# Corpus and coverage inventory — active-infinity
Baseline: 2.0.7 at commit `9b44242496568e2338c5e98b90e558d4b0999f4e`.
Coverage measured 2026-10-27 with
`cargo llvm-cov --locked --all-features --summary-only` on Windows x86_64
(MSVC). Raw logs are kept with the hardening evidence.
## Conformance vectors (committed)
| `tests/vectors/valid` | 6 (5 images + `index.txt`) | 5 | 2,808 | images that must validate and re-encode identically |
| `tests/vectors/invalid` | 36 (35 images + `index.txt`) | 35 | 35,732 | one image per declared failure code |
| `tests/vectors/invalid_stream` | 10 (9 images + `index.txt`) | 9 | 8,133 | hostile `AINS` frame sequences |
| **Total** | **52** | **49** | **46,673** | |
The `index.txt` files pin the expected size, content hash, node/string/blob
counts and (for `non_canonical`) the canonical flag. `conformance_tests.rs`
checks that the index and the files agree, that every declared code has a
vector, and that every declared invalid class appears in the spec.
Invalid classes present: bad magic, major, minor, header size, header
truncation, flags, hash, padding, section offset, section overlap, node record,
node reference, unit reference, string reference, edge, type, unit
discriminant, UTF-8, provenance, annotation, extension, extension gap,
duplicate field, duplicate binding, reserved tag, cycle, depth, count bomb,
size limit, short count, trailing bytes, not canonical, secret entry.
## Fuzz targets
| `fuzz_decode_infinity` | `fuzz_targets/fuzz_decode_infinity.rs` | all 49 vectors | validate/decode/encode/view/projection totality; canonical fixpoint; header hash equals image hash |
| `fuzz_stream_reassembly` | `fuzz_targets/fuzz_stream_reassembly.rs` | generated valid stream + 9 invalid streams | any byte split reassembles to the whole-module image; corruption or truncation fails closed |
| `fuzz_canonical_roundtrip` | `fuzz_targets/fuzz_canonical_roundtrip.rs` | valid corpus + `not_canonical.ainf` + generated fixture | construction order and arena order do not change bytes or hash |
| `fuzz_layout_sections` | `fuzz_targets/fuzz_layout_sections.rs` | 8 layout-fault vectors + generated count bomb | offsets, counts and total size fail closed before allocation |
| `fuzz_graph_cycles` | `fuzz_targets/fuzz_graph_cycles.rs` | `cycle.ainf`, `too_deep.ainf`, generated long cycle | every cycle shape is `infinity/cycle`, not a depth error |
| `fuzz_secret_positions` | `fuzz_targets/fuzz_secret_positions.rs` | `full.ainf`, `secret_entry.ainf`, generated metadata-copy module | no export path carries the literal |
| `fuzz_unit_discriminants` | `fuzz_targets/fuzz_unit_discriminants.rs` | `bad_unit.ainf`, `unit_ref.ainf`, generated unknown unit | unknown units are `infinity/unknown-unit`; out-of-range is `infinity/unit-ref` |
| `fuzz_projection_agreement` | `fuzz_targets/fuzz_projection_agreement.rs` | `full.ainf`, `extensions.ainf`, generated secret module | JSON and Protobuf agree on redaction, marker, determinism and hash |
All targets live in `fuzz/fuzz_targets/`; `common.rs` holds shared fixture and
wire-layout helpers but is not a target. `fuzz/Cargo.toml` declares each binary.
## Committed corpora
| `fuzz/corpus/fuzz_decode_infinity` | 49 |
| `fuzz/corpus/fuzz_stream_reassembly` | 10 |
| `fuzz/corpus/fuzz_canonical_roundtrip` | 7 |
| `fuzz/corpus/fuzz_layout_sections` | 9 |
| `fuzz/corpus/fuzz_graph_cycles` | 4 |
| `fuzz/corpus/fuzz_secret_positions` | 6 |
| `fuzz/corpus/fuzz_unit_discriminants` | 5 |
| `fuzz/corpus/fuzz_projection_agreement` | 4 |
`fuzz/target` and `fuzz/artifacts` remain ignored.
## Almost-valid seed classes
| Header content hash non-zero before canonicalization | `not_canonical.ainf` | `fuzz_canonical_roundtrip` |
| Duplicate table keys | `duplicate_field.ainf` | `fuzz_decode_infinity` |
| Unsorted table keys | `not_canonical.ainf` | `fuzz_canonical_roundtrip` |
| Empty key | generated by the target | `fuzz_decode_infinity` |
| Edge to a missing node | `bad_edge.ainf` | `fuzz_layout_sections` |
| Self-loop | `cycle.ainf` | `fuzz_graph_cycles` |
| Mutual cycle | generated | `fuzz_graph_cycles` |
| Long cycle | `long-cycle.ainf` | `fuzz_graph_cycles` |
| Stream payload differs from whole-module encode | `sequence.ainf` | `fuzz_stream_reassembly` |
| Deep leaf exceeds byte budget while shallow size looks small | `limit.ainf` | `fuzz_layout_sections`, `fuzz_decode_infinity` |
| Length exactly at EOF | generated by the mutation | `fuzz_layout_sections` |
| Unknown unit discriminant | `bad_unit.ainf` | `fuzz_unit_discriminants` |
| Duplicate extension tag | `bad_extension.ainf` | `fuzz_layout_sections` |
| Secret in every legal metadata position | `secret-metadata.ainf` | `fuzz_secret_positions` |
## Coverage snapshot
| `canonical.rs` | 92.30% | 94.79% | 96.36% |
| `decode.rs` | 70.45% | 68.31% | 66.67% |
| `encode.rs` | 93.19% | 97.05% | 100.00% |
| `error.rs` | 77.56% | 76.72% | 50.00% |
| `interop.rs` | 63.26% | 63.94% | 73.40% |
| `ir.rs` | 59.98% | 58.79% | 68.37% |
| `layout.rs` | 87.06% | 85.67% | 73.33% |
| `lib.rs` | 26.92% | 30.77% | 25.00% |
| `protobuf.rs` | 88.08% | 89.47% | 100.00% |
| `stream.rs` | 59.38% | 63.13% | 63.83% |
| `unit.rs` | 53.24% | 50.51% | 100.00% |
| `validate.rs` | 83.96% | 75.19% | 86.59% |
| `view.rs` | **12.37%** | **17.39%** | **24.14%** |
| **Total** | **73.44%** | **71.66%** | **75.00%** |
Interpretation:
- `view.rs` is a public zero-copy surface with almost no direct test coverage.
`fuzz_decode_infinity` exercises it; the unit suite still does not. That is the
highest-priority remaining coverage gap.
- `unit.rs` and `ir.rs` are mostly data and display code; the fuzz targets now
route through constructors and unit lookup.
- `stream.rs` at 63% lines matches the streaming target's surface; the stream
decoder is now fuzzed directly.
## Corpus policy
1. Every fixed or crashed case gets a minimized file under
`fuzz/corpus/<target>/` with a comment in the commit message naming the
checklist item and the invariant.
2. The corpus is committed and treated as hostile input: it runs under the same
limits and sanitizers as external bytes.
3. Seeds are deterministic: no timestamps, no random keys, no environment
dependence.
4. The conformance vectors stay the canonical seed source; the fuzz corpus adds
near-miss variants, not replacements.
5. CI runs a short campaign on pull requests and a longer campaign on `main`
and nightly (H1.20).