diff --git a/docs/plans/fuzzing.md b/docs/plans/fuzzing.md index b98e157..4b2cd87 100644 --- a/docs/plans/fuzzing.md +++ b/docs/plans/fuzzing.md @@ -41,7 +41,10 @@ Progress log: - **2026-09-29 — target 3 (`spec_import`) implemented (wave 2).** Harness + 42 seeds + the three `fuzzing` hubs; no crate findings in the initial corpus replay (11 shared tests green, main crate 457 - default / 590 all-features). Smoke campaign results in §5. + default / 590 all-features). Smoke campaign clean: 2.34M execs / + 10 min, zero crash/OOM/timeout, coverage still growing at budget + end (see §5). One harness-assert fix on the way (the quoted-`""` + YAML key noted above). --- @@ -355,8 +358,23 @@ exited 0, artifact dirs empty — no crash/hang/OOM/leak): - Toolchain notes live in `fuzz/README.md`; nightly stays confined to `fuzz/`. -Wave-2 (`spec_import`) campaign results: filled in below after the -smoke run completes. +Wave-2 (`spec_import`) smoke campaign (2026-09-29, 10 min, exited 0, +artifact dirs empty): + +- `spec_import` — 2.34M execs at ~4k/s (each exec replays the three + spec constructors + the YAML boundary + compile/harden/validate + + the MCP tool lane + `$ref` resolution, so per-exec work is heavy), + coverage still growing at budget end: 14.1k edges / 36.9k features + / 3046 in-memory corpus entries. One early abort in the *first* + launch, a harness assert too strong for the documented boundary + (an explicitly-quoted `""` YAML mapping key is legal — JSON + has the same key; the nullish-key rejection covers the implicit + null key, not a quoted empty string), fixed before the counted run; + no crate finding. +- **Seeds regenerate deterministically:** `python3 + fuzz/gen_fuzz_seeds.py`. +- Toolchain notes live in `fuzz/README.md`; nightly stays confined to + `fuzz/`. ## 6. Sequencing @@ -364,10 +382,11 @@ smoke run completes. exclude, toolchain pin, runner, seed generator, README) + targets 1–2 + corpora + corpus replay + AGENTS.md gate + smoke campaigns (clean, see §5). Includes the FWD-20 SSE dribble quadratic fix. -2. ✅ **Done (2026-09-29)** — target 3 (`spec_import`): harness + - invariants (`fuzz/shared/src/spec_import.rs`), 42 seeds, `json.dict` - extended with the OpenAPI-token set, fuzzing hubs in the three - driven modules. Smoke campaign: see §5. +2. ✅ **Done (2026-09-29, commit e6491e3)** — target 3 + (`spec_import`): harness + invariants + (`fuzz/shared/src/spec_import.rs`), 42 seeds, `json.dict` extended + with the OpenAPI-token set, fuzzing hubs in the three driven + modules. Smoke campaign clean (see §5). 3. **Next** — target 4 stateful wave + longer campaigns; revisit corpus merges if any campaign yields inputs worth curating.