test(mutation): take auth manager.py off the mutation threshold line

[brownjuly2003-code]

Summary

Builds on #256 (fix/auth-rate-windows-and-key-identity). The base is main, so this PR also carries #256's six commits; its own three start after 6231b73. Merge #256 first, and this diff shrinks to those three.

Takes serving/api/auth/manager.py off the mutation threshold line and raises the threshold to match.

• Before: on 6231b73, CI run 34464697021 scored it 82.1% (430 killed of 524), against a 0.80 threshold.

• After: on this branch it scores 98.4% and gates at 0.90.

• test(mutation) — the survivors. tests/unit/test_auth_manager_mutation.py is the only file the mutation gate runs against the module. It now pins what the 94 survivors changed:

  • the key-store writability probe, including a read-only file;
  • the construction wiring: the injected store and audit publisher, usage rows through the real UsageWriter, the default store following db_path, the security config path, the grace-period fallback and its warning, and the Redis server the limiter targets;
  • the load() log events;
  • what load() writes back, and the key file it leaves byte-for-byte alone;
  • that a match's slot comes from the material that matched;
  • that rate-limit windows carry over by bucket;
  • authenticate() scan order;
  • when check_rate_limit() trusts Redis;
  • AGENTFLOW_API_KEYS parsing.

• Two simplifications remove mutants no test could kill:

  • the probe opens the key file in binary append mode;
  • _legacy_env_keys() no longer passes allowed_entity_types=None.

• The residue is named. Nine equivalents are listed with their reasons in the test file's docstring. A line-level pragma would also silence killable mutants on the same lines, so none is used. Two survivors lower-case an os.getenv name, so they survive only on Windows.

• Stale comments. Two test comments that still described the pre-fix(auth): keep rate-limit windows across reloads, and give id-less keys a stable id #256 behaviour are corrected. Only the words change.

• fix(mutation) — local verdicts mean something again. scripts/mutation_local.py gave each mutant a --basetemp inside a scratch directory it never created. pytest creates --basetemp without its parents, so the first tmp_path fixture errored at setup and the mutant was scored killed, equivalents included. run_mutant() now creates the parent first. Two tests run it on a real one-test file with the parent missing: a passing tmp_path test is scored survived, and a failing one is still killed.

• test(mutation) — the threshold follows the measurement. manager.py now gates at 0.90, up from 0.80.

  • The comment above its ModuleTarget in scripts/mutation_report.py no longer calls the logging and Redis-URL survivors equivalents. It now gives the measured score and names the nine equivalents that are left, grouped by function.
  • The [tool.mutmut] comment in pyproject.toml no longer repeats "an honest 0.80"; it points to that file instead.

Verification

• The full unit gate, lint, format, mypy and contracts pass on all three committed trees.
• The first full gate was red, and that was a real catch. Dropping rate_limit_rpm=DEFAULT_RATE_LIMIT_RPM from _legacy_env_keys() was not equivalent. TenantKey's field default is fixed at import, while the call reads the module global at load time. test_auth_key_identity.py depends on that load-time read. The argument is restored, and a test in the gate file now pins the read.
• Local mutant verdicts for the survivors: 77 of 94 killed and 6 removed by the simplifications. They came from a scratch runner, because scripts/mutation_local.py had the false-kill bug the fix(mutation) commit removes. With the fix, a run of three named equivalents and three killable mutants through the script agrees with CI: the three equivalents survive and the other three are killed.
• Mutation workflow on this branch: run 34542418689, on 77825f6. manager.py scores 98.4% (553 killed of 562), up from 82.1% (430 of 524). The 9 survivors are exactly the 9 equivalents named in the docstring. The three survivors that stayed alive locally only because of Windows (case-insensitive environment names) were killed on the Linux runner. Every module meets its threshold.
• Mutation workflow on the threshold commit: run 34550745164, on dc911d3: every module meets its threshold. manager.py holds 98.4% (553 killed of 562) against the new 0.90 threshold, and every other module is unchanged.
• PR checks on dc911d3: 28 pass, 4 skip.

Review

• test(mutation): written by opus-high, because grok's account had run out of its free usage; grok, on its second account, wrote the repair for the red gate. Reviewed by codex, with no findings. The controller skipped the review of the repair delta, so the orchestrator reviewed that delta and recorded the skip as a contour defect.
• fix(mutation): written by grok on its second account. Reviewed by codex, with no findings and no comments, so the orchestrator also read the diff.
• test(mutation), the threshold: written by grok on its second account. codex hung for 38 minutes with no output and was cancelled, so opus-cli reviewed it.
  • Pass 1 found four problems, and one repair fixed them:
    • a CHANGELOG sentence contradicted the comment it described;
    • the pyproject.toml comment was stale;
    • two named survivors were listed out of source order;
    • one phrase was garbled.
  • Pass 2 confirmed the fixes and flagged a hard-to-read sentence. A second repair split it.
  • Pass 3 found the rewrite correct. It left one advisory note: the entry names T-48, an internal task id that no other CHANGELOG entry carries. The id stays, because removing it would have needed a pass beyond the review limit.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UUTW71FTTNxbF8JAKwv3Am

[github-actions]

DORA Metrics

• Window: last 30 days
• Branch: main
• Deployment frequency: 19 total / 4.43 per week
• Lead time for changes: avg 0.71h / median 0.0h
• Change failure rate: 68.42% (13/19)
• MTTR: 79.52h across 11 incident(s)