alkstore/tasks/review-wave-7.md

id, name, status, depends_on, scope, risk, impact, level, tags

id	name	status	depends_on	scope	risk	impact	level	tags
review-wave-7	Review gate — wave 7 (fuzzing)	completed	fuzz-campaigns-and-gate	moderate	low	phase	review	wave-7 review

Description

The wave-7 review gate (the plan's §Review gates, wave-7 entry). Audit the fuzz wave as landed:

1. Campaigns audit: each target's campaign ran via the detached runner (logs in fuzz/artifacts/), clean — or its findings fixed and crash inputs promoted to committed seeds with the re-run clean. Verify no campaign was run foreground (the §5 rule — process hygiene, checked by reading the logs' provenance and the task Notes).
2. Corpus-replay gate green on stable: cargo test --manifest-path fuzz/shared/Cargo.toml re-run this session; the replay modules exercise the same invariant functions the fuzz targets run (the §2 load-bearing layout rule — read one target's wiring end to end to confirm no drift between fuzz path and replay path).
3. Corpus policy audit: committed seeds per policy (hand-made + promoted crash inputs; deterministic generator re-run is a no-op diff); grown corpora + artifacts gitignored; nothing campaign-generated leaked into git.
4. Named design points audited as resolved (the plan's wave-7 list): §3.2's parser exposure (option (b) landed; the substrate delta visibility-only and confined to the re-derived queue_ops.rs with its PROVENANCE.md entry — the amended criterion, per the E0364 resolution recorded in fuzz-parser-exposure.md; the (a)-companion disposition recorded); the AGENTS.md verification-list flip (gate line present, fuzzing paragraph truthful); the workspace/publish-exclusion mechanism (exclude = ["fuzz"] on the root workspace table — the verification that no published package leaks the sidecar stays wave 8's, per §2).
5. Harness-model findings: documented in the research doc's implementation log (or the successful-negative-result disposition recorded there); any crate-side finding's fix verified against the invariant that caught it.
6. wasm posture: cargo check --target wasm32-unknown-unknown -p alkstore-mem still clean; shared is referenced by no workspace crate.
7. Workspace gates re-run green this session (cargo build, cargo test, clippy -D warnings, fmt) + the shared clippy/fmt gates.
8. Records: implementation.md's wave-7 row updated (implemented + reviewed); the research doc's Status header updated (targets implemented, campaigns run); task files audited (all wave-7 dependency tasks completed, Notes/Summary filled).

Acceptance Criteria

• Campaign audit recorded per target (runtime, flags, outcome, findings + dispositions)
• Corpus-replay gate re-run green this session; fuzz-path/replay drift check recorded for at least one target end to end
• Corpus policy verified (committed set, gitignore posture, generator determinism)
• The three named design points audited resolved, each with its evidence
• Research doc implementation log present (findings or the negative-result disposition)
• wasm check + all gates re-run green this session
• implementation.md wave-7 row updated; task files audited

References

• docs/plans/implementation.md §Wave 7, §Review gates (wave-7 entry)
• docs/research/fuzzing.md (§2 layout rules, §4 scope, §5 runner rule, §6 gate, §7 verification)
• tasks/review-wave-6.md (the gate pattern this mirrors)
• /workspace/@alkdev/alksocks/docs/research/fuzzing.md §7 (the negative-result disposition precedent)

Notes

Review-gate audit, all items green (2026-10-10). Only record-keeping defects surfaced; all fixed inline this session:

1. Campaigns audit — four logs in fuzz/artifacts/, all runner-provenance (the runner's -artifact_prefix=… -fork=1 -rss_ limit_mb=2048 -malloc_limit_mb=2048 -timeout=25 -max_total_time=… invocation line is logged verbatim; setsid/nohup detachment, output at the runner's artifacts/ path; three started 22:13:50–52 — genuinely parallel, which a foreground child sequence could not produce honestly). Every campaign over the §7 flags confirmed in the log headers (payload_codec -max_len=65536 -dict=json.dict; every_parse/name_validation -max_len=4096 -use_value_profile=1), all 915–939 s (the 900 s override), 41 fork jobs, exiting 0 with oom/timeout/crash: 0/0/0 throughout: payload_codec 221951 re-run (927 s, ~586k execs, 2395 edges), every_parse 221351 (927 s, ~3.7M execs, 285 edges saturated), name_validation 221352 (939 s, ~59k execs, 327 edges). The superseding evidence set matches the task Notes exactly: the pre-fix crash log 221350 (exit 77, ~38 s in — the f64 finding) with its crash artifact retained on disk (gitignored), the §7 smoke 215619, and zero crate-side findings beyond the every_parse task's two, fixed and registered as D-38. No stray fuzz processes (pgrep -af fuzz empty).
2. Replay gate green this session — cargo test --manifest-path fuzz/shared/Cargo.toml: 6/6 tests (the three committed-corpus replays: 98 + 66 + 44 seeds, plus the no-corpus invariant probes). Drift check recorded for the load-bearing target every_parse end to end: fuzz_targets/every_parse.rs is the thin fuzz_target! wrapper delegating to alkstore_fuzz_shared::every_parse::fuzz_every_parse — the exact function the replay module also iterates — so the fuzz path and the replay path run the identical invariant body (typed-rejection pin, three-way agreement, the 17-accept/27-reject grammar battery, the 24 fixed adversarial skip_forward triples, and 24-byte-stride input-folded triples). The other two targets were spot-checked and have the identical shape. No drift. Additionally re-verified: the post-fix three skip_forward bodies are lexically identical (sqlite/pg/mem, read this session — the D-38 clamp + i128-gap shape), and the f64 drift disposition's invariant (FLOAT_DRIFT_ULPS bounded float-leaf closure + the exact closure elsewhere + decode-determinism) is what the replay exercises against the promoted seed-900.
3. Corpus policy — promoted crash input is byte-identical to corpus/payload_codec/seed-900 (cmp clean). Tracked corpus set is exactly 98 + 66 + 44 seed-* files (git ls-files); the .gitignore retighten holds (corpus/* contents ignored, !corpus/<target>/seed-* re-included; artifacts/coverage/ target ignored — git check-ignore verified both directions). python3 fuzz/gen_fuzz_seeds.py re-run this session: zero diff (git status --porcelain fuzz/corpus empty — the generator determinism AC).
4. The three named design points — (i) parser exposure: option (b) landed as decomposed; read the whole delta — the two visibility keywords in the re-derived queue_ops.rs, the one facade line + amended boundary doc in substrate/mod.rs, PROVENANCE D-37, the three #[doc(hidden)] pub use pairs with the fuzz/test-only doc note at each engine root, the compile-level reachability pins (fuzz_surface_tests.rs ×3, green in this session's cargo test); the E0364 amendment story is coherent as recorded, lineage body untouched. The (a)-companion disposition (not built; suite-pinned posture rides) is recorded in the exposure task's Notes, the every_parse task's Notes, and the research doc §9. (ii) The AGENTS.md flip is truthful: the gate line is on the Verification Commands list and the fuzzing paragraph states the adopted/landed state with the §5 runner rule. (iii) The publish-exclusion mechanism: exclude = ["fuzz"] on the root [workspace] table; the verification (no published package leaks the sidecar) stays wave 8's, as decomposed.
5. Harness-model findings — the research doc §9 implementation log is present and complete (the targets-landed entry, the f64 finding's full characterization and fix, the campaigns entry, and the successful-negative-result close). No crate-side campaign finding exists; the two every_parse task findings (fixed pre- campaign) were verified in the log — see item 2's read-back.
6. wasm + isolation posture — cargo check --target wasm32-unknown-unknown -p alkstore-mem clean this session; grep -rn "fuzz-shared" --include=Cargo.toml hits only the fuzz sidecar's own two manifests — no workspace crate references alkstore-fuzz-shared.
7. Gates re-run green this session — root: cargo build, cargo test (all suites, 0 failures), cargo clippy --all-targets -- -D warnings, cargo fmt --check; shared: the replay gate, clippy -D warnings, fmt --check; cargo fuzz build from fuzz/ (nightly pin selected, all three ASAN bins). Bonus byte-fidelity check: fuzz/run-detached.sh is byte-identical to alksocks' (cmp clean — the scaffold AC's claim re-verified).
8. Records — task files audited: all six dependency tasks completed with Notes/Summary filled. Two fixed inline this session: fuzz-target-name-validation.md and fuzz-campaigns-and-gate.md had their landed acceptance criteria still unticked (the work verified as done; boxes now [x]). implementation.md's wave-7 status row flipped to implemented + reviewed (2026-10-10) (was decomposed). The research doc's Status header already states targets implemented + campaigns run (no edit needed). No deeper issues found — nothing deferred to a follow-up session.

Summary

The wave-7 review gate passed. Every dimension of the audit verified this session: the four campaign logs match the §5 detached-runner posture (parallel starts, runner invocation lines, fork mode, full budgets, exit 0, zero crash/oom/timeout) with the finding evidence set exactly as the tasks recorded it (pre-fix crash log + retained artifact, the promoted seed-900 byte-identical to the crash input, re-run clean); the corpus-replay gate is green on stable (98+66+44 seeds through the same invariant functions the fuzz targets run — the end-to-end drift check on every_parse confirms wrapper and replay converge on one body); the corpus policy's final state is intact (tracked set = committed seeds only, generator re-run a no-op, gitignore retighten holding); the three named design points audited resolved with evidence (the twice-amended visibility-only exposure delta with its D-37/D-38 registered story and reachability pins, the truthful AGENTS.md flip, the exclude = ["fuzz"] mechanism with verification parked at wave 8); the harness-model finding is fully dispositioned in the research doc's §9 log (no crate bugs — the successful-negative-result posture); wasm check and every gate (workspace build/test/clippy/fmt, shared gate/clippy/fmt, cargo fuzz build) re-run green. Two record defects fixed inline (unticked AC boxes in fuzz-target-name-validation and fuzz-campaigns-and-gate) and the plan's wave-7 row flipped to implemented + reviewed (2026-10-10). Wave 7 is closed; wave 8 (release readiness) can decompose.