humanish 0.111.2 → 0.111.3

package/dist/routes/shared-world/provisioned.js

@@ -12,9 +12,9 @@ import { provisionLocalTreeSubject } from "../../subject/local-tree.js";
 import { defaultSharedWorldPhaseSink } from "../../subject/steps.js";
 import { phaseEvent } from "../../study/run-study-events.js";
 import { loadE2BDesktopModule } from "../../substrates/e2b/sdk.js";
-import { observeDesktopResources, } from "../../substrates/e2b/desktop-resources.js";
-import { acquireE2BDesktopSandbox, readE2BRelease } from "../../substrates/e2b/sandbox.js";
+import { E2BSubjectSandbox, } from "../../substrates/e2b/subject-sandbox.js";
 import { e2bShell } from "../../substrates/e2b/shell.js";
+import { validatePreparedRunArtifactPaths } from "../../run/paths.js";
 import { defaultPackLocalTree } from "../computer-use/local-tree-pack.js";
 import { inboxRecipientFor, participantHasInboxRecipient, } from "../computer-use/participant-desktop.js";
 import { resolveSubjectState } from "../computer-use/subject-projection.js";
@@ -25,8 +25,6 @@ import { buildConcurrentSharedWorldBundle, judgeSharedWorldRun } from "./bundle.
 import { runCheckpointSnapshot } from "./checkpoints.js";
 import { drainSubjectComms } from "./comms.js";
 import { buildSubjectProvenance, hostOriginDigest, isTokenlessHost, servePort, } from "./provenance.js";
-import { SANDBOX_TIMEOUT_BUFFER_MS, SUBJECT_PROVISION_BUDGET_MS, } from "../../substrates/e2b/lifetime.js";
-import { DEFAULT_STATE_STEP_TIMEOUT_MS } from "../../subject/state.js";
 import { resolveActorEntryUrl, participantRunDeps, startParticipantFlush, } from "./participant-specs.js";
 import { CONCURRENT_SHARED_WORLD_PROVIDER_METADATA, } from "./types.js";
 import { addressedRecipients } from "../../study/parse/comms.js";
@@ -46,17 +44,10 @@ class ObserverGateError extends Error {
 class SubjectPlane {
     commsInboxUrl;
     subjectCommit;
-    subjectSandboxId;
-    subjectKilled = false;
-    subjectReleaseWarning;
+    subject;
     getHostUrl;
-    // The subject desktop's host-side span and size, priced in the run's cost estimate.
-    subjectCreatedAtMs;
-    subjectTornDownAtMs;
-    subjectResources;
     ctx;
     setup;
-    subjectAllocation;
     subjectDesktop;
     subjectShell;
     // The in-sandbox email catch on the one subject sandbox; drained at teardown. Undefined
@@ -77,6 +68,11 @@ class SubjectPlane {
     constructor(ctx, setup) {
         this.ctx = ctx;
         this.setup = setup;
+        this.subject = new E2BSubjectSandbox({
+            warnings: ctx.warnings,
+            scrub: ctx.scrubKnownValues,
+            now: ctx.now,
+        });
         this.disposeSignal = new Promise((resolve) => {
             this.releaseDispose = resolve;
         });
@@ -106,46 +102,35 @@ class SubjectPlane {
         // The one subject sandbox: headless service host (no GUI participant). The subject env is
         // provisioned here; the actor sandboxes get none of it. A custom desktop template (image) is
         // honored on both the subject sandbox (here) and every actor sandbox (via runCuaParticipant, which
-        // reads the same config); absent keeps the byte-stable Sandbox.create(opts) default. The
-        // receipt is on disk before any work, so `humanish reclaim` can kill it by exact id.
-        const subject = await acquireE2BDesktopSandbox({
+        // reads the same config); absent keeps the byte-stable Sandbox.create(opts) default.
+        this.subjectDesktop = await this.subject.acquire({
             module: subjectModule,
-            options: {
-                apiKey: this.ctx.e2bApiKey,
-                requestTimeoutMs,
-                timeoutMs: timeoutMs +
-                    SUBJECT_PROVISION_BUDGET_MS +
-                    (planeStateOf(plan)?.seed ?? []).reduce((sum, step) => sum + (step.timeoutMs ?? DEFAULT_STATE_STEP_TIMEOUT_MS), 0) +
-                    SANDBOX_TIMEOUT_BUFFER_MS,
-                metadata: {
-                    ...CONCURRENT_SHARED_WORLD_PROVIDER_METADATA,
-                    labId: plan.studyId,
-                    topology: "shared-world",
-                    topologyMode: "concurrent",
-                    kind: "subject",
-                    participantCount: String(plan.plane.participants.length),
-                },
-                ...(subjectEnvNames.length > 0 || Object.keys(commsEnv).length > 0
-                    ? {
-                        envs: {
-                            ...Object.fromEntries(subjectEnvNames.map((name) => [name, env[name]])),
-                            ...commsEnv,
-                        },
-                    }
-                    : {}),
-                dpi: 96,
-                lifecycle: { onTimeout: "kill" },
+            apiKey: this.ctx.e2bApiKey,
+            requestTimeoutMs,
+            sessionTimeoutMs: timeoutMs,
+            seed: planeStateOf(plan)?.seed ?? [],
+            metadata: {
+                ...CONCURRENT_SHARED_WORLD_PROVIDER_METADATA,
+                labId: plan.studyId,
+                topology: "shared-world",
+                topologyMode: "concurrent",
+                kind: "subject",
+                participantCount: String(plan.plane.participants.length),
+            },
+            envs: {
+                ...Object.fromEntries(subjectEnvNames.map((name) => [name, env[name]])),
+                ...commsEnv,
             },
             template: plan.residual.execution?.desktop?.template,
-            receipt: { root: this.ctx.runPaths, participantId: "subject" },
+            root: this.ctx.runPaths,
         });
-        this.subjectDesktop = subject.sandbox;
         this.subjectShell = e2bShell(this.subjectDesktop);
-        this.subjectAllocation = subject.allocation;
-        this.subjectSandboxId = subject.allocation.resourceId;
-        this.subjectCreatedAtMs = this.ctx.now();
-        this.subjectResources = await observeDesktopResources(this.subjectDesktop);
-        await this.ctx.input.prepareDesktop?.(this.subjectDesktop, { kind: "subject" });
+        if (this.ctx.input.prepareDesktop) {
+            await this.ctx.input.prepareDesktop(this.subjectDesktop, { kind: "subject" });
+            // The caller's hook runs with this process's file access, so the run directory is checked
+            // again before more evidence goes into it.
+            await validatePreparedRunArtifactPaths(this.ctx.runPaths);
+        }
     }
     // Start the in-sandbox email catch before the subject serve, so the app's send-API base URL
     // (injected into its env at create) resolves the moment it boots. Fail closed if the catch can't
@@ -320,7 +305,6 @@ class SubjectPlane {
      * Returns the comms thread's path when the drain wrote one.
      */
     async teardown() {
-        const { warnings, scrubKnownValues } = this.ctx;
         this.proberDisposed = true;
         this.releaseDispose();
         if (this.proberLoop) {
@@ -339,36 +323,9 @@ class SubjectPlane {
         if (commsEmail && this.deployedComms?.ready && this.subjectShell) {
             commsArtifactPath = await drainSubjectComms(this.ctx, commsEmail, this.subjectShell, this.deployedComms);
         }
-        if (this.subjectAllocation !== undefined) {
-            const released = await this.subjectAllocation.close();
-            const reading = readE2BRelease(released, {
-                label: "Subject sandbox",
-                scrub: scrubKnownValues,
-                costSpan: true,
-            });
-            this.subjectKilled = reading.released;
-            if (reading.warning)
-                warnings.push(reading.warning);
-            if (!reading.released)
-                this.subjectReleaseWarning = reading.warning ?? "Subject sandbox release is unconfirmed.";
-            // Without a kill method, or in E2B debug mode, no kill reached E2B, so there is no teardown
-            // time to record.
-            if (released.status !== "unconfirmed" || released.reason !== "release_unavailable")
-                this.subjectTornDownAtMs = this.ctx.now();
-        }
+        await this.subject.release();
         return commsArtifactPath;
     }
-    desktopUsage() {
-        if (this.subjectSandboxId === undefined)
-            return undefined;
-        return {
-            durationMs: this.subjectCreatedAtMs === undefined || this.subjectTornDownAtMs === undefined
-                ? undefined
-                : Math.max(0, this.subjectTornDownAtMs - this.subjectCreatedAtMs),
-            observation: this.subjectResources,
-            killed: this.subjectKilled,
-        };
-    }
 }
 /** Writes the in-progress bundle, runs the caller's Observer gate and starts the participants'
  *  flush. */
@@ -476,10 +433,10 @@ export async function runProvisionedPlane(ctx, live, setup) {
         actorResults,
         runError,
         subjectCommit: plane.subjectCommit,
-        subjectSandboxId: plane.subjectSandboxId,
-        subjectKilled: plane.subjectKilled,
-        subjectReleaseWarning: plane.subjectReleaseWarning,
-        subjectDesktop: plane.desktopUsage(),
+        subjectSandboxId: plane.subject.sandboxId,
+        subjectKilled: plane.subject.killed,
+        subjectReleaseWarning: plane.subject.releaseWarning,
+        subjectDesktop: plane.subject.desktopUsage(),
         getHostUrl: plane.getHostUrl,
         commsArtifactPath,
     };

package/dist/routes/shared-world/result.js

@@ -3,14 +3,16 @@
 import { redactText } from "../../evidence/redaction.js";
 import { adapterScoreFailureMessage, applyBrowserScorer } from "../../study/adapter-extension.js";
 import { attachObserverRuntimeStreamUrls } from "../../observer/render.js";
-import { foldScorerFailures, judgeExecution, sandboxCleanupFailure, OUTCOME_POLICIES, participantHarnessFailed, resultOk, sharedWorldShortfall, } from "../../run/judge.js";
-import { participantFactsOf, unreleasedSandboxFailures, } from "../computer-use/participant-facts.js";
+import { foldScorerFailures, judgeExecution, sandboxCleanupFailure, OUTCOME_POLICIES, resultOk, sharedWorldShortfall, } from "../../run/judge.js";
+import { validatePreparedRunArtifactPaths } from "../../run/paths.js";
+import { participantExecutionFailures } from "../computer-use/participant-facts.js";
+import { participantCapWarning } from "../computer-use/participant-model.js";
 import { resolveSubjectState } from "../computer-use/subject-projection.js";
 import { actorRunPassed, buildConcurrentSharedWorldBundle, judgeSharedWorldRun, maxSimultaneousWindows, } from "./bundle.js";
 import { planeStateOf } from "./plan.js";
 import { buildSubjectProvenance, hostOriginDigest } from "./provenance.js";
 import {} from "./types.js";
-import { studyResultIdentity } from "../../run/study-result.js";
+import { refusedResult, studyResultIdentity } from "../../run/study-result.js";
 import { plural } from "../../run/text.js";
 /** The results of a run whose plane did not run (a dry run) or has not reported yet. */
 export function emptyPlaneResults() {
@@ -143,10 +145,7 @@ function concurrentStudyError(args) {
  * and the run id the caller asked for, if any. `actor` is the label when a refusal names none.
  */
 export function concurrentStudyFailure(envelope) {
-    return (code, message, actorLabel) => ({
-        ...studyResultIdentity("shared-world", envelope.studyId),
-        ok: false,
-        cwd: envelope.cwd,
+    return (code, message, actorLabel) => refusedResult("shared-world", { studyId: envelope.studyId, cwd: envelope.cwd, error: { code, message } }, {
         actor: actorLabel ?? envelope.actor,
         topology: "shared-world",
         topologyMode: "concurrent",
@@ -155,43 +154,18 @@ export function concurrentStudyFailure(envelope) {
         dryRun: envelope.dryRun,
         runId: envelope.runId ?? "not-created",
         roles: [],
-        warnings: [],
-        error: { code, message },
     });
 }
 /**
- * The run's execution failures before the Observer renders: a run error (the handoff, the plane),
- * each participant whose session failed in the harness, each provider whose cleanup is unconfirmed
- * or that reported a disallowed item after its last request, and each sandbox whose release is
+ * The run's execution failures before the Observer renders: a run error (the handoff, the plane)
+ * first, then the participants' failures, then the subject sandbox when its release is
  * unconfirmed. FinishedRun.renderObserver adds an Observer that did not render.
  */
 function sharedWorldExecutionFailures(args) {
     const { runId, runError, actorResults, subject } = args;
     return [
         ...(runError === undefined ? [] : [{ kind: "run", message: runError }]),
-        ...actorResults
-            .filter((result) => participantHarnessFailed(participantFactsOf(result.outcome)))
-            .map((result) => ({
-            kind: "harness",
-            message: `${result.spec.planned.id}: ${result.outcome.sessionError ?? result.outcome.session?.reason ?? "harness error"}`,
-        })),
-        ...actorResults.flatMap((result) => result.outcome.providerCleanupError === undefined
-            ? []
-            : [
-                {
-                    kind: "provider-cleanup",
-                    message: `${result.spec.planned.id}: ${result.outcome.providerCleanupError}`,
-                },
-            ]),
-        ...actorResults.flatMap((result) => result.outcome.providerPolicyError === undefined
-            ? []
-            : [
-                {
-                    kind: "provider-policy",
-                    message: `${result.spec.planned.id}: ${result.outcome.providerPolicyError}`,
-                },
-            ]),
-        ...unreleasedSandboxFailures(actorResults.map((result) => result.outcome), runId),
+        ...participantExecutionFailures(actorResults.map((result) => result.outcome), runId),
         ...(subject.subjectSandboxId === undefined || subject.subjectKilled
             ? []
             : [sandboxCleanupFailure("subject", subject.subjectReleaseWarning, runId)]),
@@ -230,6 +204,9 @@ export async function finishConcurrentRun(ctx, live, results, plane) {
     for (const result of actorResults) {
         warnings.push(...result.outcome.warnings);
     }
+    const capWarning = participantCapWarning(plan.caps, participantCount, "each participant's model spend");
+    if (capWarning !== undefined)
+        warnings.push(capWarning);
     const bundleArgs = {
         run,
         plan,
@@ -293,6 +270,11 @@ export async function finishConcurrentRun(ctx, live, results, plane) {
         policy,
     });
     const observer = await finished.renderObserver();
+    // A caller's renderer runs with this process's file access, so after one that reports success
+    // the run directory is checked again before the result points anyone at it. A failed render is
+    // already an evidence failure, and its error code stays the run's diagnosis.
+    if (observer.ok)
+        await validatePreparedRunArtifactPaths(finished.paths);
     if (observer.ok && live.observer) {
         attachObserverRuntimeStreamUrls(observer, live.streamUrls);
     }

package/dist/routes/shared-world/route.js

@@ -33,15 +33,12 @@
 // requires the author attestation subject.exposure: synthetic. This is author-trust + a provenance
 // gate; humanish cannot tell synthetic from real data, so it makes no claim about real data.
 import path from "node:path";
-import { missingKeys, missingSubjectEnv } from "../../study/requirements.js";
-import { scrubLiterals } from "../../evidence/redaction.js";
-import { describeMissingKeys } from "../../keys/key-resolution.js";
+import { firstLiveRefusal, keysCheck, localAgentCheck, subjectEnvCheck, } from "../../study/requirements.js";
 import {} from "../../run/run.js";
+import { RunSecrets } from "../../run/secrets.js";
 import { admitRoute, completeRefusalAnalysis, } from "../../run/route-shell.js";
-import { makeCuaRunBudget } from "../computer-use/participant-model.js";
 import { runExternalPublicPlane } from "./external-public.js";
 import { sharedWorldDescriptorOf } from "./plan.js";
-import { localAgentRefusal } from "../../actors/local-agent/readiness.js";
 import { runProvisionedPlane } from "./provisioned.js";
 import { concurrentStudyFailure, finishConcurrentRun } from "./result.js";
 import { prepareConcurrentRun } from "./setup.js";
@@ -99,29 +96,35 @@ async function admitSharedWorldRun(plan, input) {
     if (plan.dryRun)
         return admitted;
     const env = input.env ?? process.env;
-    const fail = (code, message) => ({
+    const { requirements } = plan;
+    // The plan prices a cap before these, and its refusal wins over theirs.
+    const refusal = await firstLiveRefusal([
+        // The plan lists OPENAI_API_KEY for an openai brain's participants and the external-public
+        // plane's lobby-code reader; a local-agent brain's participants run on the operator's
+        // signed-in agent instead. Only on the provisioned plane does a local agent remove the key,
+        // so only there does the refusal suggest one.
+        () => keysCheck({
+            requirements,
+            env,
+            code: "HUMANISH_SHARED_WORLD_KEYS_MISSING",
+            need: (names) => `Live concurrent shared-world studies need ${names} in the environment (values are never persisted).`,
+            suggestLocalAgent: plan.plane.kind === "provisioned",
+        }),
+        () => localAgentCheck({
+            brain: plan.brain,
+            env,
+            caps: plan.caps,
+            codes: LOCAL_AGENT_REFUSAL_CODES,
+        }),
+        () => subjectEnvCheck({ requirements, env, code: "HUMANISH_SHARED_WORLD_SUBJECT_ENV_MISSING" }),
+    ]);
+    if (refusal === undefined)
+        return admitted;
+    const fail = sharedWorldFailure(plan, input);
+    return {
         ok: false,
-        result: sharedWorldFailure(plan, input)(code, message, sharedWorldDescriptorOf(plan.actor).id),
-    });
-    // The plan lists OPENAI_API_KEY for an openai brain's participants and the external-public
-    // plane's lobby-code reader; a local-agent brain's participants run on the operator's signed-in
-    // agent instead.
-    const missing = missingKeys(plan.requirements, env);
-    if (missing.length > 0) {
-        return fail("HUMANISH_SHARED_WORLD_KEYS_MISSING", `Live concurrent shared-world studies need ${missing.join(" and ")} in the environment (values are never persisted). ${describeMissingKeys(missing, env)}`);
-    }
-    if (plan.brain.kind === "local-agent") {
-        // A missing or signed-out agent found after the participants' desktops are paid for is the same
-        // news at the worst moment.
-        const refusal = await localAgentRefusal({ agent: plan.brain.agent, env, caps: plan.caps });
-        if (refusal)
-            return fail(LOCAL_AGENT_REFUSAL_CODES[refusal.kind], refusal.message);
-    }
-    const unsetSubjectEnv = missingSubjectEnv(plan.requirements, env);
-    if (unsetSubjectEnv.length > 0) {
-        return fail("HUMANISH_SHARED_WORLD_SUBJECT_ENV_MISSING", `subject.env declares ${unsetSubjectEnv.join(", ")} but the environment does not provide ${unsetSubjectEnv.length === 1 ? "it" : "them"} (pass via --dotenv; values are never persisted).`);
-    }
-    return admitted;
+        result: fail(refusal.code, refusal.message, sharedWorldDescriptorOf(plan.actor).id),
+    };
 }
 /** The route's envelope for a run that stops before its bundle. */
 function sharedWorldFailure(plan, input) {
@@ -136,15 +139,12 @@ function sharedWorldFailure(plan, input) {
     });
 }
 async function runPlanInScope(plan, input, config, scope) {
-    const { dryRun } = plan;
     const requestedCwd = path.resolve(input.cwd);
     const deps = input.deps ?? {};
     const env = input.env ?? process.env;
     const fail = sharedWorldFailure(plan, input);
     const descriptor = sharedWorldDescriptorOf(plan.actor);
     const planeClass = plan.plane.kind === "external-public" ? "external-public" : "provisioned-getHost";
-    const { maxTotalUsd } = plan.caps;
-    const runBudget = !dryRun && maxTotalUsd !== undefined ? makeCuaRunBudget(maxTotalUsd) : undefined;
     // The provisioned plane's subject; the external-public plane has none.
     const subject = plan.plane.kind === "provisioned" ? plan.plane.subject : undefined;
     const serve = subject?.serve;
@@ -155,13 +155,12 @@ async function runPlanInScope(plan, input, config, scope) {
     const runSession = deps.runSession ?? descriptor.runSession;
     const openaiApiKey = env.OPENAI_API_KEY?.trim() ?? "";
     const e2bApiKey = env.E2B_API_KEY?.trim() ?? "";
-    const knownSecretValues = [
+    const secrets = new RunSecrets([
         openaiApiKey,
         e2bApiKey,
         ...subjectEnvNames.map((name) => env[name] ?? ""),
         ...checkpoints.flatMap((probe) => probe.redact ?? []),
-    ].filter((value) => value.length >= 4);
-    const scrubKnownValues = scrubLiterals(knownSecretValues);
+    ]);
     const redactRepoLabel = plan.residual.policies?.redactRepos ?? subjectEnvNames.includes("GITHUB_TOKEN");
     const publicRepo = redactRepoLabel ? "repo-01" : subjectRepo;
     const hasGithubToken = subjectEnvNames.includes("GITHUB_TOKEN");
@@ -174,7 +173,6 @@ async function runPlanInScope(plan, input, config, scope) {
         env,
         descriptor,
         planeClass,
-        runBudget,
         runSession,
         serve,
         localTreeRoute,
@@ -183,8 +181,7 @@ async function runPlanInScope(plan, input, config, scope) {
         checkpoints,
         openaiApiKey,
         e2bApiKey,
-        knownSecretValues,
-        scrubKnownValues,
+        secrets,
         publicRepo,
         hasGithubToken,
         fail,

package/dist/routes/shared-world/setup.d.ts

@@ -1,6 +1,7 @@
 import type { CuaActorDescriptor } from "../../actors/registry.js";
 import type { StudyConfig, StudySubjectServe, StudySubjectStateCheckpoint } from "../../study/types.js";
 import type { RunScope } from "../../run/run.js";
+import type { RunSecrets } from "../../run/secrets.js";
 import type { ConcurrentSharedWorldStudyErrorCode, ConcurrentSharedWorldStudyResult, ConcurrentSharedWorldPlaneClass, FinishFacts, LiveParticipants, PlaneContext, PlaneResults, PlaneSelection, SharedWorldRunInput } from "./types.js";
 import type { StudyDeps } from "../../study/study-deps.js";
 import type { SharedWorldPlan } from "../../study/plan-types.js";
@@ -16,7 +17,6 @@ interface AdmittedStudy {
     env: Record<string, string | undefined>;
     descriptor: CuaActorDescriptor;
     planeClass: ConcurrentSharedWorldPlaneClass;
-    runBudget: PlaneContext["runBudget"];
     runSession: PlaneContext["runSession"];
     serve: StudySubjectServe | undefined;
     localTreeRoute: boolean;
@@ -25,8 +25,7 @@ interface AdmittedStudy {
     checkpoints: StudySubjectStateCheckpoint[];
     openaiApiKey: string;
     e2bApiKey: string;
-    knownSecretValues: string[];
-    scrubKnownValues: (text: string) => string;
+    secrets: RunSecrets;
     publicRepo: string;
     hasGithubToken: boolean;
     fail: (code: ConcurrentSharedWorldStudyErrorCode, message: string, actorLabel?: string) => ConcurrentSharedWorldStudyResult;

package/dist/routes/shared-world/setup.js

@@ -1,8 +1,7 @@
 // Starts a concurrent shared-world run and prepares what its plane reads: the physical project,
 // the run, the participant specs, comms, the packed tree and email receiving.
-import { randomBytes } from "node:crypto";
 import { realpath } from "node:fs/promises";
-import { buildRunSource } from "../../run/bundle.js";
+import {} from "../../run/bundle.js";
 import { prepareSelectedOutputDirectory } from "../../run/contained-output.js";
 import { renderConcurrentReviewMarkdown } from "./bundle.js";
 import { seedRecipeDigest } from "./checkpoints.js";
@@ -15,10 +14,6 @@ import { planeStateOf } from "./plan.js";
 import path from "node:path";
 import { e2bRequestTimeoutMs } from "../../substrates/e2b/lifetime.js";
 const DEFAULT_PROBER_CADENCE_MS = 1000;
-function makeRunId() {
-    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
-    return `concurrent-shared-world-${stamp}-${randomBytes(4).toString("hex")}`;
-}
 /** The provisioned plane's setup, or undefined when the study declares no `subject.serve`. */
 function provisionedSetup(study, prepared) {
     if (!study.serve)
@@ -49,16 +44,11 @@ async function bindPhysicalProject(requestedCwd) {
         .physicalPath;
 }
 function startConcurrentRun(study, cwd, scope) {
-    const { plan, input, deps } = study;
-    return scope.startRun({
+    return scope.startRun(study.plan, study.input, {
         cwd,
-        runId: input.runId,
-        mintRunId: makeRunId,
-        mode: plan.dryRun ? "dry-run" : "live",
-        study: plan.study,
-        warnings: plan.warnings,
+        prefix: "concurrent-shared-world",
         renderReview: renderConcurrentReviewMarkdown,
-        observer: { open: input.open === true, render: deps.renderObserver },
+        secrets: study.secrets,
     });
 }
 /**
@@ -67,8 +57,8 @@ function startConcurrentRun(study, cwd, scope) {
  */
 export async function prepareConcurrentRun(study, scope) {
     const { plan, input, config, requestedCwd, deps, env, descriptor, planeClass, fail } = study;
-    const { runBudget, runSession, localTreeRoute, subjectEnvNames, publicRepo } = study;
-    const { openaiApiKey, e2bApiKey, knownSecretValues, scrubKnownValues } = study;
+    const { runSession, localTreeRoute, subjectEnvNames, publicRepo } = study;
+    const { openaiApiKey, e2bApiKey, secrets } = study;
     const { dryRun, concurrency } = plan;
     const cwd = await bindPhysicalProject(requestedCwd);
     const warnings = [];
@@ -81,7 +71,7 @@ export async function prepareConcurrentRun(study, scope) {
     // Pack the working tree once per run, on the host, before any sandbox exists: a packing
     // failure fails the run closed without sandbox cost. Dry-run packs nothing.
     const packed = localTreeRoute && !dryRun
-        ? await packSubjectTree(cwd, plan.residual, deps, scrubKnownValues)
+        ? await packSubjectTree(cwd, plan.residual, deps, secrets.scrub)
         : { ok: true, archive: undefined, buffer: undefined };
     if (!packed.ok) {
         return {
@@ -95,7 +85,7 @@ export async function prepareConcurrentRun(study, scope) {
     if (!started.ok)
         return { ok: false, result: fail(started.code, started.message, descriptor.id) };
     const { run } = started;
-    const { runId, createdAt, paths: runPaths } = run;
+    const { runId, createdAt, paths: runPaths, source } = run;
     const artifactRoot = runPaths.absoluteRunRoot;
     const timeoutMs = plan.sessionTimeoutMs ?? defaultSessionTimeoutMs(plan);
     const requestTimeoutMs = e2bRequestTimeoutMs(env);
@@ -104,15 +94,9 @@ export async function prepareConcurrentRun(study, scope) {
     const now = deps.now ?? Date.now;
     const proberCadenceMs = deps.proberCadenceMs ?? DEFAULT_PROBER_CADENCE_MS;
     const seedDigest = seedRecipeDigest(planeStateOf(plan));
-    const source = await buildRunSource({
-        capturedAt: createdAt,
-        cwd,
-        humanishSource: "present",
-        packageName: "humanish",
-    });
     const stateStepRecords = [];
     const stateSnapshots = [];
-    const actorSpecs = await buildParticipantSpecs(plan.plane.participants, cwd, scrubKnownValues);
+    const actorSpecs = await buildParticipantSpecs(plan.plane.participants, cwd, run.secrets.scrub);
     const results = emptyPlaneResults();
     const live = { streamUrls: [] };
     const subjectComms = subjectCommsOf(plan.residual, planeClass);
@@ -124,7 +108,7 @@ export async function prepareConcurrentRun(study, scope) {
         env,
         participants: actorSpecs.map((spec) => spec.planned.id),
         runPaths,
-        knownSecretValues,
+        secrets: run.secrets,
         dryRun,
     });
     if (!email.ok) {
@@ -148,12 +132,10 @@ export async function prepareConcurrentRun(study, scope) {
         deps,
         env,
         concurrency,
-        runBudget,
         runSession,
         openaiApiKey,
         e2bApiKey,
-        scrubKnownValues,
-        knownSecretValues,
+        scrubKnownValues: run.secrets.scrub,
         cwd,
         run,
         runId,

package/dist/routes/shared-world/types.d.ts

@@ -7,7 +7,7 @@ import type { AutomaticAnalysisResult } from "../../analysis/automatic-completio
 import type { CuaActorDescriptor } from "../../actors/registry.js";
 import type { CommsReceivingRun } from "../../comms/receiving.js";
 import type { StudyCommsEmail, StudyCommsExternal, StudyConfig } from "../../study/types.js";
-import type { DesktopResourceObservation } from "../../substrates/e2b/desktop-resources.js";
+import type { SubjectDesktopUsage } from "../../substrates/e2b/subject-sandbox.js";
 import type { ObserverResult } from "../../observer/render.js";
 import type { ObserverRuntimeStreamUrl } from "../../observer/run-routes.js";
 import type { BundleRun, RunBundle, RunScorerProvenance, RunSubjectProvenance, RunSubjectStateStepRecord } from "../../run/bundle.js";
@@ -15,10 +15,10 @@ import type { RunScope } from "../../run/run.js";
 import type { SharedWorldStateSnapshot } from "../../run/shared-world-evidence.js";
 import type { LocalTreeArchive } from "../../subject/local-tree-archive.js";
 import type { LiveTraceFlush } from "../computer-use/live-flush.js";
-import type { CuaParticipantDeps, DesktopParticipantRun, CuaRunBudget, ParticipantRunOutcome } from "../computer-use/types.js";
+import type { CuaParticipantDeps, DesktopParticipantRun, ParticipantRunOutcome } from "../computer-use/types.js";
 import type { ProvisionedPlaneSetup } from "./provisioned.js";
 import type { SharedWorldPlan } from "../../study/plan-types.js";
-import { type StudyResultIdentity } from "../../run/study-result.js";
+import { type StudyResultErrorCode, type StudyResultIdentity } from "../../run/study-result.js";
 export declare const CONCURRENT_SHARED_WORLD_PROVIDER_METADATA: {
     readonly mode: "concurrent-shared-world-lab";
     readonly tool: "humanish";
@@ -54,13 +54,13 @@ export interface SharedWorldRunInput {
      *  core-stamped onto the bundle as evidence. Absent for library callers. */
     scorerProvenance?: RunScorerProvenance;
 }
-export type ConcurrentSharedWorldStudyErrorCode = "HUMANISH_STUDY_ANALYSIS_INVALID" | "HUMANISH_STUDY_TASKS_UNSUPPORTED" | "HUMANISH_STUDY_OPTION_UNSUPPORTED" | "HUMANISH_STUDY_V2_UNSUPPORTED" | "HUMANISH_STUDY_INVALID" | "HUMANISH_SHARED_WORLD_FAILED" | "HUMANISH_SHARED_WORLD_ACTOR_UNSUPPORTED" | "HUMANISH_SHARED_WORLD_INVALID" | "HUMANISH_SHARED_WORLD_KEYS_MISSING"
+export type ConcurrentSharedWorldStudyErrorCode = StudyResultErrorCode | "HUMANISH_SHARED_WORLD_FAILED" | "HUMANISH_SHARED_WORLD_ACTOR_UNSUPPORTED" | "HUMANISH_SHARED_WORLD_INVALID" | "HUMANISH_SHARED_WORLD_KEYS_MISSING"
 /** A local-agent brain's CLI is not on `PATH`. */
  | "HUMANISH_SHARED_WORLD_AGENT_MISSING"
 /** A local-agent brain's CLI is signed out, or could not report its sign-in status. */
  | "HUMANISH_SHARED_WORLD_AGENT_SIGNIN_REQUIRED"
 /** A dollar cap that cannot be priced: an unpriced model, or a ChatGPT-account Codex brain. */
- | "HUMANISH_SHARED_WORLD_UNPRICED_CAP" | "HUMANISH_SHARED_WORLD_SUBJECT_ENV_MISSING" | "HUMANISH_SHARED_WORLD_GETHOST_UNAVAILABLE" | "HUMANISH_SHARED_WORLD_HANDOFF_TIMEOUT" | "HUMANISH_RUN_ID_IN_USE"
+ | "HUMANISH_SHARED_WORLD_UNPRICED_CAP" | "HUMANISH_SHARED_WORLD_SUBJECT_ENV_MISSING" | "HUMANISH_SHARED_WORLD_GETHOST_UNAVAILABLE" | "HUMANISH_SHARED_WORLD_HANDOFF_TIMEOUT"
 /** A declared adopter-hosted comms catch did not answer as a humanish catch. Fail closed
  *  before any actor spend, since the funnel would silently collect nothing. */
  | "HUMANISH_SHARED_WORLD_COMMS_CATCH_UNREACHABLE"
@@ -134,12 +134,6 @@ export interface ConcurrentSharedWorldStudyResult extends AutomaticAnalysisResul
         message: string;
     };
 }
-/** The provisioned plane's own desktop, for the run's cost estimate. */
-export interface SubjectDesktopUsage {
-    durationMs: number | undefined;
-    observation: DesktopResourceObservation | undefined;
-    killed: boolean;
-}
 /** One actor's measured run (internal). */
 export interface ActorRunResult {
     spec: DesktopParticipantRun;
@@ -163,14 +157,11 @@ export interface PlaneContext {
     deps: StudyDeps;
     env: Record<string, string | undefined>;
     concurrency: number;
-    runBudget: CuaRunBudget | undefined;
     runSession: CuaParticipantDeps["runSession"];
     openaiApiKey: string;
     e2bApiKey: string;
+    /** `run.secrets.scrub`, which every plane step that writes text reads. */
     scrubKnownValues: (text: string) => string;
-    /** The values scrubKnownValues removes. Real email receiving adds its secrets before participants
-     *  start. */
-    knownSecretValues: readonly string[];
     cwd: string;
     run: StartedRun;
     runId: string;