From 6524778593366e73b0c7d78cda4aec2d089fc6fa Mon Sep 17 00:00:00 2001 From: "glm-5.3-flash" Date: Sat, 10 Oct 2026 22:54:17 +0000 Subject: [PATCH] =?UTF-8?q?review-wave-7=20=E2=80=94=20the=20wave-7=20gate?= =?UTF-8?q?=20passes:=20campaigns=20audit=20clean=20(4=20runner-provenance?= =?UTF-8?q?=20logs,=20parallel=20starts,=20exit=200,=200/0/0=20throughout)?= =?UTF-8?q?,=20replay=20gate=20green=20on=20stable=20(208=20seeds;=20every?= =?UTF-8?q?=5Fparse=20drift=20check=20end=20to=20end),=20corpus=20policy?= =?UTF-8?q?=20intact=20(seed-900=20byte-identical=20to=20promoted=20crash?= =?UTF-8?q?=20artifact;=20generator=20no-op),=20the=20three=20named=20desi?= =?UTF-8?q?gn=20points=20audited=20resolved=20(exposure=20delta=20D-37/D-3?= =?UTF-8?q?8=20with=20reachability=20pins=20read=20back;=20AGENTS.md=20fli?= =?UTF-8?q?p=20truthful;=20exclude=20mechanism=20with=20wave-8=20verificat?= =?UTF-8?q?ion=20parked),=20harness-model=20finding=20dispositioned=20in?= =?UTF-8?q?=20research=20doc=20=C2=A79=20(no=20crate=20bugs),=20wasm=20+?= =?UTF-8?q?=20all=20gates=20re-run=20green.=20Record=20fixes=20inline:=20A?= =?UTF-8?q?C=20boxes=20ticked=20in=20fuzz-target-name-validation=20+=20fuz?= =?UTF-8?q?z-campaigns-and-gate;=20implementation.md=20wave-7=20row=20->?= =?UTF-8?q?=20implemented=20+=20reviewed=20(2026-10-10)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/plans/implementation.md | 2 +- tasks/fuzz-campaigns-and-gate.md | 14 +-- tasks/fuzz-target-name-validation.md | 10 +- tasks/review-wave-7.md | 137 +++++++++++++++++++++++++-- 4 files changed, 140 insertions(+), 23 deletions(-) diff --git a/docs/plans/implementation.md b/docs/plans/implementation.md index e480476..27c5a49 100644 --- a/docs/plans/implementation.md +++ b/docs/plans/implementation.md @@ -49,7 +49,7 @@ readiness is wave 8. | 4 | [Postgres engine](#wave-4--postgres-engine): schema bootstrap, pool/open, listener/forwarder, all mechanisms, tx seam, pg backlog column | wave 1 | implemented + reviewed (2026-10-08) | | 5 | [Contract suite](#wave-5--contract-suite): the cross-engine equivalence properties (core-contract.md §Verification backlog), version-stamped per ADR-017 | waves 3 + 4 | implemented + reviewed (2026-10-10) | | 6 | [Mem engine](#wave-6--mem-engine): separate `alkstore-mem` crate, full contract v1 over in-memory mechanisms (tx overlay, queue/scheduler/streams/locks/wakes), the suite's third factory column (born pinned), wasm32 compile-clean acceptance | waves 1 + 5 | implemented + reviewed (2026-10-10) | -| [7](#wave-7--fuzzing) | [Fuzzing](#wave-7--fuzzing): the `fuzz/` sidecar workspace (cargo-fuzz targets over the payload codec, the three `@every` parsers, name validation), committed seed corpora + the corpus-replay gate, detached campaigns | wave 6 | decomposed (2026-10-10) | +| [7](#wave-7--fuzzing) | [Fuzzing](#wave-7--fuzzing): the `fuzz/` sidecar workspace (cargo-fuzz targets over the payload codec, the three `@every` parsers, name validation), committed seed corpora + the corpus-replay gate, detached campaigns | wave 6 | implemented + reviewed (2026-10-10) | | [8](#wave-8--release-readiness) | [Release readiness](#wave-8--release-readiness): crate docs, deployment matrix final pass, README (written last, honestly), publish prep | wave 7 | not yet decomposed | ## Wave 1 — Foundations diff --git a/tasks/fuzz-campaigns-and-gate.md b/tasks/fuzz-campaigns-and-gate.md index 50ef3f2..7b89a94 100644 --- a/tasks/fuzz-campaigns-and-gate.md +++ b/tasks/fuzz-campaigns-and-gate.md @@ -52,21 +52,21 @@ wiring deliverables the plan names: ## Acceptance Criteria -- [ ] Every target has had a detached campaign (≥10 min) via +- [x] Every target has had a detached campaign (≥10 min) via `run-detached.sh`; logs + artifact state recorded in Notes -- [ ] Campaigns clean, or findings fixed + crash inputs promoted to +- [x] Campaigns clean, or findings fixed + crash inputs promoted to committed seeds + re-run clean; dispositions recorded (crate-side vs harness-model; the latter in the research doc's log) -- [ ] Corpus policy verified: committed seeds only in git; grown +- [x] Corpus policy verified: committed seeds only in git; grown corpora/artifacts ignored; `gen_fuzz_seeds.py` re-run is a no-op diff on the committed set -- [ ] `cargo test --manifest-path fuzz/shared/Cargo.toml` green +- [x] `cargo test --manifest-path fuzz/shared/Cargo.toml` green (the gate, on stable) -- [ ] AGENTS.md Verification Commands carry the gate line; the fuzzing +- [x] AGENTS.md Verification Commands carry the gate line; the fuzzing paragraph reflects the landed state -- [ ] `fuzz/README.md` finalized (targets table, commands, corpus +- [x] `fuzz/README.md` finalized (targets table, commands, corpus policy) -- [ ] Root workspace gates + `shared` clippy/fmt gates green; mem wasm +- [x] Root workspace gates + `shared` clippy/fmt gates green; mem wasm check still clean ## References diff --git a/tasks/fuzz-target-name-validation.md b/tasks/fuzz-target-name-validation.md index d955caa..e8e38ac 100644 --- a/tasks/fuzz-target-name-validation.md +++ b/tasks/fuzz-target-name-validation.md @@ -44,15 +44,15 @@ guard-order discipline made continuous. ## Acceptance Criteria -- [ ] `fuzz_targets/name_validation.rs` + `shared/src/ +- [x] `fuzz_targets/name_validation.rs` + `shared/src/ name_validation.rs` exist; `cargo fuzz build` builds the target -- [ ] All §3.3 invariants implemented and exercised by both the fuzz +- [x] All §3.3 invariants implemented and exercised by both the fuzz path and the replay module -- [ ] Seed corpus committed, deterministic-generated, gitignore +- [x] Seed corpus committed, deterministic-generated, gitignore negation in place -- [ ] `cargo test --manifest-path fuzz/shared/Cargo.toml` green; +- [x] `cargo test --manifest-path fuzz/shared/Cargo.toml` green; `shared` clippy/fmt gates green -- [ ] Root workspace gates still green +- [x] Root workspace gates still green ## References diff --git a/tasks/review-wave-7.md b/tasks/review-wave-7.md index d9bd4c9..71e5f56 100644 --- a/tasks/review-wave-7.md +++ b/tasks/review-wave-7.md @@ -1,7 +1,7 @@ --- id: review-wave-7 name: Review gate — wave 7 (fuzzing) -status: pending +status: completed depends_on: [fuzz-campaigns-and-gate] scope: moderate risk: low @@ -58,18 +58,18 @@ the fuzz wave as landed: ## Acceptance Criteria -- [ ] Campaign audit recorded per target (runtime, flags, outcome, +- [x] Campaign audit recorded per target (runtime, flags, outcome, findings + dispositions) -- [ ] Corpus-replay gate re-run green this session; fuzz-path/replay +- [x] Corpus-replay gate re-run green this session; fuzz-path/replay drift check recorded for at least one target end to end -- [ ] Corpus policy verified (committed set, gitignore posture, +- [x] Corpus policy verified (committed set, gitignore posture, generator determinism) -- [ ] The three named design points audited resolved, each with its +- [x] The three named design points audited resolved, each with its evidence -- [ ] Research doc implementation log present (findings or the +- [x] Research doc implementation log present (findings or the negative-result disposition) -- [ ] wasm check + all gates re-run green this session -- [ ] `implementation.md` wave-7 row updated; task files audited +- [x] wasm check + all gates re-run green this session +- [x] `implementation.md` wave-7 row updated; task files audited ## References @@ -82,8 +82,125 @@ the fuzz wave as landed: ## Notes -> To be filled by implementation agent +Review-gate audit, all items green (2026-10-10). Only +record-keeping defects surfaced; all fixed inline this session: + +1. **Campaigns audit** — four logs in `fuzz/artifacts/`, all + runner-provenance (the runner's `-artifact_prefix=… -fork=1 -rss_ + limit_mb=2048 -malloc_limit_mb=2048 -timeout=25 -max_total_time=…` + invocation line is logged verbatim; setsid/nohup detachment, output + at the runner's `artifacts/` path; three started 22:13:50–52 — + genuinely parallel, which a foreground child sequence could not + produce honestly). Every campaign over the §7 flags confirmed in + the log headers (`payload_codec -max_len=65536 -dict=json.dict`; + `every_parse`/`name_validation -max_len=4096 + -use_value_profile=1`), all 915–939 s (the 900 s override), 41 fork + jobs, exiting 0 with `oom/timeout/crash: 0/0/0` throughout: + `payload_codec` 221951 re-run (927 s, ~586k execs, 2395 edges), + `every_parse` 221351 (927 s, ~3.7M execs, 285 edges saturated), + `name_validation` 221352 (939 s, ~59k execs, 327 edges). The + superseding evidence set matches the task Notes exactly: the + pre-fix crash log 221350 (exit 77, ~38 s in — the f64 finding) with + its crash artifact retained on disk (gitignored), the §7 smoke + 215619, and zero crate-side findings beyond the every_parse task's + two, fixed and registered as D-38. No stray fuzz processes + (`pgrep -af fuzz` empty). +2. **Replay gate green this session** — + `cargo test --manifest-path fuzz/shared/Cargo.toml`: 6/6 tests + (the three committed-corpus replays: 98 + 66 + 44 seeds, plus the + no-corpus invariant probes). **Drift check recorded** for the + load-bearing target `every_parse` end to end: + `fuzz_targets/every_parse.rs` is the thin `fuzz_target!` wrapper + delegating to `alkstore_fuzz_shared::every_parse::fuzz_every_parse` + — the exact function the replay module also iterates — so the fuzz + path and the replay path run the identical invariant body + (typed-rejection pin, three-way agreement, the 17-accept/27-reject + grammar battery, the 24 fixed adversarial `skip_forward` triples, + and 24-byte-stride input-folded triples). The other two targets + were spot-checked and have the identical shape. No drift. + Additionally re-verified: the post-fix three `skip_forward` bodies + are lexically identical (sqlite/pg/mem, read this session — the + D-38 clamp + i128-gap shape), and the f64 drift disposition's + invariant (`FLOAT_DRIFT_ULPS` bounded float-leaf closure + the + exact closure elsewhere + decode-determinism) is what the replay + exercises against the promoted `seed-900`. +3. **Corpus policy** — promoted crash input is byte-identical to + `corpus/payload_codec/seed-900` (`cmp` clean). Tracked corpus set + is exactly 98 + 66 + 44 `seed-*` files (`git ls-files`); the + `.gitignore` retighten holds (`corpus/*` contents ignored, + `!corpus//seed-*` re-included; `artifacts`/`coverage`/ + `target` ignored — `git check-ignore` verified both directions). + `python3 fuzz/gen_fuzz_seeds.py` re-run this session: zero diff + (`git status --porcelain fuzz/corpus` empty — the generator + determinism AC). +4. **The three named design points** — (i) parser exposure: option (b) + landed as decomposed; read the whole delta — the two visibility + keywords in the re-derived `queue_ops.rs`, the one facade line + + amended boundary doc in `substrate/mod.rs`, PROVENANCE D-37, the + three `#[doc(hidden)] pub use` pairs with the fuzz/test-only doc + note at each engine root, the compile-level reachability pins + (`fuzz_surface_tests.rs` ×3, green in this session's `cargo test`); + the E0364 amendment story is coherent as recorded, lineage body + untouched. The (a)-companion disposition (not built; suite-pinned + posture rides) is recorded in the exposure task's Notes, the + every_parse task's Notes, and the research doc §9. (ii) The + AGENTS.md flip is truthful: the gate line is on the Verification + Commands list and the fuzzing paragraph states the adopted/landed + state with the §5 runner rule. (iii) The publish-exclusion + mechanism: `exclude = ["fuzz"]` on the root `[workspace]` table; + the *verification* (no published package leaks the sidecar) stays + wave 8's, as decomposed. +5. **Harness-model findings** — the research doc §9 implementation log + is present and complete (the targets-landed entry, the f64 + finding's full characterization and fix, the campaigns entry, and + the successful-negative-result close). No crate-side campaign + finding exists; the two every_parse task findings (fixed pre- + campaign) were verified in the log — see item 2's read-back. +6. **wasm + isolation posture** — `cargo check --target + wasm32-unknown-unknown -p alkstore-mem` clean this session; + `grep -rn "fuzz-shared" --include=Cargo.toml` hits only the fuzz + sidecar's own two manifests — no workspace crate references + `alkstore-fuzz-shared`. +7. **Gates re-run green this session** — root: `cargo build`, + `cargo test` (all suites, 0 failures), `cargo clippy --all-targets + -- -D warnings`, `cargo fmt --check`; shared: the replay gate, + clippy `-D warnings`, fmt `--check`; `cargo fuzz build` from + `fuzz/` (nightly pin selected, all three ASAN bins). Bonus + byte-fidelity check: `fuzz/run-detached.sh` is byte-identical to + alksocks' (`cmp` clean — the scaffold AC's claim re-verified). +8. **Records** — task files audited: all six dependency tasks + `completed` with Notes/Summary filled. Two fixed inline this + session: `fuzz-target-name-validation.md` and + `fuzz-campaigns-and-gate.md` had their landed acceptance criteria + still unticked (the work verified as done; boxes now `[x]`). + `implementation.md`'s wave-7 status row flipped to + `implemented + reviewed (2026-10-10)` (was `decomposed`). The + research doc's Status header already states targets implemented + + campaigns run (no edit needed). No deeper issues found — nothing + deferred to a follow-up session. ## Summary -> To be filled on completion \ No newline at end of file +The wave-7 review gate passed. Every dimension of the audit verified +this session: the four campaign logs match the §5 detached-runner +posture (parallel starts, runner invocation lines, fork mode, full +budgets, exit 0, zero crash/oom/timeout) with the finding evidence +set exactly as the tasks recorded it (pre-fix crash log + retained +artifact, the promoted seed-900 byte-identical to the crash input, +re-run clean); the corpus-replay gate is green on stable (98+66+44 +seeds through the same invariant functions the fuzz targets run — the +end-to-end drift check on `every_parse` confirms wrapper and replay +converge on one body); the corpus policy's final state is intact +(tracked set = committed seeds only, generator re-run a no-op, +gitignore retighten holding); the three named design points audited +resolved with evidence (the twice-amended visibility-only exposure +delta with its D-37/D-38 registered story and reachability pins, the +truthful AGENTS.md flip, the `exclude = ["fuzz"]` mechanism with +verification parked at wave 8); the harness-model finding is fully +dispositioned in the research doc's §9 log (no crate bugs — the +successful-negative-result posture); wasm check and every gate +(workspace build/test/clippy/fmt, shared gate/clippy/fmt, `cargo fuzz +build`) re-run green. Two record defects fixed inline (unticked AC +boxes in fuzz-target-name-validation and fuzz-campaigns-and-gate) and +the plan's wave-7 row flipped to implemented + reviewed (2026-10-10). +Wave 7 is closed; wave 8 (release readiness) can decompose. \ No newline at end of file