Mutation Testing Driver

# Mutation Testing — `src/lib/watermark.ts` and `src/lib/zip-builder.ts`

**Tool:** Stryker Mutator 9.0
**Language:** TypeScript
**Scope:** 2 files, 187 lines
**Run time:** 4 minutes 12 seconds

<div data-callout="caution" data-label="Result">

Mutation score **72%** — below the **80% bar** for security-adjacent code. Of 144 mutants generated, 104 killed, 40 survived. Line coverage on the same files reads 96% — confirming the gap mutation testing exists to find: tests run the code but do not assert enough about what it produces. Eight surviving mutants are in **watermark signature verification** logic, which is the highest-leverage path to fix.

</div>

<div data-metric="caution" data-value="72%" data-direction="up">

Kill rate against 144 generated mutants. Target 80% before merging to `main`. The watermark verification path drives most of the survival rate — 8 mutants in a 40-line function.

</div>

<div data-stack data-stack-title="By module">
<div data-row data-value="65%">`watermark.ts` — 8 surviving mutants in signature verification</div>
<div data-row data-value="78%">`zip-builder.ts` — 12 surviving mutants, mostly in path-normalization edge cases</div>
<div data-row data-value="92%">`watermark.ts` — buyer-info injection path (acceptable)</div>
<div data-row data-value="88%">`zip-builder.ts` — frontmatter gate (acceptable)</div>
</div>

---

## Surviving mutants — prioritized

| # | Location | Mutation | Why it survived | Severity |
|---|---|---|---|---|
| 1 | `watermark.ts:42` | `!==` → `===` in HMAC comparison | No test asserts the negative path (invalid signature must reject) | <span data-pill="critical">critical</span> |
| 2 | `watermark.ts:48` | `timingSafeEqual` → `===` | No test exercises the constant-time path | <span data-pill="critical">critical</span> |
| 3 | `watermark.ts:51` | Boundary: `>` → `>=` on expiry check | No test exercises the off-by-one boundary | <span data-pill="critical">critical</span> |
| 4 | `watermark.ts:55` | Removed `return null` on invalid input | Tests never pass invalid input | <span data-pill="caution">high</span> |
| 5 | `zip-builder.ts:78` | `startsWith('/')` → `startsWith('')` | No test asserts on absolute-path rejection | <span data-pill="caution">high</span> |
| 6 | `zip-builder.ts:91` | `.includes('..')` → `false` | No test asserts on path traversal rejection | <span data-pill="caution">high</span> |
| 7 | `zip-builder.ts:103` | Conditional negated | Branch reached but result not asserted on | <span data-pill="caution">medium</span> |
| 8 | … 33 more | misc | various — see report | <span data-pill="info">low/med</span> |

---

<div data-callout="critical" data-label="Mutants 1–3 — security implication">

These three surviving mutants in `watermark.ts` mean the test suite **does not actually verify that signature checking works**. The current tests prove the function *runs*, not that it *rejects bad input*. If a future change accidentally inverts the comparison or removes the constant-time check, no test will fail. Add assertions for: (a) invalid HMAC rejects with `null`, (b) expired token rejects, (c) tampered payload rejects, (d) constant-time comparison is in fact constant-time (timing variance test).

</div>

<div data-callout="caution" data-label="Mutants 5–6 — path traversal">

`zip-builder.ts` has no test for the path-traversal guard. The function is fed user-controlled names from skill specs; if the `.includes('..')` check is ever removed or weakened, traversal becomes possible. Add a fixture skill spec with `../` in a filename and assert the build rejects it.

</div>

<div data-callout="info" data-label="Acceptable survivals">

Of the 40 survivors, ~22 are equivalent mutants (the mutation produces semantically identical behavior — logging order, redundant null checks). Mark these in `stryker.conf.json` under `ignoreStatic` so the score isn't penalized in future runs. After that adjustment, the **effective** score is ~85%.

</div>

*Mutation testing is a quality signal, not a coverage replacement. Re-run nightly on the security-critical paths; a survival-rate regression in those modules should block release.*

This sample illustrates the skill's output format. Names, metrics, and operational details are illustrative unless the artifact explicitly analyzes public information.