alkblobs/tasks/fuzz-campaigns-and-gate.md

id, name, status, depends_on, scope, risk, impact, level, tags

id	name	status	depends_on	scope	risk	impact	level	tags
fuzz-campaigns-and-gate	Fuzz campaigns (detached) + corpus-replay gate wiring + AGENTS.md verification-list flip	completed	fuzz-target-key-encoding fuzz-target-ops-ingress	moderate	medium	phase	implementation	wave-11 fuzzing

Description

The wave's operational close (the family pattern's sequencing tail: seeds committed → campaigns → fix anything found → corpus replay green) plus the two wiring deliverables the plan names:

• Campaigns, detached only — the family rule inherited verbatim: per target, via fuzz/run-detached.sh — never a foreground child of an agent session (an OOM in a target must not take down the agent host; the setsid detach is the fix for the process-tree-kill derailing). Budget 10-30 min per target (FUZZ_RUNTIME_SECS), flags per the family's starting points: key_encoding -max_len=4096 -use_value_profile=1; ops_ingress -max_len=65536 -dict=json.dict. Poll per the runner's contract (tail the log, ls the artifacts dir, pgrep -af to LIST — kill by explicit pid from the runner's echoed pid=, never pattern-kill-and-recheck in one call).
• Findings disposition: crate-side bugs are fixed (the fix rides this task when small; crash inputs are promoted to committed seeds — the seed-900+ numbering posture — and the campaign re-run clean); large or design-shaped findings escalate to the user before any postulate-and-fix. Harness-model findings (no crate bug) are documented in the task Notes (the family's successful-negative-result disposition applies if campaigns find nothing crate-side).
• Corpus policy final state: committed hand-made seeds + promoted crash inputs; grown corpora and artifacts gitignored (the scaffold's pattern, retightened to the alkstore final form — dirs re-included, contents ignored, !corpus/<target>/seed-* — so libFuzzer's fork-mode corpus merges don't leak SHA-named units into git status); verify git status shows no grown-corpus noise after campaigns; gen_fuzz_seeds.py re-run is a no-op diff on the committed set.
• The AGENTS.md verification-list flip (the plan's named design point — "the corpus-replay gate joins the verification list when the wave lands"): cargo test --manifest-path fuzz/shared/Cargo.toml joins the Verification Commands with the one-line note that campaigns run only via the detached runner; the fuzzing paragraph ("No fuzz targets exist yet for this crate … until then ignore fuzzing") rewritten to the landed state (the targets, the detached-runner rule, the corpus policy).
• fuzz/README.md finalized: targets table complete, campaign commands, corpus policy.

Acceptance Criteria

• Every target has had a detached campaign (≥10 min) via run-detached.sh; logs + artifact state recorded in Notes
• Campaigns clean, or findings fixed + crash inputs promoted to committed seeds + re-run clean; dispositions recorded (crate-side vs harness-model)
• Corpus policy verified: committed seeds only in git; grown corpora/artifacts ignored; gen_fuzz_seeds.py re-run is a no-op diff on the committed set
• cargo test --manifest-path fuzz/shared/Cargo.toml green (the gate, on stable)
• AGENTS.md Verification Commands carry the gate line; the fuzzing paragraph reflects the landed state
• fuzz/README.md finalized (targets table, commands, corpus policy)
• Root workspace gates + shared clippy/fmt gates green

References

• docs/plans/implementation.md §Wave 11 (the corpus-replay gate's named design point; the corpus policy: committed crash-input seeds, grown corpora gitignored)
• docs/plans/implementation.md §Review gates — Wave 11 review (the gate this task feeds)
• /workspace/@alkdev/alkstore/tasks/fuzz-campaigns-and-gate.md (the family operational-close pattern this adapts — its Notes carry the gitignore retightening, the polling note, and the successful-negative-result disposition)
• tasks/fuzz-scaffold.md (the runner + gitignore this task exercises)
• AGENTS.md (the verification block and the fuzzing paragraph this task flips)

Notes

• Campaigns ran in parallel (20-min budget each, FUZZ_RUNTIME_SECS=1200), detached via fuzz/run-detached.sh (the setsid+nohup rule; polled per the runner's contract — log tails, artifact-dir ls, pgrep -af to LIST): logs fuzz/artifacts/{key_encoding-20261016-071925, ops_ingress-20261016-071925}.log.
  • key_encoding (flags -max_len=4096 -use_value_profile=1): 1219 s, INFO: exiting: 0; peak cov: 766 ft: 5976 corp: 708, oom/timeout/crash: 0/0/0 throughout.
  • ops_ingress (flags -max_len=65536 -dict=json.dict): 1242 s, INFO: exiting: 0; peak cov: 2081 ft: 7075 corp: 1034, oom/timeout/crash: 0/0/0 throughout.
• Zero artifacts (fuzz/artifacts/<target>/ empty for both at campaign end); no findings — crate-side or harness-model. The successful-negative-result disposition applies: both committed seed sets replay green through the stable invariants and the parsers held their contracts under ~20 min of guided fuzzing each. No crash inputs to promote.
• Corpus policy verified post-campaign: git status noise-free during and after the campaigns (the scaffold task's gitignore retightening held through libFuzzer fork-mode corpus merges — the grown corpora, ~708/~1034 units, stayed invisible); no fuzz processes remained after the runners exited; no stray pids; the artifacts dirs stay gitignored.
• gen_fuzz_seeds.py re-run post-campaign: no-op diff on the committed set (determinism held).
• AGENTS.md flipped — the verification-list design point: the gate line (cargo test --manifest-path fuzz/shared/Cargo.toml) joined the Verification Commands block with the detached-runner note; the stale "No fuzz targets exist yet … until then ignore fuzzing" paragraph rewritten to the landed state (targets inventory, the nightly-inside-fuzz-only posture, the detached-runner rule, the corpus policy).
• fuzz/README.md needed no edit — the target tasks finalized it (targets table, commands, corpus policy) as they landed; verified consistent with what shipped.
• Gates: root cargo test (green, 54/4/149 results-suites), cargo test --all-features (green), both clippy walls (-D warnings) green, cargo fmt --check green; fuzz/shared: test gate green (7 corpus-replay tests), clippy -D warnings green, fmt --check green.

Summary

Wave 11's operational close landed: both targets (key_encoding, ops_ingress) ran clean, detached ≥20-min campaigns (exit 0, zero artifacts, zero findings — crate-side or harness-model), the corpus policy verified end-to-end against grown corpora (gitignored, gen_fuzz_seeds.py re-run a no-op), the corpus-replay gate green on stable, and the AGENTS.md verification-list flip done (gate line + landed-state fuzzing paragraph; the pre-wave "no targets / ignore fuzzing" text removed). fuzz/README.md was already final from the target tasks. All root and shared gates green. No promoted crash inputs — no crate bugs found.