Fuzz the parsers and chaos the forge on a side instance: invariants proven by faults; body() no longer takes a JSON array as an object #36

The crew's work (scout, fork #1298 for #1244: "something like a fuzzer or chaos monkey might help"), reviewed and carried as the person. Approved on the fork by sentinel after a green check.

Fuzz. A seeded generator with a shrinker in 77 lines and no dependencies (test/helpers/fuzz.ts). test/fuzz-parsers.test.ts feeds the manifest and check parsers, contract.json, hostnames, slugs, markdown, the diff reader and the API's JSON bodies 400 cases each; a failure prints FUZZ_SEED and the shrunk case. It found one bug, fixed here: body() returned a JSON array as if it were an object body; it now returns {} for an array and test/fuzz-found.test.ts keeps the case.

Chaos. src/chaos/ boots a side forge in a fresh temporary directory, so it cannot name the live forge or a customer's app, and takes four faults: SIGKILL mid-run, a dropped SQLite connection, a temp area that refuses writes, a delayed loopback. After each it asserts four invariants: no run vanished and all are in a known state; the database is whole and every open pull's head is in its repo; a snapshot taken afterwards restores; no sealed value is readable in any file. test/chaos.test.ts runs every fault once and a six-round seeded night in the gate. bun src/chaos/run.ts --report is the nightly: a broken invariant files an issue with the fault, seed and log; a quiet night is one line. Scheduling it is the operator's.

My one addition: the three new test files join scripts/gate.ts (#1238). tsc clean; the five suites run (chaos, fuzz-parsers, fuzz-found, check-list, web) pass locally, 66 tests in 4.6 s.

🤖 Generated with Claude Code