- version 0.8.1 -> 0.8.2 (patch: behavior-only bug fix in the local
feature's PTY waiter from db0b1fc; ADR-004 decision 1's negative-code
convention now holds on the PTY path; no API, wire-format, or
dependency change)
- CHANGELOG entry for 0.8.2 (review #004 resolution: the waitpid reap
mechanism, the signal round-trip notes, the tests, the docs)
- finish the em-dash sweep in prose 58da42a missed: doc comments in
tests/ (negotiation, pipe, pty, common) and fuzz/shared
(control_json, negotiation_frame, session_opseq); prose rewrites
only, no code, JSON literals, or wire shapes touched
- README checked: no version pins, nothing to update
Verification: cargo test; cargo test --all-features; cargo clippy
--all-targets -D warnings (default and --all-features); cargo fmt
--check; cargo doc --no-deps; fuzz/shared corpus replay (9 seeds pass);
cargo check + clippy for wasm32-unknown-unknown -D warnings; cargo
publish --dry-run --allow-dirty (43 files, 194.4 KiB); detached
campaigns over the four targets (chunk_frame 632s, negotiation_frame
602s, control_json 610s, session_opseq 608s) all exiting 0 with
0 crash/oom/timeout findings.
- Rewrote ~1090 em dashes across docs/ (excluding docs/reviews/
history), README, CHANGELOG, and .opencode/agents prompts with varied
restructures (colons, semicolons, parentheses, commas, sentence
splits); ADR decisions, status lines, wire-shape examples, and code
fences preserved
- Rewrote 234 em dashes in src doc comments plus a handful of existing
inline comments and one test assert message; no code, JSON literals,
or wire shapes touched
- Added Project Convention 15: no em dashes in prose (doc comments,
markdown, agent prompts, commit messages); restructure instead; no
spaced hyphens as a substitute
Verification: cargo test; cargo clippy --all-targets -- -D warnings;
cargo fmt --check; cargo doc --no-deps; cargo test --all-features;
cargo test --manifest-path fuzz/shared/Cargo.toml; cargo check and
clippy for wasm32-unknown-unknown with -D warnings; em dash grep over
src + docs + agent prompts returns no matches outside docs/reviews/
- alkcall requirement 0.10.0 -> 0.10.1 (same-family version-only bump:
the adoption-window ordering fix, private fix surface, no type alktty
touches); lockfiles updated in both the root and fuzz workspaces
- AGENTS.md pin refreshed from the stale 0.9.0 note
Verification: cargo test 113 default / 137 all-features (unchanged from
the 0.8.0 baseline); fuzz corpus replay 9 green; clippy stable + wasm
(-D warnings); fmt; doc; wasm32-unknown-unknown check; publish dry run
(43 files)
The stub-sweep release changes no type alktty touches: the four
implemented stubs, the register_openable Pub-typed refusal (alktty's
op is Sub-typed), the register_imported Result return, and the removed
RelayError::PubTypedOpen are all surfaces alktty never exercises.
- alkcall requirement 0.8.1 -> 0.9.0; lockfile follows
- alktty 0.6.0 -> 0.7.0 (minor: raising the minimum alkcall requirement
is ecosystem-coordination breaking on a 0.x crate)
- one test fix: `establisher_ok_on_valid_params` formatted a
Result<Establishment, _> with {:?} — Establishment no longer derives
Debug in alkcall 0.9.0; the assert now branches on Err and formats
only the error
Verification: 113 default / 156 all-features tests, clippy
--all-targets -D warnings, fmt --check, cargo doc, fuzz corpus replay
(9 tests / 340 seeds), wasm32-unknown-unknown check + clippy,
publish --dry-run — all pass.
Target 4 from the fuzzing plan (the alkcall-bug-class hunt): a
#[derive(Arbitrary)] op sequence drives the producer session pump
(drive_session_pre_negotiated) over a duplex pair against a fuzz-local
mock backend.
- fuzz/shared/src/session_opseq.rs: op vocabulary (client writes incl.
invalid-type/oversize-length barrier probes, backend production/EOF,
exit resolve/fail/drop, control messages, bounded reads, yields),
kill-guard exit future (ADR-005 observability), delivery model, and
the invariants: kill-on-Drop (kill_fired == !exit_resolved), exit
chunk is last with first-issued code -1 on wait-failure (ADR-004),
lossless per-stream FIFO + single stdout sentinel, stdin
prefix-losslessness (post-shutdown chunks never delivered), control
dispatch bounds, take-once allocation, teardown termination.
- Harness-model correction caught by a 60s smoke run before the
campaign (the alkcall §7.7 pattern, third time): a failed client
write can mean the session completed and dropped the server duplex
half while the write was in flight - the harness now drains and
requires the exit chunk on any write/shutdown error (premature close
without it is a finding). No adapter code changed.
- 12 committed seeds via the deterministic generator, hand-encoded
against the arbitrary 1.4.x derive layout; the encoding is pinned by
a seed-decode test. Existing chunk_frame/negotiation_frame/
control_json seed corpora are byte-identical to before.
- fuzz/.gitignore: the per-target seed negations never matched (corpus/*
excludes the parent dir; git cannot re-include beneath an excluded
dir). Fixed with the !corpus/*/ + corpus/*/* + !corpus/*/seed-*
recipe - new seed files were silently ignored until now.
- Campaign: 10 min detached via run-detached.sh, exited 0, artifact
dir empty - 42.3k execs across 33 fork jobs, 0 crash/oom/timeout,
cov 3934 -> 4075 edges. Grown corpus excised per the corpus policy.
Verification: corpus replay green on stable (9 tests), cargo test 113
+ --all-features 156, clippy stable/wasm/fuzz-shared, fmt, doc,
publish dry-run, wasm check - all pass.
- Bump alkcall 0.8.0 -> 0.8.1 (duplicate adopt/open channel-state
destruction fix from alkcall's fuzz campaign; AGENTS.md stale-pin fix).
- Adopt fuzzing per docs/plans/fuzzing.md (mirrors alkcall's
docs/research/fuzzing.md as-built layout): fuzz/ workspace with own
[workspace] table, nightly pinned for the subtree only, invariant
logic in a stable-toolchain shared crate.
- Targets: chunk_frame (5-byte chunk codec), negotiation_frame
(negotiation framing + NegotiateRequest + error_response_bytes +
the cross-codec peek-disambiguation seam), control_json
(ControlMessage JSON + signal_from_name). src/local/ out of scope
(not wire-attacker-shaped).
- 328 committed seeds (deterministic generator); grown corpora
gitignored. Corpus replay on stable is the standing fuzz gate
(cargo test --manifest-path fuzz/shared/Cargo.toml).
- Detached-runner rule (fuzz/run-detached.sh): campaigns never run in
the foreground of an agent session - OOM in a target must cost the
fuzzer, never the session host.
- Root Cargo.toml gained [workspace] members/exclude (MSRV vs fuzz
nightly dev-deps footgun) and fuzz/ in the publish exclude.
Verification: cargo test (113), cargo test --all-features (156),
clippy stable + wasm32-unknown-unknown, fmt, doc, publish dry-run,
corpus replay 328 seeds - all green. 10-min detached campaigns on all
three targets: 0 crashes/hangs/OOMs/leaks (chunk_frame cov-saturated
at 710 edges; negotiation_frame 3.69M execs cov 3157; control_json
8.6M execs cov 2035). Corpus replay caught three harness-model
mismatches pre-campaign (payload-slice shape; the negotiation framing
layer is length-prefix-only - Json unreachable from read_frame;
zero-length frames admitted by the reader, rejected by the adapter's
parse). Campaigns recorded in docs/plans/fuzzing.md section 8.
glm-5.3-flash