fix(policy): exempt the release-trigger gate, whose mutation cannot be driven

[wenzowski]

DO-NOT-CLOSE — this completes no row on its own. CLOUD-1777's work landed in #939, which closed it; this is a correction to what that PR landed, and CLOUD-843 is named only as the reason a route was unavailable.

A follow-up to #939, which is merged — a merged pull request cannot track new work.

What landed wrong

#939 added policy/release-trigger-independent.rego with a #MUTANT row and a matching entry in MUTANT_GATES. mutate census accepts that pairing, so it passed the landing-path gate. The mutation can never run.

Measured with the runner rather than reasoned about:

release-trigger-independent no-suite (tests/release-trigger-independent.bats)
::error:: mutate sweep: 175 declared mutation(s) could not be looked at —
          an unresolvable gate or suite is not a pass

mutate resolves a gate's suite as tests/$gate.bats, and shell add refused forbids adding one (CLOUD-843 replaces shell gates rather than growing them). no-suite is could-not-look, not a pass — so the registration was a coverage claim with nothing behind it, in the file whose own subject is a gate that decides nothing.

That is the same defect the admission on the original commit said it was avoiding, one level up. I declared the #MUTANT row, ran the sweep, and the sweep refuted it.

The fix

policy/connector-not-granted.rego already carries a #MUTANT-EXEMPT for exactly this situation with exactly this reason. This follows that precedent, and records that the #MUTANT row was tried first so the next reader does not re-derive it.

What still covers the module is unchanged and named in the exemption:

• Load-time tier — the module's own six test_ rules: committed shape clean, a trunk push clean, a clock alone refused, the release event alone refused, a non-watching workflow untouched, no workflow answers nothing.
• Engine tier — batten-check over this repository's committed workflow, exit 0. This is the tier a with input as case cannot reach, because it fabricates the very shape the engine may be unable to produce (here: whether on: survives as a string key rather than YAML 1.1's boolean true).

Verification

• mise run mutant-census: 140 gates, every one enforced or exempt by a filed row

Not claimed

The 175 could-not-look mutations are a tree-wide property, not this module's: every rego and engine gate in the censused set reports names-no-case or no-suite under mutate sweep, which is why the sweep is off the landing path while the census is on it. Whether that gap is worth closing is its own row, not a question this diff answers.

---

https://claude.ai/code/session_01Ef4sxymkMdNUktBXVg19LZ

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 0e14282c-e22b-456d-861f-d25b15226dc9

📥 Commits

Reviewing files that changed from the base of the PR and between 2a42e1b and 8b61926.

📒 Files selected for processing (2)

• mise.toml
• policy/release-trigger-independent.rego

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change removes release-trigger-independent from MUTANT_GATES in mise.toml. It replaces the policy’s #MUTANT comment with a #MUTANT-EXEMPT CLOUD-1260 comment. The comment documents that no dedicated Bats suite exists or may be added because the mutation runner resolves suites by gate name and reports no-suite.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 8b619

This change only exempts an unrunnable mutation gate while retaining the existing load-time and engine-tier coverage, so no merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: exempting the release-trigger gate because its mutation cannot be driven.
Description check	✅ Passed	The description directly explains the incorrect mutation declaration, the no-suite result, the exemption-based fix, and the verification results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/cloud-1777-mutation-exempt

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[wenzowski]

/fast-forward