security-protocol-fuzzinglisted

# Protocol Fuzzing Adapted from `SnailSploit/Claude-Red`, `Skills/fuzzing/offensive-fuzzing/SKILL.md`, commit `24d7968bab4b883e7f13477afe0fd91f2df3b722` (MIT; see [LICENSE](LICENSE)). The target/harness/corpus/oracle/triage workflow is narrowed to repository-owned protocol tests, with original state and evidence guidance added for AI Central. ## Choose A Target And Oracle Start at the real untrusted boundary, naming the revision, decoder or dispatcher, wire version, supported inputs and resource contract. Identify what detects a bug: panic, sanitizer report, excessive work, forbidden state change, authorization effect or violation of canonical encoding. A crash-free run alone does not prove a security property. Choose only properties the contract requires: - Parser rejection leaves retained state and quotas unchanged when specified. - Accepted canonical bytes re-encode identically when the format requires it; general decoders may intentionally accept multiple equivalent encodings. - A rejected or expired proof cannot consume unrelated authority. - Duplicate/reordered operations obey declared replay and lifecycle semantics. - Work, allocation, recursion and retained state stay within their own budgets. Do not assume all operations are idempotent. Differential disagreement is a lead; resolve which implementation or specification defines the expected behavior. ## Build The Harness Use the project's existing test and fuzz stack. Consult [references/harness-selection.md]