Updated fuzz, miri, and mutant workflows

.cargo/mutants.toml

@@ -13,3 +13,14 @@ examine_globs = [
   "src/protocol/scope.rs",
   "src/protocol/redirect_repo.rs",
 ]
+
+# `examine_globs` only limits which files are mutated; cargo-mutants otherwise
+# runs the whole package suite, whose e2e/integration binaries need the shared
+# Postgres/Redis. Restrict the test run to the tests that cover the examined
+# modules (their unit tests plus the three pure property suites), which keeps
+# the leg container-free and fast enough for the mutation budget. The filter
+# is appended to every `cargo nextest run` cargo-mutants issues.
+additional_cargo_test_args = [
+  "-E",
+  "test(crypto::ct) | test(crypto::pkce) | test(crypto::tokens) | test(protocol::scope) | test(protocol::redirect_repo) | binary(proptest_pkce) | binary(proptest_scope) | binary(proptest_redirect)",
+]

.clusterfuzzlite/Dockerfile

@@ -12,7 +12,11 @@ FROM gcr.io/oss-fuzz-base/base-builder-rust:v1
 # dependency can never again outgrow a stale preinstalled nightly
 # (`sqlx 0.9` needs rustc >= 1.94; the base image ships 1.91).
 ENV RUSTUP_TOOLCHAIN=nightly-2026-10-01
-RUN rustup toolchain install nightly-2026-10-01 && cargo install cargo-fuzz --locked
+# The base image already ships cargo-fuzz and `cargo install` is a no-op when
+# it is present, so pin with --force: a cargo-fuzz that leaks the sanitizer
+# RUSTFLAGS into host proc-macros breaks the build.
+RUN rustup toolchain install nightly-2026-10-01 \
+  && cargo install cargo-fuzz --locked --force --version 0.13.2
 
 COPY . "$SRC/d-oauth-server"
 WORKDIR "$SRC/d-oauth-server"

.clusterfuzzlite/build.sh

@@ -7,6 +7,15 @@
 
 cd "$SRC/d-oauth-server/fuzz"
 
+# The OSS-Fuzz base image exports CXX=clang++ with a CXXFLAGS that selects
+# libc++ (-stdlib=libc++). libfuzzer-sys's build script compiles libFuzzer's
+# C++ runtime with those flags, but rustc/cc links the C++ stdlib as libstdc++
+# (-lstdc++), so the runtime's libc++ (std::__1::) symbols end up undefined at
+# link time. clang++ defaults to libstdc++ when the flag is absent, so drop it
+# to make the compiled runtime and the link line agree.
+CXXFLAGS="${CXXFLAGS:-}"
+export CXXFLAGS="${CXXFLAGS//-stdlib=libc++/}"
+
 cargo fuzz build -O --debug-assertions
 
 for target_path in fuzz_targets/*.rs; do

.github/workflows/ci.yml

@@ -352,6 +352,11 @@ jobs:
         uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2
         with:
           tool: cargo-mutants
+      # cargo-mutants runs the baseline and every mutant via `cargo nextest run`.
+      - name: Install cargo-nextest
+        uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2
+        with:
+          tool: nextest
       - name: Budgeted mutation run (see .cargo/mutants.toml)
         run: cargo mutants --timeout 1800 --test-tool nextest
 
@@ -432,7 +437,9 @@ jobs:
           # Relaxed isolation for the first scheduled runs (wall-clock/env
           # access); tighten in a follow-up once green.
           MIRIFLAGS: -Zmiri-disable-isolation
+        # `+nightly` overrides the root `rust-toolchain.toml` stable pin, which
+        # would otherwise resolve `cargo miri` to stable (where miri is absent).
         run: >
-          cargo miri test --lib --
+          cargo +nightly miri test --lib --
           crypto::ct crypto::pkce crypto::tokens
           jose::jar

docs/CONTRIBUTING.md

@@ -128,6 +128,14 @@ cargo fuzz build                       # every target must compile
 cargo fuzz run <target> -- -max_total_time=60 -rss_limit_mb=2048
 ```
 
+The containerized (ClusterFuzzLite/OSS-Fuzz) build runs inside the Rust base
+image, which exports `CXX=clang++` with a `CXXFLAGS` selecting libc++. That
+breaks the link: libfuzzer-sys compiles libFuzzer's C++ runtime with `$CXX`,
+but rustc/`cc` links the C++ stdlib as `-lstdc++`, so the runtime's libc++
+(`std::__1::`) symbols go undefined. `.clusterfuzzlite/build.sh` drops
+`-stdlib=libc++` before building (clang++ then defaults to libstdc++), and the
+image pins `cargo-fuzz` so the tool cannot drift.
+
 Corpora persist across runs: `cargo fuzz run` reads and writes
 `fuzz/corpus/<target>/` (gitignored, but cached across CI runs by the
 `fuzz-run` leg), and crashes land in `fuzz/artifacts/<target>/`. To grow a