Does it work with my AI coding agent?

That's the point. Refactron verifies a diff whoever authored it: Cursor, Claude Code, Copilot, Codex, a codemod, or you. The MCP server ships today, so your agent can call verify_change on its own work before it lands.

What does UNPROVEN mean?

Your tests pass, but the changed lines aren't actually exercised by any test, so “green” proves nothing. We say so explicitly and list the tests to add, instead of hand-waving.

Does my code leave my machine?

No. Refactron runs locally against your real test suite in an isolated shadow tree. Nothing is sent to an external service to make the verdict.

How is this different from just running my tests in CI?

CI tells you the suite went green. It does not tell you whether a single test executed the lines you changed. Refactron checks that after the suite runs, and returns UNPROVEN when the answer is no, so a green run on untested code stops reading as proof.

What ships today vs. what's coming?

Shipping today: the CLI (npm install -g refactron) and the MCP server, which exposes one tool, verify_change. Changed-line coverage is proved on Python today; a TypeScript diff runs every gate and caps at UNPROVEN. In early access: the hosted CI gate. Verification needs a token, so join early access to get one.

All releases

Sep 1, 2026 · v0.4.5

The Branch No Test Took

The coverage rule was statement-level, so a changed if counted as covered the moment its header executed. A conditional whose one branch no test entered earned SAFE with the changed behaviour untested. SAFE now requires that changed conditionals were fully branched, and --mutate arrives to ask whether anything asserted on the change at all.

Om Sherikar

The coverage rule was statement-level: a changed if or elif counted as covered the moment its header executed. So a change to a conditional whose one branch no test entered earned SAFE with the changed behaviour untested. A changed conditional is one of the most common regression shapes, and it is exactly where statement coverage is weakest.

SAFE now also requires that changed conditionals were fully branched. With coverage.py --branch, a changed line reported as a partially-taken branch floors the verdict at UNPROVEN, and the reason names it.

text[UNPROVEN] Tests pass, but a changed conditional has a branch no test took
(calc.py:3). Add a test that enters the other branch.

The decision was made on measurement rather than assertion (ADR-14). --branch added no runtime cost on a real 600-test suite. The flip is surgical: it bites only a changed conditional with an untaken arc, never straight-line code, which is 0% affected, and never a fully-exercised conditional. It cannot make SAFE unreachable for ordinary changes.

--mutate, an opt-in check for whether the change was asserted

Coverage proves a changed statement ran. It does not prove that any test would fail if its behaviour changed. A line a test executes but never asserts on earns SAFE.

refactron verify-diff --mutate perturbs the operators in the changed statements, boundary, arithmetic and boolean, reruns the suite against each, and floors the verdict at UNPROVEN if any mutant survives, naming the survivor.

text[UNPROVEN] Tests pass, but a mutant of a changed statement survived
(calc.py:2, + to -): no test failed when its behaviour changed.

Off by default and slower, since it reruns the suite once per mutant, so it is a deep check rather than the fast gate. Downgrade-only: a survivor can move SAFE to UNPROVEN and never the reverse, a clean run never lifts a verdict, and an inconclusive mutant that times out is skipped. Bounded to the changed statements and Python-only (ADR-15).