glm-5.3-flash
5971c0a0d6
Adopt the alk*/fuzzing posture (alkcall 0.8.1 precedent) — the dep
bump this ride-along builds on was 4005517:
- docs/plans/fuzzing.md: the four-target plan (sse_parser,
ws_chunk_framing this session; spec_import + the stateful wave
later), the infrastructure blueprint, and the corpus/campaign
policies (§3's table tracks progress)
- fuzz/ workspace (the sibling layout): nightly-pinned subtree,
stable fuzz/shared invariant library (corpus replay = the standing
fuzz gate), detached runner (never a foreground child of an agent
session), JSON dict, deterministic seed generator; 80 committed seeds
- two wave-1 targets: sse_parser (SseParser::feed + the FWD-17
envelope mapping — the parser every subscription forwards through)
and ws_chunk_framing (WriteChunkWalk, the write pump's chunk walk)
- crate-side surfacing: SseParser/SseEvent/sse_event_envelope are pub
behind the adapters::forward::fuzzing re-export hub; the write
pump's inline chunk loop extracted as WriteChunkWalk (pump byte
behavior unchanged — 441 tests green); retained_bytes() diagnostic
(the alktunnels/alksocks posture)
- root Cargo.toml gains the explicit [workspace] table with
fuzz/ excluded (auto-discovery would pull the nightly-consumed
dev-deps into the stable build — the alkcall trap); fuzz/ joins the
publish exclude list
- AGENTS.md verification checklist gains the corpus-replay line
FWD-20 fix, found by driving the new sse_parser harness: feed()
rescanned the whole reassembly buffer per feed — a dribble-fed
subscription (one unterminated line over many small chunks) cost
quadratic CPU (1 MiB dribble ≈ minutes per connection, unbounded
total). Line assembly now walks only the arriving chunk: the buffer
holds just the current line, the scan never revisits drained bytes.
1 MiB dribble: ~5 min (quadratic) → 21 ms (linear). Regression test
sse_parser_dribble_feeds_do_not_rescan_the_buffer.
Verification: cargo test 441 passed; cargo test --all-features ok;
clippy --all-targets -- -D warnings (main + fuzz/shared) clean;
fmt --check (main, fuzz, fuzz/shared) clean; cargo fuzz build clean;
corpus replay (cargo test --manifest-path fuzz/shared/Cargo.toml) 80
seeds green.
Refs: alkcall docs/research/fuzzing.md (§7.9 posture), alksocks
08a3694 (the sibling wave-1 shape), docs/plans/fuzzing.md §2
alkhttp fuzzing
cargo-fuzz targets for the HTTP surface's hand-rolled parse paths. The
design and operating rules live in docs/plans/fuzzing.md (adopted
from alkcall's docs/research/fuzzing.md); this README is the
operational cheat-sheet.
Layout
fuzz_targets/— nightly-onlyfuzz_target!binaries (thin wrappers).shared/— stable-toolchain library holding the invariant logic; the corpus replay tests run here on plaincargo test.corpus/<target>/— committed seeds (regenerate withpython3 fuzz/gen_fuzz_seeds.py).artifacts/— gitignored crash/oom/timeout artifacts + campaign logs.
Targets
| Target | Drives |
|---|---|
sse_parser |
SseParser::feed + the FWD-17 envelope mapping (src/adapters/forward.rs) — the SSE frame parser every subscription forwards through |
ws_chunk_framing |
WriteChunkWalk (the write pump's chunk walk) (src/websocket/byte_adapter.rs) |
Running a campaign — always detached
Agent sessions must never run fuzzing in the foreground (an OOM in a target can take down the session host; see docs/plans/fuzzing.md §2). Use the detached runner:
fuzz/run-detached.sh sse_parser
# poll:
tail -n 50 fuzz/artifacts/sse_parser-*.log
ls fuzz/artifacts/sse_parser/
pgrep -f "cargo fuzz run sse_parser"
FUZZ_RUNTIME_SECS=1800 fuzz/run-detached.sh sse_parser for a longer
campaign. The runner pins -fork=1 -rss_limit_mb=2048 -malloc_limit_mb=2048 -timeout=25 and detaches via setsid + nohup.
Corpus replay (the standing fuzz gate)
cargo test --manifest-path fuzz/shared/Cargo.toml
Replays every committed seed through the same invariant functions the fuzzer runs, on stable, no nightly needed. Part of the release verification checklist (AGENTS.md).
Toolchain notes
rust-toolchain.toml pins nightly for this subtree only (llvm-tools
required by cargo-fuzz); the crate itself stays on stable at MSRV 1.88.
cargo fuzz build must be run with the fuzz dir as CWD or trust the
toolchain file (rustup resolves per directory).
Run campaigns before releases and after touching src/adapters/forward.rs
(the SSE parser) or src/websocket/byte_adapter.rs (the WS chunk walk).