---
id: review-wave-7
name: Review gate — wave 7 (fuzzing)
status: completed
depends_on: [fuzz-campaigns-and-gate]
scope: moderate
risk: low
impact: phase
level: review
tags: [wave-7, review]
---

## Description

The wave-7 review gate (the plan's §Review gates, wave-7 entry). Audit
the fuzz wave as landed:

1. **Campaigns audit**: each target's campaign ran via the detached
   runner (logs in `fuzz/artifacts/`), clean — or its findings fixed
   and crash inputs promoted to committed seeds with the re-run clean.
   Verify no campaign was run foreground (the §5 rule — process
   hygiene, checked by reading the logs' provenance and the task
   Notes).
2. **Corpus-replay gate green on stable**:
   `cargo test --manifest-path fuzz/shared/Cargo.toml` re-run this
   session; the replay modules exercise the same invariant functions
   the fuzz targets run (the §2 load-bearing layout rule — read one
   target's wiring end to end to confirm no drift between fuzz path
   and replay path).
3. **Corpus policy audit**: committed seeds per policy (hand-made +
   promoted crash inputs; deterministic generator re-run is a no-op
   diff); grown corpora + artifacts gitignored; nothing
   campaign-generated leaked into git.
4. **Named design points audited as resolved** (the plan's wave-7
   list): §3.2's parser exposure (option (b) landed; the substrate
   delta visibility-only and confined to the re-derived `queue_ops.rs`
   with its PROVENANCE.md entry — the amended criterion, per the
   E0364 resolution recorded in `fuzz-parser-exposure.md`; the
   (a)-companion disposition recorded); the AGENTS.md
   verification-list flip (gate line present, fuzzing paragraph
   truthful); the workspace/publish-exclusion mechanism (`exclude =
   ["fuzz"]` on the root workspace table — the *verification* that no
   published package leaks the sidecar stays wave 8's, per §2).
5. **Harness-model findings**: documented in the research doc's
   implementation log (or the successful-negative-result disposition
   recorded there); any crate-side finding's fix verified against the
   invariant that caught it.
6. **wasm posture**: `cargo check --target wasm32-unknown-unknown -p
   alkstore-mem` still clean; `shared` is referenced by no workspace
   crate.
7. **Workspace gates re-run green this session** (`cargo build`,
   `cargo test`, clippy `-D warnings`, fmt) + the `shared` clippy/fmt
   gates.
8. **Records**: `implementation.md`'s wave-7 row updated
   (implemented + reviewed); the research doc's Status header updated
   (targets implemented, campaigns run); task files audited (all
   wave-7 dependency tasks completed, Notes/Summary filled).

## Acceptance Criteria

- [x] Campaign audit recorded per target (runtime, flags, outcome,
      findings + dispositions)
- [x] Corpus-replay gate re-run green this session; fuzz-path/replay
      drift check recorded for at least one target end to end
- [x] Corpus policy verified (committed set, gitignore posture,
      generator determinism)
- [x] The three named design points audited resolved, each with its
      evidence
- [x] Research doc implementation log present (findings or the
      negative-result disposition)
- [x] wasm check + all gates re-run green this session
- [x] `implementation.md` wave-7 row updated; task files audited

## References

- docs/plans/implementation.md §Wave 7, §Review gates (wave-7 entry)
- docs/research/fuzzing.md (§2 layout rules, §4 scope, §5 runner rule,
  §6 gate, §7 verification)
- tasks/review-wave-6.md (the gate pattern this mirrors)
- /workspace/@alkdev/alksocks/docs/research/fuzzing.md §7 (the
  negative-result disposition precedent)

## Notes

Review-gate audit, all items green (2026-10-10). Only
record-keeping defects surfaced; all fixed inline this session:

1. **Campaigns audit** — four logs in `fuzz/artifacts/`, all
   runner-provenance (the runner's `-artifact_prefix=… -fork=1 -rss_
   limit_mb=2048 -malloc_limit_mb=2048 -timeout=25 -max_total_time=…`
   invocation line is logged verbatim; setsid/nohup detachment, output
   at the runner's `artifacts/` path; three started 22:13:50–52 —
   genuinely parallel, which a foreground child sequence could not
   produce honestly). Every campaign over the §7 flags confirmed in
   the log headers (`payload_codec -max_len=65536 -dict=json.dict`;
   `every_parse`/`name_validation -max_len=4096
   -use_value_profile=1`), all 915–939 s (the 900 s override), 41 fork
   jobs, exiting 0 with `oom/timeout/crash: 0/0/0` throughout:
   `payload_codec` 221951 re-run (927 s, ~586k execs, 2395 edges),
   `every_parse` 221351 (927 s, ~3.7M execs, 285 edges saturated),
   `name_validation` 221352 (939 s, ~59k execs, 327 edges). The
   superseding evidence set matches the task Notes exactly: the
   pre-fix crash log 221350 (exit 77, ~38 s in — the f64 finding) with
   its crash artifact retained on disk (gitignored), the §7 smoke
   215619, and zero crate-side findings beyond the every_parse task's
   two, fixed and registered as D-38. No stray fuzz processes
   (`pgrep -af fuzz` empty).
2. **Replay gate green this session** —
   `cargo test --manifest-path fuzz/shared/Cargo.toml`: 6/6 tests
   (the three committed-corpus replays: 98 + 66 + 44 seeds, plus the
   no-corpus invariant probes). **Drift check recorded** for the
   load-bearing target `every_parse` end to end:
   `fuzz_targets/every_parse.rs` is the thin `fuzz_target!` wrapper
   delegating to `alkstore_fuzz_shared::every_parse::fuzz_every_parse`
   — the exact function the replay module also iterates — so the fuzz
   path and the replay path run the identical invariant body
   (typed-rejection pin, three-way agreement, the 17-accept/27-reject
   grammar battery, the 24 fixed adversarial `skip_forward` triples,
   and 24-byte-stride input-folded triples). The other two targets
   were spot-checked and have the identical shape. No drift.
   Additionally re-verified: the post-fix three `skip_forward` bodies
   are lexically identical (sqlite/pg/mem, read this session — the
   D-38 clamp + i128-gap shape), and the f64 drift disposition's
   invariant (`FLOAT_DRIFT_ULPS` bounded float-leaf closure + the
   exact closure elsewhere + decode-determinism) is what the replay
   exercises against the promoted `seed-900`.
3. **Corpus policy** — promoted crash input is byte-identical to
   `corpus/payload_codec/seed-900` (`cmp` clean). Tracked corpus set
   is exactly 98 + 66 + 44 `seed-*` files (`git ls-files`); the
   `.gitignore` retighten holds (`corpus/*` contents ignored,
   `!corpus/<target>/seed-*` re-included; `artifacts`/`coverage`/
   `target` ignored — `git check-ignore` verified both directions).
   `python3 fuzz/gen_fuzz_seeds.py` re-run this session: zero diff
   (`git status --porcelain fuzz/corpus` empty — the generator
   determinism AC).
4. **The three named design points** — (i) parser exposure: option (b)
   landed as decomposed; read the whole delta — the two visibility
   keywords in the re-derived `queue_ops.rs`, the one facade line +
   amended boundary doc in `substrate/mod.rs`, PROVENANCE D-37, the
   three `#[doc(hidden)] pub use` pairs with the fuzz/test-only doc
   note at each engine root, the compile-level reachability pins
   (`fuzz_surface_tests.rs` ×3, green in this session's `cargo test`);
   the E0364 amendment story is coherent as recorded, lineage body
   untouched. The (a)-companion disposition (not built; suite-pinned
   posture rides) is recorded in the exposure task's Notes, the
   every_parse task's Notes, and the research doc §9. (ii) The
   AGENTS.md flip is truthful: the gate line is on the Verification
   Commands list and the fuzzing paragraph states the adopted/landed
   state with the §5 runner rule. (iii) The publish-exclusion
   mechanism: `exclude = ["fuzz"]` on the root `[workspace]` table;
   the *verification* (no published package leaks the sidecar) stays
   wave 8's, as decomposed.
5. **Harness-model findings** — the research doc §9 implementation log
   is present and complete (the targets-landed entry, the f64
   finding's full characterization and fix, the campaigns entry, and
   the successful-negative-result close). No crate-side campaign
   finding exists; the two every_parse task findings (fixed pre-
   campaign) were verified in the log — see item 2's read-back.
6. **wasm + isolation posture** — `cargo check --target
   wasm32-unknown-unknown -p alkstore-mem` clean this session;
   `grep -rn "fuzz-shared" --include=Cargo.toml` hits only the fuzz
   sidecar's own two manifests — no workspace crate references
   `alkstore-fuzz-shared`.
7. **Gates re-run green this session** — root: `cargo build`,
   `cargo test` (all suites, 0 failures), `cargo clippy --all-targets
   -- -D warnings`, `cargo fmt --check`; shared: the replay gate,
   clippy `-D warnings`, fmt `--check`; `cargo fuzz build` from
   `fuzz/` (nightly pin selected, all three ASAN bins). Bonus
   byte-fidelity check: `fuzz/run-detached.sh` is byte-identical to
   alksocks' (`cmp` clean — the scaffold AC's claim re-verified).
8. **Records** — task files audited: all six dependency tasks
   `completed` with Notes/Summary filled. Two fixed inline this
   session: `fuzz-target-name-validation.md` and
   `fuzz-campaigns-and-gate.md` had their landed acceptance criteria
   still unticked (the work verified as done; boxes now `[x]`).
   `implementation.md`'s wave-7 status row flipped to
   `implemented + reviewed (2026-10-10)` (was `decomposed`). The
   research doc's Status header already states targets implemented +
   campaigns run (no edit needed). No deeper issues found — nothing
   deferred to a follow-up session.

## Summary

The wave-7 review gate passed. Every dimension of the audit verified
this session: the four campaign logs match the §5 detached-runner
posture (parallel starts, runner invocation lines, fork mode, full
budgets, exit 0, zero crash/oom/timeout) with the finding evidence
set exactly as the tasks recorded it (pre-fix crash log + retained
artifact, the promoted seed-900 byte-identical to the crash input,
re-run clean); the corpus-replay gate is green on stable (98+66+44
seeds through the same invariant functions the fuzz targets run — the
end-to-end drift check on `every_parse` confirms wrapper and replay
converge on one body); the corpus policy's final state is intact
(tracked set = committed seeds only, generator re-run a no-op,
gitignore retighten holding); the three named design points audited
resolved with evidence (the twice-amended visibility-only exposure
delta with its D-37/D-38 registered story and reachability pins, the
truthful AGENTS.md flip, the `exclude = ["fuzz"]` mechanism with
verification parked at wave 8); the harness-model finding is fully
dispositioned in the research doc's §9 log (no crate bugs — the
successful-negative-result posture); wasm check and every gate
(workspace build/test/clippy/fmt, shared gate/clippy/fmt, `cargo fuzz
build`) re-run green. Two record defects fixed inline (unticked AC
boxes in fuzz-target-name-validation and fuzz-campaigns-and-gate) and
the plan's wave-7 row flipped to implemented + reviewed (2026-10-10).
Wave 7 is closed; wave 8 (release readiness) can decompose.