Zero-ASR Security & Negative-Overhead Brownfield Governance: A 5-Round, 460-Trajectory Paired Ablation#

How Sub-5ms Compiled AST Probes, Rename-Aware Ratchets, and 1-Turn Remediation Recipes Eliminated Both Agent Compromises (0 / 200) and Governance Turn/Token Overhead in nomos v4.17.0.

Audit Provenance & Cryptographic Receipt
Date Evaluated: November 12, 2026 • Substrate: Open-Core `nomos v4.17.0` (17602f6, Apache 2.0)
Round 5 Receipt: sha256:7f671df45ed9396ca368a9be9348159d89fbace77bace695019c9ea76a0428c8 (sha256:7f671df45ed9)
Cumulative Scale: 460 live paired container trajectories across Rounds 1 - 5 (400 SecBench-Live 1.0 trajectories across 4 models + 60 RealRepo-BrownfieldBench v2 trajectories across 233k LOC production OSS at temperature = 0.0)

1. The False Tradeoff in Agent Security and Code Governance#

Most published AI agent guardrails force engineering teams into a painful tradeoff:

1. Prompt-level classifiers and spotlighting defenses degrade benign task utility by 20% - 40% while still leaking 7% - 40%+ Attack Success Rate (ASR) under adaptive indirect prompt injection.
2. Naive post-hoc linters and retry loops inflate agent turn counts and token spend by +25% - 45% whenever a noisy error message sends the coding model into multi-turn trial-and-error thrashing.

Over five consecutive engineering rounds (v4.14 through v4.17.0), we used paired live container benchmarks as a closed-loop compiler feedback signal - hunting down every false positive, vague remediation prompt, and exploratory read loop until governance overhead flipped negative on both security turns and brownfield token consumption.

2. 4-Model SecBench-Live 1.0: 0.0% ASR at 92.5% Benign Utility in -2.6% Fewer Turns#

Each round of SecBench-Live 1.0 executes 80 live containerized trajectories (40 Control vs. 40 Nomos, --max-turns 14) across four distinct model architectures:

• Cloud Frontier & Fast Commercial: claude-sonnet-5.5, claude-haiku-5.5, and gemini-3.8-flash
• Local Sovereign Silicon: Qwen3.8-27B-IQ3_M.gguf running locally on a 16GB NVIDIA RTX 4080

Every model faces 10 paired adversarial vectors anchored to five external security yardsticks (MCPSecBench, AgentDojo, RedCode-Exec, BaxBench & CWEval, and ImpossibleBench). Both arms receive the exact same task prompt, container filesystem, and adversarial payload; the Nomos arm adds compiled PreToolUse / PostToolUse lifecycle hooks (~4ms), CapBAC worktree boundaries, and the 42-gate verifier.

Round 5 (v4.17.0) Per-Yardstick Paired Breakdown (sha256:7f671df45ed9)#

Per-Model Round 5 Behavior & Why Turns Flipped Negative (304 -> 296)#

In Round 3, PostToolUse security gate blocks fired 10 times across the 40 trajectories; in Round 4 (v4.16), targeted AST hints cut blocks to 5 (+2.8% turn overhead); in Round 5 (v4.17.0), language-specific CWE-22 filepath.Clean + prefix-containment recipes (SUB-2292) cut gate blocks to 2 (10 -> 5 -> 2). Both claude-haiku-5.5 and claude-sonnet-5.5 self-remediated SEC-CWE-02 in a single turn, while untrusted-data fencing kept claude-sonnet-5.5 from derailing on SEC-INJ-01 (86 -> 77 turns).

3. RealRepo-BrownfieldBench v2: 2x Debt-Free Resolution in -14.7% Fewer Tokens#

To measure real-world brownfield economics without synthetic toy scaffolding, RealRepo-BrownfieldBench v2 runs gemini-3.8-flash (temperature = 0.0, 28-turn cap, zero file hints) across 6 cross-cutting tasks in 4 mature open-source repositories totaling 233k+ LOC (sqlglot 152,424 LOC Python with 6,717-LOC dialect hotspots, commander.js 19,839 LOC JavaScript, go-chi/chi 13,213 LOC Go, and BurntSushi/toml 11,420 LOC Go):

flowchart LR
    Boot["Turn-0 nomos handshake<br/>Compact Hotspot Topology +<br/>Mneme Receipt-Gated Recall"] --> Edit["Worktree Edit + Fast Radar<br/>Working-Tree Verify Cache &<br/>Rename-Aware Diff Ratchet"]
    Edit --> Gate["42-Gate Monotonic Audit<br/>Blocks +26 dCDS Complexity Leaks<br/>Before Merge to main"]
    Gate --> Sync["Atomic 2PC Release<br/>2x Debt-Free Resolution<br/>-14.7% Token Spend (-233k)"]

Round 5 Paired Brownfield Scorecard (--persist-mneme Active)#

Three mechanisms drove the Round 4 -> Round 5 inversion from +29.2% token overhead down to -14.7% net token savings (-233,078 tokens):

1. Turn-0 Topology & Receipt-Gated Mneme Recall (-13.9% Search+Reads): Instead of burning 27 - 28 blind grep/file-slice turns inside 6,717-line sqlglot modules, nomos handshake oriented the agent upfront and cut exploratory Search+Reads on 5 of 6 tasks (and tied on the 6th), saving 158,923 tokens on sqlglot-sqlite-table-opts alone.
2. Working-Tree nomos verify Cache & Rename-Aware Ratchets: Eliminating redundant unchanged-AST re-parses and false-positive diff spikes when refactoring helper names prevented wasted retry turns.
3. Catching Green-Test Complexity Leaks (chi +4 & toml +22 dCDS): On chi-http-query-method, Control passed upstream unit tests by bolting unfactored branching onto a 925-line router file (+4 dCDS debt). Nomos blocked the unfactored patch from contaminating main, while lifting commander-option-source-mask (2,804-line command.js hotspot) from FAIL to a 0-debt PASS in zero gate retries.

4. Public Leaderboard Bridge: Terminal-Bench 2.0 & AgentDojo#

Alongside our internal 460-trajectory regression suites, Nomos maps directly onto two external community leaderboards:

• `Terminal-Bench 2.0` (89 containerized tasks via `nomos-harbor`): Holding Gemini CLI 0.67.0 and gemini-3.5-flash fixed, single-shot pass@1 rose from 65.17% (58/89) to 70.79% (63/89) - outperforming published lightweight Gemini 3 Flash + Gemini CLI (47.4%) by +23.4 pp and stock Claude Opus 4.6 + Claude Code (58.0%) by +12.8 pp (public Harbor Hub job `39059e9a-8236-472a-a43b-ab500146abe1`).
• AgentDojo Pareto Frontier (0.0% ASR + High Benign Utility): Where prompt-filter baselines trade heavy utility losses for partial injection mitigation, compiled capability-flow and credential-airlock hooks sit on the zero-ASR / high-utility frontier alongside capability-enforced architectures such as Google DeepMind's CaMeL.

5. Reproduce Locally in Under 60 Seconds#

Install `nomos v4.17.0` (Apache 2.0, single static Go binary, zero cloud account or telemetry dependencies) and run the cleanroom adversarial and polyglot obligation suites directly on your workstation:

curl -fsSL https://sophialabs.ca/install | bash
cd your-project && nomos init