[
 {
  "module": "tests.conformance.test_bazel_read_only_cache",
  "category": "E2E",
  "tests_before": 1,
  "kept_tests": 1,
  "location": "tests.conformance.test_bazel_read_only_cache",
  "protects": "Real Bazel cold/warm build proves a READ_ONLY shared disk cache yields cache hits and identical output while leaving shared cache bytes and mtimes untouched."
 },
 {
  "module": "tests.conformance.test_compiler_cache",
  "category": "E2E",
  "tests_before": 5,
  "kept_tests": 3,
  "location": "tests.conformance.test_compiler_cache",
  "protects": "Real sccache sessions: cold/warm C compile yields identical objects with cache hits, READ_ONLY compiler cache is not mutated, and an exception inside the session kills the owned server and removes private config."
 },
 {
  "module": "tests.conformance.test_durable_split_service_portfolio",
  "category": "SMOKE",
  "tests_before": 16,
  "kept_tests": 2,
  "location": "tests.conformance.test_durable_split_service_portfolio",
  "protects": "Real lock resolution of the durable-split-service sample yields the exact four-role/two-root union and every locked node prepares under the Standard project service."
 },
 {
  "module": "tests.conformance.test_inverse_regenerative_parity",
  "category": "E2E",
  "tests_before": 4,
  "kept_tests": 2,
  "location": "tests.conformance.test_inverse_regenerative_parity",
  "protects": "Source-to-specification then clean regeneration produces programs whose real runtime output matches the original (behavioral parity)."
 },
 {
  "module": "tests.conformance.test_live_bidirectional_roundtrip",
  "category": "E2E",
  "tests_before": 1,
  "kept_tests": 1,
  "location": "tests.conformance.test_live_bidirectional_roundtrip",
  "protects": "Gated live round trip through the litai CLI (derive, attest, review, accept, regenerate, Bazel test) across four languages with a real coding agent."
 },
 {
  "module": "tests.conformance.test_live_composed_roundtrip",
  "category": "E2E",
  "tests_before": 2,
  "kept_tests": 1,
  "location": "tests.conformance.test_live_composed_roundtrip",
  "protects": "Gated live composed-graph journey: generate, spec attest/derive/review/accept/promote via CLI, regenerate and run with real Bazel against the oracle."
 },
 {
  "module": "tests.conformance.test_live_inverse_translators",
  "category": "DELETE",
  "tests_before": 0,
  "kept_tests": 0,
  "location": null,
  "protects": "Empty class with no tests; dead module."
 },
 {
  "module": "tests.conformance.test_runtime_oracles",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Self-tests of the conformance verifier-probe support code (determinism, entropy, catalog shape); no product behavior, exercised implicitly by the sample ladder."
 },
 {
  "module": "tests.conformance.test_sample_acceptance_interfaces",
  "category": "CRITICAL",
  "tests_before": 6,
  "kept_tests": 2,
  "location": "tests.conformance.test_sample_acceptance_interfaces",
  "protects": "Verifier oracle answers stay disjoint from the public interface and the generation recipe can discover only the safe interface (no answer leakage to the generator)."
 },
 {
  "module": "tests.conformance.test_sample_ladder",
  "category": "E2E",
  "tests_before": 92,
  "kept_tests": 8,
  "location": "tests.conformance.test_sample_ladder",
  "protects": "Real sample lifecycle: gated live coding-CLI matrix and per-sample Standard-service runs (hello python/cpp, dependency-planner rust), real-Bazel service-stack lifecycle and cache hit, plus all-host recipe composition and the checkout-never-written lifecycle check."
 },
 {
  "module": "tests.conformance.test_self_hosting",
  "category": "E2E",
  "tests_before": 15,
  "kept_tests": 3,
  "location": "tests.conformance.test_self_hosting",
  "protects": "The framework replicates itself offline and deterministically from its own spec (two clean replays identical), fails closed on missing source/unpinned skill/original-import fallback, and a timed-out candidate's whole process tree is killed."
 },
 {
  "module": "tests.conformance.test_standard_locked_command_projection",
  "category": "E2E",
  "tests_before": 4,
  "kept_tests": 2,
  "location": "tests.conformance.test_standard_locked_command_projection",
  "protects": "Lock-derived Standard build/test/execute commands actually compile, test and run a projected artifact with a real host toolchain and an unchanged closure."
 },
 {
  "module": "tests.conformance.test_standard_service_stack_commands",
  "category": "DELETE",
  "tests_before": 1,
  "kept_tests": 0,
  "location": null,
  "protects": "Argument-override check of a conformance-support runner script; test-harness detail, not product behavior."
 },
 {
  "module": "tests.conformance.test_standard_toolchain_closure",
  "category": "MERGE",
  "tests_before": 1,
  "kept_tests": 0,
  "location": null,
  "protects": "Real python host-toolchain closure projection; already exercised by the python case there (project_locked_standard_toolchain_closure + require_unchanged)."
 },
 {
  "module": "tests.test_package",
  "category": "DELETE",
  "tests_before": 1,
  "kept_tests": 0,
  "location": null,
  "protects": "Asserts only that __version__ matches a regex; import is covered by every other test and the wheel smoke."
 },
 {
  "module": "tests.test_retained_project_inputs",
  "category": "CRITICAL",
  "tests_before": 12,
  "kept_tests": 3,
  "location": "tests.critical.test_retained_project_inputs",
  "protects": "Retained-project capture rejects symlinks/redirected parents and unsafe/alias paths, and never publishes a snapshot when files mutate during capture."
 },
 {
  "module": "tests.unit.test_action_accept_action",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Per-phase copy of the refuse-before-launch dispatch checks kept once in test_action_build_action."
 },
 {
  "module": "tests.unit.test_action_accept_execution",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "In-process ACCEPT custody refusals; duplicates the build/result custody invariants kept elsewhere."
 },
 {
  "module": "tests.unit.test_action_accept_process",
  "category": "MERGE",
  "tests_before": 6,
  "kept_tests": 1,
  "location": "tests.e2e.test_action_accept_process",
  "protects": "Real stdio ACCEPT child from CAS with workspace cleanup; move that one happy path into the worker round-trip E2E; cancel/deadline/diagnostic cases duplicate the BUILD process tests."
 },
 {
  "module": "tests.unit.test_action_accept_record",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Record/envelope validation of ACCEPT inputs; schema-level unit tests."
 },
 {
  "module": "tests.unit.test_action_accept_result",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "ACCEPT result import refusals mirror the BUILD result custody tests kept in test_action_build_result."
 },
 {
  "module": "tests.unit.test_action_admission",
  "category": "SMOKE",
  "tests_before": 15,
  "kept_tests": 2,
  "location": "tests.smoke.test_action_admission",
  "protects": "Live worker pool executes a real HTTP INDEX action and rechecks health before recording; stale hardware refuses admission."
 },
 {
  "module": "tests.unit.test_action_authorization",
  "category": "CRITICAL",
  "tests_before": 5,
  "kept_tests": 2,
  "location": "tests.critical.test_action_authorization",
  "protects": "AUTHORIZE receiver issues a grant without host execution and refuses substituted time/index/payload records."
 },
 {
  "module": "tests.unit.test_action_blob_source",
  "category": "CRITICAL",
  "tests_before": 7,
  "kept_tests": 3,
  "location": "tests.critical.test_action_blob_source",
  "protects": "Remote CAS reader sends the private bearer credential only to the exact endpoint, never follows redirects, and refuses plaintext/embedded credentials without safe configuration."
 },
 {
  "module": "tests.unit.test_action_build_action",
  "category": "CRITICAL",
  "tests_before": 4,
  "kept_tests": 2,
  "location": "tests.critical.test_action_build_action",
  "protects": "A validly hashed foreign payload cannot launch a BUILD child and a child cannot echo its input as a successful result (one representative for all four phases)."
 },
 {
  "module": "tests.unit.test_action_build_execution",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "In-process precondition refusals before build; covered by the process-level and result custody tests."
 },
 {
  "module": "tests.unit.test_action_build_intent",
  "category": "DELETE",
  "tests_before": 8,
  "kept_tests": 0,
  "location": null,
  "protects": "DAG/predecessor validation of the BUILD_INTENT record; unit/contract tests."
 },
 {
  "module": "tests.unit.test_action_build_process",
  "category": "E2E",
  "tests_before": 9,
  "kept_tests": 4,
  "location": "tests.e2e.test_action_build_process",
  "protects": "Worker round trip: a supervised receiver child readmits its input and builds from worker CAS; pre-existing refusal never launches; expiry/cancel stops a real child; failures hide private diagnostics."
 },
 {
  "module": "tests.unit.test_action_build_providers",
  "category": "MERGE",
  "tests_before": 8,
  "kept_tests": 1,
  "location": "tests.e2e.test_action_build_providers",
  "protects": "Configured receiver builds a consumer with a transferred provider in a supervised child; move that single scenario into the worker round-trip E2E."
 },
 {
  "module": "tests.unit.test_action_build_record",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "Record admission/schema validation unit tests."
 },
 {
  "module": "tests.unit.test_action_build_result",
  "category": "CRITICAL",
  "tests_before": 11,
  "kept_tests": 2,
  "location": "tests.critical.test_action_build_result",
  "protects": "Returned BUILD artifacts: a valid hash for a changed archive cannot replace build bytes, and a corrupt fetch never admits or leaves a stage."
 },
 {
  "module": "tests.unit.test_action_build_source",
  "category": "MERGE",
  "tests_before": 5,
  "kept_tests": 1,
  "location": "tests.e2e.test_action_build_source",
  "protects": "HTTP source transfer survives controller source removal; fold into the worker round-trip E2E as the source-transfer step; refusal cases duplicate blob_source/build_result."
 },
 {
  "module": "tests.unit.test_action_capabilities",
  "category": "SMOKE",
  "tests_before": 20,
  "kept_tests": 2,
  "location": "tests.smoke.test_action_capabilities",
  "protects": "Real capability probe binds runtime/worker/read-only capabilities and a private worker identity mismatch refuses."
 },
 {
  "module": "tests.unit.test_action_dag_planning",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "Pure projection of component plans to actions; internal planning unit tests exercised by any real run."
 },
 {
  "module": "tests.unit.test_action_dag_scheduler",
  "category": "MERGE",
  "tests_before": 7,
  "kept_tests": 1,
  "location": "tests.e2e.test_action_dag_scheduler",
  "protects": "Failure cancels only transitive descendants; move that one scheduling invariant next to the real two-slot scheduler test."
 },
 {
  "module": "tests.unit.test_action_dispatch_wire",
  "category": "E2E",
  "tests_before": 15,
  "kept_tests": 4,
  "location": "tests.e2e.test_action_dispatch_wire",
  "protects": "Real command-worker transport: request/result round trip via both input modes, corrupt worker result never enters the result store, two real slots run concurrently, cancellation kills the owned process tree."
 },
 {
  "module": "tests.unit.test_action_environment",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Environment-name case-sensitivity unit tests."
 },
 {
  "module": "tests.unit.test_action_execute_action",
  "category": "DELETE",
  "tests_before": 10,
  "kept_tests": 0,
  "location": null,
  "protects": "Per-phase copy of refuse-before-launch dispatch checks plus predecessor-record validation; representative kept in test_action_build_action."
 },
 {
  "module": "tests.unit.test_action_execute_execution",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "In-process EXECUTE worker; duplicates the real-child EXECUTE path merged into the worker round-trip E2E."
 },
 {
  "module": "tests.unit.test_action_execute_process",
  "category": "MERGE",
  "tests_before": 6,
  "kept_tests": 1,
  "location": "tests.e2e.test_action_execute_process",
  "protects": "Real stdio EXECUTE child from CAS; move the single happy path into the worker round-trip E2E."
 },
 {
  "module": "tests.unit.test_action_execute_providers",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Runtime-provider transfer custody details; overlaps provider build path merged into the E2E."
 },
 {
  "module": "tests.unit.test_action_execute_record",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "EXECUTE record/scope validation unit tests."
 },
 {
  "module": "tests.unit.test_action_execute_result",
  "category": "DELETE",
  "tests_before": 10,
  "kept_tests": 0,
  "location": null,
  "protects": "Mirrors the BUILD result-import custody tests kept in test_action_build_result."
 },
 {
  "module": "tests.unit.test_action_execution_config",
  "category": "SMOKE",
  "tests_before": 26,
  "kept_tests": 3,
  "location": "tests.smoke.test_action_execution_config",
  "protects": "Private worker configuration is picked up automatically by the public factory, invalid configuration refuses with no silent local fallback, and source CAS cannot overlap project authority."
 },
 {
  "module": "tests.unit.test_action_hardware",
  "category": "DELETE",
  "tests_before": 10,
  "kept_tests": 0,
  "location": null,
  "protects": "Hardware-fact wire validation and bounds; admission smoke covers stale-hardware refusal."
 },
 {
  "module": "tests.unit.test_action_observation_failure",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Diagnostic redaction is already asserted by the kept process test (output_bounds_and_failures_hide_private_diagnostics)."
 },
 {
  "module": "tests.unit.test_action_plan",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "PLAN receiver record-substitution checks; same pattern as authorization, which is kept."
 },
 {
  "module": "tests.unit.test_action_provider_build",
  "category": "DELETE",
  "tests_before": 11,
  "kept_tests": 0,
  "location": null,
  "protects": "Provider transfer descriptor/evidence-budget unit tests."
 },
 {
  "module": "tests.unit.test_action_source_index",
  "category": "SMOKE",
  "tests_before": 13,
  "kept_tests": 2,
  "location": "tests.smoke.test_action_source_index",
  "protects": "Real worker fetches exact source from a separate controller CAS and runs production indexing; remote corruption never publishes a blob or result."
 },
 {
  "module": "tests.unit.test_action_ssh_transport",
  "category": "CRITICAL",
  "tests_before": 5,
  "kept_tests": 2,
  "location": "tests.critical.test_action_ssh_transport",
  "protects": "SSH transport keeps arguments literal with the payload out of argv (no shell injection/leak) and real receivers preserve request custody over the seam."
 },
 {
  "module": "tests.unit.test_action_test_action",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Per-phase copy of refuse-before-launch dispatch checks; representative kept in test_action_build_action."
 },
 {
  "module": "tests.unit.test_action_test_execution",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "In-process TEST worker; duplicates the real-child TEST path merged into the worker round-trip E2E."
 },
 {
  "module": "tests.unit.test_action_test_process",
  "category": "MERGE",
  "tests_before": 6,
  "kept_tests": 1,
  "location": "tests.e2e.test_action_test_process",
  "protects": "Real stdio TEST child from CAS; move the single happy path into the worker round-trip E2E."
 },
 {
  "module": "tests.unit.test_action_test_result",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "Mirrors the BUILD result-import custody tests kept in test_action_build_result."
 },
 {
  "module": "tests.unit.test_action_tool_dependencies",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Wire/selection validation of native dependency graphs; unit tests."
 },
 {
  "module": "tests.unit.test_action_tool_observation",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Observation wire substitution/bounds unit tests; capability smoke covers real receiver observation."
 },
 {
  "module": "tests.unit.test_action_tool_selectors",
  "category": "CRITICAL",
  "tests_before": 4,
  "kept_tests": 1,
  "location": "tests.critical.test_action_tool_selectors",
  "protects": "A new PATH entry shadowing a selected tool is refused without changing the registered inventory (tool-hijack protection)."
 },
 {
  "module": "tests.unit.test_action_toolchains",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Toolchain registry selection/identity unit tests; launcher-drift guard overlaps tool_selectors."
 },
 {
  "module": "tests.unit.test_adopted_promotion_journey",
  "category": "E2E",
  "tests_before": 1,
  "kept_tests": 1,
  "location": "tests.e2e.test_adopted_promotion_journey",
  "protects": "Adopted legacy project journey through the litai CLI: convert-stage gate refuses early, retained harness receipt is run and recorded, stage advances, then signed static drafting."
 },
 {
  "module": "tests.unit.test_agent_skill_catalog",
  "category": "SMOKE",
  "tests_before": 7,
  "kept_tests": 2,
  "location": "tests.smoke.test_agent_skill_catalog",
  "protects": "Repository and shipped-template skill catalogs are closed and a stale typed dependency or unresolved reference fails closed."
 },
 {
  "module": "tests.unit.test_agent_skill_catalog_template",
  "category": "MERGE",
  "tests_before": 1,
  "kept_tests": 1,
  "location": "tests.smoke.test_agent_skill_catalog_template",
  "protects": "Byte parity between catalog agent skills and the init template; a cheap drift guard that belongs with the catalog closure smoke (better: generate via a glob instead of a hand list)."
 },
 {
  "module": "tests.unit.test_app_stack_skills",
  "category": "MERGE",
  "tests_before": 27,
  "kept_tests": 1,
  "location": "tests.smoke.test_app_stack_skills",
  "protects": "Only the catalog/template byte-identity check has standalone value; the other 26 are per-skill parent/alias/lock contract assertions."
 },
 {
  "module": "tests.unit.test_application_generation",
  "category": "CRITICAL",
  "tests_before": 32,
  "kept_tests": 4,
  "location": "tests.critical.test_application_generation",
  "protects": "Generation orchestrator fail-closed invariants: failure events never persist secrets, independent acceptance or generated-test failure prevents workspace commit, resume rejects a tampered realized build request."
 },
 {
  "module": "tests.unit.test_application_ports",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Port/protocol contract checks and an assertion about what is not public API; implementation detail."
 },
 {
  "module": "tests.unit.test_application_settings",
  "category": "CRITICAL",
  "tests_before": 27,
  "kept_tests": 3,
  "location": "tests.critical.test_application_settings",
  "protects": "Settings with literal credentials require owner-only file permissions, writes always use owner-only permissions, and literal secrets are redacted on output."
 },
 {
  "module": "tests.unit.test_architecture_boundaries",
  "category": "DELETE",
  "tests_before": 11,
  "kept_tests": 0,
  "location": null,
  "protects": "Import-direction lint rules, not product behavior; move to a static lint (e.g. import-linter) outside the test suite."
 },
 {
  "module": "tests.unit.test_artifact_exports",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Export record field-binding unit tests."
 },
 {
  "module": "tests.unit.test_artifact_graph_contracts",
  "category": "CRITICAL",
  "tests_before": 16,
  "kept_tests": 2,
  "location": "tests.critical.test_artifact_graph_contracts",
  "protects": "Artifact assembly refuses model output that overwrites a content-locked asset or blobs whose bytes do not match their reference."
 },
 {
  "module": "tests.unit.test_artifact_materialization_adapter",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Unit tests of the internal blob-to-root materializer; any build E2E materializes artifacts and fails if this breaks."
 },
 {
  "module": "tests.unit.test_artifacts",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Bundle dataclass/closure-ordering unit checks; dependency closure is exercised by every real build lifecycle."
 },
 {
  "module": "tests.unit.test_authored_library_imports",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "Schema/markdown round-trip and declaration-validation unit tests for authored library imports; implementation-detail coverage."
 },
 {
  "module": "tests.unit.test_authoring_markdown",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Frontmatter parsing/round-trip unit tests; no product-level signal beyond what skill/spec CLI E2Es exercise."
 },
 {
  "module": "tests.unit.test_authority_graph",
  "category": "DELETE",
  "tests_before": 12,
  "kept_tests": 0,
  "location": null,
  "protects": "Pure algorithm tests (DAG solve, cycle diagnostics, golden DOT/SVG exporters) of an internal graph library; string-format and determinism detail."
 },
 {
  "module": "tests.unit.test_authorized_host_execution",
  "category": "CRITICAL",
  "tests_before": 24,
  "kept_tests": 7,
  "location": "tests.critical.test_authorized_host_execution",
  "protects": "Host execution of generated artifacts only happens under an exact live grant: default/revoked/expired grants never start a process, runtime/artifact/support-tree drift after authorization fails before execution, a child cannot mutate authorized inputs, and timeout/output-budget kill the process tree."
 },
 {
  "module": "tests.unit.test_authorized_observations",
  "category": "CRITICAL",
  "tests_before": 5,
  "kept_tests": 2,
  "location": "tests.critical.test_authorized_observations",
  "protects": "Source-to-specification observation runners fail closed without a live grant (default deny, revocation after issuance wins) and detect source mutation during observation."
 },
 {
  "module": "tests.unit.test_bazel_builder",
  "category": "CRITICAL",
  "tests_before": 28,
  "kept_tests": 2,
  "location": "tests.critical.test_bazel_builder",
  "protects": "Bazel toolchain custody: only the exact content-addressed Bazel binary is accepted (cache digest mismatch refused) and lock mutation during a build is rejected."
 },
 {
  "module": "tests.unit.test_behavioral_surface_inventory",
  "category": "DELETE",
  "tests_before": 12,
  "kept_tests": 0,
  "location": null,
  "protects": "Internal inventory collector/reconciliation unit tests with SimpleNamespace inputs; covered end to end by spec derive/conformance CLI tests."
 },
 {
  "module": "tests.unit.test_bounded_process",
  "category": "DELETE",
  "tests_before": 10,
  "kept_tests": 0,
  "location": null,
  "protects": "Clock-injected unit tests of run_bounded_process; the timeout/descendant-kill guarantees that matter are kept in test_authorized_host_execution and test_coding_cli_generation."
 },
 {
  "module": "tests.unit.test_bounded_regular_file",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "tracemalloc allocation-size unit checks of a private reader; bounded-read invariant is kept via test_cas_read_bounds."
 },
 {
  "module": "tests.unit.test_browser_acceptance",
  "category": "SMOKE",
  "tests_before": 27,
  "kept_tests": 3,
  "location": "tests.smoke.test_browser_acceptance",
  "protects": "Web application acceptance really drives Chromium: a no-op export button fails closed, a working page is accepted, and a missing Playwright engine fails closed rather than skipping."
 },
 {
  "module": "tests.unit.test_build_cache_directories",
  "category": "CRITICAL",
  "tests_before": 44,
  "kept_tests": 6,
  "location": "tests.critical.test_build_cache_directories",
  "protects": "Cache cleaning and reuse cannot destroy or leak authority: clean refuses unmarked/protected directories and rechecks authority overlap immediately before delete, npm-style links are unlinked not followed, a symlink cannot redirect the lock namespace, and a cache hit never reuses an expired authorization or a changed builder identity."
 },
 {
  "module": "tests.unit.test_build_dependency_observation_contract",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Immutability/canonical round-trip tests of a ports contract dataclass."
 },
 {
  "module": "tests.unit.test_build_execution_inputs",
  "category": "CRITICAL",
  "tests_before": 4,
  "kept_tests": 2,
  "location": "tests.critical.test_build_execution_inputs",
  "protects": "Superseded or unregistered build plans cannot recover execution grants, and data custody alone cannot enable a build on a test-only receiver."
 },
 {
  "module": "tests.unit.test_build_grant_consumption",
  "category": "CRITICAL",
  "tests_before": 6,
  "kept_tests": 3,
  "location": "tests.critical.test_build_grant_consumption",
  "protects": "Single-use build grants: exactly one winner under a real process race, consumption is never refunded by revocation/expiry, and store loss/corruption refuses rather than re-issuing."
 },
 {
  "module": "tests.unit.test_build_request_declaration",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Wire-contract dataclass round-trip/validation unit tests."
 },
 {
  "module": "tests.unit.test_build_worker",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Argument/stdin-record validation unit tests of the build worker child entry point; worker round trips are covered by the remote/configured worker E2E modules."
 },
 {
  "module": "tests.unit.test_cache_lock",
  "category": "CRITICAL",
  "tests_before": 5,
  "kept_tests": 1,
  "location": "tests.critical.test_cache_lock",
  "protects": "POSIX cache lock detects hard-link replacement of the lock file as unsafe."
 },
 {
  "module": "tests.unit.test_cached_coding_cli_source_generation_runner",
  "category": "CRITICAL",
  "tests_before": 25,
  "kept_tests": 3,
  "location": "tests.critical.test_cached_coding_cli_source_generation_runner",
  "protects": "Generated-source custody: retained (non-model) input can never claim model provenance, retained-source drift prevents candidate publication, and the cache only publishes the exact accepted candidate."
 },
 {
  "module": "tests.unit.test_candidate_repair",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Contract dataclass round-trip and repair-chain shape validation."
 },
 {
  "module": "tests.unit.test_cargo_generation_skill",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Catalog/template skill byte-identity lint; fold all skill catalog/template parity checks into a single repo lint rather than per-language tests."
 },
 {
  "module": "tests.unit.test_cargo_toolchain",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Toolchain discovery unit tests with fake launchers; toolchain-drift invariant is kept once in test_bazel_builder."
 },
 {
  "module": "tests.unit.test_cargo_workspace_graph",
  "category": "SMOKE",
  "tests_before": 12,
  "kept_tests": 2,
  "location": "tests.smoke.test_cargo_workspace_graph",
  "protects": "Real offline locked `cargo metadata` graph matches the reviewed workspace graph, and a substituted package/registry is refused."
 },
 {
  "module": "tests.unit.test_cas_native_paths",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Windows path rewriting unit tests for the CAS; corruption refusal covered in test_cas_read_bounds."
 },
 {
  "module": "tests.unit.test_cas_read_bounds",
  "category": "CRITICAL",
  "tests_before": 6,
  "kept_tests": 2,
  "location": "tests.critical.test_cas_read_bounds",
  "protects": "CAS integrity: a blob of the right size still must match its digest, and copies never overwrite or clobber a replaced destination."
 },
 {
  "module": "tests.unit.test_catalog_import",
  "category": "SMOKE",
  "tests_before": 19,
  "kept_tests": 4,
  "location": "tests.smoke.test_catalog_import",
  "protects": "Catalog import from a real git source pins the requested revision and rejects cycles, embedded credentials in URLs, and option-like locators (git argument injection)."
 },
 {
  "module": "tests.unit.test_checkpointed_gates",
  "category": "SMOKE",
  "tests_before": 8,
  "kept_tests": 2,
  "location": "tests.smoke.test_checkpointed_gates",
  "protects": "Release gate runner: a repaired success requires a clean release-evidence rerun, and a changed gate plan never reuses an incompatible checkpoint."
 },
 {
  "module": "tests.unit.test_checkpointed_unittests",
  "category": "MERGE",
  "tests_before": 13,
  "kept_tests": 1,
  "location": "tests.smoke.test_checkpointed_unittests",
  "protects": "Resume-from-checkpoint and required-from-zero pass for the unittest runner; one case belongs with the release gate runner smoke."
 },
 {
  "module": "tests.unit.test_ci_action_pins",
  "category": "CRITICAL",
  "tests_before": 14,
  "kept_tests": 2,
  "location": "tests.critical.test_ci_action_pins",
  "protects": "Supply-chain: every external GitHub Action is pinned to a full commit SHA and the policy rejects tags, short hashes and expressions."
 },
 {
  "module": "tests.unit.test_ci_impact_run",
  "category": "CRITICAL",
  "tests_before": 11,
  "kept_tests": 2,
  "location": "tests.critical.test_ci_impact_run",
  "protects": "Release gates never skip tests based on testmon/durations, and a missing or untrusted impact map always runs the full suite."
 },
 {
  "module": "tests.unit.test_ci_test_plan",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "Test-plan detection unit tests (pytest/jest/go detection, mode parsing); low value, fail-closed release behavior is kept in test_ci_impact_run."
 },
 {
  "module": "tests.unit.test_claude_skillspector_hook",
  "category": "CRITICAL",
  "tests_before": 6,
  "kept_tests": 2,
  "location": "tests.critical.test_claude_skillspector_hook",
  "protects": "The repo's skill-edit security hook fails closed when the scanner is missing and propagates scanner failures."
 },
 {
  "module": "tests.unit.test_cli_arbitrary_source",
  "category": "E2E",
  "tests_before": 10,
  "kept_tests": 4,
  "location": "tests.e2e.test_cli_arbitrary_source",
  "protects": "Public `litai spec attest/derive/review/accept/promote` flow: a signed static review graph promotes a source-free project, signed derive-review-accept-audit works, unsigned or drifted sources fail closed at acceptance, and model translation requires explicit source-egress authorization."
 },
 {
  "module": "tests.unit.test_cli_build_identity",
  "category": "E2E",
  "tests_before": 14,
  "kept_tests": 3,
  "location": "tests.e2e.test_cli_build_identity",
  "protects": "`litai --version` reports honest build identity (never claims a release without provenance), and `litai update` performs a real pip upgrade in a real prefix and re-executes the original command."
 },
 {
  "module": "tests.unit.test_cli_cache_clean",
  "category": "SMOKE",
  "tests_before": 3,
  "kept_tests": 2,
  "location": "tests.smoke.test_cli_cache_clean",
  "protects": "`litai clean` returns a stable refusal for protected and unmarked cache roots instead of deleting them."
 },
 {
  "module": "tests.unit.test_cli_command_worker_lifecycle",
  "category": "MERGE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Build/test/run sharing worker authority and fail-closed coverage gaps, but driven through a fake dispatcher; the real round trip belongs in the remote execution E2E."
 },
 {
  "module": "tests.unit.test_cli_component_authoring",
  "category": "SMOKE",
  "tests_before": 11,
  "kept_tests": 3,
  "location": "tests.smoke.test_cli_component_authoring",
  "protects": "`litai component migrate` is atomic, `--check` is non-mutating, it never overwrites authored components, and a tampered pinned capability interface fails closed."
 },
 {
  "module": "tests.unit.test_cli_component_locks",
  "category": "SMOKE",
  "tests_before": 9,
  "kept_tests": 3,
  "location": "tests.smoke.test_cli_component_locks",
  "protects": "`litai lock` update/check/diff are deterministic, check is non-mutating when the lock is missing, and audit+lock pair publication rolls back on failure."
 },
 {
  "module": "tests.unit.test_cli_config_migration",
  "category": "SMOKE",
  "tests_before": 4,
  "kept_tests": 1,
  "location": "tests.smoke.test_cli_config_migration",
  "protects": "`litai config migrate` dry-run/apply resolves the user configuration root and migrated assets are consumable."
 },
 {
  "module": "tests.unit.test_cli_debug",
  "category": "MERGE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Debug-flag placement/NDJSON formatting is detail; its secret-redaction case overlaps the redaction invariants kept in test_cli_verbose."
 },
 {
  "module": "tests.unit.test_cli_execution_workers",
  "category": "DELETE",
  "tests_before": 11,
  "kept_tests": 0,
  "location": null,
  "protects": "Parser grammar and worker-parameter resolution unit tests with synthetic catalogs; worker selection is exercised by worker E2Es."
 },
 {
  "module": "tests.unit.test_cli_generation",
  "category": "MERGE",
  "tests_before": 8,
  "kept_tests": 1,
  "location": "tests.critical.test_cli_generation",
  "protects": "Generation stops before the coding CLI when authority is unreviewed; the rest are source-admission verifier helper unit tests."
 },
 {
  "module": "tests.unit.test_cli_help",
  "category": "SMOKE",
  "tests_before": 11,
  "kept_tests": 2,
  "location": "tests.smoke.test_cli_help",
  "protects": "`litai help` lists every discoverable public command and the command reference covers every public verb exactly once."
 },
 {
  "module": "tests.unit.test_cli_human_rendering",
  "category": "DELETE",
  "tests_before": 10,
  "kept_tests": 0,
  "location": null,
  "protects": "Human (TTY) output string formatting; implementation detail."
 },
 {
  "module": "tests.unit.test_cli_library_qualification",
  "category": "SMOKE",
  "tests_before": 14,
  "kept_tests": 3,
  "location": "tests.smoke.test_cli_library_qualification",
  "protects": "Public library qualification uses the library oracle, and retention-write failure or a changed verifier harness prevents admission."
 },
 {
  "module": "tests.unit.test_cli_locked_generation",
  "category": "CRITICAL",
  "tests_before": 5,
  "kept_tests": 3,
  "location": "tests.critical.test_cli_locked_generation",
  "protects": "Model egress is gated by locks: missing/stale/mismatched locks (and unreviewed authority, merged from test_cli_generation) fail before the coding agent is invoked, and the live closure is rechecked immediately before egress."
 },
 {
  "module": "tests.unit.test_cli_package",
  "category": "E2E",
  "tests_before": 10,
  "kept_tests": 3,
  "location": "tests.e2e.test_cli_package",
  "protects": "`litai package plan/build/verify` produces and verifies real npm and zip packages and refuses stale inputs; build requires explicit host-execution acknowledgement."
 },
 {
  "module": "tests.unit.test_cli_perf",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "`perf show/chart` summarization and SVG formatting of a diagnostics tool."
 },
 {
  "module": "tests.unit.test_cli_profile",
  "category": "DELETE",
  "tests_before": 1,
  "kept_tests": 0,
  "location": null,
  "protects": "Single aggregation unit test of a profiling report."
 },
 {
  "module": "tests.unit.test_cli_project_index_preflight",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Mock-heavy ordering checks of preflight before driver resolution."
 },
 {
  "module": "tests.unit.test_cli_rebuild",
  "category": "E2E",
  "tests_before": 33,
  "kept_tests": 5,
  "location": "tests.e2e.test_cli_rebuild",
  "protects": "`litai rebuild` end to end: public product results agree with committed receipts, authorized argv runs and leaves an external candidate, and it fails closed without acknowledgement/driver, without committed locks, or on a tampered derivation plan/driver drift."
 },
 {
  "module": "tests.unit.test_cli_repository_locks",
  "category": "E2E",
  "tests_before": 13,
  "kept_tests": 3,
  "location": "tests.e2e.test_cli_repository_locks",
  "protects": "Repository-level `litai lock/plan/verify` on real git repos: mixed roots lock components and a clean clone reproduces the same plan without writes, missing/stale locks refuse planning, and index drift never silently refreshes root authority."
 },
 {
  "module": "tests.unit.test_cli_retained_cargo",
  "category": "SMOKE",
  "tests_before": 9,
  "kept_tests": 3,
  "location": "tests.smoke.test_cli_retained_cargo",
  "protects": "`litai retained-cargo` materializes then checks and reuses packages without rewrites, refuses a wrong archive with sanitized diagnostics, and admit requires both acknowledgements."
 },
 {
  "module": "tests.unit.test_cli_retained_cargo_https",
  "category": "CRITICAL",
  "tests_before": 8,
  "kept_tests": 3,
  "location": "tests.critical.test_cli_retained_cargo_https",
  "protects": "Retained cargo over real TLS: redirects or wrong bytes never publish or fall back, credentials are refused for local files, and the happy path materializes over real HTTPS."
 },
 {
  "module": "tests.unit.test_cli_scxml_review",
  "category": "SMOKE",
  "tests_before": 2,
  "kept_tests": 1,
  "location": "tests.smoke.test_cli_scxml_review",
  "protects": "`litai spec scxml-review` validates a chart without writing."
 },
 {
  "module": "tests.unit.test_cli_source_admission",
  "category": "E2E",
  "tests_before": 3,
  "kept_tests": 2,
  "location": "tests.e2e.test_cli_source_admission",
  "protects": "Public source admission runs the generated test suite, admits and restores source without test outputs, and a source edit during admission publishes nothing."
 },
 {
  "module": "tests.unit.test_cli_source_to_specification",
  "category": "E2E",
  "tests_before": 6,
  "kept_tests": 3,
  "location": "tests.e2e.test_cli_source_to_specification",
  "protects": "`litai spec conformance/derive/review/accept`: every fixture conforms deterministically without source mutation, accept is atomic into a separate target, and prompt injection cannot select skills or change policy."
 },
 {
  "module": "tests.unit.test_cli_specification_corpus",
  "category": "SMOKE",
  "tests_before": 3,
  "kept_tests": 2,
  "location": "tests.smoke.test_cli_specification_corpus",
  "protects": "Specification corpus validate/explain are non-mutating and format only writes when explicitly asked."
 },
 {
  "module": "tests.unit.test_cli_standard_command_projection_error",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Exception-to-JSON-envelope mapping unit tests."
 },
 {
  "module": "tests.unit.test_cli_verbose",
  "category": "CRITICAL",
  "tests_before": 8,
  "kept_tests": 3,
  "location": "tests.critical.test_cli_verbose",
  "protects": "Verbose/debug diagnostics redact secrets in arguments, environment, output, exceptions and structured subprocess logs."
 },
 {
  "module": "tests.unit.test_cli_worker_health",
  "category": "SMOKE",
  "tests_before": 17,
  "kept_tests": 3,
  "location": "tests.smoke.test_cli_worker_health",
  "protects": "`litai worker health` really measures the local worker without writing, sustained memory pressure holds lifecycle admission, and cleanup plan never deletes while apply requires exact authorization."
 },
 {
  "module": "tests.unit.test_cli_worker_probe",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Mocked SSH probe error/JSON rendering and help."
 },
 {
  "module": "tests.unit.test_cli_worker_registry",
  "category": "SMOKE",
  "tests_before": 11,
  "kept_tests": 3,
  "location": "tests.smoke.test_cli_worker_registry",
  "protects": "`litai worker` registry CRUD round-trips, parallel writers never lose registrations, and failed/atomic publication preserves the existing catalog."
 },
 {
  "module": "tests.unit.test_cli_worker_verify_model",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Mocked model resolution and help output."
 },
 {
  "module": "tests.unit.test_cmake_generation_skill",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Skill catalog/template parity lint; fold into a single repo-wide parity check."
 },
 {
  "module": "tests.unit.test_cmake_toolchain",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "CMake discovery unit tests with fake launchers; toolchain-drift invariant kept once in test_bazel_builder."
 },
 {
  "module": "tests.unit.test_coding_cli_generation",
  "category": "CRITICAL",
  "tests_before": 130,
  "kept_tests": 8,
  "location": "tests.critical.test_coding_cli_generation",
  "protects": "Coding-agent sandbox/credential boundary: only the selected provider's credentials cross a scrubbed environment, inherited sessions are isolated, generated-cache publication cannot escape via symlink, timeout kills agent descendants, executable drift after invocation fails closed, and output budget/out-of-source writes fail closed."
 },
 {
  "module": "tests.unit.test_coding_cli_generation_stderr_limit",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Checks parsing of the stderr-allowance env setting and a single argument forwarded to the CLI. These are configuration-parsing unit tests."
 },
 {
  "module": "tests.unit.test_coding_cli_generation_timeout",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Checks parsing of the generation-timeout env var (default 900, override, rejection). Pure configuration unit tests."
 },
 {
  "module": "tests.unit.test_coding_cli_quota_fallback",
  "category": "SMOKE",
  "tests_before": 5,
  "kept_tests": 2,
  "location": "tests.smoke.test_coding_cli_quota_fallback",
  "protects": "When a CLI reports a quota or spend-cap denial, generation falls back to the next available coding CLI found on PATH, and it does not fall back when the CLI is pinned. Uses real stub executables."
 },
 {
  "module": "tests.unit.test_command_build_worker",
  "category": "E2E",
  "tests_before": 1,
  "kept_tests": 1,
  "location": "tests.e2e.test_command_build_worker",
  "protects": "A controller with no execution tools sends real BUILD, TEST and EXECUTE through worker child processes and imports the verified results. This is the main real worker round trip."
 },
 {
  "module": "tests.unit.test_command_builder",
  "category": "CRITICAL",
  "tests_before": 10,
  "kept_tests": 2,
  "location": "tests.critical.test_command_builder",
  "protects": "A corrupt worker blob or a foreign provider receipt must never register build artifacts. These are custody invariants."
 },
 {
  "module": "tests.unit.test_command_execute_provider",
  "category": "MERGE",
  "tests_before": 1,
  "kept_tests": 1,
  "location": "tests.e2e.test_command_execute_provider",
  "protects": "A runtime-only provider crosses a live child boundary and returns proof to a controller that has no commands. Valuable, but it repeats the worker round-trip shape."
 },
 {
  "module": "tests.unit.test_command_executor",
  "category": "MERGE",
  "tests_before": 11,
  "kept_tests": 1,
  "location": "tests.critical.test_command_executor",
  "protects": "EXECUTE dispatch refusals (foreign or conflicting receipts, missing build) plus a happy path that test_command_build_worker already covers."
 },
 {
  "module": "tests.unit.test_command_indexer",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Indexer port tests built on fake workers: capacity reservation, bounds and concurrency details. The real index path runs inside the worker and lifecycle E2Es."
 },
 {
  "module": "tests.unit.test_command_tester",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "TEST-phase copy of the command_executor refusal matrix. The happy path is covered by test_command_build_worker."
 },
 {
  "module": "tests.unit.test_compiler_cache",
  "category": "CRITICAL",
  "tests_before": 4,
  "kept_tests": 1,
  "location": "tests.critical.test_compiler_cache",
  "protects": "The compiler-cache startup handshake admits only the owned loopback port, which prevents cache poisoning through port hijack."
 },
 {
  "module": "tests.unit.test_compiler_cache_dependencies",
  "category": "CRITICAL",
  "tests_before": 7,
  "kept_tests": 2,
  "location": "tests.critical.test_compiler_cache_dependencies",
  "protects": "Unmodeled loader injection (LD_PRELOAD and DYLD_*) is refused before the cache server runs, and a changed library changes the cache identity."
 },
 {
  "module": "tests.unit.test_compiler_version_observations",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Parses compiler version banners. String-parsing unit tests."
 },
 {
  "module": "tests.unit.test_component_authoring_lock_contracts",
  "category": "DELETE",
  "tests_before": 8,
  "kept_tests": 0,
  "location": null,
  "protects": "Schema validity, round trips and field-order rules for authoring contracts. Contract unit tests."
 },
 {
  "module": "tests.unit.test_component_authoring_migration",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Legacy-to-v2 authoring migration projection. Pure functions over in-memory data."
 },
 {
  "module": "tests.unit.test_component_authority",
  "category": "CRITICAL",
  "tests_before": 12,
  "kept_tests": 3,
  "location": "tests.critical.test_component_authority",
  "protects": "The component authority store is append-only. It rejects skipped transitions, symlinked ancestors and concurrent forks of current history."
 },
 {
  "module": "tests.unit.test_component_command_contracts",
  "category": "CRITICAL",
  "tests_before": 17,
  "kept_tests": 2,
  "location": "tests.critical.test_component_command_contracts",
  "protects": "Component command contracts never accept shell strings, inferred executables or shell substitution (command-injection invariant)."
 },
 {
  "module": "tests.unit.test_component_execution_planning",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "In-memory execution-plan construction: diamond dedup and invalidation keys. The lifecycle E2Es exercise this."
 },
 {
  "module": "tests.unit.test_component_generation_context",
  "category": "CRITICAL",
  "tests_before": 8,
  "kept_tests": 1,
  "location": "tests.critical.test_component_generation_context",
  "protects": "Private transitive dependency content is never put into a consumer's model context, even when names collide. This prevents leakage and confusion at model egress."
 },
 {
  "module": "tests.unit.test_component_generation_scheduling",
  "category": "MERGE",
  "tests_before": 7,
  "kept_tests": 1,
  "location": "tests.smoke.test_component_generation_scheduling",
  "protects": "Incremental regeneration touches only changed nodes and their direct interface consumers. This is valuable product behavior, but here it is tested with fake runners."
 },
 {
  "module": "tests.unit.test_component_kinds",
  "category": "DELETE",
  "tests_before": 12,
  "kept_tests": 0,
  "location": null,
  "protects": "Validation of the component-kind dataclass and enum."
 },
 {
  "module": "tests.unit.test_component_lock_contracts",
  "category": "DELETE",
  "tests_before": 17,
  "kept_tests": 0,
  "location": null,
  "protects": "A 1308-line lock-contract and schema round-trip suite. Forged-lock detection is kept in test_component_lock_store."
 },
 {
  "module": "tests.unit.test_component_lock_planning",
  "category": "MERGE",
  "tests_before": 19,
  "kept_tests": 1,
  "location": "tests.smoke.test_component_lock_planning",
  "protects": "Lock planning from a real authority catalog: exact flavors, hashed assets, and symlink/junction authority directories rejected."
 },
 {
  "module": "tests.unit.test_component_lock_resolution",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Wire round trips and order-independence of the resolution plan. Pure unit tests."
 },
 {
  "module": "tests.unit.test_component_lock_reviews",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Pagination and acknowledgement mechanics of lock-diff review pages. Implementation detail."
 },
 {
  "module": "tests.unit.test_component_lock_sbom",
  "category": "DELETE",
  "tests_before": 8,
  "kept_tests": 0,
  "location": null,
  "protects": "Projects a lock into SBOM inputs. This duplicates the graph checks in test_cyclonedx_sbom."
 },
 {
  "module": "tests.unit.test_component_lock_store",
  "category": "CRITICAL",
  "tests_before": 11,
  "kept_tests": 3,
  "location": "tests.critical.test_component_lock_store",
  "protects": "Writing the lock file is atomic and fail-closed. Failed revalidation preserves the original bytes, an uncooperative concurrent change is not overwritten, and symlinked or forged locks are refused."
 },
 {
  "module": "tests.unit.test_component_markdown_adapter",
  "category": "DELETE",
  "tests_before": 14,
  "kept_tests": 0,
  "location": null,
  "protects": "Parser and renderer unit tests for component.md YAML front matter. Every sample and CLI E2E parses real component.md files."
 },
 {
  "module": "tests.unit.test_component_node_generation_preparation",
  "category": "DELETE",
  "tests_before": 8,
  "kept_tests": 0,
  "location": null,
  "protects": "Builds in-memory generation recipes and checks model-scope precedence. Unit-level."
 },
 {
  "module": "tests.unit.test_component_resolution_audit_store",
  "category": "CRITICAL",
  "tests_before": 9,
  "kept_tests": 1,
  "location": "tests.critical.test_component_resolution_audit_store",
  "protects": "Audit-store writes never follow a symlink destination or mutate its target."
 },
 {
  "module": "tests.unit.test_component_workers",
  "category": "CRITICAL",
  "tests_before": 24,
  "kept_tests": 3,
  "location": "tests.critical.test_component_workers",
  "protects": "Cross-worker artifact transfer never issues a receipt for corrupt source or destination bytes, replayed receipts are refused, and a wrong worker result blocks downstream dispatch."
 },
 {
  "module": "tests.unit.test_configured_accept_worker",
  "category": "E2E",
  "tests_before": 6,
  "kept_tests": 1,
  "location": "tests.e2e.test_configured_accept_worker",
  "protects": "A real configured ACCEPT child runs without any application tools and cleans up its job directory."
 },
 {
  "module": "tests.unit.test_configured_build_worker",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Refusal paths of the configured BUILD worker profile. It has no real child test, and test_command_build_worker covers the real BUILD dispatch."
 },
 {
  "module": "tests.unit.test_configured_execute_worker",
  "category": "E2E",
  "tests_before": 9,
  "kept_tests": 1,
  "location": "tests.e2e.test_configured_execute_worker",
  "protects": "A real action receiver routes EXECUTE to a configured child, which executes without controller source and returns verified evidence."
 },
 {
  "module": "tests.unit.test_configured_test_worker",
  "category": "E2E",
  "tests_before": 9,
  "kept_tests": 1,
  "location": "tests.e2e.test_configured_test_worker",
  "protects": "A real action receiver routes TEST to a configured child, which fetches the build and runs tests without controller source."
 },
 {
  "module": "tests.unit.test_configured_tool_observations",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Tool-registry profile drift checks against a real Python executable. Implementation detail of worker profiles."
 },
 {
  "module": "tests.unit.test_contract_migrations_boundaries",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Determinism of the migration helper plus an import-layering check. An architectural lint belongs in a linter, not in CI test time."
 },
 {
  "module": "tests.unit.test_contracts_identity",
  "category": "CRITICAL",
  "tests_before": 5,
  "kept_tests": 1,
  "location": "tests.critical.test_contracts_identity",
  "protects": "Canonical content-identity bytes and hashes stay stable. If they drift, every stored lock, receipt and cache entry becomes unreadable."
 },
 {
  "module": "tests.unit.test_contracts_lifecycle",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Round trips of lifecycle dataclasses and schemas. Contract unit tests. Schema catalog validity is covered elsewhere."
 },
 {
  "module": "tests.unit.test_conversion_git_boundaries",
  "category": "E2E",
  "tests_before": 2,
  "kept_tests": 2,
  "location": "tests.e2e.test_conversion_git_boundaries",
  "protects": "Converting an existing repository works across real git submodules: an absorbed worktree's current upstream is used as the default branch, and an initialized nested submodule is relocated."
 },
 {
  "module": "tests.unit.test_course_demo_regressions",
  "category": "SMOKE",
  "tests_before": 2,
  "kept_tests": 1,
  "location": "tests.smoke.test_course_demo_regressions",
  "protects": "A project scaffolded with initialize_project ships a hello-component whose acceptance oracle matches its spec. This is the onboarding happy path."
 },
 {
  "module": "tests.unit.test_coverage_gaps",
  "category": "SMOKE",
  "tests_before": 14,
  "kept_tests": 2,
  "location": "tests.smoke.test_coverage_gaps",
  "protects": "The implementation-gap scanner flags NotImplemented and None route handlers in product code, and the real fixture and sample trees have none."
 },
 {
  "module": "tests.unit.test_cpp_bazel_outputs",
  "category": "E2E",
  "tests_before": 10,
  "kept_tests": 2,
  "location": "tests.e2e.test_cpp_bazel_outputs",
  "protects": "A locked C++ library is generated, built with real Bazel, tested, packaged and consumed by a fresh Conan/Bazel consumer. The real static and shared products link without the producer source."
 },
 {
  "module": "tests.unit.test_cpp_libraries",
  "category": "DELETE",
  "tests_before": 8,
  "kept_tests": 0,
  "location": null,
  "protects": "Validation of the native library layout dataclass and wire."
 },
 {
  "module": "tests.unit.test_current_evidence",
  "category": "E2E",
  "tests_before": 26,
  "kept_tests": 3,
  "location": "tests.e2e.test_current_evidence",
  "protects": "The public litai CLI publishes a signed current-evidence bundle, reverifies it without writes, detects a pointer change, and the require-current-evidence gate refuses an unsigned receipt."
 },
 {
  "module": "tests.unit.test_cursor_inherited_session",
  "category": "SMOKE",
  "tests_before": 4,
  "kept_tests": 2,
  "location": "tests.smoke.test_cursor_inherited_session",
  "protects": "The Cursor stop-hook bridge delivers the bounded context to the current session and returns bound source. A model or workspace mismatch fails closed."
 },
 {
  "module": "tests.unit.test_cyclonedx_sbom",
  "category": "SMOKE",
  "tests_before": 18,
  "kept_tests": 2,
  "location": "tests.smoke.test_cyclonedx_sbom",
  "protects": "The SBOM output validates against the official CycloneDX 1.7 schema with a complete transitive graph, and tampering with the standard fields or graph fails closed."
 },
 {
  "module": "tests.unit.test_debian_packaging",
  "category": "CRITICAL",
  "tests_before": 7,
  "kept_tests": 1,
  "location": "tests.critical.test_debian_packaging",
  "protects": "Produced .deb bytes are reproducible. Verification rejects tampered bytes, unsafe control archives and path-traversal data members."
 },
 {
  "module": "tests.unit.test_dependency_artifact_selection",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Path-selection validation for dependency artifact inspection. Unit tests."
 },
 {
  "module": "tests.unit.test_dependency_library_roots",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Library-root routing for the native observer. Unit tests."
 },
 {
  "module": "tests.unit.test_dependency_lifecycle",
  "category": "SMOKE",
  "tests_before": 67,
  "kept_tests": 4,
  "location": "tests.smoke.test_dependency_lifecycle",
  "protects": "Dependency observation and resolution: the Bzlmod reachable graph, npm lock integrity and edges, and the Python distribution file closure. It also rejects npm name-escape links (path-traversal invariant)."
 },
 {
  "module": "tests.unit.test_dependency_windows_environment",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Snapshots of Windows environment context. Unit tests with mocks."
 },
 {
  "module": "tests.unit.test_design_by_contract_skill_paragraphs",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Asserts prose content of skill documents and template byte-equality. Replace with one repository-wide template-sync lint."
 },
 {
  "module": "tests.unit.test_directory_export_reader",
  "category": "CRITICAL",
  "tests_before": 9,
  "kept_tests": 2,
  "location": "tests.critical.test_directory_export_reader",
  "protects": "The archive export reader rejects unsafe paths and collisions (zip-slip), and also links, devices, privileged modes and compression bombs."
 },
 {
  "module": "tests.unit.test_dmn_adapter",
  "category": "SMOKE",
  "tests_before": 10,
  "kept_tests": 2,
  "location": "tests.smoke.test_dmn_adapter",
  "protects": "The DMN specification adapter loads the reviewed real prototype and rejects DTD, entity and XInclude content (XXE)."
 },
 {
  "module": "tests.unit.test_doc_toolchain_bootstrap",
  "category": "SMOKE",
  "tests_before": 4,
  "kept_tests": 2,
  "location": "tests.smoke.test_doc_toolchain_bootstrap",
  "protects": "The doc-toolchain CLI detect command returns a structured status, and install refuses to run without authorization."
 },
 {
  "module": "tests.unit.test_doc_toolchain_regenerate",
  "category": "E2E",
  "tests_before": 4,
  "kept_tests": 2,
  "location": "tests.e2e.test_doc_toolchain_regenerate",
  "protects": "regenerate.sh rebuilds the manager-overview deck and narrative with the pinned toolchain without mutating checked-in files, and the output passes the independent oracle."
 },
 {
  "module": "tests.unit.test_docker_container_flavor",
  "category": "CRITICAL",
  "tests_before": 5,
  "kept_tests": 1,
  "location": "tests.critical.test_docker_container_flavor",
  "protects": "The Python container base image is pinned by digest (supply-chain invariant)."
 },
 {
  "module": "tests.unit.test_document_pair_oracle",
  "category": "CRITICAL",
  "tests_before": 15,
  "kept_tests": 2,
  "location": "tests.critical.test_document_pair_oracle",
  "protects": "The document oracle rejects credential material and unauthorized publication or audience widening in generated documents."
 },
 {
  "module": "tests.unit.test_documentation",
  "category": "SMOKE",
  "tests_before": 13,
  "kept_tests": 2,
  "location": "tests.smoke.test_documentation",
  "protects": "The real repository README links only to tracked existing documents, and the documentation graph enforces reachability and lifecycle headers."
 },
 {
  "module": "tests.unit.test_documentation_update",
  "category": "CRITICAL",
  "tests_before": 14,
  "kept_tests": 2,
  "location": "tests.critical.test_documentation_update",
  "protects": "Model-driven documentation updates never send secret-bearing content to the model, and they roll back on validation failure."
 },
 {
  "module": "tests.unit.test_dsse_evidence",
  "category": "CRITICAL",
  "tests_before": 14,
  "kept_tests": 3,
  "location": "tests.critical.test_dsse_evidence",
  "protects": "DSSE verification: an untrusted signer cannot gain trust through a key id, payload or signature substitution is refused, and thresholds count distinct verified keys."
 },
 {
  "module": "tests.unit.test_durable_split_health_probe",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Tests a conformance-suite support helper (an HTTP health probe), not product behavior."
 },
 {
  "module": "tests.unit.test_elf_direct_imports",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Unit tests of ELF loader-path semantics for native dependency inspection."
 },
 {
  "module": "tests.unit.test_elf_inherited_paths",
  "category": "DELETE",
  "tests_before": 8,
  "kept_tests": 0,
  "location": null,
  "protects": "Unit tests of RPATH/RUNPATH inheritance in the ELF dependency model."
 },
 {
  "module": "tests.unit.test_elf_loader_paths",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Unit tests of RUNPATH-suppresses-RPATH ordering."
 },
 {
  "module": "tests.unit.test_evidence_cancellation",
  "category": "CRITICAL",
  "tests_before": 1,
  "kept_tests": 1,
  "location": "tests.critical.test_evidence_cancellation",
  "protects": "After SIGINT or a timeout, the gate's whole process tree is killed and the nested evidence ledger is finalized as failed. No orphaned processes or open runs remain."
 },
 {
  "module": "tests.unit.test_evidence_graph",
  "category": "CRITICAL",
  "tests_before": 14,
  "kept_tests": 3,
  "location": "tests.critical.test_evidence_graph",
  "protects": "Authenticating an evidence graph rejects untrusted nested signers and forged signatures, substituted or renamed signed artifacts, and revocation after the last read."
 },
 {
  "module": "tests.unit.test_evidence_ledger",
  "category": "SMOKE",
  "tests_before": 23,
  "kept_tests": 4,
  "location": "tests.smoke.test_evidence_ledger",
  "protects": "The run evidence ledger tees and redacts subprocess output, records non-zero exits as failed, explains failures, and pruning keeps failed runs."
 },
 {
  "module": "tests.unit.test_evidence_partition_manifest",
  "category": "CRITICAL",
  "tests_before": 6,
  "kept_tests": 1,
  "location": "tests.critical.test_evidence_partition_manifest",
  "protects": "Keep only test_evidence_outside_inventory_or_for_sensitive_path_is_rejected: sensitive repository paths must never be partitioned into model-bound evidence (data egress); the rest are partition-algorithm unit checks."
 },
 {
  "module": "tests.unit.test_evidence_records",
  "category": "CRITICAL",
  "tests_before": 13,
  "kept_tests": 3,
  "location": "tests.critical.test_evidence_records",
  "protects": "DSSE run assertions: signature verified before parse, valid signature cannot hide substituted subject/predicate, malformed payload errors never echo signed secret content; round-trip/field-validation cases are unit noise."
 },
 {
  "module": "tests.unit.test_evidence_resolution_session",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "Byte/object budget accounting of an internal resolution session with Mock backends; budget refusal is an implementation bound, not a product surface."
 },
 {
  "module": "tests.unit.test_evidence_retention",
  "category": "DELETE",
  "tests_before": 10,
  "kept_tests": 0,
  "location": null,
  "protects": "Retention-root routing unit tests over mocks; the security-relevant outcomes (unsigned retention cannot route, signer revoked after reads, missing retention refuses) are already proven through the public command in test_evidence_verification_cli."
 },
 {
  "module": "tests.unit.test_evidence_storage",
  "category": "CRITICAL",
  "tests_before": 17,
  "kept_tests": 4,
  "location": "tests.critical.test_evidence_storage",
  "protects": "Real filesystem/TLS evidence stores: immutable no-overwrite publication, existing corruption never republished/hidden, redirects/auth and TLS verification fail closed, signed statement resolves real remote evidence. Keep test_filesystem_publication_is_immutable..., test_existing_remote_corruption_is_not_overwritten_or_hidden, test_redirect_auth_metadata_encoding_and_corruption_fail_closed, test_signed_statement_resolves_real_remote_evidence_through_ports."
 },
 {
  "module": "tests.unit.test_evidence_trust",
  "category": "CRITICAL",
  "tests_before": 13,
  "kept_tests": 3,
  "location": "tests.critical.test_evidence_trust",
  "protects": "Trust policy: unsigned/wrong-key/forged key hints never establish trust, revocation/scope applied before authentication, signer must be valid for the actual run; the remaining record round-trips and time-window permutations are unit tests."
 },
 {
  "module": "tests.unit.test_evidence_verification_cli",
  "category": "SMOKE",
  "tests_before": 12,
  "kept_tests": 4,
  "location": "tests.smoke.test_evidence_verification_cli",
  "protects": "Public evidence-verification command: authenticates a complete signed custody graph read-only against a real `init`-ed project, and refuses on revoked signer after reads and unsigned retention. Keep test_public_command_authenticates_complete_graph_and_writes_nothing, test_command_verifies_against_real_initialized_project_authority, test_revocation_reload_after_reads_refuses_newly_revoked_signer, test_unsigned_retention_cannot_supply_routing_authority."
 },
 {
  "module": "tests.unit.test_exclusive_directory",
  "category": "CRITICAL",
  "tests_before": 8,
  "kept_tests": 2,
  "location": "tests.critical.test_exclusive_directory",
  "protects": "Data-loss invariant: native exclusive directory publication never replaces an existing directory/file and has no replace fallback. Keep test_existing_empty_directory_and_file_are_never_replaced and test_unsupported_native_rename_has_no_replacement_fallback."
 },
 {
  "module": "tests.unit.test_executable_component_contracts",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Dataclass/schema boundary and diamond-invalidation table unit tests of contracts; no product surface."
 },
 {
  "module": "tests.unit.test_executable_component_v2_schemas",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Wire-schema conformance/round-trips for v2 contracts; pure schema validation."
 },
 {
  "module": "tests.unit.test_execute_handoff",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Mock-heavy (Mock/patch, SimpleNamespace) replica of EXECUTE capture custody; real build->execute custody is better proven by an E2E lifecycle run."
 },
 {
  "module": "tests.unit.test_execute_worker",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Argument/stdin parsing refusals of the EXECUTE child entrypoint with mocks; startup-input validation detail."
 },
 {
  "module": "tests.unit.test_execution_dispatch_adapter",
  "category": "CRITICAL",
  "tests_before": 13,
  "kept_tests": 2,
  "location": "tests.critical.test_execution_dispatch_adapter",
  "protects": "Credential custody in command-worker dispatch: stdin dispatch is shell-free and does not persist secrets, and the request file exists only during the call. Keep test_stdin_dispatch_is_shell_free_minimal_and_does_not_persist_secrets and test_request_file_exists_only_during_the_dispatch_call (add one credentialed-URI refusal case from execution_dispatch_contracts)."
 },
 {
  "module": "tests.unit.test_execution_dispatch_contracts",
  "category": "MERGE",
  "tests_before": 19,
  "kept_tests": 2,
  "location": "tests.critical.test_execution_dispatch_contracts",
  "protects": "Contract round-trips/validation of worker catalog and dispatch wire; only the credential-free authority/artifact-URI refusal is worth keeping, as one case in the dispatch adapter's CRITICAL set."
 },
 {
  "module": "tests.unit.test_execution_worker_health_admission",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Retry/poll policy of worker health admission with fake namespaces and events; internal scheduling detail."
 },
 {
  "module": "tests.unit.test_file_observation_clocks",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Mocked stat-clock drift checks for internal index reads; implementation detail."
 },
 {
  "module": "tests.unit.test_filesystem_qualification_adapter",
  "category": "DELETE",
  "tests_before": 8,
  "kept_tests": 0,
  "location": null,
  "protects": "Mock-based recomposition of qualification lifecycle and oracle-binding internals; real qualification is exercised by conformance regenerative-parity/self-hosting E2E."
 },
 {
  "module": "tests.unit.test_final_cutover",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Cutover evidence manifest validation and legacy-reader conformance unit tests; migration bookkeeping, no user-facing surface."
 },
 {
  "module": "tests.unit.test_flavor_add",
  "category": "SMOKE",
  "tests_before": 7,
  "kept_tests": 2,
  "location": "tests.smoke.test_flavor_add",
  "protects": "`litai` flavor add on an existing initialized project: a macOS project gains Linux, and incompatible python+go fails closed without mutation. Keep test_macos_project_can_gain_linux and test_python_and_go_fail_closed_without_mutation (or one CLI add case)."
 },
 {
  "module": "tests.unit.test_flavor_markdown",
  "category": "SMOKE",
  "tests_before": 4,
  "kept_tests": 1,
  "location": "tests.smoke.test_flavor_markdown",
  "protects": "Keep test_repository_flavors_are_canonical_resolvable_markdown: every shipped Flavor definition parses and resolves, catching a broken shipped catalog; migration-script cases are one-off."
 },
 {
  "module": "tests.unit.test_flavor_name_migration",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "ADR 0010 legacy alias/name migration and selector-resolution unit tests; transitional compatibility, duplicates flavor_selection."
 },
 {
  "module": "tests.unit.test_flavor_selection",
  "category": "DELETE",
  "tests_before": 12,
  "kept_tests": 0,
  "location": null,
  "protects": "Pure selector-resolution algorithm unit tests (aliases, slots, conflicts)."
 },
 {
  "module": "tests.unit.test_forward_generation_context_journal",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "Context journal record round-trips, schema validity and forged-count checks; contract unit tests."
 },
 {
  "module": "tests.unit.test_generated_source_index",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Provider selection and tree-identity unit checks for source intelligence."
 },
 {
  "module": "tests.unit.test_generated_tests",
  "category": "DELETE",
  "tests_before": 10,
  "kept_tests": 0,
  "location": null,
  "protects": "Validation of generated-test suite document fields and uniqueness; schema/dataclass validation."
 },
 {
  "module": "tests.unit.test_generation_cache",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Cache-key/contract semantics of accepted derivations as pure unit tests; cache correctness belongs in a generation E2E."
 },
 {
  "module": "tests.unit.test_generation_planning",
  "category": "DELETE",
  "tests_before": 10,
  "kept_tests": 0,
  "location": null,
  "protects": "Plan compilation unit tests over in-memory pins/routes; behavior surfaces through locked-generation CLI tests."
 },
 {
  "module": "tests.unit.test_generation_preparation_service",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Application-service ordering and stable-error-code unit tests with fixtures."
 },
 {
  "module": "tests.unit.test_github_evidence_keys",
  "category": "CRITICAL",
  "tests_before": 10,
  "kept_tests": 2,
  "location": "tests.critical.test_github_evidence_keys",
  "protects": "JWKS key fetch for GitHub OIDC: discovery cannot redirect the key fetch, and transport failure never returns cached/stale keys. Keep test_discovery_cannot_redirect_key_fetch and test_transport_failure_is_sanitized_and_never_returns_cached_keys."
 },
 {
  "module": "tests.unit.test_github_evidence_oidc",
  "category": "CRITICAL",
  "tests_before": 11,
  "kept_tests": 3,
  "location": "tests.critical.test_github_evidence_oidc",
  "protects": "OIDC identity scope: correctly signed claim substitutions fail, other repository/workflow/target cannot be used, algorithm/key hints never change trust. Keep those three; time/size/JSON-depth permutations are unit noise."
 },
 {
  "module": "tests.unit.test_github_run_evidence",
  "category": "CRITICAL",
  "tests_before": 8,
  "kept_tests": 2,
  "location": "tests.critical.test_github_run_evidence",
  "protects": "A valid OIDC token cannot substitute for possession of the exact signed evidence; legitimately signed wrong runs refuse. Keep test_correct_oidc_token_cannot_replace_the_named_private_key and test_legitimately_signed_and_token_bound_wrong_runs_refuse."
 },
 {
  "module": "tests.unit.test_google_document_pair_publication",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Mocked subprocess tests of an auxiliary Google Docs publication script; not a product surface."
 },
 {
  "module": "tests.unit.test_grpc_call_cases",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Dataclass bounds/validation for gRPC call cases."
 },
 {
  "module": "tests.unit.test_grpc_descriptors",
  "category": "DELETE",
  "tests_before": 10,
  "kept_tests": 0,
  "location": null,
  "protects": "Protobuf descriptor closure validation unit tests; exercised implicitly by the real gRPC lifecycle."
 },
 {
  "module": "tests.unit.test_grpc_lifecycle",
  "category": "SMOKE",
  "tests_before": 3,
  "kept_tests": 2,
  "location": "tests.smoke.test_grpc_lifecycle",
  "protects": "Default native gRPC acceptance launches a real child service, accepts all four RPC shapes, refuses a wrong response, and always stops the child. Keep normal + wrong-response cases (plus one reflection-drift case merged from test_grpc_transport)."
 },
 {
  "module": "tests.unit.test_grpc_oracle",
  "category": "DELETE",
  "tests_before": 8,
  "kept_tests": 0,
  "location": null,
  "protects": "IPC document binding/refusal unit tests for the gRPC oracle with mocks."
 },
 {
  "module": "tests.unit.test_grpc_reflection",
  "category": "DELETE",
  "tests_before": 10,
  "kept_tests": 0,
  "location": null,
  "protects": "Descriptor reflection normalization/comparison unit tests."
 },
 {
  "module": "tests.unit.test_grpc_transport",
  "category": "MERGE",
  "tests_before": 10,
  "kept_tests": 1,
  "location": "tests.smoke.test_grpc_transport",
  "protects": "Real loopback RPC probe duplicates test_grpc_lifecycle's all-shapes/wrong-response coverage; move only test_reflection_drift_refuses_before_operation_calls into the lifecycle smoke."
 },
 {
  "module": "tests.unit.test_guarded_builder",
  "category": "CRITICAL",
  "tests_before": 43,
  "kept_tests": 6,
  "location": "tests.critical.test_guarded_builder",
  "protects": "Sandboxed build authorization: the compiler cannot start without valid, unrevoked, unexpired authorization; source drift during compilation and undeclared outputs are rejected; a real Python and a real C++ build succeed; timeouts kill descendants. Keep test_valid_authorization_builds_checked_hash_bytecode, test_valid_authorization_builds_native_executable, test_revoked_authorization_prevents_compiler_call, test_source_drift_during_native_compilation_is_rejected, test_staged_native_artifact_rejects_undeclared_output_before_publish, test_timeout_kills_compiler_descendants."
 },
 {
  "module": "tests.unit.test_guarded_rust_builder",
  "category": "MERGE",
  "tests_before": 15,
  "kept_tests": 1,
  "location": "tests.critical.test_guarded_rust_builder",
  "protects": "Rust variant of the same guarded-builder authorization/drift invariants; keep only test_valid_authorization_builds_runnable_native_executable as a Rust case in the guarded-builder module."
 },
 {
  "module": "tests.unit.test_harness_inventory",
  "category": "E2E",
  "tests_before": 63,
  "kept_tests": 8,
  "location": "tests.e2e.test_harness_inventory",
  "protects": "`litai init --convert` on real legacy trees (Make, Python, CMake, repo-man, nested siblings) produces a harness inventory and a wrapper that actually executes, restores the exact tree on failing gates, refuses cwd escapes, and redacts secrets. Keep test_convert_produces_inventory_and_wrapper_that_executes, test_refined_convert_installs_independent_retained_components, test_convert_python_make_repo_validates_and_admits_derived_spec, test_failing_legacy_gate_restores_exact_pre_conversion_tree, test_cmake_repository_converts_with_cmake_flavor_selected, test_repo_man_convert_emits_nested_wrapper_targets, test_wrapper_recipe_rejects_cwd_escape, test_harness_diagnostic_excerpt_redacts_environment_secrets."
 },
 {
  "module": "tests.unit.test_harness_workspace",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Sibling link resolution/validation unit tests; real sibling topology is covered by test_harness_inventory's convert scenario."
 },
 {
  "module": "tests.unit.test_homebrew_formula",
  "category": "SMOKE",
  "tests_before": 2,
  "kept_tests": 1,
  "location": "tests.smoke.test_homebrew_formula",
  "protects": "Keep test_formula_uses_python_virtualenv_and_avoids_codegraph: the rendered Homebrew formula (a release install path) is valid for the current version."
 },
 {
  "module": "tests.unit.test_host_bootstrap",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Mocked worker bootstrap delegation and structured-failure shaping; host install behavior is covered by test_host_install."
 },
 {
  "module": "tests.unit.test_host_component_lifecycle",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "In-memory session/one-shot parity and resume-boundary unit tests of the application layer."
 },
 {
  "module": "tests.unit.test_host_install",
  "category": "CRITICAL",
  "tests_before": 14,
  "kept_tests": 2,
  "location": "tests.critical.test_host_install",
  "protects": "Managed host-toolchain artifacts are digest-verified and path traversal is refused before install (supply-chain). Keep test_managed_artifact_verifies_digest_and_normalizes_name and test_managed_artifact_rejects_digest_mismatch_and_traversal; SBOM/winget/target-detection cases are unit tests."
 },
 {
  "module": "tests.unit.test_host_path_policy",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Tests a repo lint script (check_host_path_policy); belongs in a lint job, not the test suite."
 },
 {
  "module": "tests.unit.test_host_regenerative_qualification",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "HMAC attestor/checkpoint/profile unit tests; regenerative qualification itself is covered by conformance inverse-regenerative-parity E2E."
 },
 {
  "module": "tests.unit.test_host_self_update",
  "category": "CRITICAL",
  "tests_before": 19,
  "kept_tests": 3,
  "location": "tests.critical.test_host_self_update",
  "protects": "CLI self-update supply chain and safety: only newer non-prerelease wheels from the embedded origin are selected (no downgrade), staging never touches the venv, and a busy lock or failed pip leaves the install intact. Keep test_selects_newer_wheel_and_rejects_downgrade_prerelease_and_missing_asset, test_stage_writes_wheel_without_touching_venv, test_apply_skips_when_lock_busy_or_pip_fails."
 },
 {
  "module": "tests.unit.test_host_uninstall",
  "category": "CRITICAL",
  "tests_before": 7,
  "kept_tests": 2,
  "location": "tests.critical.test_host_uninstall",
  "protects": "Uninstall data-loss safety: removes only manifest-bound runtime/launcher, refuses manifest mismatch/symlinks, and preserves independently owned data. Keep test_manifest_mismatch_and_symlink_fail_closed and test_independently_owned_application_data_survives_idempotently."
 },
 {
  "module": "tests.unit.test_html_dag_view",
  "category": "DELETE",
  "tests_before": 8,
  "kept_tests": 0,
  "location": null,
  "protects": "DAG view template/asset-binding details; escaping is kept once in test_html_emitter and rendering in test_html_render/installed HTML smoke."
 },
 {
  "module": "tests.unit.test_html_dashboard",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Dashboard pane composition/byte-stability unit tests; secondary surface."
 },
 {
  "module": "tests.unit.test_html_emitter",
  "category": "SMOKE",
  "tests_before": 14,
  "kept_tests": 2,
  "location": "tests.smoke.test_html_emitter",
  "protects": "HTML emitter renders the actual project graph to a valid single-file artifact and escapes every untrusted graph string (XSS). Keep test_actual_project_emits_existing_graph_and_valid_artifact and test_every_untrusted_graph_string_is_escaped_in_html_and_json."
 },
 {
  "module": "tests.unit.test_html_framework",
  "category": "DELETE",
  "tests_before": 12,
  "kept_tests": 0,
  "location": null,
  "protects": "Synthetic-wheel installation-binding unit tests (docstring says not release proof); covered by installed HTML smoke."
 },
 {
  "module": "tests.unit.test_html_lock_health",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Lock-health HTML view details; duplicated by tests.unit.test_installed_lock_health_smoke."
 },
 {
  "module": "tests.unit.test_html_observability_schema",
  "category": "DELETE",
  "tests_before": 15,
  "kept_tests": 0,
  "location": null,
  "protects": "Published JSON-schema conformance and adversarial schema checks; pure schema validation."
 },
 {
  "module": "tests.unit.test_html_phase2_surfaces",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Phase-2 performance/workflow surface rendering details."
 },
 {
  "module": "tests.unit.test_html_publication",
  "category": "CRITICAL",
  "tests_before": 20,
  "kept_tests": 2,
  "location": "tests.critical.test_html_publication",
  "protects": "No-clobber output publication: a foreign existing destination is refused and a concurrently replaced file is preserved (no user data loss). Keep test_existing_foreign_destination_refuses_no_clobber_publish and test_replaced_file_on_writer_close_is_preserved; the other 18 are clock/race permutations."
 },
 {
  "module": "tests.unit.test_html_render",
  "category": "SMOKE",
  "tests_before": 20,
  "kept_tests": 3,
  "location": "tests.smoke.test_html_render",
  "protects": "Public `litai` HTML render CLI: success envelope and byte-stable repeat, typed nonzero refusals, and foreign/edited output preserved. Keep test_public_cli_envelope_schema_success_and_repeat, test_public_cli_refusals_are_nonzero_typed_results, test_foreign_or_edited_output_is_preserved_without_cache_creation."
 },
 {
  "module": "tests.unit.test_html_render_core",
  "category": "DELETE",
  "tests_before": 14,
  "kept_tests": 0,
  "location": null,
  "protects": "Render record contracts, identity projection and wire validation; dataclass/schema unit tests."
 },
 {
  "module": "tests.unit.test_html_source_excerpts",
  "category": "CRITICAL",
  "tests_before": 10,
  "kept_tests": 1,
  "location": "tests.critical.test_html_source_excerpts",
  "protects": "Keep test_links_and_linked_parent_directories_refuse: HTML source previews must not follow symlinks out of the project (disclosure of host files); limit/encoding cases are unit tests."
 },
 {
  "module": "tests.unit.test_html_staleness",
  "category": "SMOKE",
  "tests_before": 25,
  "kept_tests": 3,
  "location": "tests.smoke.test_html_staleness",
  "protects": "Public HTML `verify` verdicts over real files: current artifact passes, a changed source is named stale, and artifact drift at final observation refuses. Keep test_current_artifact_matches_contract_and_preserves_all_files, test_actual_changed_source_is_named_in_stale_report, test_artifact_drift_at_final_observation_is_preserved_and_refuses."
 },
 {
  "module": "tests.unit.test_html_staleness_contract",
  "category": "DELETE",
  "tests_before": 10,
  "kept_tests": 0,
  "location": null,
  "protects": "Staleness report record validation/round-trips; contract unit tests."
 },
 {
  "module": "tests.unit.test_html_surfaces",
  "category": "DELETE",
  "tests_before": 11,
  "kept_tests": 0,
  "location": null,
  "protects": "Authority-graph surface wire round-trips and refusals; actual-project rendering is covered by test_html_emitter/test_html_render."
 },
 {
  "module": "tests.unit.test_html_verification_health",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Verification-health view rendering details; secondary surface."
 },
 {
  "module": "tests.unit.test_html_version_health",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Version-health view rendering details; secondary surface."
 },
 {
  "module": "tests.unit.test_http_shared_artifacts",
  "category": "CRITICAL",
  "tests_before": 9,
  "kept_tests": 3,
  "location": "tests.critical.test_http_shared_artifacts",
  "protects": "Real-HTTP shared artifact cache custody: partial/corrupt entries are misses or refused, poisoned manifests refused, and redirects never forward credentials. Keep test_partial_publication_is_a_miss_and_corruption_is_refused, test_poisoned_manifest_and_conflicting_publication_are_refused, test_redirect_does_not_forward_credentials (cold->warm case optional as smoke)."
 },
 {
  "module": "tests.unit.test_impact",
  "category": "DELETE",
  "tests_before": 1,
  "kept_tests": 0,
  "location": null,
  "protects": "Single in-memory impact-propagation unit test of an internal library function."
 },
 {
  "module": "tests.unit.test_inherited_session_provider",
  "category": "CRITICAL",
  "tests_before": 14,
  "kept_tests": 4,
  "location": "tests.critical.test_inherited_session_provider",
  "protects": "Authenticated inherited-session provider protocol: authentication/session mismatch, payload tamper, and replay/disconnect all fail closed, so a spoofed or reflected session cannot impersonate the coordinator."
 },
 {
  "module": "tests.unit.test_install_litai",
  "category": "SMOKE",
  "tests_before": 12,
  "kept_tests": 2,
  "location": "tests.smoke.test_install_litai",
  "protects": "Host installer refuses dirty/untracked git checkouts with an actionable error and stops before pip when host preflight fails."
 },
 {
  "module": "tests.unit.test_installed_e2e_gate",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Mocked subprocess check of the installed-E2E sentinel bookkeeping; tests the release gate's cache file, not product behavior."
 },
 {
  "module": "tests.unit.test_installed_html_smoke",
  "category": "DELETE",
  "tests_before": 18,
  "kept_tests": 0,
  "location": null,
  "protects": "Synthetic-record tests of the wheel-smoke HTML oracle (self-described as not installed-wheel proof); the real installed-wheel HTML journey is the evidence."
 },
 {
  "module": "tests.unit.test_installed_html_update_smoke",
  "category": "DELETE",
  "tests_before": 11,
  "kept_tests": 0,
  "location": null,
  "protects": "Acceptance-oracle tests for the HTML update smoke script using synthetic reports; duplicative of the real installed-wheel update journey."
 },
 {
  "module": "tests.unit.test_installed_lock_health_smoke",
  "category": "MERGE",
  "tests_before": 2,
  "kept_tests": 1,
  "location": "tests.smoke.test_installed_lock_health_smoke",
  "protects": "Real lock-state transitions rendering bound HTML via in-process CLI; the scenario belongs in the actual installed-wheel smoke rather than a synthetic-wheel replica."
 },
 {
  "module": "tests.unit.test_intent_refinement",
  "category": "SMOKE",
  "tests_before": 4,
  "kept_tests": 1,
  "location": "tests.smoke.test_intent_refinement",
  "protects": "`litai design refine/explain/accept` public CLI flow including blocking-decision refusal and acceptance receipt."
 },
 {
  "module": "tests.unit.test_ipc_surface_acceptance",
  "category": "SMOKE",
  "tests_before": 38,
  "kept_tests": 3,
  "location": "tests.smoke.test_ipc_surface_acceptance",
  "protects": "IPC surface conformance oracle: matching served description passes, mismatched/missing description fails closed, persistent service routes to IPC conformance."
 },
 {
  "module": "tests.unit.test_isolation_contracts",
  "category": "CRITICAL",
  "tests_before": 15,
  "kept_tests": 3,
  "location": "tests.critical.test_isolation_contracts",
  "protects": "Sandbox isolation decision: absent backend/unconfigured stage fail closed, weaker or wrong-target observations never pass, host-yolo needs both policy and request acknowledgement."
 },
 {
  "module": "tests.unit.test_isolation_schemas",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Wire-schema round-trips and field validation for isolation reports; the security decision is covered by test_isolation_contracts."
 },
 {
  "module": "tests.unit.test_issue_first_work_skill",
  "category": "DELETE",
  "tests_before": 1,
  "kept_tests": 0,
  "location": null,
  "protects": "Asserts prose in a skill document; no executable behavior."
 },
 {
  "module": "tests.unit.test_javascript_builder",
  "category": "CRITICAL",
  "tests_before": 36,
  "kept_tests": 5,
  "location": "tests.critical.test_javascript_builder",
  "protects": "Authorization-gated Node build: valid authorization builds/seals bundle, unsandboxed build requires explicit yolo grant, npm runtime guard rejects undeclared package loads and distribution escapes, cached bundle verified before reuse."
 },
 {
  "module": "tests.unit.test_javascript_ecosystem_skill",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Skill-text/byte-identity assertions on documentation; belongs in a lint, not the test suite."
 },
 {
  "module": "tests.unit.test_javascript_generation_self_check",
  "category": "SMOKE",
  "tests_before": 9,
  "kept_tests": 2,
  "location": "tests.smoke.test_javascript_generation_self_check",
  "protects": "JavaScript generation rejects a broken single-file bundle before index/cache publication, and a valid bundle executes its modes."
 },
 {
  "module": "tests.unit.test_javascript_library_acceptance",
  "category": "SMOKE",
  "tests_before": 12,
  "kept_tests": 3,
  "location": "tests.smoke.test_javascript_library_acceptance",
  "protects": "Native node library-function oracle: correct function passes, incorrect result rejected, launcher drift during execution cannot issue evidence."
 },
 {
  "module": "tests.unit.test_known_failure_checkpoints",
  "category": "SMOKE",
  "tests_before": 21,
  "kept_tests": 3,
  "location": "tests.smoke.test_known_failure_checkpoints",
  "protects": "Known-failure annotations suppress only the exact test, stay non-passing, never apply to release runs or changed context, and the `litai project test-checkpoint` CLI works end to end."
 },
 {
  "module": "tests.unit.test_language_command_profile_entrypoint",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Command-profile prompt/entrypoint unit checks with no end-to-end behavior."
 },
 {
  "module": "tests.unit.test_learning",
  "category": "SMOKE",
  "tests_before": 10,
  "kept_tests": 2,
  "location": "tests.smoke.test_learning",
  "protects": "`litai learn` emits one proposal without writing authority and rejects non-contract input."
 },
 {
  "module": "tests.unit.test_library_acceptance",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Loader validation of library acceptance documents; harness drift is exercised by the library acceptance smoke modules."
 },
 {
  "module": "tests.unit.test_library_exports",
  "category": "MERGE",
  "tests_before": 9,
  "kept_tests": 1,
  "location": "tests.e2e.test_library_exports",
  "protects": "Library build/test retain the library and `run` refuses a non-executable library; valuable but here driven through heavily patched CLI dispatch, should be a real library sample step."
 },
 {
  "module": "tests.unit.test_library_products",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Typed projection/wire-shape round-trip of library products."
 },
 {
  "module": "tests.unit.test_lifecycle_lock",
  "category": "CRITICAL",
  "tests_before": 5,
  "kept_tests": 2,
  "location": "tests.critical.test_lifecycle_lock",
  "protects": "Project lifecycle lock rejects a second concurrent mutation (issue #318 data race) and a crashed holder does not leave a permanent stale lock."
 },
 {
  "module": "tests.unit.test_lifecycle_migration_bridge",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Typed delegation contract of an internal migration bridge with an echo port."
 },
 {
  "module": "tests.unit.test_lint_render_acceptance",
  "category": "SMOKE",
  "tests_before": 8,
  "kept_tests": 2,
  "location": "tests.smoke.test_lint_render_acceptance",
  "protects": "Project acceptance uses lint-render snapshot oracle for hand-authored library/UI components and surfaces render drift."
 },
 {
  "module": "tests.unit.test_linux_cgroup_budget",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Self-described parsing/custody fixtures, not kernel enforcement; no proof of the actual budget."
 },
 {
  "module": "tests.unit.test_linux_loader_paths",
  "category": "DELETE",
  "tests_before": 8,
  "kept_tests": 0,
  "location": null,
  "protects": "Loader-env parsing/ordering unit tests."
 },
 {
  "module": "tests.unit.test_literate_markdown_adapter",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Spec-markdown parsing unit tests; every sample E2E parses real specifications through this adapter."
 },
 {
  "module": "tests.unit.test_live_roundtrip_helpers",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Unit tests of a live-test comparison helper."
 },
 {
  "module": "tests.unit.test_live_test_selection",
  "category": "DELETE",
  "tests_before": 19,
  "kept_tests": 0,
  "location": null,
  "protects": "Configuration-precedence and env-quoting tests for the live-test harness with mocked runners; harness misconfiguration surfaces immediately in live runs."
 },
 {
  "module": "tests.unit.test_local_attestation",
  "category": "CRITICAL",
  "tests_before": 3,
  "kept_tests": 2,
  "location": "tests.critical.test_local_attestation",
  "protects": "Local source attestation is tamper-evident and the key reader rejects weak/symlinked keys."
 },
 {
  "module": "tests.unit.test_local_lifecycle_adapters",
  "category": "SMOKE",
  "tests_before": 4,
  "kept_tests": 2,
  "location": "tests.smoke.test_local_lifecycle_adapters",
  "protects": "Provider-neutral lifecycle with real local adapters: generated tree is validated, classified, built and committed, and materialization proves containment before writing."
 },
 {
  "module": "tests.unit.test_local_observation_sandbox",
  "category": "CRITICAL",
  "tests_before": 17,
  "kept_tests": 4,
  "location": "tests.critical.test_local_observation_sandbox",
  "protects": "Source-observation sandbox: real macOS sandbox denies source writes/network/host env, missing sandbox never falls back to unsandboxed, mismatched authorization fails before process creation, timeout kills the process group."
 },
 {
  "module": "tests.unit.test_local_test_handoff",
  "category": "E2E",
  "tests_before": 3,
  "kept_tests": 2,
  "location": "tests.e2e.test_local_test_handoff",
  "protects": "Local BUILD output is tested by an isolated worker from CAS after original paths are removed, without rerunning BUILD; failed build never publishes a handoff."
 },
 {
  "module": "tests.unit.test_locked_generation_authority",
  "category": "CRITICAL",
  "tests_before": 10,
  "kept_tests": 2,
  "location": "tests.critical.test_locked_generation_authority",
  "protects": "Generation authority refuses forged/non-canonical component locks and effective-graph drift, so generation cannot run against stale or tampered authority."
 },
 {
  "module": "tests.unit.test_locked_source_promotion",
  "category": "CRITICAL",
  "tests_before": 12,
  "kept_tests": 2,
  "location": "tests.critical.test_locked_source_promotion",
  "protects": "Regenerative source promotion only qualifies under the exact current component lock; stale lock evidence and store bypass fail closed."
 },
 {
  "module": "tests.unit.test_mac_project_contract",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Deterministic projection/writer unit tests for a build-closure contract file."
 },
 {
  "module": "tests.unit.test_macos_dyld_fact_memo",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Cache-memo implementation details for dyld_info inspection."
 },
 {
  "module": "tests.unit.test_macos_loader_observation",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Fixture-observer unit tests for Mach-O path resolution."
 },
 {
  "module": "tests.unit.test_macos_loader_paths",
  "category": "DELETE",
  "tests_before": 8,
  "kept_tests": 0,
  "location": null,
  "protects": "Loader path ordering/validation unit tests."
 },
 {
  "module": "tests.unit.test_make_generation_skill",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Skill-document text and byte-identity checks."
 },
 {
  "module": "tests.unit.test_make_python_bootstrap",
  "category": "DELETE",
  "tests_before": 15,
  "kept_tests": 0,
  "location": null,
  "protects": "Repository Makefile bootstrap details (mostly `make -n` output assertions); CI invoking make is itself the real smoke for this."
 },
 {
  "module": "tests.unit.test_make_toolchain",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "GNU Make discovery unit tests with fixtures."
 },
 {
  "module": "tests.unit.test_matrix_lock_reads",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Storage-initialization implementation detail of matrix lock reads."
 },
 {
  "module": "tests.unit.test_mcp_runtime",
  "category": "SMOKE",
  "tests_before": 14,
  "kept_tests": 2,
  "location": "tests.smoke.test_mcp_runtime",
  "protects": "MCP runtime: stdio JSON-RPC transport works against a stub server and author events fan out to configured channels."
 },
 {
  "module": "tests.unit.test_mcp_server",
  "category": "SMOKE",
  "tests_before": 9,
  "kept_tests": 3,
  "location": "tests.smoke.test_mcp_server",
  "protects": "`litai` MCP server: initialize/tools-list works, paths and symlinks cannot escape the session root, mutations require explicit acknowledgement."
 },
 {
  "module": "tests.unit.test_migration_characterization_baseline",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": "tests.support.migration_characterization (helpers only)",
  "protects": "Historical characterization fixtures and identity-hash pinning; asserts recorded observations, not current product behavior."
 },
 {
  "module": "tests.unit.test_model_provider_portfolio",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Endpoint dispatch unit test with fake providers."
 },
 {
  "module": "tests.unit.test_model_routing_identity",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Canonical identity/number formatting unit tests."
 },
 {
  "module": "tests.unit.test_model_scopes",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Model-scope schema round-trips and validation."
 },
 {
  "module": "tests.unit.test_model_selection_stack",
  "category": "DELETE",
  "tests_before": 11,
  "kept_tests": 0,
  "location": null,
  "protects": "Internal model stack push/pop and logging details."
 },
 {
  "module": "tests.unit.test_model_source_to_specification",
  "category": "SMOKE",
  "tests_before": 15,
  "kept_tests": 2,
  "location": "tests.smoke.test_model_source_to_specification",
  "protects": "Inverse source-to-specification pipeline with scripted model: four-language calls emit journaled base/flavor drafts, and skill identity drift fails before model egress."
 },
 {
  "module": "tests.unit.test_models_workflows",
  "category": "SMOKE",
  "tests_before": 13,
  "kept_tests": 3,
  "location": "tests.smoke.test_models_workflows",
  "protects": "Durable workflow DAG resumes after process restart without repeating completed stages, attempt budget survives restarts, and remote model endpoints are refused when egress is none."
 },
 {
  "module": "tests.unit.test_monorepo_adoption",
  "category": "SMOKE",
  "tests_before": 20,
  "kept_tests": 3,
  "location": "tests.smoke.test_monorepo_adoption",
  "protects": "`litai onboard adopt` multi-root plan: candidates preserve independent roots, apply refuses without baseline execution/acknowledgement or on plan change, and reviewed plan routes to the mutator."
 },
 {
  "module": "tests.unit.test_monorepo_components",
  "category": "E2E",
  "tests_before": 32,
  "kept_tests": 5,
  "location": "tests.e2e.test_monorepo_components",
  "protects": "Real per-root retained harness execution for monorepo components: whole-bundle receipts check, install publishes source-free components, failed tests never publish receipts, rollback preserves foreign paths, receipt tampering rejected."
 },
 {
  "module": "tests.unit.test_monorepo_input_reads",
  "category": "CRITICAL",
  "tests_before": 10,
  "kept_tests": 2,
  "location": "tests.critical.test_monorepo_input_reads",
  "protects": "Monorepo custody validates the opened file: symlink/replacement-before-open is not read or hashed."
 },
 {
  "module": "tests.unit.test_multi_entrypoint_acceptance",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Oracle resolver unit test for multi-entrypoint routing."
 },
 {
  "module": "tests.unit.test_multi_entrypoint_build",
  "category": "SMOKE",
  "tests_before": 1,
  "kept_tests": 1,
  "location": "tests.smoke.test_multi_entrypoint_build",
  "protects": "Standalone multi-output build driver actually runs under isolated host Python and materializes every export."
 },
 {
  "module": "tests.unit.test_multi_entrypoint_generation",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Recipe binding validation unit tests."
 },
 {
  "module": "tests.unit.test_native_cli_acceptance",
  "category": "SMOKE",
  "tests_before": 4,
  "kept_tests": 2,
  "location": "tests.smoke.test_native_cli_acceptance",
  "protects": "Packaged native CLI acceptance accepts the exact declared filesystem delta and rejects undeclared writes."
 },
 {
  "module": "tests.unit.test_native_cpp_cache",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Mocked compiler-cache argv routing; implementation details of wrapper placement."
 },
 {
  "module": "tests.unit.test_native_metadata_packaging",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Deterministic metadata file generation unit test."
 },
 {
  "module": "tests.unit.test_native_project_registry",
  "category": "CRITICAL",
  "tests_before": 5,
  "kept_tests": 2,
  "location": "tests.critical.test_native_project_registry",
  "protects": "Adopted child registry retains both children under concurrent registration and failed replace preserves the existing registry (no data loss)."
 },
 {
  "module": "tests.unit.test_native_sdk_acquisition",
  "category": "E2E",
  "tests_before": 2,
  "kept_tests": 1,
  "location": "tests.e2e.test_native_sdk_acquisition",
  "protects": "A generated application completes the public native-SDK lifecycle (real SDK build, locked generation, generated tests, acceptance oracle) after source removal."
 },
 {
  "module": "tests.unit.test_native_sdk_build",
  "category": "E2E",
  "tests_before": 7,
  "kept_tests": 2,
  "location": "tests.e2e.test_native_sdk_build",
  "protects": "Real CMake build of a vendored native SDK through repository admission, retained for relocation; revocation after configure prevents compilation."
 },
 {
  "module": "tests.unit.test_native_sdk_closure",
  "category": "MERGE",
  "tests_before": 2,
  "kept_tests": 1,
  "location": "tests.e2e.test_native_sdk_closure",
  "protects": "Linked-provider SDK execution from a relocated package; should be one extra scenario on the shared native SDK lifecycle fixture instead of rebuilding it (226s)."
 },
 {
  "module": "tests.unit.test_native_sdk_commands",
  "category": "MERGE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Projected application/library commands use verified native imports; the lifecycle E2E already executes these commands."
 },
 {
  "module": "tests.unit.test_native_sdk_consumer",
  "category": "MERGE",
  "tests_before": 5,
  "kept_tests": 1,
  "location": "tests.e2e.test_native_sdk_consumer",
  "protects": "Bound SDK inputs relocate, run and clean up without source; the lifecycle E2E removes source and consumes the SDK, so add a cleanup assertion there."
 },
 {
  "module": "tests.unit.test_native_sdk_consumer_build",
  "category": "MERGE",
  "tests_before": 4,
  "kept_tests": 1,
  "location": "tests.e2e.test_native_sdk_consumer_build",
  "protects": "Revocation/drift after compilation blocks artifact publication; keep one revocation assertion in the native SDK build E2E."
 },
 {
  "module": "tests.unit.test_native_sdk_custody",
  "category": "CRITICAL",
  "tests_before": 7,
  "kept_tests": 3,
  "location": "tests.critical.test_native_sdk_custody",
  "protects": "SDK CAS byte custody refuses replayed bindings, corrupt/missing blobs (no partial directory) and symlink/concurrent-mutation captures; keep those 3, drop schema round-trip and alias cases."
 },
 {
  "module": "tests.unit.test_native_sdk_dependencies",
  "category": "MERGE",
  "tests_before": 5,
  "kept_tests": 1,
  "location": "tests.e2e.test_native_sdk_dependencies",
  "protects": "Assert once in the shared native-SDK E2E that CycloneDX/loader evidence survives relocation; scope-combination and duplicate-input cases are SBOM unit logic."
 },
 {
  "module": "tests.unit.test_native_sdk_execution",
  "category": "MERGE",
  "tests_before": 2,
  "kept_tests": 2,
  "location": "tests.e2e.test_native_sdk_execution",
  "protects": "Standard command running a real SDK import plus revocation refusal should be one scenario in the shared native-SDK E2E."
 },
 {
  "module": "tests.unit.test_native_sdk_fixture",
  "category": "SMOKE",
  "tests_before": 1,
  "kept_tests": 1,
  "location": "tests.smoke.test_native_sdk_fixture",
  "protects": "Fast toolchain baseline proving the native fixture compiles, runs relocated, and fails when the library is missing; catches broken host toolchains before the expensive chain."
 },
 {
  "module": "tests.unit.test_native_sdk_generation",
  "category": "DELETE",
  "tests_before": 1,
  "kept_tests": 0,
  "location": null,
  "protects": "Projection of admitted SDK into generation recipes is internal binding logic already exercised by the build/package E2E."
 },
 {
  "module": "tests.unit.test_native_sdk_library",
  "category": "MERGE",
  "tests_before": 1,
  "kept_tests": 1,
  "location": "tests.e2e.test_native_sdk_library",
  "protects": "Library-adapter verifier on a relocated packaged SDK is a second entrypoint kind; add it as one scenario reusing the shared built package."
 },
 {
  "module": "tests.unit.test_native_sdk_package",
  "category": "MERGE",
  "tests_before": 2,
  "kept_tests": 1,
  "location": "tests.e2e.test_native_sdk_package",
  "protects": "Relocated package runs without source/CAS and detects drift; fold the drift check into the packaged-execution E2E."
 },
 {
  "module": "tests.unit.test_native_sdk_packaged_execution",
  "category": "E2E",
  "tests_before": 1,
  "kept_tests": 1,
  "location": "tests.e2e.test_native_sdk_packaged_execution",
  "protects": "Anchor E2E: a real native SDK is built from source, packaged, the producer deleted, and the Standard package still launches after relocation. Absorb execution/library/service/standard_authority/package/dependencies scenarios here against one shared build."
 },
 {
  "module": "tests.unit.test_native_sdk_preparation",
  "category": "DELETE",
  "tests_before": 1,
  "kept_tests": 0,
  "location": null,
  "protects": "Planning/node-preparation key and bounded-context ownership checks are internal planning details."
 },
 {
  "module": "tests.unit.test_native_sdk_recipes",
  "category": "MERGE",
  "tests_before": 6,
  "kept_tests": 1,
  "location": "tests.e2e.test_native_sdk_recipes",
  "protects": "Recipe-driven real native build is the fixture underlying source_build; keep only 'changed recipe content rejected by locked-input custody' there; schema/slot validation cases are unit tests."
 },
 {
  "module": "tests.unit.test_native_sdk_runtime",
  "category": "CRITICAL",
  "tests_before": 13,
  "kept_tests": 2,
  "location": "tests.critical.test_native_sdk_runtime",
  "protects": "Native image observation rejects changed SDK bytes and changed runtime-dependency bytes (tamper detection on admitted binaries); remaining 11 PE/graph counterexamples are parser unit tests."
 },
 {
  "module": "tests.unit.test_native_sdk_service",
  "category": "MERGE",
  "tests_before": 1,
  "kept_tests": 1,
  "location": "tests.e2e.test_native_sdk_service",
  "protects": "Persistent-service entrypoint start/stop/revocation over real HTTP; keep as one scenario of the packaged-execution E2E reusing its package."
 },
 {
  "module": "tests.unit.test_native_sdk_source_build",
  "category": "E2E",
  "tests_before": 7,
  "kept_tests": 2,
  "location": "tests.e2e.test_native_sdk_source_build",
  "protects": "Real policy-governed native source build with cache and relocated execution, plus one fail-closed: source changed after configure stops compile/admission."
 },
 {
  "module": "tests.unit.test_native_sdk_standard_authority",
  "category": "MERGE",
  "tests_before": 3,
  "kept_tests": 1,
  "location": "tests.e2e.test_native_sdk_standard_authority",
  "protects": "Corrupted SDK custody refusing after intent/authorization (TOCTOU) is worth one scenario in the shared E2E; BOM-writer and identity binding checks are unit-level."
 },
 {
  "module": "tests.unit.test_normalize_skill_authoring",
  "category": "DELETE",
  "tests_before": 1,
  "kept_tests": 0,
  "location": null,
  "protects": "Manifest normalization helper unit test."
 },
 {
  "module": "tests.unit.test_npm_constraint_authority",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Catalog/SBOM version-range consistency check; static data contract."
 },
 {
  "module": "tests.unit.test_nvidia_stack",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Candidate-selection unit logic with synthetic inputs."
 },
 {
  "module": "tests.unit.test_openai_compatible_adapter",
  "category": "CRITICAL",
  "tests_before": 4,
  "kept_tests": 2,
  "location": "tests.critical.test_openai_compatible_adapter",
  "protects": "Model adapter never leaks the credential into recorded provenance and rejects source egress before any transport call."
 },
 {
  "module": "tests.unit.test_openspec_adapter",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Snapshot parser and budget unit tests."
 },
 {
  "module": "tests.unit.test_operational_regenerative_qualification",
  "category": "CRITICAL",
  "tests_before": 11,
  "kept_tests": 2,
  "location": "tests.critical.test_operational_regenerative_qualification",
  "protects": "Qualification attestation fails closed (never claims independence) when source-closure evidence is missing or the audited closure contains source bytes; other cases are runner bookkeeping."
 },
 {
  "module": "tests.unit.test_operator_adoption",
  "category": "SMOKE",
  "tests_before": 28,
  "kept_tests": 4,
  "location": "tests.smoke.test_operator_adoption",
  "protects": "Public status/doctor/onboard CLI happy paths (doctor host preflight, status JSON envelope), onboard apply refusing without acknowledgement, and release-authority claims cannot be forged."
 },
 {
  "module": "tests.unit.test_orchestration_graph",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Graph identity/export shape assertions on pin declarations; implementation detail."
 },
 {
  "module": "tests.unit.test_orchestration_initialization",
  "category": "SMOKE",
  "tests_before": 24,
  "kept_tests": 3,
  "location": "tests.smoke.test_orchestration_initialization",
  "protects": "Reviewed root initialization over real Git preserves originals, requires acknowledgement, and rolls back only owned additions on failure (data-loss guard)."
 },
 {
  "module": "tests.unit.test_orchestration_planning",
  "category": "MERGE",
  "tests_before": 16,
  "kept_tests": 2,
  "location": "tests.smoke.test_orchestration_planning",
  "protects": "Plan/check read-only and stale-plan refusal belong as the first step of the initialization smoke; remaining declaration validation is unit-level."
 },
 {
  "module": "tests.unit.test_orchestration_scaffold",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Planned scaffold byte/identity checks; covered by orchestration initialization smoke."
 },
 {
  "module": "tests.unit.test_ova_compatibility",
  "category": "DELETE",
  "tests_before": 8,
  "kept_tests": 0,
  "location": null,
  "protects": "Legacy OVA record-shape/schema round-trip tests."
 },
 {
  "module": "tests.unit.test_ova_shadow",
  "category": "SMOKE",
  "tests_before": 5,
  "kept_tests": 1,
  "location": "tests.smoke.test_ova_shadow",
  "protects": "Executable OVA shadow report emits JSON and does not modify inputs; one check that the compatibility tool runs."
 },
 {
  "module": "tests.unit.test_package_adapters",
  "category": "E2E",
  "tests_before": 18,
  "kept_tests": 3,
  "location": "tests.e2e.test_package_adapters",
  "protects": "Real package production: deterministic native wheel installs with pip, Conan archive restores in a fresh cache, and verification rejects wrong package bytes."
 },
 {
  "module": "tests.unit.test_package_flavor_catalog",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Static catalog policy/line-ending checks."
 },
 {
  "module": "tests.unit.test_package_release_contracts",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "975 lines of package-plan/release-artifact contract construction; real artifacts are covered by test_project_releases and test_package_adapters."
 },
 {
  "module": "tests.unit.test_packaged_skills",
  "category": "SMOKE",
  "tests_before": 5,
  "kept_tests": 2,
  "location": "tests.smoke.test_packaged_skills",
  "protects": "Installed distribution exposes a complete resolvable skill catalog and the CLI lists packaged skills without a checkout."
 },
 {
  "module": "tests.unit.test_parent_checkout",
  "category": "E2E",
  "tests_before": 6,
  "kept_tests": 3,
  "location": "tests.e2e.test_parent_checkout",
  "protects": "litai project parent checkout clones/updates a real parent repo under parents/<id>, rejects credential-bearing URLs, and reaps git descendants holding output streams."
 },
 {
  "module": "tests.unit.test_peer_work",
  "category": "SMOKE",
  "tests_before": 29,
  "kept_tests": 4,
  "location": "tests.smoke.test_peer_work",
  "protects": "Real-Git peer-work survey at cycle start/end and branch GC: dry-run then delete exact safe branch, and refuse dirty worktree/open review (prevents deleting live work)."
 },
 {
  "module": "tests.unit.test_perf",
  "category": "DELETE",
  "tests_before": 10,
  "kept_tests": 0,
  "location": null,
  "protects": "Telemetry recorder/reader unit tests."
 },
 {
  "module": "tests.unit.test_pinned_input_closure",
  "category": "CRITICAL",
  "tests_before": 5,
  "kept_tests": 2,
  "location": "tests.critical.test_pinned_input_closure",
  "protects": "Pinned input closure rejects mutation and symlink capture/replacement of pinned authority."
 },
 {
  "module": "tests.unit.test_pinned_test_dispatch",
  "category": "CRITICAL",
  "tests_before": 13,
  "kept_tests": 2,
  "location": "tests.critical.test_pinned_test_dispatch",
  "protects": "Test-skip soundness: changing a pin's closure forces re-run and a receipt for one pin never satisfies another; wrong skips would ship untested code. Particularly relevant since CI trimming will lean on this."
 },
 {
  "module": "tests.unit.test_plugin_bundle",
  "category": "SMOKE",
  "tests_before": 5,
  "kept_tests": 2,
  "location": "tests.smoke.test_plugin_bundle",
  "protects": "Release plugin archives are reproducible and bundle skill bytes match the canonical catalog."
 },
 {
  "module": "tests.unit.test_portable_application_compiler",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Specification validation unit tests."
 },
 {
  "module": "tests.unit.test_portable_application_skill",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Template/catalog byte-equality and documentation checks."
 },
 {
  "module": "tests.unit.test_portable_artifact_tree",
  "category": "DELETE",
  "tests_before": 1,
  "kept_tests": 0,
  "location": null,
  "protects": "Single path-ordering unit case; cross-platform custody is exercised by package/native E2Es run on each host."
 },
 {
  "module": "tests.unit.test_process_tree",
  "category": "CRITICAL",
  "tests_before": 13,
  "kept_tests": 2,
  "location": "tests.critical.test_process_tree",
  "protects": "Timeout kills the whole process tree (no orphaned workers) and Windows taskkill only runs the validated System32 executable (no PATH hijack)."
 },
 {
  "module": "tests.unit.test_product_json_acceptance",
  "category": "SMOKE",
  "tests_before": 8,
  "kept_tests": 2,
  "location": "tests.smoke.test_product_json_acceptance",
  "protects": "Real application acceptance run passes on numeric fraction and reports exact identities on mismatch."
 },
 {
  "module": "tests.unit.test_production_build_binding",
  "category": "CRITICAL",
  "tests_before": 4,
  "kept_tests": 2,
  "location": "tests.critical.test_production_build_binding",
  "protects": "A scoped build grant cannot be reused for a substituted containment closure or after rebinding."
 },
 {
  "module": "tests.unit.test_profile_pytest_script",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Developer profiling script wrapper; not product behavior."
 },
 {
  "module": "tests.unit.test_project_agent_development_workflow",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Enum wire round-trip."
 },
 {
  "module": "tests.unit.test_project_authority",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Authority identity/normalization unit tests; staleness detection is covered via project_cli documentation-review E2E."
 },
 {
  "module": "tests.unit.test_project_authority_graph",
  "category": "DELETE",
  "tests_before": 8,
  "kept_tests": 0,
  "location": null,
  "protects": "Graph export/identity details."
 },
 {
  "module": "tests.unit.test_project_ci_targets",
  "category": "DELETE",
  "tests_before": 10,
  "kept_tests": 0,
  "location": null,
  "protects": "Dataclass wire round-trip/validation."
 },
 {
  "module": "tests.unit.test_project_cli",
  "category": "E2E",
  "tests_before": 58,
  "kept_tests": 8,
  "location": "tests.e2e.test_project_cli",
  "protects": "Public litai CLI: init creates a valid starter taxonomy, accepts fresh git repo preserving README, refuses non-empty dir; repository self-validates; plan shows resolved flow; documentation update is read-only and review record refreshes marker atomically; skill-catalog symlink escape refused."
 },
 {
  "module": "tests.unit.test_project_configuration",
  "category": "CRITICAL",
  "tests_before": 17,
  "kept_tests": 3,
  "location": "tests.critical.test_project_configuration",
  "protects": "Project manifest read/lock reject path replacement after open and symlinked lock files, and concurrent updates yield exactly one winner (no lost writes)."
 },
 {
  "module": "tests.unit.test_project_guidance",
  "category": "SMOKE",
  "tests_before": 5,
  "kept_tests": 1,
  "location": "tests.smoke.test_project_guidance",
  "protects": "Guidance CLI output with land CI status bound to the real checkout commit."
 },
 {
  "module": "tests.unit.test_project_html_declarations",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "HTML inventory wire validation."
 },
 {
  "module": "tests.unit.test_project_initialization_adapter",
  "category": "E2E",
  "tests_before": 60,
  "kept_tests": 8,
  "location": "tests.e2e.test_project_initialization_adapter",
  "protects": "Real-Git litai init/convert: preserves git metadata and README, CLI exposes complete result, smart-default flavors, initialized project packages every language closure, credential-bearing origins never persisted, convert quarantines tree, resumes interrupted scaffold, parent preflight failure leaves repo untouched."
 },
 {
  "module": "tests.unit.test_project_lifecycle_driver_adapter",
  "category": "CRITICAL",
  "tests_before": 7,
  "kept_tests": 2,
  "location": "tests.critical.test_project_lifecycle_driver_adapter",
  "protects": "External lifecycle driver rejects implementation drift and environment identity never binds credential values."
 },
 {
  "module": "tests.unit.test_project_lifecycle_driver_bindings",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Discriminated-union wire validation."
 },
 {
  "module": "tests.unit.test_project_lock_health",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Mocked lock-health report aggregation."
 },
 {
  "module": "tests.unit.test_project_mcp",
  "category": "CRITICAL",
  "tests_before": 12,
  "kept_tests": 2,
  "location": "tests.critical.test_project_mcp",
  "protects": "Project MCP declarations reject secrets in body and webhook URLs."
 },
 {
  "module": "tests.unit.test_project_releases",
  "category": "E2E",
  "tests_before": 83,
  "kept_tests": 9,
  "location": "tests.e2e.test_project_releases",
  "protects": "Local-git release lifecycle plan/prepare/check/publish; artifact gate binds checked bytes before publication; receipt re-authenticated before tagging; diverged remote/conflicting tag refused before mutation; prepare rollback; break-glass authorization and GitHub actor spoofing; backport conflict leaves checkout unchanged."
 },
 {
  "module": "tests.unit.test_project_reparenting",
  "category": "SMOKE",
  "tests_before": 12,
  "kept_tests": 2,
  "location": "tests.smoke.test_project_reparenting",
  "protects": "Reparent plan is read-only and apply rechecks; failed validation rolls back both lineage documents."
 },
 {
  "module": "tests.unit.test_project_source_index",
  "category": "SMOKE",
  "tests_before": 17,
  "kept_tests": 2,
  "location": "tests.smoke.test_project_source_index",
  "protects": "Real codegraph sync/check when available, and default-none never constructs an external provider (opt-in only)."
 },
 {
  "module": "tests.unit.test_project_test_receipt",
  "category": "DELETE",
  "tests_before": 10,
  "kept_tests": 0,
  "location": null,
  "protects": "Receipt domain wire/identity unit tests; tamper refusal is covered through test_project_test_receipt_cli."
 },
 {
  "module": "tests.unit.test_project_test_receipt_cli",
  "category": "SMOKE",
  "tests_before": 11,
  "kept_tests": 3,
  "location": "tests.smoke.test_project_test_receipt_cli",
  "protects": "Test-receipt CLI update/check is atomic and exact, a failed or wrong-project candidate cannot replace the current receipt, and component/spec changes stale it."
 },
 {
  "module": "tests.unit.test_project_tracker",
  "category": "SMOKE",
  "tests_before": 13,
  "kept_tests": 2,
  "location": "tests.smoke.test_project_tracker",
  "protects": "Tracker inspect reads origin from real git config and sanitizes userinfo from remotes."
 },
 {
  "module": "tests.unit.test_project_update_adapter",
  "category": "MERGE",
  "tests_before": 11,
  "kept_tests": 2,
  "location": "tests.e2e.test_project_update_adapter",
  "protects": "Three-way plan classification without mutation and repo-move successor origin should be scenarios of the update E2E; rest are conversion-shim edge cases."
 },
 {
  "module": "tests.unit.test_project_update_apply",
  "category": "MERGE",
  "tests_before": 10,
  "kept_tests": 3,
  "location": "tests.e2e.test_project_update_apply",
  "protects": "Conflict/local-only refusal and changed-after-planning refusal (data-loss guards) belong in the update E2E alongside stale_input_refuses_before_writes."
 },
 {
  "module": "tests.unit.test_project_update_conflicts",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Display-only conflict diff formatting."
 },
 {
  "module": "tests.unit.test_project_update_merge",
  "category": "E2E",
  "tests_before": 17,
  "kept_tests": 5,
  "location": "tests.e2e.test_project_update_merge",
  "protects": "litai project update: consecutive updates preserve local overlay and advance base, failed validation restores files and checkpoint exactly, stale input refuses before writes, tampered base fails closed, public CLI merges framework and catalog in one transaction."
 },
 {
  "module": "tests.unit.test_project_update_work_items",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "Advisory work-item formatting/idempotence unit tests."
 },
 {
  "module": "tests.unit.test_project_validation_adapter",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Adapter-level unit checks of project validation and sample taxonomy; the public `litai verify`/project lifecycle already exercises validation."
 },
 {
  "module": "tests.unit.test_project_verify",
  "category": "SMOKE",
  "tests_before": 7,
  "kept_tests": 3,
  "location": "tests.smoke.test_project_verify",
  "protects": "`litai verify` passes on a fresh project, writes nothing, and fails on broken authority (keep those three; gate ordering/selection are CLI details)."
 },
 {
  "module": "tests.unit.test_project_worktrees",
  "category": "SMOKE",
  "tests_before": 5,
  "kept_tests": 2,
  "location": "tests.smoke.test_project_worktrees",
  "protects": "Canonical worktree placement over real Git and the `litai project worktree` CLI report (keep canonical/linked resolve + CLI contract)."
 },
 {
  "module": "tests.unit.test_prompt_master_agent_skill",
  "category": "CRITICAL",
  "tests_before": 4,
  "kept_tests": 1,
  "location": "tests.critical.test_prompt_master_agent_skill",
  "protects": "Keep only the byte-equality check of the vendored upstream license/template (attribution compliance); routing-doc wording checks have no runtime value."
 },
 {
  "module": "tests.unit.test_prompt_routing",
  "category": "SMOKE",
  "tests_before": 5,
  "kept_tests": 2,
  "location": "tests.smoke.test_prompt_routing",
  "protects": "`litai prompt translate` wraps a request in a bounded envelope and fails closed on external task envelopes/empty input."
 },
 {
  "module": "tests.unit.test_provider_resolution",
  "category": "SMOKE",
  "tests_before": 10,
  "kept_tests": 2,
  "location": "tests.smoke.test_provider_resolution",
  "protects": "Authored component/flavor resolution reaching the component-lock CLI, plus fail-closed on unsatisfied requirements; remaining resolution-policy permutations are unit detail."
 },
 {
  "module": "tests.unit.test_public_export_check",
  "category": "CRITICAL",
  "tests_before": 2,
  "kept_tests": 2,
  "location": "tests.critical.test_public_export_check",
  "protects": "Public-export audit rejects internal forge/project/provider references (prevents leaking internal identifiers in releases); 0s."
 },
 {
  "module": "tests.unit.test_published_repository_pack",
  "category": "CRITICAL",
  "tests_before": 6,
  "kept_tests": 2,
  "location": "tests.critical.test_published_repository_pack",
  "protects": "Published history packs are self-contained and corrupted pack/bundle prerequisites are rejected (keep corruption + remote-drift refusal); happy path is covered by refresh E2E."
 },
 {
  "module": "tests.unit.test_published_repository_tree",
  "category": "MERGE",
  "tests_before": 8,
  "kept_tests": 2,
  "location": "tests.e2e.test_published_repository_tree",
  "protects": "Tree-capture tamper refusal (blob corruption/truncated listing, unpublished objects) - move those 2 cases into the publication module; bounds/hash-recompute variants are unit detail."
 },
 {
  "module": "tests.unit.test_published_schema_immutability",
  "category": "CRITICAL",
  "tests_before": 8,
  "kept_tests": 2,
  "location": "tests.critical.test_published_schema_immutability",
  "protects": "Released v0.1.1 schemas and the digest catalog stay byte-frozen under their published URIs (public compatibility promise); keep frozen-bytes and catalog-index checks."
 },
 {
  "module": "tests.unit.test_python_generation_skill",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Asserts wording inside the Python generation skill document; no executable behavior."
 },
 {
  "module": "tests.unit.test_python_install",
  "category": "E2E",
  "tests_before": 13,
  "kept_tests": 3,
  "location": "tests.e2e.test_python_install",
  "protects": "Real offline pip install of a locked wheel set with cleanup, installer-hash pinning, and installed-wrapper tamper detection (needs LITAI_TEST_PIP_WHEEL; otherwise skipped - ensure CI sets it)."
 },
 {
  "module": "tests.unit.test_python_installed",
  "category": "CRITICAL",
  "tests_before": 23,
  "kept_tests": 4,
  "location": "tests.critical.test_python_installed",
  "protects": "Installed-payload custody: RECORD rewriting cannot hide payload changes, RECORD traversal/hash tampering, install-scheme escape and symlink payloads are refused; actual_offline_pip_installation duplicates test_python_install."
 },
 {
  "module": "tests.unit.test_python_resolution",
  "category": "CRITICAL",
  "tests_before": 12,
  "kept_tests": 2,
  "location": "tests.critical.test_python_resolution",
  "protects": "Retained-install resolution rejects payload drift and refuses to let ambient Python observations supplement verified payloads; rest is fixture-heavy contract detail."
 },
 {
  "module": "tests.unit.test_python_source_authority",
  "category": "DELETE",
  "tests_before": 14,
  "kept_tests": 0,
  "location": null,
  "protects": "Requirements/pyproject parsing and normalization unit tests; malformed-input permutations with no E2E-level consequence beyond lock admission."
 },
 {
  "module": "tests.unit.test_python_target",
  "category": "SMOKE",
  "tests_before": 7,
  "kept_tests": 2,
  "location": "tests.smoke.test_python_target",
  "protects": "Real interpreter target probe matches the exact lock and does not load Python startup hooks (sitecustomize/.pth) during probing."
 },
 {
  "module": "tests.unit.test_python_toolchain",
  "category": "SMOKE",
  "tests_before": 11,
  "kept_tests": 2,
  "location": "tests.smoke.test_python_toolchain",
  "protects": "Python toolchain discovery revalidates the selected runtime and an explicit pin fails without PATH fallback; PATH-order/python2 permutations are unit detail."
 },
 {
  "module": "tests.unit.test_python_wheel_archive",
  "category": "CRITICAL",
  "tests_before": 14,
  "kept_tests": 3,
  "location": "tests.critical.test_python_wheel_archive",
  "protects": "Wheel admission refuses payload drift under a valid outer hash, unsafe member paths, and symlink/special members (supply-chain tamper detection)."
 },
 {
  "module": "tests.unit.test_python_wheel_lock",
  "category": "MERGE",
  "tests_before": 18,
  "kept_tests": 2,
  "location": "tests.critical.test_python_wheel_lock",
  "protects": "Move hash_drift and parser_alone_cannot_bypass_standard_admission into the wheel-archive CRITICAL module; graph/marker/extra selection cases are unit detail."
 },
 {
  "module": "tests.unit.test_python_wheel_runtime",
  "category": "E2E",
  "tests_before": 3,
  "kept_tests": 2,
  "location": "tests.e2e.test_python_wheel_runtime",
  "protects": "Launches a real process that imports only retained packages and never falls back to ambient site-packages when payload is missing."
 },
 {
  "module": "tests.unit.test_python_wheelhouse",
  "category": "CRITICAL",
  "tests_before": 8,
  "kept_tests": 2,
  "location": "tests.critical.test_python_wheelhouse",
  "protects": "Wheelhouse staging rejects changed/extra staged bytes and symlink/hardlink aliasing (TOCTOU on dependency bytes)."
 },
 {
  "module": "tests.unit.test_qualification_archive",
  "category": "CRITICAL",
  "tests_before": 4,
  "kept_tests": 1,
  "location": "tests.critical.test_qualification_archive",
  "protects": "A rehashed outer qualification archive cannot hide foreign members."
 },
 {
  "module": "tests.unit.test_qualification_authority",
  "category": "CRITICAL",
  "tests_before": 4,
  "kept_tests": 1,
  "location": "tests.critical.test_qualification_authority",
  "protects": "Verifier expectations come from guarded profile files; a changed case invalidates the guard (keep that one)."
 },
 {
  "module": "tests.unit.test_qualification_capture",
  "category": "CRITICAL",
  "tests_before": 39,
  "kept_tests": 4,
  "location": "tests.critical.test_qualification_capture",
  "protects": "Qualification evidence cannot be forged: real packaged-process recorder reopens after cleanup, rehashed parity cannot preserve a false pass, mutable/changed package bytes refuse, authority drift during final read exposes no capture."
 },
 {
  "module": "tests.unit.test_qualification_lifecycle_runner",
  "category": "CRITICAL",
  "tests_before": 12,
  "kept_tests": 2,
  "location": "tests.critical.test_qualification_lifecycle_runner",
  "protects": "Qualification derived from lifecycle rejects a failed pinned verifier case and source-cache-hit/reused source as evidence of clean runs."
 },
 {
  "module": "tests.unit.test_rebuild_source_cache_protocol",
  "category": "MERGE",
  "tests_before": 13,
  "kept_tests": 2,
  "location": "tests.e2e.test_rebuild_source_cache_protocol",
  "protects": "Move 'cache hit can skip only generation and never claim acceptance' and 'cache hit rejects a foreign component lock' into the rebuild CLI E2E; the rest are typed-protocol cardinality/canonicalization checks."
 },
 {
  "module": "tests.unit.test_refresh_file_custody",
  "category": "MERGE",
  "tests_before": 3,
  "kept_tests": 2,
  "location": "tests.e2e.test_refresh_file_custody",
  "protects": "Physical CRLF custody and ignored-incoming-collision preservation should become assertions inside the refresh-application journeys; this module is also a fixture provider, so extract its setUp/acquire/publish into a shared helper first."
 },
 {
  "module": "tests.unit.test_refresh_framework_locks",
  "category": "CRITICAL",
  "tests_before": 9,
  "kept_tests": 3,
  "location": "tests.critical.test_refresh_framework_locks",
  "protects": "Refresh reservations interoperate with framework lifecycle writers: writers on every root are excluded, an existing holder is preserved, and a real manifest-writer process waits until release."
 },
 {
  "module": "tests.unit.test_refresh_object_capture",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Root object selection/aggregate-bound checks; selection is exercised by every refresh apply journey and publication drift by test_refresh_publication_ownership."
 },
 {
  "module": "tests.unit.test_refresh_publication_ownership",
  "category": "CRITICAL",
  "tests_before": 12,
  "kept_tests": 4,
  "location": "tests.critical.test_refresh_publication_ownership",
  "protects": "Remote proof renewal only under all writer locks; advertisement drift rejects and releases markers; foreign child write during transport is detected and preserved; a saved document cannot construct a live handle."
 },
 {
  "module": "tests.unit.test_refresh_tree_capture",
  "category": "MERGE",
  "tests_before": 5,
  "kept_tests": 1,
  "location": "tests.critical.test_refresh_tree_capture",
  "protects": "Fold 'capture detects and preserves foreign source changes' into the ownership CRITICAL module; selected-tree capture itself is exercised by every refresh apply."
 },
 {
  "module": "tests.unit.test_registry_composition",
  "category": "SMOKE",
  "tests_before": 20,
  "kept_tests": 3,
  "location": "tests.smoke.test_registry_composition",
  "protects": "Core component/flavor graph resolution: transitive diamond dedup and cycle/flavor-conflict failure with machine codes (0s, keep 2); merge-operator and cardinality permutations are unit detail."
 },
 {
  "module": "tests.unit.test_release_contributions",
  "category": "E2E",
  "tests_before": 19,
  "kept_tests": 3,
  "location": "tests.e2e.test_release_contributions",
  "protects": "Release contribution sweep over real Git repos/worktrees: GitHub sweep classification, merged-topic worktree resolution, and fresh-clone fetch of branch dispositions."
 },
 {
  "module": "tests.unit.test_release_contributions_cli",
  "category": "MERGE",
  "tests_before": 5,
  "kept_tests": 1,
  "location": "tests.e2e.test_release_contributions_cli",
  "protects": "Move 'malformed policy never silently changes scope' into the contributions E2E; rest is argument/milestone-template parsing."
 },
 {
  "module": "tests.unit.test_release_files",
  "category": "CRITICAL",
  "tests_before": 4,
  "kept_tests": 2,
  "location": "tests.critical.test_release_files",
  "protects": "Release artifacts cannot be substituted between qualification and publication (same-size substitution fails; remote verification hashes downloaded bytes)."
 },
 {
  "module": "tests.unit.test_release_roadmap_summary",
  "category": "SMOKE",
  "tests_before": 10,
  "kept_tests": 2,
  "location": "tests.smoke.test_release_roadmap_summary",
  "protects": "Release-gating roadmap summary CLI refuses false closure and untargeted/open items (keep CLI CRLF case + full-integration refusal)."
 },
 {
  "module": "tests.unit.test_remote_execution",
  "category": "CRITICAL",
  "tests_before": 19,
  "kept_tests": 3,
  "location": "tests.critical.test_remote_execution",
  "protects": "Worker round trip fails closed: tampered/missing remote evidence rejected on import, cache mismatch fails before lifecycle, control summary redacted."
 },
 {
  "module": "tests.unit.test_remote_library_artifacts",
  "category": "CRITICAL",
  "tests_before": 14,
  "kept_tests": 2,
  "location": "tests.critical.test_remote_library_artifacts",
  "protects": "Worker library package custody: copied-byte tamper fails before publication, and worker run refuses a library before any process starts."
 },
 {
  "module": "tests.unit.test_remote_library_transport",
  "category": "SMOKE",
  "tests_before": 10,
  "kept_tests": 3,
  "location": "tests.smoke.test_remote_library_transport",
  "protects": "Public remote/ssh build-test-run with the library discriminator, plus rehashed bundle cannot bind different zip/artifact bytes."
 },
 {
  "module": "tests.unit.test_remote_sample_fanout",
  "category": "E2E",
  "tests_before": 56,
  "kept_tests": 6,
  "location": "tests.e2e.test_remote_sample_fanout",
  "protects": "Remote fan-out source transport: exact-revision git targets, dirty/untracked git-visible archive capture, mutating-tree refusal, repository-escaping symlink refusal, resumable plan-bound checkpoint, worker process-group termination."
 },
 {
  "module": "tests.unit.test_remote_source_guard",
  "category": "CRITICAL",
  "tests_before": 13,
  "kept_tests": 4,
  "location": "tests.critical.test_remote_source_guard",
  "protects": "Source archive materialization rejects escaping member paths/symlinks, hardlinks/devices/FIFOs and members beneath symlinks before any write (path traversal on workers)."
 },
 {
  "module": "tests.unit.test_remote_standard_toolchains",
  "category": "SMOKE",
  "tests_before": 7,
  "kept_tests": 2,
  "location": "tests.smoke.test_remote_standard_toolchains",
  "protects": "Received worker tools satisfy Flavor constraints via an actual admitted receiver, and commands are never resolved against the controller PATH."
 },
 {
  "module": "tests.unit.test_remote_worker_bootstrap",
  "category": "E2E",
  "tests_before": 23,
  "kept_tests": 5,
  "location": "tests.e2e.test_remote_worker_bootstrap",
  "protects": "`litai worker bootstrap` installs a verified launcher from a wheelhouse; digest mismatch / tampered or omitted dependency fail before install; existing-install drift does not start an installer; timeout kills the whole process tree."
 },
 {
  "module": "tests.unit.test_repository_catalogs",
  "category": "MERGE",
  "tests_before": 10,
  "kept_tests": 2,
  "location": "tests.e2e.test_repository_catalogs",
  "protects": "Component inheritance across repository lineage (private descendant withholds ancestor; local lock evidence not inherited) - add these assertions to the three-repository E2E; rest is planner-internal."
 },
 {
  "module": "tests.unit.test_repository_checkout_skill",
  "category": "E2E",
  "tests_before": 8,
  "kept_tests": 3,
  "location": "tests.e2e.test_repository_checkout_skill",
  "protects": "Repository checkout skill script against real Git+LFS: branch/tag/SHA shallow checkout with complete LFS, unresolved LFS pointer fails closed, missing git-lfs gives a specific failure."
 },
 {
  "module": "tests.unit.test_repository_file_custody",
  "category": "CRITICAL",
  "tests_before": 21,
  "kept_tests": 4,
  "location": "tests.critical.test_repository_file_custody",
  "protects": "Refresh never clobbers user data: additions cannot overwrite foreign files, hardlinked/special nodes and unowned link ancestors refuse, foreign-sibling drift invalidates without removal."
 },
 {
  "module": "tests.unit.test_repository_git",
  "category": "E2E",
  "tests_before": 9,
  "kept_tests": 3,
  "location": "tests.e2e.test_repository_git",
  "protects": "Real Git source locking: exact lock is reproducible and cleans temp source, a moved branch does not retarget a locked admission, ambient GIT_DIR/filter settings cannot change capture."
 },
 {
  "module": "tests.unit.test_repository_index_observation",
  "category": "CRITICAL",
  "tests_before": 4,
  "kept_tests": 1,
  "location": "tests.critical.test_repository_index_observation",
  "protects": "Index preflight never lets Git mutate the user's shared split-index bytes/mtimes."
 },
 {
  "module": "tests.unit.test_repository_initialization_e2e",
  "category": "E2E",
  "tests_before": 1,
  "kept_tests": 1,
  "location": "tests.e2e.test_repository_initialization_e2e",
  "protects": "Three-repository parent chain materializes and plans an inherited sample end to end."
 },
 {
  "module": "tests.unit.test_repository_layout",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Unit tests of scripts/check_repository_layout; the layout gate itself runs against the real repository in CI."
 },
 {
  "module": "tests.unit.test_repository_lifecycle",
  "category": "E2E",
  "tests_before": 19,
  "kept_tests": 5,
  "location": "tests.e2e.test_repository_lifecycle",
  "protects": "Real Git + subprocess retained-child delegation: dependency order with verified resume, failure retains logs and blocks consumers, dirty child/changed plan refuse, local Git filters are refused before status can execute them, SIGTERM cancels owned grandchildren."
 },
 {
  "module": "tests.unit.test_repository_lineage",
  "category": "CRITICAL",
  "tests_before": 9,
  "kept_tests": 1,
  "location": "tests.critical.test_repository_lineage",
  "protects": "Parent URLs/revision selectors reject embedded credentials and option-like inputs (git argument injection); remaining wire round-trips are DELETE."
 },
 {
  "module": "tests.unit.test_repository_lineage_git_adapter",
  "category": "E2E",
  "tests_before": 23,
  "kept_tests": 5,
  "location": "tests.e2e.test_repository_lineage_git_adapter",
  "protects": "Real Git lineage reads: three-repository chain without checkout/hook execution, missing parent fails instead of truncating, credentials never echoed, cross-process fetch serialization of the same repo, recovery from an interrupted lock owner."
 },
 {
  "module": "tests.unit.test_repository_lineage_resolution",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Pure DAG ordering/cycle algorithm tests; lineage resolution is exercised by the initialization and lineage-git E2Es."
 },
 {
  "module": "tests.unit.test_repository_lineage_store",
  "category": "CRITICAL",
  "tests_before": 8,
  "kept_tests": 2,
  "location": "tests.critical.test_repository_lineage_store",
  "protects": "Lineage metadata writes: partial write failure restores both previous documents; compare-and-swap rejects a stale parent identity (data-loss)."
 },
 {
  "module": "tests.unit.test_repository_local_tree",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Native old-object capture bounds; exercised by every refresh apply and rollback journey."
 },
 {
  "module": "tests.unit.test_repository_lock_planning",
  "category": "SMOKE",
  "tests_before": 15,
  "kept_tests": 2,
  "location": "tests.smoke.test_repository_lock_planning",
  "protects": "Root lock preparation over real Git writes nothing and a shallow clone reconstructs the identical lock and plan."
 },
 {
  "module": "tests.unit.test_repository_lock_store",
  "category": "CRITICAL",
  "tests_before": 23,
  "kept_tests": 4,
  "location": "tests.critical.test_repository_lock_store",
  "protects": "Repository lock writes never overwrite malformed/foreign locks, never follow link destinations, preserve an existing writer marker, and never clobber a concurrent first publication."
 },
 {
  "module": "tests.unit.test_repository_object_install",
  "category": "CRITICAL",
  "tests_before": 10,
  "kept_tests": 3,
  "location": "tests.critical.test_repository_object_install",
  "protects": "Object-cache install never overwrites a concurrent winner or foreign bytes, and live install adds objects without changing files, refs or pins."
 },
 {
  "module": "tests.unit.test_repository_orchestration",
  "category": "E2E",
  "tests_before": 32,
  "kept_tests": 4,
  "location": "tests.e2e.test_repository_orchestration",
  "protects": "Read-only orchestration inventory over real Git submodules: exact inventory is immutable and repeatable, credential-bearing URLs refuse without echo, ambient GIT_DIR/index selectors ignored, symlinked config/child paths refuse."
 },
 {
  "module": "tests.unit.test_repository_orchestration_contracts",
  "category": "DELETE",
  "tests_before": 15,
  "kept_tests": 0,
  "location": null,
  "protects": "Wire/schema round-trips and record immutability for orchestration contracts; covered by orchestration E2E and schema catalog checks."
 },
 {
  "module": "tests.unit.test_repository_parent_follow",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Pure helper tests (release-line parsing, tag selection, progress stream)."
 },
 {
  "module": "tests.unit.test_repository_publication",
  "category": "E2E",
  "tests_before": 37,
  "kept_tests": 6,
  "location": "tests.e2e.test_repository_publication",
  "protects": "Real remote publication proof: published older commit with checkout bytes preserved, unpublished child commit refused, forged advertisement cannot override fetched refs, remote move during fetch refuses, inherited Git controls stripped and remote diagnostics never exposed."
 },
 {
  "module": "tests.unit.test_repository_refresh",
  "category": "DELETE",
  "tests_before": 14,
  "kept_tests": 0,
  "location": null,
  "protects": "Refresh request/delta contract validation (wire fields, immutability, no-IO preparation); exercised by the refresh CLI E2E."
 },
 {
  "module": "tests.unit.test_repository_refresh_application",
  "category": "E2E",
  "tests_before": 30,
  "kept_tests": 5,
  "location": "tests.e2e.test_repository_refresh_application",
  "protects": "Live refresh commit/rollback over real Git: complete commit is manifest-last, failure rolls back and keeps verified objects, foreign concurrent edit is preserved with recovery retained, absorbed/attached HEAD and detached peer worktree survive, noop preserves every live file."
 },
 {
  "module": "tests.unit.test_repository_refresh_application_transitions",
  "category": "CRITICAL",
  "tests_before": 5,
  "kept_tests": 2,
  "location": "tests.critical.test_repository_refresh_application_transitions",
  "protects": "Refresh rollback restores a raced replacement without clobbering foreign bytes and retains an owned inode whose open descriptor changed."
 },
 {
  "module": "tests.unit.test_repository_refresh_cli",
  "category": "E2E",
  "tests_before": 4,
  "kept_tests": 2,
  "location": "tests.e2e.test_repository_refresh_cli",
  "protects": "Public `litai` refresh plan/check/apply/noop from a clean clone and exact-head root-pin-only refresh without child writes; fold the human-output assertion into the first."
 },
 {
  "module": "tests.unit.test_repository_refresh_cli_surface",
  "category": "MERGE",
  "tests_before": 5,
  "kept_tests": 1,
  "location": "tests.e2e.test_repository_refresh_cli_surface",
  "protects": "Move the canonical-typed request-file refusal into the CLI E2E; parser/help/human-text checks are formatting detail."
 },
 {
  "module": "tests.unit.test_repository_refresh_directories",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Internal directory-custody helper of refresh application; exercised by the plan/check/apply path in test_repository_refresh_cli."
 },
 {
  "module": "tests.unit.test_repository_refresh_index",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Index-format byte patching internals (both object formats, extensions); implementation detail below the public refresh apply."
 },
 {
  "module": "tests.unit.test_repository_refresh_inputs",
  "category": "CRITICAL",
  "tests_before": 32,
  "kept_tests": 4,
  "location": "tests.critical.test_repository_refresh_inputs",
  "protects": "Refresh must refuse dirty children, in-progress git operations and late foreign changes without writes, and must never execute a child repository's configured clean/smudge filter (keep test_dirty_tracked_staged_untracked_and_deleted_child_files_refuse, test_real_child_clean_filter_cannot_execute_during_inspection, test_in_progress_git_operations_refuse_even_with_clean_source, test_reobservation_rejects_late_foreign_changes_without_repairing_them)."
 },
 {
  "module": "tests.unit.test_repository_refresh_metadata",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "Manifest/lock/packed-ref byte-preservation details of metadata derivation; the CLI apply/noop E2E already asserts byte preservation of the clone."
 },
 {
  "module": "tests.unit.test_repository_refresh_modes",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Permission-bit drift edge cases of refresh admission; implementation detail."
 },
 {
  "module": "tests.unit.test_repository_refresh_planning",
  "category": "MERGE",
  "tests_before": 6,
  "kept_tests": 1,
  "location": "tests.e2e.test_repository_refresh_planning",
  "protects": "Plan/check/stale/acknowledgement is the same behavior test_repository_refresh_cli drives through `litai orchestration refresh`; move only the 'unpublished and dirty children refuse without root writes' case there as the CLI fail-closed scenario. Mocked-Windows cases have no value."
 },
 {
  "module": "tests.unit.test_repository_refresh_publication",
  "category": "CRITICAL",
  "tests_before": 16,
  "kept_tests": 2,
  "location": "tests.critical.test_repository_refresh_publication",
  "protects": "A refresh may only pin child commits proven published on the root-authorized remote: keep test_unpublished_local_head_is_refused_without_input_writes and test_duplicate_and_credential_bearing_remote_configuration_refuses (credential leakage). Happy path is covered by the CLI E2E."
 },
 {
  "module": "tests.unit.test_repository_refresh_reflogs",
  "category": "DELETE",
  "tests_before": 18,
  "kept_tests": 0,
  "location": null,
  "protects": "Native-git reflog parity for every hop/format; implementation detail of git metadata emulation, no user-visible contract beyond the CLI apply."
 },
 {
  "module": "tests.unit.test_repository_refresh_refs",
  "category": "DELETE",
  "tests_before": 10,
  "kept_tests": 0,
  "location": null,
  "protects": "Loose/packed ref observation byte details; implementation detail."
 },
 {
  "module": "tests.unit.test_repository_refresh_reservations",
  "category": "CRITICAL",
  "tests_before": 16,
  "kept_tests": 2,
  "location": "tests.critical.test_repository_refresh_reservations",
  "protects": "Concurrent git writers are blocked while refresh holds reservations, and failure releases only owned lock markers (keep test_actual_git_index_head_and_branch_writers_are_blocked, test_failure_after_acquisition_releases_only_owned_markers) -- repository corruption/data-loss guard."
 },
 {
  "module": "tests.unit.test_repository_refresh_staging",
  "category": "CRITICAL",
  "tests_before": 16,
  "kept_tests": 2,
  "location": "tests.critical.test_repository_refresh_staging",
  "protects": "Crash safety of refresh application: abrupt process exit retains the before-state and blocks a new owner, and mid-application exception retains physical before-state (keep test_abrupt_process_exit_retains_stage_and_blocks_new_owner, test_mutation_then_exception_retains_physical_before_state)."
 },
 {
  "module": "tests.unit.test_repository_refresh_worktrees",
  "category": "CRITICAL",
  "tests_before": 18,
  "kept_tests": 1,
  "location": "tests.critical.test_repository_refresh_worktrees",
  "protects": "Refresh must refuse to move a branch that is checked out in a foreign worktree (keep test_same_branch_and_symbolic_alias_outside_selection_refuse); the rest is worktree-list parsing."
 },
 {
  "module": "tests.unit.test_repository_sources",
  "category": "DELETE",
  "tests_before": 16,
  "kept_tests": 0,
  "location": null,
  "protects": "In-memory contract composition of selectors/lock plan/cache admission (1041 lines of dataclass wiring); no real repository or build. Real dependency builds are covered by lifecycle E2Es."
 },
 {
  "module": "tests.unit.test_repository_tree",
  "category": "DELETE",
  "tests_before": 11,
  "kept_tests": 0,
  "location": null,
  "protects": "Pure contract validation of tree snapshot/delta records."
 },
 {
  "module": "tests.unit.test_repository_updates",
  "category": "SMOKE",
  "tests_before": 20,
  "kept_tests": 3,
  "location": "tests.smoke.test_repository_updates",
  "protects": "`litai project update` apply path: unchanged imports preserved byte-for-byte, retired catalog removal rolls back files/provenance/lineage as one unit, reviewed catalog conflict taken in one transaction (keep test_unchanged_apply_preserves_import_bytes_and_timestamp, test_retired_catalog_removal_rolls_back_files_provenance_and_lineage, test_cli_takes_reviewed_catalog_conflict_in_dependency_closed_transaction)."
 },
 {
  "module": "tests.unit.test_research_trials",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Arithmetic of research-trial reporting; no product surface."
 },
 {
  "module": "tests.unit.test_retained_bundle_delivery",
  "category": "DELETE",
  "tests_before": 11,
  "kept_tests": 0,
  "location": null,
  "protects": "Real-TLS archive fetch, redirect/auth/corruption refusal duplicates test_cli_retained_cargo_https (test_real_tls_check_then_materialize_and_reuse, test_redirect_and_wrong_bytes_never_publish_or_fall_back); remaining cases are Windows timestamp/file-open internals."
 },
 {
  "module": "tests.unit.test_retained_cargo_admission",
  "category": "MERGE",
  "tests_before": 5,
  "kept_tests": 1,
  "location": "tests.smoke.test_retained_cargo_admission",
  "protects": "Admission receipt and acknowledgement-before-process are already driven by test_cli_retained_cargo admit tests; move only test_retired_source_must_be_absent_and_is_never_deleted (data-loss) into the CLI admit scenario."
 },
 {
  "module": "tests.unit.test_retained_cargo_build_environment",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Environment key validation/limits for cargo builds; argument-validation unit test."
 },
 {
  "module": "tests.unit.test_retained_cargo_build_outputs",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "Build-output tree capture identity and limits; internal custody helper."
 },
 {
  "module": "tests.unit.test_retained_cargo_consumer_files",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "Consumer snapshot exclusion/drift helper internals."
 },
 {
  "module": "tests.unit.test_retained_cargo_current",
  "category": "DELETE",
  "tests_before": 13,
  "kept_tests": 0,
  "location": null,
  "protects": "Gate-policy parsing/review identity binding; the CLI module already covers gate drift refusing before provider discovery."
 },
 {
  "module": "tests.unit.test_retained_cargo_execution",
  "category": "SMOKE",
  "tests_before": 15,
  "kept_tests": 3,
  "location": "tests.smoke.test_retained_cargo_execution",
  "protects": "Real cargo runs every reviewed gate bracketed by metadata, and a foreign file added during a gate stops execution while being preserved (keep test_metadata_brackets_every_exact_reviewed_gate, test_foreign_addition_during_process_is_preserved_and_stops_execution). Absorb test_real_vendor_and_git_sources_stay_current_through_offline_build from test_retained_cargo_execution_inputs if offline vendored builds lack other coverage."
 },
 {
  "module": "tests.unit.test_retained_cargo_execution_inputs",
  "category": "DELETE",
  "tests_before": 10,
  "kept_tests": 0,
  "location": null,
  "protects": "Cargo config/cache-tag/dependency capture identity details. Its one real offline vendor+git build test is optional to move into test_retained_cargo_execution."
 },
 {
  "module": "tests.unit.test_retained_cargo_external_inputs",
  "category": "DELETE",
  "tests_before": 8,
  "kept_tests": 0,
  "location": null,
  "protects": "Optional external-input policy wiring; niche declaration validation with one real build-script case that duplicates the execution smoke."
 },
 {
  "module": "tests.unit.test_retained_cargo_files",
  "category": "DELETE",
  "tests_before": 10,
  "kept_tests": 0,
  "location": null,
  "protects": "Authored-file before/after snapshot custody internals; foreign-file preservation is covered by test_cli_retained_cargo."
 },
 {
  "module": "tests.unit.test_retained_cargo_import",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Archive reopen/substitution refusal at the adapter layer; test_cli_retained_cargo covers the wrong-archive refusal through the public CLI."
 },
 {
  "module": "tests.unit.test_retained_cargo_materialization",
  "category": "CRITICAL",
  "tests_before": 11,
  "kept_tests": 1,
  "location": "tests.critical.test_retained_cargo_materialization",
  "protects": "Rollback after a failed publication removes only packages it created and preserves concurrent user changes (keep test_publication_failure_rolls_back_only_created_packages); publish/reuse happy path is in test_cli_retained_cargo."
 },
 {
  "module": "tests.unit.test_retained_cargo_package_manifests",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Manifest name/version/workspace-inheritance validation; unit contract."
 },
 {
  "module": "tests.unit.test_retained_cargo_plan",
  "category": "DELETE",
  "tests_before": 8,
  "kept_tests": 0,
  "location": null,
  "protects": "Plan schema round-trip and identity-binding validation; unit contract."
 },
 {
  "module": "tests.unit.test_retained_cargo_runtime_files",
  "category": "DELETE",
  "tests_before": 11,
  "kept_tests": 0,
  "location": null,
  "protects": "Runtime-file alias chain capture rules; internal custody helper."
 },
 {
  "module": "tests.unit.test_retained_cargo_test_authority",
  "category": "DELETE",
  "tests_before": 10,
  "kept_tests": 0,
  "location": null,
  "protects": "Test-inventory review parsing and session bracketing with fake processes; unit contract."
 },
 {
  "module": "tests.unit.test_retained_cargo_test_execution",
  "category": "SMOKE",
  "tests_before": 8,
  "kept_tests": 2,
  "location": "tests.smoke.test_retained_cargo_test_execution",
  "protects": "Real `cargo test` compile/list/run of reviewed targets: all reviewed targets pass with the standard harness, and a binary altered after discovery is never executed (keep test_all_reviewed_targets_pass_with_standard_harness, test_changed_binary_after_discovery_stops_before_execution)."
 },
 {
  "module": "tests.unit.test_retained_cargo_test_observation",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Per-binary attribution/result parsing; the zero-exit and discovery-mismatch invariants are proven by the kept test_retained_cargo_test_execution cases."
 },
 {
  "module": "tests.unit.test_retained_failure_diagnostics",
  "category": "MERGE",
  "tests_before": 10,
  "kept_tests": 1,
  "location": "tests.e2e.test_retained_failure_diagnostics",
  "protects": "Storage-exhaustion diagnostic tails reaching the CLI; keep one case (test_reported_disk_failure_and_both_physical_tails_reach_cli) as a failing-harness scenario in the receipts E2E; the rest are string-boundary matching details."
 },
 {
  "module": "tests.unit.test_retained_harness_readmission",
  "category": "E2E",
  "tests_before": 12,
  "kept_tests": 3,
  "location": "tests.e2e.test_retained_harness_readmission",
  "protects": "`litai project retained-harness readmit` end to end on a real converted Make project: readmission replaces a false Bazel claim and requalifies, source change during qualification rolls back publication, remote readmission runs the generated wrapper (keep test_readmission_replaces_false_bazel_and_requalifies_locally, test_source_change_during_qualification_rolls_back_publication, test_remote_readmission_executes_direct_and_generated_wrapper)."
 },
 {
  "module": "tests.unit.test_retained_harness_receipts",
  "category": "E2E",
  "tests_before": 19,
  "kept_tests": 6,
  "location": "tests.e2e.test_retained_harness_receipts",
  "protects": "Retained harness receipt lifecycle through the CLI: passing harness emits/promotes a finalized candidate, remote worker selected and finalized by coordinator, remote receiver failure exposes no candidate, harness cannot mutate authored source, non-passing/collection-only counts never become receipts (keep those five; drop _stage_plan unit test and legacy-migration document tests unless 0.9.0 upgrade is still supported, in which case keep test_update_migrates_0_9_0_retained_evidence_before_run_retained)."
 },
 {
  "module": "tests.unit.test_retained_harness_remote",
  "category": "E2E",
  "tests_before": 14,
  "kept_tests": 4,
  "location": "tests.e2e.test_retained_harness_remote",
  "protects": "Worker receiver round trip: runtime archive supplies the current receiver over an exact PYTHONPATH in a real subprocess, receiver rejects tampered runtime, response worker-identity tampering is rejected, receiver CLI redacts secrets/private paths (keep test_runtime_archive_supplies_current_receiver_over_exact_pythonpath, test_internal_receiver_validates_runtime_and_rejects_tampering, test_response_worker_identity_tampering_is_rejected_after_cleanup, test_receiver_cli_redacts_private_paths_and_secrets_but_keeps_code)."
 },
 {
  "module": "tests.unit.test_retained_library_binding",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Retained-library binding contract round-trip/validation."
 },
 {
  "module": "tests.unit.test_retained_library_exports",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Library export graph contract validation."
 },
 {
  "module": "tests.unit.test_retained_native_dependencies",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Loader-environment freezing of native dependency observation with fake observers; internal."
 },
 {
  "module": "tests.unit.test_retained_native_files",
  "category": "DELETE",
  "tests_before": 16,
  "kept_tests": 0,
  "location": null,
  "protects": "Byte-budget/streaming TOCTOU details of native file capture with patched stat; internal custody helper."
 },
 {
  "module": "tests.unit.test_retained_package_tree",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Package tree custody helper internals; covered by retained-cargo CLI materialize/reuse."
 },
 {
  "module": "tests.unit.test_retained_project_planning",
  "category": "DELETE",
  "tests_before": 11,
  "kept_tests": 0,
  "location": null,
  "protects": "Retained project profile validation (unknown fields, omitted stages, etc.); unit contract."
 },
 {
  "module": "tests.unit.test_retained_provider_authority",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Provider authority guard drift checks composed in-process; internal custody, no public surface."
 },
 {
  "module": "tests.unit.test_retained_provider_generation",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "Locked generation closure recipe identity checks; internal."
 },
 {
  "module": "tests.unit.test_retained_provider_native",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "Oracle/harness custody drift checks with patched loaders; internal."
 },
 {
  "module": "tests.unit.test_retained_provider_promotion",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Reopening persisted qualification evidence; internal contract."
 },
 {
  "module": "tests.unit.test_retained_scope_refresh",
  "category": "E2E",
  "tests_before": 11,
  "kept_tests": 3,
  "location": "tests.e2e.test_retained_scope_refresh",
  "protects": "`litai project retained-scope refresh` plan/apply on a real project: read-only until acknowledged and invalidates the old receipt, failed policy update rolls back inventory and preserves source, git-tracked additions captured while ignored files are not (keep test_refresh_is_read_only_until_acknowledged_and_invalidates_old_receipt, test_failed_policy_update_rolls_back_inventory_and_preserves_source, test_git_tracked_additions_are_captured_but_ignored_files_are_not)."
 },
 {
  "module": "tests.unit.test_retained_source",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "Retained source review/byte binding validation; unit contract."
 },
 {
  "module": "tests.unit.test_roadmap_work",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Roadmap record canonicalization; no product value."
 },
 {
  "module": "tests.unit.test_rust_flavor_catalog",
  "category": "DELETE",
  "tests_before": 1,
  "kept_tests": 0,
  "location": null,
  "protects": "Single catalog-lookup assertion."
 },
 {
  "module": "tests.unit.test_rust_javascript_builder",
  "category": "E2E",
  "tests_before": 9,
  "kept_tests": 2,
  "location": "tests.e2e.test_rust_javascript_builder",
  "protects": "Real composite Rust+JavaScript build through the lifecycle adapter yields one strict runnable artifact, and a tampered cached artifact is never reused (keep test_lifecycle_adapter_builds_one_strict_runnable_artifact, test_tampered_cached_artifact_is_never_reused)."
 },
 {
  "module": "tests.unit.test_rust_library_test_driver",
  "category": "E2E",
  "tests_before": 5,
  "kept_tests": 2,
  "location": "tests.e2e.test_rust_library_test_driver",
  "protects": "Real cargo targets of a generated Rust library pass before the Standard case-result protocol, and a failing native case refuses with diagnostics (keep test_native_integration_and_nested_unit_tests_pass_before_json_protocol, test_failing_native_case_refuses_and_retains_case_diagnostic)."
 },
 {
  "module": "tests.unit.test_sample_checkpoint",
  "category": "DELETE",
  "tests_before": 15,
  "kept_tests": 0,
  "location": null,
  "protects": "Test-harness checkpoint key logic in tests.conformance.support; not product behavior."
 },
 {
  "module": "tests.unit.test_sample_driver_entrypoint",
  "category": "SMOKE",
  "tests_before": 1,
  "kept_tests": 1,
  "location": "tests.smoke.test_sample_driver_entrypoint",
  "protects": "Sample E2E driver restores the exact production LITAI_* environment, so sample E2Es test the real configuration rather than test-support leakage."
 },
 {
  "module": "tests.unit.test_sample_host_toolchain_plan",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Test-harness sample matrix planning; not product behavior."
 },
 {
  "module": "tests.unit.test_sample_locked_execution_plan",
  "category": "DELETE",
  "tests_before": 0,
  "kept_tests": 0,
  "location": null,
  "protects": "Empty module (0 tests)."
 },
 {
  "module": "tests.unit.test_scheduler_lease_reference",
  "category": "DELETE",
  "tests_before": 11,
  "kept_tests": 0,
  "location": "tests.smoke.test_scheduler_lease_reference",
  "protects": "Tests a reference implementation under tests/support, not shipped code."
 },
 {
  "module": "tests.unit.test_schema_catalog",
  "category": "SMOKE",
  "tests_before": 20,
  "kept_tests": 2,
  "location": "tests.smoke.test_schema_catalog",
  "protects": "Published schema catalog is exact, versioned and every $ref resolves (keep test_index_is_exact_and_every_resource_is_versioned, test_every_reference_resolves_and_record_shapes_are_closed); the other 18 per-record shape tests are schema round-trips."
 },
 {
  "module": "tests.unit.test_scxml_adapter",
  "category": "SMOKE",
  "tests_before": 14,
  "kept_tests": 2,
  "location": "tests.smoke.test_scxml_adapter",
  "protects": "SCXML specification adapter loads via the shared registry and replays parallel/history state machines into exact contracts (keep test_parallel_and_shallow_history_replay_produces_exact_contracts, test_shared_registry_loads_scxml)."
 },
 {
  "module": "tests.unit.test_security",
  "category": "CRITICAL",
  "tests_before": 9,
  "kept_tests": 4,
  "location": "tests.critical.test_security",
  "protects": "Build-authorization security policy: signature cannot override a blocking finding, revoked origin fails first, constrained profile cannot launder privileged capabilities, yolo needs acknowledgement and grants only requested privileges (keep those four)."
 },
 {
  "module": "tests.unit.test_security_scanning",
  "category": "CRITICAL",
  "tests_before": 3,
  "kept_tests": 2,
  "location": "tests.critical.test_security_scanning",
  "protects": "Prompt-injection text in scanned source stays inert and a content-digest mismatch fails before scanning (keep test_scanner_treats_prompt_injection_as_inert_source, test_content_digest_mismatch_fails_before_scanning)."
 },
 {
  "module": "tests.unit.test_semantic_comparison",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Requirement-graph canonicalization and mapping validation; unit contract."
 },
 {
  "module": "tests.unit.test_semantic_refinement_schemas",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Schema wire validation duplicated by the schema catalog smoke."
 },
 {
  "module": "tests.unit.test_semantic_refinement_service",
  "category": "CRITICAL",
  "tests_before": 10,
  "kept_tests": 2,
  "location": "tests.critical.test_semantic_refinement_service",
  "protects": "Model output can never become authority: model proposals stay unverified and rejected reviews are evidence only (keep test_model_proposal_can_only_be_unverified, test_rejected_review_is_evidence_but_never_authority)."
 },
 {
  "module": "tests.unit.test_service_http_transport",
  "category": "CRITICAL",
  "tests_before": 5,
  "kept_tests": 2,
  "location": "tests.critical.test_service_http_transport",
  "protects": "Local acceptance probes refuse non-loopback/credentialed origins before connecting and a redirect cannot substitute another local server (keep test_non_loopback_or_credentialed_origin_is_refused_before_connect, test_redirect_cannot_substitute_another_local_server)."
 },
 {
  "module": "tests.unit.test_service_package_entrypoint",
  "category": "DELETE",
  "tests_before": 8,
  "kept_tests": 0,
  "location": null,
  "protects": "Package-plan entrypoint kind/argv mapping; argument formatting unit test."
 },
 {
  "module": "tests.unit.test_service_process_cleanup",
  "category": "CRITICAL",
  "tests_before": 1,
  "kept_tests": 1,
  "location": "tests.critical.test_service_process_cleanup",
  "protects": "Service shutdown reaps descendant processes after graceful or early root exit, preventing orphaned processes from acceptance runs."
 },
 {
  "module": "tests.unit.test_shared_artifact_cache",
  "category": "CRITICAL",
  "tests_before": 21,
  "kept_tests": 4,
  "location": "tests.critical.test_shared_artifact_cache",
  "protects": "Shared artifact cache returns verified warm hits only, refuses corrupted payloads/poisoned manifests and changed authority, and enforces quota across separate writer processes."
 },
 {
  "module": "tests.unit.test_shared_cache",
  "category": "MERGE",
  "tests_before": 5,
  "kept_tests": 1,
  "location": "tests.critical.test_shared_cache",
  "protects": "Credential-in-URL/plaintext-TLS rejection is the only invariant worth keeping; fold it into the shared cache config critical test. Helpers imported by other modules must move to tests/support before trimming."
 },
 {
  "module": "tests.unit.test_shared_cache_config",
  "category": "CRITICAL",
  "tests_before": 10,
  "kept_tests": 3,
  "location": "tests.critical.test_shared_cache_config",
  "protects": "Private cache credentials are temporary, never appear in process arguments, are cleaned up on failure, and a symlinked namespace cannot redirect a writable cache."
 },
 {
  "module": "tests.unit.test_skill_closure",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Unit tests of skill dependency-closure graph algorithm (diamonds, cycles, ordering); exercised indirectly whenever skills are resolved."
 },
 {
  "module": "tests.unit.test_skill_evaluation_gate",
  "category": "SMOKE",
  "tests_before": 12,
  "kept_tests": 2,
  "location": "tests.smoke.test_skill_evaluation_gate",
  "protects": "The CI skill-evaluation gate detects changed skills in a real git checkout and runs the evaluator (and skips when nothing changed)."
 },
 {
  "module": "tests.unit.test_skill_routing_evaluation",
  "category": "SMOKE",
  "tests_before": 19,
  "kept_tests": 2,
  "location": "tests.smoke.test_skill_routing_evaluation",
  "protects": "The skill routing evaluation CLI runs end to end against the real catalog and seed corpus."
 },
 {
  "module": "tests.unit.test_skill_update_plan",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Unit tests of a maintenance script (normalize_skill_authoring) planning logic; no product surface."
 },
 {
  "module": "tests.unit.test_snapshot_cache_reference",
  "category": "DELETE",
  "tests_before": 10,
  "kept_tests": 0,
  "location": "tests.smoke.test_snapshot_cache_reference",
  "protects": "Tests a reference implementation in tests/support, not product code."
 },
 {
  "module": "tests.unit.test_source_cache",
  "category": "CRITICAL",
  "tests_before": 36,
  "kept_tests": 6,
  "location": "tests.critical.test_source_cache",
  "protects": "Source cache publish/hit is exact, membership is published last, tampered membership/manifest/source objects fail closed, project-relative cache protects git metadata, and existing destinations are never modified."
 },
 {
  "module": "tests.unit.test_source_cache_continuation",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Asserts internal lookup-plan identity equality and legacy endpoint identity details; implementation detail."
 },
 {
  "module": "tests.unit.test_source_cache_hardening",
  "category": "MERGE",
  "tests_before": 14,
  "kept_tests": 2,
  "location": "tests.critical.test_source_cache_hardening",
  "protects": "Only casefold-alias overlap with project authority and CAS verified-bytes-from-opened-inode are worth keeping as critical cases; rest are read-only-target and bounds unit cases."
 },
 {
  "module": "tests.unit.test_source_cache_publication",
  "category": "SMOKE",
  "tests_before": 5,
  "kept_tests": 2,
  "location": "tests.smoke.test_source_cache_publication",
  "protects": "The cache publish CLI/adapter publishes a runtime cache and refuses a destination identity substitution."
 },
 {
  "module": "tests.unit.test_source_generation_boundary_contracts",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Wire contract round-trip and schema field validation. Helpers imported by other modules must move to tests/support before trimming."
 },
 {
  "module": "tests.unit.test_source_generation_custody_contracts",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Contract-version and identity-binding unit tests duplicated by lifecycle coverage."
 },
 {
  "module": "tests.unit.test_source_generation_scheduling",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "Unit tests of generation scheduling reuse/revalidation with fake runners; reuse behavior is covered by test_standard_project_lifecycle (second_unchanged_run_reuses_every_accepted_node)."
 },
 {
  "module": "tests.unit.test_source_inventory",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Unit tests of source inventory classification for source-to-specification; covered by the source-to-specification workflow smoke."
 },
 {
  "module": "tests.unit.test_source_materialization",
  "category": "CRITICAL",
  "tests_before": 14,
  "kept_tests": 2,
  "location": "tests.critical.test_source_materialization",
  "protects": "Remote source archive transport binds the request to the verified tree and extraction rejects path traversal and symlinks."
 },
 {
  "module": "tests.unit.test_source_promotion_journals",
  "category": "MERGE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Traversal/symlink refusal for journal promotion duplicates the promotion-materialization path-safety invariant."
 },
 {
  "module": "tests.unit.test_source_promotion_materialization",
  "category": "CRITICAL",
  "tests_before": 8,
  "kept_tests": 2,
  "location": "tests.critical.test_source_promotion_materialization",
  "protects": "Unlisted source, prompts, and journals never enter the promoted specification closure, and traversal/forbidden targets are refused."
 },
 {
  "module": "tests.unit.test_source_promotion_service",
  "category": "SMOKE",
  "tests_before": 2,
  "kept_tests": 1,
  "location": "tests.smoke.test_source_promotion_service",
  "protects": "Public source-promotion service materializes and assesses the exact audited closure."
 },
 {
  "module": "tests.unit.test_source_regenerative_qualification",
  "category": "DELETE",
  "tests_before": 13,
  "kept_tests": 0,
  "location": null,
  "protects": "Policy and wire-record validation unit tests for qualification evidence."
 },
 {
  "module": "tests.unit.test_source_to_specification",
  "category": "SMOKE",
  "tests_before": 20,
  "kept_tests": 3,
  "location": "tests.smoke.test_source_to_specification",
  "protects": "Source-to-specification workflow produces traceable coverage, the source guard detects mutation, and complete human review promotes atomically."
 },
 {
  "module": "tests.unit.test_source_verification_workspace",
  "category": "CRITICAL",
  "tests_before": 12,
  "kept_tests": 3,
  "location": "tests.critical.test_source_verification_workspace",
  "protects": "Verification workspace refuses mutation of the original candidate, hardlinked/linked sources, and drift before tests run."
 },
 {
  "module": "tests.unit.test_sources_intelligence",
  "category": "CRITICAL",
  "tests_before": 16,
  "kept_tests": 3,
  "location": "tests.critical.test_sources_intelligence",
  "protects": "Signed-commit verification never covers a dirty git capture, quarantine promotes only exact verified source, and command timeouts kill the whole process tree."
 },
 {
  "module": "tests.unit.test_spec_map",
  "category": "DELETE",
  "tests_before": 8,
  "kept_tests": 0,
  "location": null,
  "protects": "Debug spec-map diagnostics tooling (scanner line numbers, debug stderr output); low release value."
 },
 {
  "module": "tests.unit.test_spec_merge",
  "category": "CRITICAL",
  "tests_before": 2,
  "kept_tests": 1,
  "location": "tests.critical.test_spec_merge",
  "protects": "Spec merge refuses to overwrite an existing component (data loss)."
 },
 {
  "module": "tests.unit.test_specification_corpus_service",
  "category": "SMOKE",
  "tests_before": 6,
  "kept_tests": 1,
  "location": "tests.smoke.test_specification_corpus_service",
  "protects": "Specification corpus validate/explain work through the application service with no filesystem write surface."
 },
 {
  "module": "tests.unit.test_ssh_execution",
  "category": "SMOKE",
  "tests_before": 16,
  "kept_tests": 2,
  "location": "tests.smoke.test_ssh_execution",
  "protects": "Remote SSH execution handler stages files and returns one typed result, and fails closed when transfer never arrives."
 },
 {
  "module": "tests.unit.test_ssh_transport",
  "category": "CRITICAL",
  "tests_before": 13,
  "kept_tests": 2,
  "location": "tests.critical.test_ssh_transport",
  "protects": "SSH argv refuses unsafe transport names and the runner times out, bounds output, and kills the process group."
 },
 {
  "module": "tests.unit.test_stage3_evidence_retention",
  "category": "MERGE",
  "tests_before": 11,
  "kept_tests": 0,
  "location": null,
  "protects": "Evidence retention on failure is already exercised end to end by stage5 sample-runner tests; per-pointer unit cases add little."
 },
 {
  "module": "tests.unit.test_stage5_acceptance",
  "category": "E2E",
  "tests_before": 5,
  "kept_tests": 3,
  "location": "tests.e2e.test_stage5_acceptance",
  "protects": "A real sample run via the samples runner retains owned runtime evidence on failure, prunes on success, and `litai release evidence explain` reads it (including after a killed gate)."
 },
 {
  "module": "tests.unit.test_stage_node_tool",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Unit tests of a developer script (stage_node_tool)."
 },
 {
  "module": "tests.unit.test_standard_action_authorization",
  "category": "CRITICAL",
  "tests_before": 5,
  "kept_tests": 2,
  "location": "tests.critical.test_standard_action_authorization",
  "protects": "Worker-dispatched authorization results that are substituted or whose SDK custody changed never reach local admission."
 },
 {
  "module": "tests.unit.test_standard_action_build_intent",
  "category": "MERGE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Same substituted-worker-result refusal pattern as action authorization; one representative suffices."
 },
 {
  "module": "tests.unit.test_standard_action_indexing",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "Factory wiring and refusal unit cases for remote indexing with heavy fixtures; substituted-result invariant kept in action authorization."
 },
 {
  "module": "tests.unit.test_standard_action_planning",
  "category": "MERGE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Same substituted-result/capacity-release pattern as action authorization."
 },
 {
  "module": "tests.unit.test_standard_action_ready_queue",
  "category": "DELETE",
  "tests_before": 19,
  "kept_tests": 0,
  "location": null,
  "protects": "Scheduler ready-queue capacity unit tests (19 near-identical per-phase exhaustion/release cases)."
 },
 {
  "module": "tests.unit.test_standard_authorization",
  "category": "MERGE",
  "tests_before": 4,
  "kept_tests": 1,
  "location": "tests.critical.test_standard_authorization",
  "protects": "Returned authorization cannot renew controller time belongs with grant currency/revocation invariant."
 },
 {
  "module": "tests.unit.test_standard_bazel_lifecycle",
  "category": "SMOKE",
  "tests_before": 19,
  "kept_tests": 3,
  "location": "tests.smoke.test_standard_bazel_lifecycle",
  "protects": "Bazel lifecycle adapter (with a fake bazel) produces an exact export and cache hit, passes private cache credentials only to the build and cleans them, and rejects link outputs."
 },
 {
  "module": "tests.unit.test_standard_build_authority",
  "category": "CRITICAL",
  "tests_before": 6,
  "kept_tests": 2,
  "location": "tests.critical.test_standard_build_authority",
  "protects": "A build plan is admitted only under a current, non-revoked grant whose index and privileges cannot be substituted."
 },
 {
  "module": "tests.unit.test_standard_build_inputs",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Serialized build-input validation unit tests; covered by build authority and lifecycle tests."
 },
 {
  "module": "tests.unit.test_standard_build_intent",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Build-intent state-map unit tests; substitution refusal covered by action authorization."
 },
 {
  "module": "tests.unit.test_standard_candidate_repair_adapter",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Repair adapter unit tests; bounded fresh replacement is covered by test_standard_project_lifecycle (retryable_candidate_gets_at_most_two_fresh_replacements)."
 },
 {
  "module": "tests.unit.test_standard_cargo_lifecycle",
  "category": "SMOKE",
  "tests_before": 10,
  "kept_tests": 2,
  "location": "tests.smoke.test_standard_cargo_lifecycle",
  "protects": "Cargo lifecycle adapter (fake cargo) exports an immutable package tree and rejects a model-written Cargo.lock before cargo runs."
 },
 {
  "module": "tests.unit.test_standard_command_projection",
  "category": "SMOKE",
  "tests_before": 32,
  "kept_tests": 4,
  "location": "tests.smoke.test_standard_command_projection",
  "protects": "Projected standard commands really build, test, and import exact library artifacts per language (Python, JavaScript via node, Rust via cargo, C++ static/shared)."
 },
 {
  "module": "tests.unit.test_standard_command_scope",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Phase-scope argument checks of lifecycle adapters; unit-level."
 },
 {
  "module": "tests.unit.test_standard_dependency_guard",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Unit tests of dependency guard deduplication."
 },
 {
  "module": "tests.unit.test_standard_execution_inputs",
  "category": "DELETE",
  "tests_before": 15,
  "kept_tests": 0,
  "location": null,
  "protects": "Schema/contract validation of execution-input scopes (15 cases); grant substitution covered by build authority."
 },
 {
  "module": "tests.unit.test_standard_lifecycle_binding_adapter",
  "category": "CRITICAL",
  "tests_before": 11,
  "kept_tests": 2,
  "location": "tests.critical.test_standard_lifecycle_binding_adapter",
  "protects": "The trusted standard lifecycle binding refuses editable installs and missing/symlinked/tampered distribution payload members."
 },
 {
  "module": "tests.unit.test_standard_lifecycle_checkpoint_contracts",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Schema round-trip of checkpoint contracts."
 },
 {
  "module": "tests.unit.test_standard_lifecycle_checkpoint_store",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Checkpoint store unit tests; resume-from-checkpoint is covered by test_standard_project_lifecycle (source_checkpoint_resume_replays_gates_without_generation)."
 },
 {
  "module": "tests.unit.test_standard_lifecycle_membership",
  "category": "DELETE",
  "tests_before": 8,
  "kept_tests": 0,
  "location": null,
  "protects": "Membership/receipt document round-trip and validation unit tests."
 },
 {
  "module": "tests.unit.test_standard_lifecycle_policy",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Policy contract schema validation unit tests."
 },
 {
  "module": "tests.unit.test_standard_lifecycle_rebind",
  "category": "SMOKE",
  "tests_before": 14,
  "kept_tests": 2,
  "location": "tests.smoke.test_standard_lifecycle_rebind",
  "protects": "`litai` lifecycle rebind plan/apply via the public CLI preserves custom harness policy and rolls back on post-write drift."
 },
 {
  "module": "tests.unit.test_standard_lifecycle_wire_contracts",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Wire document schema and substitution unit tests."
 },
 {
  "module": "tests.unit.test_standard_local_command_adapter",
  "category": "SMOKE",
  "tests_before": 43,
  "kept_tests": 6,
  "location": "tests.smoke.test_standard_local_command_adapter",
  "protects": "Local lifecycle adapter really builds/tests/executes/accepts components, serves persistent-service acceptance over HTTP/SSE, hits exact cache, and rejects rewritten artifacts/manifests and tool byte drift."
 },
 {
  "module": "tests.unit.test_standard_locked_scope",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Locked-scope projection unit tests with fakes."
 },
 {
  "module": "tests.unit.test_standard_npm_lifecycle",
  "category": "SMOKE",
  "tests_before": 20,
  "kept_tests": 3,
  "location": "tests.smoke.test_standard_npm_lifecycle",
  "protects": "npm lifecycle resolves the locked target and retains a runtime tree, never mutates source on failed install, and rejects native addon payloads."
 },
 {
  "module": "tests.unit.test_standard_plan_finalization",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Plan reconstruction unit tests; substitution covered by build authority."
 },
 {
  "module": "tests.unit.test_standard_post_source_evidence",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "Evidence contract round-trip/schema validation. Helpers imported by other modules must move to tests/support before trimming."
 },
 {
  "module": "tests.unit.test_standard_project_cli_planning",
  "category": "SMOKE",
  "tests_before": 3,
  "kept_tests": 1,
  "location": "tests.smoke.test_standard_project_cli_planning",
  "protects": "`litai` locked planning uses the standard service without running a coding CLI."
 },
 {
  "module": "tests.unit.test_standard_project_factory",
  "category": "SMOKE",
  "tests_before": 19,
  "kept_tests": 3,
  "location": "tests.smoke.test_standard_project_factory",
  "protects": "Standard project factory runtime drivers really compile C++, run a Node artifact, and import a Python artifact."
 },
 {
  "module": "tests.unit.test_standard_project_lifecycle",
  "category": "SMOKE",
  "tests_before": 60,
  "kept_tests": 5,
  "location": "tests.smoke.test_standard_project_lifecycle",
  "protects": "Core standard project orchestrator: unchanged reruns reuse accepted nodes, rejected candidates are never published, root-boundary failures block cache publication, expired grants fail before finalization, failures preserve independent resume."
 },
 {
  "module": "tests.unit.test_standard_project_services",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Delegation unit tests of project services."
 },
 {
  "module": "tests.unit.test_standard_provider_receipts",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Receipt selection/validation unit tests."
 },
 {
  "module": "tests.unit.test_standard_provider_worker",
  "category": "E2E",
  "tests_before": 1,
  "kept_tests": 1,
  "location": "tests.e2e.test_standard_provider_worker",
  "protects": "Real build worker composition builds a root component from transferred two-level dependency artifacts (worker round trip)."
 },
 {
  "module": "tests.unit.test_standard_python_evidence",
  "category": "CRITICAL",
  "tests_before": 11,
  "kept_tests": 2,
  "location": "tests.critical.test_standard_python_evidence",
  "protects": "Cached Python dependency payloads that change are rejected and a manifest cannot reauthorize its own changed payload."
 },
 {
  "module": "tests.unit.test_standard_python_lifecycle",
  "category": "SMOKE",
  "tests_before": 12,
  "kept_tests": 3,
  "location": "tests.smoke.test_standard_python_lifecycle",
  "protects": "Real offline Python wheel install, build, TEST, launch and sealed-cache reuse through the Standard lifecycle adapter, plus rejection of a changed installed payload before execution."
 },
 {
  "module": "tests.unit.test_standard_rebuild_adapter",
  "category": "DELETE",
  "tests_before": 9,
  "kept_tests": 0,
  "location": null,
  "protects": "SimpleNamespace- and mock-driven checks of the rebuild adapter's internal authorization, parallelism and cache plumbing. The rebuild CLI and E2E paths already cover this."
 },
 {
  "module": "tests.unit.test_standard_release_wire_contracts",
  "category": "DELETE",
  "tests_before": 4,
  "kept_tests": 0,
  "location": null,
  "protects": "Schema round trips and unknown-field rejection for release declaration/receipt dataclasses."
 },
 {
  "module": "tests.unit.test_standard_root_integration",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Dataclass validation of StandardRootIntegrationEvidence substitution rules. Pure contract unit test."
 },
 {
  "module": "tests.unit.test_standard_root_receipts",
  "category": "MERGE",
  "tests_before": 6,
  "kept_tests": 2,
  "location": "tests.e2e.test_standard_root_receipts",
  "protects": "The rebuild CLI root receipt binds every accepted Component and refuses publication on lock-set or snapshot change. That behavior is worth keeping, but here the whole rebuild is mocked."
 },
 {
  "module": "tests.unit.test_standard_runtime",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Argv projection from smoke to serve for runtime drivers. String/tuple formatting unit test."
 },
 {
  "module": "tests.unit.test_standard_runtime_scheduling",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Internal scheduler-ordering unit tests for runtime edges, built on fake receipts."
 },
 {
  "module": "tests.unit.test_standard_scoped_projection",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Internal scoped-launcher toolchain projection rules. Unit-level contract checks."
 },
 {
  "module": "tests.unit.test_standard_source_admission",
  "category": "CRITICAL",
  "tests_before": 10,
  "kept_tests": 2,
  "location": "tests.critical.test_standard_source_admission",
  "protects": "Generated source is admitted only with a passing generation and tests, and a tampered generation transcript is refused before verification."
 },
 {
  "module": "tests.unit.test_standard_source_cache_roundtrip",
  "category": "SMOKE",
  "tests_before": 11,
  "kept_tests": 2,
  "location": "tests.smoke.test_standard_source_cache_roundtrip",
  "protects": "The accepted source cache survives a portable archive round trip (long Windows paths), and publication binds every durable cache input."
 },
 {
  "module": "tests.unit.test_standard_source_validation",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Transferred-input validation authority registration rules. Internal contract unit test."
 },
 {
  "module": "tests.unit.test_standard_toolchain_observations",
  "category": "DELETE",
  "tests_before": 6,
  "kept_tests": 0,
  "location": null,
  "protects": "Wire/record bounds for tool observation records. Schema and parsing unit tests."
 },
 {
  "module": "tests.unit.test_standard_transferred_acceptance",
  "category": "DELETE",
  "tests_before": 10,
  "kept_tests": 0,
  "location": null,
  "protects": "Mock-patched ACCEPT receipt admission permutations. The worker round-trip E2E covers the real path."
 },
 {
  "module": "tests.unit.test_standard_transferred_build",
  "category": "CRITICAL",
  "tests_before": 12,
  "kept_tests": 2,
  "location": "tests.critical.test_standard_transferred_build",
  "protects": "Transferred build artifacts cannot be registered if an export is changed, the manifest is self-consistently rewritten, or the artifact root is redirected (artifact custody tamper detection)."
 },
 {
  "module": "tests.unit.test_standard_transferred_execution",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Mock-patched EXECUTE transfer publication permutations. Unit-level."
 },
 {
  "module": "tests.unit.test_standard_transferred_tests",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Mock-patched TEST record registration permutations. Unit-level."
 },
 {
  "module": "tests.unit.test_step_harness",
  "category": "SMOKE",
  "tests_before": 5,
  "kept_tests": 2,
  "location": "tests.smoke.test_step_harness",
  "protects": "The scripts/litai_step.py CI step harness, run as a real subprocess, preserves the wrapped command's IO and exit status and records step transcripts."
 },
 {
  "module": "tests.unit.test_storage_read_only_index",
  "category": "DELETE",
  "tests_before": 8,
  "kept_tests": 0,
  "location": null,
  "protects": "Read-only cache index lookups do not create directories or locks. Low-level storage unit test."
 },
 {
  "module": "tests.unit.test_storage_settings_publication",
  "category": "CRITICAL",
  "tests_before": 20,
  "kept_tests": 3,
  "location": "tests.critical.test_storage_settings_publication",
  "protects": "Settings persistence rejects raw secrets, publication rejects tampered blobs, symlinks and overlaps, and publication refuses yolo provenance without explicit permission."
 },
 {
  "module": "tests.unit.test_swift_flavors",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Mocked xcrun probing and the wording of the install-link message."
 },
 {
  "module": "tests.unit.test_target_matrices",
  "category": "SMOKE",
  "tests_before": 17,
  "kept_tests": 2,
  "location": "tests.smoke.test_target_matrices",
  "protects": "A multi-target matrix rebuild is unaccepted when results are mixed across Linux and Windows, and cross-cell or predecessor evidence tampering is rejected."
 },
 {
  "module": "tests.unit.test_target_matrix_cli",
  "category": "MERGE",
  "tests_before": 2,
  "kept_tests": 1,
  "location": "tests.smoke.test_target_matrix_cli",
  "protects": "The matrix CLI rejects an invalid target before lifecycle execution. Fold this in as the target-matrix module's fail-closed case."
 },
 {
  "module": "tests.unit.test_test_runner_authority",
  "category": "CRITICAL",
  "tests_before": 2,
  "kept_tests": 1,
  "location": "tests.critical.test_test_runner_authority",
  "protects": "The test runner's repository-owned support imports must stay inside the reviewed closure, which guards the integrity of test evidence."
 },
 {
  "module": "tests.unit.test_test_worker",
  "category": "CRITICAL",
  "tests_before": 6,
  "kept_tests": 1,
  "location": "tests.critical.test_test_worker",
  "protects": "The TEST child refuses oversized or malformed input before the runtime starts and never leaks private tracebacks."
 },
 {
  "module": "tests.unit.test_tool_bootstrap",
  "category": "CRITICAL",
  "tests_before": 1,
  "kept_tests": 1,
  "location": "tests.critical.test_tool_bootstrap",
  "protects": "The managed Node transport is provisioned only against a pinned checksum and never through the system npm (supply chain)."
 },
 {
  "module": "tests.unit.test_toolchain_constraints",
  "category": "DELETE",
  "tests_before": 7,
  "kept_tests": 0,
  "location": null,
  "protects": "Pure merge/round-trip logic for version constraints."
 },
 {
  "module": "tests.unit.test_typescript_zig_flavors",
  "category": "DELETE",
  "tests_before": 3,
  "kept_tests": 0,
  "location": null,
  "protects": "Flavor markdown parsing and a check that catalog and template trees match byte for byte. The byte check belongs in a lint/sync gate, not the test suite."
 },
 {
  "module": "tests.unit.test_update_follow_plan",
  "category": "E2E",
  "tests_before": 5,
  "kept_tests": 2,
  "location": "tests.e2e.test_update_follow_plan",
  "protects": "`project update` follow plan/apply against real git revisions produces the same skill changes and preserves a starter component."
 },
 {
  "module": "tests.unit.test_user_assets",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Path-default and override resolution for user assets. Unit test."
 },
 {
  "module": "tests.unit.test_user_config",
  "category": "DELETE",
  "tests_before": 16,
  "kept_tests": 0,
  "location": null,
  "protects": "Catalog round trips, prompt/journal toggles and argument handling. Move the secret-shaped field rejection into the storage settings CRITICAL set if it is not already covered there."
 },
 {
  "module": "tests.unit.test_user_config_migration",
  "category": "CRITICAL",
  "tests_before": 7,
  "kept_tests": 2,
  "location": "tests.critical.test_user_config_migration",
  "protects": "`config migrate --apply` moves legacy assets into private custody, and a partial publish failure keeps the unmoved source (no data loss)."
 },
 {
  "module": "tests.unit.test_user_paths",
  "category": "DELETE",
  "tests_before": 13,
  "kept_tests": 0,
  "location": null,
  "protects": "Mocked platform path resolution (XDG, Windows known folders). Unit test."
 },
 {
  "module": "tests.unit.test_validation",
  "category": "SMOKE",
  "tests_before": 11,
  "kept_tests": 2,
  "location": "tests.smoke.test_validation",
  "protects": "The generated-source validation gate rejects unsupported API calls even when the contract declares evidence, and rejects C++ references that retain input lifetimes."
 },
 {
  "module": "tests.unit.test_version_authority",
  "category": "SMOKE",
  "tests_before": 12,
  "kept_tests": 3,
  "location": "tests.smoke.test_version_authority",
  "protects": "`litai version check` covers the distribution authority and both schema catalogs, release mode requires the exact version tag (including from nested and linked worktrees), and non-editable metadata mismatches stay strict."
 },
 {
  "module": "tests.unit.test_versioned_component_contracts",
  "category": "DELETE",
  "tests_before": 8,
  "kept_tests": 0,
  "location": null,
  "protects": "Semver/PEP 440 separation and legacy-identity reader rules. Contract unit tests."
 },
 {
  "module": "tests.unit.test_versioned_service_contracts",
  "category": "DELETE",
  "tests_before": 11,
  "kept_tests": 0,
  "location": null,
  "protects": "Golden v1-to-v2 writer/reader migrations for service wires. Schema round trips."
 },
 {
  "module": "tests.unit.test_vfi_context_scaling",
  "category": "SMOKE",
  "tests_before": 5,
  "kept_tests": 1,
  "location": "tests.smoke.test_vfi_context_scaling",
  "protects": "Prompt and cache-key context stays invariant when an unrelated sibling Component changes at VFI scale (50 siblings)."
 },
 {
  "module": "tests.unit.test_video_courses",
  "category": "E2E",
  "tests_before": 11,
  "kept_tests": 2,
  "location": "tests.e2e.test_video_courses",
  "protects": "The public `video` CLI plan runs without media tools, and a real ffmpeg/magick course render verifies with tamper detection."
 },
 {
  "module": "tests.unit.test_video_narrative",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Checks the content of repository narrative/pronunciation data. No product behavior."
 },
 {
  "module": "tests.unit.test_wheel_smoke",
  "category": "SMOKE",
  "tests_before": 13,
  "kept_tests": 2,
  "location": "tests.smoke.test_wheel_smoke",
  "protects": "Every template data file is included in the wheel's package data, and the recorded distribution origin rejects embedded credentials."
 },
 {
  "module": "tests.unit.test_wheel_smoke_custody",
  "category": "CRITICAL",
  "tests_before": 5,
  "kept_tests": 2,
  "location": "tests.critical.test_wheel_smoke_custody",
  "protects": "A wheel is marked qualified only if the exact tested bytes are retained. A changed tested wheel or changed copied bytes are refused."
 },
 {
  "module": "tests.unit.test_windows_npm_discovery",
  "category": "DELETE",
  "tests_before": 2,
  "kept_tests": 0,
  "location": null,
  "protects": "Mocked discovery of the Windows npm shim. Platform unit test."
 },
 {
  "module": "tests.unit.test_wire_contract_versions",
  "category": "CRITICAL",
  "tests_before": 17,
  "kept_tests": 2,
  "location": "tests.critical.test_wire_contract_versions",
  "protects": "Multi-file wire migration restores the exact original bytes after a commit failure, and an invalid nested result never reaches staging (no data loss)."
 },
 {
  "module": "tests.unit.test_worker_alerts",
  "category": "DELETE",
  "tests_before": 17,
  "kept_tests": 0,
  "location": null,
  "protects": "Alert dedup and history state-machine unit tests."
 },
 {
  "module": "tests.unit.test_worker_capabilities",
  "category": "CRITICAL",
  "tests_before": 14,
  "kept_tests": 1,
  "location": "tests.critical.test_worker_capabilities",
  "protects": "SSH probe diagnostics are bounded and redacted before truncation, so credentials do not leak."
 },
 {
  "module": "tests.unit.test_worker_capacity",
  "category": "SMOKE",
  "tests_before": 23,
  "kept_tests": 2,
  "location": "tests.smoke.test_worker_capacity",
  "protects": "Capacity admission holds on quota exhaustion and never pools free space across separate volumes."
 },
 {
  "module": "tests.unit.test_worker_cleanup",
  "category": "MERGE",
  "tests_before": 4,
  "kept_tests": 1,
  "location": "tests.e2e.test_worker_cleanup",
  "protects": "Read-only cleanup measurement does not follow links. Assert this in the real receiver round trip."
 },
 {
  "module": "tests.unit.test_worker_cleanup_adapter",
  "category": "E2E",
  "tests_before": 2,
  "kept_tests": 1,
  "location": "tests.e2e.test_worker_cleanup_adapter",
  "protects": "The real staged cleanup receiver measures the selected worker without exposing paths (worker/receiver round trip)."
 },
 {
  "module": "tests.unit.test_worker_cleanup_execution",
  "category": "CRITICAL",
  "tests_before": 4,
  "kept_tests": 2,
  "location": "tests.critical.test_worker_cleanup_execution",
  "protects": "Destructive cleanup requires an exact, unexpired, target-matching authorization and refuses a changed candidate before invoking the tool (data loss)."
 },
 {
  "module": "tests.unit.test_worker_forge_credentials",
  "category": "CRITICAL",
  "tests_before": 16,
  "kept_tests": 4,
  "location": "tests.critical.test_worker_forge_credentials",
  "protects": "Short-lived forge credentials: the token is redacted in repr, the askpass helper is removed even on error, an expired credential is refused without writing files, and every real git phase uses the acquired credential."
 },
 {
  "module": "tests.unit.test_worker_health_skill",
  "category": "DELETE",
  "tests_before": 1,
  "kept_tests": 0,
  "location": null,
  "protects": "Checks that skill text matches between the repository and the templates. Content check."
 },
 {
  "module": "tests.unit.test_worker_pressure",
  "category": "DELETE",
  "tests_before": 5,
  "kept_tests": 0,
  "location": null,
  "protects": "Pure classification of pressure fixtures."
 },
 {
  "module": "tests.unit.test_worker_pressure_adapter",
  "category": "E2E",
  "tests_before": 3,
  "kept_tests": 1,
  "location": "tests.e2e.test_worker_pressure_adapter",
  "protects": "The SSH pressure receiver round trip binds the request and collects native memory."
 },
 {
  "module": "tests.unit.test_worker_provisioning",
  "category": "SMOKE",
  "tests_before": 16,
  "kept_tests": 3,
  "location": "tests.smoke.test_worker_provisioning",
  "protects": "Dynamic worker provisioning through a real provider child process: the public CLI is disabled until enabled, register/replay allocates exactly once, and only bound credentials are forwarded, with help output redacted."
 },
 {
  "module": "tests.unit.test_worker_quota_probe",
  "category": "CRITICAL",
  "tests_before": 11,
  "kept_tests": 1,
  "location": "tests.critical.test_worker_quota_probe",
  "protects": "A failed or partial native quota query never becomes unlimited capacity."
 },
 {
  "module": "tests.unit.test_worker_storage",
  "category": "E2E",
  "tests_before": 18,
  "kept_tests": 3,
  "location": "tests.e2e.test_worker_storage",
  "protects": "A real local storage probe, a real SSH receiver protocol over a disposable local transport, and live output-flood/timeout containment."
 },
 {
  "module": "tests.unit.test_worker_storage_command",
  "category": "SMOKE",
  "tests_before": 10,
  "kept_tests": 2,
  "location": "tests.smoke.test_worker_storage_command",
  "protects": "The real command health receiver measures storage, and only declared credentials are forwarded to it."
 },
 {
  "module": "tests.unit.test_worker_tool_dependencies",
  "category": "SMOKE",
  "tests_before": 10,
  "kept_tests": 1,
  "location": "tests.smoke.test_worker_tool_dependencies",
  "protects": "A configured worker re-observes its native tool graph and refuses a changed library."
 },
 {
  "module": "tests.unit.test_worker_tool_selectors",
  "category": "CRITICAL",
  "tests_before": 5,
  "kept_tests": 1,
  "location": "tests.critical.test_worker_tool_selectors",
  "protects": "Tool selector lookup never executes the selector and refuses shadowed search authority."
 },
 {
  "module": "tests.unit.test_workflow_markdown",
  "category": "E2E",
  "tests_before": 9,
  "kept_tests": 2,
  "location": "tests.e2e.test_workflow_markdown",
  "protects": "A real sample project locks and plans through the CLI with a nested workflow catalog and goes stale on a workflow change, plus the opt-in live generate run."
 },
 {
  "module": "tests.unit.test_workspace",
  "category": "CRITICAL",
  "tests_before": 7,
  "kept_tests": 2,
  "location": "tests.critical.test_workspace",
  "protects": "Transactional tree acceptance: paths cannot escape the tree, and the reference compare-and-swap fails closed."
 },
 {
  "module": "tests.unit.test_write_reservations",
  "category": "CRITICAL",
  "tests_before": 20,
  "kept_tests": 3,
  "location": "tests.critical.test_write_reservations",
  "protects": "Exclusive write reservations: a separate process cannot steal a live reservation, a crashed owner's marker still blocks, and a competing owner never disturbs the first."
 },
 {
  "module": "tests.unit.test_zig_toolchain",
  "category": "DELETE",
  "tests_before": 15,
  "kept_tests": 0,
  "location": null,
  "protects": "Zig discovery against fake binaries, mostly version and message checks."
 },
 {
  "module": "tests.unit.test_zip_packaging",
  "category": "CRITICAL",
  "tests_before": 5,
  "kept_tests": 2,
  "location": "tests.critical.test_zip_packaging",
  "protects": "A native ZIP closure reproduces with an independent adapter, and adversarial members fail even when the outer digest is recomputed."
 }
]