# Seed corpora

Hand-written starting inputs, one directory per fuzz target. These are
committed; `corpus/` is not.

The split follows `astra-soak-overview`, which calls a minimized corpus
"accumulated compute, not a build artifact":

- **These seeds are human intent.** Each names a shape of the grammar worth
  reaching in the first second rather than the first hour: each of the three
  verbs, each quoting style, and one file per class of thing that must be
  refused. They are reviewable in a diff and they do not churn.
- **`corpus/` is machine output and lives on astra**, under the soak runner's
  persistent directory. Minimize with `cargo +nightly fuzz cmin command` and
  commit it once it represents real soak hours, not before.

Run against these on a machine with no corpus:

    mkdir -p fuzz/corpus/command
    cargo +nightly fuzz run command fuzz/corpus/command fuzz/seeds/command

The `mkdir` is needed once. `cargo fuzz` creates the default corpus directory
for you only when you name no directories at all; pass them explicitly and
libFuzzer requires every one to exist already.

**Name the corpus directory first and this one second.** libFuzzer writes new
inputs into whichever directory it is given first and treats the rest as
read-only. Passing `fuzz/seeds/command` alone dumps hundreds of machine-generated
files in here and buries the hand-written ones, which is exactly the split this
directory exists to keep.

## What the accept/reject seeds are for

Roughly half of these are inputs the parser refuses, which is not wasted budget.
The oracle only fires on an *accepted* request, so a rejected seed contributes
coverage of the reject paths and, more usefully, sits one mutation away from an
accepted one. `07-dotdot-before-suffix` and `15-quote-in-name` are the two worth
knowing: the first is the shape a `.git` suffix strip can get wrong, and the
second is the shape the round-trip oracle exists to catch.

## Crash seeds

An input that once found a bug stays here forever, and also becomes a file under
`fuzz/regressions/`, which `tests/regressions.rs` replays on stable. None yet.