Each layer owns a clear contract. Layers communicate through shared types (TestCase, ExecutionResult, CoverageFeedback) and trait objects (plugins), not through ad-hoc globals.

1. Input construction — src/input/

Module	Role
model.rs	ProtocolModel, field/message/sequence specs; built-ins + JSON (json-model); offline infer_model_from_bytes
mutator.rs	Hierarchical mutator; energy feedback; template splice
integrity.rs	Semantic length/checksum + protocol raw heuristics
corpus.rs	Seed load, queue, scheduling

Output: structurally prepared TestCase instances. Integrity runs post-mutation, pre-encrypt. See Protocol Models, Mutation, Integrity Repair.

2. State + coverage — src/state/, src/coverage/

Module	Role
state/tracker.rs	Response-derived state hash / transitions
state/predictor.rs	Adaptive transition prediction
coverage/provider.rs	CoverageProvider trait, CoverageFeedback, MAP_SIZE 64 KiB
coverage/null|map|software|shm	Concrete backends; default null

Default coverage is off. Grey-box edges feed oracle and scheduling when -C map|software is set. See Coverage.

3. Execution — src/execution/

Module	Role
engine.rs	Campaign loop, workers, NXS event wiring, snapshot ownership
worker.rs	Per-worker mutate → prepare → send → observe
connector.rs	TCP/UDP connect, send/recv, timeouts
reuse.rs	Intelligent connection reuse
process_monitor.rs	Local process lifecycle / crash signals
snapshot/	null | process | criu backends
desocket/	ProtocolReset (FTP/SMTP/MQTT/HTTP/binary)
libafl_*.rs	Optional LibAFL path (--features libafl, -L)

See Snapshot & Desocket, LibAFL Path.

4. Monitoring + NXS — src/monitor/, src/nxs/, nxs/

Module	Role
monitor/oracle.rs	Base oracle trait + classic signals
plugin/oracle.rs	Production suites (differential, sanitizer, diffsan, expanded)
monitor/minimizer.rs	Crash/hang minimisation
monitor/logger.rs	Structured campaign logging
nxs/meta|resolve|spawn|reaper|rate	Meta write, path resolve, non-blocking spawn, exit reaping, rate limits
nxs/ (tree)	Official existence binaries + CONTRACT

See Oracles, NXS Overview.

Cross-cutting plugins — src/plugin/

• Protocol — model binding
• Integrity — repair plugins
• Encryptor — post-repair wire transforms
• Oracle — interestingness
• Pipeline — composed plugin chains when needed

Supporting

• src/common/ — Config, types, errors, utils
• src/platform/ — Linux/Windows specifics
• src/scripting/ — Python/RPC bridges
• src/main.rs — CLI parse, offline infer, engine dispatch