Nick
515f2f2ab8
Seeds = full corpus; 30s run at ~412k exec/s across 32 workers; coverage corpus 13 -> 534 interesting inputs; no crashers. Generated code honors panic-freedom (malformed input returns error, never panics) — generator untouched. Main-session verify: suite green + codegen gate GREEN own runs.
96 lines
3.2 KiB
Python
96 lines
3.2 KiB
Python
"""Admission dispatch for the boundary-decoder fuzz audit.
|
|
|
|
classify + activate + admit (the headless scaffolding entry law,
|
|
scripts/admit_wave_i1_runtime_bridge.py pattern): fuzz the generated
|
|
boundary decoder (tui/boundary/gen) on the existing rune project,
|
|
user-dispatch approved.
|
|
"""
|
|
import json
|
|
import os
|
|
import sys
|
|
|
|
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "src"))
|
|
|
|
from rune import construction_activation as cact # noqa: E402
|
|
from rune import construction_admission as cadm # noqa: E402
|
|
from rune import construction_mode as cmode # noqa: E402
|
|
from rune import scaffold as sc # noqa: E402
|
|
|
|
ROOT = os.path.join(os.path.dirname(__file__), "..")
|
|
|
|
OBJECTIVE = (
|
|
"fuzz the generated boundary decoder in tui/boundary/gen: add a "
|
|
"go-native FuzzDecode target (decode_fuzz_test.go) seeded from every "
|
|
"schemas/boundary/corpus file, run it once for 30s, and prove the "
|
|
"decoder never panics on untrusted bytes (every failure returns an "
|
|
"error); any panic found in the generated decode path is fixed at the "
|
|
"generator level only (scripts/gen_boundary_types.py + regeneration, "
|
|
"codegen gate stays GREEN) — generated files are never hand-edited"
|
|
)
|
|
AFFECTED = [
|
|
"tui/boundary/gen/decode_fuzz_test.go",
|
|
"scripts/gen_boundary_types.py",
|
|
"tui/boundary/gen/boundary_gen.go",
|
|
]
|
|
|
|
|
|
def main() -> int:
|
|
store = os.path.join(ROOT, "store", "scaffold")
|
|
scaffold = sc.Scaffold(store, "rune")
|
|
|
|
md = cmode.classify_mode(
|
|
OBJECTIVE,
|
|
target_project="rune",
|
|
project_exists=True,
|
|
affected_surface=AFFECTED,
|
|
)
|
|
print("classified mode:", md.mode)
|
|
|
|
need = {
|
|
"need_id": "need-fuzz-boundary-decoder",
|
|
"objective": OBJECTIVE,
|
|
"origin": "worker",
|
|
"project": "rune",
|
|
"task_ref": "fuzz-boundary-decoder",
|
|
"affected_surface": AFFECTED,
|
|
"evidence_refs": [
|
|
"tui/boundary/gen/boundary_gen.go",
|
|
"schemas/boundary/v1",
|
|
"schemas/boundary/corpus",
|
|
"scripts/check_boundary_codegen.py",
|
|
],
|
|
}
|
|
act = cact.activate(md, need=need, scaffold=scaffold,
|
|
builder="fuzz-boundary-decoder")
|
|
print("activated:", act.get("activated"), act.get("mode"))
|
|
|
|
env = cadm.admit(
|
|
act,
|
|
objective=OBJECTIVE,
|
|
builder="fuzz-boundary-decoder",
|
|
affected_surface=AFFECTED,
|
|
evidence_refs=need["evidence_refs"],
|
|
origin="worker",
|
|
task_ref="fuzz-boundary-decoder",
|
|
expected_new_entities=[
|
|
"tui/boundary/gen/decode_fuzz_test.go (fuzz target FuzzDecode)",
|
|
],
|
|
expected_runtime_effects=[],
|
|
verification_obligations=[
|
|
"go test -fuzz=FuzzDecode -fuzztime=30s ./boundary/gen/ in tui/ "
|
|
"runs once with no panic (errors allowed)",
|
|
"go test ./boundary/gen/ -count=1 in tui/ green",
|
|
"python scripts/check_boundary_codegen.py GREEN",
|
|
],
|
|
approval_ref="user:fuzz-boundary-decoder dispatch",
|
|
contract_id="ADMIT-fuzz-boundary-decoder",
|
|
project_store=store,
|
|
project_id="rune",
|
|
)
|
|
print(json.dumps(env, indent=2, default=str)[:2400])
|
|
return 0 if env.get("success") else 1
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|