test(af02): add bounded T031 archive package fuzz target

TH
7d ago
+4524-1

Summary

Implement AF-02 Stack A1 on one qualification head. T031 is implemented and exact-head technical gates were green on 61f415aee1a017a08045f39cce6b129564397665; that evidence is now stale because T032 has been added. The PR remains open through T038 as required by canonical tasks.md.

Canonical base:

main: 1892f895d2ec1592ecdeb3c17e2696b41aa197c7
tree: f5b298e1348957fd8a66f137356141781471427d
T030: CANONICAL
A1: ACTIVE

Current candidate commit prepared for branch fast-forward:

2641b43e51a15d6265fe6151f3e2c53f32e5c7be

Completed implementation units in this candidate

T031 — bounded archive/package raw fuzzing

  • isolated cargo-fuzz package remains outside the product workspace;
  • archive_package_raw rejects inputs over 256 KiB;
  • shipped product seams only: inspect_package and LocalMirrorSource -> Resolver;
  • bounded process-scoped scratch cleanup;
  • no private archive API import;
  • no product Cargo.lock leakage.

T032 — Lockfile raw/structured property targets and independent model

  • adds lockfile_raw with the same 256 KiB input cap and product-side Lockfile::from_slice parsing;
  • activates canonical proptest = 1.11.0 only inside the isolated fuzz workspace;
  • adds the frozen independent model path tests/assurance/af02_models/lockfile_v2.rs with no commandf_pkg dependency and no reuse of Lockfile::{validate_v2,new_v2,to_bytes,from_slice};
  • implements the 14 frozen Lockfile invalidity classes from PROP-LOCKFILE-V2-001;
  • adds a 256-case structured property suite comparing valid generated graphs and all frozen negative classes against the shipped product validator;
  • retains root-workspace contract tests proving isolation, pins, target registration and model independence.

Authority boundary

No product source, root Cargo.lock, workflow, AF-02 schema/policy, canonical verifier, ruleset, or live authority is modified. No stochastic no-crash result is claimed. T034/T035 still own deterministic seeded execution and resource/offline evidence; T036/T037 own counterexample promotion and corpus/replay closure.

Qualification rule

Canonical tasks.md authorizes guarded merge only at T038 after T030–T037 are complete on one exact A1 head. Therefore this PR MUST remain open while T033–T037 are implemented. Any head mutation makes all earlier-head CI/review evidence stale.