206 lines
11 KiB
Markdown
206 lines
11 KiB
Markdown
---
|
||
id: review-wave-7
|
||
name: Review gate — wave 7 (fuzzing)
|
||
status: completed
|
||
depends_on: [fuzz-campaigns-and-gate]
|
||
scope: moderate
|
||
risk: low
|
||
impact: phase
|
||
level: review
|
||
tags: [wave-7, review]
|
||
---
|
||
|
||
## Description
|
||
|
||
The wave-7 review gate (the plan's §Review gates, wave-7 entry). Audit
|
||
the fuzz wave as landed:
|
||
|
||
1. **Campaigns audit**: each target's campaign ran via the detached
|
||
runner (logs in `fuzz/artifacts/`), clean — or its findings fixed
|
||
and crash inputs promoted to committed seeds with the re-run clean.
|
||
Verify no campaign was run foreground (the §5 rule — process
|
||
hygiene, checked by reading the logs' provenance and the task
|
||
Notes).
|
||
2. **Corpus-replay gate green on stable**:
|
||
`cargo test --manifest-path fuzz/shared/Cargo.toml` re-run this
|
||
session; the replay modules exercise the same invariant functions
|
||
the fuzz targets run (the §2 load-bearing layout rule — read one
|
||
target's wiring end to end to confirm no drift between fuzz path
|
||
and replay path).
|
||
3. **Corpus policy audit**: committed seeds per policy (hand-made +
|
||
promoted crash inputs; deterministic generator re-run is a no-op
|
||
diff); grown corpora + artifacts gitignored; nothing
|
||
campaign-generated leaked into git.
|
||
4. **Named design points audited as resolved** (the plan's wave-7
|
||
list): §3.2's parser exposure (option (b) landed; the substrate
|
||
delta visibility-only and confined to the re-derived `queue_ops.rs`
|
||
with its PROVENANCE.md entry — the amended criterion, per the
|
||
E0364 resolution recorded in `fuzz-parser-exposure.md`; the
|
||
(a)-companion disposition recorded); the AGENTS.md
|
||
verification-list flip (gate line present, fuzzing paragraph
|
||
truthful); the workspace/publish-exclusion mechanism (`exclude =
|
||
["fuzz"]` on the root workspace table — the *verification* that no
|
||
published package leaks the sidecar stays wave 8's, per §2).
|
||
5. **Harness-model findings**: documented in the research doc's
|
||
implementation log (or the successful-negative-result disposition
|
||
recorded there); any crate-side finding's fix verified against the
|
||
invariant that caught it.
|
||
6. **wasm posture**: `cargo check --target wasm32-unknown-unknown -p
|
||
alkstore-mem` still clean; `shared` is referenced by no workspace
|
||
crate.
|
||
7. **Workspace gates re-run green this session** (`cargo build`,
|
||
`cargo test`, clippy `-D warnings`, fmt) + the `shared` clippy/fmt
|
||
gates.
|
||
8. **Records**: `implementation.md`'s wave-7 row updated
|
||
(implemented + reviewed); the research doc's Status header updated
|
||
(targets implemented, campaigns run); task files audited (all
|
||
wave-7 dependency tasks completed, Notes/Summary filled).
|
||
|
||
## Acceptance Criteria
|
||
|
||
- [x] Campaign audit recorded per target (runtime, flags, outcome,
|
||
findings + dispositions)
|
||
- [x] Corpus-replay gate re-run green this session; fuzz-path/replay
|
||
drift check recorded for at least one target end to end
|
||
- [x] Corpus policy verified (committed set, gitignore posture,
|
||
generator determinism)
|
||
- [x] The three named design points audited resolved, each with its
|
||
evidence
|
||
- [x] Research doc implementation log present (findings or the
|
||
negative-result disposition)
|
||
- [x] wasm check + all gates re-run green this session
|
||
- [x] `implementation.md` wave-7 row updated; task files audited
|
||
|
||
## References
|
||
|
||
- docs/plans/implementation.md §Wave 7, §Review gates (wave-7 entry)
|
||
- docs/research/fuzzing.md (§2 layout rules, §4 scope, §5 runner rule,
|
||
§6 gate, §7 verification)
|
||
- tasks/review-wave-6.md (the gate pattern this mirrors)
|
||
- /workspace/@alkdev/alksocks/docs/research/fuzzing.md §7 (the
|
||
negative-result disposition precedent)
|
||
|
||
## Notes
|
||
|
||
Review-gate audit, all items green (2026-10-10). Only
|
||
record-keeping defects surfaced; all fixed inline this session:
|
||
|
||
1. **Campaigns audit** — four logs in `fuzz/artifacts/`, all
|
||
runner-provenance (the runner's `-artifact_prefix=… -fork=1 -rss_
|
||
limit_mb=2048 -malloc_limit_mb=2048 -timeout=25 -max_total_time=…`
|
||
invocation line is logged verbatim; setsid/nohup detachment, output
|
||
at the runner's `artifacts/` path; three started 22:13:50–52 —
|
||
genuinely parallel, which a foreground child sequence could not
|
||
produce honestly). Every campaign over the §7 flags confirmed in
|
||
the log headers (`payload_codec -max_len=65536 -dict=json.dict`;
|
||
`every_parse`/`name_validation -max_len=4096
|
||
-use_value_profile=1`), all 915–939 s (the 900 s override), 41 fork
|
||
jobs, exiting 0 with `oom/timeout/crash: 0/0/0` throughout:
|
||
`payload_codec` 221951 re-run (927 s, ~586k execs, 2395 edges),
|
||
`every_parse` 221351 (927 s, ~3.7M execs, 285 edges saturated),
|
||
`name_validation` 221352 (939 s, ~59k execs, 327 edges). The
|
||
superseding evidence set matches the task Notes exactly: the
|
||
pre-fix crash log 221350 (exit 77, ~38 s in — the f64 finding) with
|
||
its crash artifact retained on disk (gitignored), the §7 smoke
|
||
215619, and zero crate-side findings beyond the every_parse task's
|
||
two, fixed and registered as D-38. No stray fuzz processes
|
||
(`pgrep -af fuzz` empty).
|
||
2. **Replay gate green this session** —
|
||
`cargo test --manifest-path fuzz/shared/Cargo.toml`: 6/6 tests
|
||
(the three committed-corpus replays: 98 + 66 + 44 seeds, plus the
|
||
no-corpus invariant probes). **Drift check recorded** for the
|
||
load-bearing target `every_parse` end to end:
|
||
`fuzz_targets/every_parse.rs` is the thin `fuzz_target!` wrapper
|
||
delegating to `alkstore_fuzz_shared::every_parse::fuzz_every_parse`
|
||
— the exact function the replay module also iterates — so the fuzz
|
||
path and the replay path run the identical invariant body
|
||
(typed-rejection pin, three-way agreement, the 17-accept/27-reject
|
||
grammar battery, the 24 fixed adversarial `skip_forward` triples,
|
||
and 24-byte-stride input-folded triples). The other two targets
|
||
were spot-checked and have the identical shape. No drift.
|
||
Additionally re-verified: the post-fix three `skip_forward` bodies
|
||
are lexically identical (sqlite/pg/mem, read this session — the
|
||
D-38 clamp + i128-gap shape), and the f64 drift disposition's
|
||
invariant (`FLOAT_DRIFT_ULPS` bounded float-leaf closure + the
|
||
exact closure elsewhere + decode-determinism) is what the replay
|
||
exercises against the promoted `seed-900`.
|
||
3. **Corpus policy** — promoted crash input is byte-identical to
|
||
`corpus/payload_codec/seed-900` (`cmp` clean). Tracked corpus set
|
||
is exactly 98 + 66 + 44 `seed-*` files (`git ls-files`); the
|
||
`.gitignore` retighten holds (`corpus/*` contents ignored,
|
||
`!corpus/<target>/seed-*` re-included; `artifacts`/`coverage`/
|
||
`target` ignored — `git check-ignore` verified both directions).
|
||
`python3 fuzz/gen_fuzz_seeds.py` re-run this session: zero diff
|
||
(`git status --porcelain fuzz/corpus` empty — the generator
|
||
determinism AC).
|
||
4. **The three named design points** — (i) parser exposure: option (b)
|
||
landed as decomposed; read the whole delta — the two visibility
|
||
keywords in the re-derived `queue_ops.rs`, the one facade line +
|
||
amended boundary doc in `substrate/mod.rs`, PROVENANCE D-37, the
|
||
three `#[doc(hidden)] pub use` pairs with the fuzz/test-only doc
|
||
note at each engine root, the compile-level reachability pins
|
||
(`fuzz_surface_tests.rs` ×3, green in this session's `cargo test`);
|
||
the E0364 amendment story is coherent as recorded, lineage body
|
||
untouched. The (a)-companion disposition (not built; suite-pinned
|
||
posture rides) is recorded in the exposure task's Notes, the
|
||
every_parse task's Notes, and the research doc §9. (ii) The
|
||
AGENTS.md flip is truthful: the gate line is on the Verification
|
||
Commands list and the fuzzing paragraph states the adopted/landed
|
||
state with the §5 runner rule. (iii) The publish-exclusion
|
||
mechanism: `exclude = ["fuzz"]` on the root `[workspace]` table;
|
||
the *verification* (no published package leaks the sidecar) stays
|
||
wave 8's, as decomposed.
|
||
5. **Harness-model findings** — the research doc §9 implementation log
|
||
is present and complete (the targets-landed entry, the f64
|
||
finding's full characterization and fix, the campaigns entry, and
|
||
the successful-negative-result close). No crate-side campaign
|
||
finding exists; the two every_parse task findings (fixed pre-
|
||
campaign) were verified in the log — see item 2's read-back.
|
||
6. **wasm + isolation posture** — `cargo check --target
|
||
wasm32-unknown-unknown -p alkstore-mem` clean this session;
|
||
`grep -rn "fuzz-shared" --include=Cargo.toml` hits only the fuzz
|
||
sidecar's own two manifests — no workspace crate references
|
||
`alkstore-fuzz-shared`.
|
||
7. **Gates re-run green this session** — root: `cargo build`,
|
||
`cargo test` (all suites, 0 failures), `cargo clippy --all-targets
|
||
-- -D warnings`, `cargo fmt --check`; shared: the replay gate,
|
||
clippy `-D warnings`, fmt `--check`; `cargo fuzz build` from
|
||
`fuzz/` (nightly pin selected, all three ASAN bins). Bonus
|
||
byte-fidelity check: `fuzz/run-detached.sh` is byte-identical to
|
||
alksocks' (`cmp` clean — the scaffold AC's claim re-verified).
|
||
8. **Records** — task files audited: all six dependency tasks
|
||
`completed` with Notes/Summary filled. Two fixed inline this
|
||
session: `fuzz-target-name-validation.md` and
|
||
`fuzz-campaigns-and-gate.md` had their landed acceptance criteria
|
||
still unticked (the work verified as done; boxes now `[x]`).
|
||
`implementation.md`'s wave-7 status row flipped to
|
||
`implemented + reviewed (2026-10-10)` (was `decomposed`). The
|
||
research doc's Status header already states targets implemented +
|
||
campaigns run (no edit needed). No deeper issues found — nothing
|
||
deferred to a follow-up session.
|
||
|
||
## Summary
|
||
|
||
The wave-7 review gate passed. Every dimension of the audit verified
|
||
this session: the four campaign logs match the §5 detached-runner
|
||
posture (parallel starts, runner invocation lines, fork mode, full
|
||
budgets, exit 0, zero crash/oom/timeout) with the finding evidence
|
||
set exactly as the tasks recorded it (pre-fix crash log + retained
|
||
artifact, the promoted seed-900 byte-identical to the crash input,
|
||
re-run clean); the corpus-replay gate is green on stable (98+66+44
|
||
seeds through the same invariant functions the fuzz targets run — the
|
||
end-to-end drift check on `every_parse` confirms wrapper and replay
|
||
converge on one body); the corpus policy's final state is intact
|
||
(tracked set = committed seeds only, generator re-run a no-op,
|
||
gitignore retighten holding); the three named design points audited
|
||
resolved with evidence (the twice-amended visibility-only exposure
|
||
delta with its D-37/D-38 registered story and reachability pins, the
|
||
truthful AGENTS.md flip, the `exclude = ["fuzz"]` mechanism with
|
||
verification parked at wave 8); the harness-model finding is fully
|
||
dispositioned in the research doc's §9 log (no crate bugs — the
|
||
successful-negative-result posture); wasm check and every gate
|
||
(workspace build/test/clippy/fmt, shared gate/clippy/fmt, `cargo fuzz
|
||
build`) re-run green. Two record defects fixed inline (unticked AC
|
||
boxes in fuzz-target-name-validation and fuzz-campaigns-and-gate) and
|
||
the plan's wave-7 row flipped to implemented + reviewed (2026-10-10).
|
||
Wave 7 is closed; wave 8 (release readiness) can decompose. |