Corund vs mutation testing

A whole-suite score vs one decisive case

Mutation testing tools seed synthetic mutants across a codebase -- small, mechanical edits like flipping a comparison or dropping a line -- and report the fraction the suite catches. That measures something real: how strong the suite is, in general, against the kinds of bugs a mutant generator knows how to make. Two named examples: mutant (Ruby -- "AI writes your code. AI writes your tests. But who tests the tests?"), free for open-source use, commercial license $30/developer/month or $250/developer/year; and Arcmutate (Java/Kotlin/Android, built on PIT -- "Enterprise Mutation Testing"), whose own price list is not public (see the source note below).

Corund's C1 red-on-revert does something narrower and more specific to the PR in front of you. It reverts this PR's actual fix -- not a synthetic stand-in for a bug, the real one the PR claims to have fixed -- and requires the PR's new or changed tests to fail against the unfixed code. Then it restores the fix and requires them to pass. One decisive mutant, the original code, in seconds: not a sampled score across many synthetic mutants, a direct answer to the one question that matters for this diff -- does this test detect this bug.

Plus three checks mutation testing doesn't touch

A suite-strength score says nothing about whether the tests behind it can even be trusted to gate a merge. Corund's other three checks close that gap:

• C2 skip-audit -- a silent test skip becomes a CI failure unless it is named on a loud-skip allowlist with a reason. A suite score computed over tests that were quietly skipped is a score over nothing.
• C3 gate-fold -- every changed test file must be tracked in git and inside the branch-protection required path. A test that exists but doesn't gate is a report, not a case, no matter how strong it scores.
• C4 approval-binding -- a human approval is bound to the exact commit SHA it was given for; a new commit voids it. GitHub branch protection can already dismiss stale approvals natively -- C4's addition is binding the approval to the verdict SHA with a receipt and an org policy that says so.

The claim, exactly

Mutation testing tools exist, and the technique is sound for what it measures. This comparison rests on mutant and Arcmutate only -- a third, "diff-scoped mutest," is retracted from this page until a real vendor or repo page is found under that name. The claim here is narrower: no CI product enforces red-on-revert plus skip-audit plus gate-fold plus approval-binding together, at merge time. See the fuller version of this position, and how it differs from agent-side verification skills, on the Compare overview.

Sources, fetched 2026-09-05: mutant pricing -- https://github.com/mbj/mutant/blob/main/docs/commercial.md; Arcmutate pricing -- UNMEASURED, both https://www.arcmutate.com/pricing and its trailing-slash variant returned HTTP 404. Full citations: /docs#sources (/marketing/sources.md).