[pitboss] phase 01: Track A.1 — Spec derivation strategy enum + flow-steps-optional fallback

tests/dynamic_fixtures/spec_strategies/callgraph_entry_http.py

@@ -0,0 +1,9 @@
+# Fixture: spec derived via FromCallgraphEntry (rule id matches `*.http.*`,
+# entry point classified as HttpRoute).
+from flask import Flask, request
+
+app = Flask(__name__)
+
+@app.route("/echo")
+def echo():
+    return request.args.get("q", "")

tests/dynamic_fixtures/spec_strategies/flow_steps_taint.py

@@ -0,0 +1,6 @@
+# Fixture: spec derived via FromFlowSteps (taint flow with explicit source/sink).
+import os
+
+def handle_request(payload):
+    cmd = payload
+    os.system(cmd)

tests/dynamic_fixtures/spec_strategies/func_summary_walk.rs

@@ -0,0 +1,11 @@
+// Fixture: spec derived via FromFuncSummaryWalk (FuncSummary records
+// `tainted_sink_params` for a param that flows to a sink, without an
+// in-evidence flow_steps trace).
+
+fn read_path(_root: &str, name: &str) -> std::io::Result<Vec<u8>> {
+    std::fs::read(name)
+}
+
+fn main() {
+    let _ = read_path("/", "/etc/passwd");
+}

tests/dynamic_fixtures/spec_strategies/rule_namespace_cmdi.py

@@ -0,0 +1,6 @@
+# Fixture: spec derived via FromRuleNamespace (AST pattern `py.cmdi.os_system`
+# without a taint flow).
+import os
+
+def run_user_command(user_arg):
+    os.system(user_arg)