Bounty #1112: Add /attest/submit fuzzer (bounded, safe)

[MrHyplex9511]

Bounty #1112 — /attest/submit fuzzer

Bounded, safety-first fuzzer for the POST /attest/submit attestation endpoint, plus an offline pytest suite and README.

Deliverables

• tools/fuzz_attest.py — stdlib-only fuzzer (urllib/json/argparse). 102 seeded payloads across 6 classes: missing_field, wrong_type, bad_json, oversized, injection, truncated.
• tools/fuzz_attest/test_fuzz_attest.py — 15 offline pytest tests (no network), covering vocabulary size/categories, dry-run cap, network-free dry run, 4xx/5xx/200 classification, exception handling, credential-field absence, throwaway miner-id guarantee, raw bad_json serialization, base-url validation.
• tools/fuzz_attest/README.md — usage, safety contract, payload-class and verdict tables.

Live bounded run (2026-09-14, https://rustchain.org/attest/submit)

60 requests, 1.5s spacing, seed 1. Every payload rejected as a handled HTTP 4xx — no 5xx, no unexpected 200.

status	count
400	27
422	33

category	count
wrong_type	17
bad_json	13
injection	13
missing_field	8
truncated	6
oversized	3

Verdicts: handled_4xx: 60, anomalies: 0.

Safety contract

• Malformed payloads only; no valid attestation can be emitted (always-invalid placeholder signatures).
• Throwaway miner ids (fuzz-<16 hex>) — no real miner identities or credentials.
• Hard cap 60 requests/run; --delay 1.0 minimum spacing (default 1.5); --dry-run mode for CI.
• JSON report + category/status/verdict summaries; any 5xx/2xx response is surfaced as an anomaly for follow-up via Private Vulnerability Reporting.

Compliance with issue requirements

• = 100 payloads: 102.

• Required categories (missing fields, wrong types, oversized, injection-style): all present, plus bad_json and truncated.
• Distinguishes handled 4xx validation failures from 5xx bugs / worse: verdict_counts split into handled_4xx / server_5xx / unexpected_200, anomalies flagged with response bodies.
• No real bugs observed in this bounded run; raw responses are captured for triage.

Verification

python3 -m pytest tools/fuzz_attest/ -v → 15 passed. python3 tools/fuzz_attest.py --dry-run --requests 60 validates generation offline.

Note: the live node's validation appears stricter than docs/API.md (requires device/miner fields and rejects clock_skew strings). Not a bug — just schema drift worth a doc update.