test: fuzz config and protocol parsers

[ben-ranford]

Summary

Closes #60

• Add bounded fuzz targets and deterministic corpora for sparse configuration parsing/canonicalization and JSON-RPC request framing.
• Assert v1 canonical-byte and hash stability in tests by decoding resolved canonical configuration into Config before validation; production Parse remains the sparse layer loader that applies defaults.
• Add a verified parser-fuzz target runner and document its bounded usage. Protocol envelope and duplicate-key diagnostics now redact attacker-controlled field names.

Validation

• go test ./config ./protocol -count=1
• STAVE_PARSER_FUZZ_TIME=5s make fuzz-parser-long
• make generated-refresh
• make ci (exit 0)

Release Notes

• Added opt-in bounded parser fuzzing for configuration and agent protocol inputs. Protocol parse diagnostics no longer echo unknown or duplicate attacker-controlled envelope keys.

Scope firewall: this PR adds tests, fuzz corpora, bounded fuzz tooling, and the minimal protocol diagnostic redaction found by that testing. It does not alter configuration defaults, canonical JSON bytes, hashes, public APIs, dependencies, or the Go version floor.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-13T14:26:15.317296Z	b25e216	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dd1bd2ffb8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

🔵 Needs a closer look

Adjust the nesting seeds, clarify production limits in the documentation, and add the required changelog entry.

Pull request overview

Adds bounded fuzzing for configuration and JSON-RPC parsers, canonicalization checks, deterministic corpora, and redacted protocol diagnostics.

Changes:

• Adds configuration and protocol fuzz targets with seed corpora.
• Adds bounded fuzz tooling, Make targets, and documentation.
• Adds canonical v1 stability tests and protocol diagnostic redaction.

File summaries

File	Summary
scripts/rigor/run-parser-fuzz.sh	Runs and verifies bounded parser fuzz targets.
scripts/rigor/generated/dependency-inventory.json	Refreshes generated dependency inventory.
protocol/testdata/fuzz/FuzzDecodeLineBounded/faed0eb43a2d0f14	Adds an unknown-field corpus seed.
protocol/testdata/fuzz/FuzzDecodeLineBounded/6905685302560345	Adds a malformed-envelope corpus seed.
protocol/jsonl.go	Redacts unknown and duplicate protocol keys; requires an Unreleased changelog entry.
protocol/jsonl_test.go	Tests protocol diagnostic redaction.
protocol/fuzz_test.go	Adds bounded protocol fuzzing; nesting seeds need boundary adjustment.
Makefile	Adds the parser fuzz target.
docs/README.md	Links to fuzzing documentation.
docs/fuzzing.md	Documents bounded fuzzing; should distinguish harness and production limits.
config/testdata/fuzz/FuzzConfigParseCanonical/5095979aeaacb19a	Adds a configuration corpus seed.
config/fuzz_test.go	Adds bounded configuration fuzzing and canonicalization checks.
config/config_test.go	Verifies canonical v1 bytes and hashes.

Review details

Suppressed comments (3)

docs/fuzzing.md:23

• This says the input-size and nesting limits are only fuzz-harness bounds, but the protocol parser also enforces its caller-provided byte limit and the depth-64 production guard in protocol/jsonl.go. Distinguish the configuration harness bounds from those production protocol limits so this documentation does not misstate the runtime safeguards.

nesting limits are fuzz-harness bounds, not claimed production parser limits;
the nesting guard uses JSON tokens so braces in string values remain covered.

protocol/fuzz_test.go:59

• These seeds do not exercise the intended nesting boundary: the generated payload already includes the root envelope and the params object, so protocolNestedSeed(64) reaches validator depth 65 and is rejected just like protocolNestedSeed(65). Use values that account for those two envelope levels so one seed reaches the accepted maximum and the next tests rejection.

		protocolNestedSeed(64),
		protocolNestedSeed(65),

protocol/jsonl.go:42

• This changes the protocol error text that runtime/agent/server.go sends to clients, so it is a user-visible behavior change. CONTRIBUTING.md:38 requires such changes to update CHANGELOG.md; add an Unreleased entry describing redaction of unknown and duplicate envelope keys.

			return Request{}, errors.New("unknown JSON-RPC envelope field")

• Files reviewed: 12/13 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud