feat(guard): audit the REQUIRED fuzz context's target list, not only the advisory one (#406) - #409

What

tools/check_fuzz_targets.py (added for REQ-GUARD-GATE-EVIDENCE-002 (h)) audited the wrong one of two fuzz target lists. This teaches it to audit the one that actually gates merges.

• Advisory — fuzz-nightly.yml's matrix.include, what the tool compared. Its job name is templated (Fuzz ${{ matrix.target }}), so by check_required_contexts.py's rules it can never be a required context.
• Required — ci.yml's fuzz-smoke job (Fuzz smoke (60s/target), in .github/required-contexts.txt), which hand-writes each harness as a cargo +nightly fuzz run <target> step. It was compared against nothing.

So the covered list was advisory and the uncovered list blocked merges. Add a [[bin]] plus a nightly matrix entry but forget the fuzz-smoke step, and the tool reported All 4 declared fuzz targets are run while the required gate fuzzed 3 of 4, green, forever (#406) — the requirement's own defect shape one level up.

How

The nightly's - target: regex can't be reused: the fuzz-smoke targets sit as the positional of a cargo … fuzz run command inside run: steps. A second extractor (smoke_targets) parses them, scoped to the fuzz-smoke: job block and skipping full-line comments so a fuzz run string in prose can't poison the scan. It drops the +toolchain token, value-taking flags with their argument (so --target <triple> is never read as a harness), and the libfuzzer args after --; a command not resolving to exactly one positional is a broken scan (exit 2), never a silently dropped leg. The declaration is now asserted against both lists; the worst exit wins.

The comment-scoping is not hypothetical: an intermediate version scanned the whole file, matched this PR's own guard-step comment (cargo … fuzz run … <target>), and turned the required Rivet validate (artifacts) context red. The clean-room pass caught it before it shipped; the fix is block scoping plus a real-tree self-test row that runs the check against the committed ci.yml and asserts exit 0, so a poisoning comment fails the self-test loudly instead of reading the gate as broken.

Oracle (executed, non-vacuous)

• --self-test grows to 18 rows (exit 0), including the The REQUIRED 'Fuzz smoke' job's target list is compared against nothing; check_fuzz_targets audits only the advisory nightly #406 acceptance criterion — a [[bin]] absent from fuzz-smoke exits 1 — whose exit differs from the base row (0) on the same tool with a distinct input, the discrimination the advisory-only tool lacked. Mutating _one_smoke_target to a constant reds the suite (not green-regardless).
• Live: appending a fourth [[bin]] to the real fuzz/Cargo.toml makes the fuzz-smoke check exit 1 (fuzz_new_harness … NOT run by the fuzz-smoke job); the unmodified tree exits 0.
• rivet validate → PASS; no broken cross-refs.

Artifacts

• REQ-GUARD-FUZZ-SMOKE-001 (implemented) and TEST-GUARD-FUZZ-SMOKE (with runnable fields.steps and satisfies/verifies links).
• The human-scoped REQ-GUARD-GATE-EVIDENCE-002 is not touched or promoted.

Honest scope

Set equality proves declaration parity, not execution — a fuzz-smoke leg carrying continue-on-error: true or if: false still counts as "run". That is a distinct obligation (execution evidence) left to a successor; this closes the list-parity hole #406 names and no more.

Closes #406.

🤖 Generated with Claude Code

Generated by Claude Code