[pitboss] phase 07: M6 — Evidence consumers: formatters, ranking, UI

.github/workflows/ci.yml

@@ -404,20 +404,7 @@ jobs:
           toolchain: stable
           cache: true
 
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 20
-          cache: npm
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Build frontend
-        working-directory: frontend
-        run: |
-          npm ci
-          npm run build
-
       - name: Corpus unit tests (no_marker_collisions, all_payloads_have_fixture_paths)
-        run: cargo nextest run --lib -p nyx-scanner --test-threads=4 2>/dev/null || \
-             cargo nextest run --lib -p nyx-scanner
+        run: cargo nextest run --lib -p nyx-scanner dynamic::corpus
         env:
           RUST_LOG: error

.github/workflows/corpus_promote.yml

@@ -106,38 +106,46 @@ jobs:
           # Stage candidate files into fuzz-discovered (already there).
           # The PR body provides the reviewer with everything they need.
 
-          # Build PR body.
-          body=$(cat <<'EOF'
-          ## Corpus Promotion Proposal
+          # Build PR body into a temp file to avoid shell re-interpolation of
+          # sidecar JSON content (which may contain backticks or $(...) sequences).
+          body_file=$(mktemp)
 
-          This PR was generated automatically by the weekly corpus-promote workflow.
-          It does **not** auto-merge — a human reviewer must approve each candidate
-          before it can land in `src/dynamic/corpus.rs` (§16.4).
+          cat > "$body_file" <<'PREAMBLE'
+## Corpus Promotion Proposal
 
-          ### Candidates
+This PR was generated automatically by the weekly corpus-promote workflow.
+It does **not** auto-merge — a human reviewer must approve each candidate
+before it can land in `src/dynamic/corpus.rs` (§16.4).
 
-          The following payloads were discovered by the internal mutation fuzzer and
-          confirmed via `sink_hit && oracle_fired` against instrumented fixtures:
+### Candidates
 
-          EOF
-          )
+The following payloads were discovered by the internal mutation fuzzer and
+confirmed via `sink_hit && oracle_fired` against instrumented fixtures:
+
+PREAMBLE
 
           for f in $CANDIDATE_FILES; do
             sidecar="${f}.json"
+            printf -- '- `%s`\n' "$f" >> "$body_file"
             if [ -f "$sidecar" ]; then
-              body="$body\n- \`$f\`\n  \`\`\`json\n$(cat "$sidecar")\n  \`\`\`\n"
-            else
-              body="$body\n- \`$f\`\n"
+              printf '  ```json\n' >> "$body_file"
+              cat "$sidecar" >> "$body_file"
+              printf '\n  ```\n' >> "$body_file"
             fi
           done
 
-          body="$body\n### Review checklist\n"
-          body="$body\n- [ ] Bytes are a genuine attack vector, not a fixture artifact\n"
-          body="$body\n- [ ] Oracle marker is unique (no collision with other caps)\n"
-          body="$body\n- [ ] \`fixture_paths\` updated in \`src/dynamic/corpus.rs\`\n"
-          body="$body\n- [ ] \`since_corpus_version\` set to next version\n"
-          body="$body\n- [ ] \`CORPUS_VERSION\` bumped and bump history updated\n"
-          body="$body\n\n_Generated by corpus_promote.yml — do not auto-merge._\n"
+          cat >> "$body_file" <<'CHECKLIST'
+
+### Review checklist
+
+- [ ] Bytes are a genuine attack vector, not a fixture artifact
+- [ ] Oracle marker is unique (no collision with other caps)
+- [ ] `fixture_paths` updated in `src/dynamic/corpus.rs`
+- [ ] `since_corpus_version` set to next version
+- [ ] `CORPUS_VERSION` bumped and bump history updated
+
+_Generated by corpus_promote.yml — do not auto-merge._
+CHECKLIST
 
           git add fuzz-discovered/ || true
           git diff --cached --quiet || git commit -m "chore: add ${CANDIDATE_COUNT} fuzzer-discovered corpus candidates"
@@ -146,10 +154,12 @@ jobs:
 
           gh pr create \
             --title "chore(corpus): promote ${CANDIDATE_COUNT} fuzzer-discovered payload(s)" \
-            --body "$(printf '%b' "$body")" \
+            --body "$(cat "$body_file")" \
             --base master \
             --label "corpus-promotion" || true
 
+          rm -f "$body_file"
+
       - name: Dry run summary
         if: github.event.inputs.dry_run == 'true'
         run: |