{
  "schema": "vedokrok.public-item.v1",
  "release_id": "MHC-RPUB-20260920-75ad787a",
  "url": "/knowledge/review-test-changes-independently-from-the-code-they-excuse",
  "id": "MHC-D-RESEARCH-0658",
  "version": "0.1.0",
  "title": "Review test changes independently from the code they excuse",
  "summary": "Green can mean the test moved, not the bug.",
  "kind": "protocol",
  "body": "Inspect deleted tests, weaker assertions, new mocks and changed fixtures separately from implementation logic. Ask whether each test still checks the intended behavior. For important invariants, preserve at least one independently authored or reviewed test that the implementation agent did not redefine.",
  "limits": [
    "Human-written tests can also be poor; independence reduces correlated failure but does not guarantee correctness."
  ],
  "topics": [
    "union-ai-assisted-coding-safeguards"
  ],
  "intents": [],
  "source_ids": [
    "RS-1C68AE8325C384C0"
  ],
  "evidence": [
    {
      "claim": "OWASP recommends independent scrutiny of AI-generated test changes because an agent can make a suite pass by weakening, deleting or misdirecting tests.",
      "source_id": "RS-1C68AE8325C384C0",
      "role": "supports",
      "note": "This is a threat model and practice recommendation, not evidence that every agent routinely corrupts tests.",
      "locator": "Test Fabrication and Test Deletion"
    }
  ],
  "use_when": [
    "The same agent changes implementation and tests until CI turns green."
  ],
  "avoid_when": [
    "Human-written tests can also be poor; independence reduces correlated failure but does not guarantee correctness."
  ],
  "example": "An agent replaces an exact authorization result with 'not null'; the test diff is rejected even though CI is green.",
  "check": "A passing suite still exercises the intended contract rather than the agent's preferred implementation.",
  "steps": [
    "Deleted tests justified.",
    "Assertions not weakened silently.",
    "Mocks do not remove the behavior under test.",
    "Old regression intent preserved.",
    "Critical invariant has independent review."
  ],
  "sources": [
    {
      "id": "RS-1C68AE8325C384C0",
      "title": "Secure Coding with AI Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Secure_Coding_with_AI_Cheat_Sheet.html"
    }
  ],
  "relations": [
    {
      "from": "MHC-D-RESEARCH-0658",
      "to": "MHC-D-RESEARCH-0659",
      "type": "use_before",
      "url": "/knowledge/add-one-adversarial-case-the-coding-agent-did-not-propose"
    }
  ],
  "collections": [
    {
      "id": "RC-E25DB1788236EF13",
      "title": "Let coding agents move fast inside a reviewable security boundary",
      "url": "/collections/let-coding-agents-move-fast-inside-a-reviewable-security-boundary"
    }
  ]
}