humanish 0.107.0 → 0.108.0

package/dist/lab/discover.js

@@ -5,16 +5,12 @@ import { lstat, open, readdir, realpath } from "node:fs/promises";
 import path from "node:path";
 import { parse } from "yaml";
 import { parseLabConfig } from "./config.js";
-import {} from "./types.js";
+import { STUDY_SCHEMA } from "./types.js";
 import { assertPreparedSelectedOutputDirectory, assertSafeOutputPathSegment, prepareSelectedOutputDirectory, readContainedRegularFile, } from "../run/contained-output.js";
 import { isNodeError } from "../run/type-guards.js";
-const LAB_LIST_SCHEMA = "humanish.lab-list.v1";
-const LAB_INSPECT_SCHEMA = "humanish.lab-inspect.v1";
-const committedLabsDir = path.join("humanish", "labs");
-const ignoredLabsDirs = [
-    path.join(".humanish", "labs"),
-    path.join(".humanish", "local", "labs"),
-];
+import { studyFileCandidates, studyFileStem, STUDY_DIRECTORIES } from "../study/files.js";
+const STUDY_LIST_SCHEMA = "humanish.study-list.v1";
+const STUDY_SHOW_SCHEMA = "humanish.study-show.v1";
 export async function resolveLabManifest(cwd, lab) {
     const resolvedCwd = path.resolve(cwd);
     const warnings = [];
@@ -40,16 +36,10 @@ export async function resolveLabManifest(cwd, lab) {
             contents: read.contents,
         });
     }
-    const candidates = [
-        { origin: "committed", relativePath: path.join(committedLabsDir, `${lab}.yaml`) },
-        { origin: "committed", relativePath: path.join(committedLabsDir, `${lab}.yml`) },
-        ...ignoredLabsDirs.flatMap((dir) => [
-            { origin: "ignored", relativePath: path.join(dir, `${lab}.yaml`) },
-            { origin: "ignored", relativePath: path.join(dir, `${lab}.yml`) },
-        ]),
-    ];
+    // A studies/ file wins over every labs/ file. The same stem under both families is an error, so
+    // neither file silently shadows the other.
+    const candidates = studyFileCandidates(lab);
     for (const candidate of candidates) {
-        const requestedPath = path.join(resolvedCwd, candidate.relativePath);
         const read = await readManagedManifest(projectRoot, candidate.relativePath);
         if (read.status === "missing") {
             continue;
@@ -57,11 +47,18 @@ export async function resolveLabManifest(cwd, lab) {
         if (read.status === "unsafe") {
             return invalidLab({ cwd: resolvedCwd, lab, warnings }, read.message);
         }
+        if (candidate.directory.family === "studies") {
+            for (const other of candidates.filter((entry) => entry.directory.family === "labs")) {
+                const present = await inspectManagedPath(projectRoot, other.relativePath, "file");
+                if (present.status !== "missing")
+                    return ambiguousStudy(resolvedCwd, lab, [candidate.relativePath, other.relativePath], warnings);
+            }
+        }
         return parseResolvedLab({
             cwd: resolvedCwd,
             lab,
-            origin: candidate.origin,
-            path: requestedPath,
+            origin: candidate.directory.origin,
+            path: path.join(resolvedCwd, candidate.relativePath),
             warnings,
             contents: read.contents,
         });
@@ -71,22 +68,21 @@ export async function resolveLabManifest(cwd, lab) {
 export async function listLabManifests(cwd) {
     const resolvedCwd = path.resolve(cwd);
     const warnings = [];
-    const labs = new Map();
+    const listed = new Map();
     const projectRoot = await bindProjectRoot(resolvedCwd);
     if (!projectRoot) {
         return {
-            schema: LAB_LIST_SCHEMA,
+            schema: STUDY_LIST_SCHEMA,
             ok: true,
             cwd: resolvedCwd,
-            labs: [],
-            warnings: ["Project root failed containment validation; managed lab manifests were skipped."],
+            studies: [],
+            warnings: ["Project root failed containment validation; study files were skipped."],
         };
     }
-    const dirs = [
-        { origin: "committed", relativeDir: committedLabsDir },
-        ...ignoredLabsDirs.map((relativeDir) => ({ origin: "ignored", relativeDir })),
-    ];
-    for (const entry of dirs) {
+    let legacyFiles = 0;
+    // Each stem's files by directory family, to mark the stems that name a file in both.
+    const stems = new Map();
+    for (const entry of STUDY_DIRECTORIES) {
         const directory = await bindManagedDirectory(projectRoot, entry.relativeDir);
         if (directory.status === "missing") {
             continue;
@@ -107,13 +103,15 @@ export async function listLabManifests(cwd) {
         for (const name of names.filter((value) => value.endsWith(".yaml") || value.endsWith(".yml"))) {
             let relativePath;
             try {
-                assertSafeOutputPathSegment(name, "Lab manifest name");
+                assertSafeOutputPathSegment(name, "Study file name");
                 relativePath = path.join(entry.relativeDir, name);
             }
             catch {
-                warnings.push(`${entry.relativeDir}: unsafe lab manifest name; skipped.`);
+                warnings.push(`${entry.relativeDir}: unsafe study file name; skipped.`);
                 continue;
             }
+            const stem = stemSlot(stems, studyFileStem(name) ?? name);
+            stem[entry.family === "studies" ? "studies" : "legacy"] ??= relativeToCwd(resolvedCwd, path.join(resolvedCwd, relativePath));
             const requestedPath = path.join(resolvedCwd, relativePath);
             const read = await readManagedManifest(projectRoot, relativePath);
             if (read.status !== "ok") {
@@ -132,8 +130,11 @@ export async function listLabManifests(cwd) {
                 warnings.push(`${relativeToCwd(resolvedCwd, requestedPath)}: ${parsed.error.message}`);
                 continue;
             }
+            if (legacyStudyWarning(parsed.path, parsed.config.schema) !== undefined)
+                legacyFiles += 1;
             const key = `${parsed.config.id}:${entry.origin}:${relativeToCwd(resolvedCwd, requestedPath)}`;
-            labs.set(key, {
+            stem.keys.push(key);
+            listed.set(key, {
                 id: parsed.config.id,
                 source: parsed.config.subject.source,
                 origin: entry.origin,
@@ -146,11 +147,24 @@ export async function listLabManifests(cwd) {
             });
         }
     }
+    if (legacyFiles > 0) {
+        warnings.push(`${legacyFiles === 1 ? "One study file uses" : `${legacyFiles} study files use`} humanish.lab.v2 or a labs/ directory, which 0.109 stops reading. humanish migrate converts and moves the v2 files; humanish study show names the fix for each file.`);
+    }
+    for (const [name, stem] of stems) {
+        if (stem.studies === undefined || stem.legacy === undefined)
+            continue;
+        const error = `${name} names two files, ${stem.studies} and ${stem.legacy}; running it by name fails until you delete one (humanish migrate moves a kept labs/ file).`;
+        for (const key of stem.keys) {
+            const entry = listed.get(key);
+            if (entry)
+                entry.error = error;
+        }
+    }
     return {
-        schema: LAB_LIST_SCHEMA,
+        schema: STUDY_LIST_SCHEMA,
         ok: true,
         cwd: resolvedCwd,
-        labs: [...labs.values()].sort((left, right) => `${left.origin}:${left.id}`.localeCompare(`${right.origin}:${right.id}`)),
+        studies: [...listed.values()].sort((left, right) => `${left.origin}:${left.id}`.localeCompare(`${right.origin}:${right.id}`)),
         warnings,
     };
 }
@@ -158,10 +172,10 @@ export async function inspectLabManifest(cwd, lab) {
     const resolved = await resolveLabManifest(cwd, lab);
     if (!resolved.ok) {
         return {
-            schema: LAB_INSPECT_SCHEMA,
+            schema: STUDY_SHOW_SCHEMA,
             ok: false,
             cwd: resolved.cwd,
-            lab,
+            study: lab,
             error: resolved.error,
             warnings: resolved.warnings,
         };
@@ -174,23 +188,23 @@ export async function inspectLabManifest(cwd, lab) {
         if (!(error instanceof PersonaConfigError))
             throw error;
         return {
-            schema: LAB_INSPECT_SCHEMA,
+            schema: STUDY_SHOW_SCHEMA,
             ok: false,
             cwd: path.resolve(cwd),
-            lab,
-            error: { code: "HUMANISH_LAB_INVALID", message: error.message },
+            study: lab,
+            error: { code: "HUMANISH_STUDY_INVALID", message: error.message },
             warnings: resolved.warnings,
         };
     }
     return {
-        schema: LAB_INSPECT_SCHEMA,
+        schema: STUDY_SHOW_SCHEMA,
         personas: labPersonaIds(resolved.config).map((id) => {
             const persona = personaResolution.personas.get(id);
             return { id, resolved: !!persona, ...(persona ? { brief: personaBrief(persona) } : {}) };
         }),
         ok: true,
         cwd: path.resolve(cwd),
-        lab,
+        study: lab,
         config: resolved.config,
         origin: resolved.origin,
         path: resolved.path,
@@ -203,13 +217,16 @@ function parseResolvedLab(args) {
         raw = parse(args.contents);
     }
     catch (error) {
-        return invalidLab(args, error instanceof Error ? error.message : "Lab YAML could not be parsed.");
+        return invalidLab(args, error instanceof Error ? error.message : "The study file's YAML could not be parsed.");
     }
     const parsed = parseLabConfig(raw);
     if (!parsed.ok) {
         return invalidLab(args, parsed.error.message);
     }
     const warnings = [...args.warnings, ...parsed.warnings];
+    const legacy = legacyStudyWarning(relativeToCwd(args.cwd, args.path), parsed.config.schema);
+    if (legacy !== undefined)
+        warnings.push(legacy);
     if (args.path.endsWith(".yml")) {
         warnings.push("Prefer .yaml for humanish-authored lab source; .yml is accepted for compatibility only.");
     }
@@ -221,6 +238,24 @@ function parseResolvedLab(args) {
         warnings,
     };
 }
+/**
+ * What 0.109 stops reading in this file: the humanish.lab.v2 format, a labs/ directory, or both, and
+ * what to run about it. Undefined for a v3 file outside the labs/ directories.
+ */
+function legacyStudyWarning(relativePath, schema) {
+    const retiredDirectory = STUDY_DIRECTORIES.find((directory) => directory.family === "labs" && path.dirname(relativePath) === directory.relativeDir);
+    // A file discovery parsed has one of two schemas, so not v3 is v2.
+    const v2 = schema !== STUDY_SCHEMA;
+    if (retiredDirectory !== undefined) {
+        const studies = retiredDirectory.relativeDir.replace(/labs$/, "studies");
+        return v2
+            ? `${relativePath} is a humanish.lab.v2 file in ${retiredDirectory.relativeDir}/, and 0.109 reads neither. Run humanish migrate to convert it and move it to ${studies}/.`
+            : `${relativePath} is in ${retiredDirectory.relativeDir}/, which 0.109 stops reading. Move it to ${studies}/.`;
+    }
+    return v2
+        ? `${relativePath} is a humanish.lab.v2 file, which 0.109 stops reading. Run humanish migrate ${relativePath} to convert it.`
+        : undefined;
+}
 async function bindProjectRoot(cwd) {
     try {
         const lexical = await lstat(cwd);
@@ -242,7 +277,7 @@ async function readManagedManifest(projectRoot, relativePath) {
     if (!contents) {
         return {
             status: "unsafe",
-            message: "Managed lab manifest changed or failed containment validation.",
+            message: "The study file changed or failed containment validation.",
         };
     }
     return { status: "ok", contents: contents.toString("utf8") };
@@ -264,7 +299,7 @@ async function readExplicitManifest(projectRoot, requestedPath) {
         if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1n) {
             return {
                 status: "unsafe",
-                message: "Explicit lab manifest must resolve to a single-link regular file.",
+                message: "The study file path must resolve to a single-link regular file.",
             };
         }
         const handle = await open(physicalPath, constants.O_RDONLY | constants.O_NOFOLLOW);
@@ -276,7 +311,7 @@ async function readExplicitManifest(projectRoot, requestedPath) {
                 opened.ino !== before.ino) {
                 return {
                     status: "unsafe",
-                    message: "Explicit lab manifest changed before it could be read safely.",
+                    message: "The study file changed before it could be read safely.",
                 };
             }
             const contents = await handle.readFile();
@@ -293,7 +328,7 @@ async function readExplicitManifest(projectRoot, requestedPath) {
                 after.ino !== before.ino) {
                 return {
                     status: "unsafe",
-                    message: "Explicit lab manifest changed while it was being read.",
+                    message: "The study file changed while it was being read.",
                 };
             }
             return { status: "ok", contents: contents.toString("utf8") };
@@ -303,7 +338,7 @@ async function readExplicitManifest(projectRoot, requestedPath) {
         }
     }
     catch {
-        return { status: "unsafe", message: "Explicit lab manifest failed containment validation." };
+        return { status: "unsafe", message: "The study file path failed containment validation." };
     }
 }
 async function bindManagedDirectory(projectRoot, relativePath) {
@@ -327,7 +362,7 @@ async function inspectManagedPath(projectRoot, relativePath, expectedKind) {
         const segments = relativePath.replace(/\\/g, "/").split("/");
         let current = projectRoot.physicalPath;
         for (const [index, segment] of segments.entries()) {
-            assertSafeOutputPathSegment(segment, "Managed lab path segment");
+            assertSafeOutputPathSegment(segment, "Study file path segment");
             current = path.join(current, segment);
             let stats;
             try {
@@ -341,18 +376,21 @@ async function inspectManagedPath(projectRoot, relativePath, expectedKind) {
             }
             const leaf = index === segments.length - 1;
             if (stats.isSymbolicLink()) {
-                return { status: "unsafe", message: "Managed lab paths must not contain symbolic links." };
+                return {
+                    status: "unsafe",
+                    message: "Study directory paths must not contain symbolic links.",
+                };
             }
             if (!leaf && !stats.isDirectory()) {
-                return { status: "unsafe", message: "Managed lab path parents must be directories." };
+                return { status: "unsafe", message: "Study file path parents must be directories." };
             }
             if (leaf && expectedKind === "directory" && !stats.isDirectory()) {
-                return { status: "unsafe", message: "Managed lab directory has an unsafe file type." };
+                return { status: "unsafe", message: "A study directory has an unsafe file type." };
             }
             if (leaf && expectedKind === "file" && (!stats.isFile() || stats.nlink !== 1n)) {
                 return {
                     status: "unsafe",
-                    message: "Managed lab manifest must be a single-link regular file.",
+                    message: "A study file must be a single-link regular file.",
                 };
             }
             if (leaf) {
@@ -368,7 +406,7 @@ async function inspectManagedPath(projectRoot, relativePath, expectedKind) {
         }
     }
     catch {
-        return { status: "unsafe", message: "Managed lab path failed containment validation." };
+        return { status: "unsafe", message: "A study file path failed containment validation." };
     }
     return { status: "missing" };
 }
@@ -387,22 +425,44 @@ function invalidLab(args, message) {
     return {
         ok: false,
         cwd: args.cwd,
-        lab: args.lab,
+        study: args.lab,
         error: {
-            code: "HUMANISH_LAB_INVALID",
+            code: "HUMANISH_STUDY_INVALID",
             message,
         },
         warnings: args.warnings,
     };
 }
+function stemSlot(stems, name) {
+    let slot = stems.get(name);
+    if (slot === undefined) {
+        slot = { keys: [] };
+        stems.set(name, slot);
+    }
+    return slot;
+}
+/** The same stem under a studies/ and a labs/ directory: discovery reads neither. */
+function ambiguousStudy(cwd, name, paths, warnings) {
+    const [studiesPath, labsPath] = paths.map((entry) => entry.replace(/\\/g, "/"));
+    return {
+        ok: false,
+        cwd,
+        study: name,
+        error: {
+            code: "HUMANISH_STUDY_AMBIGUOUS",
+            message: `${name} names two files, ${studiesPath} and ${labsPath}. Delete the one you do not want; if you keep ${labsPath}, run humanish migrate to move it. Or pass the path of the one to run.`,
+        },
+        warnings,
+    };
+}
 function labNotFound(cwd, lab, warnings) {
     return {
         ok: false,
         cwd,
-        lab,
+        study: lab,
         error: {
-            code: "HUMANISH_LAB_NOT_FOUND",
-            message: `Lab not found: ${lab}. Look in humanish/labs/ or pass a .yaml path.`,
+            code: "HUMANISH_STUDY_NOT_FOUND",
+            message: `Study not found: ${lab}. Look in humanish/studies/ or humanish/labs/, or pass a .yaml path.`,
         },
         warnings,
     };

package/dist/lab/doctor.d.ts

@@ -3,10 +3,10 @@ import type { LabConfig } from "./types.js";
 import type { PlanResult } from "./plan-types.js";
 import type { DetectedLocalAgent } from "../actors/local-agent/cli.js";
 import type { ReasoningEffort } from "../actors/reasoning-effort.js";
-import type { DoctorResult } from "../cli/doctor.js";
-import { type CodexInstallation } from "../actors/codex/qualified-versions.js";
+import type { DoctorCheckDraft } from "../cli/doctor.js";
+import { type CodexInstallation } from "../actors/codex/codex-admission.js";
 import type { RefusedCodexExecutable } from "../actors/codex/restricted-executable.js";
-type Check = DoctorResult["checks"][number];
+type Check = DoctorCheckDraft;
 /**
  * Read-only Codex account readiness. An unadmitted CLI also reports the release it found, and an
  * unavailable one the file humanish found and turned down.
@@ -66,6 +66,13 @@ export declare function labSetupChecks(args: LabSetupCheckArgs): Promise<{
     reads?: ReadonlySet<string>;
     checks: Check[];
 }>;
+/**
+ * The ids of the project's labs that need each provider key for a live run, from the same plan
+ * `doctor --lab` reads. Each listed manifest resolves by its path, since a file name need not match
+ * the id inside. A lab that runs dry, that the plain CLI cannot run, or that does not plan needs
+ * none.
+ */
+export declare function studiesByRequiredKey(cwd: string, keyPresent: (name: string) => boolean): Promise<Map<string, string[]>>;
 /**
  * The lab planned with no run options, so its own scenario mode decides dry or live. Doctor and the
  * TUI read a live run's keys and subject env from this plan's requirements.

package/dist/lab/doctor.js

@@ -6,7 +6,7 @@ import { protocolAdditionsWarning, protocolIncompatibilityMessage, } from "../ac
 import { automaticAnalysisBudget } from "../analysis/automatic-config.js";
 import { externalCatchHealthy } from "../comms/sandbox-catch.js";
 import { receivingRequiredKey } from "../comms/setup.js";
-import { classifyCodexInstallation, codexInstallAdvice, codexVersionRecovery, } from "../actors/codex/qualified-versions.js";
+import { classifyCodexInstallation, codexInstallAdvice, codexVersionRecovery, } from "../actors/codex/codex-admission.js";
 /** A ready row's message, with the schema values the launch recorded. */
 function readyMessage(message, readiness) {
     const additions = protocolAdditionsWarning(readiness.cliVersion, readiness.protocolAdditions);
@@ -110,10 +110,24 @@ export async function localCodexParticipantCheck(args) {
         name: "local participant authentication",
         ok: readiness.ready,
         message: readiness.ready
-            ? readyMessage("Qualified Codex CLI and ChatGPT login are ready for restricted local browser participants. No E2B or model API key is required; inference is remote, and model access and account quota remain untested.", readiness)
+            ? readyMessage("Codex CLI and ChatGPT login are ready for restricted local browser participants. No E2B or model API key is required; inference is remote, and model access and account quota remain untested.", readiness)
             : `Local Codex participant setup is unavailable (${readiness.errorCode}). ${codexRecovery(readiness, "Install the supported Codex CLI version and sign in with a ChatGPT account.")} No API fallback is used.`,
     };
 }
+/**
+ * The discovery and planning functions doctor's study checks use, loaded on first use as
+ * labSetupChecks always loaded them, so they stay out of this module's static imports.
+ */
+async function studyLoaders() {
+    const discover = await import("./discover.js");
+    const plan = await import("./plan.js");
+    return {
+        listStudies: discover.listLabManifests,
+        resolveStudy: discover.resolveLabManifest,
+        resolveDryRun: plan.resolveLabDryRun,
+        routeOf: plan.routeOf,
+    };
+}
 /**
  * Setup checks only: no model turn, browser or desktop creation. CLI startup may use the network.
  * `keys` are the keys a live run requires. `reads` are the provider keys the lab is known to read,
@@ -121,9 +135,8 @@ export async function localCodexParticipantCheck(args) {
  * scorer's host code may read any key.
  */
 export async function labSetupChecks(args) {
-    const { resolveLabManifest } = await import("./discover.js");
-    const { resolveLabDryRun, routeOf } = await import("./plan.js");
-    const resolved = await resolveLabManifest(args.cwd, args.lab);
+    const { resolveStudy, resolveDryRun, routeOf } = await studyLoaders();
+    const resolved = await resolveStudy(args.cwd, args.lab);
     if (!resolved.ok)
         return {
             desktop: false,
@@ -131,7 +144,7 @@ export async function labSetupChecks(args) {
             checks: [{ name: "lab", ok: false, message: resolved.error.message }],
         };
     const config = resolved.config, route = routeOf(config);
-    const dryRun = resolveLabDryRun(config, undefined, true) === true;
+    const dryRun = resolveDryRun(config, undefined, true) === true;
     const checks = [
         {
             name: "lab route",
@@ -298,19 +311,21 @@ async function analysisCheck(analysis, args, checkAccount) {
             ? "Use Linux x64 or the Apple Silicon Mac with a supported Codex CLI, or explicitly select provider: openai with an API key."
             : readiness.errorCode === "codex_busy"
                 ? "Another restricted Codex analyst or setup check is active in this process. Wait for it to finish, then retry."
-                : codexRecovery(readiness, "Install the qualified CLI and sign in with a ChatGPT account.");
+                : codexRecovery(readiness, "Install the Codex CLI and sign in with a ChatGPT account.");
         return {
             name: "post-run analysis",
             ok: readiness.ready,
             message: readiness.ready
-                ? readyMessage("Qualified Codex CLI and ChatGPT account login are ready for a separate restricted analyst. Analysis sends selected evidence to remote inference; model access and account allowance remain untested. Dollar cost and output-token ceilings are unavailable.", readiness)
+                ? readyMessage("Codex CLI and ChatGPT account login are ready for a separate restricted analyst. Analysis sends selected evidence to remote inference; model access and account allowance remain untested. Dollar cost and output-token ceilings are unavailable.", readiness)
                 : `Codex account analysis is unavailable (${readiness.errorCode ?? "codex_unavailable"}). ${recovery} No API fallback is used; participant readiness is independent.`,
         };
     }
+    const keyed = args.keyPresent("OPENAI_API_KEY");
     return {
         name: "post-run analysis",
         ok: true,
-        message: args.keyPresent("OPENAI_API_KEY")
+        ...(keyed ? {} : { status: "note" }),
+        message: keyed
             ? `OPENAI_API_KEY is present for the separate automatic analysis request; model access and quota are not tested. The analysis is refused before it starts if its estimate is over $${analysis.maxCostUsd}; this is not a billing cap. Participant readiness is independent.`
             : "Will be skipped: OPENAI_API_KEY is missing. The participant may run, but there will be no automatic findings report. Add an OpenAI API key or set review.analysis: false deliberately.",
     };
@@ -325,6 +340,29 @@ function checkScope(analysis) {
             : "Local setup only. Provider credentials are not validated, model access/quota and target reachability are untested, and no paid resources were created.",
     };
 }
+/**
+ * The ids of the project's labs that need each provider key for a live run, from the same plan
+ * `doctor --lab` reads. Each listed manifest resolves by its path, since a file name need not match
+ * the id inside. A lab that runs dry, that the plain CLI cannot run, or that does not plan needs
+ * none.
+ */
+export async function studiesByRequiredKey(cwd, keyPresent) {
+    const { listStudies, resolveStudy, resolveDryRun, routeOf } = await studyLoaders();
+    const users = new Map();
+    for (const entry of (await listStudies(cwd)).studies) {
+        const resolved = await resolveStudy(cwd, entry.path);
+        if (!resolved.ok || resolveDryRun(resolved.config, undefined, true) === true)
+            continue;
+        if (unsupportedCliRoute(resolved.config, routeOf(resolved.config)))
+            continue;
+        const planned = await planCliRun(resolved.config, cwd);
+        if (!planned.ok)
+            continue;
+        for (const key of requiredKeys(planned.planned.plan.requirements, keyPresent))
+            users.set(key, (users.get(key) ?? new Set()).add(entry.id));
+    }
+    return new Map([...users].map(([key, ids]) => [key, [...ids]]));
+}
 /**
  * The lab planned with no run options, so its own scenario mode decides dry or live. Doctor and the
  * TUI read a live run's keys and subject env from this plan's requirements.