humanish 0.110.4 → 0.111.1

package/dist/study/types.d.ts

@@ -3,7 +3,6 @@ import type { StudyTask } from "./tasks.js";
 import type { DwellWindow, StopWhen } from "../actors/stop-conditions.js";
 import { type ReasoningEffort } from "../actors/reasoning-effort.js";
 import type { StudyRoute } from "./routing.js";
-export declare const V2_SCHEMA = "humanish.lab.v2";
 /** The study format: it declares its route, one actor, its participants and one caps block. */
 export declare const STUDY_SCHEMA = "humanish.study.v3";
 export declare const ID_PATTERN: RegExp;
@@ -18,16 +17,6 @@ export declare const ID_PATTERN: RegExp;
  * error, never a desktop attempt. See docs/architecture/state-driven-executor.md.
  */
 type StudySubjectSource = "this-repo" | "clone" | "app-url" | "local-app" | "terminal-product" | "desktop-cli" | "local-tree";
-/**
- * How a subject's world relates across participants. `per-lane-worlds` (the default; absent ==
- * this) is the only fan-out topology the computer-use route ships: N participants, N independent
- * worlds, isolation + per-participant attribution. `shared-world` is the declared override: one
- * mutable service plane that N participants use at the same time, so their actions interact through
- * shared state. Consumed only on the shared-world routes (a provisioned clone plane, or an
- * external-public app-url plane) with a computer-use actor; inert/warned everywhere else
- * (claims match mechanism).
- */
-type StudySubjectTopology = "per-lane-worlds" | "shared-world";
 export interface StudySubjectClone {
     /** git clone depth; 1 (shallow) by default. Consumed on the computer-use clone route. */
     depth?: number;
@@ -189,26 +178,18 @@ export interface StudySubjectProduct {
 }
 export interface StudySubject {
     source: StudySubjectSource;
-    /**
-     * World topology across participants. Absent == `per-lane-worlds` (the isolation default; every
-     * existing study is byte-stable). `shared-world` is the declared override: one mutable service
-     * plane, N participants at once, each in its role. Consumed only on the shared-world routes (a
-     * provisioned clone or an external-public app-url plane, a computer-use actor, and a roster of ≥2
-     * participants); inert/warned elsewhere.
-     */
-    topology?: StudySubjectTopology;
     /**
      * Concurrent shared-world route only: the author's required attestation that the
      * subject behind the internet-reachable `getHost` URL is synthetic seeded data. The concurrent
      * route exposes the subject on a tokenless public URL for the run's duration, so real/external
      * data must never sit behind it. This is author-trust + a provenance gate (verify also requires
      * `subject.state.provenance == "seeded"`). It does not guarantee the data is synthetic. Required when
-     * `topology: shared-world` + `execution.concurrency > 1`; inert/warned elsewhere.
+     * `route: shared-world` + `execution.concurrency > 1`; inert/warned elsewhere.
      */
     exposure?: "synthetic";
     /**
      * External-public shared-world route only: the author's required ownership
-     * attestation when a real public deployment (`source: app-url` + `topology: shared-world` +
+     * attestation when a real public deployment (`source: app-url` + `route: shared-world` +
      * `concurrency > 1` + `policies.allowPublicTargets: true`) is used directly as the shared plane.
      * The harness neither provisions nor exposes this target (no getHost, no clone, no seed), so it
      * cannot attest the data is synthetic; instead the operator must attest they own/operate it.
@@ -276,12 +257,6 @@ export interface StudySubject {
      */
     localTree?: StudySubjectLocalTree;
 }
-export interface StudyParticipantFocus {
-    id?: string;
-    label?: string;
-    /** Per-participant steer appended to the actor's mission. Consumed on the app-url route. */
-    instruction?: string;
-}
 /**
  * One participant in a differentiated fan-out on the computer-use E2B route (`per-lane-worlds`).
  * Each entry becomes an independent E2B desktop sandbox with its own persona/device/starting-steer. All
@@ -294,7 +269,7 @@ export interface StudyParticipantEntry {
     id?: string;
     /**
      * App-defined actor type label for grouping simulated users ("operator", "viewer",
-     * "maintainer", etc.). It is separate from the execution actor dispatch key (`actors[0].type`);
+     * "maintainer", etc.). It is separate from the execution actor dispatch key (`actor.type`);
      * it is adapter-owned taxonomy for roster/readback.
      */
     actorType?: string;
@@ -302,7 +277,7 @@ export interface StudyParticipantEntry {
     surface?: string;
     /** App-defined correlation id tying participants to one shared case/account/work item. */
     caseGroup?: string;
-    /** Persona id/label threaded into this participant's actor prompt. Default: actors[0].persona. */
+    /** Persona id/label threaded into this participant's actor prompt. Default: actor.persona. */
     persona?: string;
     /** Named hosted-screen preset for this participant. XOR raw execution.desktop.resolution. */
     device?: string;
@@ -345,17 +320,6 @@ export interface StudyParticipantEntry {
      */
     host?: boolean;
 }
-/**
- * Compact authoring sugar for repeated participant groups. The parser expands each group into concrete
- * `lanes[]` with deterministic ids (`<group.id>-01`, `<group.id>-02`, ...). The runtime never
- * consumes this shape directly; it always sees ordinary `LabActorLane` entries.
- */
-export interface StudyActorRosterGroup extends Omit<StudyParticipantEntry, "id"> {
-    /** Public-safe group id; prefixes generated participant ids. */
-    id: string;
-    /** Number of participants to generate for this group. */
-    count: number;
-}
 export interface StudyActor {
     /**
      * The actor label. On computer-use (including shared-world), scripted-browser, and
@@ -365,18 +329,8 @@ export interface StudyActor {
      * the descriptor for dispatch and capability enforcement.
      */
     type: string;
-    /** Participant count, route-specific (see the scope header in config.ts): synthetic simCount; scripted
-     *  surface roster {1 = desktop, 2 = desktop + mobile, default 1}; computer-use E2B route the
-     *  homogeneous fan-out participant count (cap 16). XOR `lanes`. */
-    count?: number;
-    /** Computer-use E2B route: a differentiated fan-out roster (`per-lane-worlds`). XOR `count`,
-     *  `roster`, and `laneFocus`. Cap 16 participants. Consumed only on the cua E2B route
-     *  (inert/warned elsewhere). */
-    lanes?: StudyParticipantEntry[];
     /** Persona id/label threaded into the actor prompt. Consumed on the app-url route. */
     persona?: string;
-    /** Consumed on the app-url route (laneFocus.instruction appended to the mission). XOR `lanes`. */
-    laneFocus?: StudyParticipantFocus;
     /** Free-form mission threaded into the actor prompt. Consumed on the app-url route. A mission on
      *  its own is a complete, valid study; `tasks` is additive, never required. */
     mission?: string;
@@ -404,7 +358,7 @@ export interface StudyActor {
      */
     localAgent?: "codex" | "claude";
     /**
-     * How hard the model is asked to think, per turn. A `lanes[]` entry's `reasoningEffort` overrides this.
+     * How hard the model is asked to think, per turn. A `participants` entry's `reasoningEffort` overrides this.
      *
      * Absent means the provider's default, and absence is recorded as absence: a run that did not
      * declare an effort does not claim one. Support is model-dependent (see src/actors/reasoning-effort.ts),
@@ -419,12 +373,12 @@ export interface StudyActor {
      */
     reasoningEffort?: ReasoningEffort;
     /**
-     * Deterministic completion guard used as the default for CUA participants. A `lanes[]` entry's stopWhen
+     * Deterministic completion guard used as the default for CUA participants. A `participants` entry's stopWhen
      * overrides this value.
      */
     stopWhen?: StopWhen;
     /**
-     * A declared observation window, the default for every participant; a `lanes[]` entry's dwell overrides
+     * A declared observation window, the default for every participant; a `participants` entry's dwell overrides
      * it. `when` is a stopWhen-shaped condition (absent: the window opens after the first
      * observation); `ms` is the hold, `everyMs` the frame cadence (default 10 s), `then` whether
      * the participant continues afterwards (default) or the session ends. The harness takes no
@@ -545,20 +499,6 @@ export interface StudyExecution {
      */
     concurrency?: number;
     desktop?: StudyExecutionDesktop;
-    /**
-     * Blast-radius budget for each computer-use participant. Consumed on the computer-use route:
-     * `caps.maxUsd`, when set, is a fail-closed abort: the session stops the moment its running
-     * estimated spend crosses it (the runaway-retry guard), and a cap on a model src/run/pricing.ts
-     * cannot price is refused at preflight rather than run uncapped. It is a per-participant cap:
-     * enforced inside each participant's loop, so an N-participant fan-out can spend up to N × maxUsd
-     * before any participant aborts (the run warns with the true ~N × cap ceiling).
-     * `caps.maxTotalUsd` is the shared study budget: one ledger across every participant, the knob a
-     * researcher actually reasons with. Absent = uncapped (the historical CUA behavior); maxUsd: 0
-     * still permits a request before reported usage trips it. Inert (warned) on non-computer-use
-     * routes. Reuses the same StudyScenarioCaps shape as the terminal route's `scenario.caps` (not a
-     * fork).
-     */
-    caps?: StudyScenarioCaps;
     /** `terminal-product` route: the terminal transport + stdin posture. Consumed on that route. */
     terminal?: StudyExecutionTerminal;
     /** `terminal-product` route: runtime key placement, defaulting to openai-egress, an external
@@ -571,6 +511,7 @@ export interface StudyExecution {
     };
     /**
      * `terminal-product` route: outbound routing allowlist passed to E2B with a deny-all fallback.
+     * Every other route leaves egress open and ignores it with a warning; 0.112.0 refuses it there.
      * Domain filtering is a routing control, not strict destination isolation on shared hosting.
      * It does not constrain spending through an allowed runtime provider, including when
      * openai-egress keeps the raw runtime key outside the sandbox.
@@ -584,48 +525,45 @@ export interface StudyExecution {
      */
     egressAllow?: string[];
 }
-type StudyScenarioMode = "dry-run" | "live";
+type StudyMode = "dry-run" | "live";
 /**
- * The blast-radius budget for a route that passes a live key to an in-sandbox command.
- * Per the safety contract, the live key is never exercised without a fail-closed cap in force.
- * All values are non-negative numbers (0 is the no-spend default). Live runs require maxUsd and a
- * positive maxMinutes; maxUsd/maxJobs are checked after the session against known ledger signals
- * and maxMinutes is enforced as the command wall clock. Codex tokens are unpriced, so a live run
- * refuses a positive maxUsd unless a costProbe measures spend (HUMANISH_TERMINAL_UNPRICED_CAP).
+ * A study's spend, job and time caps, the top-level `caps` block. Each route reads its own keys, and
+ * parseStudy refuses a key the route does not read. All values are non-negative numbers.
+ *
+ * Computer use and shared world read `maxUsd` and `maxTotalUsd`. `maxUsd`, when set, is a
+ * fail-closed abort for each participant: the session stops the moment its running estimated spend
+ * crosses it (the runaway-retry guard), and a cap on a model src/run/pricing.ts cannot price is
+ * refused at preflight rather than run uncapped. It is enforced inside each participant's loop, so
+ * an N-participant fan-out can spend up to N × maxUsd before any participant aborts (the run warns
+ * with the true ~N × cap ceiling). Absent = uncapped; maxUsd: 0 still permits a request before
+ * reported usage trips it.
+ *
+ * The terminal route passes a live key to an in-sandbox command, and per the safety contract the
+ * live key is never exercised without a fail-closed cap in force. It reads `maxUsd`, `maxJobs` and
+ * `maxMinutes` (0 is the no-spend default). Live runs require maxUsd and a positive maxMinutes;
+ * maxUsd/maxJobs are checked after the session against known ledger signals and maxMinutes is
+ * enforced as the command wall clock. Codex tokens are unpriced, so a live run refuses a positive
+ * maxUsd unless a costProbe measures spend (HUMANISH_TERMINAL_UNPRICED_CAP).
  */
-export interface StudyScenarioCaps {
+export interface StudyCaps {
     /** Max USD the run may spend (provider + product). 0 = no-spend. */
     maxUsd?: number;
     /**
      * study-level model-spend budget, the number a researcher actually reasons with: "this
      * study is N participants, roughly $X", decided once, up front, where recruiting decisions are
-     * made. The computer-use route reads it from `execution.caps.maxTotalUsd` only: every participant's
-     * running estimated model spend feeds one shared ledger, and the moment the run total crosses
-     * this, each participant stops at its next turn with `budget_reached` (status `incomplete`:
-     * the participant ran out of budget; never `gave_up`, because a study-level stop is not the
-     * participant's doing). Estimated model spend only; desktop-minutes ride the cost summary but
-     * not this ledger. Independent of the per-participant `maxUsd` backstop; either, both, or neither may
-     * be set. A positive `scenario.caps.maxTotalUsd` on a computer-use study is a parse error; on the
-     * terminal route it is inert (warned), since the single agent's maxUsd already caps the run.
+     * made. Computer use and shared world only: every participant's running estimated model spend
+     * feeds one shared ledger, and the moment the run total crosses this, each participant stops at
+     * its next turn with `budget_reached` (status `incomplete`: the participant ran out of budget;
+     * never `gave_up`, because a study-level stop is not the participant's doing). Estimated model
+     * spend only; desktop-minutes ride the cost summary but not this ledger. Independent of the
+     * per-participant `maxUsd` backstop; either, both, or neither may be set.
      */
     maxTotalUsd?: number;
-    /** Max billable product jobs the agent may trigger. 0 = none. */
+    /** Terminal: max billable product jobs the agent may trigger. 0 = none. */
     maxJobs?: number;
-    /** Max wall-clock minutes for the agent session. */
+    /** Terminal: max wall-clock minutes for the agent session. */
     maxMinutes?: number;
 }
-export interface StudyScenario {
-    /** Reference a committed scenario by id (humanish/scenarios/<ref>.yaml) or path. Consumed
-     *  (and required) on the scripted-browser route; forward-declared elsewhere. */
-    ref?: string;
-    /** Or inline the scenario body. Forward-declared: no route reads it yet, so a set value warns. */
-    inline?: Record<string, unknown>;
-    /** dry-run = a synthetic bundle with no provider spend; live = real run. Consumed. */
-    mode?: StudyScenarioMode;
-    /** Spend/job/time caps. Consumed (recorded in the bundle) on the terminal-product route;
-     *  inert (warned) elsewhere. */
-    caps?: StudyScenarioCaps;
-}
 export interface StudyPolicies {
     /**
      * Redact target repo labels in durable artifacts. Consumed on the computer-use,
@@ -722,7 +660,7 @@ export interface StudyCommsReceivingEmail {
 interface StudyCommsCaptureEmail {
     connection?: never;
     allowedOrigins?: never;
-    /** Which implementation backs the inbox (a backend discriminator, distinct from `scenario.mode`):
+    /** Which implementation backs the inbox (a backend discriminator, distinct from `mode`):
      *  `fake` (default) is an in-harness in-memory inbox in the Fowler test-double sense: an in-sandbox
      *  catch captures the app's sends. Provider-backed receiving uses the separate
      *  StudyCommsReceivingEmail configuration selected by a saved connection. */
@@ -789,45 +727,28 @@ export interface StudyCommsRecipient {
      *  for the persona surface's default address (not drain-matched). */
     address?: string;
 }
-export interface StudyConfig {
-    /** The format the file was written in. Both parse into this one shape. */
-    schema: typeof V2_SCHEMA | typeof STUDY_SCHEMA;
-    id: string;
-    title?: string;
-    description?: string;
-    subject: StudySubject;
-    actors: StudyActor[];
-    execution?: StudyExecution;
-    /** Forward-declared: no route reads it yet, so a set value warns. */
-    personas?: Record<string, unknown>[];
-    scenario?: StudyScenario;
-    policies?: StudyPolicies;
-    review?: StudyReview;
-    defaults?: StudyDefaults;
-    comms?: StudyComms;
-}
 /**
- * A humanish.study.v3 file as src/study/parse/study.ts reads it: the declared route, one actor, its
- * participants and one caps block. It has the keys the file has. parseStudy still returns the
- * StudyConfig above.
+ * A humanish.study.v3 study as parseStudy returns it, with the keys the file has: the declared
+ * route, one actor, its participants and one caps block.
  */
-export interface StudyV3 {
+export interface StudyConfig {
     schema: typeof STUDY_SCHEMA;
     id: string;
     title?: string;
     description?: string;
+    /** The route the study declares. parseStudy refuses one its subject and actor do not take. */
     route: StudyRoute;
     /** Absent: a dry run. */
-    mode?: StudyScenarioMode;
-    subject: Omit<StudySubject, "topology">;
-    actor: Omit<StudyActor, "count" | "lanes" | "laneFocus">;
+    mode?: StudyMode;
+    subject: StudySubject;
+    actor: StudyActor;
     /** Preview, computer-use and shared-world, in the form the file used. */
     participants?: StudyParticipants;
     /** Scripted only. */
     surfaces?: StudySurfaces;
     /** The caps keys the route reads. */
-    caps?: StudyScenarioCaps;
-    execution?: Omit<StudyExecution, "caps">;
+    caps?: StudyCaps;
+    execution?: StudyExecution;
     /** Scripted: a committed scenario id or path. */
     scenario?: string;
     policies?: StudyPolicies;
@@ -836,15 +757,17 @@ export interface StudyV3 {
     comms?: StudyComms;
 }
 /**
- * A count, a count with one instruction for every participant, or a list. A list entry with a
- * `count` is expanded into its participants, `<id>-01` to `<id>-NN`.
+ * A count, a count with one instruction for every participant, or a list. parseStudy expands a list
+ * entry with a `count` into its participants, `<id>-01` to `<id>-NN`.
  */
 type StudyParticipants = number | StudyParticipantGroup | StudyParticipantEntry[];
-interface StudyParticipantGroup {
+/** `participants` as identical participants that share one instruction. */
+export interface StudyParticipantGroup {
     count?: number;
     instruction?: string;
 }
-type StudySurfaces = readonly ["desktop"] | readonly ["desktop", "mobile"];
+/** The scripted surfaces: desktop, or desktop and mobile. */
+export type StudySurfaces = readonly ["desktop"] | readonly ["desktop", "mobile"];
 interface StudyParseSuccess {
     ok: true;
     config: StudyConfig;

package/dist/study/types.js

@@ -1,6 +1,5 @@
 import {} from "../analysis/automatic-config.js";
 import {} from "../actors/reasoning-effort.js";
-export const V2_SCHEMA = "humanish.lab.v2";
 /** The study format: it declares its route, one actor, its participants and one caps block. */
 export const STUDY_SCHEMA = "humanish.study.v3";
 // Must start alphanumeric so an id never collides with the path-vs-id resolver heuristic

package/dist/study/url-credentials.js

@@ -1,8 +1,7 @@
 // Every URL a study config declares, checked for a credential. Route planners call it, since a
 // library caller's config skips the parser that refuses these first.
-import { rosterOf } from "./parse/actors.js";
 import { entryCredentialReason, urlCredentialReason } from "./parse/url-credentials.js";
-import { actorsOf } from "./study-fields.js";
+import { participantList } from "./study-fields.js";
 /**
  * The first URL in `config` that carries a credential, with why: the subject's app, serve and
  * public surface URLs, and each participant's target and entry.
@@ -17,14 +16,14 @@ export function studyUrlCredentialReason(config) {
             ? undefined
             : urlCredentialReason("subject.serve.url", subject.serve.url),
         ...(subject.product?.publicSurfaces ?? []).map((surface) => () => urlCredentialReason("subject.product.publicSurfaces", surface)),
-        ...actorsOf(config).flatMap((actor) => (rosterOf(actor) ?? []).flatMap((participant, index) => [
+        ...(participantList(config) ?? []).flatMap((participant, index) => [
             () => participant.target === undefined
                 ? undefined
                 : urlCredentialReason(`participants[${index}].target`, participant.target),
             () => participant.entry === undefined
                 ? undefined
                 : entryCredentialReason(`participants[${index}].entry`, participant.entry),
-        ])),
+        ]),
     ];
     for (const reason of reasons) {
         const found = reason();

package/dist/study/validation.d.ts

@@ -7,7 +7,7 @@ import type { StudyConfig } from "./types.js";
  */
 export declare function computerUseValidationReason(config: StudyConfig): string | null;
 /**
- * Cross-validate a `topology: shared-world` declaration. Returns the failure message, or
+ * Cross-validate a `route: shared-world` declaration. Returns the failure message, or
  * null when the one shared-world route can run it: the external-public checks for an app-url
  * subject, the provisioned checks otherwise. Enforced at parse and again by the route, since
  * runStudyWith takes a config that skipped the parser.
@@ -34,14 +34,6 @@ export declare function taskProtocolValidationReason(config: StudyConfig, suppor
  * at parse and again on the computer-use and scripted-browser routes for library callers.
  */
 export declare function cloneTargetValidationReason(config: StudyConfig): string | null;
-/**
- * Refuse a positive `scenario.caps.maxUsd` or `maxTotalUsd` on a computer-use study.
- * `scenario.caps` belongs to the terminal route; the computer-use route stops on `execution.caps`,
- * so a dollar figure here would read as a cap while the study ran uncapped. Zero spends nothing
- * either way and stays a warning. Enforced at parse and again on the computer-use routes for
- * library callers.
- */
-export declare function scenarioCapsValidationReason(config: StudyConfig): string | null;
 /** Refuse a claimed output bound when the route cannot pass it to the first-party provider. */
 export declare function outputTokenLimitValidationReason(config: StudyConfig): string | null;
 /**
@@ -60,7 +52,7 @@ export declare function concurrentSharedWorldValidationReason(config: StudyConfi
  * it rejects every provisioned-subject field (serve/state.seed/state.checkpoint/exposure/clone/repos
  * are inert with no sandbox, so they fail closed), and requires a
  * non-loopback appUrl + allowPublicTargets + the operator-ownership attestation subject.publicTarget +
- * concurrency >= 2 + an actors[0].lanes roster of ≥2 with exactly one host participant. The getHost synthetic
+ * concurrency >= 2 + a `participants` list of ≥2 with exactly one host participant. The getHost synthetic
  * gate is deliberately unreachable here (there is no internet-reachable harness-owned URL to attest).
  * Enforced at parse and re-enforced in the engine (runStudyWith takes a config that skipped the parser).
  */

package/dist/study/validation.js

@@ -1,9 +1,9 @@
 import { isMaxOutputTokens } from "../actors/output-token-limit.js";
-import { PARTICIPANT_ID_MAX_CHARS, PARTICIPANT_ID_PATTERN, focusOf } from "./parse/actors.js";
+import { PARTICIPANT_ID_MAX_CHARS, PARTICIPANT_ID_PATTERN } from "./parse/actors.js";
 import { isHttpUrl, isLoopbackUrl } from "./parse/subject.js";
 import { declaredTargets } from "./plan-participants.js";
 import { actorResolvesToComputerUse, computerUseParticipantCount, MAX_COMPUTER_USE_PARTICIPANTS, registeredComputerUseActors, resolveEntryUrl, isComputerUseComposition, isScriptedBrowserComposition, isSharedWorldComposition, isTerminalProductComposition, } from "./routing.js";
-import { actorOf, actorsOf, participantList, declaredParticipantCount, declaresSharedWorld, } from "./study-fields.js";
+import { participantList } from "./study-fields.js";
 /**
  * Cross-validate the computer-use fan-out declaration (`per-lane-worlds`). Returns the failure
  * message, or null when valid. The parser enforces it, and runStudyWith checks it again for a config
@@ -11,25 +11,18 @@ import { actorOf, actorsOf, participantList, declaredParticipantCount, declaresS
  * validity, unique ids) first, then the route-scoped XOR, cap and policy checks.
  */
 export function computerUseValidationReason(config) {
-    const actor = actorOf(config);
     const roster = participantList(config);
     const structuralReason = rosterStructuralValidationReason(config);
     if (structuralReason) {
         return structuralReason;
     }
     // clone.fanout is a declared behavior change: rejected on the computer-use route (was
-    // inert-warned). Fan-out is declared via `actors[0].count` or `actors[0].lanes`;
-    // subject.clone.fanout never applied here.
+    // inert-warned). Fan-out is declared with `participants`; subject.clone.fanout never applied
+    // here.
     if (config.subject.clone?.fanout !== undefined) {
         return "`subject.clone.fanout` is not used on the computer-use route: declare fan-out with participants (homogeneous) or participants (a roster of participants). (No current route reads clone.fanout.)";
     }
     if (roster !== undefined) {
-        if (declaredParticipantCount(config) !== undefined) {
-            return "Set either `actors[0].count` (identical participants) or `actors[0].lanes` (a roster of distinct participants), not both.";
-        }
-        if (focusOf(actor) !== undefined) {
-            return "actors[0].laneFocus and actors[0].lanes are mutually exclusive: each roster entry's `instruction` is the fan-out steer; laneFocus is the steer for a single participant.";
-        }
         if (config.execution?.desktop?.resolution !== undefined &&
             roster.some((entry) => entry.device !== undefined)) {
             return "participants[].device and a raw execution.desktop.resolution are mutually exclusive: a per-participant device preset and a single hand-set resolution cannot both govern participant geometry.";
@@ -54,13 +47,13 @@ export function computerUseValidationReason(config) {
     // Public targets fan out into N independent worlds driving the same public app, which is an
     // ambiguous shared-world-ish shape, not a per-participant target swarm. Permit N>1 public runs only
     // when every roster entry declares its own target, making the adapter-owned topology explicit. But when
-    // `subject.topology: shared-world` is also declared, N participants against one public target is the
+    // `route: shared-world` is also declared, N participants against one public target is the
     // external-public shared-world topology, so route it there (a real public deployment
     // as the shared plane) instead of refusing; externalPublicSharedWorldValidationReason then applies.
     if (participantCount > 1 &&
         config.policies?.allowPublicTargets === true &&
         declaredTargets(config).length === 0 &&
-        !declaresSharedWorld(config)) {
+        config.route !== "shared-world") {
         return "`policies.allowPublicTargets` with more than one participant sends them all to one public app, which is a shared world. Set `route: shared-world` to run them together there, give each `participants[]` entry its own `target`, or run one participant.";
     }
     return null;
@@ -98,7 +91,7 @@ function rosterStructuralValidationReason(config) {
     return null;
 }
 /**
- * Cross-validate a `topology: shared-world` declaration. Returns the failure message, or
+ * Cross-validate a `route: shared-world` declaration. Returns the failure message, or
  * null when the one shared-world route can run it: the external-public checks for an app-url
  * subject, the provisioned checks otherwise. Enforced at parse and again by the route, since
  * runStudyWith takes a config that skipped the parser.
@@ -110,8 +103,8 @@ export function sharedWorldValidationReason(config) {
 }
 /**
  * The structural checks every provisioned shared world shares. It requires: a clone or local-tree source + e2b-desktop
- * target + a computer-use actor + a `subject.serve` block + an `actors[0].lanes` roster of ≥2 roles (the
- * roster is the role roster; there is no separate roles[] field), and every role `entry` must resolve
+ * target + a computer-use actor + a `subject.serve` block + a `participants` list of ≥2 (the list
+ * is the role roster; there is no separate roles[] field), and every role `entry` must resolve
  * same-origin (loopback) with serve.url. Fail-closed: a half-declared shared-world is rejected,
  * never silently downgraded.
  */
@@ -126,7 +119,7 @@ function provisionedSharedWorldStructureReason(config) {
     if (config.execution?.target !== "e2b-desktop") {
         return "`route: shared-world` requires `execution.target: e2b-desktop`: the role participants drive hosted desktop browsers against one in-sandbox app.";
     }
-    if (!actorResolvesToComputerUse(actorOf(config)?.type)) {
+    if (!actorResolvesToComputerUse(config.actor?.type)) {
         return `\`route: shared-world\` requires a registered computer-use actor (one of: ${registeredComputerUseActors().join(", ")}); each role participant runs a computer-use session.`;
     }
     const serve = config.subject.serve;
@@ -149,7 +142,7 @@ function provisionedSharedWorldStructureReason(config) {
 }
 /** SMTP capture runs only where each participant has its own world, so a shared world refuses it. */
 export function smtpValidationReason(config) {
-    return config.comms?.email?.smtp && declaresSharedWorld(config)
+    return config.comms?.email?.smtp && config.route === "shared-world"
         ? "SMTP capture is not supported yet for shared-world studies. Use the default per-lane-worlds topology for SMTP, or configure supported HTTP email capture for concurrent shared-world studies."
         : undefined;
 }
@@ -160,7 +153,7 @@ export function smtpValidationReason(config) {
  */
 export function desktopMediaValidationReason(config, supportsMedia = isComputerUseComposition(config)) {
     if (config.execution?.desktop?.recording !== undefined &&
-        (!supportsMedia || declaresSharedWorld(config) || config.subject.source === "local-app")) {
+        (!supportsMedia || config.route === "shared-world" || config.subject.source === "local-app")) {
         return "execution.desktop.recording is supported only for computer-use participants on independent desktops. Remove the declaration or select a supported route.";
     }
     const media = config.execution?.desktop?.media;
@@ -169,7 +162,7 @@ export function desktopMediaValidationReason(config, supportsMedia = isComputerU
     if (media.microphone !== undefined && media.microphone.source !== "speech") {
         return "execution.desktop.media.microphone.source must be speech. Microphone source-file injection is unsupported.";
     }
-    if (declaresSharedWorld(config)) {
+    if (config.route === "shared-world") {
         return "execution.desktop.media is unsupported on shared-world routes; declared capture devices would not be provisioned. Use independent computer-use browser participants or remove the declaration.";
     }
     if (!supportsMedia ||
@@ -181,8 +174,10 @@ export function desktopMediaValidationReason(config, supportsMedia = isComputerU
         return "execution.desktop.media requires Chrome or Chromium; Firefox cannot receive the declared synthetic capture device. Set execution.desktop.browser: chrome or chromium.";
     }
     if (media.microphone !== undefined) {
-        if (actorsOf(config).some((actor) => actor.type !== "local-agent" ||
-            (actor.localAgent !== undefined && actor.localAgent !== "codex"))) {
+        const actor = config.actor;
+        if (actor !== undefined &&
+            (actor.type !== "local-agent" ||
+                (actor.localAgent !== undefined && actor.localAgent !== "codex"))) {
             return "Participant speech currently requires local-agent with Codex, on a local or hosted desktop.";
         }
         if (config.execution?.target !== "local" && media.camera !== undefined) {
@@ -199,7 +194,7 @@ export function receivingEmailValidationReason(config) {
         !["app-url", "clone", "local-tree"].includes(config.subject.source)) {
         return "Real email receiving requires a hosted computer-use browser study with an app-url, clone, or local-tree subject. Scripted, terminal, desktop-cli and local-app routes are unsupported.";
     }
-    if (actorsOf(config).some((actor) => actor.type === "local-agent")) {
+    if (config.actor?.type === "local-agent") {
         return "Real email receiving is unavailable for local-agent: its host process does not isolate the inbox management credential. Use a hosted first-party computer-use actor.";
     }
     return undefined;
@@ -207,15 +202,8 @@ export function receivingEmailValidationReason(config) {
 /** Refuse task declarations that the selected execution path would discard.
  * Direct runners pass their actual support rather than trusting the config's dispatch shape. */
 export function taskProtocolValidationReason(config, supportsTasks = isComputerUseComposition(config) && !isSharedWorldComposition(config)) {
-    for (const [index, actor] of actorsOf(config).entries()) {
-        if (actor.tasks === undefined)
-            continue;
-        if (index > 0) {
-            return `actors[${index}].tasks is unsupported: current runners consume only actors[0]. Use the first actor's computer-use participants for a task protocol.`;
-        }
-        if (!supportsTasks) {
-            return "actor.tasks is unsupported on this execution path. Task protocols require the computer-use route, with one world per participant; shared-world, terminal-product, scripted-browser and synthetic routes do not consume them. Remove tasks only if a mission-only study is intended.";
-        }
+    if (config.actor?.tasks !== undefined && !supportsTasks) {
+        return "actor.tasks is unsupported on this execution path. Task protocols require the computer-use route, with one world per participant; shared-world, terminal-product, scripted-browser and synthetic routes do not consume them. Remove tasks only if a mission-only study is intended.";
     }
     return null;
 }
@@ -233,27 +221,9 @@ export function cloneTargetValidationReason(config) {
     const got = target === undefined ? "it is absent" : `got "${target}"`;
     return `clone subjects require \`execution.target: e2b-desktop\` (${got}): humanish clones and serves the repo inside a hosted desktop sandbox. \`execution.target: local\` applies to app-url and local-app subjects.`;
 }
-/**
- * Refuse a positive `scenario.caps.maxUsd` or `maxTotalUsd` on a computer-use study.
- * `scenario.caps` belongs to the terminal route; the computer-use route stops on `execution.caps`,
- * so a dollar figure here would read as a cap while the study ran uncapped. Zero spends nothing
- * either way and stays a warning. Enforced at parse and again on the computer-use routes for
- * library callers.
- */
-export function scenarioCapsValidationReason(config) {
-    if (!isComputerUseComposition(config))
-        return null;
-    for (const key of ["maxUsd", "maxTotalUsd"]) {
-        const value = config.scenario?.caps?.[key];
-        if (value === undefined || value <= 0)
-            continue;
-        return `scenario.caps.${key} (${value}) does not cap a computer-use study: this route stops on execution.caps.${key}. Move the value to execution.caps.${key}; scenario.caps applies only to terminal-product studies.`;
-    }
-    return null;
-}
 /** Refuse a claimed output bound when the route cannot pass it to the first-party provider. */
 export function outputTokenLimitValidationReason(config) {
-    const actor = actorOf(config);
+    const actor = config.actor;
     if (actor?.maxOutputTokens === undefined)
         return null;
     if (!isMaxOutputTokens(actor.maxOutputTokens))
@@ -317,7 +287,7 @@ export function concurrentSharedWorldValidationReason(config) {
  * it rejects every provisioned-subject field (serve/state.seed/state.checkpoint/exposure/clone/repos
  * are inert with no sandbox, so they fail closed), and requires a
  * non-loopback appUrl + allowPublicTargets + the operator-ownership attestation subject.publicTarget +
- * concurrency >= 2 + an actors[0].lanes roster of ≥2 with exactly one host participant. The getHost synthetic
+ * concurrency >= 2 + a `participants` list of ≥2 with exactly one host participant. The getHost synthetic
  * gate is deliberately unreachable here (there is no internet-reachable harness-owned URL to attest).
  * Enforced at parse and re-enforced in the engine (runStudyWith takes a config that skipped the parser).
  */
@@ -332,7 +302,7 @@ export function externalPublicSharedWorldValidationReason(config) {
     if (config.execution?.target !== "e2b-desktop") {
         return "the external-public shared-world route requires `execution.target: e2b-desktop`: the role participants drive hosted desktop browsers against the one public deployment.";
     }
-    if (!actorResolvesToComputerUse(actorOf(config)?.type)) {
+    if (!actorResolvesToComputerUse(config.actor?.type)) {
         return `the external-public shared-world route requires a registered computer-use actor (one of: ${registeredComputerUseActors().join(", ")}); each role participant runs a computer-use session.`;
     }
     const roster = participantList(config);

package/dist/study/warnings.d.ts

@@ -1,12 +1,20 @@
 import type { StudyConfig } from "./types.js";
 /**
- * The fields a config sets that its route does not read, each as `field` or `field (reason)`. A v2
- * file gets them as one warning; a v3 study is refused for any of them.
+ * The fields a config sets that its route does not read, each as `field` or `field (reason)`.
+ * parseStudy refuses a study for any of them.
  */
 export declare function inertFieldLabels(config: StudyConfig): string[];
 /**
  * The same fields as `inertFieldLabels`, as paths without their reasons, such as
- * `actors[0].lanes[].entry` or `execution.timeoutMs`. `humanish migrate` drops each one.
+ * `participants[].entry` or `execution.timeoutMs`. `humanish migrate` drops each one.
  */
 export declare function inertFieldPaths(config: StudyConfig): string[];
+/**
+ * The warning for `execution.egressAllow` on a route that ignores it, or undefined. Only the
+ * terminal route creates its sandbox with the list as an outbound allowlist; on any other route the
+ * study author would trust a list that blocks nothing. `humanish study check` and every run print
+ * it, and the run records it in its bundle.
+ * Removed in 0.112.0: deprecated on 2026-10-05. 0.112.0 refuses the field off the terminal route.
+ */
+export declare function egressAllowIgnoredWarning(config: StudyConfig): string | undefined;
 export declare function forwardDeclaredWarnings(config: StudyConfig): string[];