c473a0e102GLM complementary review remediation on the wallet stack:
- The Pi status adapter content string now reflects the structured
connected flag ("Wallet is not connected.") instead of an
unconditional "Wallet status is available." that contradicted
connected:false; bound by a new REQUIRE on the disconnected path.
- The wallet_status_json fuzzer clock now advances its monotonic
component from fuzz input, so fuzzed frames traverse the deeper
revalidation ladder and deadline paths instead of a single fixed-
authority success path.
- docs/architecture.md: documented the one-strike authority teardown
contract (no retry/resync by the bridge) and the ABA generation-
reuse defense living in authority contracts, gated on adversarial
authority tests before any live composition.
Validation (umask 0022): dev CTest 79/79, ASan/UBSan 79/79,
TSan 79/79; wallet_status_json fuzzer 10,000 units fuzz_exit=0;
clang-format clean; git diff --check clean.
|
||
|---|---|---|
| .. | ||
| corpus | ||
| apple_container_stats_fuzzer.cpp | ||
| change_apply_journal_fuzzer.cpp | ||
| change_manifest_fuzzer.cpp | ||
| CMakeLists.txt | ||
| library_bundle_fuzzer.cpp | ||
| mcp_codec_fuzzer.cpp | ||
| policy_jsonpath_fuzzer.cpp | ||
| README.md | ||
| session_plan_fuzzer.cpp | ||
| wallet_status_json_fuzzer.cpp | ||
Fuzzing
Fuzz targets exercise untrusted wire and persistence parsers under libFuzzer, ASan, and UBSan. The current targets cover the MCP/JSON-RPC codec, the argument parser that backs constrained policy decisions, and the retained change-manifest decoder, strict canonical session-plan validation, and change-apply journal recovery parser, and retained library-bundle verifier. Checked corpus files are stable review artifacts; fuzzing must mutate a copy rather than writing generated units into the repository.
Configure and build the targets with a Clang distribution that includes the libFuzzer runtime. Apple Clang installations do not always ship that runtime; Homebrew LLVM is the default used by preflight on macOS.
cmake --preset fuzz -DCMAKE_CXX_COMPILER=/path/to/clang++
cmake --build --preset fuzz
Run the MCP codec target against a disposable corpus copy:
corpus_copy="$(mktemp -d "${TMPDIR:-/tmp}/glove-mcp-corpus.XXXXXX")"
cp -R fuzz/corpus/mcp_codec/. "${corpus_copy}/"
./build/fuzz/fuzz/glove_mcp_codec_fuzzer \
-runs=10000 -max_len=65536 -timeout=5 -rss_limit_mb=2048 \
"${corpus_copy}"
Run the policy target the same way, substituting
fuzz/corpus/policy_jsonpath and glove_policy_jsonpath_fuzzer.
Run the manifest target the same way, substituting
fuzz/corpus/change_manifest and glove_change_manifest_fuzzer.
Run the session-plan target the same way, substituting
fuzz/corpus/session_plan and glove_session_plan_fuzzer.
Run the change-apply journal target the same way, substituting
fuzz/corpus/change_apply_journal and glove_change_apply_journal_fuzzer.
Run the library-bundle target the same way, substituting
fuzz/corpus/library_bundle and glove_library_bundle_fuzzer.
Crashes, sanitizer findings, or timeouts are failures. Minimize a reproducer before adding it to the checked corpus, and give each retained input a descriptive filename tied to the parser invariant it covers.