integration: wave-1 combined CI check (do not merge)

.github/linters/.markdown-lint.yml

@@ -0,0 +1,14 @@
+# Super-Linter's default markdownlint rules (v8.7.0 TEMPLATES/.markdown-lint.yml)
+# with MD013 line length off. Super-Linter lints each changed file in full, and
+# CHANGELOG.md keeps each entry on one line while docs tables have rows past
+# 400 characters, so any edit to those files failed on lines nobody touched.
+MD004: false
+MD007:
+  indent: 2
+MD013: false
+MD026:
+  punctuation: ".,;:!。，；:"
+MD029: false
+MD033: false
+MD036: false
+blank_lines: false

.github/workflows/ci.yml

@@ -16,18 +16,18 @@ on:
 permissions:
   contents: read
 
+# A new push to a pull request cancels that pull request's older run. Every
+# other run gets its own group: a shared group would still cancel a queued run
+# on main whenever another push arrived.
 concurrency:
-  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
 jobs:
   draft-and-build-gates:
-    name: "${{ github.event_name == 'pull_request' && 'PR build and Node.js 24 runtime smoke' || 'Build gates' }}"
+    name: Build gates
     runs-on: ubuntu-latest
-    # The PR path also runs the serial runtime and CLI contract smoke suites.
-    # Under runner contention they completed successfully just after the former
-    # 15-minute ceiling, so keep a bounded two-times completion budget.
-    timeout-minutes: 30
+    timeout-minutes: 15
 
     steps:
       - name: Check out repository
@@ -67,6 +67,13 @@ jobs:
       - name: Find dead code and dependencies
         run: pnpm -w knip
 
+      # Informational until the pending dead-code removals land; then these
+      # categories move into the blocking `pnpm -w knip` step above. Findings
+      # exit 0, so they do not add a failure annotation to every run.
+      - name: Report unused exports
+        continue-on-error: true
+        run: pnpm -w knip --include exports,types,duplicates --no-exit-code
+
       - name: Build
         run: pnpm -w build
 
@@ -84,14 +91,6 @@ jobs:
       - name: Enforce production dependency advisory policy
         run: pnpm -w security:dependency-advisories
 
-      - name: Run PR runtime smoke tests
-        if: github.event_name == 'pull_request'
-        run: pnpm --filter @ultrafuzz/runtime test:pr-smoke:prebuilt
-
-      - name: Run PR CLI status contract smoke tests
-        if: github.event_name == 'pull_request'
-        run: pnpm --filter @ultrafuzz/cli test:pr-smoke:prebuilt
-
   external-static-analysis:
     name: External static analysis
     runs-on: ubuntu-latest
@@ -125,10 +124,10 @@ jobs:
           VALIDATE_SHELL_SHFMT: true
           VALIDATE_YAML: true
 
-  # The lane table lives in scripts/ci/release-validation-lanes.mjs so the
-  # pull-request policy is a tested artifact instead of an invisible `if:`.
-  # While this job was gated off pull requests, every runtime test reported
-  # `skipping` on a PR and resume-path regressions merged with all checks green.
+  # The lane table lives in scripts/ci/release-validation-lanes.mjs, whose test
+  # checks that it runs every gate scripts/validate-release.mjs defines. Every
+  # lane runs on pull requests too: while lanes were gated off pull requests,
+  # regressions in the skipped suites merged with all checks green.
   release-validation-lanes:
     name: Select release validation lanes
     runs-on: ubuntu-latest
@@ -144,17 +143,14 @@ jobs:
 
       - name: Select release validation lanes
         id: select
-        env:
-          EVENT_NAME: ${{ github.event_name }}
         run: |
-          echo "lanes=$(node scripts/ci/release-validation-lanes.mjs --event "$EVENT_NAME")" >> "$GITHUB_OUTPUT"
+          echo "lanes=$(node scripts/ci/release-validation-lanes.mjs)" >> "$GITHUB_OUTPUT"
 
+  # The lanes start without waiting for the build gates; release-gates still
+  # requires every job.
   release-validation:
     name: Full release validation (${{ matrix.description }})
-    needs:
-      - draft-and-build-gates
-      - external-static-analysis
-      - release-validation-lanes
+    needs: release-validation-lanes
     runs-on: ubuntu-latest
     timeout-minutes: ${{ matrix.timeout_minutes }}
     strategy:
@@ -172,6 +168,14 @@ jobs:
           sudo rm -rf /usr/local/lib/android
           sudo rm -rf /usr/share/dotnet
 
+      # Every test that launches a run copies a sealed execution snapshot of
+      # thousands of files and fsyncs each one in the test process, where
+      # eatmydata makes fsync a no-op. The Smithers engine's environment is
+      # built from an allowlist without LD_PRELOAD, so engine processes still
+      # sync. An ephemeral runner has nothing to protect across a crash.
+      - name: Install eatmydata
+        run: command -v eatmydata || { sudo apt-get update && sudo apt-get install -y eatmydata; }
+
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -214,7 +218,7 @@ jobs:
 
       - name: Validate release lane
         run: >-
-          pnpm -w validate:release --
+          eatmydata pnpm -w validate:release --
           --gates "${{ matrix.gates }}"
           --report ".ultrafuzz/release-validation/${{ matrix.lane }}.json"
 

.ultrafuzz/evals/bug-finding.yml

@@ -45,7 +45,7 @@ reporting: # policy only — provider selection/credentials live in ultrafuzz.to
   node_telemetry: true
   heartbeat_interval_seconds: 60
   experiment_prefix: bug-finding
-  artifacts:
-    mode: manifest-only # forced default when target.sensitivity == private; opt in to "upload"
+  artifacts: # still validated, but no eval behaviour depends on it
+    mode: manifest-only
     include: ["report.md", "report.json"]
     max_file_bytes: 5000000

.ultrafuzz/prompts/_templates/output-contract/coverage-evidence-markdown.mdx

@@ -37,5 +37,6 @@ Blockers:
 
 Repeat blocker and evidence rows in artifact order. Runtime publication compares
 this section with the typed handoff and rejects missing, duplicated, reordered,
-or bare coverage scores. Raw `covg-eval` output is for iteration only and
-defines neither published declaration-completeness view.
+or contradicting scoped scores, and it warns about coverage scores that name no
+exact scope. Raw `covg-eval` output is for iteration only and defines neither
+published declaration-completeness view.

.ultrafuzz/prompts/review/final-report.md

@@ -385,25 +385,8 @@ Ultrafuzz is an automated smart-contract fuzzing campaign assistant. Issues belo
 - Tokens used: `<token usage, or unavailable>`
 - Estimated spend: `<cost estimate such as $123 or $123+ when pricing is partial, or unavailable>`
 - Audit profile: `<effective audit profile, or unavailable>`
-
-## Audit context
-
-- Threat model: [THREAT_MODEL.md](<relative path to THREAT_MODEL.md>); [threat-model.json](<relative path to threat-model.json>)
-- Goal plan: [goal-plan.json](<relative path to goal-plan.json>)
 ```
 
-Render `## Audit context` with exactly this heading, bullet order, and link
-text, immediately after `## Run summary`. Use repository-relative or
-report-relative paths to the run's own `threat-model` and `goal-plan` artifacts;
-never absolute paths or external URLs. Omit an individual link whose artifact
-the run did not produce, omit the `Goal plan` bullet when there is no goal plan,
-and omit the whole section when the run produced none of them. Do not invent a
-different heading, ordering, or link text: `ultrafuzz report` regenerates this
-exact section deterministically from the run's own artifacts and overwrites
-anything else.
-Keep detailed threat content in those dedicated artifacts; do not duplicate it
-in `report.md`.
-
 Each production issue entry must use exactly this Markdown section order. The
 following example is structural only; replace the title, actor names, actions,
 outcomes, explanations, code, variants, and strategy IDs with issue-specific
@@ -825,8 +808,6 @@ Before finishing, verify that:
 - `report.md` contains `## Property provenance`, including every
   property-derived finding and no invented property IDs for non-property
   findings.
-- `report.md` renders the fixed `## Audit context` section for every artifact
-  the run produced, without copying their detailed analysis.
 - `report.md` contains `## Property implementation coverage` rendered from the
   exact runtime-authoritative coverage object.
 - `report.md` contains `## Goal search coverage` with counts recomputed from the

.ultrafuzz/prompts/setup/discover-base-test.md

@@ -39,8 +39,10 @@ If the setup handoffs identify Vyper-only or mixed Solidity/Vyper production
 contracts, make the reusable Foundry fixture Vyper-aware while keeping the tests
 Solidity-based. Define Solidity interfaces for the Vyper contracts' ABI-visible
 public/external functions and events, or reuse ABI-derived interfaces generated
-by the target repository. Do not require Foundry to compile `.vy` files as
-Solidity sources.
+by the target repository. Declare any new interface in the test tree: the
+workspace handoff rejects every change under the production source roots (by
+default `src/` and `contracts/`). Do not require Foundry to compile `.vy` files
+as Solidity sources.
 
 For Vyper deployment helpers, prefer one reusable path that compiles creation
 bytecode with the target project's pinned compiler/tooling from the project

.ultrafuzz/prompts/setup/prepare-foundry-harness.md

@@ -22,7 +22,9 @@ production contracts, keep Foundry as the test harness and do not ask Foundry to
 compile `.vy` files as Solidity sources. Configure the harness so generated
 `.t.sol` tests interact with Vyper contracts through Solidity interfaces that
 match the contracts' public/external ABI, or through ABI-derived Solidity
-interfaces when the target repository already generates them.
+interfaces when the target repository already generates them. Declare any new
+interface in the test tree: the workspace handoff rejects every change under the
+production source roots (by default `src/` and `contracts/`).
 
 Create only the minimal harness layout needed by later fuzzing agents.
 

.ultrafuzz/prompts/strategies/invariants/implement-properties.md

@@ -124,8 +124,10 @@ an unselected expected check is not implemented or fulfilled.
      guard, or other precondition that prevents the backend from observing the
      violating post-state. Preconditions may admit valid actions; they may not
      assume the property under test.
-   - Do not edit production contracts except interfaces that are genuinely
-     required by the test harness.
+   - Do not edit production contracts, not even to add an interface: the
+     workspace handoff rejects every change under the production source roots
+     (by default `src/` and `contracts/`). Declare any interface the harness
+     needs in the test tree instead.
    - Keep generated or changed invariant files in the test tree and include
      every changed `*.t.sol` test/reproducer in `generated-tests.json`.
    - Preserve Recon constructor deployment if property work changes `Setup`,

.ultrafuzz/prompts/strategies/invariants/setup.md

@@ -71,7 +71,7 @@ project's pinned revision.
 Use these Recon/Chimera rules while making decisions:
 
 - Read `AGENTS.md` and obey all repository-specific rules before editing.
-- Do not edit production `src/` or `contracts/` except for interfaces if they are genuinely required by the harness.
+- Do not edit production `src/` or `contracts/`, not even to add an interface: the workspace handoff rejects every change under the production source roots. Declare any interface the harness needs in the test tree instead.
 - [Chimera](https://github.com/Recon-Fuzz/create-chimera-app) is the write-once, run-everywhere scaffold for Foundry, Echidna, Medusa, Halmos, and Kontrol style runs.
 - The create-chimera-app layout under the repository's test root is:
   `<test-root>/recon/Setup.sol`, `BeforeAfter.sol`, `Properties.sol`,

.ultrafuzz/topology.yml

@@ -41,6 +41,8 @@ groups:
   review:
     label: Review
     color: "#0f766e"
+    defaults:
+      timeout_seconds: 7200
 nodes:
   - id: __start__
     kind: meta
@@ -198,7 +200,6 @@ nodes:
     group: references
     depends_on:
       - __start__
-    timeout_seconds: 300
     outputs:
       - path: references/0kn0t.md
         contract: ultrafuzz/nonempty-markdown@1
@@ -211,7 +212,6 @@ nodes:
     group: references
     depends_on:
       - __start__
-    timeout_seconds: 300
     outputs:
       - path: references/certora-thinking.md
         contract: ultrafuzz/nonempty-markdown@1
@@ -224,7 +224,6 @@ nodes:
     group: references
     depends_on:
       - __start__
-    timeout_seconds: 300
     outputs:
       - path: references/certora-sanity.md
         contract: ultrafuzz/nonempty-markdown@1
@@ -237,7 +236,6 @@ nodes:
     group: references
     depends_on:
       - __start__
-    timeout_seconds: 300
     outputs:
       - path: references/aviggiano.md
         contract: ultrafuzz/nonempty-markdown@1
@@ -250,7 +248,6 @@ nodes:
     group: references
     depends_on:
       - __start__
-    timeout_seconds: 300
     outputs:
       - path: references/rounding.md
         contract: ultrafuzz/nonempty-markdown@1
@@ -263,7 +260,6 @@ nodes:
     group: references
     depends_on:
       - __start__
-    timeout_seconds: 300
     outputs:
       - path: references/crytic.md
         contract: ultrafuzz/nonempty-markdown@1
@@ -276,7 +272,6 @@ nodes:
     group: references
     depends_on:
       - __start__
-    timeout_seconds: 300
     outputs:
       - path: references/runtime-verification.md
         contract: ultrafuzz/nonempty-markdown@1
@@ -289,7 +284,6 @@ nodes:
     group: references
     depends_on:
       - __start__
-    timeout_seconds: 300
     outputs:
       - path: references/a16z-erc4626.md
         contract: ultrafuzz/nonempty-markdown@1
@@ -302,7 +296,6 @@ nodes:
     group: references
     depends_on:
       - __start__
-    timeout_seconds: 300
     outputs:
       - path: references/recon.md
         contract: ultrafuzz/nonempty-markdown@1

docs/SPECS.md

@@ -243,8 +243,15 @@ Every planned JSON output MUST resolve through the checked-in schema registry.
 The planned and expanded graph representations MUST persist the schema filename,
 fragment-free schema ID, schema SHA-256, package schema-bundle SHA-256, and
 validator build identity. Missing or partial bindings MUST fail planning or host
-verification. Operators declare the versioned contract in topology; they MUST
-NOT supply these trust identities manually in YAML.
+verification. Host artifact gates and verified reads MUST validate against the
+schema content a binding names, using the run's sealed schema snapshot when the
+installed bundle differs. The recorded validator build and contract digest are
+provenance: graph reads, host artifact gates, verified reads, task preparation,
+dependency admission, and the validator preflight MUST NOT require them to equal
+the reading build's own. Task preparation and the validator preflight MUST still
+require the schema bundle they validate with to be the planned one. Operators
+declare the versioned contract in topology; they MUST NOT supply these trust
+identities manually in YAML.
 
 ## Prompts
 
@@ -447,9 +454,10 @@ every non-builtin module whose lexical or physical resolution escapes the
 closure. Ordinary artifact and schema data reads remain outside this module
 boundary. Modal MUST provide the equivalent root-owned,
 read-only entrypoint. Both environments MUST run a real known-valid fixture and
-verify the returned schema ID, schema digest, bundle digest, and validator build;
-`command -v` alone is insufficient. A missing, tampered, or stale launcher or
-closure is a setup failure for new model work. It MUST NOT turn historical
+verify the returned schema ID, schema digest, and bundle digest; the returned
+validator build is provenance and MUST NOT be compared. `command -v` alone is
+insufficient. A missing, tampered, or stale launcher or closure is a setup
+failure for new model work. It MUST NOT turn historical
 seals or schema identities into resume authorization. A current-controller
 continuation MAY select current validator packages while retaining historical
 source and artifacts as provenance.
@@ -470,7 +478,6 @@ Before or at launch, each run MUST persist:
 - immutable rendered prompt snapshots under `prompt-snapshots/`
 - per-node artifacts under `artifacts/`
 - review artifacts under `review/`
-- event query indexes under `events.index/`
 - workspace metadata under `workspaces/`
 
 Reporting is agentic and lives in final-report artifacts.