alkstore/tasks/fuzz-campaigns-and-gate.md

id, name, status, depends_on, scope, risk, impact, level, tags

id	name	status	depends_on	scope	risk	impact	level	tags
fuzz-campaigns-and-gate	Fuzz campaigns (detached) + corpus-replay gate wiring + AGENTS.md verification-list flip	pending	fuzz-target-payload-codec fuzz-target-every-parse fuzz-target-name-validation	moderate	medium	phase	implementation	wave-7 fuzzing

Description

The wave's operational close (§4's sequencing tail: seeds committed → campaigns → fix anything found → corpus replay green) plus the two wiring deliverables the plan names:

• Campaigns, detached only (§5 inherited verbatim): per target, via fuzz/run-detached.sh — never a foreground child of an agent session. Budget 10–30 min per target (FUZZ_RUNTIME_SECS), flags per §7's starting points: payload_codec -max_len=65536 -dict=json.dict; every_parse -max_len=4096 -use_value_profile=1; name_validation -max_len=4096 -use_value_profile=1. Poll per §5 (tail the log, ls the artifacts dir, pgrep -af to LIST, kill by explicit pid from the runner's echoed pid= — never pattern-kill-and-recheck in one call).
• Findings disposition: crate-side bugs are fixed (the fix rides this task when small; crash inputs are promoted to committed seeds — the alksocks seed-900/901 posture — and the campaign re-run clean); large or design-shaped findings escalate to the user before any postulate-and-fix. Harness-model findings (no crate bug) are documented in the research doc's implementation log (a new § appended to docs/research/fuzzing.md — the alksocks §7 successful-negative-result disposition applies if campaigns find nothing crate-side).
• Corpus policy final state (§2): committed hand-made seeds + promoted crash inputs; grown corpora and artifacts gitignored (the scaffold's fuzz/.gitignore pattern); verify git status shows no grown-corpus noise after campaigns.
• The AGENTS.md verification-list flip: the corpus-replay gate joins the Verification Commands — cargo test --manifest-path fuzz/shared/Cargo.toml — with the one-line note that campaigns run only via the detached runner (the AGENTS.md fuzzing paragraph's "until then there is no fuzz gate" clause updated to the landed state). This is the plan's named design point ("joins the verification list when the wave lands").
• fuzz/README.md finalized: targets table complete, campaign commands, corpus policy.
• Research doc §7's verification list already carries the gate — no edit needed there beyond the implementation log.

Acceptance Criteria

• Every target has had a detached campaign (≥10 min) via run-detached.sh; logs + artifact state recorded in Notes
• Campaigns clean, or findings fixed + crash inputs promoted to committed seeds + re-run clean; dispositions recorded (crate-side vs harness-model; the latter in the research doc's log)
• Corpus policy verified: committed seeds only in git; grown corpora/artifacts ignored; gen_fuzz_seeds.py re-run is a no-op diff on the committed set
• cargo test --manifest-path fuzz/shared/Cargo.toml green (the gate, on stable)
• AGENTS.md Verification Commands carry the gate line; the fuzzing paragraph reflects the landed state
• fuzz/README.md finalized (targets table, commands, corpus policy)
• Root workspace gates + shared clippy/fmt gates green; mem wasm check still clean

References

• docs/research/fuzzing.md §4 (sequencing), §5 (detached-runner rule), §6 (no-CI / the gate), §7 (flags + verification commands)
• docs/plans/implementation.md §Wave 7 (the named design points this task closes: the AGENTS.md flip)
• /workspace/@alkdev/alksocks/docs/research/fuzzing.md §5, §7 (the inherited operational posture + the successful-negative-result disposition)
• tasks/fuzz-scaffold.md (the runner + gitignore this task exercises)

Notes

To be filled by implementation agent

Summary

To be filled on completion