Context
Noted during the #80 review (PR #99). Minor / by-design gap, filed for tracking.
Situation
Of the 13 fuzz targets, matter_roundtrip is the only one that runs libFuzzer-only (deep-fuzz) with no AFL++/CMPLOG counterpart in deep-fuzz-afl. Reason: it uses bolero's structured [u8; 32] generator (construct Ed25519N Matter → encode → decode → assert raw-byte stability), which does not fit afl.rs's raw &[u8] byte-stream model, so it was deliberately left out of fuzz-common and the AFL harness in #80.
Consequences:
matter_roundtrip gets no CMPLOG comparison coverage — only value-profile.- Its corpus never cross-pollinates with an AFL leg (there is none). The
deep-fuzz restore step harmlessly attempts to download corpus-afl-matter_roundtrip (guarded by || true), which never exists.
Is this worth fixing?
The encode→decode round-trip invariant is what matter_roundtrip guards; CMPLOG's strength (getting past verbatim decode gates on adversarial bytes) adds little to a self-constructed round-trip. So the gap may be acceptable as-is. Options if we want coverage parity:
- Byte-slice adaptation: an AFL bin that takes the first 32 bytes of
&[u8] as the raw and runs the same round-trip. Loses bolero's guaranteed-32-bytes-every-iteration property (short inputs early-return, wasting iterations) but gives CMPLOG a shot at the decode leg.
- Accept and document: keep
matter_roundtrip bolero-only; remove the dead corpus-afl-matter_roundtrip restore attempt from the deep-fuzz job for that target (or leave the harmless || true).
Acceptance
Decide between adding an AFL byte-slice variant vs. documenting the intentional bolero-only status; if the latter, tidy the no-op AFL corpus restore for this target.
Pointers
fuzz/tests/matter.rs — matter_roundtrip (structured [u8; 32])..github/workflows/fuzz.yml — deep-fuzz matrix includes matter_roundtrip; deep-fuzz-afl matrix does not.- Design rationale:
docs/superpowers/specs/2026-07-05-80-cmplog-afl-harness-design.md (Target set).
Context
Noted during the #80 review (PR #99). Minor / by-design gap, filed for tracking.
Situation
Of the 13 fuzz targets,
matter_roundtripis the only one that runs libFuzzer-only (deep-fuzz) with no AFL++/CMPLOG counterpart indeep-fuzz-afl. Reason: it uses bolero's structured[u8; 32]generator (construct Ed25519N Matter → encode → decode → assert raw-byte stability), which does not fit afl.rs's raw&[u8]byte-stream model, so it was deliberately left out offuzz-commonand the AFL harness in #80.Consequences:
matter_roundtripgets no CMPLOG comparison coverage — only value-profile.deep-fuzzrestore step harmlessly attempts to downloadcorpus-afl-matter_roundtrip(guarded by|| true), which never exists.Is this worth fixing?
The encode→decode round-trip invariant is what
matter_roundtripguards; CMPLOG's strength (getting past verbatim decode gates on adversarial bytes) adds little to a self-constructed round-trip. So the gap may be acceptable as-is. Options if we want coverage parity:&[u8]as the raw and runs the same round-trip. Loses bolero's guaranteed-32-bytes-every-iteration property (short inputs early-return, wasting iterations) but gives CMPLOG a shot at the decode leg.matter_roundtripbolero-only; remove the deadcorpus-afl-matter_roundtriprestore attempt from thedeep-fuzzjob for that target (or leave the harmless|| true).Acceptance
Decide between adding an AFL byte-slice variant vs. documenting the intentional bolero-only status; if the latter, tidy the no-op AFL corpus restore for this target.
Pointers
fuzz/tests/matter.rs—matter_roundtrip(structured[u8; 32])..github/workflows/fuzz.yml—deep-fuzzmatrix includesmatter_roundtrip;deep-fuzz-aflmatrix does not.docs/superpowers/specs/2026-07-05-80-cmplog-afl-harness-design.md(Target set).