genotoxic

Graph-informed mutation testing triage that combines mutation testing and necessist (test statement removal) with code graph analysis to sort findings into actionable categories: corroborated findings, false positives, missing unit tests, and fuzzing targets. It parses a codebase with Trailmark, runs a mutation testing framework and optionally necessist, then uses survived mutants, unnecessary test statements, and call graph data to identify false positives, missing coverage, and fuzzing targets. It is intended for triaging survived mutants and analyzing mutation results, and not for codebases with no existing test suite, pure documentation or configuration changes, or single-file scripts with trivial logic.

The workflow has three main phases plus an optional parallel phase. Phase 1 builds the code graph with `trailmark analyze` and runs pre-analysis via the QueryEngine API, which is mandatory before triage and computes blast radius, entry points, privilege boundaries, and taint propagation. Phase 2 runs the appropriate mutation framework and captures survived mutants with their file path, line number, mutation type, and status, filtering to survived mutants only. Phase 2b optionally runs necessist on supported languages (Go, Rust, Solidity/Foundry, TypeScript/Hardhat, TypeScript/Vitest, and Rust/Anchor) to find unnecessary test statements, keeping findings where the test still passed after removal. Phase 3 triages each survived mutant and each necessist removal into a bucket using graph data, mapping necessist removals to a production function first.

Prerequisites include trailmark (installed via `uv pip install trailmark`), a mutation testing framework for the target language, optionally necessist (installed with `cargo install necessist`), and an existing passing test suite; on macOS the skill notes running `ulimit -n 1024` before any mull-runner invocation because newer macOS defaults can crash Mull's subprocess spawning. A recurring principle is to install and run the real tools rather than falling back to manual analysis. Quick classification heuristics mark mutants with no callers, only test callers, logging or display strings, or equivalent behavior as false positives, while findings flagged by both mutation testing and necessist on the same function are corroborated and treated as the highest-value results.