After reading this answer by someone knowledgeable in the field, I realized that I still don't understand even a little bit what International Traffic in Arms Regulations (ITAR) (and its cousins) does and doesn't say what various people can or can't do, and so far I haven't found the ITAR-tl;dr.
edit: I'm getting rid of the hypothetical scenario and adjusting the question to make sure it doesn't read like a request for legal advice.
I've given myself an exercise - launch to orbit in 20 lines of python. It's along the lines of A Neural Network in 11 lines of Python; Part 1 and Part 2. (Part 2 is 13 lines, a clear case of mission creep.)
This is purely a deterministic model. ISP is constant or a simple function, thrust is on or off, Earth's atmosphere rotates as a rigid body, drag coefficient is brontosaurus shaped when plotted vs Mach number, atmosphere is isothermal with scale height behavior, etc. You launch thousands of times and use gradient descent to eventually find an orbit. Only SciPy and NumPy are allowed. I think fifty lines is realistic and probably straightforward, but it could be shorter if made ugly and/or opaque.
Now, if I allow for realistic wind, or engine fluctuations, or mechanical noise in my thrust vectoring, or turbulence, or other things, then I need to add some simulated measurements (e.g. simulated inertial sensors or GPS) and then feedback, and also raise my limit to a few hundred lines of python and/or import other python packages within the Anaconda distribution.
I am wondering if is there any way to tell when a US citizen sitting with their laptop in the US might be starting to cross into potential ITAR territory? Is it when feedback is introduced? Or when Kalman filtering is added? Or is it only when it gets out of the laptop and on to the internet?
I am not asking for nor do I want a legal opinion. But are there any guidelines, rules of thumb, articles in space related magazines, blogs... anything where one could get some kind of gist of where the gray zone begins to darken noticeably?
I see a lot of cautions and warnings peppered in SXSE, but they mostly seemed nuanced for those who should already know but a reminder now an then can't hurt. In this case I'm asking from a responsible noob's point of view.