The model isn't the problem — the system is

The model below is honest: asked bluntly for harm, it refuses. But the scaffold around it misrepresents the world so the task looks benign (not a jailbreak — no adversarial tokens, just a false framing), then repurposes the model's correct, well-intended answer into the harm it refused to do directly. Toggle the framing and watch a model-only evaluation pass while the composite system does damage.