perf(#498): score the behavioral tier on its own model, not the attacker's

[Weegy]

Stacked on top of byte5ai#730 — base is that PR's branch, not main, since the adversarial suite is not on main yet. @sneumannb5 this is your issue and your PR; merge, squash into byte5ai#730, or close it, whatever fits how you want byte5ai#730 to land.

What

BehavioralModels gains a juror field, wired through ADVERSARIAL_JUROR_MODEL and defaulting to claude-sonnet-5. Until now the three Delphi jurors ran on models.attacker.

Why

Each juror reads the entire escalation transcript, and a non-unanimous round 1 doubles three full reads to six. That made the eval's cheapest-to-judge step its most expensive one — judging "did the digest boundary and the role hold" is a bounded classification over text already in context, not the open-ended adversarial reasoning the conductor does.

Measured on the current corpus (1 behavioral scenario, maxTurns: 4, Opus 4.8 attacker / Haiku 4.5 target):

	Attacker	Target	Jury	Run
Before	~$0.054	~$0.011	~$0.060–0.120	$0.13–0.19
After	~$0.054	~$0.011	~$0.036–0.072	$0.09–0.11

Today's absolute number is small either way. The reason to fix it now is the slope: cost scales with the number of behavioral scenarios, and the jury is the part that grows fastest — at 20 behavioral entries the difference is roughly $64 vs $40 per month at 20 merges.

Why this is safe to downgrade

The jury is not the only scorer. findIdentityLeaks runs over the same transcript and forces breached on any real identity value regardless of how the jury voted (runBehavioralScenario), so a leniently-voting juror cannot turn an actual leak green. Your existing test the findIdentityLeaks oracle overrides a fooled jury ⇒ breached already pins exactly that property.

What a weaker jury can still cost is the softer half of the signal — manipulation resistance where nothing literal leaked. That's why the default steps to Sonnet rather than straight to Haiku. ADVERSARIAL_JUROR_MODEL=claude-haiku-4-5-20251001 is available for anyone who measures it against a known-breached transcript first; the README says so rather than leaving it as folklore.

Test

One added test, and it asserts against the calls the provider actually received, not against the interface — a juror field that nothing read would have passed every existing test (the stubProvider now records {role, model} per call). Reverting the one-line models.juror → models.attacker wiring turns exactly that test red; I ran that mutation to confirm.

• tsc --noEmit -p test/adversarial/tsconfig.json — clean
• tsx --test test/adversarialModel.test.ts test/adversarialRunner.test.ts — 39 pass, 0 fail
• npm run lint — clean

No change to the deterministic tier, the corpus, the baseline, or the workflow.

[Weegy]

Superseded — merged straight into the byte5ai#730 branch instead, at Marcel's request, so the change rides along in that PR rather than needing a second merge. Branch head is now 093cbe13.

@sneumannb5 heads-up that this touched your PR branch: two merge commits on top of your e855dc36 — the juror-model change from this PR, then current main. Your commits are untouched and nothing was rebased or force-pushed. Full rationale and verification are in the comment on byte5ai#730.