[YUZHEthefool]

Problem

Scheduled fuzzing publishes only an opaque HMAC candidate ID. Raw libFuzzer inputs, stack traces and QEMU evidence were kept in RUNNER_TEMP and discarded with the job, so the open candidates in #40 and #41 cannot be reproduced or root-caused even by maintainers.

Outcome

Retain failure-only plaintext evidence inside the runner, seal it with age, and publish only ciphertext. The public candidate schema, issue format and HMAC IDs are unchanged.

Closes #46.

Design and scope

• scripts/fuzz/private_evidence.py run records the exact command, revision, source hashes, source patch, guest-image hashes, tool versions, exit status and raw libFuzzer output in an exclusive private directory.
• seal streams a tar/gzip archive directly into age; only campaign.tar.gz.age is uploaded, under fuzz-evidence-<job-index>. Plaintext never enters a cache or artifact.
• QEMU failures retain the submitted program, private guest image, disk, serial output, QEMU stderr and outcome.json. The receipt distinguishes crash, boot_timeout, guest_hang and execution_error; an execution error alone is not a kernel defect.
• crash-triage --private-index writes a mode-0600 index mapping public candidate IDs to retained inputs. The public report remains exactly two fields and never embeds paths or payloads; the index cannot be written into the public output directory.
• The campaign fails closed when FUZZ_EVIDENCE_RECIPIENTS is missing or malformed, or when encryption/upload fails, so the reporting job cannot create a pointer without evidence.
• The QEMU libFuzzer per-input timeout is now -timeout=1200, above the executor's 900-second guest bound, in both the workflow runner and the local Makefile campaign targets.
• Documentation covers recipient generation, the repository variable, decryption and the fact that candidate IDs deduplicate inputs, not root causes.

Security properties

• The plaintext evidence tree is created mode 0700 with an exclusive-create check; the triage index is 0600.
• seal refuses symlinks, hard links, special files, incomplete runs, an existing output, and archives over 1 GiB.
• Encryption failure or a non-age output is rejected before os.replace.
• The HMAC fingerprint key is removed from the environment before the fuzzer or dependency build scripts run.
• Repository variable FUZZ_EVIDENCE_RECIPIENTS is already configured on this repository and preflight succeeds.

Validation

Check	Result
python3 -m pytest scripts/tests -q	PASS: 198 passed (9 new evidence tests)
bash scripts/ci/entrypoint.sh tools	PASS: fuzzer-tests, fuzzer-clippy, fuzz-features, executor
make lint	PASS (including ABI oracle)
userspace/fuzzer tests	PASS: 15 unit + 1 smoke + 7 executor + 4 scaffold
userspace/fuzzer Clippy -D warnings + release crash-triage build	PASS
userspace/nilix-syz-fuzzer tests	PASS: 34
fuzz qemu_executor::tests	PASS: 5, including failure receipt retention
New evidence tests	PASS: real age round-trip, tamper rejection, symlink/hardlink refusal, size limit, fail-closed encryption, non-zero campaign exit
FUZZ_EVIDENCE_RECIPIENTS preflight	PASS against the configured repository variable
git diff --check (cr-at-eol)	PASS

The real-guest QEMU smoke/campaign was not run locally; the PR relies on the existing qemu-fuzz CI gate for the guest path.

Compatibility and limitations

• No syscall, ABI, kernel or public candidate-format change.
• Historical ID-only reports ([Fuzzing]: private candidate from run 40653591456 #40, [Fuzzing]: private candidate from run 40840050759 #41) cannot recover inputs that were never retained; this protects future campaigns only.
• Decryption requires a maintainer-held private age identity kept outside the repository and CI.
• The scheduled workflow fails closed if FUZZ_EVIDENCE_RECIPIENTS is removed or invalid.