Dynamic

[elicpeter]

Summary

This pull request significantly enhances the project's continuous integration (CI) and corpus management workflows. It introduces a dedicated dynamic verification workflow, refines and expands the test matrix in CI, and adds automated processes for auditing and promoting fuzz-discovered corpus candidates. These improvements increase test reliability, ensure cross-platform correctness, and automate important safety checks for corpus data.

CI and Testing Workflow Improvements:

• Added a new .github/workflows/dynamic.yml workflow to run the dynamic test suite across three environments: Linux (process-only), Linux (with Docker), and macOS, ensuring the dynamic harness pipeline is robust across supported platforms.
• Refactored the main CI workflow (ci.yml) to split Rust stable tests into process-only and Docker-backed jobs, and added explicit steps for interpreter and language image availability checks. Also introduced a positive control job for dynamic sandbox escape tests. [1] [2]
• Added .config/nextest.toml to serialize specific timing-sensitive tests into their own group, improving reliability of tests that are sensitive to resource contention.

Corpus Management and Audit Automation:

• Added a new workflow (corpus_promote.yml) that automatically proposes pull requests to promote new fuzz-discovered corpus candidates, including a hard gate marker-collision audit and detailed reviewer checklists.
• Enhanced the CI workflow with a corpus-marker-audit job that audits for marker collisions, runs corpus unit tests, and checks Python/Rust payload table sync, preventing cross-cap oracle collisions and ensuring data integrity.

These changes collectively improve test coverage, reliability, and the safety of corpus updates by automating critical checks and expanding the CI matrix.

Related issues

Closes #72

Checklist

• cargo test --bin nyx passes
• cargo clippy --all -- -D warnings is clean
• cargo fmt -- --check passes
• User-visible changes are noted in CHANGELOG.md under ## [Unreleased]
• Docs updated if behavior, flags, or config changed (docs/, README.md, CONTRIBUTING.md)
• New rules / language support include fixtures and integration tests