wave-7 decomposition — seven fuzzing tasks: scaffold, parser exposure (§3.2 resolved as option b), three targets, campaigns + gate wiring, review gate

tasks/fuzz-campaigns-and-gate.md

@@ -0,0 +1,89 @@
+---
+id: fuzz-campaigns-and-gate
+name: Fuzz campaigns (detached) + corpus-replay gate wiring + AGENTS.md verification-list flip
+status: pending
+depends_on: [fuzz-target-payload-codec, fuzz-target-every-parse, fuzz-target-name-validation]
+scope: moderate
+risk: medium
+impact: phase
+level: implementation
+tags: [wave-7, fuzzing]
+---
+
+## Description
+
+The wave's operational close (§4's sequencing tail: seeds committed →
+campaigns → fix anything found → corpus replay green) plus the two
+wiring deliverables the plan names:
+
+- **Campaigns, detached only** (§5 inherited verbatim): per target, via
+  `fuzz/run-detached.sh` — **never a foreground child of an agent
+  session**. Budget 10–30 min per target (`FUZZ_RUNTIME_SECS`), flags
+  per §7's starting points: `payload_codec -max_len=65536
+  -dict=json.dict`; `every_parse -max_len=4096 -use_value_profile=1`;
+  `name_validation -max_len=4096 -use_value_profile=1`. Poll per §5
+  (`tail` the log, `ls` the artifacts dir, `pgrep -af` to LIST, kill by
+  explicit pid from the runner's echoed `pid=` — never
+  pattern-kill-and-recheck in one call).
+- **Findings disposition**: crate-side bugs are fixed (the fix rides
+  this task when small; crash inputs are promoted to committed seeds —
+  the alksocks seed-900/901 posture — and the campaign re-run clean);
+  large or design-shaped findings escalate to the user before any
+  postulate-and-fix. Harness-model findings (no crate bug) are
+  documented in the research doc's implementation log (a new §
+  appended to `docs/research/fuzzing.md` — the alksocks §7
+  successful-negative-result disposition applies if campaigns find
+  nothing crate-side).
+- **Corpus policy final state** (§2): committed hand-made seeds +
+  promoted crash inputs; grown corpora and artifacts gitignored (the
+  scaffold's `fuzz/.gitignore` pattern); verify `git status` shows no
+  grown-corpus noise after campaigns.
+- **The AGENTS.md verification-list flip**: the corpus-replay gate
+  joins the Verification Commands —
+  `cargo test --manifest-path fuzz/shared/Cargo.toml` — with the
+  one-line note that campaigns run only via the detached runner (the
+  AGENTS.md fuzzing paragraph's "until then there is no fuzz gate"
+  clause updated to the landed state). This is the plan's named design
+  point ("joins the verification list when the wave lands").
+- **`fuzz/README.md` finalized**: targets table complete, campaign
+  commands, corpus policy.
+- **Research doc §7's verification list** already carries the gate —
+  no edit needed there beyond the implementation log.
+
+## Acceptance Criteria
+
+- [ ] Every target has had a detached campaign (≥10 min) via
+      `run-detached.sh`; logs + artifact state recorded in Notes
+- [ ] Campaigns clean, or findings fixed + crash inputs promoted to
+      committed seeds + re-run clean; dispositions recorded (crate-side
+      vs harness-model; the latter in the research doc's log)
+- [ ] Corpus policy verified: committed seeds only in git; grown
+      corpora/artifacts ignored; `gen_fuzz_seeds.py` re-run is a no-op
+      diff on the committed set
+- [ ] `cargo test --manifest-path fuzz/shared/Cargo.toml` green
+      (the gate, on stable)
+- [ ] AGENTS.md Verification Commands carry the gate line; the fuzzing
+      paragraph reflects the landed state
+- [ ] `fuzz/README.md` finalized (targets table, commands, corpus
+      policy)
+- [ ] Root workspace gates + `shared` clippy/fmt gates green; mem wasm
+      check still clean
+
+## References
+
+- docs/research/fuzzing.md §4 (sequencing), §5 (detached-runner rule),
+  §6 (no-CI / the gate), §7 (flags + verification commands)
+- docs/plans/implementation.md §Wave 7 (the named design points this
+  task closes: the AGENTS.md flip)
+- /workspace/@alkdev/alksocks/docs/research/fuzzing.md §5, §7 (the
+  inherited operational posture + the successful-negative-result
+  disposition)
+- tasks/fuzz-scaffold.md (the runner + gitignore this task exercises)
+
+## Notes
+
+> To be filled by implementation agent
+
+## Summary
+
+> To be filled on completion