[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-trail-of-bits-vector-forge":3,"mdc-bhwerk-key":35,"related-repo-trail-of-bits-vector-forge":3222,"related-org-trail-of-bits-vector-forge":3319},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":30,"sourceUrl":33,"mdContent":34},"vector-forge","generate test vectors via mutation testing","Mutation-driven test vector generation. Finds implementations of a cryptographic algorithm or protocol, runs mutation testing to identify escaped mutants, then generates new test vectors that deliberately exercise the uncovered code paths. Compares before\u002Fafter mutation kill rates to prove vector effectiveness. Use when generating cryptographic test vectors, measuring Wycheproof coverage gaps, finding escaped mutants via mutation testing, creating cross-implementation test suites, or improving test vector coverage for crypto primitives.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"trail-of-bits","Trail of Bits","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftrail-of-bits.png","trailofbits",[13,17,20],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Cryptography","cryptography",{"name":21,"slug":22,"type":16},"Testing","testing",6139,"https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills","2026-07-18T05:47:31.878303",null,541,[29],"agent-skills",{"repoUrl":24,"stars":23,"forks":27,"topics":31,"description":32},[29],"Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows","https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills\u002Ftree\u002FHEAD\u002Fplugins\u002Ftrailmark\u002Fskills\u002Fvector-forge","---\nname: vector-forge\ndescription: \"Mutation-driven test vector generation. Finds implementations of a cryptographic algorithm or protocol, runs mutation testing to identify escaped mutants, then generates new test vectors that deliberately exercise the uncovered code paths. Compares before\u002Fafter mutation kill rates to prove vector effectiveness. Use when generating cryptographic test vectors, measuring Wycheproof coverage gaps, finding escaped mutants via mutation testing, creating cross-implementation test suites, or improving test vector coverage for crypto primitives.\"\n---\n\n# Vector Forge\n\nUses mutation testing to systematically identify gaps in test vector\ncoverage, then generates new test vectors that close those gaps.\nMeasures effectiveness by comparing mutation kill rates before and after.\n\n## When to Use\n\n- Generating test vectors for cryptographic algorithms or protocols\n- Evaluating how well existing test vectors cover an implementation\n- Finding implementation code paths that no test vector exercises\n- Creating Wycheproof-style cross-implementation test vectors\n- Measuring the concrete coverage value of a test vector suite\n\n## When NOT to Use\n\n- No implementations exist yet (need code to mutate)\n- Single trivial implementation with no edge cases\n- Testing application logic rather than algorithm implementations\n- The algorithm has no public test vectors to compare against\n\n## Prerequisites\n\n- **trailmark** installed — if `uv run trailmark` fails, run:\n  ```bash\n  uv pip install trailmark\n  ```\n- At least one implementation of the target algorithm in a\n  language with mutation testing support\n- A test harness that consumes test vectors and exercises\n  the implementation\n- A mutation testing framework for the target language\n\n---\n\n## Rationalizations to Reject\n\n| Rationalization | Why It's Wrong | Required Action |\n|-----------------|----------------|-----------------|\n| \"We have enough test vectors\" | Mutation testing proves otherwise | Run the baseline first |\n| \"The implementation's own tests are sufficient\" | Own tests often share blind spots with the impl | Cross-impl vectors catch different bugs |\n| \"FFI crates can be mutation tested at the binding layer\" | Mutations to wrappers don't affect the underlying impl | Mutate the actual implementation language |\n| \"Timeouts mean the mutation was caught\" | Timeouts are ambiguous — could be killed or alive | Resolve timeouts before drawing conclusions |\n| \"All mutants are equivalent\" | Most aren't — verify by reading the mutation | Classify each escaped mutant individually |\n| \"Checking valid vectors is enough\" | Permissive mutations survive without negative assertions | Assert rejection for every invalid vector |\n| \"Manual analysis is fine\" | Manual analysis misses what tooling catches | Install and run the tools |\n\n---\n\n## Workflow Overview\n\n```\nPhase 1: Discovery       → Find implementations to test\n      ↓\nPhase 2: Harness         → Write\u002Fadapt test vector harness for each impl\n      ↓\nPhase 3: Baseline        → Run mutation testing with existing vectors\n      ↓\nPhase 4: Escape Analysis → Classify escaped mutants by code path\n      ↓\nPhase 5: Vector Gen      → Create test vectors targeting escapes\n      ↓\nPhase 6: Validation      → Re-run mutation testing, compare before\u002Fafter\n      ↓\nOutput: Coverage Report + New Test Vectors\n```\n\n---\n\n## Phase 1: Discovery\n\nFind implementations of the target algorithm. Look for:\n\n1. **Pure implementations** in high-level languages (Go, Rust, Python)\n   — these are the best mutation testing targets\n2. **FFI wrapper crates** — identify these early so you don't waste\n   time mutating wrapper glue code\n3. **Reference implementations** — useful for cross-verification but\n   may not be the best mutation targets\n\nFor each implementation, note:\n- Language and mutation testing framework\n- Whether it's pure code or FFI wrappers\n- Existing test suite size and coverage\n- Which API surface the test vectors will exercise\n\n### Implementation Type Classification\n\n| Type | Mutation Value | Example |\n|------|---------------|---------|\n| Pure implementation | High | zkcrypto\u002Fbls12_381 (Rust), gnark-crypto (Go) |\n| FFI bindings to C\u002Fasm | Low at binding layer | blst Rust crate |\n| C\u002FC++ implementation | High (use Mull) | blst C library |\n| Generated code | Medium (mutations may be equivalent) | gnark-crypto generated field arithmetic |\n\n**Key insight:** If an implementation delegates to another language\nvia FFI, you must mutate the *underlying* implementation, not the\nbindings. For C\u002FC++ underneath Rust\u002FGo\u002FPython, use Mull or similar.\n\n---\n\n## Phase 2: Harness\n\nFor each implementation, create a test harness that:\n\n1. Reads test vectors from JSON files (Wycheproof format recommended)\n2. Exercises the implementation's API for each vector\n3. Asserts **both acceptance and rejection**:\n   - Valid vectors: deserialization succeeds, output matches expected\n   - Invalid vectors: deserialization fails or verification rejects\n4. Adds **roundtrip assertions** for valid deserialization vectors:\n   `serialize(deserialize(bytes)) == bytes`\n5. Reports pass\u002Ffail per vector with test IDs\n\n**Critical:** A harness that only checks valid vectors will miss all\npermissive mutations (e.g., `&` → `|` in validation). See\n[references\u002Flessons-learned.md](references\u002Flessons-learned.md) §7.\n\nThe harness must be runnable by the mutation testing framework.\nFor most frameworks this means:\n- **Go:** A `_test.go` file in the same package as the implementation\n- **Rust:** An integration test in `tests\u002F` or inline `#[test]` functions\n- **Python:** A pytest test file\n- **C\u002FC++:** A test binary linked against the implementation\n\n### Harness Placement\n\nThe harness must live *inside the implementation's package* so the\nmutation framework can see it. This usually means:\n\n```bash\n# Go: add test file to the package being mutated\ncp wycheproof_test.go \u002Fpath\u002Fto\u002Fimpl\u002Fpackage\u002F\n\n# Rust: add integration test\ncp wycheproof.rs \u002Fpath\u002Fto\u002Fcrate\u002Ftests\u002F\n\n# Python: add test to the test directory\ncp test_wycheproof.py \u002Fpath\u002Fto\u002Fpackage\u002Ftests\u002F\n```\n\n### Handling Existing Vectors\n\nIf the implementation already has test vectors:\n1. Run mutation testing with ONLY the existing vectors (baseline)\n2. Run mutation testing with ONLY your new vectors\n3. Run mutation testing with BOTH combined\n4. The delta between (1) and (3) shows the new vectors' value\n\n---\n\n## Phase 3: Baseline\n\nRun mutation testing with existing test vectors only.\n\n### Framework Selection\n\nSee [references\u002Fmutation-frameworks.md](references\u002Fmutation-frameworks.md)\nfor language-specific setup.\n\n| Language | Framework | Command |\n|----------|-----------|---------|\n| Go | gremlins | `gremlins unleash .\u002Fpath\u002Fto\u002Fpackage` |\n| Rust | cargo-mutants | `cargo mutants -j N --timeout T` |\n| Python | mutmut | `mutmut run --paths-to-mutate src\u002F` |\n| C\u002FC++ | Mull | `mull-runner -test-framework=GoogleTest binary` |\n\n### Parallelism\n\nAlways use parallel execution for large codebases:\n- `cargo mutants -j 8` (Rust, 8 parallel workers)\n- `gremlins unleash --timeout-coefficient 3` (Go, increase timeouts)\n- `mutmut run --runner \"pytest -x -q\"` (Python, fail-fast)\n\n### Recording Baseline Results\n\nCapture these metrics per implementation:\n\n| Metric | Description |\n|--------|-------------|\n| Total mutants | Number of mutations generated |\n| Killed | Mutants caught by tests |\n| Survived\u002FLived | Mutants NOT caught (these are the targets) |\n| Not covered | Code paths no test reaches at all |\n| Timed out | Ambiguous — resolve before comparing |\n| Efficacy % | Killed \u002F (Killed + Survived) |\n| Coverage % | (Total - Not covered) \u002F Total |\n\nSave the full mutation log for Phase 4 analysis.\n\n---\n\n## Phase 4: Escape Analysis (Graph-Informed Triage)\n\nClassify each escaped (survived + not covered) mutant using the\nTrailmark call graph for reachability and blast radius analysis.\n\n**This phase MUST use the genotoxic skill's triage methodology.**\nThe call graph transforms mutation results from a flat list of\nsurvived mutants into an actionable, prioritized set of vector\ntargets.\n\n### Step 1: Build the Call Graph\n\nBuild a Trailmark code graph for each implementation before\ntriaging mutations:\n\n```bash\n# Go\nuv run trailmark analyze --language go --summary {targetDir}\n\n# Rust\nuv run trailmark analyze --language rust --summary {targetDir}\n```\n\nThe graph provides:\n- **Caller chains** — trace from public API entry points to\n  mutated functions to determine reachability\n- **Cyclomatic complexity** — prioritize high-CC functions\n- **Blast radius** — functions with many callers have wider\n  impact if their mutations survive\n\n### Step 2: Filter to Relevant Code\n\nMutation frameworks test the entire package. Filter results to\nonly the files\u002Ffunctions that test vectors should exercise:\n\n```bash\n# Go (gremlins)\ngrep -E \"(LIVED|NOT COVERED)\" baseline.log \\\n  | grep -E \" at (relevant|files)\" \\\n  | sort\n\n# Rust (cargo-mutants)\ncat mutants.out\u002Fmissed.txt | grep \"src\u002Frelevant\"\n```\n\n### Step 3: Graph-Informed Classification\n\nFor each escaped mutant, map it to its containing function in the\ncall graph and apply the genotoxic triage criteria:\n\n| Graph Signal | Classification | Action |\n|--------------|----------------|--------|\n| No callers in graph | **False Positive** | Dead code, skip |\n| Only test callers | **False Positive** | Test infrastructure |\n| Logging\u002Fdisplay\u002Fformatting | **False Positive** | Cosmetic |\n| Cross-package callers but NOT COVERED | **Cross-Package Gap** | See below |\n| Reachable from public API, low CC | **Missing Vector** | Design targeted vector |\n| Reachable from public API, high CC (>10) | **Fuzzing Target** | Both vector + fuzz harness |\n| Validation\u002Ferror-handling path | **Negative Vector** | Craft invalid input that triggers path |\n| Optimization path (GLV, SIMD, batch) | **Edge-Case Vector** | Input that triggers optimization threshold |\n| `\\|`→`^` after left shift (e.g. `(t\u003C\u003C1) \\| carry`) | **Equivalent Mutant** | Skip — bit 0 always 0, OR=XOR |\n| ct_eq `&`→`\\|` on Montgomery limbs | **API-Unreachable** | Needs library-internal tests, not vectors |\n| Equivalent mutation (behavior unchanged) | **False Positive** | Skip |\n\n### Step 4: Identify Cross-Package Test Gaps\n\n**Critical pitfall:** Mutation frameworks often only run tests\nwithin the same package as the mutation. For Go (gremlins) and\nRust (cargo-mutants), this means:\n\n- A mutation in `hash_to_curve\u002Fg2.go` only runs tests in the\n  `hash_to_curve` package, NOT tests in the parent `bls12381`\n  package that imports it\n- Functions that are fully exercised by cross-package tests\n  will appear as NOT COVERED — these are **false positives**\n- To confirm: check if the mutated function is called from a\n  test in a *different* package that wouldn't be run\n\nTo resolve cross-package gaps:\n1. Add a thin test in the sub-package that calls through the\n   same code path as the cross-package test\n2. Or run gremlins with `--test-pkg .\u002F...` (if supported)\n3. Or document as a framework limitation in the report\n\n### Step 5: Prioritize by Security Impact\n\nUsing the call graph, rank surviving mutants by impact:\n\n| Priority | Criteria | Example |\n|----------|----------|---------|\n| **P0 — Critical** | Mutant weakens validation\u002Fequality\u002Fauthentication | `ct_eq`: `&` → `\\|` makes equality permissive |\n| **P1 — High** | Mutant in deserialization flag parsing | `from_compressed`: `&` → `\\|` accepts invalid flags |\n| **P2 — Medium** | Mutant in field arithmetic internals | `Fp::square`: `\\|` → `^` corrupts computation |\n| **P3 — Low** | Mutant in optimization path | `phi` endomorphism: only affects performance path |\n| **Skip** | Formatting, display, equivalent mutation | `Debug::fmt` return value replacement |\n\n### Step 6: Group by Vector Strategy\n\nGroup escaped mutants by the code path they represent and the\ntype of test vector needed:\n\n```\nDeserialization flag validation (P1):\n  - g1.rs:339,363-365,384 — from_compressed_unchecked flags\n  → Need: valid-point-wrong-flag vectors\n\nField arithmetic (P2):\n  - fp.rs:371-376,406,635-643 — subtract_p, neg, square\n  → Need: field arithmetic KATs with edge-case values\n\nOptimization thresholds (P3):\n  - g1.go:68, g2.go:75 — GLV vs windowed multiplication\n  → Need: scalar multiplication with large scalars\n\nCross-package (framework limitation):\n  - hash_to_curve\u002Fg2.go:242-278 — isogeny, sgn0\n  → Document as false positive or add sub-package test\n```\n\nEach group becomes a target for new test vectors in Phase 5.\n\n---\n\n## Phase 5: Vector Generation\n\nFor each escaped code path group, design test vectors that\nforce execution through that path.\n\n### Vector Design Patterns\n\n| Code Path Type | Vector Strategy |\n|----------------|----------------|\n| Point deserialization | Malformed points: wrong length, invalid field elements, off-curve, wrong subgroup, identity point |\n| Signature verification | Valid sig + all single-bit corruptions of sig, pk, msg |\n| Hash-to-curve | Known answer tests (KATs) with edge-case inputs: empty, single byte, max length |\n| Aggregate operations | 1 signer, many signers, duplicate signers, mixed valid\u002Finvalid |\n| Error handling | Every error path should have a vector that triggers it |\n| Arithmetic edge cases | Zero, one, field modulus - 1, points at infinity |\n| Serialization flags | Every valid flag combination + every invalid flag combination |\n| Roundtrip integrity | For every valid deser vector, assert `serialize(deserialize(b)) == b` |\n| Carry\u002Freduction faults | Reimplement at reduced limb widths, inject faults, extract distinguishing inputs |\n\n### Single-Fault Negative Vectors\n\nEach negative vector should have **exactly one defect** with\neverything else valid — this isolates which validation check is\nbeing tested. See [references\u002Fvector-patterns.md](references\u002Fvector-patterns.md)\nfor per-flag construction examples.\n\n### Fault Simulation (Limb-Width Reimplementation)\n\nWhen mutation testing only applies local operator swaps, deeper\narchitectural bugs (carry propagation, reduction overflow) go\nuntested. To close this gap, reimplement the target algorithm\nat reduced limb widths (8, 16, 25, 32 bits) and deliberately\ninject faults — then generate vectors that catch them.\n\nSee [references\u002Ffault-simulation.md](references\u002Ffault-simulation.md)\nfor the full methodology: limb-width selection, fault injection\ncatalog, vector extraction, and validation workflow.\n\n### Cross-Implementation Verification\n\nEvery new test vector MUST be verified against at least two\nindependent implementations before being added to the suite:\n\n1. Generate the vector using implementation A\n2. Verify with implementation B (different codebase, ideally different language)\n3. If B disagrees, investigate — one implementation has a bug\n\n### Vector Format\n\nUse Wycheproof JSON format (`algorithm`, `testGroups[].tests[]`\nwith `tcId`, `comment`, `result`, `flags`). See\n[references\u002Fvector-patterns.md](references\u002Fvector-patterns.md)\nfor the full schema.\n\n**JSON encoding:** Wycheproof canonicalizes vectors with\n`reformat_json.py`, which unescapes HTML entities. Generate vectors\nwith literal characters, not HTML-escaped sequences:\n\n- **Go:** Use `json.NewEncoder` + `enc.SetEscapeHTML(false)` —\n  never `json.Marshal`\u002F`json.MarshalIndent`, which silently escape\n  `>` → `\\u003e`, `\u003C` → `\\u003c`, `&` → `\\u0026`\n- **Python:** `json.dumps` is safe by default\n- **Node.js:** `JSON.stringify` is safe by default\n\nSee [references\u002Flessons-learned.md](references\u002Flessons-learned.md)\n§14 for details.\n\n---\n\n## Phase 6: Validation\n\nRe-run mutation testing with the new test vectors included.\n\n**Tip:** Use per-file mutation testing for fast iteration during\nvector development (see [references\u002Flessons-learned.md](references\u002Flessons-learned.md) §12).\nOnly run full-crate tests for the final comparison.\n\n### Before\u002FAfter Comparison\n\n| Metric | Baseline | With New Vectors | Delta |\n|--------|----------|------------------|-------|\n| Killed | X | Y | Y - X |\n| Survived | A | B | A - B (should decrease) |\n| Not Covered | C | D | C - D (should decrease) |\n| Efficacy % | E% | F% | F - E |\n\n### Success Criteria\n\nVectors have both **retroactive** value (killing mutants in\nexisting code) and **proactive** value (catching bugs in future\nimplementations). Generate both kinds — boundary-condition vectors\nmay not improve kill rates in mature libraries but will catch bugs\nin new implementations. See\n[references\u002Flessons-learned.md](references\u002Flessons-learned.md) §13.\n\n**Retroactive (measurable):** previously survived\u002Funcovered mutants\nbecome killed, no regressions.\n\n**If kill rates don't change:** the implementation's own tests\nlikely already cover those paths. The vectors still add\ncross-implementation verification value. Document which case\napplies.\n\n---\n\n## Output Format\n\nWrite `VECTOR_FORGE_REPORT.md` covering: target algorithm,\nimplementations tested, baseline results, escape analysis,\nnew vectors generated, after results, before\u002Fafter delta, and\nconclusions. See\n[references\u002Freport-template.md](references\u002Freport-template.md)\nfor the full template.\n\n---\n\n## Quality Checklist\n\nBefore delivering:\n\n- [ ] At least one pure implementation mutation-tested (not just FFI wrappers)\n- [ ] Baseline run completed with existing vectors\n- [ ] Trailmark call graph built for each implementation\n- [ ] All escaped mutants triaged using graph-informed classification\n- [ ] Cross-package false positives identified and documented\n- [ ] Security-critical mutations (ct_eq, validation, auth) prioritized as P0\u002FP1\n- [ ] Fault simulation and mutation-derived vectors cross-verified against 2+ implementations\n- [ ] After run completed with new vectors included\n- [ ] Before\u002Fafter delta computed and explained\n- [ ] Report written to `VECTOR_FORGE_REPORT.md`\n- [ ] New test vectors saved in standard format (Wycheproof JSON)\n\n---\n\n## Integration\n\n| Skill | Relationship |\n|-------|-------------|\n| **genotoxic** (required for Phase 4) | Provides graph-informed triage — call graph cuts actionable mutants by 30-50% |\n| **mutation-testing** (mewt\u002Fmuton) | Use for Solidity; Vector Forge is language-agnostic |\n| **property-based-testing** | Better than hand-crafted vectors for bitwise mutations in field arithmetic |\n| **testing-handbook-skills** (fuzzing) | Functions with CC > 10 and surviving mutants need both vectors and fuzz harnesses |\n\n---\n\n## Supporting Documentation\n\n- **[references\u002Fmutation-frameworks.md](references\u002Fmutation-frameworks.md)** -\n  Language-specific mutation testing framework setup\n- **[references\u002Fvector-patterns.md](references\u002Fvector-patterns.md)** -\n  Common test vector patterns for cryptographic primitives\n- **[references\u002Ffault-simulation.md](references\u002Ffault-simulation.md)** -\n  Limb-width reimplementation for carry, reduction, and overflow faults\n- **[references\u002Freport-template.md](references\u002Freport-template.md)** -\n  Full markdown template for the Vector Forge report\n- **[references\u002Flessons-learned.md](references\u002Flessons-learned.md)** -\n  BLS12-381 case study: FFI kill rates, timeout masking, cross-package\n  false positives, bitwise mutation gaps, and security-critical priorities\n",{"data":36,"body":37},{"name":4,"description":6},{"type":38,"children":39},"root",[40,48,54,61,91,97,120,126,203,207,213,372,375,381,391,394,400,405,439,444,467,474,573,591,594,600,605,666,700,705,772,778,790,897,903,908,931,934,940,945,951,963,1078,1084,1089,1125,1131,1136,1249,1254,1257,1263,1268,1278,1284,1289,1397,1402,1435,1441,1446,1598,1604,1609,1898,1904,1914,1968,1973,1999,2005,2010,2207,2213,2218,2227,2232,2235,2241,2246,2252,2397,2403,2422,2428,2433,2444,2450,2455,2473,2479,2535,2553,2670,2680,2683,2689,2694,2710,2716,2837,2843,2868,2878,2888,2891,2897,2917,2920,2926,2931,3043,3046,3052,3144,3147,3153,3216],{"type":41,"tag":42,"props":43,"children":44},"element","h1",{"id":4},[45],{"type":46,"value":47},"text","Vector Forge",{"type":41,"tag":49,"props":50,"children":51},"p",{},[52],{"type":46,"value":53},"Uses mutation testing to systematically identify gaps in test vector\ncoverage, then generates new test vectors that close those gaps.\nMeasures effectiveness by comparing mutation kill rates before and after.",{"type":41,"tag":55,"props":56,"children":58},"h2",{"id":57},"when-to-use",[59],{"type":46,"value":60},"When to Use",{"type":41,"tag":62,"props":63,"children":64},"ul",{},[65,71,76,81,86],{"type":41,"tag":66,"props":67,"children":68},"li",{},[69],{"type":46,"value":70},"Generating test vectors for cryptographic algorithms or protocols",{"type":41,"tag":66,"props":72,"children":73},{},[74],{"type":46,"value":75},"Evaluating how well existing test vectors cover an implementation",{"type":41,"tag":66,"props":77,"children":78},{},[79],{"type":46,"value":80},"Finding implementation code paths that no test vector exercises",{"type":41,"tag":66,"props":82,"children":83},{},[84],{"type":46,"value":85},"Creating Wycheproof-style cross-implementation test vectors",{"type":41,"tag":66,"props":87,"children":88},{},[89],{"type":46,"value":90},"Measuring the concrete coverage value of a test vector suite",{"type":41,"tag":55,"props":92,"children":94},{"id":93},"when-not-to-use",[95],{"type":46,"value":96},"When NOT to Use",{"type":41,"tag":62,"props":98,"children":99},{},[100,105,110,115],{"type":41,"tag":66,"props":101,"children":102},{},[103],{"type":46,"value":104},"No implementations exist yet (need code to mutate)",{"type":41,"tag":66,"props":106,"children":107},{},[108],{"type":46,"value":109},"Single trivial implementation with no edge cases",{"type":41,"tag":66,"props":111,"children":112},{},[113],{"type":46,"value":114},"Testing application logic rather than algorithm implementations",{"type":41,"tag":66,"props":116,"children":117},{},[118],{"type":46,"value":119},"The algorithm has no public test vectors to compare against",{"type":41,"tag":55,"props":121,"children":123},{"id":122},"prerequisites",[124],{"type":46,"value":125},"Prerequisites",{"type":41,"tag":62,"props":127,"children":128},{},[129,188,193,198],{"type":41,"tag":66,"props":130,"children":131},{},[132,138,140,147,149],{"type":41,"tag":133,"props":134,"children":135},"strong",{},[136],{"type":46,"value":137},"trailmark",{"type":46,"value":139}," installed — if ",{"type":41,"tag":141,"props":142,"children":144},"code",{"className":143},[],[145],{"type":46,"value":146},"uv run trailmark",{"type":46,"value":148}," fails, run:\n",{"type":41,"tag":150,"props":151,"children":156},"pre",{"className":152,"code":153,"language":154,"meta":155,"style":155},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","uv pip install trailmark\n","bash","",[157],{"type":41,"tag":141,"props":158,"children":159},{"__ignoreMap":155},[160],{"type":41,"tag":161,"props":162,"children":165},"span",{"class":163,"line":164},"line",1,[166,172,178,183],{"type":41,"tag":161,"props":167,"children":169},{"style":168},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[170],{"type":46,"value":171},"uv",{"type":41,"tag":161,"props":173,"children":175},{"style":174},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[176],{"type":46,"value":177}," pip",{"type":41,"tag":161,"props":179,"children":180},{"style":174},[181],{"type":46,"value":182}," install",{"type":41,"tag":161,"props":184,"children":185},{"style":174},[186],{"type":46,"value":187}," trailmark\n",{"type":41,"tag":66,"props":189,"children":190},{},[191],{"type":46,"value":192},"At least one implementation of the target algorithm in a\nlanguage with mutation testing support",{"type":41,"tag":66,"props":194,"children":195},{},[196],{"type":46,"value":197},"A test harness that consumes test vectors and exercises\nthe implementation",{"type":41,"tag":66,"props":199,"children":200},{},[201],{"type":46,"value":202},"A mutation testing framework for the target language",{"type":41,"tag":204,"props":205,"children":206},"hr",{},[],{"type":41,"tag":55,"props":208,"children":210},{"id":209},"rationalizations-to-reject",[211],{"type":46,"value":212},"Rationalizations to Reject",{"type":41,"tag":214,"props":215,"children":216},"table",{},[217,241],{"type":41,"tag":218,"props":219,"children":220},"thead",{},[221],{"type":41,"tag":222,"props":223,"children":224},"tr",{},[225,231,236],{"type":41,"tag":226,"props":227,"children":228},"th",{},[229],{"type":46,"value":230},"Rationalization",{"type":41,"tag":226,"props":232,"children":233},{},[234],{"type":46,"value":235},"Why It's Wrong",{"type":41,"tag":226,"props":237,"children":238},{},[239],{"type":46,"value":240},"Required Action",{"type":41,"tag":242,"props":243,"children":244},"tbody",{},[245,264,282,300,318,336,354],{"type":41,"tag":222,"props":246,"children":247},{},[248,254,259],{"type":41,"tag":249,"props":250,"children":251},"td",{},[252],{"type":46,"value":253},"\"We have enough test vectors\"",{"type":41,"tag":249,"props":255,"children":256},{},[257],{"type":46,"value":258},"Mutation testing proves otherwise",{"type":41,"tag":249,"props":260,"children":261},{},[262],{"type":46,"value":263},"Run the baseline first",{"type":41,"tag":222,"props":265,"children":266},{},[267,272,277],{"type":41,"tag":249,"props":268,"children":269},{},[270],{"type":46,"value":271},"\"The implementation's own tests are sufficient\"",{"type":41,"tag":249,"props":273,"children":274},{},[275],{"type":46,"value":276},"Own tests often share blind spots with the impl",{"type":41,"tag":249,"props":278,"children":279},{},[280],{"type":46,"value":281},"Cross-impl vectors catch different bugs",{"type":41,"tag":222,"props":283,"children":284},{},[285,290,295],{"type":41,"tag":249,"props":286,"children":287},{},[288],{"type":46,"value":289},"\"FFI crates can be mutation tested at the binding layer\"",{"type":41,"tag":249,"props":291,"children":292},{},[293],{"type":46,"value":294},"Mutations to wrappers don't affect the underlying impl",{"type":41,"tag":249,"props":296,"children":297},{},[298],{"type":46,"value":299},"Mutate the actual implementation language",{"type":41,"tag":222,"props":301,"children":302},{},[303,308,313],{"type":41,"tag":249,"props":304,"children":305},{},[306],{"type":46,"value":307},"\"Timeouts mean the mutation was caught\"",{"type":41,"tag":249,"props":309,"children":310},{},[311],{"type":46,"value":312},"Timeouts are ambiguous — could be killed or alive",{"type":41,"tag":249,"props":314,"children":315},{},[316],{"type":46,"value":317},"Resolve timeouts before drawing conclusions",{"type":41,"tag":222,"props":319,"children":320},{},[321,326,331],{"type":41,"tag":249,"props":322,"children":323},{},[324],{"type":46,"value":325},"\"All mutants are equivalent\"",{"type":41,"tag":249,"props":327,"children":328},{},[329],{"type":46,"value":330},"Most aren't — verify by reading the mutation",{"type":41,"tag":249,"props":332,"children":333},{},[334],{"type":46,"value":335},"Classify each escaped mutant individually",{"type":41,"tag":222,"props":337,"children":338},{},[339,344,349],{"type":41,"tag":249,"props":340,"children":341},{},[342],{"type":46,"value":343},"\"Checking valid vectors is enough\"",{"type":41,"tag":249,"props":345,"children":346},{},[347],{"type":46,"value":348},"Permissive mutations survive without negative assertions",{"type":41,"tag":249,"props":350,"children":351},{},[352],{"type":46,"value":353},"Assert rejection for every invalid vector",{"type":41,"tag":222,"props":355,"children":356},{},[357,362,367],{"type":41,"tag":249,"props":358,"children":359},{},[360],{"type":46,"value":361},"\"Manual analysis is fine\"",{"type":41,"tag":249,"props":363,"children":364},{},[365],{"type":46,"value":366},"Manual analysis misses what tooling catches",{"type":41,"tag":249,"props":368,"children":369},{},[370],{"type":46,"value":371},"Install and run the tools",{"type":41,"tag":204,"props":373,"children":374},{},[],{"type":41,"tag":55,"props":376,"children":378},{"id":377},"workflow-overview",[379],{"type":46,"value":380},"Workflow Overview",{"type":41,"tag":150,"props":382,"children":386},{"className":383,"code":385,"language":46},[384],"language-text","Phase 1: Discovery       → Find implementations to test\n      ↓\nPhase 2: Harness         → Write\u002Fadapt test vector harness for each impl\n      ↓\nPhase 3: Baseline        → Run mutation testing with existing vectors\n      ↓\nPhase 4: Escape Analysis → Classify escaped mutants by code path\n      ↓\nPhase 5: Vector Gen      → Create test vectors targeting escapes\n      ↓\nPhase 6: Validation      → Re-run mutation testing, compare before\u002Fafter\n      ↓\nOutput: Coverage Report + New Test Vectors\n",[387],{"type":41,"tag":141,"props":388,"children":389},{"__ignoreMap":155},[390],{"type":46,"value":385},{"type":41,"tag":204,"props":392,"children":393},{},[],{"type":41,"tag":55,"props":395,"children":397},{"id":396},"phase-1-discovery",[398],{"type":46,"value":399},"Phase 1: Discovery",{"type":41,"tag":49,"props":401,"children":402},{},[403],{"type":46,"value":404},"Find implementations of the target algorithm. Look for:",{"type":41,"tag":406,"props":407,"children":408},"ol",{},[409,419,429],{"type":41,"tag":66,"props":410,"children":411},{},[412,417],{"type":41,"tag":133,"props":413,"children":414},{},[415],{"type":46,"value":416},"Pure implementations",{"type":46,"value":418}," in high-level languages (Go, Rust, Python)\n— these are the best mutation testing targets",{"type":41,"tag":66,"props":420,"children":421},{},[422,427],{"type":41,"tag":133,"props":423,"children":424},{},[425],{"type":46,"value":426},"FFI wrapper crates",{"type":46,"value":428}," — identify these early so you don't waste\ntime mutating wrapper glue code",{"type":41,"tag":66,"props":430,"children":431},{},[432,437],{"type":41,"tag":133,"props":433,"children":434},{},[435],{"type":46,"value":436},"Reference implementations",{"type":46,"value":438}," — useful for cross-verification but\nmay not be the best mutation targets",{"type":41,"tag":49,"props":440,"children":441},{},[442],{"type":46,"value":443},"For each implementation, note:",{"type":41,"tag":62,"props":445,"children":446},{},[447,452,457,462],{"type":41,"tag":66,"props":448,"children":449},{},[450],{"type":46,"value":451},"Language and mutation testing framework",{"type":41,"tag":66,"props":453,"children":454},{},[455],{"type":46,"value":456},"Whether it's pure code or FFI wrappers",{"type":41,"tag":66,"props":458,"children":459},{},[460],{"type":46,"value":461},"Existing test suite size and coverage",{"type":41,"tag":66,"props":463,"children":464},{},[465],{"type":46,"value":466},"Which API surface the test vectors will exercise",{"type":41,"tag":468,"props":469,"children":471},"h3",{"id":470},"implementation-type-classification",[472],{"type":46,"value":473},"Implementation Type Classification",{"type":41,"tag":214,"props":475,"children":476},{},[477,498],{"type":41,"tag":218,"props":478,"children":479},{},[480],{"type":41,"tag":222,"props":481,"children":482},{},[483,488,493],{"type":41,"tag":226,"props":484,"children":485},{},[486],{"type":46,"value":487},"Type",{"type":41,"tag":226,"props":489,"children":490},{},[491],{"type":46,"value":492},"Mutation Value",{"type":41,"tag":226,"props":494,"children":495},{},[496],{"type":46,"value":497},"Example",{"type":41,"tag":242,"props":499,"children":500},{},[501,519,537,555],{"type":41,"tag":222,"props":502,"children":503},{},[504,509,514],{"type":41,"tag":249,"props":505,"children":506},{},[507],{"type":46,"value":508},"Pure implementation",{"type":41,"tag":249,"props":510,"children":511},{},[512],{"type":46,"value":513},"High",{"type":41,"tag":249,"props":515,"children":516},{},[517],{"type":46,"value":518},"zkcrypto\u002Fbls12_381 (Rust), gnark-crypto (Go)",{"type":41,"tag":222,"props":520,"children":521},{},[522,527,532],{"type":41,"tag":249,"props":523,"children":524},{},[525],{"type":46,"value":526},"FFI bindings to C\u002Fasm",{"type":41,"tag":249,"props":528,"children":529},{},[530],{"type":46,"value":531},"Low at binding layer",{"type":41,"tag":249,"props":533,"children":534},{},[535],{"type":46,"value":536},"blst Rust crate",{"type":41,"tag":222,"props":538,"children":539},{},[540,545,550],{"type":41,"tag":249,"props":541,"children":542},{},[543],{"type":46,"value":544},"C\u002FC++ implementation",{"type":41,"tag":249,"props":546,"children":547},{},[548],{"type":46,"value":549},"High (use Mull)",{"type":41,"tag":249,"props":551,"children":552},{},[553],{"type":46,"value":554},"blst C library",{"type":41,"tag":222,"props":556,"children":557},{},[558,563,568],{"type":41,"tag":249,"props":559,"children":560},{},[561],{"type":46,"value":562},"Generated code",{"type":41,"tag":249,"props":564,"children":565},{},[566],{"type":46,"value":567},"Medium (mutations may be equivalent)",{"type":41,"tag":249,"props":569,"children":570},{},[571],{"type":46,"value":572},"gnark-crypto generated field arithmetic",{"type":41,"tag":49,"props":574,"children":575},{},[576,581,583,589],{"type":41,"tag":133,"props":577,"children":578},{},[579],{"type":46,"value":580},"Key insight:",{"type":46,"value":582}," If an implementation delegates to another language\nvia FFI, you must mutate the ",{"type":41,"tag":584,"props":585,"children":586},"em",{},[587],{"type":46,"value":588},"underlying",{"type":46,"value":590}," implementation, not the\nbindings. For C\u002FC++ underneath Rust\u002FGo\u002FPython, use Mull or similar.",{"type":41,"tag":204,"props":592,"children":593},{},[],{"type":41,"tag":55,"props":595,"children":597},{"id":596},"phase-2-harness",[598],{"type":46,"value":599},"Phase 2: Harness",{"type":41,"tag":49,"props":601,"children":602},{},[603],{"type":46,"value":604},"For each implementation, create a test harness that:",{"type":41,"tag":406,"props":606,"children":607},{},[608,613,618,643,661],{"type":41,"tag":66,"props":609,"children":610},{},[611],{"type":46,"value":612},"Reads test vectors from JSON files (Wycheproof format recommended)",{"type":41,"tag":66,"props":614,"children":615},{},[616],{"type":46,"value":617},"Exercises the implementation's API for each vector",{"type":41,"tag":66,"props":619,"children":620},{},[621,623,628,630],{"type":46,"value":622},"Asserts ",{"type":41,"tag":133,"props":624,"children":625},{},[626],{"type":46,"value":627},"both acceptance and rejection",{"type":46,"value":629},":\n",{"type":41,"tag":62,"props":631,"children":632},{},[633,638],{"type":41,"tag":66,"props":634,"children":635},{},[636],{"type":46,"value":637},"Valid vectors: deserialization succeeds, output matches expected",{"type":41,"tag":66,"props":639,"children":640},{},[641],{"type":46,"value":642},"Invalid vectors: deserialization fails or verification rejects",{"type":41,"tag":66,"props":644,"children":645},{},[646,648,653,655],{"type":46,"value":647},"Adds ",{"type":41,"tag":133,"props":649,"children":650},{},[651],{"type":46,"value":652},"roundtrip assertions",{"type":46,"value":654}," for valid deserialization vectors:\n",{"type":41,"tag":141,"props":656,"children":658},{"className":657},[],[659],{"type":46,"value":660},"serialize(deserialize(bytes)) == bytes",{"type":41,"tag":66,"props":662,"children":663},{},[664],{"type":46,"value":665},"Reports pass\u002Ffail per vector with test IDs",{"type":41,"tag":49,"props":667,"children":668},{},[669,674,676,682,684,690,692,698],{"type":41,"tag":133,"props":670,"children":671},{},[672],{"type":46,"value":673},"Critical:",{"type":46,"value":675}," A harness that only checks valid vectors will miss all\npermissive mutations (e.g., ",{"type":41,"tag":141,"props":677,"children":679},{"className":678},[],[680],{"type":46,"value":681},"&",{"type":46,"value":683}," → ",{"type":41,"tag":141,"props":685,"children":687},{"className":686},[],[688],{"type":46,"value":689},"|",{"type":46,"value":691}," in validation). See\n",{"type":41,"tag":693,"props":694,"children":696},"a",{"href":695},"references\u002Flessons-learned.md",[697],{"type":46,"value":695},{"type":46,"value":699}," §7.",{"type":41,"tag":49,"props":701,"children":702},{},[703],{"type":46,"value":704},"The harness must be runnable by the mutation testing framework.\nFor most frameworks this means:",{"type":41,"tag":62,"props":706,"children":707},{},[708,726,752,762],{"type":41,"tag":66,"props":709,"children":710},{},[711,716,718,724],{"type":41,"tag":133,"props":712,"children":713},{},[714],{"type":46,"value":715},"Go:",{"type":46,"value":717}," A ",{"type":41,"tag":141,"props":719,"children":721},{"className":720},[],[722],{"type":46,"value":723},"_test.go",{"type":46,"value":725}," file in the same package as the implementation",{"type":41,"tag":66,"props":727,"children":728},{},[729,734,736,742,744,750],{"type":41,"tag":133,"props":730,"children":731},{},[732],{"type":46,"value":733},"Rust:",{"type":46,"value":735}," An integration test in ",{"type":41,"tag":141,"props":737,"children":739},{"className":738},[],[740],{"type":46,"value":741},"tests\u002F",{"type":46,"value":743}," or inline ",{"type":41,"tag":141,"props":745,"children":747},{"className":746},[],[748],{"type":46,"value":749},"#[test]",{"type":46,"value":751}," functions",{"type":41,"tag":66,"props":753,"children":754},{},[755,760],{"type":41,"tag":133,"props":756,"children":757},{},[758],{"type":46,"value":759},"Python:",{"type":46,"value":761}," A pytest test file",{"type":41,"tag":66,"props":763,"children":764},{},[765,770],{"type":41,"tag":133,"props":766,"children":767},{},[768],{"type":46,"value":769},"C\u002FC++:",{"type":46,"value":771}," A test binary linked against the implementation",{"type":41,"tag":468,"props":773,"children":775},{"id":774},"harness-placement",[776],{"type":46,"value":777},"Harness Placement",{"type":41,"tag":49,"props":779,"children":780},{},[781,783,788],{"type":46,"value":782},"The harness must live ",{"type":41,"tag":584,"props":784,"children":785},{},[786],{"type":46,"value":787},"inside the implementation's package",{"type":46,"value":789}," so the\nmutation framework can see it. This usually means:",{"type":41,"tag":150,"props":791,"children":793},{"className":152,"code":792,"language":154,"meta":155,"style":155},"# Go: add test file to the package being mutated\ncp wycheproof_test.go \u002Fpath\u002Fto\u002Fimpl\u002Fpackage\u002F\n\n# Rust: add integration test\ncp wycheproof.rs \u002Fpath\u002Fto\u002Fcrate\u002Ftests\u002F\n\n# Python: add test to the test directory\ncp test_wycheproof.py \u002Fpath\u002Fto\u002Fpackage\u002Ftests\u002F\n",[794],{"type":41,"tag":141,"props":795,"children":796},{"__ignoreMap":155},[797,806,825,835,844,862,870,879],{"type":41,"tag":161,"props":798,"children":799},{"class":163,"line":164},[800],{"type":41,"tag":161,"props":801,"children":803},{"style":802},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[804],{"type":46,"value":805},"# Go: add test file to the package being mutated\n",{"type":41,"tag":161,"props":807,"children":809},{"class":163,"line":808},2,[810,815,820],{"type":41,"tag":161,"props":811,"children":812},{"style":168},[813],{"type":46,"value":814},"cp",{"type":41,"tag":161,"props":816,"children":817},{"style":174},[818],{"type":46,"value":819}," wycheproof_test.go",{"type":41,"tag":161,"props":821,"children":822},{"style":174},[823],{"type":46,"value":824}," \u002Fpath\u002Fto\u002Fimpl\u002Fpackage\u002F\n",{"type":41,"tag":161,"props":826,"children":828},{"class":163,"line":827},3,[829],{"type":41,"tag":161,"props":830,"children":832},{"emptyLinePlaceholder":831},true,[833],{"type":46,"value":834},"\n",{"type":41,"tag":161,"props":836,"children":838},{"class":163,"line":837},4,[839],{"type":41,"tag":161,"props":840,"children":841},{"style":802},[842],{"type":46,"value":843},"# Rust: add integration test\n",{"type":41,"tag":161,"props":845,"children":847},{"class":163,"line":846},5,[848,852,857],{"type":41,"tag":161,"props":849,"children":850},{"style":168},[851],{"type":46,"value":814},{"type":41,"tag":161,"props":853,"children":854},{"style":174},[855],{"type":46,"value":856}," wycheproof.rs",{"type":41,"tag":161,"props":858,"children":859},{"style":174},[860],{"type":46,"value":861}," \u002Fpath\u002Fto\u002Fcrate\u002Ftests\u002F\n",{"type":41,"tag":161,"props":863,"children":865},{"class":163,"line":864},6,[866],{"type":41,"tag":161,"props":867,"children":868},{"emptyLinePlaceholder":831},[869],{"type":46,"value":834},{"type":41,"tag":161,"props":871,"children":873},{"class":163,"line":872},7,[874],{"type":41,"tag":161,"props":875,"children":876},{"style":802},[877],{"type":46,"value":878},"# Python: add test to the test directory\n",{"type":41,"tag":161,"props":880,"children":882},{"class":163,"line":881},8,[883,887,892],{"type":41,"tag":161,"props":884,"children":885},{"style":168},[886],{"type":46,"value":814},{"type":41,"tag":161,"props":888,"children":889},{"style":174},[890],{"type":46,"value":891}," test_wycheproof.py",{"type":41,"tag":161,"props":893,"children":894},{"style":174},[895],{"type":46,"value":896}," \u002Fpath\u002Fto\u002Fpackage\u002Ftests\u002F\n",{"type":41,"tag":468,"props":898,"children":900},{"id":899},"handling-existing-vectors",[901],{"type":46,"value":902},"Handling Existing Vectors",{"type":41,"tag":49,"props":904,"children":905},{},[906],{"type":46,"value":907},"If the implementation already has test vectors:",{"type":41,"tag":406,"props":909,"children":910},{},[911,916,921,926],{"type":41,"tag":66,"props":912,"children":913},{},[914],{"type":46,"value":915},"Run mutation testing with ONLY the existing vectors (baseline)",{"type":41,"tag":66,"props":917,"children":918},{},[919],{"type":46,"value":920},"Run mutation testing with ONLY your new vectors",{"type":41,"tag":66,"props":922,"children":923},{},[924],{"type":46,"value":925},"Run mutation testing with BOTH combined",{"type":41,"tag":66,"props":927,"children":928},{},[929],{"type":46,"value":930},"The delta between (1) and (3) shows the new vectors' value",{"type":41,"tag":204,"props":932,"children":933},{},[],{"type":41,"tag":55,"props":935,"children":937},{"id":936},"phase-3-baseline",[938],{"type":46,"value":939},"Phase 3: Baseline",{"type":41,"tag":49,"props":941,"children":942},{},[943],{"type":46,"value":944},"Run mutation testing with existing test vectors only.",{"type":41,"tag":468,"props":946,"children":948},{"id":947},"framework-selection",[949],{"type":46,"value":950},"Framework Selection",{"type":41,"tag":49,"props":952,"children":953},{},[954,956,961],{"type":46,"value":955},"See ",{"type":41,"tag":693,"props":957,"children":959},{"href":958},"references\u002Fmutation-frameworks.md",[960],{"type":46,"value":958},{"type":46,"value":962},"\nfor language-specific setup.",{"type":41,"tag":214,"props":964,"children":965},{},[966,987],{"type":41,"tag":218,"props":967,"children":968},{},[969],{"type":41,"tag":222,"props":970,"children":971},{},[972,977,982],{"type":41,"tag":226,"props":973,"children":974},{},[975],{"type":46,"value":976},"Language",{"type":41,"tag":226,"props":978,"children":979},{},[980],{"type":46,"value":981},"Framework",{"type":41,"tag":226,"props":983,"children":984},{},[985],{"type":46,"value":986},"Command",{"type":41,"tag":242,"props":988,"children":989},{},[990,1012,1034,1056],{"type":41,"tag":222,"props":991,"children":992},{},[993,998,1003],{"type":41,"tag":249,"props":994,"children":995},{},[996],{"type":46,"value":997},"Go",{"type":41,"tag":249,"props":999,"children":1000},{},[1001],{"type":46,"value":1002},"gremlins",{"type":41,"tag":249,"props":1004,"children":1005},{},[1006],{"type":41,"tag":141,"props":1007,"children":1009},{"className":1008},[],[1010],{"type":46,"value":1011},"gremlins unleash .\u002Fpath\u002Fto\u002Fpackage",{"type":41,"tag":222,"props":1013,"children":1014},{},[1015,1020,1025],{"type":41,"tag":249,"props":1016,"children":1017},{},[1018],{"type":46,"value":1019},"Rust",{"type":41,"tag":249,"props":1021,"children":1022},{},[1023],{"type":46,"value":1024},"cargo-mutants",{"type":41,"tag":249,"props":1026,"children":1027},{},[1028],{"type":41,"tag":141,"props":1029,"children":1031},{"className":1030},[],[1032],{"type":46,"value":1033},"cargo mutants -j N --timeout T",{"type":41,"tag":222,"props":1035,"children":1036},{},[1037,1042,1047],{"type":41,"tag":249,"props":1038,"children":1039},{},[1040],{"type":46,"value":1041},"Python",{"type":41,"tag":249,"props":1043,"children":1044},{},[1045],{"type":46,"value":1046},"mutmut",{"type":41,"tag":249,"props":1048,"children":1049},{},[1050],{"type":41,"tag":141,"props":1051,"children":1053},{"className":1052},[],[1054],{"type":46,"value":1055},"mutmut run --paths-to-mutate src\u002F",{"type":41,"tag":222,"props":1057,"children":1058},{},[1059,1064,1069],{"type":41,"tag":249,"props":1060,"children":1061},{},[1062],{"type":46,"value":1063},"C\u002FC++",{"type":41,"tag":249,"props":1065,"children":1066},{},[1067],{"type":46,"value":1068},"Mull",{"type":41,"tag":249,"props":1070,"children":1071},{},[1072],{"type":41,"tag":141,"props":1073,"children":1075},{"className":1074},[],[1076],{"type":46,"value":1077},"mull-runner -test-framework=GoogleTest binary",{"type":41,"tag":468,"props":1079,"children":1081},{"id":1080},"parallelism",[1082],{"type":46,"value":1083},"Parallelism",{"type":41,"tag":49,"props":1085,"children":1086},{},[1087],{"type":46,"value":1088},"Always use parallel execution for large codebases:",{"type":41,"tag":62,"props":1090,"children":1091},{},[1092,1103,1114],{"type":41,"tag":66,"props":1093,"children":1094},{},[1095,1101],{"type":41,"tag":141,"props":1096,"children":1098},{"className":1097},[],[1099],{"type":46,"value":1100},"cargo mutants -j 8",{"type":46,"value":1102}," (Rust, 8 parallel workers)",{"type":41,"tag":66,"props":1104,"children":1105},{},[1106,1112],{"type":41,"tag":141,"props":1107,"children":1109},{"className":1108},[],[1110],{"type":46,"value":1111},"gremlins unleash --timeout-coefficient 3",{"type":46,"value":1113}," (Go, increase timeouts)",{"type":41,"tag":66,"props":1115,"children":1116},{},[1117,1123],{"type":41,"tag":141,"props":1118,"children":1120},{"className":1119},[],[1121],{"type":46,"value":1122},"mutmut run --runner \"pytest -x -q\"",{"type":46,"value":1124}," (Python, fail-fast)",{"type":41,"tag":468,"props":1126,"children":1128},{"id":1127},"recording-baseline-results",[1129],{"type":46,"value":1130},"Recording Baseline Results",{"type":41,"tag":49,"props":1132,"children":1133},{},[1134],{"type":46,"value":1135},"Capture these metrics per implementation:",{"type":41,"tag":214,"props":1137,"children":1138},{},[1139,1155],{"type":41,"tag":218,"props":1140,"children":1141},{},[1142],{"type":41,"tag":222,"props":1143,"children":1144},{},[1145,1150],{"type":41,"tag":226,"props":1146,"children":1147},{},[1148],{"type":46,"value":1149},"Metric",{"type":41,"tag":226,"props":1151,"children":1152},{},[1153],{"type":46,"value":1154},"Description",{"type":41,"tag":242,"props":1156,"children":1157},{},[1158,1171,1184,1197,1210,1223,1236],{"type":41,"tag":222,"props":1159,"children":1160},{},[1161,1166],{"type":41,"tag":249,"props":1162,"children":1163},{},[1164],{"type":46,"value":1165},"Total mutants",{"type":41,"tag":249,"props":1167,"children":1168},{},[1169],{"type":46,"value":1170},"Number of mutations generated",{"type":41,"tag":222,"props":1172,"children":1173},{},[1174,1179],{"type":41,"tag":249,"props":1175,"children":1176},{},[1177],{"type":46,"value":1178},"Killed",{"type":41,"tag":249,"props":1180,"children":1181},{},[1182],{"type":46,"value":1183},"Mutants caught by tests",{"type":41,"tag":222,"props":1185,"children":1186},{},[1187,1192],{"type":41,"tag":249,"props":1188,"children":1189},{},[1190],{"type":46,"value":1191},"Survived\u002FLived",{"type":41,"tag":249,"props":1193,"children":1194},{},[1195],{"type":46,"value":1196},"Mutants NOT caught (these are the targets)",{"type":41,"tag":222,"props":1198,"children":1199},{},[1200,1205],{"type":41,"tag":249,"props":1201,"children":1202},{},[1203],{"type":46,"value":1204},"Not covered",{"type":41,"tag":249,"props":1206,"children":1207},{},[1208],{"type":46,"value":1209},"Code paths no test reaches at all",{"type":41,"tag":222,"props":1211,"children":1212},{},[1213,1218],{"type":41,"tag":249,"props":1214,"children":1215},{},[1216],{"type":46,"value":1217},"Timed out",{"type":41,"tag":249,"props":1219,"children":1220},{},[1221],{"type":46,"value":1222},"Ambiguous — resolve before comparing",{"type":41,"tag":222,"props":1224,"children":1225},{},[1226,1231],{"type":41,"tag":249,"props":1227,"children":1228},{},[1229],{"type":46,"value":1230},"Efficacy %",{"type":41,"tag":249,"props":1232,"children":1233},{},[1234],{"type":46,"value":1235},"Killed \u002F (Killed + Survived)",{"type":41,"tag":222,"props":1237,"children":1238},{},[1239,1244],{"type":41,"tag":249,"props":1240,"children":1241},{},[1242],{"type":46,"value":1243},"Coverage %",{"type":41,"tag":249,"props":1245,"children":1246},{},[1247],{"type":46,"value":1248},"(Total - Not covered) \u002F Total",{"type":41,"tag":49,"props":1250,"children":1251},{},[1252],{"type":46,"value":1253},"Save the full mutation log for Phase 4 analysis.",{"type":41,"tag":204,"props":1255,"children":1256},{},[],{"type":41,"tag":55,"props":1258,"children":1260},{"id":1259},"phase-4-escape-analysis-graph-informed-triage",[1261],{"type":46,"value":1262},"Phase 4: Escape Analysis (Graph-Informed Triage)",{"type":41,"tag":49,"props":1264,"children":1265},{},[1266],{"type":46,"value":1267},"Classify each escaped (survived + not covered) mutant using the\nTrailmark call graph for reachability and blast radius analysis.",{"type":41,"tag":49,"props":1269,"children":1270},{},[1271,1276],{"type":41,"tag":133,"props":1272,"children":1273},{},[1274],{"type":46,"value":1275},"This phase MUST use the genotoxic skill's triage methodology.",{"type":46,"value":1277},"\nThe call graph transforms mutation results from a flat list of\nsurvived mutants into an actionable, prioritized set of vector\ntargets.",{"type":41,"tag":468,"props":1279,"children":1281},{"id":1280},"step-1-build-the-call-graph",[1282],{"type":46,"value":1283},"Step 1: Build the Call Graph",{"type":41,"tag":49,"props":1285,"children":1286},{},[1287],{"type":46,"value":1288},"Build a Trailmark code graph for each implementation before\ntriaging mutations:",{"type":41,"tag":150,"props":1290,"children":1292},{"className":152,"code":1291,"language":154,"meta":155,"style":155},"# Go\nuv run trailmark analyze --language go --summary {targetDir}\n\n# Rust\nuv run trailmark analyze --language rust --summary {targetDir}\n",[1293],{"type":41,"tag":141,"props":1294,"children":1295},{"__ignoreMap":155},[1296,1304,1346,1353,1361],{"type":41,"tag":161,"props":1297,"children":1298},{"class":163,"line":164},[1299],{"type":41,"tag":161,"props":1300,"children":1301},{"style":802},[1302],{"type":46,"value":1303},"# Go\n",{"type":41,"tag":161,"props":1305,"children":1306},{"class":163,"line":808},[1307,1311,1316,1321,1326,1331,1336,1341],{"type":41,"tag":161,"props":1308,"children":1309},{"style":168},[1310],{"type":46,"value":171},{"type":41,"tag":161,"props":1312,"children":1313},{"style":174},[1314],{"type":46,"value":1315}," run",{"type":41,"tag":161,"props":1317,"children":1318},{"style":174},[1319],{"type":46,"value":1320}," trailmark",{"type":41,"tag":161,"props":1322,"children":1323},{"style":174},[1324],{"type":46,"value":1325}," analyze",{"type":41,"tag":161,"props":1327,"children":1328},{"style":174},[1329],{"type":46,"value":1330}," --language",{"type":41,"tag":161,"props":1332,"children":1333},{"style":174},[1334],{"type":46,"value":1335}," go",{"type":41,"tag":161,"props":1337,"children":1338},{"style":174},[1339],{"type":46,"value":1340}," --summary",{"type":41,"tag":161,"props":1342,"children":1343},{"style":174},[1344],{"type":46,"value":1345}," {targetDir}\n",{"type":41,"tag":161,"props":1347,"children":1348},{"class":163,"line":827},[1349],{"type":41,"tag":161,"props":1350,"children":1351},{"emptyLinePlaceholder":831},[1352],{"type":46,"value":834},{"type":41,"tag":161,"props":1354,"children":1355},{"class":163,"line":837},[1356],{"type":41,"tag":161,"props":1357,"children":1358},{"style":802},[1359],{"type":46,"value":1360},"# Rust\n",{"type":41,"tag":161,"props":1362,"children":1363},{"class":163,"line":846},[1364,1368,1372,1376,1380,1384,1389,1393],{"type":41,"tag":161,"props":1365,"children":1366},{"style":168},[1367],{"type":46,"value":171},{"type":41,"tag":161,"props":1369,"children":1370},{"style":174},[1371],{"type":46,"value":1315},{"type":41,"tag":161,"props":1373,"children":1374},{"style":174},[1375],{"type":46,"value":1320},{"type":41,"tag":161,"props":1377,"children":1378},{"style":174},[1379],{"type":46,"value":1325},{"type":41,"tag":161,"props":1381,"children":1382},{"style":174},[1383],{"type":46,"value":1330},{"type":41,"tag":161,"props":1385,"children":1386},{"style":174},[1387],{"type":46,"value":1388}," rust",{"type":41,"tag":161,"props":1390,"children":1391},{"style":174},[1392],{"type":46,"value":1340},{"type":41,"tag":161,"props":1394,"children":1395},{"style":174},[1396],{"type":46,"value":1345},{"type":41,"tag":49,"props":1398,"children":1399},{},[1400],{"type":46,"value":1401},"The graph provides:",{"type":41,"tag":62,"props":1403,"children":1404},{},[1405,1415,1425],{"type":41,"tag":66,"props":1406,"children":1407},{},[1408,1413],{"type":41,"tag":133,"props":1409,"children":1410},{},[1411],{"type":46,"value":1412},"Caller chains",{"type":46,"value":1414}," — trace from public API entry points to\nmutated functions to determine reachability",{"type":41,"tag":66,"props":1416,"children":1417},{},[1418,1423],{"type":41,"tag":133,"props":1419,"children":1420},{},[1421],{"type":46,"value":1422},"Cyclomatic complexity",{"type":46,"value":1424}," — prioritize high-CC functions",{"type":41,"tag":66,"props":1426,"children":1427},{},[1428,1433],{"type":41,"tag":133,"props":1429,"children":1430},{},[1431],{"type":46,"value":1432},"Blast radius",{"type":46,"value":1434}," — functions with many callers have wider\nimpact if their mutations survive",{"type":41,"tag":468,"props":1436,"children":1438},{"id":1437},"step-2-filter-to-relevant-code",[1439],{"type":46,"value":1440},"Step 2: Filter to Relevant Code",{"type":41,"tag":49,"props":1442,"children":1443},{},[1444],{"type":46,"value":1445},"Mutation frameworks test the entire package. Filter results to\nonly the files\u002Ffunctions that test vectors should exercise:",{"type":41,"tag":150,"props":1447,"children":1449},{"className":152,"code":1448,"language":154,"meta":155,"style":155},"# Go (gremlins)\ngrep -E \"(LIVED|NOT COVERED)\" baseline.log \\\n  | grep -E \" at (relevant|files)\" \\\n  | sort\n\n# Rust (cargo-mutants)\ncat mutants.out\u002Fmissed.txt | grep \"src\u002Frelevant\"\n",[1450],{"type":41,"tag":141,"props":1451,"children":1452},{"__ignoreMap":155},[1453,1461,1501,1535,1547,1554,1562],{"type":41,"tag":161,"props":1454,"children":1455},{"class":163,"line":164},[1456],{"type":41,"tag":161,"props":1457,"children":1458},{"style":802},[1459],{"type":46,"value":1460},"# Go (gremlins)\n",{"type":41,"tag":161,"props":1462,"children":1463},{"class":163,"line":808},[1464,1469,1474,1480,1485,1490,1495],{"type":41,"tag":161,"props":1465,"children":1466},{"style":168},[1467],{"type":46,"value":1468},"grep",{"type":41,"tag":161,"props":1470,"children":1471},{"style":174},[1472],{"type":46,"value":1473}," -E",{"type":41,"tag":161,"props":1475,"children":1477},{"style":1476},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[1478],{"type":46,"value":1479}," \"",{"type":41,"tag":161,"props":1481,"children":1482},{"style":174},[1483],{"type":46,"value":1484},"(LIVED|NOT COVERED)",{"type":41,"tag":161,"props":1486,"children":1487},{"style":1476},[1488],{"type":46,"value":1489},"\"",{"type":41,"tag":161,"props":1491,"children":1492},{"style":174},[1493],{"type":46,"value":1494}," baseline.log",{"type":41,"tag":161,"props":1496,"children":1498},{"style":1497},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1499],{"type":46,"value":1500}," \\\n",{"type":41,"tag":161,"props":1502,"children":1503},{"class":163,"line":827},[1504,1509,1514,1518,1522,1527,1531],{"type":41,"tag":161,"props":1505,"children":1506},{"style":1476},[1507],{"type":46,"value":1508},"  |",{"type":41,"tag":161,"props":1510,"children":1511},{"style":168},[1512],{"type":46,"value":1513}," grep",{"type":41,"tag":161,"props":1515,"children":1516},{"style":174},[1517],{"type":46,"value":1473},{"type":41,"tag":161,"props":1519,"children":1520},{"style":1476},[1521],{"type":46,"value":1479},{"type":41,"tag":161,"props":1523,"children":1524},{"style":174},[1525],{"type":46,"value":1526}," at (relevant|files)",{"type":41,"tag":161,"props":1528,"children":1529},{"style":1476},[1530],{"type":46,"value":1489},{"type":41,"tag":161,"props":1532,"children":1533},{"style":1497},[1534],{"type":46,"value":1500},{"type":41,"tag":161,"props":1536,"children":1537},{"class":163,"line":837},[1538,1542],{"type":41,"tag":161,"props":1539,"children":1540},{"style":1476},[1541],{"type":46,"value":1508},{"type":41,"tag":161,"props":1543,"children":1544},{"style":168},[1545],{"type":46,"value":1546}," sort\n",{"type":41,"tag":161,"props":1548,"children":1549},{"class":163,"line":846},[1550],{"type":41,"tag":161,"props":1551,"children":1552},{"emptyLinePlaceholder":831},[1553],{"type":46,"value":834},{"type":41,"tag":161,"props":1555,"children":1556},{"class":163,"line":864},[1557],{"type":41,"tag":161,"props":1558,"children":1559},{"style":802},[1560],{"type":46,"value":1561},"# Rust (cargo-mutants)\n",{"type":41,"tag":161,"props":1563,"children":1564},{"class":163,"line":872},[1565,1570,1575,1580,1584,1588,1593],{"type":41,"tag":161,"props":1566,"children":1567},{"style":168},[1568],{"type":46,"value":1569},"cat",{"type":41,"tag":161,"props":1571,"children":1572},{"style":174},[1573],{"type":46,"value":1574}," mutants.out\u002Fmissed.txt",{"type":41,"tag":161,"props":1576,"children":1577},{"style":1476},[1578],{"type":46,"value":1579}," |",{"type":41,"tag":161,"props":1581,"children":1582},{"style":168},[1583],{"type":46,"value":1513},{"type":41,"tag":161,"props":1585,"children":1586},{"style":1476},[1587],{"type":46,"value":1479},{"type":41,"tag":161,"props":1589,"children":1590},{"style":174},[1591],{"type":46,"value":1592},"src\u002Frelevant",{"type":41,"tag":161,"props":1594,"children":1595},{"style":1476},[1596],{"type":46,"value":1597},"\"\n",{"type":41,"tag":468,"props":1599,"children":1601},{"id":1600},"step-3-graph-informed-classification",[1602],{"type":46,"value":1603},"Step 3: Graph-Informed Classification",{"type":41,"tag":49,"props":1605,"children":1606},{},[1607],{"type":46,"value":1608},"For each escaped mutant, map it to its containing function in the\ncall graph and apply the genotoxic triage criteria:",{"type":41,"tag":214,"props":1610,"children":1611},{},[1612,1633],{"type":41,"tag":218,"props":1613,"children":1614},{},[1615],{"type":41,"tag":222,"props":1616,"children":1617},{},[1618,1623,1628],{"type":41,"tag":226,"props":1619,"children":1620},{},[1621],{"type":46,"value":1622},"Graph Signal",{"type":41,"tag":226,"props":1624,"children":1625},{},[1626],{"type":46,"value":1627},"Classification",{"type":41,"tag":226,"props":1629,"children":1630},{},[1631],{"type":46,"value":1632},"Action",{"type":41,"tag":242,"props":1634,"children":1635},{},[1636,1657,1677,1697,1718,1739,1760,1781,1802,1844,1878],{"type":41,"tag":222,"props":1637,"children":1638},{},[1639,1644,1652],{"type":41,"tag":249,"props":1640,"children":1641},{},[1642],{"type":46,"value":1643},"No callers in graph",{"type":41,"tag":249,"props":1645,"children":1646},{},[1647],{"type":41,"tag":133,"props":1648,"children":1649},{},[1650],{"type":46,"value":1651},"False Positive",{"type":41,"tag":249,"props":1653,"children":1654},{},[1655],{"type":46,"value":1656},"Dead code, skip",{"type":41,"tag":222,"props":1658,"children":1659},{},[1660,1665,1672],{"type":41,"tag":249,"props":1661,"children":1662},{},[1663],{"type":46,"value":1664},"Only test callers",{"type":41,"tag":249,"props":1666,"children":1667},{},[1668],{"type":41,"tag":133,"props":1669,"children":1670},{},[1671],{"type":46,"value":1651},{"type":41,"tag":249,"props":1673,"children":1674},{},[1675],{"type":46,"value":1676},"Test infrastructure",{"type":41,"tag":222,"props":1678,"children":1679},{},[1680,1685,1692],{"type":41,"tag":249,"props":1681,"children":1682},{},[1683],{"type":46,"value":1684},"Logging\u002Fdisplay\u002Fformatting",{"type":41,"tag":249,"props":1686,"children":1687},{},[1688],{"type":41,"tag":133,"props":1689,"children":1690},{},[1691],{"type":46,"value":1651},{"type":41,"tag":249,"props":1693,"children":1694},{},[1695],{"type":46,"value":1696},"Cosmetic",{"type":41,"tag":222,"props":1698,"children":1699},{},[1700,1705,1713],{"type":41,"tag":249,"props":1701,"children":1702},{},[1703],{"type":46,"value":1704},"Cross-package callers but NOT COVERED",{"type":41,"tag":249,"props":1706,"children":1707},{},[1708],{"type":41,"tag":133,"props":1709,"children":1710},{},[1711],{"type":46,"value":1712},"Cross-Package Gap",{"type":41,"tag":249,"props":1714,"children":1715},{},[1716],{"type":46,"value":1717},"See below",{"type":41,"tag":222,"props":1719,"children":1720},{},[1721,1726,1734],{"type":41,"tag":249,"props":1722,"children":1723},{},[1724],{"type":46,"value":1725},"Reachable from public API, low CC",{"type":41,"tag":249,"props":1727,"children":1728},{},[1729],{"type":41,"tag":133,"props":1730,"children":1731},{},[1732],{"type":46,"value":1733},"Missing Vector",{"type":41,"tag":249,"props":1735,"children":1736},{},[1737],{"type":46,"value":1738},"Design targeted vector",{"type":41,"tag":222,"props":1740,"children":1741},{},[1742,1747,1755],{"type":41,"tag":249,"props":1743,"children":1744},{},[1745],{"type":46,"value":1746},"Reachable from public API, high CC (>10)",{"type":41,"tag":249,"props":1748,"children":1749},{},[1750],{"type":41,"tag":133,"props":1751,"children":1752},{},[1753],{"type":46,"value":1754},"Fuzzing Target",{"type":41,"tag":249,"props":1756,"children":1757},{},[1758],{"type":46,"value":1759},"Both vector + fuzz harness",{"type":41,"tag":222,"props":1761,"children":1762},{},[1763,1768,1776],{"type":41,"tag":249,"props":1764,"children":1765},{},[1766],{"type":46,"value":1767},"Validation\u002Ferror-handling path",{"type":41,"tag":249,"props":1769,"children":1770},{},[1771],{"type":41,"tag":133,"props":1772,"children":1773},{},[1774],{"type":46,"value":1775},"Negative Vector",{"type":41,"tag":249,"props":1777,"children":1778},{},[1779],{"type":46,"value":1780},"Craft invalid input that triggers path",{"type":41,"tag":222,"props":1782,"children":1783},{},[1784,1789,1797],{"type":41,"tag":249,"props":1785,"children":1786},{},[1787],{"type":46,"value":1788},"Optimization path (GLV, SIMD, batch)",{"type":41,"tag":249,"props":1790,"children":1791},{},[1792],{"type":41,"tag":133,"props":1793,"children":1794},{},[1795],{"type":46,"value":1796},"Edge-Case Vector",{"type":41,"tag":249,"props":1798,"children":1799},{},[1800],{"type":46,"value":1801},"Input that triggers optimization threshold",{"type":41,"tag":222,"props":1803,"children":1804},{},[1805,1831,1839],{"type":41,"tag":249,"props":1806,"children":1807},{},[1808,1813,1815,1821,1823,1829],{"type":41,"tag":141,"props":1809,"children":1811},{"className":1810},[],[1812],{"type":46,"value":689},{"type":46,"value":1814},"→",{"type":41,"tag":141,"props":1816,"children":1818},{"className":1817},[],[1819],{"type":46,"value":1820},"^",{"type":46,"value":1822}," after left shift (e.g. ",{"type":41,"tag":141,"props":1824,"children":1826},{"className":1825},[],[1827],{"type":46,"value":1828},"(t\u003C\u003C1) | carry",{"type":46,"value":1830},")",{"type":41,"tag":249,"props":1832,"children":1833},{},[1834],{"type":41,"tag":133,"props":1835,"children":1836},{},[1837],{"type":46,"value":1838},"Equivalent Mutant",{"type":41,"tag":249,"props":1840,"children":1841},{},[1842],{"type":46,"value":1843},"Skip — bit 0 always 0, OR=XOR",{"type":41,"tag":222,"props":1845,"children":1846},{},[1847,1865,1873],{"type":41,"tag":249,"props":1848,"children":1849},{},[1850,1852,1857,1858,1863],{"type":46,"value":1851},"ct_eq ",{"type":41,"tag":141,"props":1853,"children":1855},{"className":1854},[],[1856],{"type":46,"value":681},{"type":46,"value":1814},{"type":41,"tag":141,"props":1859,"children":1861},{"className":1860},[],[1862],{"type":46,"value":689},{"type":46,"value":1864}," on Montgomery limbs",{"type":41,"tag":249,"props":1866,"children":1867},{},[1868],{"type":41,"tag":133,"props":1869,"children":1870},{},[1871],{"type":46,"value":1872},"API-Unreachable",{"type":41,"tag":249,"props":1874,"children":1875},{},[1876],{"type":46,"value":1877},"Needs library-internal tests, not vectors",{"type":41,"tag":222,"props":1879,"children":1880},{},[1881,1886,1893],{"type":41,"tag":249,"props":1882,"children":1883},{},[1884],{"type":46,"value":1885},"Equivalent mutation (behavior unchanged)",{"type":41,"tag":249,"props":1887,"children":1888},{},[1889],{"type":41,"tag":133,"props":1890,"children":1891},{},[1892],{"type":46,"value":1651},{"type":41,"tag":249,"props":1894,"children":1895},{},[1896],{"type":46,"value":1897},"Skip",{"type":41,"tag":468,"props":1899,"children":1901},{"id":1900},"step-4-identify-cross-package-test-gaps",[1902],{"type":46,"value":1903},"Step 4: Identify Cross-Package Test Gaps",{"type":41,"tag":49,"props":1905,"children":1906},{},[1907,1912],{"type":41,"tag":133,"props":1908,"children":1909},{},[1910],{"type":46,"value":1911},"Critical pitfall:",{"type":46,"value":1913}," Mutation frameworks often only run tests\nwithin the same package as the mutation. For Go (gremlins) and\nRust (cargo-mutants), this means:",{"type":41,"tag":62,"props":1915,"children":1916},{},[1917,1946,1956],{"type":41,"tag":66,"props":1918,"children":1919},{},[1920,1922,1928,1930,1936,1938,1944],{"type":46,"value":1921},"A mutation in ",{"type":41,"tag":141,"props":1923,"children":1925},{"className":1924},[],[1926],{"type":46,"value":1927},"hash_to_curve\u002Fg2.go",{"type":46,"value":1929}," only runs tests in the\n",{"type":41,"tag":141,"props":1931,"children":1933},{"className":1932},[],[1934],{"type":46,"value":1935},"hash_to_curve",{"type":46,"value":1937}," package, NOT tests in the parent ",{"type":41,"tag":141,"props":1939,"children":1941},{"className":1940},[],[1942],{"type":46,"value":1943},"bls12381",{"type":46,"value":1945},"\npackage that imports it",{"type":41,"tag":66,"props":1947,"children":1948},{},[1949,1951],{"type":46,"value":1950},"Functions that are fully exercised by cross-package tests\nwill appear as NOT COVERED — these are ",{"type":41,"tag":133,"props":1952,"children":1953},{},[1954],{"type":46,"value":1955},"false positives",{"type":41,"tag":66,"props":1957,"children":1958},{},[1959,1961,1966],{"type":46,"value":1960},"To confirm: check if the mutated function is called from a\ntest in a ",{"type":41,"tag":584,"props":1962,"children":1963},{},[1964],{"type":46,"value":1965},"different",{"type":46,"value":1967}," package that wouldn't be run",{"type":41,"tag":49,"props":1969,"children":1970},{},[1971],{"type":46,"value":1972},"To resolve cross-package gaps:",{"type":41,"tag":406,"props":1974,"children":1975},{},[1976,1981,1994],{"type":41,"tag":66,"props":1977,"children":1978},{},[1979],{"type":46,"value":1980},"Add a thin test in the sub-package that calls through the\nsame code path as the cross-package test",{"type":41,"tag":66,"props":1982,"children":1983},{},[1984,1986,1992],{"type":46,"value":1985},"Or run gremlins with ",{"type":41,"tag":141,"props":1987,"children":1989},{"className":1988},[],[1990],{"type":46,"value":1991},"--test-pkg .\u002F...",{"type":46,"value":1993}," (if supported)",{"type":41,"tag":66,"props":1995,"children":1996},{},[1997],{"type":46,"value":1998},"Or document as a framework limitation in the report",{"type":41,"tag":468,"props":2000,"children":2002},{"id":2001},"step-5-prioritize-by-security-impact",[2003],{"type":46,"value":2004},"Step 5: Prioritize by Security Impact",{"type":41,"tag":49,"props":2006,"children":2007},{},[2008],{"type":46,"value":2009},"Using the call graph, rank surviving mutants by impact:",{"type":41,"tag":214,"props":2011,"children":2012},{},[2013,2033],{"type":41,"tag":218,"props":2014,"children":2015},{},[2016],{"type":41,"tag":222,"props":2017,"children":2018},{},[2019,2024,2029],{"type":41,"tag":226,"props":2020,"children":2021},{},[2022],{"type":46,"value":2023},"Priority",{"type":41,"tag":226,"props":2025,"children":2026},{},[2027],{"type":46,"value":2028},"Criteria",{"type":41,"tag":226,"props":2030,"children":2031},{},[2032],{"type":46,"value":497},{"type":41,"tag":242,"props":2034,"children":2035},{},[2036,2076,2115,2154,2181],{"type":41,"tag":222,"props":2037,"children":2038},{},[2039,2047,2052],{"type":41,"tag":249,"props":2040,"children":2041},{},[2042],{"type":41,"tag":133,"props":2043,"children":2044},{},[2045],{"type":46,"value":2046},"P0 — Critical",{"type":41,"tag":249,"props":2048,"children":2049},{},[2050],{"type":46,"value":2051},"Mutant weakens validation\u002Fequality\u002Fauthentication",{"type":41,"tag":249,"props":2053,"children":2054},{},[2055,2061,2063,2068,2069,2074],{"type":41,"tag":141,"props":2056,"children":2058},{"className":2057},[],[2059],{"type":46,"value":2060},"ct_eq",{"type":46,"value":2062},": ",{"type":41,"tag":141,"props":2064,"children":2066},{"className":2065},[],[2067],{"type":46,"value":681},{"type":46,"value":683},{"type":41,"tag":141,"props":2070,"children":2072},{"className":2071},[],[2073],{"type":46,"value":689},{"type":46,"value":2075}," makes equality permissive",{"type":41,"tag":222,"props":2077,"children":2078},{},[2079,2087,2092],{"type":41,"tag":249,"props":2080,"children":2081},{},[2082],{"type":41,"tag":133,"props":2083,"children":2084},{},[2085],{"type":46,"value":2086},"P1 — High",{"type":41,"tag":249,"props":2088,"children":2089},{},[2090],{"type":46,"value":2091},"Mutant in deserialization flag parsing",{"type":41,"tag":249,"props":2093,"children":2094},{},[2095,2101,2102,2107,2108,2113],{"type":41,"tag":141,"props":2096,"children":2098},{"className":2097},[],[2099],{"type":46,"value":2100},"from_compressed",{"type":46,"value":2062},{"type":41,"tag":141,"props":2103,"children":2105},{"className":2104},[],[2106],{"type":46,"value":681},{"type":46,"value":683},{"type":41,"tag":141,"props":2109,"children":2111},{"className":2110},[],[2112],{"type":46,"value":689},{"type":46,"value":2114}," accepts invalid flags",{"type":41,"tag":222,"props":2116,"children":2117},{},[2118,2126,2131],{"type":41,"tag":249,"props":2119,"children":2120},{},[2121],{"type":41,"tag":133,"props":2122,"children":2123},{},[2124],{"type":46,"value":2125},"P2 — Medium",{"type":41,"tag":249,"props":2127,"children":2128},{},[2129],{"type":46,"value":2130},"Mutant in field arithmetic internals",{"type":41,"tag":249,"props":2132,"children":2133},{},[2134,2140,2141,2146,2147,2152],{"type":41,"tag":141,"props":2135,"children":2137},{"className":2136},[],[2138],{"type":46,"value":2139},"Fp::square",{"type":46,"value":2062},{"type":41,"tag":141,"props":2142,"children":2144},{"className":2143},[],[2145],{"type":46,"value":689},{"type":46,"value":683},{"type":41,"tag":141,"props":2148,"children":2150},{"className":2149},[],[2151],{"type":46,"value":1820},{"type":46,"value":2153}," corrupts computation",{"type":41,"tag":222,"props":2155,"children":2156},{},[2157,2165,2170],{"type":41,"tag":249,"props":2158,"children":2159},{},[2160],{"type":41,"tag":133,"props":2161,"children":2162},{},[2163],{"type":46,"value":2164},"P3 — Low",{"type":41,"tag":249,"props":2166,"children":2167},{},[2168],{"type":46,"value":2169},"Mutant in optimization path",{"type":41,"tag":249,"props":2171,"children":2172},{},[2173,2179],{"type":41,"tag":141,"props":2174,"children":2176},{"className":2175},[],[2177],{"type":46,"value":2178},"phi",{"type":46,"value":2180}," endomorphism: only affects performance path",{"type":41,"tag":222,"props":2182,"children":2183},{},[2184,2191,2196],{"type":41,"tag":249,"props":2185,"children":2186},{},[2187],{"type":41,"tag":133,"props":2188,"children":2189},{},[2190],{"type":46,"value":1897},{"type":41,"tag":249,"props":2192,"children":2193},{},[2194],{"type":46,"value":2195},"Formatting, display, equivalent mutation",{"type":41,"tag":249,"props":2197,"children":2198},{},[2199,2205],{"type":41,"tag":141,"props":2200,"children":2202},{"className":2201},[],[2203],{"type":46,"value":2204},"Debug::fmt",{"type":46,"value":2206}," return value replacement",{"type":41,"tag":468,"props":2208,"children":2210},{"id":2209},"step-6-group-by-vector-strategy",[2211],{"type":46,"value":2212},"Step 6: Group by Vector Strategy",{"type":41,"tag":49,"props":2214,"children":2215},{},[2216],{"type":46,"value":2217},"Group escaped mutants by the code path they represent and the\ntype of test vector needed:",{"type":41,"tag":150,"props":2219,"children":2222},{"className":2220,"code":2221,"language":46},[384],"Deserialization flag validation (P1):\n  - g1.rs:339,363-365,384 — from_compressed_unchecked flags\n  → Need: valid-point-wrong-flag vectors\n\nField arithmetic (P2):\n  - fp.rs:371-376,406,635-643 — subtract_p, neg, square\n  → Need: field arithmetic KATs with edge-case values\n\nOptimization thresholds (P3):\n  - g1.go:68, g2.go:75 — GLV vs windowed multiplication\n  → Need: scalar multiplication with large scalars\n\nCross-package (framework limitation):\n  - hash_to_curve\u002Fg2.go:242-278 — isogeny, sgn0\n  → Document as false positive or add sub-package test\n",[2223],{"type":41,"tag":141,"props":2224,"children":2225},{"__ignoreMap":155},[2226],{"type":46,"value":2221},{"type":41,"tag":49,"props":2228,"children":2229},{},[2230],{"type":46,"value":2231},"Each group becomes a target for new test vectors in Phase 5.",{"type":41,"tag":204,"props":2233,"children":2234},{},[],{"type":41,"tag":55,"props":2236,"children":2238},{"id":2237},"phase-5-vector-generation",[2239],{"type":46,"value":2240},"Phase 5: Vector Generation",{"type":41,"tag":49,"props":2242,"children":2243},{},[2244],{"type":46,"value":2245},"For each escaped code path group, design test vectors that\nforce execution through that path.",{"type":41,"tag":468,"props":2247,"children":2249},{"id":2248},"vector-design-patterns",[2250],{"type":46,"value":2251},"Vector Design Patterns",{"type":41,"tag":214,"props":2253,"children":2254},{},[2255,2271],{"type":41,"tag":218,"props":2256,"children":2257},{},[2258],{"type":41,"tag":222,"props":2259,"children":2260},{},[2261,2266],{"type":41,"tag":226,"props":2262,"children":2263},{},[2264],{"type":46,"value":2265},"Code Path Type",{"type":41,"tag":226,"props":2267,"children":2268},{},[2269],{"type":46,"value":2270},"Vector Strategy",{"type":41,"tag":242,"props":2272,"children":2273},{},[2274,2287,2300,2313,2326,2339,2352,2365,2384],{"type":41,"tag":222,"props":2275,"children":2276},{},[2277,2282],{"type":41,"tag":249,"props":2278,"children":2279},{},[2280],{"type":46,"value":2281},"Point deserialization",{"type":41,"tag":249,"props":2283,"children":2284},{},[2285],{"type":46,"value":2286},"Malformed points: wrong length, invalid field elements, off-curve, wrong subgroup, identity point",{"type":41,"tag":222,"props":2288,"children":2289},{},[2290,2295],{"type":41,"tag":249,"props":2291,"children":2292},{},[2293],{"type":46,"value":2294},"Signature verification",{"type":41,"tag":249,"props":2296,"children":2297},{},[2298],{"type":46,"value":2299},"Valid sig + all single-bit corruptions of sig, pk, msg",{"type":41,"tag":222,"props":2301,"children":2302},{},[2303,2308],{"type":41,"tag":249,"props":2304,"children":2305},{},[2306],{"type":46,"value":2307},"Hash-to-curve",{"type":41,"tag":249,"props":2309,"children":2310},{},[2311],{"type":46,"value":2312},"Known answer tests (KATs) with edge-case inputs: empty, single byte, max length",{"type":41,"tag":222,"props":2314,"children":2315},{},[2316,2321],{"type":41,"tag":249,"props":2317,"children":2318},{},[2319],{"type":46,"value":2320},"Aggregate operations",{"type":41,"tag":249,"props":2322,"children":2323},{},[2324],{"type":46,"value":2325},"1 signer, many signers, duplicate signers, mixed valid\u002Finvalid",{"type":41,"tag":222,"props":2327,"children":2328},{},[2329,2334],{"type":41,"tag":249,"props":2330,"children":2331},{},[2332],{"type":46,"value":2333},"Error handling",{"type":41,"tag":249,"props":2335,"children":2336},{},[2337],{"type":46,"value":2338},"Every error path should have a vector that triggers it",{"type":41,"tag":222,"props":2340,"children":2341},{},[2342,2347],{"type":41,"tag":249,"props":2343,"children":2344},{},[2345],{"type":46,"value":2346},"Arithmetic edge cases",{"type":41,"tag":249,"props":2348,"children":2349},{},[2350],{"type":46,"value":2351},"Zero, one, field modulus - 1, points at infinity",{"type":41,"tag":222,"props":2353,"children":2354},{},[2355,2360],{"type":41,"tag":249,"props":2356,"children":2357},{},[2358],{"type":46,"value":2359},"Serialization flags",{"type":41,"tag":249,"props":2361,"children":2362},{},[2363],{"type":46,"value":2364},"Every valid flag combination + every invalid flag combination",{"type":41,"tag":222,"props":2366,"children":2367},{},[2368,2373],{"type":41,"tag":249,"props":2369,"children":2370},{},[2371],{"type":46,"value":2372},"Roundtrip integrity",{"type":41,"tag":249,"props":2374,"children":2375},{},[2376,2378],{"type":46,"value":2377},"For every valid deser vector, assert ",{"type":41,"tag":141,"props":2379,"children":2381},{"className":2380},[],[2382],{"type":46,"value":2383},"serialize(deserialize(b)) == b",{"type":41,"tag":222,"props":2385,"children":2386},{},[2387,2392],{"type":41,"tag":249,"props":2388,"children":2389},{},[2390],{"type":46,"value":2391},"Carry\u002Freduction faults",{"type":41,"tag":249,"props":2393,"children":2394},{},[2395],{"type":46,"value":2396},"Reimplement at reduced limb widths, inject faults, extract distinguishing inputs",{"type":41,"tag":468,"props":2398,"children":2400},{"id":2399},"single-fault-negative-vectors",[2401],{"type":46,"value":2402},"Single-Fault Negative Vectors",{"type":41,"tag":49,"props":2404,"children":2405},{},[2406,2408,2413,2415,2420],{"type":46,"value":2407},"Each negative vector should have ",{"type":41,"tag":133,"props":2409,"children":2410},{},[2411],{"type":46,"value":2412},"exactly one defect",{"type":46,"value":2414}," with\neverything else valid — this isolates which validation check is\nbeing tested. See ",{"type":41,"tag":693,"props":2416,"children":2418},{"href":2417},"references\u002Fvector-patterns.md",[2419],{"type":46,"value":2417},{"type":46,"value":2421},"\nfor per-flag construction examples.",{"type":41,"tag":468,"props":2423,"children":2425},{"id":2424},"fault-simulation-limb-width-reimplementation",[2426],{"type":46,"value":2427},"Fault Simulation (Limb-Width Reimplementation)",{"type":41,"tag":49,"props":2429,"children":2430},{},[2431],{"type":46,"value":2432},"When mutation testing only applies local operator swaps, deeper\narchitectural bugs (carry propagation, reduction overflow) go\nuntested. To close this gap, reimplement the target algorithm\nat reduced limb widths (8, 16, 25, 32 bits) and deliberately\ninject faults — then generate vectors that catch them.",{"type":41,"tag":49,"props":2434,"children":2435},{},[2436,2437,2442],{"type":46,"value":955},{"type":41,"tag":693,"props":2438,"children":2440},{"href":2439},"references\u002Ffault-simulation.md",[2441],{"type":46,"value":2439},{"type":46,"value":2443},"\nfor the full methodology: limb-width selection, fault injection\ncatalog, vector extraction, and validation workflow.",{"type":41,"tag":468,"props":2445,"children":2447},{"id":2446},"cross-implementation-verification",[2448],{"type":46,"value":2449},"Cross-Implementation Verification",{"type":41,"tag":49,"props":2451,"children":2452},{},[2453],{"type":46,"value":2454},"Every new test vector MUST be verified against at least two\nindependent implementations before being added to the suite:",{"type":41,"tag":406,"props":2456,"children":2457},{},[2458,2463,2468],{"type":41,"tag":66,"props":2459,"children":2460},{},[2461],{"type":46,"value":2462},"Generate the vector using implementation A",{"type":41,"tag":66,"props":2464,"children":2465},{},[2466],{"type":46,"value":2467},"Verify with implementation B (different codebase, ideally different language)",{"type":41,"tag":66,"props":2469,"children":2470},{},[2471],{"type":46,"value":2472},"If B disagrees, investigate — one implementation has a bug",{"type":41,"tag":468,"props":2474,"children":2476},{"id":2475},"vector-format",[2477],{"type":46,"value":2478},"Vector Format",{"type":41,"tag":49,"props":2480,"children":2481},{},[2482,2484,2490,2492,2498,2500,2506,2507,2513,2514,2520,2521,2527,2529,2533],{"type":46,"value":2483},"Use Wycheproof JSON format (",{"type":41,"tag":141,"props":2485,"children":2487},{"className":2486},[],[2488],{"type":46,"value":2489},"algorithm",{"type":46,"value":2491},", ",{"type":41,"tag":141,"props":2493,"children":2495},{"className":2494},[],[2496],{"type":46,"value":2497},"testGroups[].tests[]",{"type":46,"value":2499},"\nwith ",{"type":41,"tag":141,"props":2501,"children":2503},{"className":2502},[],[2504],{"type":46,"value":2505},"tcId",{"type":46,"value":2491},{"type":41,"tag":141,"props":2508,"children":2510},{"className":2509},[],[2511],{"type":46,"value":2512},"comment",{"type":46,"value":2491},{"type":41,"tag":141,"props":2515,"children":2517},{"className":2516},[],[2518],{"type":46,"value":2519},"result",{"type":46,"value":2491},{"type":41,"tag":141,"props":2522,"children":2524},{"className":2523},[],[2525],{"type":46,"value":2526},"flags",{"type":46,"value":2528},"). See\n",{"type":41,"tag":693,"props":2530,"children":2531},{"href":2417},[2532],{"type":46,"value":2417},{"type":46,"value":2534},"\nfor the full schema.",{"type":41,"tag":49,"props":2536,"children":2537},{},[2538,2543,2545,2551],{"type":41,"tag":133,"props":2539,"children":2540},{},[2541],{"type":46,"value":2542},"JSON encoding:",{"type":46,"value":2544}," Wycheproof canonicalizes vectors with\n",{"type":41,"tag":141,"props":2546,"children":2548},{"className":2547},[],[2549],{"type":46,"value":2550},"reformat_json.py",{"type":46,"value":2552},", which unescapes HTML entities. Generate vectors\nwith literal characters, not HTML-escaped sequences:",{"type":41,"tag":62,"props":2554,"children":2555},{},[2556,2637,2654],{"type":41,"tag":66,"props":2557,"children":2558},{},[2559,2563,2565,2571,2573,2579,2581,2587,2589,2595,2597,2603,2604,2610,2611,2617,2618,2624,2625,2630,2631],{"type":41,"tag":133,"props":2560,"children":2561},{},[2562],{"type":46,"value":715},{"type":46,"value":2564}," Use ",{"type":41,"tag":141,"props":2566,"children":2568},{"className":2567},[],[2569],{"type":46,"value":2570},"json.NewEncoder",{"type":46,"value":2572}," + ",{"type":41,"tag":141,"props":2574,"children":2576},{"className":2575},[],[2577],{"type":46,"value":2578},"enc.SetEscapeHTML(false)",{"type":46,"value":2580}," —\nnever ",{"type":41,"tag":141,"props":2582,"children":2584},{"className":2583},[],[2585],{"type":46,"value":2586},"json.Marshal",{"type":46,"value":2588},"\u002F",{"type":41,"tag":141,"props":2590,"children":2592},{"className":2591},[],[2593],{"type":46,"value":2594},"json.MarshalIndent",{"type":46,"value":2596},", which silently escape\n",{"type":41,"tag":141,"props":2598,"children":2600},{"className":2599},[],[2601],{"type":46,"value":2602},">",{"type":46,"value":683},{"type":41,"tag":141,"props":2605,"children":2607},{"className":2606},[],[2608],{"type":46,"value":2609},"\\u003e",{"type":46,"value":2491},{"type":41,"tag":141,"props":2612,"children":2614},{"className":2613},[],[2615],{"type":46,"value":2616},"\u003C",{"type":46,"value":683},{"type":41,"tag":141,"props":2619,"children":2621},{"className":2620},[],[2622],{"type":46,"value":2623},"\\u003c",{"type":46,"value":2491},{"type":41,"tag":141,"props":2626,"children":2628},{"className":2627},[],[2629],{"type":46,"value":681},{"type":46,"value":683},{"type":41,"tag":141,"props":2632,"children":2634},{"className":2633},[],[2635],{"type":46,"value":2636},"\\u0026",{"type":41,"tag":66,"props":2638,"children":2639},{},[2640,2644,2646,2652],{"type":41,"tag":133,"props":2641,"children":2642},{},[2643],{"type":46,"value":759},{"type":46,"value":2645}," ",{"type":41,"tag":141,"props":2647,"children":2649},{"className":2648},[],[2650],{"type":46,"value":2651},"json.dumps",{"type":46,"value":2653}," is safe by default",{"type":41,"tag":66,"props":2655,"children":2656},{},[2657,2662,2663,2669],{"type":41,"tag":133,"props":2658,"children":2659},{},[2660],{"type":46,"value":2661},"Node.js:",{"type":46,"value":2645},{"type":41,"tag":141,"props":2664,"children":2666},{"className":2665},[],[2667],{"type":46,"value":2668},"JSON.stringify",{"type":46,"value":2653},{"type":41,"tag":49,"props":2671,"children":2672},{},[2673,2674,2678],{"type":46,"value":955},{"type":41,"tag":693,"props":2675,"children":2676},{"href":695},[2677],{"type":46,"value":695},{"type":46,"value":2679},"\n§14 for details.",{"type":41,"tag":204,"props":2681,"children":2682},{},[],{"type":41,"tag":55,"props":2684,"children":2686},{"id":2685},"phase-6-validation",[2687],{"type":46,"value":2688},"Phase 6: Validation",{"type":41,"tag":49,"props":2690,"children":2691},{},[2692],{"type":46,"value":2693},"Re-run mutation testing with the new test vectors included.",{"type":41,"tag":49,"props":2695,"children":2696},{},[2697,2702,2704,2708],{"type":41,"tag":133,"props":2698,"children":2699},{},[2700],{"type":46,"value":2701},"Tip:",{"type":46,"value":2703}," Use per-file mutation testing for fast iteration during\nvector development (see ",{"type":41,"tag":693,"props":2705,"children":2706},{"href":695},[2707],{"type":46,"value":695},{"type":46,"value":2709}," §12).\nOnly run full-crate tests for the final comparison.",{"type":41,"tag":468,"props":2711,"children":2713},{"id":2712},"beforeafter-comparison",[2714],{"type":46,"value":2715},"Before\u002FAfter Comparison",{"type":41,"tag":214,"props":2717,"children":2718},{},[2719,2744],{"type":41,"tag":218,"props":2720,"children":2721},{},[2722],{"type":41,"tag":222,"props":2723,"children":2724},{},[2725,2729,2734,2739],{"type":41,"tag":226,"props":2726,"children":2727},{},[2728],{"type":46,"value":1149},{"type":41,"tag":226,"props":2730,"children":2731},{},[2732],{"type":46,"value":2733},"Baseline",{"type":41,"tag":226,"props":2735,"children":2736},{},[2737],{"type":46,"value":2738},"With New Vectors",{"type":41,"tag":226,"props":2740,"children":2741},{},[2742],{"type":46,"value":2743},"Delta",{"type":41,"tag":242,"props":2745,"children":2746},{},[2747,2769,2792,2815],{"type":41,"tag":222,"props":2748,"children":2749},{},[2750,2754,2759,2764],{"type":41,"tag":249,"props":2751,"children":2752},{},[2753],{"type":46,"value":1178},{"type":41,"tag":249,"props":2755,"children":2756},{},[2757],{"type":46,"value":2758},"X",{"type":41,"tag":249,"props":2760,"children":2761},{},[2762],{"type":46,"value":2763},"Y",{"type":41,"tag":249,"props":2765,"children":2766},{},[2767],{"type":46,"value":2768},"Y - X",{"type":41,"tag":222,"props":2770,"children":2771},{},[2772,2777,2782,2787],{"type":41,"tag":249,"props":2773,"children":2774},{},[2775],{"type":46,"value":2776},"Survived",{"type":41,"tag":249,"props":2778,"children":2779},{},[2780],{"type":46,"value":2781},"A",{"type":41,"tag":249,"props":2783,"children":2784},{},[2785],{"type":46,"value":2786},"B",{"type":41,"tag":249,"props":2788,"children":2789},{},[2790],{"type":46,"value":2791},"A - B (should decrease)",{"type":41,"tag":222,"props":2793,"children":2794},{},[2795,2800,2805,2810],{"type":41,"tag":249,"props":2796,"children":2797},{},[2798],{"type":46,"value":2799},"Not Covered",{"type":41,"tag":249,"props":2801,"children":2802},{},[2803],{"type":46,"value":2804},"C",{"type":41,"tag":249,"props":2806,"children":2807},{},[2808],{"type":46,"value":2809},"D",{"type":41,"tag":249,"props":2811,"children":2812},{},[2813],{"type":46,"value":2814},"C - D (should decrease)",{"type":41,"tag":222,"props":2816,"children":2817},{},[2818,2822,2827,2832],{"type":41,"tag":249,"props":2819,"children":2820},{},[2821],{"type":46,"value":1230},{"type":41,"tag":249,"props":2823,"children":2824},{},[2825],{"type":46,"value":2826},"E%",{"type":41,"tag":249,"props":2828,"children":2829},{},[2830],{"type":46,"value":2831},"F%",{"type":41,"tag":249,"props":2833,"children":2834},{},[2835],{"type":46,"value":2836},"F - E",{"type":41,"tag":468,"props":2838,"children":2840},{"id":2839},"success-criteria",[2841],{"type":46,"value":2842},"Success Criteria",{"type":41,"tag":49,"props":2844,"children":2845},{},[2846,2848,2853,2855,2860,2862,2866],{"type":46,"value":2847},"Vectors have both ",{"type":41,"tag":133,"props":2849,"children":2850},{},[2851],{"type":46,"value":2852},"retroactive",{"type":46,"value":2854}," value (killing mutants in\nexisting code) and ",{"type":41,"tag":133,"props":2856,"children":2857},{},[2858],{"type":46,"value":2859},"proactive",{"type":46,"value":2861}," value (catching bugs in future\nimplementations). Generate both kinds — boundary-condition vectors\nmay not improve kill rates in mature libraries but will catch bugs\nin new implementations. See\n",{"type":41,"tag":693,"props":2863,"children":2864},{"href":695},[2865],{"type":46,"value":695},{"type":46,"value":2867}," §13.",{"type":41,"tag":49,"props":2869,"children":2870},{},[2871,2876],{"type":41,"tag":133,"props":2872,"children":2873},{},[2874],{"type":46,"value":2875},"Retroactive (measurable):",{"type":46,"value":2877}," previously survived\u002Funcovered mutants\nbecome killed, no regressions.",{"type":41,"tag":49,"props":2879,"children":2880},{},[2881,2886],{"type":41,"tag":133,"props":2882,"children":2883},{},[2884],{"type":46,"value":2885},"If kill rates don't change:",{"type":46,"value":2887}," the implementation's own tests\nlikely already cover those paths. The vectors still add\ncross-implementation verification value. Document which case\napplies.",{"type":41,"tag":204,"props":2889,"children":2890},{},[],{"type":41,"tag":55,"props":2892,"children":2894},{"id":2893},"output-format",[2895],{"type":46,"value":2896},"Output Format",{"type":41,"tag":49,"props":2898,"children":2899},{},[2900,2902,2908,2910,2915],{"type":46,"value":2901},"Write ",{"type":41,"tag":141,"props":2903,"children":2905},{"className":2904},[],[2906],{"type":46,"value":2907},"VECTOR_FORGE_REPORT.md",{"type":46,"value":2909}," covering: target algorithm,\nimplementations tested, baseline results, escape analysis,\nnew vectors generated, after results, before\u002Fafter delta, and\nconclusions. See\n",{"type":41,"tag":693,"props":2911,"children":2913},{"href":2912},"references\u002Freport-template.md",[2914],{"type":46,"value":2912},{"type":46,"value":2916},"\nfor the full template.",{"type":41,"tag":204,"props":2918,"children":2919},{},[],{"type":41,"tag":55,"props":2921,"children":2923},{"id":2922},"quality-checklist",[2924],{"type":46,"value":2925},"Quality Checklist",{"type":41,"tag":49,"props":2927,"children":2928},{},[2929],{"type":46,"value":2930},"Before delivering:",{"type":41,"tag":62,"props":2932,"children":2935},{"className":2933},[2934],"contains-task-list",[2936,2948,2957,2966,2975,2984,2993,3002,3011,3020,3034],{"type":41,"tag":66,"props":2937,"children":2940},{"className":2938},[2939],"task-list-item",[2941,2946],{"type":41,"tag":2942,"props":2943,"children":2945},"input",{"disabled":831,"type":2944},"checkbox",[],{"type":46,"value":2947}," At least one pure implementation mutation-tested (not just FFI wrappers)",{"type":41,"tag":66,"props":2949,"children":2951},{"className":2950},[2939],[2952,2955],{"type":41,"tag":2942,"props":2953,"children":2954},{"disabled":831,"type":2944},[],{"type":46,"value":2956}," Baseline run completed with existing vectors",{"type":41,"tag":66,"props":2958,"children":2960},{"className":2959},[2939],[2961,2964],{"type":41,"tag":2942,"props":2962,"children":2963},{"disabled":831,"type":2944},[],{"type":46,"value":2965}," Trailmark call graph built for each implementation",{"type":41,"tag":66,"props":2967,"children":2969},{"className":2968},[2939],[2970,2973],{"type":41,"tag":2942,"props":2971,"children":2972},{"disabled":831,"type":2944},[],{"type":46,"value":2974}," All escaped mutants triaged using graph-informed classification",{"type":41,"tag":66,"props":2976,"children":2978},{"className":2977},[2939],[2979,2982],{"type":41,"tag":2942,"props":2980,"children":2981},{"disabled":831,"type":2944},[],{"type":46,"value":2983}," Cross-package false positives identified and documented",{"type":41,"tag":66,"props":2985,"children":2987},{"className":2986},[2939],[2988,2991],{"type":41,"tag":2942,"props":2989,"children":2990},{"disabled":831,"type":2944},[],{"type":46,"value":2992}," Security-critical mutations (ct_eq, validation, auth) prioritized as P0\u002FP1",{"type":41,"tag":66,"props":2994,"children":2996},{"className":2995},[2939],[2997,3000],{"type":41,"tag":2942,"props":2998,"children":2999},{"disabled":831,"type":2944},[],{"type":46,"value":3001}," Fault simulation and mutation-derived vectors cross-verified against 2+ implementations",{"type":41,"tag":66,"props":3003,"children":3005},{"className":3004},[2939],[3006,3009],{"type":41,"tag":2942,"props":3007,"children":3008},{"disabled":831,"type":2944},[],{"type":46,"value":3010}," After run completed with new vectors included",{"type":41,"tag":66,"props":3012,"children":3014},{"className":3013},[2939],[3015,3018],{"type":41,"tag":2942,"props":3016,"children":3017},{"disabled":831,"type":2944},[],{"type":46,"value":3019}," Before\u002Fafter delta computed and explained",{"type":41,"tag":66,"props":3021,"children":3023},{"className":3022},[2939],[3024,3027,3029],{"type":41,"tag":2942,"props":3025,"children":3026},{"disabled":831,"type":2944},[],{"type":46,"value":3028}," Report written to ",{"type":41,"tag":141,"props":3030,"children":3032},{"className":3031},[],[3033],{"type":46,"value":2907},{"type":41,"tag":66,"props":3035,"children":3037},{"className":3036},[2939],[3038,3041],{"type":41,"tag":2942,"props":3039,"children":3040},{"disabled":831,"type":2944},[],{"type":46,"value":3042}," New test vectors saved in standard format (Wycheproof JSON)",{"type":41,"tag":204,"props":3044,"children":3045},{},[],{"type":41,"tag":55,"props":3047,"children":3049},{"id":3048},"integration",[3050],{"type":46,"value":3051},"Integration",{"type":41,"tag":214,"props":3053,"children":3054},{},[3055,3071],{"type":41,"tag":218,"props":3056,"children":3057},{},[3058],{"type":41,"tag":222,"props":3059,"children":3060},{},[3061,3066],{"type":41,"tag":226,"props":3062,"children":3063},{},[3064],{"type":46,"value":3065},"Skill",{"type":41,"tag":226,"props":3067,"children":3068},{},[3069],{"type":46,"value":3070},"Relationship",{"type":41,"tag":242,"props":3072,"children":3073},{},[3074,3092,3110,3126],{"type":41,"tag":222,"props":3075,"children":3076},{},[3077,3087],{"type":41,"tag":249,"props":3078,"children":3079},{},[3080,3085],{"type":41,"tag":133,"props":3081,"children":3082},{},[3083],{"type":46,"value":3084},"genotoxic",{"type":46,"value":3086}," (required for Phase 4)",{"type":41,"tag":249,"props":3088,"children":3089},{},[3090],{"type":46,"value":3091},"Provides graph-informed triage — call graph cuts actionable mutants by 30-50%",{"type":41,"tag":222,"props":3093,"children":3094},{},[3095,3105],{"type":41,"tag":249,"props":3096,"children":3097},{},[3098,3103],{"type":41,"tag":133,"props":3099,"children":3100},{},[3101],{"type":46,"value":3102},"mutation-testing",{"type":46,"value":3104}," (mewt\u002Fmuton)",{"type":41,"tag":249,"props":3106,"children":3107},{},[3108],{"type":46,"value":3109},"Use for Solidity; Vector Forge is language-agnostic",{"type":41,"tag":222,"props":3111,"children":3112},{},[3113,3121],{"type":41,"tag":249,"props":3114,"children":3115},{},[3116],{"type":41,"tag":133,"props":3117,"children":3118},{},[3119],{"type":46,"value":3120},"property-based-testing",{"type":41,"tag":249,"props":3122,"children":3123},{},[3124],{"type":46,"value":3125},"Better than hand-crafted vectors for bitwise mutations in field arithmetic",{"type":41,"tag":222,"props":3127,"children":3128},{},[3129,3139],{"type":41,"tag":249,"props":3130,"children":3131},{},[3132,3137],{"type":41,"tag":133,"props":3133,"children":3134},{},[3135],{"type":46,"value":3136},"testing-handbook-skills",{"type":46,"value":3138}," (fuzzing)",{"type":41,"tag":249,"props":3140,"children":3141},{},[3142],{"type":46,"value":3143},"Functions with CC > 10 and surviving mutants need both vectors and fuzz harnesses",{"type":41,"tag":204,"props":3145,"children":3146},{},[],{"type":41,"tag":55,"props":3148,"children":3150},{"id":3149},"supporting-documentation",[3151],{"type":46,"value":3152},"Supporting Documentation",{"type":41,"tag":62,"props":3154,"children":3155},{},[3156,3168,3180,3192,3204],{"type":41,"tag":66,"props":3157,"children":3158},{},[3159,3166],{"type":41,"tag":133,"props":3160,"children":3161},{},[3162],{"type":41,"tag":693,"props":3163,"children":3164},{"href":958},[3165],{"type":46,"value":958},{"type":46,"value":3167}," -\nLanguage-specific mutation testing framework setup",{"type":41,"tag":66,"props":3169,"children":3170},{},[3171,3178],{"type":41,"tag":133,"props":3172,"children":3173},{},[3174],{"type":41,"tag":693,"props":3175,"children":3176},{"href":2417},[3177],{"type":46,"value":2417},{"type":46,"value":3179}," -\nCommon test vector patterns for cryptographic primitives",{"type":41,"tag":66,"props":3181,"children":3182},{},[3183,3190],{"type":41,"tag":133,"props":3184,"children":3185},{},[3186],{"type":41,"tag":693,"props":3187,"children":3188},{"href":2439},[3189],{"type":46,"value":2439},{"type":46,"value":3191}," -\nLimb-width reimplementation for carry, reduction, and overflow faults",{"type":41,"tag":66,"props":3193,"children":3194},{},[3195,3202],{"type":41,"tag":133,"props":3196,"children":3197},{},[3198],{"type":41,"tag":693,"props":3199,"children":3200},{"href":2912},[3201],{"type":46,"value":2912},{"type":46,"value":3203}," -\nFull markdown template for the Vector Forge report",{"type":41,"tag":66,"props":3205,"children":3206},{},[3207,3214],{"type":41,"tag":133,"props":3208,"children":3209},{},[3210],{"type":41,"tag":693,"props":3211,"children":3212},{"href":695},[3213],{"type":46,"value":695},{"type":46,"value":3215}," -\nBLS12-381 case study: FFI kill rates, timeout masking, cross-package\nfalse positives, bitwise mutation gaps, and security-critical priorities",{"type":41,"tag":3217,"props":3218,"children":3219},"style",{},[3220],{"type":46,"value":3221},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3223,"total":3318},[3224,3239,3249,3269,3284,3297,3308],{"slug":3225,"name":3225,"fn":3226,"description":3227,"org":3228,"tags":3229,"stars":23,"repoUrl":24,"updatedAt":3238},"address-sanitizer","detect memory errors during fuzzing","AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C\u002FC++ code to find buffer overflows and use-after-free bugs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3230,3233,3236,3237],{"name":3231,"slug":3232,"type":16},"C#","c",{"name":3234,"slug":3235,"type":16},"Debugging","debugging",{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},"2026-07-17T06:05:14.925095",{"slug":3240,"name":3240,"fn":3241,"description":3242,"org":3243,"tags":3244,"stars":23,"repoUrl":24,"updatedAt":3248},"aflpp","perform multi-core fuzzing of C\u002FC++ projects","AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C\u002FC++ projects.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3245,3246,3247],{"name":3231,"slug":3232,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},"2026-07-17T06:05:12.433192",{"slug":3250,"name":3250,"fn":3251,"description":3252,"org":3253,"tags":3254,"stars":23,"repoUrl":24,"updatedAt":3268},"agentic-actions-auditor","audit GitHub Actions for security vulnerabilities","Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI\u002FCD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI\u002FCD pipeline security for prompt injection risks, or evaluating agentic action configurations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3255,3258,3261,3264,3267],{"name":3256,"slug":3257,"type":16},"Agents","agents",{"name":3259,"slug":3260,"type":16},"CI\u002FCD","ci-cd",{"name":3262,"slug":3263,"type":16},"Code Analysis","code-analysis",{"name":3265,"slug":3266,"type":16},"GitHub Actions","github-actions",{"name":14,"slug":15,"type":16},"2026-07-18T05:47:48.564744",{"slug":3270,"name":3270,"fn":3271,"description":3272,"org":3273,"tags":3274,"stars":23,"repoUrl":24,"updatedAt":3283},"algorand-vulnerability-scanner","scan Algorand smart contracts for vulnerabilities","Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL\u002FPyTeal).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3275,3278,3279,3280],{"name":3276,"slug":3277,"type":16},"Audit","audit",{"name":3262,"slug":3263,"type":16},{"name":14,"slug":15,"type":16},{"name":3281,"slug":3282,"type":16},"Smart Contracts","smart-contracts","2026-07-18T05:47:43.989063",{"slug":3285,"name":3285,"fn":3286,"description":3287,"org":3288,"tags":3289,"stars":23,"repoUrl":24,"updatedAt":3296},"ask-questions-if-underspecified","clarify requirements before implementation","Clarify requirements before implementing. Use when serious doubts arise.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3290,3293],{"name":3291,"slug":3292,"type":16},"Engineering","engineering",{"name":3294,"slug":3295,"type":16},"Productivity","productivity","2026-07-17T06:05:33.543262",{"slug":3298,"name":3298,"fn":3299,"description":3300,"org":3301,"tags":3302,"stars":23,"repoUrl":24,"updatedAt":3307},"atheris","fuzz Python code with Atheris","Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3303,3305,3306],{"name":1041,"slug":3304,"type":16},"python",{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},"2026-07-17T06:05:14.575191",{"slug":3309,"name":3309,"fn":3310,"description":3311,"org":3312,"tags":3313,"stars":23,"repoUrl":24,"updatedAt":3317},"audit-augmentation","augment code graphs with audit findings","Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3314,3315,3316],{"name":3276,"slug":3277,"type":16},{"name":3262,"slug":3263,"type":16},{"name":14,"slug":15,"type":16},"2026-08-01T05:44:54.920542",77,{"items":3320,"total":3424},[3321,3328,3334,3342,3349,3354,3360,3366,3379,3390,3402,3413],{"slug":3225,"name":3225,"fn":3226,"description":3227,"org":3322,"tags":3323,"stars":23,"repoUrl":24,"updatedAt":3238},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3324,3325,3326,3327],{"name":3231,"slug":3232,"type":16},{"name":3234,"slug":3235,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":3240,"name":3240,"fn":3241,"description":3242,"org":3329,"tags":3330,"stars":23,"repoUrl":24,"updatedAt":3248},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3331,3332,3333],{"name":3231,"slug":3232,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":3250,"name":3250,"fn":3251,"description":3252,"org":3335,"tags":3336,"stars":23,"repoUrl":24,"updatedAt":3268},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3337,3338,3339,3340,3341],{"name":3256,"slug":3257,"type":16},{"name":3259,"slug":3260,"type":16},{"name":3262,"slug":3263,"type":16},{"name":3265,"slug":3266,"type":16},{"name":14,"slug":15,"type":16},{"slug":3270,"name":3270,"fn":3271,"description":3272,"org":3343,"tags":3344,"stars":23,"repoUrl":24,"updatedAt":3283},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3345,3346,3347,3348],{"name":3276,"slug":3277,"type":16},{"name":3262,"slug":3263,"type":16},{"name":14,"slug":15,"type":16},{"name":3281,"slug":3282,"type":16},{"slug":3285,"name":3285,"fn":3286,"description":3287,"org":3350,"tags":3351,"stars":23,"repoUrl":24,"updatedAt":3296},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3352,3353],{"name":3291,"slug":3292,"type":16},{"name":3294,"slug":3295,"type":16},{"slug":3298,"name":3298,"fn":3299,"description":3300,"org":3355,"tags":3356,"stars":23,"repoUrl":24,"updatedAt":3307},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3357,3358,3359],{"name":1041,"slug":3304,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":3309,"name":3309,"fn":3310,"description":3311,"org":3361,"tags":3362,"stars":23,"repoUrl":24,"updatedAt":3317},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3363,3364,3365],{"name":3276,"slug":3277,"type":16},{"name":3262,"slug":3263,"type":16},{"name":14,"slug":15,"type":16},{"slug":3367,"name":3367,"fn":3368,"description":3369,"org":3370,"tags":3371,"stars":23,"repoUrl":24,"updatedAt":3378},"audit-context-building","build architectural context for code analysis","Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3372,3375,3376,3377],{"name":3373,"slug":3374,"type":16},"Architecture","architecture",{"name":3276,"slug":3277,"type":16},{"name":3262,"slug":3263,"type":16},{"name":3291,"slug":3292,"type":16},"2026-07-18T05:47:40.122449",{"slug":3380,"name":3380,"fn":3381,"description":3382,"org":3383,"tags":3384,"stars":23,"repoUrl":24,"updatedAt":3389},"audit-prep-assistant","prepare codebases for security audits","Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3385,3386,3387,3388],{"name":3276,"slug":3277,"type":16},{"name":3262,"slug":3263,"type":16},{"name":3291,"slug":3292,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:47:39.210985",{"slug":3391,"name":3391,"fn":3392,"description":3393,"org":3394,"tags":3395,"stars":23,"repoUrl":24,"updatedAt":3401},"burpsuite-project-parser","parse Burp Suite project files","Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3396,3397,3400],{"name":3276,"slug":3277,"type":16},{"name":3398,"slug":3399,"type":16},"CLI","cli",{"name":14,"slug":15,"type":16},"2026-07-17T06:05:33.198077",{"slug":3403,"name":3403,"fn":3404,"description":3405,"org":3406,"tags":3407,"stars":23,"repoUrl":24,"updatedAt":3412},"c-review","audit C and C++ code","Performs comprehensive C\u002FC++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C\u002FC++ applications, reviewing daemons or services for memory safety, or hunting integer overflow \u002F use-after-free \u002F race conditions in userspace code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3408,3409,3410,3411],{"name":3276,"slug":3277,"type":16},{"name":3231,"slug":3232,"type":16},{"name":3262,"slug":3263,"type":16},{"name":14,"slug":15,"type":16},"2026-07-17T06:05:11.333374",{"slug":3414,"name":3414,"fn":3415,"description":3416,"org":3417,"tags":3418,"stars":23,"repoUrl":24,"updatedAt":3423},"cairo-vulnerability-scanner","scan Cairo and StarkNet contracts for vulnerabilities","Scans Cairo\u002FStarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3419,3420,3421,3422],{"name":3276,"slug":3277,"type":16},{"name":3262,"slug":3263,"type":16},{"name":14,"slug":15,"type":16},{"name":3281,"slug":3282,"type":16},"2026-07-18T05:47:42.84568",111]