- alkvault 0.1 -> 0.2 (breaking req): decrypt returns
Zeroizing<String> (alkvault review 001, resolution paths 1+2); the
adapter seam's own wrap in decrypt_and_decode is dropped (the
pre-wrap window ADR-005 decision 3 recorded is closed upstream —
the vault fences the plaintext from its return onward, every path
including the UTF-8 error one; rotate never holds a bare plaintext
either). decode_key_arm's signature is unchanged.
- alktunnels 0.4.1 -> 0.5.0 (breaking req, additive API): the
review-003 W2 adoption's dep half (the establisher shape's
registration ride lands in the next commit).
- alktty 0.8.1 -> 0.8.2 (patch, PTY exit-signal fidelity): pin text
refreshed; no alkssh contract change (the negative-code convention
is consumed verbatim).
- seam docs re-shaped to the closed-gap posture (key_source module +
decrypt arm + decode arm; doubles.rs; fuzz key_decode battery).
Verification: cargo test (default + --all-features), clippy x2
-all-features -D warnings, fmt, fuzz corpus replay (11).
Verification of the flake check: e2e real_git_push row 6+ isolated
passes on both trees (one full-matrix load flake, pre-existing abort
race, not this change).
The family standing rule (anything worth fuzzing gets fuzzed) on the
crate's ingress surfaces, per the alkgit convention:
- fuzz_targets/{exec_parse,fingerprint,key_decode,terminal_params} —
thin fuzz_target! wrappers over four ingress surfaces:
- exec_parse: the production parse path (from_utf8-fallback ingress
shape), differentially paired against a from-spec grammar oracle;
typed routing classes + determinism.
- fingerprint: blob parse + the single fingerprint path; the
SHA256:/unpadded-base64 contract shape via a from-spec
base64 round-trip oracle; the committed ssh-keygen -lf vectors
replayed inside the gate.
- key_decode: the production decode arm (the #[doc(hidden)]
decode_key_arm exposure, routed through itself); typed-class +
bounded-fixed-message invariants; passphrase-shape robustness
drive on the underlying decode.
- terminal_params: the pty_request conversion via the #[doc(hidden)]
terminal_params exposure; exact clamp, verbatim term, the
reserved-modes {} JSON shape, serialized-shape determinism.
- shared/ — the invariant logic as a stable-clean library; the
corpus gate (cargo test --manifest-path fuzz/shared/Cargo.toml)
replays every committed seed through the batteries and joins
AGENTS.md's verification list.
- corpus/<target>/ committed seeds + the deterministic
gen_fuzz_seeds.py (no-op-diff verified).
- run-detached.sh + nightly pin; the sidecar excluded from the root
workspace (workspace + package excludes; publish dry-run clean).
Exposure shape decided + recorded per target (README + lib.rs doc
comments): fingerprint needs none (fully public ingress); the rest
are #[doc(hidden)] re-exports of the production surfaces, never
forks. Detached campaigns ran per target (600 s default budget, fork
mode): all four clean; the two findings of the first round are
recorded in the task file (the harness oracle's double-/-strip bug;
the PPK echo fixed in the preceding commit).
Verification: corpus gate green (11 tests); scripts/matrix.sh green;
taskgraph validate clean.
glm-5.3-flash