← the record

Audit 0f9d81f3435e

pdbethke/starlette, scoped to starlette, at 8aa828ceaf: the project's own tests caught 32 of 40 planted faults, 8 got through, and corral proved 8 of those missing tests by writing a test and running it.

repo
https://github.com/pdbethke/starlette
scope
starlette (--path: only files under it were considered)
commit
8aa828ceaff764a2e57932fb42fdf105a47c4c83
corral
v1.0.0-rc.29
substrate
jail · container
image
corral-campaign/starlette:1@sha256:11855f76ec8cdffdbe9fb1fec9ff6b2ce3361ccea993bbe75e5c138065a955e7
seats
critic: claude-code:claude-sonnet-5-5 [2.1.311 (Claude Code)]
mutant-generator: claude-code:claude-opus-5-5 [2.1.311 (Claude Code)]
test-writer: codex [codex-cli 0.163.0]
test-writer-shadow: claude-code:claude-opus-5-5 [2.1.311 (Claude Code)]
tokens
579.7k in, 18.9k out, 26 calls
started
2026-10-27 07:59 UTC
not audited
28 ungoaled · 5 ambiguous-test · 1 imported at load time — no test exercises it directly · 1 no-language · 1 uncovered — no test executes this file

starlette/datastructures.py

0.80kill rate, 95% interval 0.65–0.90 (n=40 distinct)
32 of 40caught by the project's tests
8got through
8proven missing tests
language
python
status
certified
the tests corral wrote
from __future__ import annotations
import pytest
from starlette.datastructures import MutableHeaders
from starlette.datastructures import Headers, MutableHeaders
from starlette.datastructures import URL, URLPath
from starlette.datastructures import MultiDict

def test_corral_update_replaces_duplicates_at_first_position() -> None:
    headers = MutableHeaders(
        raw=[
            (b"x-before", b"before"),
            (b"authorization", b"old-first"),
            (b"x-between", b"between"),
            (b"authorization", b"old-second"),
            (b"x-after", b"after"),
        ]
    )

    headers.update({"Authorization": "replacement", "X-New": "new"})

    assert headers["AUTHORIZATION"] == "replacement"
    assert headers.getlist("authorization") == ["replacement"]
    assert headers.raw == [
        (b"x-before", b"before"),
        (b"authorization", b"replacement"),
        (b"x-between", b"between"),
        (b"x-after", b"after"),
        (b"x-new", b"new"),
    ]
    with pytest.raises(KeyError):
        headers["missing-corral-header"]

def test_corral_mutablecopy_does_not_mutate_original_headers() -> None:
    original = Headers(
        raw=[
            (b"x-policy", b"first"),
            (b"x-other", b"keep"),
            (b"x-policy", b"second"),
        ]
    )
    snapshot = original.raw
    copied = original.mutablecopy()

    assert isinstance(copied, MutableHeaders)
    assert copied.raw == snapshot

    copied["X-Policy"] = "replacement"
    del copied["X-Other"]
    copied.append("X-New", "added")

    assert copied.raw == [
        (b"x-policy", b"replacement"),
        (b"x-new", b"added"),
    ]
    assert original.raw == snapshot
    assert original.getlist("X-Policy") == ["first", "second"]
    assert original["X-Other"] == "keep"
    with pytest.raises(KeyError):
        original["X-New"]

def test_corral_delete_header_removes_all_interleaved_duplicates() -> None:
    headers = MutableHeaders(
        raw=[
            (b"x-before", b"keep-before"),
            (b"authorization", b"first-secret"),
            (b"x-between", b"keep-between"),
            (b"authorization", b"second-secret"),
            (b"authorization", b"third-secret"),
            (b"x-after", b"keep-after"),
        ]
    )

    del headers["AuThOrIzAtIoN"]

    assert headers.raw == [
        (b"x-before", b"keep-before"),
        (b"x-between", b"keep-between"),
        (b"x-after", b"keep-after"),
    ]
    assert headers.getlist("AUTHORIZATION") == []
    assert "Authorization" not in headers
    with pytest.raises(KeyError):
        headers["authorization"]

def test_corral_wss_base_preserves_secure_absolute_url_schemes() -> None:
    base = URL("wss://example.org/root/")
    assert base.is_secure is True

    for protocol, expected_scheme in (("http", "https"), ("websocket", "wss")):
        absolute = URLPath("/endpoint", protocol=protocol).make_absolute_url(base)
        assert str(absolute) == f"{expected_scheme}://example.org/root/endpoint"
        assert absolute.is_secure is True

def test_corral_setlist_indexes_last_replacement_value() -> None:
    data = MultiDict([("role", "old"), ("keep", "untouched"), ("role", "stale")])

    data.setlist("role", ["reader", "editor", "admin"])

    assert data["role"] == "admin"
    assert data.getlist("role") == ["reader", "editor", "admin"]
    assert data["keep"] == "untouched"
    assert data.poplist("role") == ["reader", "editor", "admin"]
    with pytest.raises(KeyError):
        data["role"]

def test_corral_ior_preserves_identity_and_updates_existing_alias() -> None:
    headers = MutableHeaders(raw=[
        (b"x-before", b"before"),
        (b"x-token", b"old"),
        (b"x-token", b"duplicate"),
        (b"x-after", b"after"),
    ])
    alias = headers

    headers |= {"X-Token": "replacement", "X-New": "new"}

    assert headers is alias
    assert alias.raw == [
        (b"x-before", b"before"),
        (b"x-token", b"replacement"),
        (b"x-after", b"after"),
        (b"x-new", b"new"),
    ]

    with pytest.raises(TypeError):
        headers |= [("X-Token", "invalid")]

    assert headers is alias
    assert alias["X-Token"] == "replacement"

def test_corral_setdefault_returns_existing_header_value() -> None:
    headers = MutableHeaders({"X-Token": "existing-secret"})

    assert headers.setdefault("x-ToKeN", "replacement-secret") == "existing-secret"
    assert headers.getlist("X-TOKEN") == ["existing-secret"]
    assert headers.setdefault("X-New", "new-value") == "new-value"
    assert headers["x-new"] == "new-value"

def test_corral_union_preserves_original_and_has_independent_storage() -> None:
    original = MutableHeaders(
        raw=[
            (b"x-before", b"first"),
            (b"x-token", b"old"),
            (b"x-token", b"duplicate"),
            (b"x-after", b"last"),
        ]
    )
    snapshot = list(original.raw)

    merged = original | {"X-Token": "replacement", "X-New": "added"}

    assert isinstance(merged, MutableHeaders)
    assert merged is not original
    assert original.raw == snapshot
    assert merged.raw == [
        (b"x-before", b"first"),
        (b"x-token", b"replacement"),
        (b"x-after", b"last"),
        (b"x-new", b"added"),
    ]

    merged["X-Before"] = "changed"
    merged.append("X-Token", "another")
    assert original.raw == snapshot

    original["X-After"] = "original-only"
    assert merged["X-After"] == "last"

    with pytest.raises(TypeError):
        original | [("X-Token", "invalid")]

    assert original.getlist("X-Token") == ["old", "duplicate"]

The faults that got through

A proven fault was caught by a test corral wrote and ran; an unproven one was not, so it may be a missing test or a fault no test can see.

s5/m3 · line 118 proven

- return self.scheme in ("https", "wss")
+ return self.scheme in ("https",)

s5/m5 · line 376 proven

- self._dict[key] = values[-1]
+ self._dict[key] = values[0]

s3/m5 · line 558 proven

- return MutableHeaders(raw=self._list[:])
+ return MutableHeaders(raw=self._list)

s5/m1 · line 627 proven

- for idx in reversed(pop_indexes):
+ for idx in reversed(pop_indexes[:1]):

s6/m2 · line 631 proven

- self.update(other)
- return self
+ new = MutableHeaders(raw=list(self.raw))
+ new.update(other)
+ return new

s7/m5 · line 639 proven

- new = self.mutablecopy()
+ new = self

s7/m3 · line 656 proven

- return item_value.decode("latin-1")
+ return value

s3/m4 · line 661 proven

- self[key] = val
+ self.append(key, val)