feat: v0.13.0 — adversarial inputs (fuzz, proptest, OS matrix)

.github/workflows/ci.yml

@@ -17,7 +17,11 @@ env:
 jobs:
   rust:
     name: fmt · clippy · test
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
@@ -67,6 +71,34 @@ jobs:
       - name: coverage report (informational)
         run: rivet coverage || true
 
+  msrv:
+    name: MSRV (1.89)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # 1.89 pinned below
+        with:
+          toolchain: "1.89"
+      - run: cargo build --workspace --locked
+
+  coverage:
+    name: coverage (advisory evidence)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - name: Install cargo-llvm-cov
+        run: cargo install --locked cargo-llvm-cov
+      - name: Measure (advisory — evidence, not a gate)
+        run: cargo llvm-cov --workspace --lcov --output-path lcov.info
+      - name: Upload coverage evidence
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: coverage-lcov
+          path: lcov.info
+          retention-days: 30
+
   deny:
     name: cargo deny (supply-chain audit)
     runs-on: ubuntu-latest

.github/workflows/fuzz.yml

@@ -0,0 +1,49 @@
+# Fuzzing (REQ-FUZZ-001) — the untrusted-input parsers. A short smoke on
+# every PR (fast, catches regressions) + a longer nightly campaign.
+# Adapted from pulseengine/sigil's fuzz.yml.
+
+name: Fuzz
+
+on:
+  pull_request:
+    paths:
+      - "crates/varve-core/**"
+      - "fuzz/**"
+      - ".github/workflows/fuzz.yml"
+  schedule:
+    - cron: "0 3 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  fuzz:
+    name: cargo fuzz (${{ matrix.target }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [layer_id, manifest, dsse_verify, pin, realms]
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # nightly is required for -Z sanitizer; toolchain action pins the channel below
+        with:
+          toolchain: nightly
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+        with:
+          key: fuzz-${{ matrix.target }}
+      - name: Install cargo-fuzz
+        run: cargo install --locked cargo-fuzz
+      - name: Fuzz duration
+        id: dur
+        run: echo "secs=${{ github.event_name == 'schedule' && 600 || 60 }}" >> "$GITHUB_OUTPUT"
+      - name: Run ${{ matrix.target }}
+        run: cargo +nightly fuzz run ${{ matrix.target }} -- -max_total_time=${{ steps.dur.outputs.secs }} -rss_limit_mb=4096
+      - name: Upload any crash corpus
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: fuzz-crash-${{ matrix.target }}
+          path: fuzz/artifacts/
+          retention-days: 30

.gitignore

@@ -3,3 +3,7 @@
 # Cargo.lock tracked (26262-8 config-management: releases must rebuild from VCS)
 .DS_Store
 /dist
+fuzz/target/
+fuzz/corpus/
+fuzz/artifacts/
+fuzz/Cargo.lock

CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## v0.13.0 — 2026-08-08
+
+Adversarial inputs (REQ-FUZZ-001 + REQ-PROP-001 + REQ-MATRIX-001 verified).
+
+- **Fuzzing**: five cargo-fuzz targets on the untrusted-input parsers
+  (layer-id grammar, layer-manifest JSON, DSSE envelope, varve.toml,
+  varve-realms.toml); PR smoke + nightly campaign (`fuzz.yml`). It earned
+  its keep on the first run — found a real canonicalization bug: the
+  layer-id grammar accepted leading-zero patches (`2026.07.052` parsed to
+  patch 52 but Displayed as `2026.07.52` — two pin strings for one
+  identity). Fixed, regression-seeded, re-fuzzed clean past 1.6M runs
+- **Property tests**: proptest laws across the whole input space — layer-id
+  round-trip, rollback verdict monotonicity (accept iff counter >= mark),
+  advance-never-lowers, platform-match totality + wasm universality
+- **Matrix**: CI now tests linux AND macos (was ubuntu-only while shipping
+  4 platforms), pins an MSRV (1.89) build, and publishes cargo-llvm-cov
+  coverage as advisory evidence
+- Kani proofs of the same invariants split to REQ-KANI-001 (v1.0, the
+  scry advisory→required pattern) — not claimed here
+
 ## v0.12.1 — 2026-08-08
 
 Audit hardening. Independent ASPICE/ISO-26262 and cybersecurity audits