Adversarial fuzz confirmation: e3confirm-20260729-0001 (frontmatter)

Post-PR-#163 (cd54074) confirmation run, corrected pre-fix baseline fa675cf

Generated: 2026-07-29T00:00:00Z

Source: adversarial-fuzzing/v1 campaign-report.json, campaign_id e3confirm-20260729-0001

ERROR

Summary

Confirmation campaign e3confirm-20260729-0001 re-ran four bounded adversarial workers against the frontmatter subsystem (388 total cases: boundary-probe 99, differential-probe 97, shape-probe 86, template-probe 106) on HEAD d2acdb1 (contains fix cd54074 / PR #163), using the corrected pre-fix baseline fa675cf (cd54074^). At the worker-execution level every worker completed cleanly: zero panics, hangs, timeouts, confinement bypasses, or nondeterminism.

Fuzz run description	Iterations	Pass	Result
Malformed files, invalid var-file boundaries, path confinement, and stable diagnostics (frontmatter target)	99	99/99	PASS
Baseline-vs-head parity, JSON/YAML equivalence, and deterministic output (frontmatter target, corrected baseline fa675cf)	97	97/97	PASS
Recursive JSON/YAML frontmatter structures, duplicate-key handling, and BOM edge cases	86	86/86	PASS
Jinja whitespace/newline normalization and output-formatting edge cases	106	106/106	PASS

This is execution health, not a clean campaign outcome. The campaign confirmed 8 product bugs (FUZZ-001, 002, 003, 004, 005, 006, 008, 009), 1 intentional boundary (FUZZ-007), and 2 inconclusive items (FUZZ-004 relates to a new gap shipped with cd54074; FUZZ-010 and FUZZ-011 need a product ruling, not a code fix). Zero regression tests were promoted by design: every confirmed bug is currently unfixed, so no passing durable test could be written without either failing CI or enshrining the defect as intended behavior.

boundary-probe ERROR

Detailed context fragment: 20260729-3-fuzz-report/20260729-3-fuzz-report-boundary-probe.xhtml (auto-generated)

Adversarial fuzz worker

boundary-probe

Session e3confirm-20260729-0001 · Worker boundary-probe

FAIL

Fuzz run description	Iterations	Pass	Result
Malformed files, invalid var-file boundaries, path confinement, and stable diagnostics (frontmatter target)	99	94/99	FAIL

Inputs exercised

Case	Template / input	Outcome
FUZZ-001	`FR-7b: exit 3 for usage/configuration/contract error. ERR_CONFIG_READ is a documented ConfigError-family code, so it should exit 3.`	confirmed product bug (3 reproductions): Exits 2 (validation/render family) with ERR_CONFIG_READ, while the equivalent invalid-UTF-8 --var-file failure exits 3. Exit-code family disagrees with the diagnostic family.
FUZZ-002	`A security-relevant confinement refusal must not be reported with a not-found code; the engine already has a dedicated ERR_INCLUDE_ESCAPE for the identical condition during include`	confirmed product bug (3 reproductions): Refused correctly (no read occurs, exit 3) but with ERR_RESOLVE_NOT_FOUND and message 'template path escapes configured roots', i.e. an escape reported under a not-found code. Confirmed for ../ traversal, absolute path,
FUZZ-003	`No include is in play for a top-level --file, and the sibling nonexistent-path case correctly returns ERR_RESOLVE_NOT_FOUND with exit 3.`	confirmed product bug (3 reproductions): Returns ERR_INCLUDE_NOT_FOUND 'include file not found: <dir>' with exit 2; the nonexistent-path sibling returns ERR_RESOLVE_NOT_FOUND with exit 3. Both code and exit family are inconsistent for the same argument.
FUZZ-004	FR-8: diagnostics must include source file path, line and column when available. The equivalent `required_variables: [x]` declaration proves line/column ARE computable for the same	confirmed product bug (3 reproductions): Both styles give code ERR_VAL_MISSING_REQUIRED, exit 2, and the same message naming x. But `required_variables` yields line=3 column=5, while `variables: {x: {required: true}}` yields line=null column=null. (Coordinator
FUZZ-005	`FR-8: diagnostics must include path, line and column when available. Human-mode output proves the location is known.`	confirmed product bug (3 reproductions): Human mode prints 'did not find expected key at line 3 column 2'. The --json diagnostic for the identical failure carries ERR_CONFIG_PARSE with path=null, line=null, column=null. Machine consumers get strictly less infor

Findings

FUZZ-001

Minimal template / frontmatter: \xa0
Input: (none)
Expected: FR-7b: exit 3 for usage/configuration/contract error. ERR_CONFIG_READ is a documented ConfigError-family code, so it should exit 3.
Observed: Exits 2 (validation/render family) with ERR_CONFIG_READ, while the equivalent invalid-UTF-8 --var-file failure exits 3. Exit-code family disagrees with the diagnostic family.
Requirement / ADR: No requirement/ADR currently traces this exact behavior; classified via the adversarial-fuzzing oracle rules (stable diagnostic/top-level boundary).
Requirement / ADR follow-up: Map ERR_CONFIG_READ to exit 3 per FR-7b.
Root cause: See observed_result; coordinator-established root cause recorded in campaign-report.json.
Recommended fix: Map ERR_CONFIG_READ to exit 3 per FR-7b.

FUZZ-002

Minimal template / frontmatter: a file existing one level above --root
Input: (none)
Expected: A security-relevant confinement refusal must not be reported with a not-found code; the engine already has a dedicated ERR_INCLUDE_ESCAPE for the identical condition during include expansion.
Observed: Refused correctly (no read occurs, exit 3) but with ERR_RESOLVE_NOT_FOUND and message 'template path escapes configured roots', i.e. an escape reported under a not-found code. Confirmed for ../ traversal, absolute path, and symlink-outside-root.
Requirement / ADR: No confinement bypass: every escape attempt was correctly refused and nothing outside --root was read. This is a diagnostic-accuracy defect only.
Requirement / ADR follow-up: Introduce/reuse an escape-specific code for top-level --file confinement refusals; register it in the error-code registry.
Root cause: See observed_result; coordinator-established root cause recorded in campaign-report.json.
Recommended fix: Introduce/reuse an escape-specific code for top-level --file confinement refusals; register it in the error-code registry.

FUZZ-003

Minimal template / frontmatter: an empty directory passed as --file
Input: (none)
Expected: No include is in play for a top-level --file, and the sibling nonexistent-path case correctly returns ERR_RESOLVE_NOT_FOUND with exit 3.
Observed: Returns ERR_INCLUDE_NOT_FOUND 'include file not found: <dir>' with exit 2; the nonexistent-path sibling returns ERR_RESOLVE_NOT_FOUND with exit 3. Both code and exit family are inconsistent for the same argument.
Requirement / ADR: No requirement/ADR currently traces this exact behavior; classified via the adversarial-fuzzing oracle rules (stable diagnostic/top-level boundary).
Requirement / ADR follow-up: Return ERR_RESOLVE_NOT_FOUND (or a not-a-file code) with exit 3 when --file names a directory.
Root cause: See observed_result; coordinator-established root cause recorded in campaign-report.json.
Recommended fix: Return ERR_RESOLVE_NOT_FOUND (or a not-a-file code) with exit 3 when --file names a directory.

FUZZ-004

Minimal template / frontmatter: --- variables: x: required: true --- {{x}}
Input: (none)
Expected: FR-8: diagnostics must include source file path, line and column when available. The equivalent `required_variables: [x]` declaration proves line/column ARE computable for the same file, so the two declaration styles must yield identically shaped diagnostics.
Observed: Both styles give code ERR_VAL_MISSING_REQUIRED, exit 2, and the same message naming x. But `required_variables` yields line=3 column=5, while `variables: {x: {required: true}}` yields line=null column=null. (Coordinator correction to the worker's report: `path` IS populated in both styles; only line/column are lost.)
Requirement / ADR: The `variables:` map is the feature ADDED by cd54074. Pre-fix it was ignored entirely, so this incomplete diagnostic shape ships WITH the fix rather than predating it. This is the only finding attributable to cd54074 itself.
Requirement / ADR follow-up: Thread line/column into ERR_VAL_MISSING_REQUIRED for the `variables:` declaration style so both styles match. Highest priority: this gap shipped with cd54074.
Root cause: The `variables:` map is the feature ADDED by cd54074. Pre-fix it was ignored entirely, so this incomplete diagnostic shape ships WITH the fix rather than predating it. This is the only finding attributable to cd54074 itself.
Recommended fix: Thread line/column into ERR_VAL_MISSING_REQUIRED for the `variables:` declaration style so both styles match. Highest priority: this gap shipped with cd54074.

FUZZ-005

Minimal template / frontmatter: --- foo: bar: 1 baz: 2 --- body
Input: (none)
Expected: FR-8: diagnostics must include path, line and column when available. Human-mode output proves the location is known.
Observed: Human mode prints 'did not find expected key at line 3 column 2'. The --json diagnostic for the identical failure carries ERR_CONFIG_PARSE with path=null, line=null, column=null. Machine consumers get strictly less information than humans for the same failure. Reproduced across tab indentation, unclosed quote, unclosed flow map, and non-map frontmatter shapes.
Requirement / ADR: No requirement/ADR currently traces this exact behavior; classified via the adversarial-fuzzing oracle rules (stable diagnostic/top-level boundary).
Requirement / ADR follow-up: Propagate serde_yaml::Error::location() and the template path into ConfigError -> Diagnostic so --json matches human output.
Root cause: See observed_result; coordinator-established root cause recorded in campaign-report.json.
Recommended fix: Propagate serde_yaml::Error::location() and the template path into ConfigError -> Diagnostic so --json matches human output.

differential-probe ERROR

Detailed context fragment: 20260729-3-fuzz-report/20260729-3-fuzz-report-differential-probe.xhtml (auto-generated)

Adversarial fuzz worker

differential-probe

Session e3confirm-20260729-0001 · Worker differential-probe

FAIL

Fuzz run description	Iterations	Pass	Result
Baseline-vs-head parity, JSON/YAML equivalence, and deterministic output (frontmatter target, corrected baseline fa675cf)	97	96/97	FAIL

Inputs exercised

Case	Template / input	Outcome
FUZZ-006	`Equivalent JSON and YAML inputs must not produce different semantics without a documented reason. Either both reject an out-of-range integer or both preserve it losslessly.`	confirmed product bug (5 reproductions): JSON: exit 0, renders VALUE=18446744073709552000.0 -- the integer u64::MAX+1 is silently rounded through f64 into a different value, and `validate --json` reports {"valid": true} with zero diagnostics. YAML with the same
FUZZ-007	ERR_VAL_DUPLICATE is a documented stable code for duplicate frontmatter variable declarations; once `variables:` is a real declaration source, both spellings feeding one `seen` set	intentional boundary (not a defect) (3 reproductions): HEAD exits 2 with ERR_VAL_DUPLICATE; pre-fix baseline ignored `variables:` so no duplicate was detected. A faithful consequence of intentional fix (c). Accounts for 12 of the 21 baseline-vs-HEAD sweep diffs.

Findings

FUZZ-006

Minimal template / frontmatter: --- required_variables: - top --- VALUE=[[top]]
Input: {"top": 18446744073709551616}
Expected: Equivalent JSON and YAML inputs must not produce different semantics without a documented reason. Either both reject an out-of-range integer or both preserve it losslessly.
Observed: JSON: exit 0, renders VALUE=18446744073709552000.0 -- the integer u64::MAX+1 is silently rounded through f64 into a different value, and `validate --json` reports {"valid": true} with zero diagnostics. YAML with the same value: exit 3, ERR_CONFIG_PARSE. Control at exactly u64::MAX renders losslessly in both formats.
Requirement / ADR: Silent data corruption with an affirmative valid:true is the worst failure mode of the two paths.
Requirement / ADR follow-up: Reject or losslessly preserve JSON integers beyond u64::MAX; never silently round to f64 while reporting valid:true.
Root cause: See observed_result; coordinator-established root cause recorded in campaign-report.json.
Recommended fix: Reject or losslessly preserve JSON integers beyond u64::MAX; never silently round to f64 while reporting valid:true.

FUZZ-007

Minimal template / frontmatter: --- required_variables: - name variables: name: required: true --- Hello {{name}}
Input: (none)
Expected: ERR_VAL_DUPLICATE is a documented stable code for duplicate frontmatter variable declarations; once `variables:` is a real declaration source, both spellings feeding one `seen` set is consistent.
Observed: HEAD exits 2 with ERR_VAL_DUPLICATE; pre-fix baseline ignored `variables:` so no duplicate was detected. A faithful consequence of intentional fix (c). Accounts for 12 of the 21 baseline-vs-HEAD sweep diffs.
Requirement / ADR: Document the cross-section duplicate rule in requirements.md; currently only implied by code.
Requirement / ADR follow-up: Coordinator classified as non-actionable (intentional_boundary/inconclusive); no new requirement/ADR needed. Document the cross-section duplicate rule in requirements.md; currently only implied by code.
Root cause: See observed_result; coordinator-established root cause recorded in campaign-report.json.
Recommended fix: No further action recommended; see coordinator_note/attribution_note.

shape-probe ERROR

Detailed context fragment: 20260729-3-fuzz-report/20260729-3-fuzz-report-shape-probe.xhtml (auto-generated)

Adversarial fuzz worker

shape-probe

Session e3confirm-20260729-0001 · Worker shape-probe

FAIL

Fuzz run description	Iterations	Pass	Result
Recursive JSON/YAML frontmatter structures, duplicate-key handling, and BOM edge cases	86	84/86	FAIL

Inputs exercised

Case	Template / input	Outcome
FUZZ-008	`Top-level boundary: raw frontmatter text and --- delimiters must never leak into rendered body output. This is precisely the BOM-frontmatter-leak class cd54074 targeted for the sin`	confirmed product bug (3 reproductions): Exit 0. Rendered stdout is '\uFEFF---~required_variables:~ - name~---~Hello World' -- one BOM plus the entire raw frontmatter header leaks into the body. Root cause: parse_template_document calls strip_prefix('\u{feff}'
FUZZ-009	Duplicate-key handling is the defect class cd54074 targeted. Duplicate keys are fail-closed at the var-file ingress (exit 3, ERR_CONFIG_PARSE) and in the `required_variables` list	confirmed product bug (3 reproductions): Exit 0, renders 'BODY:' -- the duplicate `a:` key silently collapses last-wins BEFORE the Rust duplicate-tracking code runs, so the `required: true` declaration is silently DISCARDED and no ERR_VAL_DUPLICATE or ERR_VAL_M

Findings

FUZZ-008

Minimal template / frontmatter: \xEF\xBB\xBF\xEF\xBB\xBF--- required_variables: - name --- Hello {{name}}
Input: (none)
Expected: Top-level boundary: raw frontmatter text and --- delimiters must never leak into rendered body output. This is precisely the BOM-frontmatter-leak class cd54074 targeted for the single-BOM case.
Observed: Exit 0. Rendered stdout is '\uFEFF---~required_variables:~ - name~---~Hello World' -- one BOM plus the entire raw frontmatter header leaks into the body. Root cause: parse_template_document calls strip_prefix('\u{feff}') exactly ONCE, so a second BOM defeats opening_delimiter_len and split_frontmatter returns None, treating the whole document as body. Single-BOM control renders correctly as 'Hello World'.
Requirement / ADR: Not a regression -- the pre-fix baseline leaks too (with both BOMs). But it means the BOM-frontmatter-leak defect CLASS is only closed for exactly one leading BOM, not closed in general.
Requirement / ADR follow-up: Strip all leading BOMs (loop or trim_start_matches) instead of exactly one, or fail closed on a repeated BOM prefix.
Root cause: parse_template_document calls strip_prefix('\u{feff}') exactly ONCE, so a second BOM defeats opening_delimiter_len and split_frontmatter returns None, treating the whole document as body. Single-BOM control renders correctly as 'Hello World'.
Recommended fix: Strip all leading BOMs (loop or trim_start_matches) instead of exactly one, or fail closed on a repeated BOM prefix.

FUZZ-009

Minimal template / frontmatter: --- variables: a: required: true a: required: false --- BODY:{{a}}
Input: (none)
Expected: Duplicate-key handling is the defect class cd54074 targeted. Duplicate keys are fail-closed at the var-file ingress (exit 3, ERR_CONFIG_PARSE) and in the `required_variables` list (exit 2, ERR_VAL_DUPLICATE); the frontmatter map sections must not silently diverge.
Observed: Exit 0, renders 'BODY:' -- the duplicate `a:` key silently collapses last-wins BEFORE the Rust duplicate-tracking code runs, so the `required: true` declaration is silently DISCARDED and no ERR_VAL_DUPLICATE or ERR_VAL_MISSING_REQUIRED fires. Same root cause for `defaults:` (dup key renders 'BODY:2' silently). Cause: RawFrontmatter's BTreeMap<String, _> fields inherit serde's permissive map deserialization rather than serde_yaml::Value's duplicate detection.
Requirement / ADR: Not a regression -- reproduces pre-fix. But it means the duplicate-key defect CLASS is closed only at the var-file boundary, not at the frontmatter boundary. Silent loss of a `required: true` declaration is the most consequential instance.
Requirement / ADR follow-up: Apply duplicate-key detection to frontmatter defaults:/input_defaults:/metadata:/variables: maps, matching the var-file boundary.
Root cause: RawFrontmatter's BTreeMap<String, _> fields inherit serde's permissive map deserialization rather than serde_yaml::Value's duplicate detection.
Recommended fix: Apply duplicate-key detection to frontmatter defaults:/input_defaults:/metadata:/variables: maps, matching the var-file boundary.

template-probe PASS

Detailed context fragment: 20260729-3-fuzz-report/20260729-3-fuzz-report-template-probe.xhtml (auto-generated)

Adversarial fuzz worker

template-probe

Session e3confirm-20260729-0001 · Worker template-probe

PASS

Fuzz run description	Iterations	Pass	Result
Jinja whitespace/newline normalization and output-formatting edge cases	106	106/106	PASS

Inputs exercised

Case	Template / input	Outcome
FUZZ-010	`Cannot be established. assemble_output() calls profile_body.trim_end() deliberately, and no document in docs/ states whether trailing-whitespace normalization is intended.`	inconclusive (not a defect) (3 reproductions): Trailing CR is dropped (stdout 'a\n'); trailing blank lines collapse ('line2\n\n\n' -> 'line2\n'); mid-body CRLF is correctly preserved. Separately, --output writes NO trailing newline while stdout appends one. Coordinat

Recommendations

FUZZ-004 (highest priority — shipped with cd54074): thread line/column into ERR_VAL_MISSING_REQUIRED for the variables: declaration style so it matches required_variables. Owner: comp.
FUZZ-006: reject or losslessly preserve JSON integers beyond u64::MAX; never silently round to f64 while validate --json reports valid: true. Owner: comp.
FUZZ-008 (partial-fix gap in cd54074/PR #163, not a full regression): strip all leading BOMs (loop or trim_start_matches) instead of exactly one. Owner: comp.
FUZZ-009 (partial-fix gap in cd54074/PR #163, not a full regression): apply duplicate-key detection to frontmatter variables:/defaults: maps, matching the var-file boundary. Owner: comp.
FUZZ-001/002/003/005: diagnostic-code/exit-family consistency fixes (map ERR_CONFIG_READ to exit 3; give path-confinement refusals a dedicated code; return ERR_RESOLVE_NOT_FOUND for a directory passed as --file; propagate serde_yaml error location into --json diagnostics). Owner: comp.
FUZZ-010: product ruling needed on trailing CR/blank-line normalization (deliberate code, self-consistent round-trip, no documented intent). Owner: team-lead.
FUZZ-011: cosmetic duplicated diagnostic-code prefix in human-mode ValidationError output; registry disclaims human-message stability so no contract is violated. Owner: comp.
FUZZ-007 is an intentional consequence of fix (c) (both required_variables and variables: now feed one duplicate-detection set); document the cross-section duplicate rule in requirements.md.

Metadata

report_kind	multi-agent-fuzz-session
session_id	e3confirm-20260729-0001
worker_count	4
template	.claude/skills/html-report/templates/fuzz-run-agent.xhtml.j2
campaign_id	e3confirm-20260729-0001
total_cases_run	388
confirmed_bugs	8
intentional_boundaries	1
inconclusive	2
promoted_tests	0
regressions_attributable_to_cd54074	1