Run a metamorphic relation against a single input. Generator-free.

op(a, b) == op(b, a) — op is commutative.

The MR is over the input pair #(a, a) and the output type b. Use it as:

let mr = metamon.commutativity_of(name: "add_commutative")
metamon.forall_morph(
  generator.tuple2(int_gen, int_gen),
  mr,
  fn(pair) { add(pair.0, pair.1) },
)

Re-export of Config and default_config.

R(U(f(x)), f(T(x))). Equivariance: the input transform T and the output transform U commute with f modulo R.

Run a property over many random inputs.

Run a metamorphic relation over many random inputs.

Run an N-ary metamorphic relation: apply each of transforms to the source input to build follow-up inputs, then assert that the resulting outputs [f(x), f(T0(x)), ..., f(Tn(x))] satisfy relation. Useful when the property requires comparing more than two outputs in one shot (e.g. (a, b, c) ↦ op(op(a,b), c) and its re-associations all agree).

Passing [] for transforms is a programming error (vacuous test) and panics with a structured message.

forall_morph_n with an explicit configuration.

Run a metamorphic relation with an explicit configuration.

Run multiple metamorphic relations against the same generator. Each MR is tried independently; failures are collected and reported together at the end.

Passing [] is a programming error (vacuous test) and panics with a structured message — use forall(...) for a single-input property.

Run a property whose predicate also exposes its intermediate value.

predicate returns #(observation, holds). holds decides whether the property is satisfied (same as forall); observation is recorded under the label predicate value and shown in the failure report — no manual annotate.annotate_value is needed.

Use this when the predicate’s intermediate value (typically f(input)) is what determines the branch. Without it, forall failure reports only show the shrunk source input, which can force a debug round-trip to recover what f(input) actually was.

forall_observable with an explicit configuration.

Run a round-trip property over many random inputs: decode(encode(x)) must equal Ok(x) for every generated x.

The failure report header is round_trip[<name>] so it is immediately obvious from the panic which round-trip broke. The underlying machinery is the same as forall, including shrinking of the source input.

metamon.forall_round_trip(
  gen: generator.bit_array(range.constant(0, 16)),
  name: "base64",
  encode: base64.encode,
  decode: base64.decode,
)

Run a round-trip property where the encoder is partial: the encoder returns Result(b, e_enc) because not every generated input is a valid input for the codec. Inputs the encoder rejects (Error(_)) are treated as out of scope and skipped — the property succeeds for them.

Use this variant for codecs whose encoder has structural preconditions: byte-alignment requirements, value-range checks, hrp / version constraints, etc. A typical pattern is to combine forall_round_trip_partial with a generator that produces the surrounding inputs (e.g. arbitrary BitArray plus arbitrary version bytes); the encoder filters down to the valid subset and the property checks the round-trip on that subset.

The failure report header is round_trip[<name>] so it is immediately obvious from the panic which round-trip broke. The underlying machinery is the same as forall, including shrinking of the source input.

metamon.forall_round_trip_partial(
  gen: generator.tuple2(byte_gen, payload_gen),
  name: "base58check",
  encode: fn(pair) { base58check.encode(pair.0, pair.1) },
  decode: fn(s) {
    case base58check.decode(s) {
      Ok(decoded) -> Ok(#(decoded.version, decoded.payload))
      Error(e) -> Error(e)
    }
  },
)

forall_round_trip_partial with an explicit configuration.

The runner automatically registers a coverage.cover_at_least(1, "encoder_accepted", ok) requirement so a property whose generator is so wide that the encoder rejects every sample fails the test with a structured “coverage shortfall” message rather than passing silently. To enforce a stricter floor (e.g. “at least 50% of inputs must round-trip”), call coverage.cover(50.0, "encoder_accepted", ok) inside your own property body — coverage labels accumulate across calls.

Run a round-trip property using a caller-supplied equality Relation(a) instead of structural ==. The decoded value must satisfy equality.holds(decoded, input).

Use this when the source type carries values that are not preserved verbatim across encode → decode: opaque types whose decoded form normalises (e.g. multipart Part with re-derived convenience fields), MIME types that lowercase the essence, JSON values whose key order is implementation-defined. Composing with relation.equivalent_under(via, name) lets you compare on a projection (e.g. headers + body ignoring derived caches).

The failure report header is round_trip[<name>]. The relation’s own name appears under relation: in the failure block, just like forall_morph failures.

metamon.forall_round_trip_under(
  gen: parts_gen(),
  name: "multipart_round_trip",
  encode: fn(parts) { multipartkit.encode(boundary, parts) },
  decode: fn(body) { multipartkit.parse(body, content_type) },
  equality: relation.equivalent_under(
    fn(parts) { list.map(parts, part_payload) },
    "wire_payload",
  ),
)

forall_round_trip_under with an explicit configuration.

forall_round_trip with an explicit configuration.

Run a property with an explicit configuration.

f(f(x)) == f(x). Idempotency.

Encoded as a Plain MR whose transform is f itself and whose relation is structural equality.

f(T(x)) == f(x) — f is invariant under the input transform.

Construct a Plain MR. The relation is checked between f(source_input) and f(transform.apply(source_input)).

Construct an Equivariant MR. The relation is checked between output_transform.apply(f(source_input)) and f(input_transform.apply(source_input)).

Get the user-facing name of an MR.

Convenience: a fresh random seed.

Construct a deterministic seed from an integer.

Re-export of with_diff_enabled.

Re-export of with_max_edges.

Re-export of with_max_edges_or_panic.

Re-export of with_max_size.

Re-export of with_max_size_or_panic.

Choose the failure-report output format. Text (default) is human-friendly; Json is single-line JSON for CI / LLM consumers.

Re-export of with_regression_file.

Re-export of with_regression_file_or_panic.

Re-export of with_runs.

Re-export of with_runs_or_panic. Use in test code where the bound is statically known and the let assert Ok(c) = ... arm would be dead code.

Re-export of with_seed.

Re-export of with_shrink_limit.

Re-export of with_shrink_limit_or_panic.