Makefile

@@ -43,10 +43,10 @@ export DOCKER_HOST := unix://$(PODMAN_SOCK)
 endif
 endif
 
-.PHONY: ci lint build unit smoke up down local local-down changelog openzaak-up openzaak-smoke openzaak-seed openzaak-down stack-up stack-smoke stack-down keycloak-up keycloak-smoke keycloak-down flowable-up flowable-smoke flowable-down help
+.PHONY: ci lint build unit mutation smoke up down local local-down changelog openzaak-up openzaak-smoke openzaak-seed openzaak-down stack-up stack-smoke stack-down keycloak-up keycloak-smoke keycloak-down flowable-up flowable-smoke flowable-down help
 
-## ci: run the full pipeline — lint, build, unit, smoke (mirrors Gitea Actions)
-ci: lint build unit smoke
+## ci: run the full pipeline — lint, build, unit, mutation, smoke (mirrors Gitea Actions)
+ci: lint build unit mutation smoke
 
 ## lint: verify formatting (no changes)
 lint:
@@ -60,6 +60,15 @@ build:
 unit:
 	dotnet test $(SLN) -c Release
 
+## mutation: run the Stryker.NET ratchet on the ACL (fails below the recorded baseline)
+# Stryker is pinned as a local dotnet tool (.config/dotnet-tools.json); `tool restore`
+# makes `make mutation` work from a fresh clone. Config + break threshold (the ratchet,
+# CLAUDE.md §5) live in services/acl/stryker-config.json. The ACL is the first service
+# with branching logic, so it sets the repo-wide baseline; later slices ratchet it up.
+mutation:
+	dotnet tool restore
+	cd services/acl && dotnet stryker
+
 ## smoke: seed config, bring the whole stack up, wait for health-checked services, tear down
 # SEED populates the external config volumes first (upstream images used verbatim;
 # only our acl/bff are built). `up -d --build` starts EVERYTHING. Readiness is

services/acl/stryker-config.json

@@ -0,0 +1,11 @@
+{
+  "stryker-config": {
+    "solution": "Acl.slnx",
+    "reporters": ["progress", "html"],
+    "thresholds": {
+      "high": 95,
+      "low": 90,
+      "break": 90
+    }
+  }
+}