Risk-based testing
Tests protect contracts and risks, not raw counts. P0 blocks release; P1 protects important behavior; P2 samples boundaries and failure modes.
Decision rubric
Keep a test when it uses the lowest useful layer, asserts an observable contract, models a realistic regression, has one unique canonical owner, is deterministic, and has a justified runtime cost. Move or rewrite it when any check fails.
Tiers: P0 covers release-blocking data, safety, and protocol invariants; P1 covers important user-facing behavior and failure handling; P2 covers representative boundaries and unusual inputs; diagnostic tests measure performance without claiming correctness.
Applied inventory
| Sampled area | Risk | Classification | Canonical owner | Decision |
|---|---|---|---|---|
| Picker helper | Clamp/scroll arguments could be ignored | misleading | src/tui/state/tests/pickers.rs | rewrite; keep helper and state coverage distinct |
| Modal secret test | Fixture had no secret; preview redaction could regress unnoticed | tautological | src/tui/sessions/commands.rs test | rewrite; canonical preview redaction owner |
| Title waits | Busy yield and speed ceilings are scheduler-dependent | timing-sensitive | src/agent/tests/titles_herdr.rs | rewrite with completion channels and bounded deadlock guard |
| Filesystem cache | Directory mtime and zero elapsed are platform/timing races | timing-sensitive | src/tools/fs_cache.rs | rewrite with private keys and aged entries |
| CLI hook cleanup | Immediate marker absence does not prove descendant cleanup | tautological | tests/cli_smoke.rs | rewrite with PID publication and ESRCH |
| ast-grep timeout | 30-second test is costly and obscures timeout contract | timing-sensitive | src/tools/ast_grep.rs | rewrite with test-only short context timeout; production remains 30s |
| Auth concurrency duplicate | Same duplicate contract existed in facade and auth module | duplicate contract | src/config/auth.rs | consolidate; retain lower-level canonical test |
| Settings unknown fields | Parser rejection and facade wiring are distinct risks | unique contracts | src/config/settings.rs, src/config/mod.rs | keep both; distinct owners |
| Resume/continue integration | Resume identity and continue selection are separate CLI contracts | unique contracts | tests/cli_smoke.rs | keep both |
| Responsiveness timing gate | Draw latency is a performance diagnostic, not a general correctness claim | benchmark/diagnostic | TUI render tests | keep as explicit timing gate |
| SSE partitions | Chunk boundaries must not change complete events or metadata | P2 boundary | src/mcp/sse.rs | keep oracle comparison including finish() |
| Append durability | Write, flush, sync, and rollback failures affect durable state | P0 fault injection | src/sessions/write.rs | keep one table-driven stage matrix plus distinct happy path |
| Unicode editor | Grapheme-safe mutation must preserve valid UTF-8 cursor boundaries | P2 boundary | src/tui/prompt_editor/tests.rs | representative mutation coverage is now kept; broader operations are follow-up |
P2 claims are limited to these representative samples; they do not claim exhaustive platform, Unicode, PTY, or fault-matrix coverage.
Direct helper redaction assertions live under src/output/redaction.rs, and session duplicate coverage lives in src/sessions/write.rs. The metadata failure case explicitly asserts SessionAppendOutcome::DurableJsonlMetadataUpdateFailed while checking readable JSONL and the metadata path's directory boundary.
Local checks
Run focused checks while working, then the full suite before merging:
cargo test --locked --lib agent::
cargo test --locked --lib providers::
cargo test --locked --lib tools::
cargo test --locked --lib tui::
cargo test --locked --lib mcp::
cargo test --locked --lib config::
cargo test --locked --lib sessions::
cargo test --locked --lib context::
cargo test --locked --bin magi-code
cargo test --locked --test foundation
cargo test --locked --test cli_smoke
cargo test --locked --doc
cargo test --locked --quietCI checks public Rust API compatibility with cargo semver-checks against the pull request's base branch. New public exports need an intended external use, covered by tests/foundation.rs or equivalent evidence.
Test health and CI
cargo test --quiet is the canonical full-suite command. CI runs root library, binary, foundation, CLI smoke, and doctest partitions in named failure-isolated steps. Each step appends one TSV row with status, duration, run id, attempt, and SHA; the combined per-attempt artifact is named test-health-${{ github.run_attempt }}, so failed workflow reruns remain available for flake comparison. Artifacts across run history expose these fields for later analysis, but the workflow does not create an automatic historical graph. A flake means fail then pass on an explicit workflow rerun; there are no automatic retries.
Maintenance rules
Keep unique P0/P1 contracts and representative P2 boundaries. Rewrite misleading tests, consolidate obvious duplicates, use bounded deterministic signals instead of sleeps/yields, and label diagnostics honestly.