13. Conformance testing

Requirement prefix: T13.

What must be tested#

T13.1 Every requirement claimed as satisfied in the conformance matrix MUST have at least one test cited against it.
T13.2 Every such test MUST have been shown to fail when the behaviour it checks is removed or inverted. A test that cannot fail verifies nothing.
T13.3 Each test MUST state, in a comment or its name, the failure mode it guards against. A test whose failure mode nobody wrote down is a test nobody will maintain.

T13.4 Round trip. One fixture covering every modelled class MUST round-trip through canonical JSON, and MUST be byte-identical on a second pass (J9.1, J9.2).
T13.5 Cross-cutting guarantees. The properties that hold across the crate — no PHI in Display or errors, partial orders that stay partial, the four null flavours staying four, unimplemented operations refusing — MUST be tested at the crate boundary, not only inside the module that implements them. These are the properties that regress when someone adds a type by copying the shape of the one next to it.
T13.6 Distinctive markers. Tests for PHI leakage MUST use a string that cannot occur by accident, so "does this output contain patient data?" is answerable by substring search.
T13.7 Interoperability. At least one test MUST read a payload in the divergent forms other implementations emit (J9.8, J9.9) and assert that what the crate writes back is canonical.
T13.8 Doctests. Every public type and every non-trivial public function MUST carry a doctest, and the doctests MUST run in CI. A documented example that does not compile is worse than none, because it costs the reader the time to find out.

T13.9 A test that self-skips MUST say so and MUST fail if it ends up checking nothing.
T13.10 A requirement implemented but untested is ? in the matrix, never • (C0.8).
T13.11 A measurement quoted in documentation or in a comment MUST name what measured it and when (J9.15 is the example: the stack figure carries its toolchain version and its method).

T13.12 cargo clippy --all-targets MUST pass with clippy::pedantic enabled and with missing_docs, missing_errors_doc, and missing_panics_doc denied. A fallible function whose errors are undocumented and a panicking one whose panics are undocumented are both defects in a clinical library, because a caller who does not know cannot guard.
T13.13 unsafe_code MUST be forbidden.
T13.14 Where a lint is suppressed, the suppression MUST carry a comment giving the reason. An unexplained #[allow] is indistinguishable from one added to make a build pass.