Framework layout

Relative to ${BOLOS_SDK}/fuzzing/:

Path	Purpose
`cmake/`	`LedgerAppFuzz.cmake` — the module apps include (The CMake integration)
`include/`	Public harness headers apps include
`scripts/`	Campaign, CI build, corpus, seed, and invariant/layout tooling
`mock/`	Host-side crypto / NBGL / OS mocks linked via `secure_sdk`
`macros/`	Compile-define extraction (Build macros)
`libs/`	Per-library CMake aggregators for the instrumented SDK
`sanitizers/`	Sanitizer ignore-lists
`sdk-fuzz/`	The SDK's own self-fuzz targets
`doc/`	This documentation

Public headers

Under include/:

Header	Purpose
`fuzz_harness.h`	Default `fuzz_entry()` body and command dispatch (The harness)
`fuzz_defs.h`	Input layout, shared constants, and the `fuzz_command_spec_t` type
`fuzz_mutator.h`	Prefix-aware custom mutator
`tlv_mutator.h`	Optional grammar-aware TLV mutator (opt-in)

Under scripts/. Most developers only invoke the first three directly; the rest are wired in by the campaign and CI.

Script	Purpose
`app-campaign.sh`	Run a full campaign (Running a campaign)
`corpus.py`	Pack/unpack a corpus archive, or `promote` one to `base-corpus.zip` (Corpus and compatibility keys)
`fuzz_manifest.py`	Parse and validate the manifest; emit shell config, dictionary, and compat key
`seeds.py`	Generate the seed corpus from the manifest (generic + app custom)
`invariant.py`	Build the model: sync from discovery, then apply `domain-overrides.txt`
`cfl-build.sh`	Shared ClusterFuzzLite build (CI and maintainability)
`app-common.sh`	Sourced by both entry points: toolchain discovery, build/corpus helpers, and the manifest-derived configuration
`fuzz_seed_utils.py`	Importable helpers for an app's own seed generator (prefix size, seed prefix, control bytes)

The campaign's environment variables are documented in Environment variables.