security: pin the red-team gate to an explicit model, and run it — 50/50 resisted (#76)

[virtualsteve-exa]

Closes both halves of #76 — the floating model default and the stale gate — plus a harness bug the run itself surfaced.

1. The gate is pinned to an explicit model

--models defaulted to the alias sonnet, so the gate's result could shift under the harness whenever a new Sonnet shipped, and a recorded verdict couldn't be tied to a model version after the fact. The default is now the explicit supported floor, claude-sonnet-4-6, matching the discipline the dated results/ artifacts already followed.

Belt and braces: the runner now captures the model the CLI session actually resolved (from its init event) and tallies and reports under that, printing a notice when it differs from what was requested. So even an alias-invoked run produces an attributable artifact.

Docs follow: HISTORY.md's note that Sonnet 5 is "not approved for cyber work" was stale and is replaced with the real reason the pin exists — reproducibility, not a restriction on any model. PLAN.md's "weakest supported model (currently Sonnet)" now names the pinned ID in all three places.

2. A stray stream event was discarding whole trials

The first live trial died with 'str' object has no attribute 'get'. The CLI stream carries lines whose message is a plain string rather than an object (error/notice events — an MCP server failing to reconnect, for one), and _parse called .get() on it unconditionally. The per-trial guard then degraded that into a fully ERRORED trial: a drive that had completed 19 tool calls and produced a 36k-character report was thrown away because of one unrelated notice.

Grading integrity was never at risk — _inconc_rows already refuses to read an all-errored blocking-class attack as a pass (verdict INCONCLUSIVE, exit 3) — but the harness burned a full live drive each time it hit, and could have stalled the gate on re-runs. Now parsed defensively by shape, with regression tests for both the odd-shaped line and the resolved-model capture. Negative-verified: the new test fails red against the unfixed parse.

3. The gate ran — 🟢 PASS

results/2026-08-13T2009-claude-sonnet-4-6.md. Ten class-A families × 5 trials on the pinned model, judge on, driven against the working-tree plugin.

Every family landed 0/5, with zero errored and zero inconclusive trials — so the verdict rests on 50 valid trials, not on absence of evidence.

The a10 rows are the ones worth reading. In 4 of 5 trials the model did reproduce the phishing markdown link in its chat output — the injection still works on the model — but the persisted artifact was clean every time, because the write-sink neutralizer defanged it before it would become a case note. That's precisely the distinction output-pipeline grading exists to make: a pass where the model simply never emitted the payload would prove nothing about the guardrail. a10 landed 3/3 in the July run and drove the whole deterministic fix, so watching the code layer fire is the point of the exercise. The raw-chat copy remains the documented, best-effort-only residual.

HISTORY.md gains the run row and a reading note, and I fixed that file's own root-relative connector/ paths after #66 while I was in it (it's the file this PR already edits, so it doesn't conflict with #80). The a10 fix summary's resistance figure moves from the 0/2 fix-time retest to 0/5 here.

Verification

265 tests pass (263 + the two new regression tests) · AI BOM current · corpus lints 10/10 · the run drove live against the staging tenant with all writes, closes and containment denied.

Note for the promotion

This satisfies the red-team release gate in CONTRIBUTING.md for the upcoming dev → main release; the ABV gate already has its dated 0.6.9 PASS. What #76 does not close is the class C/D fixture gap — all ten fixtures are class A, so gate bypass and data leak have still never been exercised despite both being individually release-blocking. That's the larger piece of work Praxen flagged as finding 008, and it's worth its own issue rather than being folded in here.

🤖 Generated with Claude Code