swaits
7002e89efd
P2 promised these two targets and never added them. `fuzz_http_mcp_request` feeds a method, a path, headers (token present, absent, wrong, raw) and a JSON-RPC body drawn from the real method and tool names into the in-process router. Whatever arrives, the door answers: no token live for the book is refused 4xx, never run (INVARIANT 8), and a live token never makes the door fail (no 5xx on the MCP route). Whether a token is live is asked of the door itself (`FuzzDoor::carries_a_token`), so a token smuggled in an extra header is judged by the real rule rather than by the target's guess. `fuzz_upload_put` declares a size and a hash and sends bytes: taken only when both are exactly what was declared, from the token the grant names, and only once (INVARIANT 9); a 200 for anything else is the bug. Both join the weekly matrix in scheduled.yml; fuzz/Cargo.lock gains ledger-mcp's dependency closure because the targets drive its router.
49 lines
1.7 KiB
YAML
49 lines
1.7 KiB
YAML
# Weekly, and on demand: the slow layers (docs/testing.md): the proofs,
|
|
# the GnuCash oracle and the fuzz targets. Mutation testing is not run in
|
|
# CI (owner, 2026-10-29, D-59): it is a local run (`just mutants-*`), and
|
|
# P12 runs it whole on the owner's desktop.
|
|
name: scheduled
|
|
on:
|
|
schedule:
|
|
- cron: "17 6 * * 1"
|
|
workflow_dispatch:
|
|
jobs:
|
|
prove:
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: jdx/mise-action@v2
|
|
- run: just prove
|
|
# The Kani harnesses too slow for prove's 30 minutes on four cores
|
|
# (justfile kani_slow; docs/verification.md), on a runner of their own.
|
|
prove-slow:
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: jdx/mise-action@v2
|
|
- run: just prove-slow
|
|
oracle:
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: jdx/mise-action@v2
|
|
- run: just oracle
|
|
fuzz:
|
|
runs-on: ubuntu-24.04
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
target: [fuzz_journal_line, fuzz_entry_validate, fuzz_op_sequence, fuzz_core_serde, fuzz_store_open, fuzz_store_replay, fuzz_settings_replay, fuzz_import_csv, fuzz_config_parse, fuzz_extract_pdf, fuzz_extract_xlsx, fuzz_http_mcp_request, fuzz_upload_put]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: jdx/mise-action@v2
|
|
- run: just fuzz ${{ matrix.target }} 600
|
|
# A crash's input is the finding: keep it (the 2026-10-26 run found one
|
|
# in fuzz_store_replay and kept nothing, so it had to be hunted again).
|
|
- if: failure()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: fuzz-${{ matrix.target }}-artifacts
|
|
path: fuzz/artifacts
|
|
if-no-files-found: ignore
|