humanish 0.115.0 → 0.117.0

package/dist/routes/computer-use/bundle-parts.d.ts

@@ -1,11 +1,11 @@
 import { type RunProviderResource, type RunSubjectProvenance } from "../../run/bundle.js";
 import { type ParticipantIds } from "../../run/participant-records.js";
-import { type CuaSubjectProvenanceArg, type ParticipantRunOutcome } from "./types.js";
+import { type ParticipantRunOutcome } from "./types.js";
 /** The human-readable state story appended to the provenance event (and review.md via it). */
 export declare function describeSubjectState(state: RunSubjectProvenance["state"], dryRun: boolean): string;
-/** Human-readable provenance line for the single-participant subject.provenance event:
- *  claims "cloned/packed and served" only when it actually happened. */
-export declare function subjectProvenanceMessage(provenance: CuaSubjectProvenanceArg, publicAppUrl: string, dryRun: boolean, hasSession: boolean): string;
+/** Human-readable provenance line for the single-participant subject.provenance event of a clone
+ *  or local-tree subject: claims "cloned/packed and served" only when it actually happened. */
+export declare function subjectProvenanceMessage(provenance: RunSubjectProvenance, publicAppUrl: string, dryRun: boolean, hasSession: boolean): string;
 export declare function providerResourcesForOutcome(args: {
     outcome: ParticipantRunOutcome | undefined;
     createdAt: string;

package/dist/routes/computer-use/bundle-parts.js

@@ -24,8 +24,8 @@ export function describeSubjectState(state, dryRun) {
             return "external-public (operator-declared, operator-owned public deployment; neither provisioned nor seeded)";
     }
 }
-/** Human-readable provenance line for the single-participant subject.provenance event:
- *  claims "cloned/packed and served" only when it actually happened. */
+/** Human-readable provenance line for the single-participant subject.provenance event of a clone
+ *  or local-tree subject: claims "cloned/packed and served" only when it actually happened. */
 export function subjectProvenanceMessage(provenance, publicAppUrl, dryRun, hasSession) {
     if (provenance.source === "clone") {
         if (dryRun) {

package/dist/routes/computer-use/bundle.d.ts

@@ -1,8 +1,8 @@
 import type { CuaActorDescriptor } from "../../actors/registry.js";
 import type { ComputerUsePlan } from "../../study/plan-types.js";
-import type { BundleRun, RunBundle, RunRerunLineage } from "../../run/bundle.js";
+import type { BundleRun, RunBundle, RunRerunLineage, RunSubjectProvenance } from "../../run/bundle.js";
 import { type Judgment } from "../../run/judge.js";
-import type { CuaParticipantPlan, DesktopParticipantRun, CuaSubjectProjection, CuaSubjectProvenanceArg, ParticipantRunOutcome } from "./types.js";
+import type { CuaParticipantPlan, DesktopParticipantRun, ParticipantRunOutcome } from "./types.js";
 /** What every bundle of one run shares, in progress or final. */
 export interface CuaRunBundleBase {
     /** The run every bundle of it belongs to. */
@@ -32,9 +32,8 @@ interface CuaRunBundleState {
     judgment: Judgment;
     dryRun: boolean;
     outcomes: ParticipantRunOutcome[] | undefined;
-    subjects: CuaSubjectProjection[];
-    aggregateSubject: CuaSubjectProjection;
-    subjectProvenance: CuaSubjectProvenanceArg | undefined;
+    subjects: RunSubjectProvenance[];
+    aggregateSubject: RunSubjectProvenance;
     failFastReason?: string;
     inProgress?: true;
 }

package/dist/routes/computer-use/bundle.js

@@ -117,9 +117,7 @@ function singleParticipantArgs(base, state) {
             }),
         source: base.source,
         ...(state.inProgress === undefined ? {} : { inProgress: state.inProgress }),
-        ...(state.subjectProvenance === undefined
-            ? {}
-            : { subjectProvenance: state.subjectProvenance }),
+        subject: state.aggregateSubject,
         ...(desktopTemplate === undefined ? {} : { desktopTemplate }),
         ...(outcome?.desktopBrowser === undefined ? {} : { desktopBrowser: outcome.desktopBrowser }),
         providerResources: providerResourcesForOutcome({

package/dist/routes/computer-use/e2b-desktop/prepare.js

@@ -5,6 +5,7 @@ import { validatePreparedRunArtifactPaths } from "../../../run/paths.js";
 import { provisionCloneSubject } from "../../../subject/clone.js";
 import { provisionDesktopCli } from "../../../subject/desktop-cli.js";
 import { provisionLocalTreeSubject } from "../../../subject/local-tree.js";
+import { SubjectBuildError } from "../../../subject/serve.js";
 import { inspectDesktopScreenGeometry } from "../../../substrates/e2b/desktop-geometry.js";
 import { observeDesktopResources } from "../../../substrates/e2b/desktop-resources.js";
 import { acquireE2BDesktopSandbox, e2bDesktopTemplate } from "../../../substrates/e2b/sandbox.js";
@@ -166,37 +167,45 @@ export async function provisionParticipantSubject(ctx, state, desktop) {
             onPhase: ctx.onSubjectPhase,
         });
     }
-    if (subject.kind === "clone") {
-        state.subjectCommit = await provisionCloneSubject(shell, {
-            repo: subject.repo,
-            depth: residual.subject.clone?.depth ?? 1,
-            serve: subject.serve,
-            ...(subject.state === undefined ? {} : { state: subject.state }),
-            hasGithubToken: subject.env.includes("GITHUB_TOKEN"),
-            requestTimeoutMs: deps.requestTimeoutMs,
-            scrub: deps.scrubKnownValues,
-            onCommit: (commit) => {
-                state.subjectCommit = commit;
-            },
-            onStateStep: (record) => {
-                state.stateStepRecords.push(record);
-            },
-            onPhase: ctx.onSubjectPhase,
-            ...deps.detachedTimers,
-        });
+    try {
+        if (subject.kind === "clone") {
+            state.subjectCommit = await provisionCloneSubject(shell, {
+                repo: subject.repo,
+                depth: residual.subject.clone?.depth ?? 1,
+                serve: subject.serve,
+                ...(subject.state === undefined ? {} : { state: subject.state }),
+                hasGithubToken: subject.env.includes("GITHUB_TOKEN"),
+                requestTimeoutMs: deps.requestTimeoutMs,
+                scrub: deps.scrubKnownValues,
+                onCommit: (commit) => {
+                    state.subjectCommit = commit;
+                },
+                onStateStep: (record) => {
+                    state.stateStepRecords.push(record);
+                },
+                onPhase: ctx.onSubjectPhase,
+                ...deps.detachedTimers,
+            });
+        }
+        else if (subject.kind === "local-tree" && deps.localTreeArchiveBuffer) {
+            await provisionLocalTreeSubject(shell, {
+                archiveBuffer: deps.localTreeArchiveBuffer,
+                serve: subject.serve,
+                ...(subject.state === undefined ? {} : { state: subject.state }),
+                requestTimeoutMs: deps.requestTimeoutMs,
+                scrub: deps.scrubKnownValues,
+                onStateStep: (record) => {
+                    state.stateStepRecords.push(record);
+                },
+                onPhase: ctx.onSubjectPhase,
+                ...deps.detachedTimers,
+            });
+        }
     }
-    else if (subject.kind === "local-tree" && deps.localTreeArchiveBuffer) {
-        await provisionLocalTreeSubject(shell, {
-            archiveBuffer: deps.localTreeArchiveBuffer,
-            serve: subject.serve,
-            ...(subject.state === undefined ? {} : { state: subject.state }),
-            requestTimeoutMs: deps.requestTimeoutMs,
-            scrub: deps.scrubKnownValues,
-            onStateStep: (record) => {
-                state.stateStepRecords.push(record);
-            },
-            onPhase: ctx.onSubjectPhase,
-            ...deps.detachedTimers,
-        });
+    catch (error) {
+        // A failed serve.build gets its own code, so the run names the step the author has to fix.
+        if (error instanceof SubjectBuildError)
+            state.failureCode = "HUMANISH_COMPUTER_USE_SUBJECT_BUILD_FAILED";
+        throw error;
     }
 }

package/dist/routes/computer-use/fanout-records.js

@@ -3,7 +3,7 @@
 import { participantAssignment } from "../../study/participant-assignment.js";
 import { participantEvent, participantRecord, participantStream, } from "../../run/participant-records.js";
 import { participantCaption } from "../../run/participant-caption.js";
-import { sessionEndingInWords } from "../../run/outcomes.js";
+import { participantSummary } from "../../run/outcomes.js";
 import { declaredScreenForRender } from "../../substrates/e2b/desktop-geometry.js";
 import { describeSubjectState, phaseEventIdSuffix, publicSafeAppUrlLabel } from "./bundle-parts.js";
 import { participantSubjectEnv } from "./types.js";
@@ -60,15 +60,12 @@ function fanoutParticipantRecord(args, spec, index, view) {
         mode: "browser-sim",
         progress: args.inProgress === true && outcome === undefined ? 20 : 100,
         currentStep: reason,
-        summary: session
-            ? `${name} used the app and ${sessionEndingInWords(session.trace)}.`
-            : args.inProgress === true && outcome === undefined
-                ? `${name} is using the app.`
-                : outcome?.skippedReason !== undefined
-                    ? `${name} was ${outcome.skippedReason}.`
-                    : outcome?.sessionError !== undefined
-                        ? `${name} did not finish a session: ${outcome.sessionError}`
-                        : `${name} would use ${publicTargetUrl}; no session ran.`,
+        summary: participantSummary(name, { name: "the app", target: publicTargetUrl }, {
+            trace: session?.trace,
+            skippedReason: outcome?.skippedReason,
+            sessionError: outcome?.sessionError,
+            inProgress: args.inProgress === true && outcome === undefined,
+        }),
         startedAt: args.run.createdAt,
         updatedAt: args.run.createdAt,
     });
@@ -208,7 +205,9 @@ function fanoutSubjectEvents(ctx, spec, view) {
             at: args.run.createdAt,
             level: "info",
             type: "cua-lab.subject.declared",
-            message: `Participant ${spec.planned.id}: subject app declared at ${publicTargetUrl} (loopback inside the participant's own desktop sandbox).`,
+            message: subject.source === "desktop-cli"
+                ? `Participant ${spec.planned.id}: subject product declared: ${subject.product}, used from a terminal window inside the participant's own desktop sandbox.`
+                : `Participant ${spec.planned.id}: subject app declared at ${publicTargetUrl} (loopback inside the participant's own desktop sandbox).`,
         });
     }
     return events;

package/dist/routes/computer-use/live-phase.d.ts

@@ -31,7 +31,7 @@ export declare function runStudyParticipants(setup: CuaRunSetup, participants: C
             killed: boolean;
             streamUrlPresent: boolean;
         };
-        subject?: import("./types.js").CuaSubjectProjection;
+        subject?: import("../../run/bundle.js").RunSubjectProvenance;
         plan?: import("./types.js").CuaParticipantPlan;
         lanes?: import("./types.js").CuaParticipantResult[];
         laneSummary?: import("./types.js").CuaParticipantSummary;

package/dist/routes/computer-use/live-phase.js

@@ -37,7 +37,6 @@ export async function runStudyParticipants(setup, participants) {
             outcomes: undefined,
             subjects: inProgress.subjects,
             aggregateSubject: inProgress.aggregateSubject,
-            subjectProvenance: inProgress.provenance,
             inProgress: true,
         });
         await run.writeSnapshot(inProgressBundle);

package/dist/routes/computer-use/local-vm.js

@@ -139,10 +139,11 @@ function createLocalParticipantDesktop(context, run, warnings, artifactRoot) {
     };
 }
 /** The Codex account participant, whose unconfirmed cleanup blocks the study's analysis. */
-function accountProvider(state) {
+function accountProvider(state, maxWaitMs) {
     return async ({ executor }) => {
         const participant = createRestrictedCodexParticipant({
             speechEnabled: executor.speechEnabled === true,
+            ...(maxWaitMs === undefined ? {} : { maxWaitMs }),
         });
         state.participants.push(participant);
         const provider = Object.assign(participant.provider, {
@@ -183,7 +184,9 @@ export function prepareLocalVmRun(options) {
     };
     const { config: _config, assets: _assets, signal: _signal, ...runOptions } = options;
     return {
-        options: account ? { ...runOptions, createProvider: accountProvider(state) } : runOptions,
+        options: account
+            ? { ...runOptions, createProvider: accountProvider(state, config.actor?.maxWaitMs) }
+            : runOptions,
         localVm: {
             desktop: (run, warnings, artifactRoot) => createLocalParticipantDesktop(context, run, warnings, artifactRoot),
             capacity: () => localRuntimeCapacity(),

package/dist/routes/computer-use/participant-execution.d.ts

@@ -1,5 +1,6 @@
 import { type PreparedOutputRoot } from "../../run/contained-output.js";
-import type { CuaParticipantDeps, CuaParticipantPlan, CuaParticipantResult, DesktopParticipantRun, CuaSubjectProjection, ParticipantRunOutcome } from "./types.js";
+import type { CuaParticipantDeps, CuaParticipantPlan, CuaParticipantResult, DesktopParticipantRun, ParticipantRunOutcome } from "./types.js";
+import type { RunSubjectProvenance } from "../../run/bundle.js";
 /** Build a participant's writeScreenshot closure: writes under screenshots/<screenshotDir>/ and records
  *  the relative path the trace references (screenshots/<name> at N=1; screenshots/<laneId>/<name>
  *  at N>1). */
@@ -24,7 +25,7 @@ export declare function runCuaParticipants(runs: DesktopParticipantRun[], deps:
     failFastReason?: string;
 }>;
 /** Project one participant outcome (or a dry-run contract spec) into the public CuaParticipantResult. */
-export declare function toParticipantResult(spec: DesktopParticipantRun, outcome: ParticipantRunOutcome | undefined, subject: CuaSubjectProjection, dryRun: boolean): CuaParticipantResult;
+export declare function toParticipantResult(spec: DesktopParticipantRun, outcome: ParticipantRunOutcome | undefined, subject: RunSubjectProvenance, dryRun: boolean): CuaParticipantResult;
 /**
  * Run every participant of a live run. The in-process route drives its single participant in this
  * process; one hosted participant runs alone; a fan-out runs at the plan's concurrency and may stop early.

package/dist/routes/computer-use/participant-model.js

@@ -44,6 +44,9 @@ export async function startParticipantModel(spec, deps, executor) {
                 : { reasoningEffort: spec.planned.limits.reasoningEffort }),
             ...(brain.declaredModel === undefined ? {} : { model: brain.declaredModel }),
             ...(executor.speechEnabled === true ? { speechEnabled: true } : {}),
+            ...(spec.planned.limits.maxWaitMs === undefined
+                ? {}
+                : { maxWaitMs: spec.planned.limits.maxWaitMs }),
             session: { env },
         });
         return { provider: codexParticipant.provider, codexParticipant };
@@ -130,6 +133,12 @@ export function participantSessionOptions(spec, deps, ready, provider, writeScre
             ? {}
             : { stopWhen: spec.planned.limits.stopWhen }),
         ...(spec.planned.limits.dwell === undefined ? {} : { dwell: spec.planned.limits.dwell }),
+        ...(spec.planned.limits.maxWaitMs === undefined
+            ? {}
+            : { maxWaitMs: spec.planned.limits.maxWaitMs }),
+        ...(spec.planned.limits.idleWaitMs === undefined
+            ? {}
+            : { idleWaitMs: spec.planned.limits.idleWaitMs }),
         ...(spec.planned.tasks === undefined ? {} : { tasks: spec.planned.tasks }),
         // The study budget: this participant notes its own running estimate on the shared
         // ledger and stops when the run total crosses the cap, independent of the per-participant

package/dist/routes/computer-use/participant-runs.d.ts

@@ -4,14 +4,18 @@ import { type ResolvedPersona } from "../../study/persona.js";
 import { type RunRerunLineage } from "../../run/bundle.js";
 import type { PreparedSelectedOutputDirectory } from "../../run/contained-output.js";
 import { type CuaActorStudyErrorCode, type CuaParticipantPlan, type CuaParticipantPlanEntry, type DesktopParticipantRun, type ParticipantRunsAndPlan } from "./types.js";
-export declare function defaultSessionTimeoutMs(config: StudyConfig): number;
+/**
+ * The session budget of a study that declares no execution.timeoutMs. On a provisioned route it is
+ * what the `ceilingMs` sandbox ceiling leaves after provisioning, seeding and the teardown buffer.
+ */
+export declare function defaultSessionTimeoutMs(config: StudyConfig, ceilingMs: number): number;
 /** Per-participant sandbox deadline (each one owns its own desktop). Mirrors the
  *  single-participant formula verbatim so N=1 stays byte-stable: explicit sandboxTimeoutMs, else session budget + (clone
  *  or local-tree: provision budget + Σ state-step budgets) + the server-side
  *  reclamation buffer. Local-tree shares the clone route's provisioning budget: it swaps a
  *  git clone for an upload+extract, but the shared install/build/state/start/probe pipeline
  *  costs the same wall-clock room either way. */
-export declare function resolveParticipantSandboxMs(config: StudyConfig): number;
+export declare function resolveParticipantSandboxMs(config: StudyConfig, ceilingMs: number): number;
 /**
  * The in-flight participant bound a study declares. Defaults to the participant count: every
  * declared participant runs at once, because a throttle nobody asked for silently turns "N actors

package/dist/routes/computer-use/participant-runs.js

@@ -12,18 +12,22 @@ import {} from "../../run/bundle.js";
 import { participantAssignment } from "../../study/participant-assignment.js";
 import { resolveCommittedPersonas } from "../../study/persona-resolve.js";
 import { CUA_FANOUT_STRATEGY, CUA_MAX_CONCURRENCY_ENV, DEFAULT_APP_URL_SESSION_TIMEOUT_MS, MIN_DERIVED_SESSION_TIMEOUT_MS, } from "./types.js";
-import { MAX_SANDBOX_MS, SANDBOX_TIMEOUT_BUFFER_MS, SUBJECT_PROVISION_BUDGET_MS, } from "../../substrates/e2b/lifetime.js";
+import { SANDBOX_TIMEOUT_BUFFER_MS, SUBJECT_PROVISION_BUDGET_MS, } from "../../substrates/e2b/lifetime.js";
 import { readPositiveInt } from "../../study/parse/values.js";
 import { digestUrl } from "./bundle-parts.js";
 import { composeParticipantInstructions, DEFAULT_MISSION } from "./participant-prompt.js";
 import { resolveCuaRerunSelection } from "./rerun-selection.js";
 import { plural } from "../../run/text.js";
-export function defaultSessionTimeoutMs(config) {
+/**
+ * The session budget of a study that declares no execution.timeoutMs. On a provisioned route it is
+ * what the `ceilingMs` sandbox ceiling leaves after provisioning, seeding and the teardown buffer.
+ */
+export function defaultSessionTimeoutMs(config, ceilingMs) {
     const provisionedRoute = config.subject.source === "clone" || config.subject.source === "local-tree";
     if (!provisionedRoute)
         return DEFAULT_APP_URL_SESSION_TIMEOUT_MS;
     const stateBudgetMs = (config.subject.state?.seed ?? []).reduce((sum, step) => sum + (step.timeoutMs ?? DEFAULT_STATE_STEP_TIMEOUT_MS), 0);
-    const room = MAX_SANDBOX_MS - SUBJECT_PROVISION_BUDGET_MS - stateBudgetMs - SANDBOX_TIMEOUT_BUFFER_MS;
+    const room = ceilingMs - SUBJECT_PROVISION_BUDGET_MS - stateBudgetMs - SANDBOX_TIMEOUT_BUFFER_MS;
     return Math.max(MIN_DERIVED_SESSION_TIMEOUT_MS, Math.min(DEFAULT_APP_URL_SESSION_TIMEOUT_MS, room));
 }
 /** Per-participant sandbox deadline (each one owns its own desktop). Mirrors the
@@ -32,10 +36,10 @@ export function defaultSessionTimeoutMs(config) {
  *  reclamation buffer. Local-tree shares the clone route's provisioning budget: it swaps a
  *  git clone for an upload+extract, but the shared install/build/state/start/probe pipeline
  *  costs the same wall-clock room either way. */
-export function resolveParticipantSandboxMs(config) {
+export function resolveParticipantSandboxMs(config, ceilingMs) {
     if (isLocalBrowserStudy(config))
         return LOCAL_BROWSER_LIFETIME_MS;
-    const timeoutMs = config.execution?.timeoutMs ?? defaultSessionTimeoutMs(config);
+    const timeoutMs = config.execution?.timeoutMs ?? defaultSessionTimeoutMs(config, ceilingMs);
     const provisionedRoute = config.subject.source === "clone" || config.subject.source === "local-tree";
     const stateBudgetMs = provisionedRoute
         ? (config.subject.state?.seed ?? []).reduce((sum, step) => sum + (step.timeoutMs ?? DEFAULT_STATE_STEP_TIMEOUT_MS), 0)

package/dist/routes/computer-use/plan.d.ts

@@ -1,6 +1,7 @@
 import { type CuaActorDescriptor } from "../../actors/registry.js";
 import type { ComputerUsePlan, ComputerUseRunner, RoutePlanResult, RouteRefusal } from "../../study/plan-types.js";
 import type { StudyConfig, StudySubjectState } from "../../study/types.js";
+import { type SandboxCeiling } from "../../substrates/e2b/lifetime.js";
 import { type ComputerUseRunInput, type CuaActorStudyErrorCode } from "./types.js";
 /** The error a computer-use study returns before a run starts. */
 export interface ComputerUseRefusal extends RouteRefusal<"computer-use", CuaActorStudyErrorCode> {
@@ -45,4 +46,6 @@ export declare function planComputerUseStudy(config: StudyConfig, input: {
     readonly driving?: CallerDriving;
     readonly countOverride?: number;
     readonly rerun?: ComputerUseRunInput["rerun"];
+    /** The longest sandbox lifetime the operator's E2B plan allows (sandboxCeiling). */
+    readonly sandboxCeiling: SandboxCeiling;
 }): ComputerUsePlanResult;

package/dist/routes/computer-use/plan.js

@@ -10,11 +10,11 @@ import { subjectStateInvalidReason } from "../../study/parse/subject-state.js";
 import { brainOf, callerBrainOf, planCaps, desktopRequirements, planBase, provisionedSubject, } from "../../study/plan-base.js";
 import { computerUseParticipants, declaredTargets } from "../../study/plan-participants.js";
 import { MAX_COMPUTER_USE_PARTICIPANTS } from "../../study/routing.js";
-import { cloneTargetValidationReason, computerUseValidationReason, desktopMediaValidationReason, outputTokenLimitValidationReason, receivingEmailValidationReason, taskProtocolValidationReason, } from "../../study/validation.js";
+import { cloneTargetValidationReason, computerUseValidationReason, desktopMediaValidationReason, outputTokenLimitValidationReason, receivingEmailValidationReason, taskProtocolValidationReason, waitLimitValidationReason, } from "../../study/validation.js";
 import { desktopCliProductReason } from "../../study/composition-rules.js";
 import { isLocalBrowserStudy } from "../../substrates/local/runtime-config.js";
 import { boundedConcurrency, defaultSessionTimeoutMs, resolveParticipantSandboxMs, } from "./participant-runs.js";
-import { MAX_SANDBOX_MS } from "../../substrates/e2b/lifetime.js";
+import { ceilingAdvice } from "../../substrates/e2b/lifetime.js";
 import {} from "./types.js";
 /** The registered descriptor for a planned actor id; planComputerUseStudy checked the registry. */
 export function cuaDescriptorOf(actor) {
@@ -74,16 +74,18 @@ const invalid = (message) => ({
  * is touched. The parser enforces most of these too; the engine repeats them for library callers
  * that hand it a config directly. The groups run in this order, and each returns its first reason.
  */
-function cuaStudyRejection(config, hasRunSession, driving, subjectRoute) {
+function cuaStudyRejection(config, hasRunSession, driving, subjectRoute, ceilingMs) {
     return (unsupportedDeclarationReason(config, hasRunSession, driving, subjectRoute) ??
         subjectStructureReason(config, subjectRoute) ??
         entryTargetReason(config, subjectRoute) ??
         driverReason(driving, subjectRoute) ??
-        rosterShapeReason(config));
+        rosterShapeReason(config, ceilingMs));
 }
 /** A declaration this route cannot honor, for any subject or with the caller's own driver. */
 function unsupportedDeclarationReason(config, hasRunSession, driving, { inProcessRoute }) {
-    const reason = desktopMediaValidationReason(config) || outputTokenLimitValidationReason(config);
+    const reason = desktopMediaValidationReason(config) ||
+        outputTokenLimitValidationReason(config) ||
+        waitLimitValidationReason(config);
     if (reason)
         return invalid(reason);
     if (config.actor?.maxOutputTokens !== undefined &&
@@ -173,7 +175,7 @@ function driverReason(driving, { localAppSubject, inProcessRoute }) {
     return undefined;
 }
 /** The participant roster, then the sandbox deadline its session budget derives. */
-function rosterShapeReason(config) {
+function rosterShapeReason(config, ceilingMs) {
     // Device XOR raw resolution, cap, unique ids,
     // allowPublicTargets with more than one participant, clone.fanout.
     const fanoutReason = computerUseValidationReason(config);
@@ -182,13 +184,13 @@ function rosterShapeReason(config) {
     // The sandbox deadline is derived from the session budget, so a study can ask for a session that
     // cannot legally be provisioned. Show the arithmetic: the provider's own error names a limit
     // but not which knob produced it.
-    const derivedSandboxMs = resolveParticipantSandboxMs(config);
-    if (derivedSandboxMs <= MAX_SANDBOX_MS)
+    const derivedSandboxMs = resolveParticipantSandboxMs(config, ceilingMs);
+    if (derivedSandboxMs <= ceilingMs)
         return undefined;
     const provisionedRoute = config.subject.source === "clone" || config.subject.source === "local-tree";
-    const sessionMs = config.execution?.timeoutMs ?? defaultSessionTimeoutMs(config);
+    const sessionMs = config.execution?.timeoutMs ?? defaultSessionTimeoutMs(config, ceilingMs);
     const headroomMs = derivedSandboxMs - sessionMs;
-    return invalid(`execution.timeoutMs ${Math.round(sessionMs / 60_000)}m derives a ${Math.round(derivedSandboxMs / 60_000)}m sandbox deadline, and a sandbox may not live longer than ${MAX_SANDBOX_MS / 60_000}m. The deadline is the session budget plus ${Math.round(headroomMs / 60_000)}m of provisioning and teardown headroom${provisionedRoute ? " (this route clones, installs, builds and serves the subject before the actor starts)" : ""}. Lower execution.timeoutMs to at most ${Math.round((MAX_SANDBOX_MS - headroomMs) / 60_000)}m, or set execution.desktop.sandboxTimeoutMs explicitly.`);
+    return invalid(`execution.timeoutMs ${Math.round(sessionMs / 60_000)}m derives a ${Math.round(derivedSandboxMs / 60_000)}m sandbox deadline, and a sandbox may not live longer than ${ceilingMs / 60_000}m. The deadline is the session budget plus ${Math.round(headroomMs / 60_000)}m of provisioning and teardown headroom${provisionedRoute ? " (this route clones, installs, builds and serves the subject before the actor starts)" : ""}. Lower execution.timeoutMs to at most ${Math.round((ceilingMs - headroomMs) / 60_000)}m, or set execution.desktop.sandboxTimeoutMs explicitly.${ceilingAdvice(derivedSandboxMs)}`);
 }
 /** The plan's rerun: the source run and, when given, the participants to rerun. */
 function rerunPlan({ sourceRunId, participantIds, }) {
@@ -223,7 +225,10 @@ export function planComputerUseStudy(config, input) {
     if (!descriptor || !isCuaActorDescriptor(descriptor))
         return refuse("in-scope", "HUMANISH_COMPUTER_USE_ACTOR_UNSUPPORTED", `actor.type "${actorType}" is not a registered computer-use actor.`);
     const actor = descriptor.id;
-    const rejection = cuaStudyRejection(config, hasRunSession, driving, declaredSubjectRoute(config, driving));
+    const ceiling = input.sandboxCeiling;
+    if (!ceiling.ok)
+        return refuse("in-scope", "HUMANISH_COMPUTER_USE_SUBJECT_INVALID", ceiling.message, actor);
+    const rejection = cuaStudyRejection(config, hasRunSession, driving, declaredSubjectRoute(config, driving), ceiling.ms);
     if (rejection)
         return refuse("in-scope", rejection.code, rejection.message, actor);
     // A shared world runs every participant against one app; this route would run them as separate
@@ -288,8 +293,8 @@ export function planComputerUseStudy(config, input) {
             actor,
             runner,
             concurrency: boundedConcurrency(declared, n),
-            sessionBudgetMs: config.execution?.timeoutMs ?? defaultSessionTimeoutMs(config),
-            sandboxMs: resolveParticipantSandboxMs(config),
+            sessionBudgetMs: config.execution?.timeoutMs ?? defaultSessionTimeoutMs(config, ceiling.ms),
+            sandboxMs: resolveParticipantSandboxMs(config, ceiling.ms),
             caps: planCaps(config),
             ...(input.rerun === undefined ? {} : { rerun: rerunPlan(input.rerun) }),
             requirements: base.dryRun || runner.desktop === "in-process"

package/dist/routes/computer-use/rerun-selection.js

@@ -2,10 +2,10 @@
 // participants that failed, blocked, timed out or finished hollow are picked unless ids are given.
 import {} from "../../run/bundle.js";
 import { loadRunBundle } from "../../run/locate.js";
+import { resolveLatestRunPointer } from "../../run/paths.js";
 import {} from "../../run/streams.js";
 import { plural } from "../../run/text.js";
 import { access } from "node:fs/promises";
-import path from "node:path";
 import { cli } from "../../cli/invocation.js";
 export async function resolveCuaRerunSelection(args) {
     const { studyId, sourceRunId } = args;
@@ -16,7 +16,7 @@ export async function resolveCuaRerunSelection(args) {
     const source = await loadRunBundle(args.cwd, sourceRunId);
     if (!source) {
         const noRuns = sourceRunId === "latest" &&
-            !(await access(path.join(args.cwd, ".humanish", "runs", "latest.json")).then(() => true, () => false));
+            !(await access(resolveLatestRunPointer(args.cwd)).then(() => true, () => false));
         return refuse(noRuns
             ? "--rerun-failed-from latest found no run: this project has no runs yet, and a rerun repeats the failed participants of an earlier live run."
             : `--rerun-failed-from ${sourceRunId} names no run humanish can read in this project. ${cli("runs")} lists its runs.`);

package/dist/routes/computer-use/result.js

@@ -7,8 +7,8 @@ import { participantCapWarning } from "./participant-model.js";
 import { summarizeCuaDiagnostics } from "./diagnostics.js";
 import { toParticipantResult } from "./participant-execution.js";
 import { buildCuaRunBundle, judgeComputerUseRun } from "./bundle.js";
-import { aggregateCuaSubject, projectParticipantSubjects, subjectProvenanceArg, } from "./subject-projection.js";
-import { CUA_FANOUT_STRATEGY, participantSubjectEnv, } from "./types.js";
+import { aggregateCuaSubject, projectParticipantSubjects } from "./subject-projection.js";
+import { CUA_FANOUT_STRATEGY, } from "./types.js";
 import { plannedAppUrl } from "./plan.js";
 import { studyResultIdentity } from "../../run/study-result.js";
 import { plural } from "../../run/text.js";
@@ -157,10 +157,9 @@ function cuaStudyResult(args) {
 export async function finishCuaRun(setup, finish, ran) {
     const { plan, input, cwd, streams, descriptor, run } = setup;
     const { participantRuns, participantPlan, bundleBase } = setup;
-    const { rerunLineage, publicRepo, subjectArgs } = finish;
+    const { rerunLineage, subjectArgs } = finish;
     const { dryRun } = plan;
     const appUrl = plannedAppUrl(plan.runner.subject);
-    const subjectEnvNames = [...participantSubjectEnv(plan.runner.subject)];
     const { runId } = run;
     const participantCount = participantRuns.length;
     const { outcomes, failFastReason, receiving, receivingWarnings, externalCommsWarnings } = ran;
@@ -174,7 +173,6 @@ export async function finishCuaRun(setup, finish, ran) {
         ...(capWarning === undefined ? [] : [capWarning]),
         ...aggregate.warnings,
     ];
-    const finalProvenance = subjectProvenanceArg(aggregateSubject, publicRepo, subjectEnvNames);
     // One judgment for the whole run: the bundle's verdict and the result's ok both read it.
     const judgment = judgeComputerUseRun(bundleBase, { dryRun, outcomes });
     const bundle = buildCuaRunBundle(bundleBase, {
@@ -183,7 +181,6 @@ export async function finishCuaRun(setup, finish, ran) {
         outcomes,
         subjects,
         aggregateSubject,
-        subjectProvenance: finalProvenance,
         ...(failFastReason === undefined ? {} : { failFastReason }),
     });
     const adapterWarnings = [];

package/dist/routes/computer-use/setup.d.ts

@@ -3,14 +3,14 @@ import type { RefusedStudy } from "../../run/route-shell.js";
 import { RunSecrets } from "../../run/secrets.js";
 import type { CuaActorDescriptor } from "../../actors/registry.js";
 import type { StudyCommsEmail, StudyCommsExternal, StudyConfig } from "../../study/types.js";
-import { type RunRerunLineage } from "../../run/bundle.js";
+import { type RunRerunLineage, type RunSubjectProvenance } from "../../run/bundle.js";
 import { type LocalTreeArchive } from "../../subject/local-tree-archive.js";
 import { type ComputerUseRefusal } from "./plan.js";
 import type { ComputerUsePlan } from "../../study/plan-types.js";
 import { trackRuntimeStreams, type LiveTraceFlush } from "./live-flush.js";
 import { type CuaRunBundleBase } from "./bundle.js";
 import { projectParticipantSubjects } from "./subject-projection.js";
-import { type CuaActorStudyErrorCode, type CuaActorStudyResult, type CuaParticipantDeps, type CuaParticipantPlan, type DesktopParticipantRun, type CuaSubjectProjection, type CuaSubjectProvenanceArg, type ComputerUseRunInput } from "./types.js";
+import { type CuaActorStudyErrorCode, type CuaActorStudyResult, type CuaParticipantDeps, type CuaParticipantPlan, type DesktopParticipantRun, type ComputerUseRunInput } from "./types.js";
 /**
  * The envelope of a refusal the plan left for after the cwd checks. The participant cap and
  * in-process fan-out refusals come after the committed personas are read, so a persona-file error still wins.
@@ -51,9 +51,8 @@ export interface CuaParticipantsSetup {
     } | undefined;
     /** The subjects of the in-progress bundle, written before any participant starts. */
     inProgress: {
-        subjects: CuaSubjectProjection[];
-        aggregateSubject: CuaSubjectProjection;
-        provenance: CuaSubjectProvenanceArg | undefined;
+        subjects: RunSubjectProvenance[];
+        aggregateSubject: RunSubjectProvenance;
     };
     /** The refusal envelope, for a run that stops before its bundle. */
     fail: (code: CuaActorStudyErrorCode, message: string, actorLabel?: string) => CuaActorStudyResult;
@@ -61,7 +60,6 @@ export interface CuaParticipantsSetup {
 /** What only finishCuaRun reads besides the participants' outcomes. */
 export interface CuaFinishFacts {
     rerunLineage: RunRerunLineage | undefined;
-    publicRepo: string | undefined;
     subjectArgs: Omit<Parameters<typeof projectParticipantSubjects>[0], "outcomes" | "dryRun">;
 }
 type PreparedCuaRun = {

package/dist/routes/computer-use/setup.js

@@ -20,7 +20,7 @@ import { phaseEvent, planEvent } from "../../study/run-study-events.js";
 import { defaultSubjectPhaseSink } from "../../subject/steps.js";
 import {} from "./bundle.js";
 import { packRunLocalTree } from "./local-tree-pack.js";
-import { projectParticipantSubjects, subjectProvenanceArg } from "./subject-projection.js";
+import { projectParticipantSubjects } from "./subject-projection.js";
 import { participantSubjectEnv, } from "./types.js";
 import { capacityShortfall } from "../../substrates/local/capacity.js";
 import { studyPersonaIds } from "../../study/persona-resolve.js";
@@ -248,9 +248,6 @@ export async function startCuaRun(plan, input, admitted, scope) {
         dryRun: false,
     });
     const inProgressAggregateSubject = inProgressSubjects[0];
-    const inProgressProvenance = subjectProvenanceArg(inProgressAggregateSubject, publicRepo, [
-        ...participantSubjectEnv(plan.runner.subject),
-    ]);
     const bundleBase = {
         run,
         participantRuns,
@@ -287,11 +284,10 @@ export async function startCuaRun(plan, input, admitted, scope) {
             inProgress: {
                 subjects: inProgressSubjects,
                 aggregateSubject: inProgressAggregateSubject,
-                provenance: inProgressProvenance,
             },
             fail: admitted.fail,
         },
-        finish: { rerunLineage: admitted.rerunLineage, publicRepo, subjectArgs },
+        finish: { rerunLineage: admitted.rerunLineage, subjectArgs },
     };
 }
 /** The participant deps every participant reads, with computer use's own overrides. */

package/dist/routes/computer-use/single-bundle.d.ts

@@ -3,11 +3,10 @@ import type { SubjectPhaseEvent } from "../../subject/steps.js";
 import type { DesktopBrowserEvidence } from "../../substrates/e2b/desktop-browser.js";
 import type { ActorPersonaRef } from "../../actors/contract.js";
 import type { CuaLoopResult } from "../../actors/computer-use/loop.js";
-import { type BundleRun, type RunBundle, type RunFeedbackCandidate, type RunProviderResource } from "../../run/bundle.js";
+import { type BundleRun, type RunBundle, type RunFeedbackCandidate, type RunProviderResource, type RunSubjectProvenance } from "../../run/bundle.js";
 import { type RunDesktopGeometry, type RunStream } from "../../run/streams.js";
 import { type Verdict } from "../../run/judge.js";
 import { type DesktopUsage } from "../../run/cost-summary.js";
-import type { CuaSubjectProvenanceArg } from "./types.js";
 /**
  * The bundle of a single-participant run: one participant and no rerun. buildCuaRunBundle
  * (bundle.ts) maps the run's base and state into these arguments.
@@ -70,9 +69,9 @@ export declare function buildSingleParticipantBundle(args: {
         reportedFriction: boolean;
     };
     source: RunBundle["source"];
-    /** Provisioned-route provenance (clone or local-tree): what the actor actually drove (names
-     * + digests only, never values or command text), including the subject's state story. */
-    subjectProvenance?: CuaSubjectProvenanceArg;
+    /** The subject as subject-projection.ts projects it (names and digests only, never values or
+     * command text): run.json records it as `subject`, and the subject event describes it. */
+    subject: RunSubjectProvenance;
     /**
      * Entry kind for the non-clone subject.declared event, which declares what the subject
      * was. "local-app": an already-running local dev server driven in-process, un-pinnable, and