[codex] add complex synthetic benchmark fixture

tests/fixtures/demo/complex_shared_uncertainty_iam_benchmark/README.md

@@ -0,0 +1,53 @@
+# Complex Shared Uncertainty IAM Benchmark Fixture
+
+Fixture id: `complex_shared_uncertainty_iam_benchmark_001`
+
+This is a local-only synthetic fixture and frozen synthetic oracle for a future
+IAMScope demo/benchmark slice. It uses only synthetic account `000000000000`
+and does not contain live AWS evidence.
+
+## Fixture Files
+
+- `scenario.json`
+- `binding_metadata.json`
+- `findings.json`
+- `naive_candidates.json`
+- `expected_uncertainty_groups.json`
+
+## Oracle Counts
+
+- naive candidate rows: `42`
+- findings/verdict rows: `18`
+- `validated`: `4`
+- `blocked`: `5`
+- `precondition_only`: `3`
+- `inconclusive`: `6`
+
+## Shared Uncertainty Groups
+
+- `shared_passrole_target_resource_scope_unknown`: `3`
+- `shared_cross_account_trust_condition_unknown`: `2`
+- `shared_boundary_or_session_policy_context_missing`: `1`
+
+## Boundary
+
+The fixture is manually authored as `frozen_synthetic_oracle` with
+`source_tool: static_fixture_authoring`. It was not generated or replayed by
+IAMScope reasoners, makes `0` AWS calls, and uses no live AWS.
+
+## Non-Claims
+
+- no live AWS
+- no broad IAMScope correctness
+- no broad PassRole correctness
+- no generic Deny correctness
+- no resource-policy Deny support
+- no SCP Deny support beyond selected synthetic fixture behavior
+- no exploitability proof
+- no downstream authorization proof
+- no Lambda invocation behavior
+- no production readiness
+- no correctness for real AWS environments
+- no correctness for other principals, roles, accounts, regions, conditions, permission boundaries, SCPs, resource policies, or findings
+- no composite benchmark score
+- no pass/fail benchmark label

tests/fixtures/demo/complex_shared_uncertainty_iam_benchmark/binding_metadata.json

@@ -0,0 +1,49 @@
+{
+  "aws_calls_made": 0,
+  "findings_generation": {
+    "fixture_oracle_counts": {
+      "finding_count": 18,
+      "naive_candidate_count": 42,
+      "uncertainty_group_counts": {
+        "shared_boundary_or_session_policy_context_missing": 1,
+        "shared_cross_account_trust_condition_unknown": 2,
+        "shared_passrole_target_resource_scope_unknown": 3
+      },
+      "verdict_breakdown": {
+        "blocked": 5,
+        "inconclusive": 6,
+        "precondition_only": 3,
+        "validated": 4
+      }
+    },
+    "generated_or_replayed_by_iamscope": false,
+    "mode": "frozen_synthetic_oracle",
+    "reasoners_run": [],
+    "replay_equivalence_status": "not_claimed",
+    "source_tool": "static_fixture_authoring",
+    "stronger_demo_claims_allowed": false
+  },
+  "fixture_id": "complex_shared_uncertainty_iam_benchmark_001",
+  "generated_or_replayed_by_iamscope": false,
+  "generation_mode": "frozen_synthetic_oracle",
+  "live_aws_used": false,
+  "non_claims": {
+    "no_broad_iamscope_correctness": true,
+    "no_broad_passrole_correctness": true,
+    "no_composite_benchmark_score": true,
+    "no_correctness_for_other_principals_roles_accounts_regions_conditions_boundaries_scps_resource_policies_or_findings": true,
+    "no_correctness_for_real_aws_environments": true,
+    "no_downstream_authorization_proof": true,
+    "no_exploitability_proof": true,
+    "no_generic_deny_correctness": true,
+    "no_lambda_invocation_behavior": true,
+    "no_live_aws": true,
+    "no_pass_fail_benchmark_label": true,
+    "no_production_readiness": true,
+    "no_resource_policy_deny_support": true,
+    "no_scp_deny_support_beyond_selected_synthetic_fixture_behavior": true
+  },
+  "reasoners_run": [],
+  "schema_version": "complex_synthetic_benchmark_binding_metadata.v1",
+  "source_tool": "static_fixture_authoring"
+}

tests/fixtures/demo/complex_shared_uncertainty_iam_benchmark/expected_uncertainty_groups.json

@@ -0,0 +1,52 @@
+{
+  "fixture_id": "complex_shared_uncertainty_iam_benchmark_001",
+  "generation_mode": "frozen_synthetic_oracle",
+  "groups": [
+    {
+      "count": 3,
+      "finding_ids": [
+        "complex-finding-013",
+        "complex-finding-014",
+        "complex-finding-015"
+      ],
+      "reviewer_action": "Resolve target-role resource-scope coverage before treating these rows as independent validated risks.",
+      "uncertainty_class": "shared_passrole_target_resource_scope_unknown"
+    },
+    {
+      "count": 2,
+      "finding_ids": [
+        "complex-finding-016",
+        "complex-finding-017"
+      ],
+      "reviewer_action": "Resolve synthetic cross-account trust-condition context before promoting these rows.",
+      "uncertainty_class": "shared_cross_account_trust_condition_unknown"
+    },
+    {
+      "count": 1,
+      "finding_ids": [
+        "complex-finding-018"
+      ],
+      "reviewer_action": "Resolve boundary or session-policy context before treating this row as validated.",
+      "uncertainty_class": "shared_boundary_or_session_policy_context_missing"
+    }
+  ],
+  "non_claims": {
+    "no_broad_iamscope_correctness": true,
+    "no_broad_passrole_correctness": true,
+    "no_composite_benchmark_score": true,
+    "no_correctness_for_other_principals_roles_accounts_regions_conditions_boundaries_scps_resource_policies_or_findings": true,
+    "no_correctness_for_real_aws_environments": true,
+    "no_downstream_authorization_proof": true,
+    "no_exploitability_proof": true,
+    "no_generic_deny_correctness": true,
+    "no_lambda_invocation_behavior": true,
+    "no_live_aws": true,
+    "no_pass_fail_benchmark_label": true,
+    "no_production_readiness": true,
+    "no_resource_policy_deny_support": true,
+    "no_scp_deny_support_beyond_selected_synthetic_fixture_behavior": true
+  },
+  "report_only": true,
+  "schema_version": "complex_synthetic_benchmark_uncertainty_groups.v1",
+  "source_tool": "static_fixture_authoring"
+}