Coverage Coach

Problem

Coverage guided fuzzing can show that source code remains untouched without explaining why. For a stateful protocol such as MQTT, a missed branch may require valid packet bytes, an earlier message, broker configuration, session state, or a different harness boundary.

Coverage Coach explored a narrower question. Can an uncovered source region become a specific diagnosis and a repair attempt whose result is checked by execution rather than accepted because it looks plausible?

Constraints

The project was academic research, not a production security scanner. The system had to distinguish packet problems from state and harness problems while working with target specific source and build information.

Generated inputs could not count as progress by themselves. A suggested repair needed an identity bound source target and a repeatable replay check. Failed attempts also had to remain visible so the final record did not imply that every generated intervention worked.

Ownership

I designed and implemented the research prototype. My work covered coverage deficit records, blocker classification, typed intervention plans, seed and sequence construction, replay verification, and decision recording.

The underlying execution repository and raw research artifacts remain private. This public case study uses a sanitized architecture to explain the engineering shape without exposing private paths or unpublished material.

Decisions

I made the source region the primary evidence unit. A proposal is tied to a selected line, branch, or handler path before generation starts.

I separated diagnosis from construction. The classifier identifies whether the likely blocker is packet grammar, the starting seed, state, harness behavior, environment, or an unknown cause. The planner then chooses an intervention type, including a packet sequence when appropriate, that matches that diagnosis.

Replay is the acceptance gate. If the target execution reaches the bound region, the decision can be accepted with evidence. If it does not, the rejection and its reason remain in the ledger.

Implementation

The pipeline begins with coverage data and normalizes uncovered source records into stable deficits. A blocker classifier adds a reasoned category. An intervention planner creates a typed action, and a builder materializes a seed, ordered sequence, or state oriented repair.

The verifier replays the artifact against the target and checks the intended source evidence. A decision recorder stores accepted, rejected, and skipped outcomes. The loop can stop when the selected region closes, the available interventions are exhausted, or further attempts stop making progress.

Result

The result is an auditable research workflow that separates a suggested repair from an execution backed result. The architecture also preserves rejected attempts, making failure part of the evidence instead of invisible generation waste.

The private repository and final research report support the implemented workflow and its evidence rules. The public diagram explains the workflow but does not independently prove implementation or ownership. Private campaign results are not presented as public benchmarks.

Limitations

The sanitized architecture does not support claims that Coverage Coach beats OSS Fuzz, improves aggregate project coverage, discovers vulnerabilities, or generalizes across every MQTT broker.

Numeric research outcomes remain blocked from this public case study until the corresponding raw artifacts can be released or reproduced under a publishable protocol.

Reflection

The most important design choice was making rejection useful. An AI assisted system becomes easier to trust when it records why a plausible intervention failed and refuses to convert suggestion volume into success.

Coverage gaps also became more informative once the workflow could distinguish packet syntax from the state and harness conditions surrounding the packet.