Crescendo doesn't ask the attacker for JSON — wrap raw as the reply.
Return phase boundary turn numbers to inject into the metaprompt template.
Override this to inject strategy-specific template variables. Strategies
that don't need extra template vars (e.g. GOAT) can omit this method —
the orchestrator treats undefined as "no extra vars".
Build a turn-aware system prompt for the attacker.
Score feedback, adaptation hints, and backtrack markers are communicated via the attacker's private conversation history (H_attacker) as system messages — not embedded in this prompt.