fixtures: add 4 crypto posture conformance vectors (crypto agility)

tests/fixtures/crypto_posture/vector_01_nominal_approved.json

@@ -0,0 +1,34 @@
+{
+  "_meta": {
+    "vector_id": "crypto_posture_01",
+    "description": "Nominal approved PQC posture — approved algorithm suite, valid key origin, matching policy",
+    "category": "nominal_approved",
+    "expected_verdict": "ALLOW",
+    "expected_reason_code": "crypto_posture_approved"
+  },
+  "input": {
+    "actor_id": "operator-alpha",
+    "action_class": "sensitive_command",
+    "context": {
+      "mission_phase": "transit",
+      "comms_mode": "DDIL"
+    },
+    "authority_scope": {
+      "level": "operational",
+      "delegation_chain": ["ground_authority", "vessel_commander"]
+    },
+    "invariant_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "crypto_posture": {
+      "alg_suite": "ML-KEM-768",
+      "key_origin": "onboard_kms",
+      "rotation_epoch": "2026-03-01T00:00:00Z",
+      "policy_hash": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
+      "toolchain_provenance": "genesis-aix-build-2026.03.r1"
+    }
+  },
+  "expected_output": {
+    "verdict": "ALLOW",
+    "reasons": ["crypto_posture_approved"],
+    "schema_version": "0.2.0"
+  }
+}

tests/fixtures/crypto_posture/vector_02_hybrid_pqc_approved.json

@@ -0,0 +1,34 @@
+{
+  "_meta": {
+    "vector_id": "crypto_posture_02",
+    "description": "Hybrid classic+PQC posture approved by policy",
+    "category": "hybrid_pqc_approved",
+    "expected_verdict": "ALLOW",
+    "expected_reason_code": "crypto_posture_hybrid_approved"
+  },
+  "input": {
+    "actor_id": "operator-bravo",
+    "action_class": "sensitive_command",
+    "context": {
+      "mission_phase": "station_keeping",
+      "comms_mode": "SATCOM"
+    },
+    "authority_scope": {
+      "level": "operational",
+      "delegation_chain": ["ground_authority"]
+    },
+    "invariant_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "crypto_posture": {
+      "alg_suite": "ECDH-P384+ML-KEM-768",
+      "key_origin": "HSM",
+      "rotation_epoch": "2026-02-15T00:00:00Z",
+      "policy_hash": "b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3",
+      "toolchain_provenance": "genesis-aix-build-2026.02.r3"
+    }
+  },
+  "expected_output": {
+    "verdict": "ALLOW",
+    "reasons": ["crypto_posture_hybrid_approved"],
+    "schema_version": "0.2.0"
+  }
+}

tests/fixtures/crypto_posture/vector_03_unknown_posture_refuse.json

@@ -0,0 +1,34 @@
+{
+  "_meta": {
+    "vector_id": "crypto_posture_03",
+    "description": "Misconfigured/unknown algorithm suite — fail-closed to REFUSE",
+    "category": "unknown_posture_refuse",
+    "expected_verdict": "REFUSE",
+    "expected_reason_code": "crypto_posture_unknown_suite"
+  },
+  "input": {
+    "actor_id": "operator-charlie",
+    "action_class": "sensitive_command",
+    "context": {
+      "mission_phase": "transit",
+      "comms_mode": "EMCON"
+    },
+    "authority_scope": {
+      "level": "operational",
+      "delegation_chain": ["ground_authority", "vessel_commander"]
+    },
+    "invariant_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "crypto_posture": {
+      "alg_suite": "UNKNOWN-ALG-SUITE-999",
+      "key_origin": "external_ca",
+      "rotation_epoch": "2026-01-01T00:00:00Z",
+      "policy_hash": "c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
+      "toolchain_provenance": "vendor-x-build-unknown"
+    }
+  },
+  "expected_output": {
+    "verdict": "REFUSE",
+    "reasons": ["crypto_posture_unknown_suite"],
+    "schema_version": "0.2.0"
+  }
+}

tests/fixtures/crypto_posture/vector_04_invalid_signature_refuse.json

@@ -0,0 +1,39 @@
+{
+  "_meta": {
+    "vector_id": "crypto_posture_04",
+    "description": "Invalid signature or wrong algorithm — algorithm mismatch triggers REFUSE",
+    "category": "invalid_signature_refuse",
+    "expected_verdict": "REFUSE",
+    "expected_reason_code": "crypto_posture_invalid_signature"
+  },
+  "input": {
+    "actor_id": "operator-delta",
+    "action_class": "sensitive_command",
+    "context": {
+      "mission_phase": "return",
+      "comms_mode": "LOS"
+    },
+    "authority_scope": {
+      "level": "tactical",
+      "delegation_chain": ["ground_authority", "vessel_commander", "watch_officer"]
+    },
+    "invariant_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "crypto_posture": {
+      "alg_suite": "ML-DSA-65",
+      "key_origin": "onboard_kms",
+      "rotation_epoch": "2026-03-01T00:00:00Z",
+      "policy_hash": "d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5",
+      "toolchain_provenance": "genesis-aix-build-2026.03.r1"
+    },
+    "signature_verification": {
+      "declared_alg": "ML-DSA-65",
+      "actual_alg_used": "Ed25519",
+      "verification_result": "FAIL"
+    }
+  },
+  "expected_output": {
+    "verdict": "REFUSE",
+    "reasons": ["crypto_posture_invalid_signature"],
+    "schema_version": "0.2.0"
+  }
+}