humanish 0.115.0 → 0.116.0

package/dist/routes/computer-use/bundle-parts.d.ts

@@ -1,11 +1,11 @@
 import { type RunProviderResource, type RunSubjectProvenance } from "../../run/bundle.js";
 import { type ParticipantIds } from "../../run/participant-records.js";
-import { type CuaSubjectProvenanceArg, type ParticipantRunOutcome } from "./types.js";
+import { type ParticipantRunOutcome } from "./types.js";
 /** The human-readable state story appended to the provenance event (and review.md via it). */
 export declare function describeSubjectState(state: RunSubjectProvenance["state"], dryRun: boolean): string;
-/** Human-readable provenance line for the single-participant subject.provenance event:
- *  claims "cloned/packed and served" only when it actually happened. */
-export declare function subjectProvenanceMessage(provenance: CuaSubjectProvenanceArg, publicAppUrl: string, dryRun: boolean, hasSession: boolean): string;
+/** Human-readable provenance line for the single-participant subject.provenance event of a clone
+ *  or local-tree subject: claims "cloned/packed and served" only when it actually happened. */
+export declare function subjectProvenanceMessage(provenance: RunSubjectProvenance, publicAppUrl: string, dryRun: boolean, hasSession: boolean): string;
 export declare function providerResourcesForOutcome(args: {
     outcome: ParticipantRunOutcome | undefined;
     createdAt: string;

package/dist/routes/computer-use/bundle-parts.js

@@ -24,8 +24,8 @@ export function describeSubjectState(state, dryRun) {
             return "external-public (operator-declared, operator-owned public deployment; neither provisioned nor seeded)";
     }
 }
-/** Human-readable provenance line for the single-participant subject.provenance event:
- *  claims "cloned/packed and served" only when it actually happened. */
+/** Human-readable provenance line for the single-participant subject.provenance event of a clone
+ *  or local-tree subject: claims "cloned/packed and served" only when it actually happened. */
 export function subjectProvenanceMessage(provenance, publicAppUrl, dryRun, hasSession) {
     if (provenance.source === "clone") {
         if (dryRun) {

package/dist/routes/computer-use/bundle.d.ts

@@ -1,8 +1,8 @@
 import type { CuaActorDescriptor } from "../../actors/registry.js";
 import type { ComputerUsePlan } from "../../study/plan-types.js";
-import type { BundleRun, RunBundle, RunRerunLineage } from "../../run/bundle.js";
+import type { BundleRun, RunBundle, RunRerunLineage, RunSubjectProvenance } from "../../run/bundle.js";
 import { type Judgment } from "../../run/judge.js";
-import type { CuaParticipantPlan, DesktopParticipantRun, CuaSubjectProjection, CuaSubjectProvenanceArg, ParticipantRunOutcome } from "./types.js";
+import type { CuaParticipantPlan, DesktopParticipantRun, ParticipantRunOutcome } from "./types.js";
 /** What every bundle of one run shares, in progress or final. */
 export interface CuaRunBundleBase {
     /** The run every bundle of it belongs to. */
@@ -32,9 +32,8 @@ interface CuaRunBundleState {
     judgment: Judgment;
     dryRun: boolean;
     outcomes: ParticipantRunOutcome[] | undefined;
-    subjects: CuaSubjectProjection[];
-    aggregateSubject: CuaSubjectProjection;
-    subjectProvenance: CuaSubjectProvenanceArg | undefined;
+    subjects: RunSubjectProvenance[];
+    aggregateSubject: RunSubjectProvenance;
     failFastReason?: string;
     inProgress?: true;
 }

package/dist/routes/computer-use/bundle.js

@@ -117,9 +117,7 @@ function singleParticipantArgs(base, state) {
             }),
         source: base.source,
         ...(state.inProgress === undefined ? {} : { inProgress: state.inProgress }),
-        ...(state.subjectProvenance === undefined
-            ? {}
-            : { subjectProvenance: state.subjectProvenance }),
+        subject: state.aggregateSubject,
         ...(desktopTemplate === undefined ? {} : { desktopTemplate }),
         ...(outcome?.desktopBrowser === undefined ? {} : { desktopBrowser: outcome.desktopBrowser }),
         providerResources: providerResourcesForOutcome({

package/dist/routes/computer-use/fanout-records.js

@@ -3,7 +3,7 @@
 import { participantAssignment } from "../../study/participant-assignment.js";
 import { participantEvent, participantRecord, participantStream, } from "../../run/participant-records.js";
 import { participantCaption } from "../../run/participant-caption.js";
-import { sessionEndingInWords } from "../../run/outcomes.js";
+import { participantSummary } from "../../run/outcomes.js";
 import { declaredScreenForRender } from "../../substrates/e2b/desktop-geometry.js";
 import { describeSubjectState, phaseEventIdSuffix, publicSafeAppUrlLabel } from "./bundle-parts.js";
 import { participantSubjectEnv } from "./types.js";
@@ -60,15 +60,12 @@ function fanoutParticipantRecord(args, spec, index, view) {
         mode: "browser-sim",
         progress: args.inProgress === true && outcome === undefined ? 20 : 100,
         currentStep: reason,
-        summary: session
-            ? `${name} used the app and ${sessionEndingInWords(session.trace)}.`
-            : args.inProgress === true && outcome === undefined
-                ? `${name} is using the app.`
-                : outcome?.skippedReason !== undefined
-                    ? `${name} was ${outcome.skippedReason}.`
-                    : outcome?.sessionError !== undefined
-                        ? `${name} did not finish a session: ${outcome.sessionError}`
-                        : `${name} would use ${publicTargetUrl}; no session ran.`,
+        summary: participantSummary(name, { name: "the app", target: publicTargetUrl }, {
+            trace: session?.trace,
+            skippedReason: outcome?.skippedReason,
+            sessionError: outcome?.sessionError,
+            inProgress: args.inProgress === true && outcome === undefined,
+        }),
         startedAt: args.run.createdAt,
         updatedAt: args.run.createdAt,
     });
@@ -208,7 +205,9 @@ function fanoutSubjectEvents(ctx, spec, view) {
             at: args.run.createdAt,
             level: "info",
             type: "cua-lab.subject.declared",
-            message: `Participant ${spec.planned.id}: subject app declared at ${publicTargetUrl} (loopback inside the participant's own desktop sandbox).`,
+            message: subject.source === "desktop-cli"
+                ? `Participant ${spec.planned.id}: subject product declared: ${subject.product}, used from a terminal window inside the participant's own desktop sandbox.`
+                : `Participant ${spec.planned.id}: subject app declared at ${publicTargetUrl} (loopback inside the participant's own desktop sandbox).`,
         });
     }
     return events;

package/dist/routes/computer-use/live-phase.d.ts

@@ -31,7 +31,7 @@ export declare function runStudyParticipants(setup: CuaRunSetup, participants: C
             killed: boolean;
             streamUrlPresent: boolean;
         };
-        subject?: import("./types.js").CuaSubjectProjection;
+        subject?: import("../../run/bundle.js").RunSubjectProvenance;
         plan?: import("./types.js").CuaParticipantPlan;
         lanes?: import("./types.js").CuaParticipantResult[];
         laneSummary?: import("./types.js").CuaParticipantSummary;

package/dist/routes/computer-use/live-phase.js

@@ -37,7 +37,6 @@ export async function runStudyParticipants(setup, participants) {
             outcomes: undefined,
             subjects: inProgress.subjects,
             aggregateSubject: inProgress.aggregateSubject,
-            subjectProvenance: inProgress.provenance,
             inProgress: true,
         });
         await run.writeSnapshot(inProgressBundle);

package/dist/routes/computer-use/participant-execution.d.ts

@@ -1,5 +1,6 @@
 import { type PreparedOutputRoot } from "../../run/contained-output.js";
-import type { CuaParticipantDeps, CuaParticipantPlan, CuaParticipantResult, DesktopParticipantRun, CuaSubjectProjection, ParticipantRunOutcome } from "./types.js";
+import type { CuaParticipantDeps, CuaParticipantPlan, CuaParticipantResult, DesktopParticipantRun, ParticipantRunOutcome } from "./types.js";
+import type { RunSubjectProvenance } from "../../run/bundle.js";
 /** Build a participant's writeScreenshot closure: writes under screenshots/<screenshotDir>/ and records
  *  the relative path the trace references (screenshots/<name> at N=1; screenshots/<laneId>/<name>
  *  at N>1). */
@@ -24,7 +25,7 @@ export declare function runCuaParticipants(runs: DesktopParticipantRun[], deps:
     failFastReason?: string;
 }>;
 /** Project one participant outcome (or a dry-run contract spec) into the public CuaParticipantResult. */
-export declare function toParticipantResult(spec: DesktopParticipantRun, outcome: ParticipantRunOutcome | undefined, subject: CuaSubjectProjection, dryRun: boolean): CuaParticipantResult;
+export declare function toParticipantResult(spec: DesktopParticipantRun, outcome: ParticipantRunOutcome | undefined, subject: RunSubjectProvenance, dryRun: boolean): CuaParticipantResult;
 /**
  * Run every participant of a live run. The in-process route drives its single participant in this
  * process; one hosted participant runs alone; a fan-out runs at the plan's concurrency and may stop early.

package/dist/routes/computer-use/participant-runs.d.ts

@@ -4,14 +4,18 @@ import { type ResolvedPersona } from "../../study/persona.js";
 import { type RunRerunLineage } from "../../run/bundle.js";
 import type { PreparedSelectedOutputDirectory } from "../../run/contained-output.js";
 import { type CuaActorStudyErrorCode, type CuaParticipantPlan, type CuaParticipantPlanEntry, type DesktopParticipantRun, type ParticipantRunsAndPlan } from "./types.js";
-export declare function defaultSessionTimeoutMs(config: StudyConfig): number;
+/**
+ * The session budget of a study that declares no execution.timeoutMs. On a provisioned route it is
+ * what the `ceilingMs` sandbox ceiling leaves after provisioning, seeding and the teardown buffer.
+ */
+export declare function defaultSessionTimeoutMs(config: StudyConfig, ceilingMs: number): number;
 /** Per-participant sandbox deadline (each one owns its own desktop). Mirrors the
  *  single-participant formula verbatim so N=1 stays byte-stable: explicit sandboxTimeoutMs, else session budget + (clone
  *  or local-tree: provision budget + Σ state-step budgets) + the server-side
  *  reclamation buffer. Local-tree shares the clone route's provisioning budget: it swaps a
  *  git clone for an upload+extract, but the shared install/build/state/start/probe pipeline
  *  costs the same wall-clock room either way. */
-export declare function resolveParticipantSandboxMs(config: StudyConfig): number;
+export declare function resolveParticipantSandboxMs(config: StudyConfig, ceilingMs: number): number;
 /**
  * The in-flight participant bound a study declares. Defaults to the participant count: every
  * declared participant runs at once, because a throttle nobody asked for silently turns "N actors

package/dist/routes/computer-use/participant-runs.js

@@ -12,18 +12,22 @@ import {} from "../../run/bundle.js";
 import { participantAssignment } from "../../study/participant-assignment.js";
 import { resolveCommittedPersonas } from "../../study/persona-resolve.js";
 import { CUA_FANOUT_STRATEGY, CUA_MAX_CONCURRENCY_ENV, DEFAULT_APP_URL_SESSION_TIMEOUT_MS, MIN_DERIVED_SESSION_TIMEOUT_MS, } from "./types.js";
-import { MAX_SANDBOX_MS, SANDBOX_TIMEOUT_BUFFER_MS, SUBJECT_PROVISION_BUDGET_MS, } from "../../substrates/e2b/lifetime.js";
+import { SANDBOX_TIMEOUT_BUFFER_MS, SUBJECT_PROVISION_BUDGET_MS, } from "../../substrates/e2b/lifetime.js";
 import { readPositiveInt } from "../../study/parse/values.js";
 import { digestUrl } from "./bundle-parts.js";
 import { composeParticipantInstructions, DEFAULT_MISSION } from "./participant-prompt.js";
 import { resolveCuaRerunSelection } from "./rerun-selection.js";
 import { plural } from "../../run/text.js";
-export function defaultSessionTimeoutMs(config) {
+/**
+ * The session budget of a study that declares no execution.timeoutMs. On a provisioned route it is
+ * what the `ceilingMs` sandbox ceiling leaves after provisioning, seeding and the teardown buffer.
+ */
+export function defaultSessionTimeoutMs(config, ceilingMs) {
     const provisionedRoute = config.subject.source === "clone" || config.subject.source === "local-tree";
     if (!provisionedRoute)
         return DEFAULT_APP_URL_SESSION_TIMEOUT_MS;
     const stateBudgetMs = (config.subject.state?.seed ?? []).reduce((sum, step) => sum + (step.timeoutMs ?? DEFAULT_STATE_STEP_TIMEOUT_MS), 0);
-    const room = MAX_SANDBOX_MS - SUBJECT_PROVISION_BUDGET_MS - stateBudgetMs - SANDBOX_TIMEOUT_BUFFER_MS;
+    const room = ceilingMs - SUBJECT_PROVISION_BUDGET_MS - stateBudgetMs - SANDBOX_TIMEOUT_BUFFER_MS;
     return Math.max(MIN_DERIVED_SESSION_TIMEOUT_MS, Math.min(DEFAULT_APP_URL_SESSION_TIMEOUT_MS, room));
 }
 /** Per-participant sandbox deadline (each one owns its own desktop). Mirrors the
@@ -32,10 +36,10 @@ export function defaultSessionTimeoutMs(config) {
  *  reclamation buffer. Local-tree shares the clone route's provisioning budget: it swaps a
  *  git clone for an upload+extract, but the shared install/build/state/start/probe pipeline
  *  costs the same wall-clock room either way. */
-export function resolveParticipantSandboxMs(config) {
+export function resolveParticipantSandboxMs(config, ceilingMs) {
     if (isLocalBrowserStudy(config))
         return LOCAL_BROWSER_LIFETIME_MS;
-    const timeoutMs = config.execution?.timeoutMs ?? defaultSessionTimeoutMs(config);
+    const timeoutMs = config.execution?.timeoutMs ?? defaultSessionTimeoutMs(config, ceilingMs);
     const provisionedRoute = config.subject.source === "clone" || config.subject.source === "local-tree";
     const stateBudgetMs = provisionedRoute
         ? (config.subject.state?.seed ?? []).reduce((sum, step) => sum + (step.timeoutMs ?? DEFAULT_STATE_STEP_TIMEOUT_MS), 0)

package/dist/routes/computer-use/plan.d.ts

@@ -1,6 +1,7 @@
 import { type CuaActorDescriptor } from "../../actors/registry.js";
 import type { ComputerUsePlan, ComputerUseRunner, RoutePlanResult, RouteRefusal } from "../../study/plan-types.js";
 import type { StudyConfig, StudySubjectState } from "../../study/types.js";
+import { type SandboxCeiling } from "../../substrates/e2b/lifetime.js";
 import { type ComputerUseRunInput, type CuaActorStudyErrorCode } from "./types.js";
 /** The error a computer-use study returns before a run starts. */
 export interface ComputerUseRefusal extends RouteRefusal<"computer-use", CuaActorStudyErrorCode> {
@@ -45,4 +46,6 @@ export declare function planComputerUseStudy(config: StudyConfig, input: {
     readonly driving?: CallerDriving;
     readonly countOverride?: number;
     readonly rerun?: ComputerUseRunInput["rerun"];
+    /** The longest sandbox lifetime the operator's E2B plan allows (sandboxCeiling). */
+    readonly sandboxCeiling: SandboxCeiling;
 }): ComputerUsePlanResult;

package/dist/routes/computer-use/plan.js

@@ -14,7 +14,7 @@ import { cloneTargetValidationReason, computerUseValidationReason, desktopMediaV
 import { desktopCliProductReason } from "../../study/composition-rules.js";
 import { isLocalBrowserStudy } from "../../substrates/local/runtime-config.js";
 import { boundedConcurrency, defaultSessionTimeoutMs, resolveParticipantSandboxMs, } from "./participant-runs.js";
-import { MAX_SANDBOX_MS } from "../../substrates/e2b/lifetime.js";
+import { ceilingAdvice } from "../../substrates/e2b/lifetime.js";
 import {} from "./types.js";
 /** The registered descriptor for a planned actor id; planComputerUseStudy checked the registry. */
 export function cuaDescriptorOf(actor) {
@@ -74,12 +74,12 @@ const invalid = (message) => ({
  * is touched. The parser enforces most of these too; the engine repeats them for library callers
  * that hand it a config directly. The groups run in this order, and each returns its first reason.
  */
-function cuaStudyRejection(config, hasRunSession, driving, subjectRoute) {
+function cuaStudyRejection(config, hasRunSession, driving, subjectRoute, ceilingMs) {
     return (unsupportedDeclarationReason(config, hasRunSession, driving, subjectRoute) ??
         subjectStructureReason(config, subjectRoute) ??
         entryTargetReason(config, subjectRoute) ??
         driverReason(driving, subjectRoute) ??
-        rosterShapeReason(config));
+        rosterShapeReason(config, ceilingMs));
 }
 /** A declaration this route cannot honor, for any subject or with the caller's own driver. */
 function unsupportedDeclarationReason(config, hasRunSession, driving, { inProcessRoute }) {
@@ -173,7 +173,7 @@ function driverReason(driving, { localAppSubject, inProcessRoute }) {
     return undefined;
 }
 /** The participant roster, then the sandbox deadline its session budget derives. */
-function rosterShapeReason(config) {
+function rosterShapeReason(config, ceilingMs) {
     // Device XOR raw resolution, cap, unique ids,
     // allowPublicTargets with more than one participant, clone.fanout.
     const fanoutReason = computerUseValidationReason(config);
@@ -182,13 +182,13 @@ function rosterShapeReason(config) {
     // The sandbox deadline is derived from the session budget, so a study can ask for a session that
     // cannot legally be provisioned. Show the arithmetic: the provider's own error names a limit
     // but not which knob produced it.
-    const derivedSandboxMs = resolveParticipantSandboxMs(config);
-    if (derivedSandboxMs <= MAX_SANDBOX_MS)
+    const derivedSandboxMs = resolveParticipantSandboxMs(config, ceilingMs);
+    if (derivedSandboxMs <= ceilingMs)
         return undefined;
     const provisionedRoute = config.subject.source === "clone" || config.subject.source === "local-tree";
-    const sessionMs = config.execution?.timeoutMs ?? defaultSessionTimeoutMs(config);
+    const sessionMs = config.execution?.timeoutMs ?? defaultSessionTimeoutMs(config, ceilingMs);
     const headroomMs = derivedSandboxMs - sessionMs;
-    return invalid(`execution.timeoutMs ${Math.round(sessionMs / 60_000)}m derives a ${Math.round(derivedSandboxMs / 60_000)}m sandbox deadline, and a sandbox may not live longer than ${MAX_SANDBOX_MS / 60_000}m. The deadline is the session budget plus ${Math.round(headroomMs / 60_000)}m of provisioning and teardown headroom${provisionedRoute ? " (this route clones, installs, builds and serves the subject before the actor starts)" : ""}. Lower execution.timeoutMs to at most ${Math.round((MAX_SANDBOX_MS - headroomMs) / 60_000)}m, or set execution.desktop.sandboxTimeoutMs explicitly.`);
+    return invalid(`execution.timeoutMs ${Math.round(sessionMs / 60_000)}m derives a ${Math.round(derivedSandboxMs / 60_000)}m sandbox deadline, and a sandbox may not live longer than ${ceilingMs / 60_000}m. The deadline is the session budget plus ${Math.round(headroomMs / 60_000)}m of provisioning and teardown headroom${provisionedRoute ? " (this route clones, installs, builds and serves the subject before the actor starts)" : ""}. Lower execution.timeoutMs to at most ${Math.round((ceilingMs - headroomMs) / 60_000)}m, or set execution.desktop.sandboxTimeoutMs explicitly.${ceilingAdvice(derivedSandboxMs)}`);
 }
 /** The plan's rerun: the source run and, when given, the participants to rerun. */
 function rerunPlan({ sourceRunId, participantIds, }) {
@@ -223,7 +223,10 @@ export function planComputerUseStudy(config, input) {
     if (!descriptor || !isCuaActorDescriptor(descriptor))
         return refuse("in-scope", "HUMANISH_COMPUTER_USE_ACTOR_UNSUPPORTED", `actor.type "${actorType}" is not a registered computer-use actor.`);
     const actor = descriptor.id;
-    const rejection = cuaStudyRejection(config, hasRunSession, driving, declaredSubjectRoute(config, driving));
+    const ceiling = input.sandboxCeiling;
+    if (!ceiling.ok)
+        return refuse("in-scope", "HUMANISH_COMPUTER_USE_SUBJECT_INVALID", ceiling.message, actor);
+    const rejection = cuaStudyRejection(config, hasRunSession, driving, declaredSubjectRoute(config, driving), ceiling.ms);
     if (rejection)
         return refuse("in-scope", rejection.code, rejection.message, actor);
     // A shared world runs every participant against one app; this route would run them as separate
@@ -288,8 +291,8 @@ export function planComputerUseStudy(config, input) {
             actor,
             runner,
             concurrency: boundedConcurrency(declared, n),
-            sessionBudgetMs: config.execution?.timeoutMs ?? defaultSessionTimeoutMs(config),
-            sandboxMs: resolveParticipantSandboxMs(config),
+            sessionBudgetMs: config.execution?.timeoutMs ?? defaultSessionTimeoutMs(config, ceiling.ms),
+            sandboxMs: resolveParticipantSandboxMs(config, ceiling.ms),
             caps: planCaps(config),
             ...(input.rerun === undefined ? {} : { rerun: rerunPlan(input.rerun) }),
             requirements: base.dryRun || runner.desktop === "in-process"

package/dist/routes/computer-use/rerun-selection.js

@@ -2,10 +2,10 @@
 // participants that failed, blocked, timed out or finished hollow are picked unless ids are given.
 import {} from "../../run/bundle.js";
 import { loadRunBundle } from "../../run/locate.js";
+import { resolveLatestRunPointer } from "../../run/paths.js";
 import {} from "../../run/streams.js";
 import { plural } from "../../run/text.js";
 import { access } from "node:fs/promises";
-import path from "node:path";
 import { cli } from "../../cli/invocation.js";
 export async function resolveCuaRerunSelection(args) {
     const { studyId, sourceRunId } = args;
@@ -16,7 +16,7 @@ export async function resolveCuaRerunSelection(args) {
     const source = await loadRunBundle(args.cwd, sourceRunId);
     if (!source) {
         const noRuns = sourceRunId === "latest" &&
-            !(await access(path.join(args.cwd, ".humanish", "runs", "latest.json")).then(() => true, () => false));
+            !(await access(resolveLatestRunPointer(args.cwd)).then(() => true, () => false));
         return refuse(noRuns
             ? "--rerun-failed-from latest found no run: this project has no runs yet, and a rerun repeats the failed participants of an earlier live run."
             : `--rerun-failed-from ${sourceRunId} names no run humanish can read in this project. ${cli("runs")} lists its runs.`);

package/dist/routes/computer-use/result.js

@@ -7,8 +7,8 @@ import { participantCapWarning } from "./participant-model.js";
 import { summarizeCuaDiagnostics } from "./diagnostics.js";
 import { toParticipantResult } from "./participant-execution.js";
 import { buildCuaRunBundle, judgeComputerUseRun } from "./bundle.js";
-import { aggregateCuaSubject, projectParticipantSubjects, subjectProvenanceArg, } from "./subject-projection.js";
-import { CUA_FANOUT_STRATEGY, participantSubjectEnv, } from "./types.js";
+import { aggregateCuaSubject, projectParticipantSubjects } from "./subject-projection.js";
+import { CUA_FANOUT_STRATEGY, } from "./types.js";
 import { plannedAppUrl } from "./plan.js";
 import { studyResultIdentity } from "../../run/study-result.js";
 import { plural } from "../../run/text.js";
@@ -157,10 +157,9 @@ function cuaStudyResult(args) {
 export async function finishCuaRun(setup, finish, ran) {
     const { plan, input, cwd, streams, descriptor, run } = setup;
     const { participantRuns, participantPlan, bundleBase } = setup;
-    const { rerunLineage, publicRepo, subjectArgs } = finish;
+    const { rerunLineage, subjectArgs } = finish;
     const { dryRun } = plan;
     const appUrl = plannedAppUrl(plan.runner.subject);
-    const subjectEnvNames = [...participantSubjectEnv(plan.runner.subject)];
     const { runId } = run;
     const participantCount = participantRuns.length;
     const { outcomes, failFastReason, receiving, receivingWarnings, externalCommsWarnings } = ran;
@@ -174,7 +173,6 @@ export async function finishCuaRun(setup, finish, ran) {
         ...(capWarning === undefined ? [] : [capWarning]),
         ...aggregate.warnings,
     ];
-    const finalProvenance = subjectProvenanceArg(aggregateSubject, publicRepo, subjectEnvNames);
     // One judgment for the whole run: the bundle's verdict and the result's ok both read it.
     const judgment = judgeComputerUseRun(bundleBase, { dryRun, outcomes });
     const bundle = buildCuaRunBundle(bundleBase, {
@@ -183,7 +181,6 @@ export async function finishCuaRun(setup, finish, ran) {
         outcomes,
         subjects,
         aggregateSubject,
-        subjectProvenance: finalProvenance,
         ...(failFastReason === undefined ? {} : { failFastReason }),
     });
     const adapterWarnings = [];

package/dist/routes/computer-use/setup.d.ts

@@ -3,14 +3,14 @@ import type { RefusedStudy } from "../../run/route-shell.js";
 import { RunSecrets } from "../../run/secrets.js";
 import type { CuaActorDescriptor } from "../../actors/registry.js";
 import type { StudyCommsEmail, StudyCommsExternal, StudyConfig } from "../../study/types.js";
-import { type RunRerunLineage } from "../../run/bundle.js";
+import { type RunRerunLineage, type RunSubjectProvenance } from "../../run/bundle.js";
 import { type LocalTreeArchive } from "../../subject/local-tree-archive.js";
 import { type ComputerUseRefusal } from "./plan.js";
 import type { ComputerUsePlan } from "../../study/plan-types.js";
 import { trackRuntimeStreams, type LiveTraceFlush } from "./live-flush.js";
 import { type CuaRunBundleBase } from "./bundle.js";
 import { projectParticipantSubjects } from "./subject-projection.js";
-import { type CuaActorStudyErrorCode, type CuaActorStudyResult, type CuaParticipantDeps, type CuaParticipantPlan, type DesktopParticipantRun, type CuaSubjectProjection, type CuaSubjectProvenanceArg, type ComputerUseRunInput } from "./types.js";
+import { type CuaActorStudyErrorCode, type CuaActorStudyResult, type CuaParticipantDeps, type CuaParticipantPlan, type DesktopParticipantRun, type ComputerUseRunInput } from "./types.js";
 /**
  * The envelope of a refusal the plan left for after the cwd checks. The participant cap and
  * in-process fan-out refusals come after the committed personas are read, so a persona-file error still wins.
@@ -51,9 +51,8 @@ export interface CuaParticipantsSetup {
     } | undefined;
     /** The subjects of the in-progress bundle, written before any participant starts. */
     inProgress: {
-        subjects: CuaSubjectProjection[];
-        aggregateSubject: CuaSubjectProjection;
-        provenance: CuaSubjectProvenanceArg | undefined;
+        subjects: RunSubjectProvenance[];
+        aggregateSubject: RunSubjectProvenance;
     };
     /** The refusal envelope, for a run that stops before its bundle. */
     fail: (code: CuaActorStudyErrorCode, message: string, actorLabel?: string) => CuaActorStudyResult;
@@ -61,7 +60,6 @@ export interface CuaParticipantsSetup {
 /** What only finishCuaRun reads besides the participants' outcomes. */
 export interface CuaFinishFacts {
     rerunLineage: RunRerunLineage | undefined;
-    publicRepo: string | undefined;
     subjectArgs: Omit<Parameters<typeof projectParticipantSubjects>[0], "outcomes" | "dryRun">;
 }
 type PreparedCuaRun = {

package/dist/routes/computer-use/setup.js

@@ -20,7 +20,7 @@ import { phaseEvent, planEvent } from "../../study/run-study-events.js";
 import { defaultSubjectPhaseSink } from "../../subject/steps.js";
 import {} from "./bundle.js";
 import { packRunLocalTree } from "./local-tree-pack.js";
-import { projectParticipantSubjects, subjectProvenanceArg } from "./subject-projection.js";
+import { projectParticipantSubjects } from "./subject-projection.js";
 import { participantSubjectEnv, } from "./types.js";
 import { capacityShortfall } from "../../substrates/local/capacity.js";
 import { studyPersonaIds } from "../../study/persona-resolve.js";
@@ -248,9 +248,6 @@ export async function startCuaRun(plan, input, admitted, scope) {
         dryRun: false,
     });
     const inProgressAggregateSubject = inProgressSubjects[0];
-    const inProgressProvenance = subjectProvenanceArg(inProgressAggregateSubject, publicRepo, [
-        ...participantSubjectEnv(plan.runner.subject),
-    ]);
     const bundleBase = {
         run,
         participantRuns,
@@ -287,11 +284,10 @@ export async function startCuaRun(plan, input, admitted, scope) {
             inProgress: {
                 subjects: inProgressSubjects,
                 aggregateSubject: inProgressAggregateSubject,
-                provenance: inProgressProvenance,
             },
             fail: admitted.fail,
         },
-        finish: { rerunLineage: admitted.rerunLineage, publicRepo, subjectArgs },
+        finish: { rerunLineage: admitted.rerunLineage, subjectArgs },
     };
 }
 /** The participant deps every participant reads, with computer use's own overrides. */

package/dist/routes/computer-use/single-bundle.d.ts

@@ -3,11 +3,10 @@ import type { SubjectPhaseEvent } from "../../subject/steps.js";
 import type { DesktopBrowserEvidence } from "../../substrates/e2b/desktop-browser.js";
 import type { ActorPersonaRef } from "../../actors/contract.js";
 import type { CuaLoopResult } from "../../actors/computer-use/loop.js";
-import { type BundleRun, type RunBundle, type RunFeedbackCandidate, type RunProviderResource } from "../../run/bundle.js";
+import { type BundleRun, type RunBundle, type RunFeedbackCandidate, type RunProviderResource, type RunSubjectProvenance } from "../../run/bundle.js";
 import { type RunDesktopGeometry, type RunStream } from "../../run/streams.js";
 import { type Verdict } from "../../run/judge.js";
 import { type DesktopUsage } from "../../run/cost-summary.js";
-import type { CuaSubjectProvenanceArg } from "./types.js";
 /**
  * The bundle of a single-participant run: one participant and no rerun. buildCuaRunBundle
  * (bundle.ts) maps the run's base and state into these arguments.
@@ -70,9 +69,9 @@ export declare function buildSingleParticipantBundle(args: {
         reportedFriction: boolean;
     };
     source: RunBundle["source"];
-    /** Provisioned-route provenance (clone or local-tree): what the actor actually drove (names
-     * + digests only, never values or command text), including the subject's state story. */
-    subjectProvenance?: CuaSubjectProvenanceArg;
+    /** The subject as subject-projection.ts projects it (names and digests only, never values or
+     * command text): run.json records it as `subject`, and the subject event describes it. */
+    subject: RunSubjectProvenance;
     /**
      * Entry kind for the non-clone subject.declared event, which declares what the subject
      * was. "local-app": an already-running local dev server driven in-process, un-pinnable, and

package/dist/routes/computer-use/single-bundle.js

@@ -2,7 +2,7 @@ import { participantAssignment } from "../../study/participant-assignment.js";
 import { redactText } from "../../evidence/redaction.js";
 import { REVIEW_SCHEMA, bundleArtifacts, bundleHead, } from "../../run/bundle.js";
 import {} from "../../run/streams.js";
-import { aggregateTaskFunnels, formatParticipantOutcomes, formatRunTaskFunnel, sessionEndingInWords, withCuaReviewProvenance, } from "../../run/outcomes.js";
+import { aggregateTaskFunnels, formatParticipantOutcomes, formatRunTaskFunnel, participantSummary, withCuaReviewProvenance, } from "../../run/outcomes.js";
 import { participantCaption } from "../../run/participant-caption.js";
 import { actorEnding } from "../../actors/stop-cause.js";
 import { describeSubjectState, phaseEventIdSuffix, publicSafeAppUrlLabel, subjectProvenanceMessage, } from "./bundle-parts.js";
@@ -103,13 +103,11 @@ function singleSimulation(args, view) {
         mode: "browser-sim",
         progress: args.inProgress === true ? 20 : 100,
         currentStep: reason,
-        summary: args.session
-            ? `${name} used the app ${browserPlace(args)}, and ${sessionEndingInWords(args.session.trace)}.`
-            : args.inProgress === true
-                ? `${name} is using the app ${browserPlace(args)}.`
-                : args.sessionError !== undefined
-                    ? `${name} did not finish a session: ${args.sessionError}`
-                    : `${name} would use ${publicAppUrl}; no session ran.`,
+        summary: participantSummary(name, { name: "the app", place: browserPlace(args), target: publicAppUrl }, {
+            trace: args.session?.trace,
+            sessionError: args.sessionError,
+            inProgress: args.inProgress === true,
+        }),
         startedAt: args.run.createdAt,
         updatedAt: args.run.createdAt,
     });
@@ -183,6 +181,7 @@ function singleStream(args, view) {
 }
 function singleEvents(args, view) {
     const { publicAppUrl, desktopGeometry } = view;
+    const { subject } = args;
     const events = [
         {
             id: "event-000-created",
@@ -191,30 +190,32 @@ function singleEvents(args, view) {
             type: "cua-lab.run.created",
             message: `Created a computer-use run for ${args.studyId} (actor ${args.actorId}).`,
         },
-        args.subjectProvenance
+        subject.source === "clone" || subject.source === "local-tree"
             ? participantEvent(SINGLE, {
                 id: "event-001-subject",
                 at: args.run.createdAt,
                 level: "info",
                 type: "cua-lab.subject.provenance",
                 // Claim "cloned/packed and served" only when it actually happened.
-                message: `${subjectProvenanceMessage(args.subjectProvenance, publicAppUrl, args.dryRun, args.session !== undefined)} (subject env names: ${args.subjectProvenance.envNames.length > 0 ? args.subjectProvenance.envNames.join(", ") : "none"}; values never persisted); state: ${describeSubjectState(args.subjectProvenance.state, args.dryRun)}.`,
+                message: `${subjectProvenanceMessage(subject, publicAppUrl, args.dryRun, args.session !== undefined)} (subject env names: ${subject.envNames !== undefined && subject.envNames.length > 0 ? subject.envNames.join(", ") : "none"}; values never persisted); state: ${describeSubjectState(subject.state, args.dryRun)}.`,
             })
             : participantEvent(SINGLE, {
                 id: "event-001-subject",
                 at: args.run.createdAt,
                 level: "info",
                 type: "cua-lab.subject.declared",
-                // Declare what the subject was, including the absence of a pin. A
-                // local-app / in-process subject is an already-running local dev server the caller
-                // provisioned; it cannot be commit-pinned, so its provenance is unpinned and
-                // no E2B desktop was created. A plain app-url entry runs inside the desktop sandbox, or,
-                // on the local VM, reaches the host's loopback from the VM's browser.
-                message: args.entryKind === "local-app"
-                    ? `Subject app declared at ${publicAppUrl}: a running local dev server driven in this process, with no clone and no E2B desktop. Provenance: provided by the caller and unpinned, because a running dev server has no commit to pin.`
-                    : runnerSubstrate(args) === "local-desktop"
-                        ? `Subject app declared at ${publicAppUrl} (the host's loopback, opened from a browser on a local VM).`
-                        : `Subject app declared at ${publicAppUrl} (loopback inside the desktop sandbox).`,
+                // Declare what the subject was, including the absence of a pin. A desktop-cli product
+                // is named, since it has no URL. A local-app / in-process subject is an already-running
+                // local dev server the caller provisioned; it cannot be commit-pinned, so its provenance
+                // is unpinned and no E2B desktop was created. A plain app-url entry runs inside the
+                // desktop sandbox, or, on the local VM, reaches the host's loopback from the VM's browser.
+                message: subject.source === "desktop-cli"
+                    ? `Subject product declared: ${subject.product}, used from a terminal window inside the desktop sandbox.`
+                    : args.entryKind === "local-app"
+                        ? `Subject app declared at ${publicAppUrl}: a running local dev server driven in this process, with no clone and no E2B desktop. Provenance: provided by the caller and unpinned, because a running dev server has no commit to pin.`
+                        : runnerSubstrate(args) === "local-desktop"
+                            ? `Subject app declared at ${publicAppUrl} (the host's loopback, opened from a browser on a local VM).`
+                            : `Subject app declared at ${publicAppUrl} (loopback inside the desktop sandbox).`,
             }),
         args.session
             ? participantEvent(SINGLE, {
@@ -428,11 +429,7 @@ export function buildSingleParticipantBundle(args) {
         ...(args.providerResources === undefined || args.providerResources.length === 0
             ? {}
             : { providerResources: args.providerResources }),
-        // Structured subject provenance: code pin + state story. Uniform, and
-        // stated on app-url bundles too: the caller minted the URL, its state is the caller's.
-        // CuaSubjectProvenanceArg's two variants (clone, local-tree) are already RunSubjectProvenance-
-        // shaped, so no reconstruction is needed beyond the app-url fallback.
-        subject: args.subjectProvenance ?? { source: "app-url", state: { provenance: "undeclared" } },
+        subject: args.subject,
         ...(cost === undefined ? {} : { cost }),
     };
 }

package/dist/routes/computer-use/subject-projection.d.ts

@@ -2,7 +2,7 @@ import type { ComputerUsePlan } from "../../study/plan-types.js";
 import type { StudySubjectState } from "../../study/types.js";
 import { type RunSubjectProvenance, type RunSubjectStateStepRecord } from "../../run/bundle.js";
 import { type LocalTreeArchive } from "../../subject/local-tree-archive.js";
-import { type DesktopParticipantRun, type CuaSubjectProjection, type CuaSubjectProvenanceArg, type ParticipantRunOutcome } from "./types.js";
+import { type DesktopParticipantRun, type ParticipantRunOutcome } from "./types.js";
 /**
  * Each participant's subject projection. A participant's outcome adds the subject commit it resolved and the
  * state steps it executed; without outcomes (dry run, or a run still in progress) the declared
@@ -15,7 +15,7 @@ export declare function projectParticipantSubjects(args: {
     runs: readonly DesktopParticipantRun[];
     outcomes: readonly ParticipantRunOutcome[] | undefined;
     dryRun: boolean;
-}): CuaSubjectProjection[];
+}): RunSubjectProvenance[];
 /**
  * Resolve the bundle's state marker from the declaration and what actually ran.
  * Precedence: external declared → "unpinned" (seed records, if any, stay attached; a
@@ -28,10 +28,6 @@ export declare function resolveSubjectState(args: {
     dryRun: boolean;
     executed: RunSubjectStateStepRecord[];
 }): RunSubjectProvenance["state"];
-/** Narrow a resolved CuaSubjectProjection into the shape buildSingleParticipantBundle's
- *  subjectProvenance param wants (provisioned-route sources only; app-url stays undeclared, the
- *  default branch that builder already handles). */
-export declare function subjectProvenanceArg(subject: CuaSubjectProjection, publicRepo: string | undefined, subjectEnvNames: string[]): CuaSubjectProvenanceArg | undefined;
 /**
  * The run-level subject for the top level and the bundle. Local-tree participants all pack from the
  * same once-per-run archive, so every participant already carries the identical archiveSha256/commit/dirty and
@@ -39,11 +35,11 @@ export declare function subjectProvenanceArg(subject: CuaSubjectProjection, publ
  * commit; the aggregate carries it only when every participant agrees, and warns when they diverge.
  */
 export declare function aggregateCuaSubject(args: {
-    subjects: readonly CuaSubjectProjection[];
+    subjects: readonly RunSubjectProvenance[];
     outcomes: readonly ParticipantRunOutcome[] | undefined;
     participantCount: number;
     dryRun: boolean;
 }): {
-    subject: CuaSubjectProjection;
+    subject: RunSubjectProvenance;
     warnings: string[];
 };