humanish 0.106.1 → 0.107.0

package/dist/routes/shared-world/route.js

@@ -1,38 +1,39 @@
-// The CONCURRENT shared-world lab backend (#164 phase 2): N persona lanes drive ONE shared,
-// mutable service plane SIMULTANEOUSLY — the actual leverage of a sim. A recomposition of shipped
+// The concurrent shared-world lab backend (#164 phase 2): N persona participants drive one shared,
+// mutable service plane at the same time. A recomposition of shipped
 // pieces + the getHost wrapper:
 //
-//   - ONE SUBJECT sandbox: provisionCloneSubject ONCE (clone+install+build+seed) + serve on
+//   - One subject sandbox: provisionCloneSubject once (clone+install+build+seed) + serve on
 //     0.0.0.0, exposed via getHost(port) → a tokenless reachable URL (the headless service host;
 //     no GUI seat).
-//   - N ACTOR desktop sandboxes: fan-out's runCuaParticipant machinery (per-lane device/persona, by-id
+//   - N actor desktop sandboxes: fan-out's runCuaParticipant machinery (per-participant device/persona, by-id
 //     teardown) bounded by execution.concurrency, each browser pointed at the getHost URL —
-//     driving the shared service AT THE SAME TIME. INDEPENDENT (FIX-11): no pipeline gate, no
+//     driving the shared service at the same time. Independent: no pipeline gate, no
 //     fail-fast — one actor's failure must not block the swarm or corrupt the "M of N" outcomes.
 //   - A background prober snapshots the subject DB checkpoint digests on a cadence → a stateSeries
 //     of the shared world evolving under load.
-//   - ALL N+1 sandboxes torn down BY exact id in a finally — NEVER Sandbox.list.
+//   - All N+1 sandboxes torn down by exact id in a finally, never through Sandbox.list.
 //
-// HONEST ATTRIBUTION (verify-enforced, doctrine-audit fixes incorporated): the bundle declares
-// attributionClass: shared-world + a CONCURRENT humanish.shared-world.v1 block (topologyMode
-// "concurrent"; laneWindows + stateSeries + outcomes; NO timeline) whose attributionLimits drop
+// Attribution (enforced by verify): the bundle declares
+// attributionClass: shared-world + a concurrent humanish.shared-world.v1 block (topologyMode
+// "concurrent"; laneWindows + stateSeries + outcomes; no timeline) whose attributionLimits drop
 // `sequential-only`/`no-concurrent-races` and add `concurrent`,
 // `best-effort-causal-attribution`, `non-deterministic-shared-state`,
 // `window-and-snapshot-granularity`, `contention-observed-not-proven-safe`,
-// `state-change-not-isolated-to-actors`. laneWindows + stateSeries are INDEPENDENT series with NO
+// `state-change-not-isolated-to-actors`. laneWindows + stateSeries are independent series with no
 // per-delta→actor field — causation under concurrency is structurally inexpressible.
 //
-// CAPABILITY vs PROOF (FIX-1): the deterministic $0 gate proves the PLUMBING + the honesty
+// Capability and proof: the deterministic $0 gate proves the plumbing + the honesty
 // contract — the real mapWithConcurrency produces genuinely overlapping laneWindows (a rendezvous
-// latch in the fake session forces two lane fns in-flight while the REAL orchestrator clock
+// latch in the fake session forces two participant fns in-flight while the real orchestrator clock
 // measures the windows). Every generated bundle describes only its own observations; no one run
 // establishes scale, repeatability, or adopter-harness replacement.
 //
-// Synthetic-subject (FIX-3): a getHost URL is internet-reachable for the run, so this route is
-// synthetic-seeded-subjects ONLY. Verify fail-closes on subject.state.provenance != "seeded" and
+// Synthetic subject: a getHost URL is internet-reachable for the run, so this route is for
+// synthetic seeded subjects only. Verify fail-closes on subject.state.provenance != "seeded" and
 // requires the author attestation subject.exposure: synthetic. This is author-trust + a provenance
-// gate, NOT a no-real-data guarantee (humanish cannot tell synthetic from real data).
+// gate; humanish cannot tell synthetic from real data, so it makes no claim about real data.
 import path from "node:path";
+import { missingKeys, missingSubjectEnv } from "../../lab/requirements.js";
 import { completeAutomaticAnalysis } from "../../analysis/automatic-completion.js";
 import { resolveAutomaticAnalysis } from "../../analysis/automatic-config.js";
 import { scrubLiterals } from "../../evidence/redaction.js";
@@ -46,7 +47,8 @@ import { localAgentRefusal } from "../../actors/local-agent/readiness.js";
 import { runProvisionedPlane } from "./provisioned.js";
 import { concurrentLabFailure, finishConcurrentRun } from "./result.js";
 import { prepareConcurrentRun } from "./setup.js";
-import { sharedWorldInputWithScorer } from "../../lab/route-inputs.js";
+import { browserRouteScorer } from "../../lab/adapter-scorer-loader.js";
+import { withLateScorer } from "../../lab/route-inputs.js";
 import {} from "./types.js";
 import { rosterOf } from "../../lab/parse/actors.js";
 /** The shared-world code for each local-agent refusal, kind for kind with computer-use. */
@@ -62,12 +64,11 @@ const LOCAL_AGENT_REFUSAL_CODES = {
  * run and its analysis.
  */
 export async function runConcurrentSharedWorld(options) {
-    const { config, dryRun, lab, ...input } = options;
+    const { config, dryRun, ...input } = options;
     // planSharedWorldLab makes every configuration refusal, in the order this route always has.
     const planned = planSharedWorldLab(config, {
         dryRun,
-        ...(lab === undefined ? {} : { lab }),
-        hooks: input.hooks ?? {},
+        hasRunSession: input.deps?.runSession !== undefined,
     });
     if (planned.ok)
         return runSharedWorldPlan(planned.plan, input, config);
@@ -90,7 +91,7 @@ export function sharedWorldLabRefusal(options, refusal) {
     });
     // A refusal starts no run, so a declared or default analysis is recorded as skipped.
     const analysis = resolveAutomaticAnalysis(config.review?.analysis);
-    return completeAutomaticAnalysis(fail(refusal.code, refusal.message, refusal.actor), undefined, analysis.ok ? analysis.config : undefined, options.automaticAnalysis, { trigger: config.review?.analysis === undefined ? "default" : "explicit" });
+    return completeAutomaticAnalysis(fail(refusal.code, refusal.message, refusal.actor), undefined, analysis.ok ? analysis.config : undefined, options, { trigger: config.review?.analysis === undefined ? "default" : "explicit" });
 }
 /**
  * runLab's step for a shared-world plan. It runs a live plan's local checks (the keys, a local
@@ -103,11 +104,11 @@ export async function admitSharedWorldPlan(plan, input, config) {
         return { ok: false, outcome: sharedWorldOutcome(refused) };
     return {
         ok: true,
-        run: async (scorer) => sharedWorldOutcome(await runAdmittedSharedWorldRun(plan, sharedWorldInputWithScorer(input, scorer), config)),
+        run: async (scorer) => sharedWorldOutcome(await runAdmittedSharedWorldRun(plan, withLateScorer(input, scorer, browserRouteScorer), config)),
     };
 }
 function sharedWorldOutcome(result) {
-    return { route: "shared-world", backend: "concurrent-shared-world", result };
+    return { route: "shared-world", result };
 }
 /** Run a shared-world plan: its local checks, then the run. */
 export async function runSharedWorldPlan(plan, input, config) {
@@ -122,18 +123,13 @@ export async function runSharedWorldPlan(plan, input, config) {
 async function admitSharedWorldRun(plan, input) {
     if (plan.dryRun)
         return undefined;
-    const env = input.hooks?.env ?? process.env;
-    const subjectEnvNames = plan.plane.kind === "provisioned" ? plan.plane.subject.env : [];
+    const env = input.env ?? process.env;
     const fail = (code, message) => completeSharedWorldAnalysis(plan, input, sharedWorldFailure(plan, input)(code, message, sharedWorldDescriptorOf(plan.actor).id), undefined);
-    // OPENAI_API_KEY drives an openai brain's seats and the external-public plane's lobby-code
-    // reader; a local-agent brain's seats run on the operator's signed-in agent instead.
-    const openaiKeyNeeded = plan.brain.kind === "openai" || plan.plane.kind === "external-public";
-    const missingKeys = [
-        ...(env.OPENAI_API_KEY?.trim() || !openaiKeyNeeded ? [] : ["OPENAI_API_KEY"]),
-        ...(env.E2B_API_KEY?.trim() ? [] : ["E2B_API_KEY"]),
-    ];
-    if (missingKeys.length > 0) {
-        return fail("HUMANISH_CONCURRENT_SHARED_WORLD_LAB_KEYS_MISSING", `Live concurrent shared-world labs need ${missingKeys.join(" and ")} in the environment (values are never persisted). ${describeMissingKeys(missingKeys, env)}`);
+    // The plan lists OPENAI_API_KEY for an openai brain's seats and the external-public plane's
+    // lobby-code reader; a local-agent brain's seats run on the operator's signed-in agent instead.
+    const missing = missingKeys(plan.requirements, env);
+    if (missing.length > 0) {
+        return fail("HUMANISH_CONCURRENT_SHARED_WORLD_LAB_KEYS_MISSING", `Live concurrent shared-world labs need ${missing.join(" and ")} in the environment (values are never persisted). ${describeMissingKeys(missing, env)}`);
     }
     if (plan.brain.kind === "local-agent") {
         // A missing or signed-out agent found after the seats' desktops are paid for is the same
@@ -142,9 +138,9 @@ async function admitSharedWorldRun(plan, input) {
         if (refusal)
             return fail(LOCAL_AGENT_REFUSAL_CODES[refusal.kind], refusal.message);
     }
-    const missingSubjectEnv = subjectEnvNames.filter((name) => !env[name]?.trim());
-    if (missingSubjectEnv.length > 0) {
-        return fail("HUMANISH_CONCURRENT_SHARED_WORLD_LAB_SUBJECT_ENV_MISSING", `subject.env declares ${missingSubjectEnv.join(", ")} but the environment does not provide ${missingSubjectEnv.length === 1 ? "it" : "them"} (pass via --env-file; values are never persisted).`);
+    const unsetSubjectEnv = missingSubjectEnv(plan.requirements, env);
+    if (unsetSubjectEnv.length > 0) {
+        return fail("HUMANISH_CONCURRENT_SHARED_WORLD_LAB_SUBJECT_ENV_MISSING", `subject.env declares ${unsetSubjectEnv.join(", ")} but the environment does not provide ${unsetSubjectEnv.length === 1 ? "it" : "them"} (pass via --env-file; values are never persisted).`);
     }
     return undefined;
 }
@@ -160,7 +156,7 @@ function runAdmittedSharedWorldRun(plan, input, config) {
     });
 }
 function completeSharedWorldAnalysis(plan, input, result, finished) {
-    return completeAutomaticAnalysis(result, finished, plan.analysis?.config, input.automaticAnalysis, {
+    return completeAutomaticAnalysis(result, finished, plan.analysis?.config, input, {
         ...(plan.analysis === undefined ? {} : { trigger: plan.analysis.trigger }),
         preferLargerOutput: plan.analysis?.preferLargerOutput === true,
     });
@@ -180,8 +176,8 @@ function sharedWorldFailure(plan, input) {
 async function runPlanInScope(plan, input, config, scope) {
     const { dryRun } = plan;
     const requestedCwd = path.resolve(input.cwd);
-    const hooks = input.hooks ?? {};
-    const env = hooks.env ?? process.env;
+    const deps = input.deps ?? {};
+    const env = input.env ?? process.env;
     const fail = sharedWorldFailure(plan, input);
     const descriptor = sharedWorldDescriptorOf(plan.actor);
     const planeClass = plan.plane.kind === "external-public" ? "external-public" : "provisioned-getHost";
@@ -194,7 +190,7 @@ async function runPlanInScope(plan, input, config, scope) {
     const subjectRepo = plan.residual.subject.repos?.[0] ?? "";
     const subjectEnvNames = [...(subject?.env ?? [])];
     const checkpoints = [...(subject?.state.checkpoint ?? [])];
-    const runSession = hooks.runSession ?? descriptor.runSession;
+    const runSession = deps.runSession ?? descriptor.runSession;
     const openaiApiKey = env.OPENAI_API_KEY?.trim() ?? "";
     const e2bApiKey = env.E2B_API_KEY?.trim() ?? "";
     const knownSecretValues = [
@@ -212,7 +208,7 @@ async function runPlanInScope(plan, input, config, scope) {
         input,
         config,
         requestedCwd,
-        hooks,
+        deps,
         env,
         descriptor,
         planeClass,

package/dist/routes/shared-world/setup.d.ts

@@ -1,17 +1,18 @@
 import type { CuaActorDescriptor } from "../../actors/registry.js";
 import type { LabConfig, LabSubjectServe, LabSubjectStateCheckpoint } from "../../lab/types.js";
 import type { RunScope } from "../../run/run.js";
-import type { ConcurrentSharedWorldLabErrorCode, ConcurrentSharedWorldLabResult, ConcurrentSharedWorldPlaneClass, FinishFacts, LiveParticipants, PlaneContext, PlaneResults, PlaneSelection, SharedWorldLabHooks, SharedWorldRunInput } from "./types.js";
+import type { ConcurrentSharedWorldLabErrorCode, ConcurrentSharedWorldLabResult, ConcurrentSharedWorldPlaneClass, FinishFacts, LiveParticipants, PlaneContext, PlaneResults, PlaneSelection, SharedWorldRunInput } from "./types.js";
+import type { LabDeps } from "../../lab/lab-deps.js";
 import type { SharedWorldPlan } from "../../lab/plan-types.js";
 /** What validation derived from the lab, which setup reads. */
 interface AdmittedLab {
     plan: SharedWorldPlan;
     input: SharedWorldRunInput;
-    /** Read by the computer-use lane runner, whose hooks and desktop setup take the whole config.
-     *  Seats, their count and their host and entry come from the plan's participants. */
+    /** Read for the subject's serve URL, which each seat's subject names. Seats, their count and
+     *  their host and entry come from the plan's participants. */
     config: LabConfig;
     requestedCwd: string;
-    hooks: SharedWorldLabHooks;
+    deps: LabDeps;
     env: Record<string, string | undefined>;
     descriptor: CuaActorDescriptor;
     planeClass: ConcurrentSharedWorldPlaneClass;

package/dist/routes/shared-world/setup.js

@@ -10,7 +10,7 @@ import { prepareEmailReceiving, prepareExternalComms, receivingSourceOf, subject
 import { declaredOriginDigestOf } from "./external-public.js";
 import { packSubjectTree } from "./provisioned.js";
 import { emptyPlaneResults } from "./result.js";
-import { buildParticipantSpecs, defaultSessionTimeoutMs } from "./seats.js";
+import { buildParticipantSpecs, defaultSessionTimeoutMs } from "./participant-specs.js";
 import { planeStateOf } from "./plan.js";
 import path from "node:path";
 import { e2bRequestTimeoutMs } from "../../substrates/e2b/lifetime.js";
@@ -49,7 +49,7 @@ async function bindPhysicalProject(requestedCwd) {
         .physicalPath;
 }
 function startConcurrentRun(lab, cwd, scope) {
-    const { plan, input, hooks } = lab;
+    const { plan, input, deps } = lab;
     return scope.startRun({
         cwd,
         runId: input.runId,
@@ -57,7 +57,7 @@ function startConcurrentRun(lab, cwd, scope) {
         mode: plan.dryRun ? "dry-run" : "live",
         lab: plan.lab,
         renderReview: renderConcurrentReviewMarkdown,
-        observer: { open: input.open === true, render: hooks.renderObserverFn },
+        observer: { open: input.open === true, render: deps.renderObserver },
     });
 }
 /**
@@ -65,7 +65,7 @@ function startConcurrentRun(lab, cwd, scope) {
  * specs, comms, the packed tree and email receiving. Returns the refusal when one of them fails.
  */
 export async function prepareConcurrentRun(lab, scope) {
-    const { plan, input, config, requestedCwd, hooks, env, descriptor, planeClass, fail } = lab;
+    const { plan, input, config, requestedCwd, deps, env, descriptor, planeClass, fail } = lab;
     const { runBudget, runSession, localTreeRoute, subjectEnvNames, publicRepo } = lab;
     const { openaiApiKey, e2bApiKey, knownSecretValues, scrubKnownValues } = lab;
     const { dryRun, concurrency } = plan;
@@ -73,17 +73,14 @@ export async function prepareConcurrentRun(lab, scope) {
     const warnings = [];
     // The comms catch and the packed tree are checked before the run starts, so a refusal leaves
     // no run directory. Neither spends: the probe is one request and packing runs on the host.
-    const externalComms = await prepareExternalComms(plan.residual, planeClass, dryRun, warnings);
+    const externalComms = await prepareExternalComms(plan.residual, planeClass, dryRun, warnings, env);
     if (!externalComms.ok) {
-        return {
-            ok: false,
-            result: fail("HUMANISH_CONCURRENT_SHARED_WORLD_LAB_COMMS_CATCH_UNREACHABLE", externalComms.message),
-        };
+        return { ok: false, result: fail(externalComms.code, externalComms.message) };
     }
     // Pack the working tree once per run, on the host, before any sandbox exists: a packing
     // failure fails the run closed without sandbox cost. Dry-run packs nothing.
     const packed = localTreeRoute && !dryRun
-        ? await packSubjectTree(cwd, plan.residual, hooks, scrubKnownValues)
+        ? await packSubjectTree(cwd, plan.residual, deps, scrubKnownValues)
         : { ok: true, archive: undefined, buffer: undefined };
     if (!packed.ok) {
         return {
@@ -102,9 +99,9 @@ export async function prepareConcurrentRun(lab, scope) {
     const timeoutMs = plan.sessionTimeoutMs ?? defaultSessionTimeoutMs(plan);
     const requestTimeoutMs = e2bRequestTimeoutMs(env);
     const redactScreenshots = plan.residual.policies?.redactScreenshots === true;
-    const timers = hooks.detachedTimers ?? {};
-    const now = hooks.now ?? Date.now;
-    const proberCadenceMs = hooks.proberCadenceMs ?? DEFAULT_PROBER_CADENCE_MS;
+    const timers = deps.detachedTimers ?? {};
+    const now = deps.now ?? Date.now;
+    const proberCadenceMs = deps.proberCadenceMs ?? DEFAULT_PROBER_CADENCE_MS;
     const seedDigest = seedRecipeDigest(planeStateOf(plan));
     const source = await buildRunSource({
         capturedAt: createdAt,
@@ -147,7 +144,7 @@ export async function prepareConcurrentRun(lab, scope) {
         input,
         config,
         descriptor,
-        hooks,
+        deps,
         env,
         concurrency,
         runBudget,
@@ -155,6 +152,7 @@ export async function prepareConcurrentRun(lab, scope) {
         openaiApiKey,
         e2bApiKey,
         scrubKnownValues,
+        knownSecretValues,
         cwd,
         run,
         runId,

package/dist/routes/shared-world/types.d.ts

@@ -1,22 +1,19 @@
+import type { LabDeps } from "../../lab/lab-deps.js";
+import type { LabEvent } from "../../lab/run-lab-events.js";
+import type { RunLabHomes } from "../../lab/run-lab-homes.js";
 import type { SharedWorldJudgment } from "../../run/judge.js";
-import type { CuaActorSessionOptions } from "../../actors/computer-use/actor.js";
-import type { CuaLoopResult } from "../../actors/computer-use/loop.js";
-import type { BrowserLabAdapterHooks } from "../../lab/adapter-extension.js";
-import type { SubjectPhaseEvent } from "../../subject/steps.js";
-import type { DetachedTimers } from "../../substrates/detached.js";
-import type { E2BDesktopModule, E2BDesktopSandbox } from "../../substrates/e2b/sdk.js";
-import type { AutomaticAnalysisHooks, AutomaticAnalysisResult } from "../../analysis/automatic-completion.js";
+import type { BrowserScorer } from "../../lab/adapter-extension.js";
+import type { AutomaticAnalysisResult } from "../../analysis/automatic-completion.js";
 import type { CuaActorDescriptor } from "../../actors/registry.js";
 import type { CommsReceivingRun } from "../../comms/receiving.js";
 import type { LabCommsEmail, LabCommsExternal, LabConfig } from "../../lab/types.js";
 import type { DesktopResourceObservation } from "../../substrates/e2b/desktop-resources.js";
-import type { ObserverResult, renderObserver } from "../../observer/render.js";
+import type { ObserverResult } from "../../observer/render.js";
 import type { ObserverRuntimeStreamUrl } from "../../observer/run-routes.js";
-import type { RunBundle, RunScorerProvenance, RunSubjectProvenance, RunSubjectStateStepRecord } from "../../run/bundle.js";
+import type { BundleRun, RunBundle, RunScorerProvenance, RunSubjectProvenance, RunSubjectStateStepRecord } from "../../run/bundle.js";
 import type { RunScope } from "../../run/run.js";
 import type { SharedWorldStateSnapshot } from "../../run/shared-world-evidence.js";
 import type { LocalTreeArchive } from "../../subject/local-tree-archive.js";
-import type { RunLabProvenance } from "../../run/status.js";
 import type { LiveTraceFlush } from "../computer-use/live-flush.js";
 import type { CuaParticipantDeps, DesktopParticipantRun, CuaRunBudget, ParticipantRunOutcome } from "../computer-use/types.js";
 import type { ProvisionedPlaneSetup } from "./provisioned.js";
@@ -28,9 +25,8 @@ export declare const CONCURRENT_SHARED_WORLD_PROVIDER_METADATA: {
 };
 export declare const CONCURRENT_ATTRIBUTION_LIMITS: readonly ["concurrent", "best-effort-causal-attribution", "non-deterministic-shared-state", "window-and-snapshot-granularity", "contention-observed-not-proven-safe", "state-change-not-isolated-to-actors"];
 export interface RunConcurrentSharedWorldLabOptions {
-    automaticAnalysis?: AutomaticAnalysisHooks;
-    /** Which manifest produced this run (#455); threaded into the status record + bundle. */
-    lab?: RunLabProvenance;
+    /** Cancels post-run analysis only. */
+    analysisSignal?: AbortSignal;
     cwd: string;
     config: LabConfig;
     /** Resolved upstream (scenario.mode + CLI override); defaults safe (dry-run). */
@@ -40,27 +36,44 @@ export interface RunConcurrentSharedWorldLabOptions {
     onObserverReady?: (observer: ObserverResult & {
         ok: true;
     }) => Promise<void> | void;
-    hooks?: SharedWorldLabHooks;
-    /** Present only when the browser-route scorer hooks were CONFIG-DECLARED and loaded by the CLI
-     *  (#316); core-stamped onto the bundle as evidence. Absent for library callers. */
+    /** Keys and subject env for the run. Defaults to process.env. */
+    env?: Readonly<Record<string, string | undefined>>;
+    /**
+     * Runs after a sandbox exists and before anything is provisioned on it: the provisioned plane's
+     * subject sandbox, then each seat's desktop. The external-public plane has seats only.
+     */
+    prepareDesktop?: NonNullable<RunLabHomes["prepareDesktop"]>;
+    /** Awaited after a participant's live stream starts, and again after its sandbox is gone. */
+    onStream?: NonNullable<RunLabHomes["onStream"]>;
+    /** Reports subject phases to onEvent; built by normalizeRunLabOptions. */
+    emit?: (event: LabEvent) => void;
+    /** Test seams. */
+    deps?: LabDeps;
+    /** Scores the assembled evidence: `RunLabOptions.scorer`, or the scorer the CLI loads. */
+    scorer?: BrowserScorer;
+    /** Present only when the scorer was CONFIG-DECLARED and loaded by the CLI (#316);
+     *  core-stamped onto the bundle as evidence. Absent for library callers. */
     scorerProvenance?: RunScorerProvenance;
 }
 /** What a shared-world run takes besides its plan. The plan carries the config, dry run and lab. */
 export type SharedWorldRunInput = Omit<RunConcurrentSharedWorldLabOptions, "config" | "dryRun" | "lab">;
-export type ConcurrentSharedWorldLabErrorCode = "HUMANISH_LAB_ANALYSIS_INVALID" | "HUMANISH_LAB_TASKS_UNSUPPORTED" | "HUMANISH_LAB_OPTION_CONFLICT" | "HUMANISH_LAB_OPTION_UNSUPPORTED" | "HUMANISH_CONCURRENT_SHARED_WORLD_LAB_FAILED" | "HUMANISH_CONCURRENT_SHARED_WORLD_LAB_ACTOR_UNSUPPORTED" | "HUMANISH_CONCURRENT_SHARED_WORLD_LAB_INVALID" | "HUMANISH_CONCURRENT_SHARED_WORLD_LAB_KEYS_MISSING"
-/** A local-agent brain's CLI is not on PATH. */
+export type ConcurrentSharedWorldLabErrorCode = "HUMANISH_LAB_ANALYSIS_INVALID" | "HUMANISH_LAB_TASKS_UNSUPPORTED" | "HUMANISH_LAB_OPTION_UNSUPPORTED" | "HUMANISH_CONCURRENT_SHARED_WORLD_LAB_FAILED" | "HUMANISH_CONCURRENT_SHARED_WORLD_LAB_ACTOR_UNSUPPORTED" | "HUMANISH_CONCURRENT_SHARED_WORLD_LAB_INVALID" | "HUMANISH_CONCURRENT_SHARED_WORLD_LAB_KEYS_MISSING"
+/** A local-agent brain's CLI is not on `PATH`. */
  | "HUMANISH_CONCURRENT_SHARED_WORLD_LAB_AGENT_MISSING"
 /** A local-agent brain's CLI is signed out, or could not report its sign-in status. */
  | "HUMANISH_CONCURRENT_SHARED_WORLD_LAB_AGENT_SIGNIN_REQUIRED"
 /** A dollar cap that cannot be priced: an unpriced model, or a ChatGPT-account Codex brain. */
  | "HUMANISH_CONCURRENT_SHARED_WORLD_LAB_UNPRICED_CAP" | "HUMANISH_CONCURRENT_SHARED_WORLD_LAB_SUBJECT_ENV_MISSING" | "HUMANISH_CONCURRENT_SHARED_WORLD_LAB_GETHOST_UNAVAILABLE" | "HUMANISH_CONCURRENT_SHARED_WORLD_LAB_HANDOFF_TIMEOUT" | "HUMANISH_RUN_ID_IN_USE"
 /** A declared adopter-hosted comms catch (#328) did not answer as a humanish catch — fail closed
- *  BEFORE any actor spend, since the funnel would silently collect nothing. */
- | "HUMANISH_CONCURRENT_SHARED_WORLD_LAB_COMMS_CATCH_UNREACHABLE";
+ *  before any actor spend, since the funnel would silently collect nothing. */
+ | "HUMANISH_CONCURRENT_SHARED_WORLD_LAB_COMMS_CATCH_UNREACHABLE"
+/** comms.email.external.authTokenEnv names a token shorter than MIN_CATCH_TOKEN_LENGTH or not
+ *  well-formed Unicode (src/comms/external-evidence.ts). Refused before the catch is probed. */
+ | "HUMANISH_CONCURRENT_SHARED_WORLD_LAB_COMMS_TOKEN_INVALID";
 /** The two plane classes of the concurrent shared-world route (#164 phase 2). */
 export type ConcurrentSharedWorldPlaneClass = "provisioned-getHost" | "external-public";
 export declare const EXTERNAL_PUBLIC_ATTRIBUTION_LIMITS: readonly ["concurrent", "best-effort-causal-attribution", "non-deterministic-shared-state", "window-and-snapshot-granularity", "contention-observed-not-proven-safe", "state-change-not-isolated-to-actors", "external-public-plane", "operator-attested-target-not-harness-controlled", "no-synthetic-attestation", "no-authoritative-shared-state-proof", "concurrency-by-temporal-co-occupancy-only"];
-/** One persona's OUTCOME against the contended world (the "M of N" headline). */
+/** One persona's outcome against the contended world (the "M of N" headline). */
 export interface ConcurrentSharedWorldParticipantResult {
     id: string;
     index: number;
@@ -96,7 +109,7 @@ export interface ConcurrentSharedWorldLabResult extends AutomaticAnalysisResult
     actor: string;
     topology: "shared-world";
     topologyMode: "concurrent";
-    /** The DECLARED number of persona seats. */
+    /** The declared number of personas. */
     roleCount: number;
     /** Effective in-flight bound (execution.concurrency). */
     concurrency: number;
@@ -104,17 +117,17 @@ export interface ConcurrentSharedWorldLabResult extends AutomaticAnalysisResult
     runId: string;
     /** The harness-minted getHost URL the actors drove (tokenless; live only). */
     host?: string;
-    /** The ONE subject sandbox lifecycle proof. */
+    /** The one subject sandbox lifecycle proof. */
     subjectSandbox?: {
         sandboxId: string;
         killed: boolean;
     };
     /** Whether ≥2 actor windows overlapped in time (proven concurrency; live only). */
     overlapProven?: boolean;
-    /** Max lanes observed live at the same instant (live only) — the honest simultaneity number; a
-     *  6-lane run capped at 3 reports 3 here, never 6 (#350). */
+    /** Max participants observed live at the same instant (live only) — the honest simultaneity number; a
+     *  6-participant run capped at 3 reports 3 here, never 6 (#350). */
     maxSimultaneousLanes?: number;
-    /** Subject provenance (invariant 5): the ONE shared plane. */
+    /** Subject provenance (invariant 5): the one shared plane. */
     subject?: RunSubjectProvenance;
     roles: ConcurrentSharedWorldParticipantResult[];
     observer?: ObserverResult;
@@ -145,11 +158,12 @@ type StartedRun = Extract<Awaited<ReturnType<RunScope["startRun"]>>, {
 export interface PlaneContext {
     plan: SharedWorldPlan;
     input: SharedWorldRunInput;
-    /** Read by the computer-use lane runner, whose hooks and desktop setup take the whole config.
-     *  Seats, their count and their host and entry come from the plan's participants. */
+    /** Read for the subject's serve URL, which each seat's subject names. Seats, their count and
+     *  their host and entry come from the plan's participants. */
     config: LabConfig;
     descriptor: CuaActorDescriptor;
-    hooks: SharedWorldLabHooks;
+    /** The run's test seams; empty outside tests. */
+    deps: LabDeps;
     env: Record<string, string | undefined>;
     concurrency: number;
     runBudget: CuaRunBudget | undefined;
@@ -157,6 +171,8 @@ export interface PlaneContext {
     openaiApiKey: string;
     e2bApiKey: string;
     scrubKnownValues: (text: string) => string;
+    /** The values scrubKnownValues removes. Real email receiving adds its secrets before seats start. */
+    knownSecretValues: readonly string[];
     cwd: string;
     run: StartedRun;
     runId: string;
@@ -176,7 +192,7 @@ export interface PlaneContext {
 }
 /**
  * What the seats feed while they run. A plane sets the attached Observer and starts the trace
- * flush; the runtime stream hooks append stream URLs; the orchestrator reads all three at finish.
+ * flush; each seat's onStream appends stream URLs; the orchestrator reads all three at finish.
  */
 export interface LiveParticipants {
     observer?: ObserverResult & {
@@ -195,14 +211,12 @@ export interface ExternalCommsWiring {
 export interface ConcurrentBundleArgs {
     /** The run's judgment (judgeSharedWorldRun over the other fields). */
     judgment: SharedWorldJudgment;
-    /** Lab provenance for the bundle\'s own `lab` field (#455). */
-    lab?: RunLabProvenance;
+    /** The run this bundle belongs to; the bundle head reads its id, mode, start and lab. */
+    run: BundleRun;
     plan: SharedWorldPlan;
     descriptor: CuaActorDescriptor;
-    createdAt: string;
     dryRun: boolean;
     inProgress?: boolean;
-    runId: string;
     source: RunBundle["source"];
     actorSpecs: DesktopParticipantRun[];
     actorResults: ActorRunResult[];
@@ -213,15 +227,15 @@ export interface ConcurrentBundleArgs {
     hostDigest?: string;
     /** Run-level digest-only comms-thread evidence path (humanish.comms-thread.v1), when a comms lab
      *  captured mail into the subject sandbox's catch. Registered on the first persona stream (it is a
-     *  property of the ONE shared app, not of any single persona). */
+     *  property of the one shared app, and belongs to no single persona). */
     commsArtifactPath?: string;
     /** #164 phase 2: the plane-class discriminator (default provisioned-getHost, byte-stable). */
     planeClass?: ConcurrentSharedWorldPlaneClass;
-    /** external-public only: sha256-16 of the OBSERVED origin the seats converged on (the convergence
+    /** external-public only: sha256-16 of the observed origin the seats converged on (the convergence
      *  proof — what the seats actually reached, tolerant of a declared->observed redirect). */
     publicOriginDigest?: string;
     /** external-public only: sha256-16 of the operator-DECLARED plane origin (evidence/reference only;
-     *  NOT asserted equal to the observed origin — a cross-origin redirect is normal and expected). */
+     *  never asserted equal to the observed origin, since a cross-origin redirect is normal). */
     declaredOriginDigest?: string;
     /** external-public only: sha256-16 of the shared /lobby/CODE path all seats converged on. */
     lobbyConvergenceDigest?: string;
@@ -236,6 +250,8 @@ export interface PlaneResults {
     subjectCommit: string | undefined;
     subjectSandboxId: string | undefined;
     subjectKilled: boolean;
+    /** The subject sandbox's scrubbed release warning when its release is unconfirmed. */
+    subjectReleaseWarning: string | undefined;
     subjectDesktop: SubjectDesktopUsage | undefined;
     getHostUrl: string | undefined;
     publicOriginDigest: string | undefined;
@@ -262,93 +278,4 @@ export interface FinishFacts {
     stateSnapshots: SharedWorldStateSnapshot[];
     declaredOriginDigest: string | undefined;
 }
-/**
- * Library-level hooks mirroring CuaActorLabHooks — the DI seams that let CI drive the FULL
- * orchestration with fakes at $0/zero-network. The fake desktop module records create/kill BY id
- * and exposes NO `list` method (the by-id teardown rail is then provable by construction).
- */
-export interface SharedWorldLabHooks extends BrowserLabAdapterHooks {
-    /** Lazy-load the E2B desktop module (tests inject a fake; default loadE2BDesktopModule). */
-    loadDesktopModule?: () => Promise<E2BDesktopModule>;
-    /**
-     * Runs after a sandbox is created and before anything is provisioned on it. The provisioned
-     * plane calls it for the subject sandbox with no lane, then for each seat's desktop with its lane;
-     * the external-public plane calls it for the seats only.
-     */
-    prepareDesktop?: (desktop: E2BDesktopSandbox, lane?: {
-        laneId: string;
-        laneIndex: number;
-        laneCount: number;
-    }) => Promise<void>;
-    /**
-     * Awaited after a seat's live desktop stream starts. The URL carries an auth key and must never
-     * be persisted. A rejection becomes a run warning, as on the computer-use route.
-     */
-    onRuntimeStreamReady?: (stream: {
-        laneId: string;
-        sandboxId: string;
-        simId: string;
-        streamId: string;
-        url: string;
-    }) => Promise<void> | void;
-    /** Awaited after a seat's sandbox is gone, for seats whose stream started. Rejections are swallowed. */
-    onRuntimeStreamEnded?: (stream: {
-        laneId: string;
-        simId: string;
-        streamId: string;
-    }) => Promise<void> | void;
-    /** The per-seat computer-use session runner (default: the resolved actor descriptor's). */
-    runSession?: (options: CuaActorSessionOptions) => Promise<CuaLoopResult>;
-    /** The operator environment (keys + subject env values). Defaults to process.env. */
-    env?: Record<string, string | undefined>;
-    renderObserverFn?: typeof renderObserver;
-    /** Injected clock/sleep for the detached-step polling (tests only). */
-    detachedTimers?: DetachedTimers;
-    /**
-     * Subject-provisioning phase sink (mirrors CuaActorLabHooks.onPhase): one call per
-     * started/completed boundary during the ONE shared-plane provision (clone route: clone, install,
-     * build, serve start, ready, subject.state seed-step groups; local-tree route: upload, extract,
-     * install, build, serve start, ready, seed-step groups - no clone phase). Defaults to one stderr
-     * line per event. Override in tests to capture instead of writing to real stderr.
-     */
-    onPhase?: (event: SubjectPhaseEvent) => void;
-    /**
-     * CONCURRENT route only (#164 phase 2): the harness clock used to MEASURE each actor's laneWindow
-     * [start,end] (default Date.now). The deterministic heart test does NOT override this — overlap is
-     * produced by a rendezvous latch in the fake runSession + measured by the REAL clock (FIX-1), so
-     * the windows are real, not injected. (A test may override only for non-overlap assertions.)
-     */
-    now?: () => number;
-    /** CONCURRENT route only: the background stateSeries prober cadence (ms). Default 1000. */
-    proberCadenceMs?: number;
-    /**
-     * EXTERNAL-PUBLIC concurrent route only (#164 phase 2): the host-first handoff barrier deadline
-     * (ms). The host seat must surface a shared-session (/lobby/CODE) URL within this budget or the run
-     * fails closed with HUMANISH_CONCURRENT_SHARED_WORLD_LAB_HANDOFF_TIMEOUT and no follower opens.
-     * Default 120000 (also capped by execution.timeoutMs). Tests inject a short value to exercise the
-     * fail-closed path deterministically.
-     */
-    handoffDeadlineMs?: number;
-    /**
-     * EXTERNAL-PUBLIC concurrent route only: the vision reader that extracts a /lobby/CODE off a seat's
-     * screenshot frame (the CDP-independent handoff relay + per-seat convergence observation). Defaults to
-     * the real single-frame OpenAI read (readLobbyCodeFromFrame). Tests inject a fake so the barrier's
-     * handoff + convergence proof can be exercised deterministically without a live vision call.
-     */
-    readLobbyCodeFromFrame?: (frame: Buffer, apiKey: string) => Promise<string | undefined>;
-    /**
-     * Local-tree packing DI seam (tests only, no npm dependency needed to exercise the route):
-     * defaults to createLocalTreeArchive(root, opts) plus a host-side read of the produced archive
-     * file into an ArrayBuffer (the SAME default routes/computer-use/route.ts uses). Called ONCE per run, before
-     * the ONE shared-plane sandbox is created, on the live local-tree route.
-     */
-    packLocalTree?: (args: {
-        root: string;
-        extraExclude?: string[];
-        maxArchiveBytes?: number;
-    }) => Promise<{
-        archive: LocalTreeArchive;
-        buffer: ArrayBuffer;
-    }>;
-}
 export {};

package/dist/routes/shared-world/types.js

@@ -5,7 +5,7 @@ export const CONCURRENT_SHARED_WORLD_PROVIDER_METADATA = {
     mode: "concurrent-shared-world-lab",
     tool: "humanish",
 };
-// The verify-enforced CONCURRENT attribution ceiling (FIX-5). Mirrored in
+// The verify-enforced concurrent attribution ceiling. Mirrored in
 // verify/shared-world-concurrent.ts CONCURRENT_REQUIRED_LIMITS.
 export const CONCURRENT_ATTRIBUTION_LIMITS = [
     "concurrent",
@@ -16,7 +16,7 @@ export const CONCURRENT_ATTRIBUTION_LIMITS = [
     "state-change-not-isolated-to-actors",
 ];
 // EXTERNAL-PUBLIC plane class: the honest-downgrade attribution ceiling. The concurrent family
-// (an honest ceiling) PLUS the mandatory external-public disclosures — mirrored in the required
+// (an honest ceiling) plus the mandatory external-public disclosures, mirrored in the required
 // set in verify/shared-world-concurrent.ts (CONCURRENT_ATTRIBUTION_LIMITS +
 // EXTERNAL_PUBLIC_EXTRA_LIMITS). Verify fails closed on a missing one.
 export const EXTERNAL_PUBLIC_ATTRIBUTION_LIMITS = [