[pitboss] phase 11: Track J.9 + Track L.9 — CRYPTO, JSON_PARSE, UNAUTHORIZED_ID, DATA_EXFIL corpora

tests/dynamic_fixtures/crypto/python/benign.py

@@ -0,0 +1,9 @@
+# Phase 11 (Track J.9) — Python CRYPTO benign control fixture.
+#
+# Uses `secrets.token_bytes(32)` (a CSPRNG) so the produced key
+# trivially exceeds the weak budget.
+import secrets
+
+
+def run(_value):
+    return secrets.token_bytes(32)

tests/dynamic_fixtures/crypto/python/vuln.py

@@ -0,0 +1,10 @@
+# Phase 11 (Track J.9) — Python CRYPTO vuln fixture.
+#
+# Uses `random.randint(0, 0xFFFF)` (a non-CSPRNG) to derive a 16-bit
+# key; the harness's instrumented key path writes a `ProbeKind::WeakKey`
+# probe and the `WeakKeyEntropy` oracle fires.
+import random
+
+
+def run(_value):
+    return random.randint(0, 0xFFFF)