2) Attached to your primary contract code is other code, called an “assert guard” contract. Attached to it is the tests, as well as the primary code. It has a multi-sig of owners capable of changing the primary contract code.
Assert Guards: Towards Automated Code Bounties & Safe Smart Contract Coding on Ethereum
ConsenSys
282
This seems to assume that the tests are bug-free and thorough. The tests will need updating as well. I suggest having the contract code be ignorant of any tests, have bounties for writing tests, and use a registry to connect contracts with with tests, as well as controlling access and versioning of the contracts and tests.
The big question that I’m grappling with is who would pay the bounties for tests? Who has incentive to push ether into this system?