Adversarial fuzz worker

qa-fuzz-20260729-0002-boundary-probe

Session qa-fuzz-20260729-0002 · Worker boundary-probe

pass

29/29 cases passed with stable diagnostics and no panics/hangs. Two non-blocking notes recorded in this report's text (not filed as new GH issues): an undocumented --var-file/--var precedence rule (FUZZ-B01), and a reconfirmation that already-filed GH #168 (var-file path confinement gap) is still present at baseline (FUZZ-B02).

Fuzz run descriptionIterationsPassResult
CLI negative-contract cases: malformed input, invalid var-files, path confinement, and flag precedence from the live campaign 29 29/29 PASS

Inputs exercised

CaseTemplate / inputOutcome
boundary-04--var key=cli-value --var-file override.json (same key, last-loaded-wins)PASS (documented as FUZZ-B01, non-blocking doc-gap note -- undocumented precedence in render_request.rs:267-274)
boundary-09--var-file ../../escape-attempt.json (path confinement probe)PASS-as-reconfirmed (FUZZ-B02, GH #168 gap still present at baseline 749a3e0, not re-filed)
boundary-01,02,03,05,06,07,08,10-29Non-object top-level values, malformed-but-YAML-valid JSON, duplicate keys, invalid var names, missing files, YAML anchors/aliases, dangerous-but-inert YAML tags, multi-var-file precedencePASS; correct stable diagnostics (ERR_CONFIG_VARFILE/ERR_CONFIG_PARSE, exit 3), no panics/hangs