property-based-testing/SOURCE.md

Source, license and execution boundaries

Property-Based Testing from Trail of Bits Skills and repository contributors. Pinned source: https://github.com/trailofbits/skills/tree/82fe8226252622fa807643bdca1710901198553a/plugins/property-based-testing/skills/property-based-testing License: CC BY-SA 4.0, https://creativecommons.org/licenses/by-sa/4.0/ . Full legal text, a separate publisher grant, original credits and links are bundled. Keep attribution, license/source links and change notices; adaptations must observe ShareAlike. Included names and brand assets do not imply endorsement.

All nine skill-directory files and four license/source-context files are retained byte for byte. Five references and the original skill README are complete. BB Skills adds SOURCE.md, BB-SKILLS-REVIEW.json and an original examples/probe_property_fixture.py with its recorded native-property-evidence.json. These additions also use CC BY-SA 4.0. The .bb1 version suffix is independent packaging metadata, not an upstream release number. Source-context relative links refer to the pinned repository rather than this smaller ZIP.

This is guidance for selecting, writing, reviewing and explaining properties. It is not an executable testing service. Installing the package does not add a project dependency, run a model, activate CI, submit findings, run mutation campaigns or deploy contracts. Choose the actual language and existing library; introducing a new dependency in an existing project is a separate project-owner decision. An isolated synthetic test fixture is different from altering that project.

The larger repository's AI evaluation harnesses, prompts and smart-contract test fixtures are not included or executed. The bundled agents/openai.yaml and plugin metadata describe upstream integration and display settings. Claude Code and Codex are catalog browsing labels, not proven runtime compatibility. This review does not execute an AI client or evaluate the full skill. Any separate Hypothesis fixture must identify its own code, strategies, library version, generated cases, seeded counterexamples and limits.

A generated passing run samples a finite domain. It cannot prove every input works, the property itself is correct, or arbitrary code is safe. A shrunk counterexample must be classified against a stated contract: implementation defect, invalid strategy, wrong property, or ambiguous specification. The source's strongest-to-weakest ordering is a rule of thumb; a weak idempotence check can still pass a function returning a constant. Test independent preservation requirements and retain important regression examples.

No paid resource, model service or cloud project was used. Downloads are free; model/tool/cloud prerequisites and charges are separate from this package license. Read each reference before applying it to financial, contract, authentication or production data.