# codex gpt-5.5 LOW closes the flaky 2/3 tail at k=1

2026-06-27. The 7 cells the Anthropic baseline catches only **2/3** at k=1 (the "can't make up its mind" tail,
`docs/validation/2026-06-18-baseline-generalization-recall.md` FLAKINESS-AUDIT). Test: does gpt-5.5-LOW catch them on a
SINGLE roll? If yes, consistency is a MODEL trait, not a k-budget artifact.

Rig: `SG_LLM_BACKEND=codex gate.py <cell>/vuln.ts --neutral-path --depth 0 --k 1 --model gpt-5.5 --effort low --no-workspace-alias`.
Blind (neutral path). Driver: `scratchpad/sweep_codex_low.py`. Hand-judged (auto-score unreliable — see below).

## Result — 7/7 CAUGHT at k=1
| cell | baseline k=1 | gpt-5.5-low k=1 | canonical-matching finding |
|---|---|---|---|
| S1-reset-token-reuse | 2/3 | CATCH | "Reset tokens are reusable until expiry" |
| S2-role-privilege-escalation | 2/3 | CATCH | "Role managers can grant arbitrary permissions" |
| S2-team-owner-invariant | 2/3 | CATCH | "Role-change endpoint can modify protected principals without checking target role" |
| S3-session-tenant-isolation-idor | 2/3 | CATCH | "Session activity update is not tenant or user scoped" (= touchSession unscoped) |
| S3-task-assignee-membership-idor | 2/3 | CATCH | "Assignee ownership is never validated on task creation" |
| S3-task-assignee-membership-zyncapi | 2/3 | CATCH | "Assignee target is not tenant/member validated before update" |
| S5-email-html-injection | 2/3 | CATCH | "Raw template interpolation allows HTML/attribute injection" |

## gpt-5.4 (half price) on the same tail — 6/7, one HARD miss
Same rig, `--model gpt-5.4 --effort low --k 1`, hand-judged:
| cell | gpt-5.4-low k=1 | note |
|---|---|---|
| S1-reset-token-reuse | CATCH | "token is replayable — no single-use/consumed-state check" |
| S2-role-privilege-escalation | **MISS** | found tenant/actor/id bugs, NOT the perms-beyond-actor ceiling |
| S2-team-owner-invariant | CATCH | "does not reserve the owner role or protect owner membership" |
| S3-session-tenant-isolation-idor | CATCH | "`touchSession` allows cross-tenant mutation by bare session ID" |
| S3-task-assignee-membership-idor | CATCH | "Unverified cross-tenant assignee assignment on create" |
| S3-task-assignee-membership-zyncapi | CATCH | "Assignee changes trust an arbitrary user ID... outside the tenant" |
| S5-email-html-injection | CATCH | "Raw variable interpolation injects attacker-controlled HTML" |

### The S2-role miss does NOT recover under effort escalation
Per the low→med→high ladder, escalated the single failing cell. gpt-5.4 MISSED the canonical at **low, med AND high** (0/3
across efforts) — each roll found adjacent issues (cross-tenant reassignment, OLA cross-file dep, id validation, and at HIGH
an unbounded-permissions-array DoS) but none named "a role-manager can grant permissions BEYOND the actor's own set." gpt-5.5-low
caught it 1/1. **Effort is not the lever — model is.** The correct escalation for a 5.4 miss is a MODEL bump (5.4→5.5), not an
effort bump. Same lesson as C02. (Each effort is n=1; but 0/3 across independent rolls is a real blind spot, not roll noise.)

## Verdict
gpt-5.5-LOW catches the entire flaky tail on a single roll, where the Anthropic baseline drops ~1 roll in 3. gpt-5.4-LOW catches
6/7 at half price — strong, but has one model-level blind spot (RBAC permission-ceiling) that no effort closes. Combined with
C02 (low=high 3/3, the oracle-only cell): **the lever is model choice, not reasoning budget and not k-rolls.** gpt-5.5 is
single-roll-consistent on exactly the cells that made the Anthropic leg need k=3 to reach union recall. This is the strongest
case yet for swapping the LLM leg to gpt-5.5 — same or better catch at LOWER effort AND lower k.

## Caveats
- k=1 per cell (n=1) — a single roll catching is strong but not a RATE. Direction is clean (7/7 vs a 2/3 baseline) but a
  k≥3 gpt-5.5-low pass would tighten the per-cell reliability number. Owner deferred that to conserve quota.
- Auto-score (verdict.py) returned 3 MISS + 4 PUNT — ALL false negatives of the scorer, not the model: function-name
  canonical_symbols (`touchSession`, `assignee_id`) don't substring-match a semantic description, and phrase symbols punt by
  design. Hand-judge is authoritative here (same discipline as the sonnet baseline, which also hand-judges these). The scorer
  gap is a known [[single-file-cell-path-leak]] sibling, not evidence against the catch.
- No Anthropic control re-run ([[no-anthropic-control-runs]]); baseline is the recorded 2/3 from the generalization doc.