89 lines
3.9 KiB
Markdown
89 lines
3.9 KiB
Markdown
---
|
||
id: fuzz-campaigns-and-gate
|
||
name: Fuzz campaigns (detached) + corpus-replay gate wiring + AGENTS.md verification-list flip
|
||
status: pending
|
||
depends_on: [fuzz-target-payload-codec, fuzz-target-every-parse, fuzz-target-name-validation]
|
||
scope: moderate
|
||
risk: medium
|
||
impact: phase
|
||
level: implementation
|
||
tags: [wave-7, fuzzing]
|
||
---
|
||
|
||
## Description
|
||
|
||
The wave's operational close (§4's sequencing tail: seeds committed →
|
||
campaigns → fix anything found → corpus replay green) plus the two
|
||
wiring deliverables the plan names:
|
||
|
||
- **Campaigns, detached only** (§5 inherited verbatim): per target, via
|
||
`fuzz/run-detached.sh` — **never a foreground child of an agent
|
||
session**. Budget 10–30 min per target (`FUZZ_RUNTIME_SECS`), flags
|
||
per §7's starting points: `payload_codec -max_len=65536
|
||
-dict=json.dict`; `every_parse -max_len=4096 -use_value_profile=1`;
|
||
`name_validation -max_len=4096 -use_value_profile=1`. Poll per §5
|
||
(`tail` the log, `ls` the artifacts dir, `pgrep -af` to LIST, kill by
|
||
explicit pid from the runner's echoed `pid=` — never
|
||
pattern-kill-and-recheck in one call).
|
||
- **Findings disposition**: crate-side bugs are fixed (the fix rides
|
||
this task when small; crash inputs are promoted to committed seeds —
|
||
the alksocks seed-900/901 posture — and the campaign re-run clean);
|
||
large or design-shaped findings escalate to the user before any
|
||
postulate-and-fix. Harness-model findings (no crate bug) are
|
||
documented in the research doc's implementation log (a new §
|
||
appended to `docs/research/fuzzing.md` — the alksocks §7
|
||
successful-negative-result disposition applies if campaigns find
|
||
nothing crate-side).
|
||
- **Corpus policy final state** (§2): committed hand-made seeds +
|
||
promoted crash inputs; grown corpora and artifacts gitignored (the
|
||
scaffold's `fuzz/.gitignore` pattern); verify `git status` shows no
|
||
grown-corpus noise after campaigns.
|
||
- **The AGENTS.md verification-list flip**: the corpus-replay gate
|
||
joins the Verification Commands —
|
||
`cargo test --manifest-path fuzz/shared/Cargo.toml` — with the
|
||
one-line note that campaigns run only via the detached runner (the
|
||
AGENTS.md fuzzing paragraph's "until then there is no fuzz gate"
|
||
clause updated to the landed state). This is the plan's named design
|
||
point ("joins the verification list when the wave lands").
|
||
- **`fuzz/README.md` finalized**: targets table complete, campaign
|
||
commands, corpus policy.
|
||
- **Research doc §7's verification list** already carries the gate —
|
||
no edit needed there beyond the implementation log.
|
||
|
||
## Acceptance Criteria
|
||
|
||
- [ ] Every target has had a detached campaign (≥10 min) via
|
||
`run-detached.sh`; logs + artifact state recorded in Notes
|
||
- [ ] Campaigns clean, or findings fixed + crash inputs promoted to
|
||
committed seeds + re-run clean; dispositions recorded (crate-side
|
||
vs harness-model; the latter in the research doc's log)
|
||
- [ ] Corpus policy verified: committed seeds only in git; grown
|
||
corpora/artifacts ignored; `gen_fuzz_seeds.py` re-run is a no-op
|
||
diff on the committed set
|
||
- [ ] `cargo test --manifest-path fuzz/shared/Cargo.toml` green
|
||
(the gate, on stable)
|
||
- [ ] AGENTS.md Verification Commands carry the gate line; the fuzzing
|
||
paragraph reflects the landed state
|
||
- [ ] `fuzz/README.md` finalized (targets table, commands, corpus
|
||
policy)
|
||
- [ ] Root workspace gates + `shared` clippy/fmt gates green; mem wasm
|
||
check still clean
|
||
|
||
## References
|
||
|
||
- docs/research/fuzzing.md §4 (sequencing), §5 (detached-runner rule),
|
||
§6 (no-CI / the gate), §7 (flags + verification commands)
|
||
- docs/plans/implementation.md §Wave 7 (the named design points this
|
||
task closes: the AGENTS.md flip)
|
||
- /workspace/@alkdev/alksocks/docs/research/fuzzing.md §5, §7 (the
|
||
inherited operational posture + the successful-negative-result
|
||
disposition)
|
||
- tasks/fuzz-scaffold.md (the runner + gitignore this task exercises)
|
||
|
||
## Notes
|
||
|
||
> To be filled by implementation agent
|
||
|
||
## Summary
|
||
|
||
> To be filled on completion |