test(wl_audit): close item E mutmut survivors 55+88 + re-classify 17 as equivalent

Item G1 of v1.1 test-coverage push.

Closes 2 of the 3 higher-value wl_audit.py survivors from item E
(2026-05-19) with surgical mock-based unit tests in
TestAuditMutationCoverageGaps:

  - test_authorization_header_exact_splunk_prefix kills mutant 55
    (line 156: `"Splunk %s"` → `"XXSplunk %sXX"`). The existing
    test_post_audit_event_sets_headers uses substring `in`, which
    the mutated header `"XXSplunk <key>XX"` slips past. New test
    asserts exact equality on the full header value.

  - test_generic_exception_returns_non_empty_error_message kills
    mutant 88 (line 189: `error_msg = str(e)` → `error_msg = None`
    in the generic exception handler). No prior test exercised
    this branch (existing tests only triggered HTTPError, URLError,
    socket.timeout). New test injects RuntimeError via
    mock_urlopen.side_effect and asserts error_msg is non-None +
    non-empty + contains the original exception's text.

Mutant 17 (line 91: kwarg-filter string `"app_context"` →
`"XXapp_contextXX"`) re-classified as EQUIVALENT. The original
item-E triage claimed it was killable via len(event) assertions,
but closer analysis showed the loop's second write to
event["app_context"] is idempotent — both line-85 and the loop's
line-92 pull from the same kwargs dict, so the dict overwrite has
no observable effect. Documented in MUTATION_TESTING.md.

Manual verification (apply mutation → run new test → confirm
assertion failure → restore):
  - Mutant 55 applied: test fails with
    `expected "Splunk MY_SESSION_KEY_12345", got "XXSplunk
    MY_SESSION_KEY_12345XX"`
  - Mutant 88 applied: test fails with
    `assert None is not None`
  - After restore: 614/614 unit tests pass (+2 from prior 612)

Coverage delta: bin/wl_audit.py 84% → 89% (+5pp).
Effective wl_audit kill rate: 55/90 → 57/90 (61% → 63%).
Remaining 33 survivors are in lower-value classes (log/error
message text, equivalent HTTP-status edge cases, integration-only
paths) per the item-E triage table.

Author: RelativisticJet

docs/MUTATION_TESTING.md

@@ -315,32 +315,52 @@ into 4 classes:
 | HTTP boundary edge cases | 68 (`200 <= status_code < 300` → `<= 300`) | Killable but unusual | Skip — HTTP 300 (Multiple Choices) is rarely seen and not load-bearing |
 | Event-building + HTTP path | 17 (kwarg filter), 55 (auth header template), 88 (None error_msg) | Killable, higher value | Defer to v1.1 item G |
 
-### Higher-value survivors (deferred to item G)
+### Higher-value survivors (status updated 2026-05-19 during item G)
 
 - **Mutant 17** (line 91): kwarg filter `("app_context", "comment")`
-  → `("XXapp_contextXX", "comment")`. Mutated version doesn't filter
-  `app_context`, so it would be added to the event dict redundantly
-  with the explicit `event["app_context"] = ...` write earlier. The
-  resulting event would have `app_context` twice. Killable by
-  asserting `len(event) == expected_field_count` in test_audit.
+  → `("XXapp_contextXX", "comment")`. **RECLASSIFIED AS EQUIVALENT.**
+  The original triage claimed this was killable via
+  `len(event) == expected_field_count` because the unfiltered loop
+  would write `app_context` to the event again. Closer analysis
+  during item G showed the second write is idempotent:
+  `event["app_context"] = kwargs["app_context"]` overwrites the
+  line-85 assignment with the *same* value (both pull from the same
+  `kwargs` dict), and a dict overwrite does not add a key. No
+  observable behavior changes for any test input. The mutant is
+  structurally indistinguishable from the original.
 
 - **Mutant 55** (line 156): HTTP Authorization header template
-  `"Splunk %s"` → `"XXSplunk %sXX"`. Production code would send
-  malformed auth header; Splunk REST API would reject with 401.
-  Tests mock urlopen and don't inspect the actual header value.
-  Killable by mock-asserting the header value.
+  `"Splunk %s"` → `"XXSplunk %sXX"`. **CLOSED in test_audit.py
+  `test_authorization_header_exact_splunk_prefix` (item G,
+  2026-05-19).** The existing
+  `test_post_audit_event_sets_headers` used `"Splunk <key>" in
+  <header>` (substring), which the mutated `"XXSplunk <key>XX"`
+  passes. The new test asserts exact equality on the full header
+  value. Manually verified: applying the mutation locally produces
+  the assertion failure
+  `expected "Splunk MY_SESSION_KEY_12345", got "XXSplunk
+  MY_SESSION_KEY_12345XX"`.
 
 - **Mutant 88** (line 189): `error_msg = str(e)` → `error_msg = None`
-  in the generic exception handler. Caller receives `(False, None)`
-  instead of `(False, "real error text")`, masking diagnostics. Test
-  could assert `error_msg is not None and len(error_msg) > 0` in the
-  exception path.
-
-These ~3-5 higher-value survivors are in the integration-tested HTTP
-send path. Closing them via unit tests would require mocking the
-urllib.request layer — a different style of test than the existing
-event-construction unit tests. Defer to v1.1 item G as part of the
-broader test-coverage push.
+  in the generic exception handler. **CLOSED in test_audit.py
+  `test_generic_exception_returns_non_empty_error_message` (item
+  G, 2026-05-19).** No prior test exercised the generic
+  `except Exception` branch (existing tests only triggered HTTPError,
+  URLError, socket.timeout). The new test injects a `RuntimeError`
+  via `mock_urlopen.side_effect` and asserts `error_msg is not None`
+  + non-empty + contains the original exception's text.
+  Manually verified: applying the mutation produces `assert None
+  is not None` failure.
+
+Closing summary (item G first batch, 2026-05-19):
+- Mutant 17 → equivalent (triage corrected — no test possible without
+  destroying program semantics).
+- Mutant 55 → killed by exact-string header assertion.
+- Mutant 88 → killed by mocked-`side_effect` generic-exception test.
+- Effective wl_audit kill rate after this batch: 57/90 → **63%**
+  (was 55/90 = 61%). 33 survivors remain, all in the lower-value
+  classes (log/error message text, equivalent HTTP-status edge
+  cases, integration-only paths).
 
 ---
 

tests/unit/test_audit.py

@@ -409,3 +409,90 @@ def test_truncation_count_message_reports_exact_dropped_count(
             "expected the truncation marker to report the exact "
             "number of dropped entries, got: {!r}".format(marker)
         )
+
+    @patch('wl_audit.urllib.request.urlopen')
+    def test_authorization_header_exact_splunk_prefix(self, mock_urlopen):
+        """Kill mutmut #55 (item E, 2026-05-19): Authorization header
+        template ``"Splunk %s"`` mutated to ``"XXSplunk %sXX"``.
+
+        Existing ``test_post_audit_event_sets_headers`` uses a substring
+        ``in`` assertion (``"Splunk test-session-key" in <header>``) which
+        the mutation slips past — the malformed header
+        ``"XXSplunk test-session-keyXX"`` still contains the substring.
+        In production the malformed header would cause Splunk's REST API
+        to reject the request with 401 (unauthorized) and audit events
+        would silently fail to land. Pin the header value with exact
+        equality so any character mutation is killed.
+        """
+        from wl_audit import build_audit_event, post_audit_event
+
+        mock_response = MagicMock()
+        mock_response.status = 200
+        mock_urlopen.return_value = mock_response
+
+        event = build_audit_event(
+            action="added",
+            analyst="jsmith",
+            detection_rule="Rule 1",
+            csv_file="file.csv",
+        )
+        post_audit_event("MY_SESSION_KEY_12345", event)
+
+        req = mock_urlopen.call_args[0][0]
+        auth_header = req.headers["Authorization"]
+
+        # Exact format pin: "Splunk <session_key>" — any character
+        # mutation in the literal prefix or its template structure
+        # produces a different string and fails this assertion.
+        assert auth_header == "Splunk MY_SESSION_KEY_12345", (
+            "Authorization header must be exactly "
+            "'Splunk MY_SESSION_KEY_12345' (no extra characters, "
+            "no template drift). Got: {!r}".format(auth_header)
+        )
+
+    @patch('wl_audit.urllib.request.urlopen')
+    def test_generic_exception_returns_non_empty_error_message(self, mock_urlopen):
+        """Kill mutmut #88 (item E, 2026-05-19): generic ``except Exception``
+        branch assigns ``error_msg = str(e)``, mutated to ``error_msg = None``.
+
+        The HTTPError / URLError / socket.timeout branches are covered by
+        other tests, but the catch-all ``except Exception`` branch has no
+        coverage. Mutating ``error_msg = str(e)`` to ``error_msg = None``
+        makes the caller receive ``(False, None)`` instead of
+        ``(False, "real error text")``, masking diagnostic information.
+
+        Trigger by raising a non-{HTTPError, URLError, timeout} exception
+        (RuntimeError) from urlopen, then assert that the returned
+        ``error_msg`` is a non-empty string containing the original
+        exception's text.
+        """
+        from wl_audit import build_audit_event, post_audit_event
+
+        # RuntimeError doesn't match any of the specific except clauses
+        # (HTTPError, URLError, socket.timeout) — falls through to the
+        # generic ``except Exception``.
+        mock_urlopen.side_effect = RuntimeError("kaboom: unexpected runtime failure")
+
+        event = build_audit_event(
+            action="added",
+            analyst="jsmith",
+            detection_rule="Rule 1",
+            csv_file="file.csv",
+        )
+        success, error_msg = post_audit_event("SESSION_KEY", event)
+
+        assert success is False
+        # Mutant 88 sets error_msg = None — explicitly assert it isn't None.
+        assert error_msg is not None, (
+            "error_msg must not be None — mutant 88 silently drops "
+            "the diagnostic text from generic-exception failures."
+        )
+        assert isinstance(error_msg, str), (
+            "error_msg must be a string for caller-side logging compat. "
+            "Got type: {}".format(type(error_msg))
+        )
+        assert len(error_msg) > 0, "error_msg must contain diagnostic text"
+        assert "kaboom" in error_msg, (
+            "error_msg should preserve the original exception's text "
+            "(str(e) behavior). Got: {!r}".format(error_msg)
+        )