---
id: review-wave-7
name: Review gate — wave 7 (fuzzing)
status: pending
depends_on: [fuzz-campaigns-and-gate]
scope: moderate
risk: low
impact: phase
level: review
tags: [wave-7, review]
---

## Description

The wave-7 review gate (the plan's §Review gates, wave-7 entry). Audit
the fuzz wave as landed:

1. **Campaigns audit**: each target's campaign ran via the detached
   runner (logs in `fuzz/artifacts/`), clean — or its findings fixed
   and crash inputs promoted to committed seeds with the re-run clean.
   Verify no campaign was run foreground (the §5 rule — process
   hygiene, checked by reading the logs' provenance and the task
   Notes).
2. **Corpus-replay gate green on stable**:
   `cargo test --manifest-path fuzz/shared/Cargo.toml` re-run this
   session; the replay modules exercise the same invariant functions
   the fuzz targets run (the §2 load-bearing layout rule — read one
   target's wiring end to end to confirm no drift between fuzz path
   and replay path).
3. **Corpus policy audit**: committed seeds per policy (hand-made +
   promoted crash inputs; deterministic generator re-run is a no-op
   diff); grown corpora + artifacts gitignored; nothing
   campaign-generated leaked into git.
4. **Named design points audited as resolved** (the plan's wave-7
   list): §3.2's parser exposure (option (b) landed, substrate diff
   empty, the (a)-companion disposition recorded); the AGENTS.md
   verification-list flip (gate line present, fuzzing paragraph
   truthful); the workspace/publish-exclusion mechanism (`exclude =
   ["fuzz"]` on the root workspace table — the *verification* that no
   published package leaks the sidecar stays wave 8's, per §2).
5. **Harness-model findings**: documented in the research doc's
   implementation log (or the successful-negative-result disposition
   recorded there); any crate-side finding's fix verified against the
   invariant that caught it.
6. **wasm posture**: `cargo check --target wasm32-unknown-unknown -p
   alkstore-mem` still clean; `shared` is referenced by no workspace
   crate.
7. **Workspace gates re-run green this session** (`cargo build`,
   `cargo test`, clippy `-D warnings`, fmt) + the `shared` clippy/fmt
   gates.
8. **Records**: `implementation.md`'s wave-7 row updated
   (implemented + reviewed); the research doc's Status header updated
   (targets implemented, campaigns run); task files audited (all
   wave-7 dependency tasks completed, Notes/Summary filled).

## Acceptance Criteria

- [ ] Campaign audit recorded per target (runtime, flags, outcome,
      findings + dispositions)
- [ ] Corpus-replay gate re-run green this session; fuzz-path/replay
      drift check recorded for at least one target end to end
- [ ] Corpus policy verified (committed set, gitignore posture,
      generator determinism)
- [ ] The three named design points audited resolved, each with its
      evidence
- [ ] Research doc implementation log present (findings or the
      negative-result disposition)
- [ ] wasm check + all gates re-run green this session
- [ ] `implementation.md` wave-7 row updated; task files audited

## References

- docs/plans/implementation.md §Wave 7, §Review gates (wave-7 entry)
- docs/research/fuzzing.md (§2 layout rules, §4 scope, §5 runner rule,
  §6 gate, §7 verification)
- tasks/review-wave-6.md (the gate pattern this mirrors)
- /workspace/@alkdev/alksocks/docs/research/fuzzing.md §7 (the
  negative-result disposition precedent)

## Notes

> To be filled by implementation agent

## Summary

> To be filled on completion