alkblobs/tasks/review-wave-11.md

id, name, status, depends_on, scope, risk, impact, level, tags

id	name	status	depends_on	scope	risk	impact	level	tags
review-wave-11	Wave 11 review gate — the fuzzing gate	completed	fuzz-campaigns-and-gate	narrow	low	phase	review	wave-11 review fuzzing

Description

The wave-11 review gate (docs/plans/implementation.md §Review gates — the fuzzing gate), before wave 12 (release readiness) decomposes. The wave's claim: the family fuzzing pattern landed over the remediated surface's parse clusters, campaigns ran, and the corpus-replay gate joined the verification list. The gate audits exactly that claim.

Gate checks:

• Campaigns run clean — or findings fixed + crash inputs promoted to committed seeds + re-run clean; the dispositions recorded (crate-side vs harness-model), escalations honored.
• The corpus-replay gate green on stable — cargo test --manifest-path fuzz/shared/Cargo.toml replays every committed seed through the invariants; the gate line present in AGENTS.md's Verification Commands with the detached-runner note; the fuzzing paragraph reflects the landed state.
• Seeds committed per the corpus policy — hand-made seeds + promoted crash inputs in git; grown corpora/artifacts ignored; git status clean of corpus noise; the generator re-run a no-op.
• The exposure audited — fuzz-ingress-exposure's diff is visibility-only (three keywords + the doc-hidden re-export block + doc notes), the semver note recorded, the reachability pin present; the ops-ingress target drives the production function, not a shim.
• The deferred-surface dispositions recorded — the plan's wave-11 decomposition record names them (the binary channel framing → alkcall's surface; the put-path staging logic → wave 9's deterministic failure-path regression coverage); confirm nothing worth fuzzing was silently skipped.
• Statuses updated — the plan's wave table row and the task files' statuses/summaries reflect what landed.
• Gates green (the AGENTS verification matrix, now including the fuzz gate): cargo test (default), cargo test --all-features server-less (clean skips), cargo test --all-features against the live harness (the pg acceptance), clippy --all-targets -- -D warnings across the feature variants, cargo fmt --check, cargo doc --no-deps, and the corpus-replay gate.

Live harness

export ALKBLOBS_PG_HOST=localhost
export ALKBLOBS_PG_PORT=15432
export ALKBLOBS_PG_USER=postgres
export ALKBLOBS_PG_PASSWORD=poc
export ALKBLOBS_PG_DB=blobs

The local dockerized postgres container (pglo-poc, postgres:16-alpine on :15432) — running for dev/testing; the pg columns' acceptance requires it.

Findings are fixed inline where cheap, or recorded as wave-12 amendments (release readiness reads them).

Acceptance Criteria

• Every gate check above passes (each verified against the diff and the campaign logs, not the task's claim)
• The corpus-replay gate green on stable; the AGENTS flip verified
• The corpus policy verified (committed seeds only; generator no-op)
• The exposure diff audited visibility-only
• The plan's wave table + task statuses/summaries current
• All gates green across the verification matrix (incl. the fuzz gate)

References

• docs/plans/implementation.md (§Wave 11; §Review gates — the fuzzing gate; §The waves — wave 12's dependency)
• tasks/fuzz-scaffold.md, tasks/fuzz-ingress-exposure.md, tasks/fuzz-target-key-encoding.md, tasks/fuzz-target-ops-ingress.md, tasks/fuzz-campaigns-and-gate.md
• AGENTS.md (the verification matrix + the fuzzing paragraph)
• /workspace/@alkdev/alkstore/tasks/review-wave-7.md (the family's fuzzing-gate precedent, if present in shape)

Notes

• Commit chain verified: all five task hashes in the wave log match git log (fuzz-scaffold 43083a4, fuzz-ingress-exposure 925f153, fuzz-target-key-encoding 0898d3a, fuzz-target-ops-ingress 0b62e6b, fuzz-campaigns-and-gate 57bb36c); tree clean at review start.
• Campaigns run clean — verified against the on-disk campaign logs (fuzz/artifacts/{key_encoding,ops_ingress}-20261016-071925.log), not just the task's claim: both INFO: exiting: 0 (1219 s / 1242 s), oom/timeout/crash: 0/0/0 at the final lines, both artifacts dirs empty. Dispositions recorded in fuzz-campaigns-and-gate's Notes (successful negative result — zero crate-side findings, zero harness-model findings, nothing promoted). Escalation path never triggered.
• The corpus-replay gate green on stable — cargo test --manifest-path fuzz/shared/Cargo.toml: 7 tests green (both corpus replays + the no-corpus, boundary-exactness, over-count honesty, and S-5 posture probes). The AGENTS flip verified: the Verification Commands block carries the gate line with the detached-runner note; the fuzzing paragraph describes the landed state (targets inventory, nightly-inside-fuzz-only, detached-runner rule, corpus policy).
• Seeds committed per the corpus policy — git ls-files: 119 (key_encoding, seed-000..118) + 53 (ops_ingress, seed-000..052) committed; on-disk corpus dirs held the grown corpora (724 / 1151) invisible to git status — the gitignore's final retightened form (dirs re-included, contents ignored, !corpus/<target>/seed-*) verified. python3 fuzz/gen_fuzz_seeds.py re-run: no-op diff (clean before and after). git status noise-free throughout the review.
• The exposure audited visibility-only — 925f153's diff read in full: fn → pub fn, two structs → pub struct with pub fields + field docs, the two #[doc(hidden)] re-export statements (ops/mod.rs facade hop → lib.rs under #[cfg(feature = "ops")]) with the fuzz/test-only doc note, the new src/fuzz_surface_tests.rs reachability pin, the module declaration, and the task file. Zero logic/signature/derive changes. The semver note is recorded on the task. The ops-ingress target drives the production fetch_ranges_ingress through those re-exports (verified in fuzz/shared/src/ops_ingress.rs's import of the crate-root names) — no shim.
• The deferred-surface dispositions confirmed present — the plan's wave-11 target inventory names both: binary channel framing → alkcall's surface (no alkblobs-owned codec; pumps write raw bytes over BiStream), put-path staging logic → wave 9's deterministic failure-path regression coverage (concurrency/cancellation hazard class unreachable by the libFuzzer byte-input model). Nothing worth fuzzing silently skipped — both dispositions carry their reasons.
• Statuses were one edit short (fixed inline): the plan's wave table row still read "decomposed (2026-10-15)" — updated to "completed (2026-10-16; gate green)" and the frontmatter last_updated brought to the wave-11-completed state. The five task files' statuses/summaries were already current and accurate.
• Minor inline fix: fuzz/.gitignore lacked a trailing newline after the final negation line — added.
• Gates green (each run fresh in this session, not trusted from the tasks):
  • cargo test (default): green — 149 unit + 54 conformance + 4 git-interop
  • cargo test --all-features against the live harness (the pglo-poc container verified running, postgres:16-alpine on :15432): green — 328 unit + 125 conformance + 4 git-interop (the pg columns ran for real, not skipped)
  • cargo clippy --all-targets -- -D warnings and cargo clippy --all-features --all-targets -- -D warnings: clean
  • cargo fmt --check: clean
  • cargo doc --no-deps: warning-free
  • the corpus-replay gate: green (above)

Summary

The wave-11 fuzzing gate ran green (2026-10-16). Every claim audited against primary evidence: the five landed commits match the wave log; both detached campaigns' on-disk logs show clean exits (exit 0, zero oom/timeout/crash, zero artifacts, zero findings — nothing promoted, nothing escalated); the corpus-replay gate is green on stable (7 tests) and present in AGENTS.md's Verification Commands with the landed-state fuzzing paragraph; the committed seed sets are exactly the hand-made 119 + 53 with the generator re-run a no-op, grown corpora gitignored, and git status clean; the exposure diff is visibility-only as specified (semver note recorded, reachability pin present, the production function driven); both deferred-surface dispositions are recorded with their reasons in the plan. Full gate matrix green, including the live-harness --all-features acceptance against the running pglo-poc container. Two minor inline fixes: the plan's wave-11 table row + frontmatter last_updated brought to completed state, and a trailing newline on fuzz/.gitignore. Wave 12 (release readiness) is unblocked to decompose.