Harden TemplateOnlyBuilder difficulty bounds

- Clamp malformed min/max vulns to safe bounds

- Preserve at least one selected vulnerability

- Add regression coverage for non-schema difficulty envelopes

src/open_range/builder/builder.py

@@ -963,9 +963,14 @@ class TemplateOnlyBuilder:
         avg_extra = 4
         tier_max_vulns = max(1, 1 + (max_steps_hi - avg_first) // avg_extra)
 
-        max_vulns = manifest.get("difficulty", {}).get("max_vulns", 2)
-        min_vulns = manifest.get("difficulty", {}).get("min_vulns", 1)
-        effective_max = min(max_vulns, tier_max_vulns, len(candidates))
+        max_v_raw = manifest.get("difficulty", {}).get("max_vulns", 2)
+        min_v_raw = manifest.get("difficulty", {}).get("min_vulns", 1)
+        max_vulns = max(1, int(max_v_raw))
+        min_vulns = max(1, int(min_v_raw))
+        if min_vulns > max_vulns:
+            min_vulns = max_vulns
+
+        effective_max = max(1, min(max_vulns, tier_max_vulns, len(candidates)))
         effective_min = min(min_vulns, effective_max)
         count = rng.randint(effective_min, effective_max)
         chosen = rng.sample(candidates, count)

tests/test_builder.py

@@ -82,6 +82,22 @@ async def test_template_builder_clamps_min_vulns_to_candidate_pool(tier1_manifes
     assert all(v.type == "sqli" for v in spec.truth_graph.vulns)
 
 
+@pytest.mark.asyncio
+async def test_template_builder_handles_non_schema_difficulty_bounds(tier1_manifest):
+    from open_range.builder.builder import TemplateOnlyBuilder
+
+    builder = TemplateOnlyBuilder()
+    manifest = {
+        **tier1_manifest,
+        "bug_families": ["sqli"],
+        "difficulty": {**tier1_manifest.get("difficulty", {}), "min_vulns": -2, "max_vulns": 0},
+    }
+
+    spec = await builder.build(manifest, BuildContext(seed=9, tier=1))
+    assert len(spec.truth_graph.vulns) == 1
+    assert spec.truth_graph.vulns[0].type == "sqli"
+
+
 @pytest.mark.asyncio
 async def test_template_builder_avoids_previous_vulns(tier1_manifest):
     from open_range.builder.builder import TemplateOnlyBuilder