iuna

commit 9bd00d5361a67888e0fa6a5bd386ea12db5d096e
parent 277aafea1f57f4fdc015a8b0fc194abf827afee1
Author: Joris Hartog <jorishartog@hotmail.com>
Date:   Wed, 19 Aug 2026 21:50:14 +0200

Align release fuzz gates

Diffstat:
M
ROADMAP.md
 | 
4
++--
M
deployment.sh
 | 
12
+++++++-----
M
docs/genesis.md
 | 
11
+++++++----
M
docs/security-review.md
 | 
10
+++++-----

4 files changed, 21 insertions(+), 16 deletions(-)
diff --git a/ROADMAP.md b/ROADMAP.md
@@ -120,8 +120,8 @@ A release intended for deployment must pass:
 
 - `cargo test --locked`
 - `cargo check --locked --manifest-path fuzz/Cargo.toml`
-- fuzz smoke runs for `p2p_envelope`, `compact_snapshot`, `domain_json`,
-  `stratum_request`, and `wallet_config`
+- fuzz gate runs with `256` iterations each for `p2p_envelope`,
+  `compact_snapshot`, `domain_json`, `stratum_request`, and `wallet_config`
 - `cargo test --locked --release --test properties -- --ignored`
 
 Normal local development may skip ignored long-running property tests and long fuzzing sessions, but deployment must run the release gate smoke checks.
diff --git a/deployment.sh b/deployment.sh
@@ -74,13 +74,15 @@ ensure_tauri_cli() {
 run_release_tests() {
   require_command cargo
 
+  local fuzz_runs="${IUNA_FUZZ_RUNS:-256}"
+
   cargo test --locked
   cargo check --locked --manifest-path fuzz/Cargo.toml
-  cargo run --locked --manifest-path fuzz/Cargo.toml --bin p2p_envelope -- -runs=1 fuzz/corpus/p2p_envelope
-  cargo run --locked --manifest-path fuzz/Cargo.toml --bin compact_snapshot -- -runs=1 fuzz/corpus/compact_snapshot
-  cargo run --locked --manifest-path fuzz/Cargo.toml --bin domain_json -- -runs=1 fuzz/corpus/domain_json
-  cargo run --locked --manifest-path fuzz/Cargo.toml --bin stratum_request -- -runs=1 fuzz/corpus/stratum_request
-  cargo run --locked --manifest-path fuzz/Cargo.toml --bin wallet_config -- -runs=1 fuzz/corpus/wallet_config
+  cargo run --locked --manifest-path fuzz/Cargo.toml --bin p2p_envelope -- -runs="$fuzz_runs" fuzz/corpus/p2p_envelope
+  cargo run --locked --manifest-path fuzz/Cargo.toml --bin compact_snapshot -- -runs="$fuzz_runs" fuzz/corpus/compact_snapshot
+  cargo run --locked --manifest-path fuzz/Cargo.toml --bin domain_json -- -runs="$fuzz_runs" fuzz/corpus/domain_json
+  cargo run --locked --manifest-path fuzz/Cargo.toml --bin stratum_request -- -runs="$fuzz_runs" fuzz/corpus/stratum_request
+  cargo run --locked --manifest-path fuzz/Cargo.toml --bin wallet_config -- -runs="$fuzz_runs" fuzz/corpus/wallet_config
   cargo test --locked --release --test properties -- --ignored
 }
 
diff --git a/docs/genesis.md b/docs/genesis.md
@@ -43,15 +43,18 @@ Build and deploy from the candidate commit:
 ```sh
 cargo test --locked
 cargo check --locked --manifest-path fuzz/Cargo.toml
-cargo run --locked --manifest-path fuzz/Cargo.toml --bin p2p_envelope -- -runs=1 fuzz/corpus/p2p_envelope
-cargo run --locked --manifest-path fuzz/Cargo.toml --bin compact_snapshot -- -runs=1 fuzz/corpus/compact_snapshot
-cargo run --locked --manifest-path fuzz/Cargo.toml --bin domain_json -- -runs=1 fuzz/corpus/domain_json
-cargo run --locked --manifest-path fuzz/Cargo.toml --bin stratum_request -- -runs=1 fuzz/corpus/stratum_request
+cargo run --locked --manifest-path fuzz/Cargo.toml --bin p2p_envelope -- -runs=256 fuzz/corpus/p2p_envelope
+cargo run --locked --manifest-path fuzz/Cargo.toml --bin compact_snapshot -- -runs=256 fuzz/corpus/compact_snapshot
+cargo run --locked --manifest-path fuzz/Cargo.toml --bin domain_json -- -runs=256 fuzz/corpus/domain_json
+cargo run --locked --manifest-path fuzz/Cargo.toml --bin stratum_request -- -runs=256 fuzz/corpus/stratum_request
+cargo run --locked --manifest-path fuzz/Cargo.toml --bin wallet_config -- -runs=256 fuzz/corpus/wallet_config
 cargo test --locked --release --test properties -- --ignored
 ./deployment.sh <version>
 ```
 
 The deployment script writes release packages to `downloads/` and creates `downloads/SHA256SUMS`.
+It runs `256` iterations per fuzz target by default; set `IUNA_FUZZ_RUNS`
+only for an explicitly documented emergency redeploy.
 
 Verify the files before publishing them:
 
diff --git a/docs/security-review.md b/docs/security-review.md
@@ -145,11 +145,11 @@ Before the mainnet-candidate launch, attach or publish logs for:
 ```sh
 cargo test --locked
 cargo check --locked --manifest-path fuzz/Cargo.toml
-cargo fuzz run p2p_envelope -- -runs=256
-cargo fuzz run compact_snapshot -- -runs=256
-cargo fuzz run domain_json -- -runs=256
-cargo fuzz run stratum_request -- -runs=256
-cargo fuzz run wallet_config -- -runs=256
+cargo run --locked --manifest-path fuzz/Cargo.toml --bin p2p_envelope -- -runs=256 fuzz/corpus/p2p_envelope
+cargo run --locked --manifest-path fuzz/Cargo.toml --bin compact_snapshot -- -runs=256 fuzz/corpus/compact_snapshot
+cargo run --locked --manifest-path fuzz/Cargo.toml --bin domain_json -- -runs=256 fuzz/corpus/domain_json
+cargo run --locked --manifest-path fuzz/Cargo.toml --bin stratum_request -- -runs=256 fuzz/corpus/stratum_request
+cargo run --locked --manifest-path fuzz/Cargo.toml --bin wallet_config -- -runs=256 fuzz/corpus/wallet_config
 cargo test --locked --release --test properties -- --ignored
 ```