From 7cf8a6bcd192281caf75b59570d9e2ce54244338 Mon Sep 17 00:00:00 2001
From: Seongho Bae <seongho@kw.ac.kr>
Date: Wed, 1 Jul 2026 16:02:37 +0900
Subject: [PATCH 01/10] Chart later numeric report rows

---
 python/fast_mlsirm/report.py | 13 +++++++------
 tests/test_report.py         | 23 +++++++++++++++++++++++
 2 files changed, 30 insertions(+), 6 deletions(-)

diff --git a/python/fast_mlsirm/report.py b/python/fast_mlsirm/report.py
index 89fbcd684..3b81a7c71 100644
--- a/python/fast_mlsirm/report.py
+++ b/python/fast_mlsirm/report.py
@@ -245,7 +245,12 @@ def _bar_chart(rows: list[dict[str, Any]], value_key: str | None) -> str:
         return ""
     if not rows:
         return ""
-    values = [float(row[value_key]) for row in rows if _is_number(row.get(value_key))]
+    numeric_rows = [
+        (index, row, float(row[value_key]))
+        for index, row in enumerate(rows)
+        if _is_number(row.get(value_key))
+    ]
+    values = [value for _, _, value in numeric_rows]
     if not values:
         return ""
 
@@ -253,11 +258,7 @@ def _bar_chart(rows: list[dict[str, Any]], value_key: str | None) -> str:
     upper = max(values)
     span = upper - lower
     chart_rows = []
-    for index, row in enumerate(rows[:12]):
-        raw_value = row.get(value_key)
-        if not _is_number(raw_value):
-            continue
-        value = float(raw_value)
+    for index, row, value in numeric_rows[:12]:
         width = 64.0 if span == 0 else 8.0 + ((value - lower) / span) * 92.0
         chart_rows.append(
             "\n".join(
diff --git a/tests/test_report.py b/tests/test_report.py
index 0019a48fa..6de507e6c 100644
--- a/tests/test_report.py
+++ b/tests/test_report.py
@@ -185,6 +185,29 @@ def test_render_table_section_omits_empty_chart_placeholder(tmp_path):
     assert "No chartable values were recorded for this section." not in html
 
 
+def test_render_table_section_charts_later_numeric_rows(tmp_path):
+    source = tmp_path / "fit_diagnostics.json"
+    out = tmp_path / "report.html"
+    item_ids = list(range(13))
+    outfit = [None] * 12 + [1.2]
+    source.write_text(
+        json.dumps(
+            {
+                "model_fit": {"loglik": -3.2},
+                "itemfit": {"item_id": item_ids, "outfit_mnsq": outfit, "observed_count": [4] * 13},
+            }
+        ),
+        encoding="utf-8",
+    )
+
+    render_diagnostics_report(source, out)
+
+    html = out.read_text(encoding="utf-8")
+    assert '<div class="bar-chart" role="img" aria-label="Compact diagnostics bar chart">' in html
+    assert '<span class="bar-label">Item Id 12</span>' in html
+    assert "Showing 12 of 13 rows." in html
+
+
 def test_render_report_rejects_unknown_payload(tmp_path):
     source = tmp_path / "unknown.json"
     out = tmp_path / "report.html"

From aac355f0f9eb29633a492ed1dbb57f9bf0bdaa7c Mon Sep 17 00:00:00 2001
From: Seongho Bae <seongho@kw.ac.kr>
Date: Fri, 10 Jul 2026 15:39:36 +0900
Subject: [PATCH 02/10] fix: satisfy coverage and scorecard gates

---
 .clusterfuzzlite/Dockerfile     |   4 ++
 .clusterfuzzlite/build.sh       |   5 ++
 .clusterfuzzlite/project.yaml   |   1 +
 .github/dependabot.yml          |  18 ++++++
 .github/workflows/cflite_pr.yml |  44 +++++++++++++
 .github/workflows/ci.yml        |  18 ++++--
 .github/workflows/codeql.yml    |  26 ++++++++
 SECURITY.md                     |  21 ++++++
 crates/mlsirm-core/src/lib.rs   | 109 ++++++++++++++++++++++++++++++--
 fuzz/Cargo.lock                 |  94 +++++++++++++++++++++++++++
 fuzz/Cargo.toml                 |  21 ++++++
 fuzz/fuzz_targets/neg_loglik.rs |  91 ++++++++++++++++++++++++++
 12 files changed, 441 insertions(+), 11 deletions(-)
 create mode 100644 .clusterfuzzlite/Dockerfile
 create mode 100755 .clusterfuzzlite/build.sh
 create mode 100644 .clusterfuzzlite/project.yaml
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/cflite_pr.yml
 create mode 100644 .github/workflows/codeql.yml
 create mode 100644 SECURITY.md
 create mode 100644 fuzz/Cargo.lock
 create mode 100644 fuzz/Cargo.toml
 create mode 100644 fuzz/fuzz_targets/neg_loglik.rs

diff --git a/.clusterfuzzlite/Dockerfile b/.clusterfuzzlite/Dockerfile
new file mode 100644
index 000000000..772995cc8
--- /dev/null
+++ b/.clusterfuzzlite/Dockerfile
@@ -0,0 +1,4 @@
+FROM gcr.io/oss-fuzz-base/base-builder-rust@sha256:a960440a8543df2411ca489eff995366ce8041b086141cc5092664d793f20e9e
+
+COPY . $SRC/fast-mlsirm
+WORKDIR $SRC/fast-mlsirm
diff --git a/.clusterfuzzlite/build.sh b/.clusterfuzzlite/build.sh
new file mode 100755
index 000000000..fbb80032a
--- /dev/null
+++ b/.clusterfuzzlite/build.sh
@@ -0,0 +1,5 @@
+#!/bin/bash -eux
+
+cd "$SRC/fast-mlsirm"
+cargo fuzz build -O neg_loglik
+cp fuzz/target/x86_64-unknown-linux-gnu/release/neg_loglik "$OUT/"
diff --git a/.clusterfuzzlite/project.yaml b/.clusterfuzzlite/project.yaml
new file mode 100644
index 000000000..22761ba7e
--- /dev/null
+++ b/.clusterfuzzlite/project.yaml
@@ -0,0 +1 @@
+language: rust
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..645fb1b8c
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: cargo
+    directory: /fuzz
+    schedule:
+      interval: weekly
diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml
new file mode 100644
index 000000000..eed4066c3
--- /dev/null
+++ b/.github/workflows/cflite_pr.yml
@@ -0,0 +1,44 @@
+name: ClusterFuzzLite PR fuzzing
+
+on:
+  pull_request:
+    paths:
+      - ".clusterfuzzlite/**"
+      - ".github/workflows/cflite_pr.yml"
+      - "Cargo.toml"
+      - "crates/**"
+      - "fuzz/**"
+
+permissions:
+  contents: read
+
+jobs:
+  PR:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      security-events: write
+    concurrency:
+      group: ${{ github.workflow }}-${{ matrix.sanitizer }}-${{ github.ref }}
+      cancel-in-progress: true
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer: [address]
+    steps:
+      - name: Build fuzzers (${{ matrix.sanitizer }})
+        id: build
+        uses: google/clusterfuzzlite/actions/build_fuzzers@82652fb49e77bc29c35da1167bb286e93c6bcc05
+        with:
+          language: rust
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          sanitizer: ${{ matrix.sanitizer }}
+      - name: Run fuzzers (${{ matrix.sanitizer }})
+        id: run
+        uses: google/clusterfuzzlite/actions/run_fuzzers@82652fb49e77bc29c35da1167bb286e93c6bcc05
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fuzz-seconds: 120
+          mode: code-change
+          output-sarif: true
+          sanitizer: ${{ matrix.sanitizer }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index babb4a63e..679228825 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,20 +5,24 @@ on:
     branches: [main, develop]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   python:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
-          python-version: "3.12"
+          python-version: "3.12.3"
       - run: python -m pip install -e .[dev]
       - run: pytest
 
   rust:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - run: rustup toolchain install 1.97.0 --profile minimal
+      - run: rustup default 1.97.0
       - run: cargo test
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 000000000..f43ab07f1
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,26 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+  schedule:
+    - cron: "24 3 * * 2"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze Python
+    runs-on: ubuntu-24.04
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: github/codeql-action/init@641a925cfafe92d0fdf8b239ba4053e3f8d99d6d
+        with:
+          languages: python
+      - uses: github/codeql-action/analyze@641a925cfafe92d0fdf8b239ba4053e3f8d99d6d
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..2f16215af
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are prepared for the default branch and the latest released
+source package when one exists.
+
+## Reporting a Vulnerability
+
+Please report suspected vulnerabilities through GitHub private vulnerability
+reporting:
+
+https://github.com/ContextualWisdomLab/fast-mlsirm/security/advisories/new
+
+Do not open a public issue for a vulnerability report. Include the affected
+version or commit, reproduction steps, expected impact, and any known safe
+workaround.
+
+We aim to acknowledge vulnerability reports within 7 days. After validation, we
+will coordinate a disclosure timeline and target a fix or mitigation plan within
+90 days, depending on severity and affected users.
diff --git a/crates/mlsirm-core/src/lib.rs b/crates/mlsirm-core/src/lib.rs
index 8699dd6f2..8d2f14bd8 100644
--- a/crates/mlsirm-core/src/lib.rs
+++ b/crates/mlsirm-core/src/lib.rs
@@ -102,7 +102,8 @@ pub fn neg_loglik_and_grad(
             let a = alpha.exp();
             let mut dist2 = config.eps_distance;
             for k in 0..config.latent_dim {
-                let diff = params.xi[p * config.latent_dim + k] - params.zeta[i * config.latent_dim + k];
+                let diff =
+                    params.xi[p * config.latent_dim + k] - params.zeta[i * config.latent_dim + k];
                 dist2 += diff * diff;
             }
             let r = if uses_space { dist2.sqrt() } else { 0.0 };
@@ -120,8 +121,8 @@ pub fn neg_loglik_and_grad(
             if uses_space {
                 grad.tau += e * (-gamma * r);
                 for k in 0..config.latent_dim {
-                    let diff =
-                        params.xi[p * config.latent_dim + k] - params.zeta[i * config.latent_dim + k];
+                    let diff = params.xi[p * config.latent_dim + k]
+                        - params.zeta[i * config.latent_dim + k];
                     let common = gamma * diff / r;
                     grad.xi[p * config.latent_dim + k] += e * (-common);
                     grad.zeta[i * config.latent_dim + k] += e * common;
@@ -148,7 +149,12 @@ fn add_penalty(
     value += add_l2(&params.theta, penalty.lambda_theta, 0.0, &mut grad.theta);
     value += add_l2(&params.b, penalty.lambda_b, 0.0, &mut grad.b);
     if free_alpha {
-        value += add_l2(&params.alpha, penalty.lambda_alpha, penalty.mu_alpha, &mut grad.alpha);
+        value += add_l2(
+            &params.alpha,
+            penalty.lambda_alpha,
+            penalty.mu_alpha,
+            &mut grad.alpha,
+        );
     }
     if uses_space {
         value += add_l2(&params.xi, penalty.lambda_xi, 0.0, &mut grad.xi);
@@ -261,4 +267,99 @@ mod tests {
         let finite_diff = (obj_plus - base) / h;
         assert!((finite_diff - grad.tau).abs() < 1e-5);
     }
+
+    #[test]
+    fn mask_excludes_observations_from_likelihood_and_gradients() {
+        let cfg = config();
+        let p = params();
+        let penalty = PenaltyConfig {
+            lambda_theta: 0.0,
+            lambda_xi: 0.0,
+            lambda_zeta: 0.0,
+            lambda_b: 0.0,
+            lambda_alpha: 0.0,
+            lambda_tau: 0.0,
+            mu_alpha: 0.0,
+            mu_tau: 0.0,
+        };
+        let y = vec![1.0, 0.0, 0.0, 1.0];
+        let mask = vec![true, false, false, true];
+
+        let (masked_obj, masked_grad, masked_loglik) =
+            neg_loglik_and_grad(&y, Some(&mask), &[0, 0], &p, &cfg, &penalty);
+
+        let first_cfg = ModelConfig {
+            n_persons: 1,
+            n_items: 1,
+            n_dims: 1,
+            latent_dim: 2,
+            model_type: ModelType::Mls2plm,
+            eps_distance: cfg.eps_distance,
+        };
+        let first_params = Params {
+            theta: vec![p.theta[0]],
+            alpha: vec![p.alpha[0]],
+            b: vec![p.b[0]],
+            xi: vec![p.xi[0], p.xi[1]],
+            zeta: vec![p.zeta[0], p.zeta[1]],
+            tau: p.tau,
+        };
+        let (first_obj, _, _) =
+            neg_loglik_and_grad(&[1.0], None, &[0], &first_params, &first_cfg, &penalty);
+
+        let second_params = Params {
+            theta: vec![p.theta[1]],
+            alpha: vec![p.alpha[1]],
+            b: vec![p.b[1]],
+            xi: vec![p.xi[2], p.xi[3]],
+            zeta: vec![p.zeta[2], p.zeta[3]],
+            tau: p.tau,
+        };
+        let (second_obj, _, _) =
+            neg_loglik_and_grad(&[1.0], None, &[0], &second_params, &first_cfg, &penalty);
+
+        assert!((masked_obj - (first_obj + second_obj)).abs() < 1e-12);
+        assert!((masked_loglik + masked_obj).abs() < 1e-12);
+        assert_eq!(masked_grad.theta.len(), cfg.n_persons * cfg.n_dims);
+    }
+
+    #[test]
+    fn mirt_omits_latent_space_and_tau_penalty_terms() {
+        let cfg = ModelConfig {
+            n_persons: 1,
+            n_items: 1,
+            n_dims: 1,
+            latent_dim: 2,
+            model_type: ModelType::Mirt,
+            eps_distance: 1e-8,
+        };
+        let p = Params {
+            theta: vec![0.5],
+            alpha: vec![0.2],
+            b: vec![-0.1],
+            xi: vec![10.0, -10.0],
+            zeta: vec![-7.0, 3.0],
+            tau: 4.0,
+        };
+        let penalty = PenaltyConfig {
+            lambda_theta: 0.0,
+            lambda_xi: 0.0,
+            lambda_zeta: 0.0,
+            lambda_b: 0.0,
+            lambda_alpha: 0.0,
+            lambda_tau: 10.0,
+            mu_alpha: 0.0,
+            mu_tau: -2.0,
+        };
+
+        let (got, grad, loglik) = neg_loglik_and_grad(&[1.0], None, &[0], &p, &cfg, &penalty);
+        let eta = 0.2_f64.exp() * 0.5 - 0.1;
+        let expected = softplus(eta) - eta;
+
+        assert!((got - expected).abs() < 1e-12);
+        assert!((loglik + expected).abs() < 1e-12);
+        assert_eq!(grad.xi, vec![0.0, 0.0]);
+        assert_eq!(grad.zeta, vec![0.0, 0.0]);
+        assert_eq!(grad.tau, 0.0);
+    }
 }
diff --git a/fuzz/Cargo.lock b/fuzz/Cargo.lock
new file mode 100644
index 000000000..e9e61bb28
--- /dev/null
+++ b/fuzz/Cargo.lock
@@ -0,0 +1,94 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
+
+[[package]]
+name = "cc"
+version = "1.2.66"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f5d6cac793997bd970000024b2934968efe83b382de4fdcf4fcb46b6ee4ad996"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "fast-mlsirm-fuzz"
+version = "0.0.0"
+dependencies = [
+ "libfuzzer-sys",
+ "mlsirm-core",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom",
+ "libc",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.186"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+
+[[package]]
+name = "libfuzzer-sys"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9fd2f41a1cba099f79a0b6b6c35656cf7c03351a7bae8ff0f28f25270f929d2"
+dependencies = [
+ "arbitrary",
+ "cc",
+]
+
+[[package]]
+name = "mlsirm-core"
+version = "0.1.0"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml
new file mode 100644
index 000000000..2fc4cbb56
--- /dev/null
+++ b/fuzz/Cargo.toml
@@ -0,0 +1,21 @@
+[package]
+name = "fast-mlsirm-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2021"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "=0.4.13"
+mlsirm-core = { path = "../crates/mlsirm-core" }
+
+[workspace]
+
+[[bin]]
+name = "neg_loglik"
+path = "fuzz_targets/neg_loglik.rs"
+test = false
+doc = false
+bench = false
diff --git a/fuzz/fuzz_targets/neg_loglik.rs b/fuzz/fuzz_targets/neg_loglik.rs
new file mode 100644
index 000000000..1df3eb8db
--- /dev/null
+++ b/fuzz/fuzz_targets/neg_loglik.rs
@@ -0,0 +1,91 @@
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+use mlsirm_core::{neg_loglik_and_grad, ModelConfig, ModelType, Params, PenaltyConfig};
+
+fn byte_to_f64(byte: u8) -> f64 {
+    (byte as f64 / 32.0) - 4.0
+}
+
+fn next_value(data: &[u8], cursor: &mut usize) -> f64 {
+    let value = byte_to_f64(data[*cursor % data.len()]);
+    *cursor += 1;
+    value
+}
+
+fuzz_target!(|data: &[u8]| {
+    if data.len() < 8 {
+        return;
+    }
+
+    let n_persons = (data[0] as usize % 3) + 1;
+    let n_items = (data[1] as usize % 3) + 1;
+    let n_dims = (data[2] as usize % 2) + 1;
+    let latent_dim = (data[3] as usize % 2) + 1;
+    let model_type = match data[4] % 5 {
+        0 => ModelType::Mirt,
+        1 => ModelType::Mls2plm,
+        2 => ModelType::Mlsrm,
+        3 => ModelType::Uls2plm,
+        _ => ModelType::Ulsrm,
+    };
+    let eps_distance = 1e-8 + (data[5] as f64 / 255.0) * 1e-3;
+    let config = ModelConfig {
+        n_persons,
+        n_items,
+        n_dims,
+        latent_dim,
+        model_type,
+        eps_distance,
+    };
+
+    let mut cursor = 6;
+
+    let y = (0..n_persons * n_items)
+        .map(|_| {
+            if next_value(data, &mut cursor) >= 0.0 {
+                1.0
+            } else {
+                0.0
+            }
+        })
+        .collect::<Vec<_>>();
+    let mask = (0..n_persons * n_items)
+        .map(|_| next_value(data, &mut cursor) >= -3.5)
+        .collect::<Vec<_>>();
+    let factor_id = (0..n_items)
+        .map(|idx| (idx + data[(cursor + idx) % data.len()] as usize) % n_dims)
+        .collect::<Vec<_>>();
+    cursor += n_items;
+
+    let params = Params {
+        theta: (0..n_persons * n_dims)
+            .map(|_| next_value(data, &mut cursor))
+            .collect(),
+        alpha: (0..n_items)
+            .map(|_| next_value(data, &mut cursor))
+            .collect(),
+        b: (0..n_items)
+            .map(|_| next_value(data, &mut cursor))
+            .collect(),
+        xi: (0..n_persons * latent_dim)
+            .map(|_| next_value(data, &mut cursor))
+            .collect(),
+        zeta: (0..n_items * latent_dim)
+            .map(|_| next_value(data, &mut cursor))
+            .collect(),
+        tau: next_value(data, &mut cursor),
+    };
+    let penalty = PenaltyConfig {
+        lambda_theta: next_value(data, &mut cursor).abs() * 0.01,
+        lambda_xi: next_value(data, &mut cursor).abs() * 0.01,
+        lambda_zeta: next_value(data, &mut cursor).abs() * 0.01,
+        lambda_b: next_value(data, &mut cursor).abs() * 0.01,
+        lambda_alpha: next_value(data, &mut cursor).abs() * 0.01,
+        lambda_tau: next_value(data, &mut cursor).abs() * 0.01,
+        mu_alpha: next_value(data, &mut cursor),
+        mu_tau: next_value(data, &mut cursor),
+    };
+
+    let _ = neg_loglik_and_grad(&y, Some(&mask), &factor_id, &params, &config, &penalty);
+});

From 5779b8832834a1d9dfdada7090f59b505597fe11 Mon Sep 17 00:00:00 2001
From: Seongho Bae <seongho@kw.ac.kr>
Date: Fri, 10 Jul 2026 15:52:52 +0900
Subject: [PATCH 03/10] fix: run fuzz builder as non-root

---
 .clusterfuzzlite/Dockerfile | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.clusterfuzzlite/Dockerfile b/.clusterfuzzlite/Dockerfile
index 772995cc8..c557b1358 100644
--- a/.clusterfuzzlite/Dockerfile
+++ b/.clusterfuzzlite/Dockerfile
@@ -1,4 +1,8 @@
 FROM gcr.io/oss-fuzz-base/base-builder-rust@sha256:a960440a8543df2411ca489eff995366ce8041b086141cc5092664d793f20e9e
 
-COPY . $SRC/fast-mlsirm
+RUN useradd --create-home --shell /bin/bash fuzzbuilder \
+    && chown -R fuzzbuilder:fuzzbuilder /rust
+
+COPY --chown=fuzzbuilder:fuzzbuilder . $SRC/fast-mlsirm
 WORKDIR $SRC/fast-mlsirm
+USER fuzzbuilder

From ee54b9dbbe31e56ba0cbc360e0c9646b45b58c47 Mon Sep 17 00:00:00 2001
From: Seongho Bae <seongho@kw.ac.kr>
Date: Fri, 10 Jul 2026 15:56:59 +0900
Subject: [PATCH 04/10] fix: allow non-root fuzz builds

---
 .clusterfuzzlite/Dockerfile | 4 +++-
 .clusterfuzzlite/build.sh   | 3 +++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/.clusterfuzzlite/Dockerfile b/.clusterfuzzlite/Dockerfile
index c557b1358..77d006a9d 100644
--- a/.clusterfuzzlite/Dockerfile
+++ b/.clusterfuzzlite/Dockerfile
@@ -1,7 +1,9 @@
 FROM gcr.io/oss-fuzz-base/base-builder-rust@sha256:a960440a8543df2411ca489eff995366ce8041b086141cc5092664d793f20e9e
 
 RUN useradd --create-home --shell /bin/bash fuzzbuilder \
-    && chown -R fuzzbuilder:fuzzbuilder /rust
+    && touch /usr/lib/libFuzzingEngine.a \
+    && chown fuzzbuilder:fuzzbuilder /usr/lib/libFuzzingEngine.a \
+    && chown -R fuzzbuilder:fuzzbuilder /rust /out /work /src
 
 COPY --chown=fuzzbuilder:fuzzbuilder . $SRC/fast-mlsirm
 WORKDIR $SRC/fast-mlsirm
diff --git a/.clusterfuzzlite/build.sh b/.clusterfuzzlite/build.sh
index fbb80032a..f17f71c29 100755
--- a/.clusterfuzzlite/build.sh
+++ b/.clusterfuzzlite/build.sh
@@ -1,5 +1,8 @@
 #!/bin/bash -eux
 
 cd "$SRC/fast-mlsirm"
+mkdir -p "$OUT"
+id
+ls -ld "$SRC/fast-mlsirm" "$OUT" "$(dirname "$LIB_FUZZING_ENGINE")"
 cargo fuzz build -O neg_loglik
 cp fuzz/target/x86_64-unknown-linux-gnu/release/neg_loglik "$OUT/"

From 4bcea162d8744de6c49a0d449bba497c9624918f Mon Sep 17 00:00:00 2001
From: Seongho Bae <seongho@kw.ac.kr>
Date: Fri, 10 Jul 2026 16:01:09 +0900
Subject: [PATCH 05/10] fix: align fuzz user with runner workspace

---
 .clusterfuzzlite/Dockerfile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.clusterfuzzlite/Dockerfile b/.clusterfuzzlite/Dockerfile
index 77d006a9d..0a52181f0 100644
--- a/.clusterfuzzlite/Dockerfile
+++ b/.clusterfuzzlite/Dockerfile
@@ -1,6 +1,7 @@
 FROM gcr.io/oss-fuzz-base/base-builder-rust@sha256:a960440a8543df2411ca489eff995366ce8041b086141cc5092664d793f20e9e
 
-RUN useradd --create-home --shell /bin/bash fuzzbuilder \
+RUN groupadd --gid 1001 fuzzbuilder \
+    && useradd --uid 1001 --gid fuzzbuilder --create-home --shell /bin/bash fuzzbuilder \
     && touch /usr/lib/libFuzzingEngine.a \
     && chown fuzzbuilder:fuzzbuilder /usr/lib/libFuzzingEngine.a \
     && chown -R fuzzbuilder:fuzzbuilder /rust /out /work /src

From 20101a01e335d4da3769205befd8d043afea5344 Mon Sep 17 00:00:00 2001
From: Seongho Bae <seongho@kw.ac.kr>
Date: Fri, 10 Jul 2026 16:05:12 +0900
Subject: [PATCH 06/10] fix: prepare fuzz output path for non-root user

---
 .clusterfuzzlite/Dockerfile | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.clusterfuzzlite/Dockerfile b/.clusterfuzzlite/Dockerfile
index 0a52181f0..cc5cc6ac3 100644
--- a/.clusterfuzzlite/Dockerfile
+++ b/.clusterfuzzlite/Dockerfile
@@ -2,9 +2,11 @@ FROM gcr.io/oss-fuzz-base/base-builder-rust@sha256:a960440a8543df2411ca489eff995
 
 RUN groupadd --gid 1001 fuzzbuilder \
     && useradd --uid 1001 --gid fuzzbuilder --create-home --shell /bin/bash fuzzbuilder \
+    && mkdir -p /github/workspace/build-out \
     && touch /usr/lib/libFuzzingEngine.a \
     && chown fuzzbuilder:fuzzbuilder /usr/lib/libFuzzingEngine.a \
-    && chown -R fuzzbuilder:fuzzbuilder /rust /out /work /src
+    && chown -R fuzzbuilder:fuzzbuilder /rust /out /work /src /github \
+    && chmod -R a+rwx /github/workspace/build-out
 
 COPY --chown=fuzzbuilder:fuzzbuilder . $SRC/fast-mlsirm
 WORKDIR $SRC/fast-mlsirm

From ed99c5ec51b9eaf69a53fd43108de55a4ad9fd37 Mon Sep 17 00:00:00 2001
From: Seongho Bae <seongho@kw.ac.kr>
Date: Fri, 10 Jul 2026 16:12:43 +0900
Subject: [PATCH 07/10] fix: prepare cflite output directory

---
 .github/workflows/cflite_pr.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml
index eed4066c3..a733c3a9b 100644
--- a/.github/workflows/cflite_pr.yml
+++ b/.github/workflows/cflite_pr.yml
@@ -26,6 +26,12 @@ jobs:
       matrix:
         sanitizer: [address]
     steps:
+      - name: Prepare ClusterFuzzLite output directory
+        run: |
+          mkdir -p "$GITHUB_WORKSPACE/build-out"
+          chmod -R a+rwx "$GITHUB_WORKSPACE/build-out"
+          echo "Prepared ClusterFuzzLite build-out for non-root fuzzbuilder writes"
+          ls -ld "$GITHUB_WORKSPACE" "$GITHUB_WORKSPACE/build-out"
       - name: Build fuzzers (${{ matrix.sanitizer }})
         id: build
         uses: google/clusterfuzzlite/actions/build_fuzzers@82652fb49e77bc29c35da1167bb286e93c6bcc05

From b6029992280cdad2282f32db869dbaa15d11ef7f Mon Sep 17 00:00:00 2001
From: Seongho Bae <seongho@kw.ac.kr>
Date: Fri, 10 Jul 2026 16:15:35 +0900
Subject: [PATCH 08/10] fix: allow rust sanitizer setup for fuzz user

---
 .clusterfuzzlite/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.clusterfuzzlite/Dockerfile b/.clusterfuzzlite/Dockerfile
index cc5cc6ac3..9a27fc6d5 100644
--- a/.clusterfuzzlite/Dockerfile
+++ b/.clusterfuzzlite/Dockerfile
@@ -2,10 +2,10 @@ FROM gcr.io/oss-fuzz-base/base-builder-rust@sha256:a960440a8543df2411ca489eff995
 
 RUN groupadd --gid 1001 fuzzbuilder \
     && useradd --uid 1001 --gid fuzzbuilder --create-home --shell /bin/bash fuzzbuilder \
-    && mkdir -p /github/workspace/build-out \
+    && mkdir -p /github/workspace/build-out /rustc \
     && touch /usr/lib/libFuzzingEngine.a \
     && chown fuzzbuilder:fuzzbuilder /usr/lib/libFuzzingEngine.a \
-    && chown -R fuzzbuilder:fuzzbuilder /rust /out /work /src /github \
+    && chown -R fuzzbuilder:fuzzbuilder /rust /rustc /out /work /src /github \
     && chmod -R a+rwx /github/workspace/build-out
 
 COPY --chown=fuzzbuilder:fuzzbuilder . $SRC/fast-mlsirm

From 748b96496b7f3ee9cd34b87663c5a67b15d70e02 Mon Sep 17 00:00:00 2001
From: Seongho Bae <seongho@kw.ac.kr>
Date: Fri, 10 Jul 2026 16:18:14 +0900
Subject: [PATCH 09/10] fix: expose cflite build script

---
 .clusterfuzzlite/Dockerfile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.clusterfuzzlite/Dockerfile b/.clusterfuzzlite/Dockerfile
index 9a27fc6d5..10024e354 100644
--- a/.clusterfuzzlite/Dockerfile
+++ b/.clusterfuzzlite/Dockerfile
@@ -9,5 +9,7 @@ RUN groupadd --gid 1001 fuzzbuilder \
     && chmod -R a+rwx /github/workspace/build-out
 
 COPY --chown=fuzzbuilder:fuzzbuilder . $SRC/fast-mlsirm
+COPY --chown=fuzzbuilder:fuzzbuilder .clusterfuzzlite/build.sh $SRC/build.sh
+RUN chmod +x $SRC/build.sh
 WORKDIR $SRC/fast-mlsirm
 USER fuzzbuilder

From e31f5101e0b0d5c882744868e9809667486a8d81 Mon Sep 17 00:00:00 2001
From: Seongho Bae <seongho@kw.ac.kr>
Date: Fri, 10 Jul 2026 16:21:43 +0900
Subject: [PATCH 10/10] fix: keep cflite diagnostics path-safe

---
 .clusterfuzzlite/build.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.clusterfuzzlite/build.sh b/.clusterfuzzlite/build.sh
index f17f71c29..fde040c6e 100755
--- a/.clusterfuzzlite/build.sh
+++ b/.clusterfuzzlite/build.sh
@@ -3,6 +3,7 @@
 cd "$SRC/fast-mlsirm"
 mkdir -p "$OUT"
 id
-ls -ld "$SRC/fast-mlsirm" "$OUT" "$(dirname "$LIB_FUZZING_ENGINE")"
+echo "LIB_FUZZING_ENGINE=${LIB_FUZZING_ENGINE:-unset}"
+ls -ld "$SRC/fast-mlsirm" "$OUT"
 cargo fuzz build -O neg_loglik
 cp fuzz/target/x86_64-unknown-linux-gnu/release/neg_loglik "$OUT/"