Adversarial fuzz worker

shape-probe

Session e3confirm-20260729-0001 · Worker shape-probe

FAIL

Fuzz run descriptionIterationsPassResult
Recursive JSON/YAML frontmatter structures, duplicate-key handling, and BOM edge cases 86 84/86 FAIL

Inputs exercised

CaseTemplate / inputOutcome
FUZZ-008Top-level boundary: raw frontmatter text and --- delimiters must never leak into rendered body output. This is precisely the BOM-frontmatter-leak class cd54074 targeted for the sinconfirmed product bug (3 reproductions): Exit 0. Rendered stdout is '\uFEFF---~required_variables:~ - name~---~Hello World' -- one BOM plus the entire raw frontmatter header leaks into the body. Root cause: parse_template_document calls strip_prefix('\u{feff}'
FUZZ-009Duplicate-key handling is the defect class cd54074 targeted. Duplicate keys are fail-closed at the var-file ingress (exit 3, ERR_CONFIG_PARSE) and in the `required_variables` list confirmed product bug (3 reproductions): Exit 0, renders 'BODY:' -- the duplicate `a:` key silently collapses last-wins BEFORE the Rust duplicate-tracking code runs, so the `required: true` declaration is silently DISCARDED and no ERR_VAL_DUPLICATE or ERR_VAL_M

Findings

FUZZ-008

Minimal template / frontmatter
\xEF\xBB\xBF\xEF\xBB\xBF--- required_variables: - name --- Hello {{name}}
Input
(none)
Expected
Top-level boundary: raw frontmatter text and --- delimiters must never leak into rendered body output. This is precisely the BOM-frontmatter-leak class cd54074 targeted for the single-BOM case.
Observed
Exit 0. Rendered stdout is '\uFEFF---~required_variables:~ - name~---~Hello World' -- one BOM plus the entire raw frontmatter header leaks into the body. Root cause: parse_template_document calls strip_prefix('\u{feff}') exactly ONCE, so a second BOM defeats opening_delimiter_len and split_frontmatter returns None, treating the whole document as body. Single-BOM control renders correctly as 'Hello World'.
Requirement / ADR
Not a regression -- the pre-fix baseline leaks too (with both BOMs). But it means the BOM-frontmatter-leak defect CLASS is only closed for exactly one leading BOM, not closed in general.
Requirement / ADR follow-up
Strip all leading BOMs (loop or trim_start_matches) instead of exactly one, or fail closed on a repeated BOM prefix.
Root cause
parse_template_document calls strip_prefix('\u{feff}') exactly ONCE, so a second BOM defeats opening_delimiter_len and split_frontmatter returns None, treating the whole document as body. Single-BOM control renders correctly as 'Hello World'.
Recommended fix
Strip all leading BOMs (loop or trim_start_matches) instead of exactly one, or fail closed on a repeated BOM prefix.

FUZZ-009

Minimal template / frontmatter
--- variables: a: required: true a: required: false --- BODY:{{a}}
Input
(none)
Expected
Duplicate-key handling is the defect class cd54074 targeted. Duplicate keys are fail-closed at the var-file ingress (exit 3, ERR_CONFIG_PARSE) and in the `required_variables` list (exit 2, ERR_VAL_DUPLICATE); the frontmatter map sections must not silently diverge.
Observed
Exit 0, renders 'BODY:' -- the duplicate `a:` key silently collapses last-wins BEFORE the Rust duplicate-tracking code runs, so the `required: true` declaration is silently DISCARDED and no ERR_VAL_DUPLICATE or ERR_VAL_MISSING_REQUIRED fires. Same root cause for `defaults:` (dup key renders 'BODY:2' silently). Cause: RawFrontmatter's BTreeMap<String, _> fields inherit serde's permissive map deserialization rather than serde_yaml::Value's duplicate detection.
Requirement / ADR
Not a regression -- reproduces pre-fix. But it means the duplicate-key defect CLASS is closed only at the var-file boundary, not at the frontmatter boundary. Silent loss of a `required: true` declaration is the most consequential instance.
Requirement / ADR follow-up
Apply duplicate-key detection to frontmatter defaults:/input_defaults:/metadata:/variables: maps, matching the var-file boundary.
Root cause
RawFrontmatter's BTreeMap<String, _> fields inherit serde's permissive map deserialization rather than serde_yaml::Value's duplicate detection.
Recommended fix
Apply duplicate-key detection to frontmatter defaults:/input_defaults:/metadata:/variables: maps, matching the var-file boundary.