fix: drop temperature for models that reject it — inbound security screening was fail-open

[Weegy]

The loud symptom

The adversarial eval crashed on its first real run (it had never executed before, because ANTHROPIC_API_KEY was only just set):

BadRequestError: 400 `temperature` is deprecated for this model.
  at Object.vote (middleware/test/adversarial/adversarialModel.ts:330)

The quiet one

LlmScreener.screen() sends temperature: 0 on every inbound turn:

// securityScreener.ts:218
const req: LlmRequest = { model: this.#model, …, temperature: 0 };

Its caller turns any exception into unscreenable — an explicit, documented fail-open (securityScreener.ts:92: "the screener was unavailable/errored/timed out: fail open"). And the screener is constructed with the agent's own model:

// buildOrchestrator.ts:329
new LlmScreener({ provider: deps.provider, model: config.model })

whose default is DEFAULT_ORCHESTRATOR_MODEL = 'claude-opus-4-8' — a model that rejects temperature: 0.

So on the repo's own default configuration, #579's inbound security screening returned unscreenable for every payload, and reported no error while doing it. Same failure shape as the permanently-green golden-eval guard-skip, but on a security control.

Five further production call sites pass temperature: 0 through the same adapter: the plan-runner's materializer, replanner (×2), gate and gc.

Why the gate is a measured table, not a version comparison

Measured against the live API on 2026-08-19:

model	omitted	0	0.5	1
claude-opus-4-6	OK	OK	OK	OK
claude-opus-4-7	OK	400	400	OK
claude-opus-4-8	OK	400	400	OK
claude-opus-5	OK	400	400	OK
claude-sonnet-4-6	OK	OK	OK	OK
claude-sonnet-5	OK	400	400	OK
claude-haiku-4-5	OK	OK	OK	OK

Two things this table says that a guess would get wrong:

1. opus-4-6 accepts the parameter and opus-4-7 rejects it. "Newer than X" is a plausible and wrong rule; so is "the Claude 5 family". Only an explicit list is defensible, so the table lives in the source next to the list.
2. temperature: 1 is always accepted, because it is the default — the API only objects to being asked for a value it no longer honours. That is why the eval's attacker step (temperature 1, on claude-opus-4-8) survived and only the juror (temperature 0) raised. Without this, the stack trace points at the juror and invites the wrong conclusion.

The fix

buildParams in llm-adapter-anthropic omits temperature when the model does not honour it. The adapter is the layer that owns the wire contract, so one change covers all seven call sites, including createLlmProviderFromNeutral (the legacy v1 wrapper), which delegates through the same neutral provider rather than building its own params.

supportsTemperature(model) is exported so a caller can tell in advance that its determinism request will be dropped. On the affected models there is no way to obtain temperature: 0 at all, so dropping it is the only available behaviour — and strictly better than raising into a fail-open catch.

Not fallout from #730

Worth stating plainly, because the stack trace suggests otherwise: the juror ran on claude-opus-4-8 at temperature: 0 before #730's juror-model knob and would have raised the identical 400. The knob changed which model name appears in the error, nothing else.

Verification

• npm test — 6841 tests, 0 fail, 0 cancelled (baseline 6839 + the two added here)
• tsc --noEmit clean; npm run lint clean
• Mutation check, rebuilding dist/ between runs because the test resolves the package through it — forcing the gate to always-true and to always-false each turns exactly one of the two new tests red. (The first attempt without a rebuild killed neither mutant and looked green; noted here because it is the standing trap in this repo.)

The second test guards the other direction: a gate that dropped temperature everywhere would satisfy the first test while silently removing determinism from the models that still support it.

Follow-up worth its own issue

The screener's fail-open is correct as a policy but has no signal attached: a screener that errors on 100% of calls looks identical to one that is merely occasionally unavailable. A counter or a log on repeated unscreenable verdicts would have surfaced this in a day.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}