Conversation
Symbolic frontier seeding already concretely replayed candidate sequences but only wrote them to the mutation corpus. Persist exact failure sites through the existing invariant cache so the normal replay, shrink, attribution, and result path reports them in the same run. Keep explicit fuzz replay replay-only.
Contributor
✅ Changelog foundThe deterministic check will validate the changed entry. |
figtracer
marked this pull request as ready for review
September 14, 2026 11:57
figtracer
requested review from
0xrusowsky,
DaniPopes,
grandizzy,
mablr,
mattsse and
stevencartavia
as code owners
September 14, 2026 11:57
mablr
reviewed
Sep 14, 2026
mablr
left a comment
mablr
left a comment
Member
There was a problem hiding this comment.
Maybe let's keep freshly confirmed frontier failures in memory and feed them directly into the existing replay/reporting path?
Replay existing invariant failures before frontier solving, keep newly confirmed failures independent of persistence, and reject frontiers beyond the configured campaign depth. Preserve the original reproducer when generic shrinking changes the failure site.
mablr
reviewed
Sep 14, 2026
mattsse
requested changes
Sep 14, 2026
mattsse
left a comment
mattsse
left a comment
Member
There was a problem hiding this comment.
Two reporting issues remain below.
Collect every replay-confirmed frontier predicate, including the anchor, before building the invariant campaign result. Keep exact persisted failure sites out of generic shrinking so the retained counterexample and trace describe the same failure.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Symbolic invariant frontier seeding already concretely replayed solved sequences, but confirmed counterexamples were only written to the mutation corpus. The same
forge testcould therefore pass even though a laterforge fuzz replayreproduced the failure. This keeps every replay-confirmed predicate, including the campaign anchor, through the normal invariant result path and persists its exact failure site. Site-locked reproducers skip generic shrinking so the reported sequence, reason, and trace describe the same failure.forge fuzz replayremains replay-only, and stateless fuzzing is unchanged.Across three independent Maze captures, the unchanged solver produced five concrete counterexamples that master stored but did not report; all five replayed exactly. This demonstrates the generic reporting defect, not a Maze-wide engine improvement. A WETH fixture and the Nerite stateful suite remained neutral when their captured frontiers produced no eligible confirmed counterexample. Regression coverage includes multiple confirmed predicates in one batch, reverted prefixes, assertion candidates, direct predicate checks,
afterInvariant, and exact-site replay.AI assistance was used to implement and validate this change.