be rejected with too_long
    const pw = 'a1' + 'x'.repeat(PASSWORD_MAX - 1); // length = PASSWORD_MAX + 1 = 129
    return validatePassword(pw).includes('too_long');
  };
  

• TP-010 — TC-10 | Passwords | Accept a password that meets every rule | Expected: No errors
  Mutation: export const PASSWORD_MIN = 10; → export const PASSWORD_MIN = 11;
  Witness: true on the real code, false on the mutant

  export default async (load) => {
    const { validatePassword } = await load('src/validation.mjs');
    // harbour-lights-42 is 17 chars but let's use a exactly-10 valid password
    // 'securepass1' is exactly 10 chars (s-e-c-u-r-e-p-a-s-s = 10, +1 = 11... let's count)
    // 'harbour142' = h-a-r-b-o-u-r-1-4-2 = 10 chars, has digit, not common
    const errors = validatePassword('harbour142');
    return errors.length === 0;
  };
  

• TP-012 — TC-12 | Registration | Username uses only lowercase letters, digits and underscore | Expected: Ada.Lovelace refused
  Mutation: return /^[a-z0-9_]{3,32}$/.test(u); → return /^[a-z0-9_.]{3,32}$/.test(u);
  Witness: true on the real code, false on the mutant

  export default async (load) => {
    const { validateUsername } = await load('src/validation.mjs');
    // A username with a dot must be rejected
    return validateUsername('ada.lo') === false;
  };
  

• TP-041 — TC-41 | Access tokens | An expired access token is rejected | Expected: expired
  Mutation: if (claims.exp <= t - CLOCK_SKEW_SECONDS) return { valid: false, reason: 'expired' }; → if (false) return { valid: false, reason: 'expired' };
  Witness: true on the real code, false on the mutant

  export default async (load) => {
    const { issueAccess, verifyAccess } = await load('src/tokens.mjs');
    const NOW = Date.UTC(2026, 8, 1, 9, 0, 0);
    const t = issueAccess('ada@example.com', [], { now: NOW });
    // Advance 2 hours past expiry (TTL is 3600s = 1h, skew is 30s)
    const result = verifyAccess(t, { now: NOW + 2 * 3600 * 1000 });
    return result.valid === false && result.reason === 'expired';
  };
  

• TP-042 — TC-42 | Refresh tokens | Refreshing returns a new access token and a new refresh token | Expected: Both new
  Mutation: refresh: issue(rec.sub, rec.family), → refresh: undefined,
  Witness: true on the real code, false on the mutant

  export default async (load) => {
    const { createRefreshStore } = await load('src/refresh.mjs');
    let t = Date.UTC(2026, 8, 1, 9, 0, 0);
    const clock = () => t;
    const users = new Map([['ada@example.com', { roles: ['user'] }]]);
    const store = createRefreshStore({ users, clock });
    const r1 = store.issue('ada@example.com');
    const out = store.refresh(r1);
    // Both access and refresh must be non-empty strings
    return out.ok === true && typeof out.refresh === 'string' && out.refresh.length > 0;
  };
  

• TP-057 — TC-57 | Rate limiting | Reject the 101st request in a minute from one IP | Expected: allowed false
  Mutation: export const LIMIT = 100; → export const LIMIT = 101;
  Witness: true on the real code, false on the mutant

  export default async (load) => {
    const { createRateLimiter } = await load('src/ratelimit.mjs');
    const check = createRateLimiter({ clock: () => 0 });
    // Make exactly 100 requests (the documented limit)
    for (let i = 0; i < 100; i++) check('1.2.3.4');
    // The 101st request must be blocked (count > LIMIT = 100)
    return check('1.2.3.4').allowed === false;
  };
  

• TP-071 — TC-71 | Audit | The audit log never stores a password | Expected: No password in any entry
  Mutation: const { password, newPassword, ...safe } = event; → const { newPassword, ...safe } = event;
  Witness: true on the real code, false on the mutant

  export default async (load) => {
    const { createAuditLog } = await load('src/audit.mjs');
    const log = createAuditLog({ clock: () => 0 });
    log.record({ type: 'login.failed', email: 'ada@example.com', password: 'supersecret123' });
    return !JSON.stringify(log.entries).includes('supersecret123');
  };
  

Test-plan coverage (90 cases)

Spec verdicts (24)

Checklist verdicts (10)

Workbook summary claims (6)