test(security): add a fuzz target for XDR and SCVal decoding #20

Problem

Decoding is covered by examples, not coverage-guided fuzzing.

Why this matters

Fuzzing finds panics and pathological inputs that examples miss.

Context

All decoded input is untrusted.

Scope

• Add a fuzz/ crate with targets for SCVal, envelope, and event decoding

• Run a bounded smoke fuzz in CI on a schedule

Out of scope

• Fuzzing the CLI argument parser (separate issue).

Technical guidance

• Use cargo-fuzz; no filesystem access in targets.

Relevant modules/files

• fuzz/

Acceptance criteria

• Targets build and run

• No panics found in a bounded run

Tests required

• Scheduled fuzz job

Security considerations

Directly protects the untrusted-input boundary.

Performance considerations

Bounded iterations.

Documentation requirements

Document how to run the fuzzer.

Dependencies

None.

Definition of done

Merged with a scheduled job.

Complexity recommendation

difficulty/high

Contribution guidelines

• Assignment required before starting. Request assignment on this issue; do not open a pull request until a maintainer has assigned you.

• Your pull request must include Closes #20.

• Run the local gate before opening the PR:

  cargo fmt --all -- --check
  cargo clippy --all-targets --all-features -- -D warnings
  cargo test --all
  

• Example commit message: test(security): add a fuzz target for XDR and SCVal decoding

• Suggested timeframe: complete within the active Wave cycle.

• Complexity is tagged with a difficulty/* label. Drips determines the applicable points and budget through its own system.

• See docs/WAVE.md and CONTRIBUTING.md.