[MohammadThabetHassan]

The instrument behind the coverage-matrix finding, made reproducible.

What it does

A policy over a finite label domain induces a finite partition of its subject space — the twelve trust x action cells. A mutant is fully described by the decision it returns for each cell, so two mutants that agree on every cell are equivalent by construction. Equivalence is decided, not estimated, which is the usual obstacle to mutation-testing access-control policies.

Measured on the shipped policy

38 single-edit mutants, 16 provably equivalent (42.1%), 22 observable.

Suite	Cases	Cells	Killed	Score	Missing decision
default-scenarios.json	5	5/12	14/22	63.6%	none
adversarial-scenarios.json	25	3/12	8/22	36.4%	allow
coverage-matrix-scenarios.json	12	12/12	22/22	100.0%	none

The five-case suite catches nearly twice what the twenty-five-case suite does. Case count is not coverage, and the last column says why.

The sharpest instance: changing default_decision from deny to allow — a policy that permits everything not explicitly denied — passes the adversarial suite 25/25, and is caught by the five-case suite. That is the dangerous direction, and the OWASP/ATLAS-mapped suite is blind to it.

One test I had to weaken

I first asserted that every adversarial-suite survivor loosens the permitted set. It failed on widen_trust[TW-002+trusted], which moves a cell from deny to require_approval without changing what is allowed.

It now asserts what actually holds: a survivor differs from the reference only on cells the suite never witnesses. The reference satisfies every expectation, so a change to a witnessed cell would break one — detection power is bounded by cell coverage, not case count. That is the provable claim, and it is stronger than the one I started with.

ruff, mypy, reality_check and the full suite pass; coverage 95.09%.