alkstore/tasks/review-wave-7.md

id, name, status, depends_on, scope, risk, impact, level, tags

id	name	status	depends_on	scope	risk	impact	level	tags
review-wave-7	Review gate — wave 7 (fuzzing)	pending	fuzz-campaigns-and-gate	moderate	low	phase	review	wave-7 review

Description

The wave-7 review gate (the plan's §Review gates, wave-7 entry). Audit the fuzz wave as landed:

1. Campaigns audit: each target's campaign ran via the detached runner (logs in fuzz/artifacts/), clean — or its findings fixed and crash inputs promoted to committed seeds with the re-run clean. Verify no campaign was run foreground (the §5 rule — process hygiene, checked by reading the logs' provenance and the task Notes).
2. Corpus-replay gate green on stable: cargo test --manifest-path fuzz/shared/Cargo.toml re-run this session; the replay modules exercise the same invariant functions the fuzz targets run (the §2 load-bearing layout rule — read one target's wiring end to end to confirm no drift between fuzz path and replay path).
3. Corpus policy audit: committed seeds per policy (hand-made + promoted crash inputs; deterministic generator re-run is a no-op diff); grown corpora + artifacts gitignored; nothing campaign-generated leaked into git.
4. Named design points audited as resolved (the plan's wave-7 list): §3.2's parser exposure (option (b) landed; the substrate delta visibility-only and confined to the re-derived queue_ops.rs with its PROVENANCE.md entry — the amended criterion, per the E0364 resolution recorded in fuzz-parser-exposure.md; the (a)-companion disposition recorded); the AGENTS.md verification-list flip (gate line present, fuzzing paragraph truthful); the workspace/publish-exclusion mechanism (exclude = ["fuzz"] on the root workspace table — the verification that no published package leaks the sidecar stays wave 8's, per §2).
5. Harness-model findings: documented in the research doc's implementation log (or the successful-negative-result disposition recorded there); any crate-side finding's fix verified against the invariant that caught it.
6. wasm posture: cargo check --target wasm32-unknown-unknown -p alkstore-mem still clean; shared is referenced by no workspace crate.
7. Workspace gates re-run green this session (cargo build, cargo test, clippy -D warnings, fmt) + the shared clippy/fmt gates.
8. Records: implementation.md's wave-7 row updated (implemented + reviewed); the research doc's Status header updated (targets implemented, campaigns run); task files audited (all wave-7 dependency tasks completed, Notes/Summary filled).

Acceptance Criteria

• Campaign audit recorded per target (runtime, flags, outcome, findings + dispositions)
• Corpus-replay gate re-run green this session; fuzz-path/replay drift check recorded for at least one target end to end
• Corpus policy verified (committed set, gitignore posture, generator determinism)
• The three named design points audited resolved, each with its evidence
• Research doc implementation log present (findings or the negative-result disposition)
• wasm check + all gates re-run green this session
• implementation.md wave-7 row updated; task files audited

References

• docs/plans/implementation.md §Wave 7, §Review gates (wave-7 entry)
• docs/research/fuzzing.md (§2 layout rules, §4 scope, §5 runner rule, §6 gate, §7 verification)
• tasks/review-wave-6.md (the gate pattern this mirrors)
• /workspace/@alkdev/alksocks/docs/research/fuzzing.md §7 (the negative-result disposition precedent)

Notes

To be filled by implementation agent

Summary

To be filled on completion