New target class: Tree Sitter parser fuzzing harnesses

[quinn-dougherty]

Background

From the 2026-06-22 evals team meeting: the team is pivoting from OSS-Fuzz/ARVO targets (already hardened) to "wild" parsers with real-world impact and no existing fuzzing coverage. Tree Sitter parsers are used by Zed, GitHub (syntax highlighting), Neovim, and many other high-profile projects. They are written in C and expose a stable C API, making them straightforward to wrap with libfuzzer.

Scope

• Pick 2–3 high-impact grammar repos (candidates: tree-sitter-python, tree-sitter-javascript, tree-sitter-c)
• Write libfuzzer harnesses wrapping the Tree Sitter C API (ts_parser_parse_string)
• Add to targets/ following OSS-Fuzz conventions (Dockerfile, build.sh, metadata.yaml)
• Seed corpus: small valid source files for each grammar
• Format dictionary: language-specific keywords/tokens

Acceptance criteria

• At least 2 Tree Sitter grammar targets in targets/
• Each builds cleanly in the OSS-Fuzz base image
• Harness exercises the parse path (not a stub) — per issue Live-fuzzing harnesses never link/exercise the real target library (no-op/stub) — all fuzzing results invalid #151
• metadata.yaml filled out with target name, language, category
• Added to experiment sweep configs

Notes

Fallback: if a grammar's C library is awkward to link, the tree-sitter runtime itself (libtree-sitter) is a valid secondary target. Even parsing crashes in the runtime are high-value given its deployment surface.