feat(red-team): govern generated attacks behind curate, review, and a new grant

[worldofhacks]

Tier 1 of generative red-teaming as a governed two-stage loop — stages 1–3.

Base, please read first

Branched from b0e641c (codex/integration-b34-reconcile-802), per the task's "reusing 0022's
governed path (PR #50, landing on b0e641c)". That branch is not published, so this PR shows
7 commits — 6 are your unpublished integration base and only 0678a7c is mine. Retarget
once b0e641c is pushed, or review 0678a7c alone. Nothing outside my 7 new files is touched.

What this closes

The 2026-07-25 coverage review recorded that hosted generation was implemented but structurally
undispatchable: the coordinator requires every proposal to equal the reviewed corpus
byte-for-byte, so a generated attempt falls outside the grant that authorized the run.

That check is correct and is not loosened here. An authorization is content-addressed over the
exact corpus hash, so a generated case is by construction outside every prior grant. The missing
piece was a governed way to mint a new corpus identity and take a new grant.

The invariant

Every generated attack passes curate → human review → new corpus hash → new authorization
before it touches the target.

Stage	Module	State
1 curate	agents/red_team/curation.py	implemented, 16 tests
2 human review gate	agents/red_team/review_gate.py	implemented, 16 tests
3 new hash + fresh authorization	campaign/generated_profile.py	implemented, 16 tests
4 dispatch	—	not wired — stacks on 0022
5 evaluate (oracle/canary Judge)	existing	unchanged, not reached

The generator (generate_traced, qwen, target_scope:none) is unmodified and still never
touches a target.

Two things worth your attention

The generator authors input_sequence and nothing else. oracle_expectation is forced to
kind: "none", and severity / exploitability / ground_truth_refs are neutralized rather
than inherited from the governed template. This is not cosmetic: a generated case inheriting the
template's synthetic_canary_match oracle would assert a deterministic canary hit its own turns may
never trip, and would still pass schema validation. ground_truth_refs is deliberately
non-resolving, so writing a generated case into the authored corpus fails the corpus validator's
bidirectional case↔label check until a human authors its label.

Minimization is structural only, and skipped for denial_of_service — collapsing repeats in a
token-exhaustion attack would destroy it while reporting success. Semantic (delta-debugging)
minimization needs target feedback, so it belongs to Tier 2.

Honest limits

• Stage 4 is not wired. prepare_generated_dispatch() runs every gate and stops, rather than
  no-op'ing — a silent no-op would look exactly like a successful dispatch.
• Tier 2 (multi-round feedback loop) is NEXT, not done. Verdicts do not yet steer the next round.
• No live run, no verdict, no confirmed exploit is claimed from any generated case.

Coordination

• No migration. Stages 1–3 are pure and content-addressed, following the existing
  tool_profile.py / corpus.py precedent — no revision number to reconcile with A.
• No re-export from agents/red_team/__init__.py — campaign already depends on
  agents.red_team; re-exporting would invert the layering.
• Review records use the exact provenance shape load_live_100_corpus already validates
  (source_kind: hosted_red_team), rather than a second notion of "approved".

Gates

ruff check .            All checks passed          (ruff 0.16.0 — CI's resolved version, not local 0.15.x)
ruff format --check .   714 files already formatted
pytest tests/           1901 passed, 3 skipped
new suites              48 passed
scripts/secret_scan.sh  clean (926 files)

Pushed identically to GitHub and GitLab at 0678a7c.

🤖 Generated with Claude Code