humanish 0.134.0 → 0.135.0

package/dist/routes/computer-use/fanout-bundle.js

@@ -2,7 +2,7 @@ import { e2bDesktopTemplate } from "../../substrates/e2b/sandbox.js";
 import { receivingPublication } from "../../comms/receiving-runtime.js";
 import { actorEnding } from "../../actors/stop-cause.js";
 import { cuaGoalSource } from "../../actors/goal-source.js";
-import { redactText } from "../../evidence/redaction.js";
+import { redactEncodedText } from "../../evidence/encoded-text.js";
 import { REVIEW_SCHEMA, bundleArtifacts, bundleHead, } from "../../run/bundle.js";
 import { aggregateTaskFunnels, formatParticipantOutcomes, formatRunTaskFunnel, gapsListClause, skippedSentence, withCuaReviewProvenance, } from "../../run/outcomes.js";
 import { providerResourcesForOutcome, publicSafeAppUrlLabel, streakGaps } from "./bundle-parts.js";
@@ -186,7 +186,7 @@ function fanoutFeedbackCandidates(args) {
                     participantId: spec.planned.id,
                     streamId: spec.streamId,
                     personaId: spec.persona.id,
-                    goal: redactText(spec.evidenceInstructions ?? spec.instructions),
+                    goal: redactEncodedText(spec.evidenceInstructions ?? spec.instructions),
                     ...(outcome?.session === undefined ? {} : { session: outcome.session }),
                     ...(outcome?.session === undefined
                         ? {}
@@ -270,7 +270,7 @@ export function buildCuaFanoutBundle(args) {
             // this writer produced. The only adopter-side workaround was scanner evasion.
             //
             // The instructions the model actually receives are untouched; only the persisted copy changes.
-            goal: redactText(specs[0].evidenceInstructions ?? specs[0].instructions),
+            goal: redactEncodedText(specs[0].evidenceInstructions ?? specs[0].instructions),
             source: `study:${plan.studyId}`,
             sourceDigest: specs[0].persona.promptDigest,
         },

package/dist/routes/computer-use/participant-runs.js

@@ -6,7 +6,7 @@ import { isLocalBrowserStudy, LOCAL_BROWSER_LIFETIME_MS, } from "../../substrate
 import { resolveParticipant } from "../../run/participant.js";
 import {} from "../../study/types.js";
 import { scrubPersonaBrief } from "../../study/persona.js";
-import { redactText } from "../../evidence/redaction.js";
+import { redactEncodedText } from "../../evidence/encoded-text.js";
 import {} from "../../run/bundle.js";
 import { participantAssignment } from "../../study/participant-assignment.js";
 import { resolveCommittedPersonas } from "../../study/persona-resolve.js";
@@ -237,7 +237,7 @@ export function sanitizeParticipantRuns(runs, scrub) {
     for (const spec of runs) {
         if (spec.evidenceAssignment)
             spec.evidenceAssignment = participantAssignment(spec.evidenceAssignment, scrub);
-        spec.evidenceInstructions = redactText(scrub(spec.instructions));
+        spec.evidenceInstructions = redactEncodedText(scrub(spec.instructions));
         spec.persona = scrubPersonaBrief(spec.persona, scrub);
     }
 }

package/dist/routes/computer-use/single-bundle.js

@@ -1,5 +1,5 @@
 import { participantAssignment } from "../../study/participant-assignment.js";
-import { redactText } from "../../evidence/redaction.js";
+import { redactEncodedText } from "../../evidence/encoded-text.js";
 import { REVIEW_SCHEMA, bundleArtifacts, bundleHead, } from "../../run/bundle.js";
 import {} from "../../run/streams.js";
 import { aggregateTaskFunnels, formatParticipantOutcomes, formatRunTaskFunnel, participantSummary, withCuaReviewProvenance, } from "../../run/outcomes.js";
@@ -385,7 +385,7 @@ export function buildSingleParticipantBundle(args) {
         scenario: {
             id: `cua-${args.studyId}`,
             title: args.studyTitle ?? `Computer-use run: ${args.studyId}`,
-            goal: redactText(args.mission),
+            goal: redactEncodedText(args.mission),
             source: `study:${args.studyId}`,
             sourceDigest: args.persona.promptDigest,
         },
@@ -425,7 +425,7 @@ export function buildSingleParticipantBundle(args) {
                         participantId: args.participantId ?? "lane-01",
                         streamId: SINGLE.streamId,
                         personaId: args.persona.id,
-                        goal: redactText(args.mission),
+                        goal: redactEncodedText(args.mission),
                         ...(args.session === undefined ? {} : { session: args.session }),
                         ...(args.traceArtifactPath === undefined
                             ? {}

package/dist/routes/scripted/setup.js

@@ -8,6 +8,7 @@ import { resolveBrowserCommand } from "../../actors/scripted-browser/browser-com
 import { publicSafeToken } from "../../actors/scripted-browser/journey.js";
 import { prepareSelectedOutputDirectory } from "../../run/contained-output.js";
 import { RunSecrets } from "../../run/secrets.js";
+import { redactEncodedText } from "../../evidence/encoded-text.js";
 import { evidenceAppUrlOf } from "./plan.js";
 import { resolveScriptedScenario } from "./scenario.js";
 import {} from "./types.js";
@@ -55,6 +56,9 @@ export async function prepareScriptedRun(plan, input) {
             result: failed("HUMANISH_SCRIPTED_SCENARIO_INVALID", scenario.message),
         };
     }
+    const steps = recordedStepIds(scenario.journey.steps, secrets);
+    if (!steps.ok)
+        return { ok: false, result: failed("HUMANISH_SCRIPTED_SCENARIO_INVALID", steps.message) };
     // The goal, title and step labels are recorded; a step's path, selector, value and expected text
     // drive the browser and stay as written.
     const journey = {
@@ -62,9 +66,9 @@ export async function prepareScriptedRun(plan, input) {
         scenarioId: idHoldsKnownValue(scenario.journey.scenarioId, secrets)
             ? "scenario"
             : scenario.journey.scenarioId,
-        goal: secrets.scrub(scenario.journey.goal),
-        scenarioTitle: secrets.scrub(scenario.journey.scenarioTitle),
-        steps: recordedStepIds(scenario.journey.steps, secrets),
+        goal: recordedText(scenario.journey.goal, secrets),
+        scenarioTitle: recordedText(scenario.journey.scenarioTitle, secrets),
+        steps: steps.steps,
     };
     // The plan lists E2B_API_KEY and the subject env only for a live clone.
     const { requirements } = plan;
@@ -127,6 +131,13 @@ export async function prepareScriptedRun(plan, input) {
         },
     };
 }
+/**
+ * Scenario text the run records, without the run's known values and then without keys as written
+ * or encoded, since verify decodes the files that record it.
+ */
+function recordedText(text, secrets) {
+    return redactEncodedText(secrets.scrub(text));
+}
 /**
  * Whether an id holds a known value as written or as the parser's id token of it, lower-cased with
  * other characters as `-`, which the scrub would not find.
@@ -139,22 +150,56 @@ function idHoldsKnownValue(id, secrets) {
         }));
 }
 /**
- * The steps with their labels scrubbed and their ids safe to record. A step id names the step's
- * screenshot file and is recorded beside it, and the parser derives an omitted id from the label,
- * lower-cased and cut to 80 characters, so the scrub may not find a value in it. A step whose
- * label or id holds a known value is renamed by its position instead.
+ * The steps with their labels redacted and their ids safe to record, or why the run is refused. A
+ * step id names the step's screenshot file and is recorded beside it, and the parser derives an
+ * omitted id from the label, lower-cased and cut to 80 characters, so the scrub may not find a
+ * value in it. A step whose label changes under recordedText, or whose id holds a known value, is
+ * renamed by its position instead.
  */
 function recordedStepIds(steps, secrets) {
     const taken = new Set(steps.map((step) => step.id));
-    return steps.map((step, index) => {
-        const label = secrets.scrub(step.label);
-        if (label === step.label && !idHoldsKnownValue(step.id, secrets))
-            return { ...step, label };
-        const position = `step-${String(index + 1).padStart(2, "0")}`;
-        let id = position;
-        for (let suffix = 2; taken.has(id); suffix += 1)
-            id = `${position}-${suffix}`;
+    const recorded = [];
+    for (const [index, step] of steps.entries()) {
+        const label = recordedText(step.label, secrets);
+        if (label === step.label && !idHoldsKnownValue(step.id, secrets)) {
+            recorded.push({ ...step, label });
+            continue;
+        }
+        const id = positionId(index, taken, secrets);
+        if (id === undefined)
+            return {
+                ok: false,
+                message: `The label or id of scenario step ${index + 1} holds a key, a local path or a value this run keeps out of its files, so the run renames the step by its position, and each id that position gives holds one of those values too. Remove it from the step's label and id.`,
+            };
         taken.add(id);
-        return { ...step, id, label };
-    });
+        recorded.push({ ...step, id, label });
+    }
+    return { ok: true, steps: recorded };
+}
+/**
+ * The id a renamed step takes by its position, such as step-03 for the third step, then step-03-2,
+ * step-03-3 and on when another step has it. A known value can be one of these ids, so one that
+ * holds a known value is passed over. Every id holds the position id, so a position id that holds a
+ * known value gives undefined at once. Otherwise taken.size + 1 ids that hold no known value are
+ * tried, which includes a free one, as long as known values pass over at most
+ * MAX_KNOWN_VALUE_SKIPS of them; a value such as `-01-` that every numbered id holds gives undefined.
+ */
+function positionId(index, taken, secrets) {
+    const position = `step-${String(index + 1).padStart(2, "0")}`;
+    if (idHoldsKnownValue(position, secrets))
+        return undefined;
+    let skips = 0;
+    for (let suffix = 1; suffix <= taken.size + 1 + skips; suffix += 1) {
+        const id = suffix === 1 ? position : `${position}-${suffix}`;
+        if (taken.has(id))
+            continue;
+        if (!idHoldsKnownValue(id, secrets))
+            return id;
+        if (skips === MAX_KNOWN_VALUE_SKIPS)
+            return undefined;
+        skips += 1;
+    }
+    return undefined;
 }
+// Known values are few, and a numbered id holds one only when the value matches its digits.
+const MAX_KNOWN_VALUE_SKIPS = 32;

package/dist/routes/shared-world/bundle.js

@@ -1,7 +1,7 @@
 // Builds the run bundle for a concurrent shared-world run: per-participant simulations, streams and
 // events, the sharedWorld evidence block and the review summary.
 import { receivingPublication } from "../../comms/receiving-runtime.js";
-import { redactText } from "../../evidence/redaction.js";
+import { redactEncodedText } from "../../evidence/encoded-text.js";
 import { planeStateOf } from "./plan.js";
 import { REVIEW_SCHEMA, bundleArtifacts, bundleHead, } from "../../run/bundle.js";
 import { SHARED_WORLD_SCHEMA, concurrencyFacts, sharedWorldParticipantKeys, } from "../../run/shared-world-evidence.js";
@@ -362,7 +362,7 @@ export function buildConcurrentSharedWorldBundle(args) {
         scenario: {
             id: `concurrent-shared-world-${plan.studyId}`,
             title: plan.title ?? `Concurrent shared-world: ${plan.studyId}`,
-            goal: redactText(actorSpecs[0]?.evidenceInstructions ??
+            goal: redactEncodedText(actorSpecs[0]?.evidenceInstructions ??
                 actorSpecs[0]?.instructions ??
                 "Concurrent shared-world interaction."),
             source: `study:${plan.studyId}`,
@@ -423,7 +423,7 @@ function sharedWorldFeedbackCandidates(args) {
                 participantId: spec.planned.id,
                 streamId: spec.streamId,
                 personaId: spec.persona.id,
-                goal: redactText(spec.evidenceInstructions ?? spec.instructions),
+                goal: redactEncodedText(spec.evidenceInstructions ?? spec.instructions),
                 ...(outcome?.session === undefined
                     ? {}
                     : { session: outcome.session, traceArtifactPath: spec.traceArtifactPath }),

package/dist/routes/shared-world/participant-specs.js

@@ -10,7 +10,7 @@ import { startLiveTraceFlush } from "../computer-use/live-flush.js";
 import { desktopParticipantDeps, } from "../computer-use/participant-deps.js";
 import { resolveCommittedPersonasForCwd } from "../../study/persona-resolve.js";
 import { participantAssignment } from "../../study/participant-assignment.js";
-import { redactText } from "../../evidence/redaction.js";
+import { redactEncodedText } from "../../evidence/encoded-text.js";
 import { sandboxHeadroomMs } from "../../substrates/e2b/lifetime.js";
 // prose-check: model prompt (the participant model reads this, not a person)
 const DEFAULT_MISSION = "You are one of MANY users hitting a shared web application at the same time. The browser is already open at the app. Accomplish your role's task, then stop.";
@@ -178,7 +178,7 @@ export async function buildParticipantSpecs(participants, cwd, scrubKnownValues)
     for (const spec of actorSpecs) {
         if (spec.evidenceAssignment)
             spec.evidenceAssignment = participantAssignment(spec.evidenceAssignment, scrubKnownValues);
-        spec.evidenceInstructions = redactText(scrubKnownValues(spec.instructions));
+        spec.evidenceInstructions = redactEncodedText(scrubKnownValues(spec.instructions));
         spec.persona = scrubPersonaBrief(spec.persona, scrubKnownValues);
     }
     return actorSpecs;

package/dist/routes/terminal/bundle.js

@@ -1,4 +1,4 @@
-import { redactText } from "../../evidence/redaction.js";
+import { redactEncodedText } from "../../evidence/encoded-text.js";
 import { participantAssignment } from "../../study/participant-assignment.js";
 import { REVIEW_SCHEMA, bundleArtifacts, bundleHead, } from "../../run/bundle.js";
 import {} from "../../run/judge.js";
@@ -250,7 +250,7 @@ function terminalRunBundle(args, parts) {
             // The author mission is public-safe committed study text. It is recorded plaintext as the goal,
             // redacted defensively before persisting (it never carries a secret, but the harness never
             // trusts that). The full composed prompt is bound by digest, not text.
-            goal: redactText(args.mission),
+            goal: redactEncodedText(args.mission),
             source: `study:${args.studyId}`,
             sourceDigest: args.persona.promptDigest,
         },

package/dist/run/run.js

@@ -3,6 +3,7 @@
 // their own evidence files; this module owns when the run starts, how it is published, and how it
 // is closed on every exit.
 import { randomBytes } from "node:crypto";
+import { redactEncodedText } from "../evidence/encoded-text.js";
 import { redactText } from "../evidence/redaction.js";
 import { buildObserverData } from "../observer/data.js";
 import { splitObserverData } from "../observer/participant-items.js";
@@ -160,14 +161,14 @@ function runPublisher(args) {
     const { options, runId, createdAt, paths, runStatus, now, admit, participantsRan } = args;
     const observer = observerTarget(options);
     // The study's warnings join whatever events the route wrote, once, in every write. A warning can
-    // quote the study file, which may name a sandbox URL a participant needs, so each goes through
-    // the redaction a run failure gets.
+    // quote the study file, which may name a sandbox URL a participant needs or hold an encoded key,
+    // so each goes through the redaction study text gets.
     const studyWarnings = (options.warnings ?? []).map((message, index) => ({
         id: `event-study-warning-${String(index + 1).padStart(3, "0")}`,
         at: createdAt,
         level: "warn",
         type: "study.warning",
-        message: redactText(message),
+        message: redactEncodedText(message),
     }));
     // So do the host suspensions the heartbeat has seen by the time of the write, and the files the
     // final sandbox id sweep could not read.

package/dist/run-study.d.ts

@@ -21,9 +21,9 @@ export declare function runStudyWith(config: StudyConfig, options: InternalRunSt
 /**
  * The package's study runner (`src/index.ts`): runStudyWith with the public options only. A
  * config that skipped parseStudy is checked first (libraryConfigRefusal): a humanish.lab.v2 config
- * or one with a humanish 0.110 field, no `actor`, or a `route` the config does not take. That, or a
- * field RunStudyOptions no longer has, is refused in the route's own result envelope before
- * anything runs.
+ * or one with a humanish 0.110 field, no `actor`, a `route` the config does not take, or an
+ * `actor.model` verify would flag. That, or a field RunStudyOptions no longer has, is refused in the
+ * route's own result envelope before anything runs.
  */
 export declare function runStudy(config: StudyConfig, options: RunStudyOptions): Promise<StudyOutcome>;
 /** A study planned once: the route's refusal, or the run of its plan. */

package/dist/run-study.js

@@ -34,9 +34,9 @@ export async function runStudyWith(config, options, deps = {}) {
 /**
  * The package's study runner (`src/index.ts`): runStudyWith with the public options only. A
  * config that skipped parseStudy is checked first (libraryConfigRefusal): a humanish.lab.v2 config
- * or one with a humanish 0.110 field, no `actor`, or a `route` the config does not take. That, or a
- * field RunStudyOptions no longer has, is refused in the route's own result envelope before
- * anything runs.
+ * or one with a humanish 0.110 field, no `actor`, a `route` the config does not take, or an
+ * `actor.model` verify would flag. That, or a field RunStudyOptions no longer has, is refused in the
+ * route's own result envelope before anything runs.
  */
 export async function runStudy(config, options) {
     const rejected = libraryConfigRefusal(config);

package/dist/study/bundle-estimate.d.ts

@@ -16,8 +16,6 @@ export interface BundleEstimate {
     readonly runFileBytes: number;
     /** The largest participant trace file, which analysis also reads whole. */
     readonly largestTraceBytes: number;
-    /** Every participant's trace file together, whose items the Observer page joins in one string. */
-    readonly tracesBytes: number;
     /** observer/index.html, which verify reads whole. */
     readonly observerPageBytes: number;
     /** Every file, screenshots included. */

package/dist/study/bundle-estimate.js

@@ -16,13 +16,14 @@
 // observer-data.json leaves the lists out too and was 0.94 to 1.12 of run.json's size on the live
 // runs measured, so it passes 32 MiB only after run.json passes 16 MiB, and the estimate does not
 // check it.
-// The Observer page and the Observer server join every participant's items in one string before
-// gzip. A bundle export renders the Observer page, so it fails there too once --max-bytes is
-// raised past its 25 MiB default, which refuses such a run first. Writing run.json joins none: the
-// sandbox id scrub (publicSandboxView) works one participant at a time. V8's longest string is
-// 536,870,888 characters on Node 24. A trace file's bytes are at least the characters of its
-// items as compact JSON, so the estimate compares the traces' bytes and may warn a little early.
-import { constants } from "node:buffer";
+// A page past 32 MiB grades the run local_only. humanish export then needs --local-only, and a
+// bundle export fails even with it, since its copy must verify as share_ready.
+// The Observer feed, verify, analysis and the run.json writer each hold one participant's items in
+// a string at a time. The page holds all of them gzipped in base64, about 0.18 characters for each
+// trace byte, so it reaches V8's longest string, 536,870,888 characters, near 3 GB of traces.
+// humanish observe on 25 participants with 30 MiB traces wrote a 138 MiB page at a peak of
+// 3.8 GiB, so memory may run out first. Neither limit was measured past that run, and the estimate
+// checks neither.
 import { EVIDENCE_LIMITS } from "../analysis/analysis-limits.js";
 import { RUN_ARTIFACT_MAX_BYTES } from "../run/contained-output.js";
 import { formatDuration } from "../run/projection.js";
@@ -169,7 +170,6 @@ export function estimateBundle(participants, sessionMs) {
     return {
         runFileBytes,
         largestTraceBytes: largestTrace,
-        tracesBytes: traces,
         observerPageBytes,
         // observer-data.json is about run.json's size.
         totalBytes: observerPageBytes + screenshots * RATES.screenshotBytes + traces + 2 * runFileBytes,
@@ -192,7 +192,6 @@ export function estimateBundle(participants, sessionMs) {
 export function bundleLimitReason(estimate) {
     const runFile = estimate.runFileBytes > EVIDENCE_LIMITS.sourceBytes;
     const page = estimate.observerPageBytes > RUN_ARTIFACT_MAX_BYTES;
-    const joined = estimate.tracesBytes > constants.MAX_STRING_LENGTH;
     const entries = estimate.entries > estimate.entryLimit;
     const passed = [
         ...(runFile
@@ -207,12 +206,7 @@ export function bundleLimitReason(estimate) {
             : []),
         ...(page
             ? [
-                `The Observer page, observer/index.html, may grow to about ${mib(estimate.observerPageBytes)}, past the ${mib(RUN_ARTIFACT_MAX_BYTES)} verify reads in one file.`,
-            ]
-            : []),
-        ...(joined
-            ? [
-                `All participants' traces together may grow to about ${mib(estimate.tracesBytes)}, past the ${mib(constants.MAX_STRING_LENGTH)} that fits in one string. The Observer page puts all their items in one string, so the page would not build. A bundle export allowed past its 25 MiB default renders that page, so it would fail too.`,
+                `The Observer page, observer/index.html, may grow to about ${mib(estimate.observerPageBytes)}, past the ${mib(RUN_ARTIFACT_MAX_BYTES)} verify reads in one file, so verify would grade the run local_only: humanish export would refuse it without --local-only, and a bundle export would fail.`,
             ]
             : []),
         ...(entries
@@ -242,7 +236,7 @@ export function bundleLimitReason(estimate) {
         ...(runFile ? ["shorten the mission (actor.mission)"] : []),
     ];
     // A trace is one participant's, so splitting the study helps only the run's own files.
-    if (runFile || page || joined || entries || changes.length === 0)
+    if (runFile || page || entries || changes.length === 0)
         changes.push("split the participants across studies");
     const advice = changes.length < 2
         ? changes.join("")

package/dist/study/config.d.ts

@@ -30,9 +30,10 @@ interface ConfigRefusal {
 }
 /**
  * Why runStudy refuses a config a library caller passes, or undefined: a humanish.lab.v2 config,
- * one that still sets a StudyConfig field of humanish 0.110, one with no `actor` object, and one
- * whose `route` is not the route its subject and actor take, with parseStudy's message. A planner
- * reads only the v3 fields, so a budget left in `execution.caps` would otherwise run uncapped.
+ * one that still sets a StudyConfig field of humanish 0.110, one with no `actor` object, one
+ * whose `route` is not the route its subject and actor take, and one whose `actor.model` verify
+ * would flag, with parseStudy's message. A planner reads only the v3 fields, so a budget left in
+ * `execution.caps` would otherwise run uncapped, and passes the model on as written.
  */
 export declare function libraryConfigRefusal(config: StudyConfig): ConfigRefusal | undefined;
 export {};

package/dist/study/config.js

@@ -30,7 +30,7 @@ import { isLocalBrowserStudy, localBrowserDefaults, localBrowserUnsupportedReaso
 import { isRecord } from "../run/type-guards.js";
 import { compositionReason } from "./composition-rules.js";
 import { V2_SCHEMA, V2_UNSUPPORTED_MESSAGE, v2FieldMoves } from "./migrate/v2.js";
-import { parseActorFields, parseActorType, parseParticipantEntries } from "./parse/actors.js";
+import { actorModelReason, parseActorFields, parseActorType, parseParticipantEntries, } from "./parse/actors.js";
 import { parseComms, recipientParticipantId } from "./parse/comms.js";
 import { parseCaps, parseDefaults, parseExecution, parsePolicies, parseReview, } from "./parse/execution.js";
 import { ACTOR_REQUIRED, readStudyFront, routeNameReason, } from "./parse/front.js";
@@ -96,9 +96,10 @@ function routeMismatchReason(config) {
 }
 /**
  * Why runStudy refuses a config a library caller passes, or undefined: a humanish.lab.v2 config,
- * one that still sets a StudyConfig field of humanish 0.110, one with no `actor` object, and one
- * whose `route` is not the route its subject and actor take, with parseStudy's message. A planner
- * reads only the v3 fields, so a budget left in `execution.caps` would otherwise run uncapped.
+ * one that still sets a StudyConfig field of humanish 0.110, one with no `actor` object, one
+ * whose `route` is not the route its subject and actor take, and one whose `actor.model` verify
+ * would flag, with parseStudy's message. A planner reads only the v3 fields, so a budget left in
+ * `execution.caps` would otherwise run uncapped, and passes the model on as written.
  */
 export function libraryConfigRefusal(config) {
     const raw = config;
@@ -114,7 +115,9 @@ export function libraryConfigRefusal(config) {
         };
     if (!isRecord(raw.actor))
         return { code: "HUMANISH_STUDY_INVALID", message: ACTOR_REQUIRED };
-    const message = routeNameReason(raw.route) ?? routeMismatchReason(config);
+    const message = routeNameReason(raw.route) ??
+        routeMismatchReason(config) ??
+        actorModelReason(raw.actor.model, "actor");
     return message === undefined ? undefined : { code: "HUMANISH_STUDY_INVALID", message };
 }
 // Each section in a fixed order, so a file with more than one error always reports the same one

package/dist/study/parse/actors.d.ts

@@ -6,6 +6,12 @@ export declare function parseActorType(entry: Record<string, unknown>, path: str
     ok: true;
     value: string;
 } | StudyParseFailure;
+/**
+ * Why an actor's `model` is refused, or undefined. The provider is asked for the model and its trace
+ * records the name, so redacting it would ask for another model. Text verify would flag, as written
+ * or encoded, is refused instead. runStudy asks this of a config built without parseStudy too.
+ */
+export declare function actorModelReason(raw: unknown, path: string): string | undefined;
 /** An actor's keys other than `type`. */
 type ActorFields = Omit<StudyActor, "type">;
 /**

package/dist/study/parse/actors.js

@@ -51,6 +51,17 @@ function parsePersonaId(raw, path) {
     }
     return { ok: true, value: persona };
 }
+/**
+ * Why an actor's `model` is refused, or undefined. The provider is asked for the model and its trace
+ * records the name, so redacting it would ask for another model. Text verify would flag, as written
+ * or encoded, is refused instead. runStudy asks this of a config built without parseStudy too.
+ */
+export function actorModelReason(raw, path) {
+    const model = str(raw);
+    if (model === undefined || !scanEncodedText(model).sensitive)
+        return undefined;
+    return `\`${path}.model\` looks like a secret or a local path, and the run records it. Set the model id your provider lists, or leave \`${path}.model\` out to use the default.`;
+}
 /**
  * Every actor key other than `type`. The parser reads them after the participant entries, so a file
  * with errors in both reports the entry first.
@@ -65,6 +76,9 @@ export function parseActorFields(entry, path) {
     const mission = str(entry.mission);
     if (mission)
         actor.mission = mission;
+    const modelReason = actorModelReason(entry.model, path);
+    if (modelReason)
+        return invalid(modelReason);
     const model = str(entry.model);
     if (model)
         actor.model = model;

package/dist/study/parse/subject-state.js

@@ -1,7 +1,7 @@
 // The state and env channels of a served subject (clone or local-tree): `subject.envValues`,
 // the structural parse of `subject.state`, and subjectStateInvalidReason, the semantic check
 // parseStudy and the computer-use route share.
-import { containsSensitive } from "../../evidence/redaction.js";
+import { scanEncodedText } from "../../evidence/encoded-text.js";
 import { ENV_NAME_PATTERN, invalid, posInt, str, strList } from "./values.js";
 import { isRecord } from "../../run/type-guards.js";
 /**
@@ -29,9 +29,9 @@ export function parseEnvValues(raw) {
         if (value === undefined) {
             return invalid(`\`subject.envValues.${name}\` must be a string, number, or boolean.`);
         }
-        // Reuse the redaction module's own detector rather than inventing a second opinion about what
-        // a secret looks like; the two must never disagree about the same string.
-        if (containsSensitive(value)) {
+        // verify blocks a run whose files scanEncodedText reads as sensitive, so this refuses what that
+        // scan reads: a secret or local path as written, or decoded from base64 or an escape.
+        if (scanEncodedText(value).sensitive) {
             return invalid(`\`subject.envValues.${name}\` looks like a secret or a local path, and envValues are committed with the study and recorded in evidence. List the name in \`subject.env\` instead: its value then comes from your environment and is never stored.`);
         }
         envValues[name] = value;

package/dist/study/participant-assignment.js

@@ -1,9 +1,9 @@
-import { redactText } from "../evidence/redaction.js";
+import { redactEncodedText } from "../evidence/encoded-text.js";
 /** Project only authored participant-facing fields. Never pass runtime-composed instructions:
  * they can contain inbox URLs or multiplayer grants. Pick fields explicitly so a task's hidden
  * success criteria cannot cross this evidence boundary, even from an untyped library caller. */
 export function participantAssignment(assignment, scrubKnownValues = (text) => text) {
-    const sanitize = (text) => redactText(scrubKnownValues(text));
+    const sanitize = (text) => redactEncodedText(scrubKnownValues(text));
     return {
         mission: sanitize(assignment.mission),
         ...(assignment.focus === undefined ? {} : { focus: sanitize(assignment.focus) }),

package/dist/study/persona.d.ts

@@ -37,7 +37,13 @@ export declare function parseResolvedPersona(raw: unknown, fallback: {
 }, warnings?: string[]): ResolvedPersona;
 export declare function personaToDirectives(persona: ResolvedPersona): PersonaDirectives;
 export declare function renderPersonaPromptSection(persona: ResolvedPersona): string;
-/** Only the authored persona section; excludes task criteria, runtime grants and inbox URLs. */
+/**
+ * Only the authored persona section; excludes task criteria, runtime grants and inbox URLs. With
+ * `scrub`, the run's known values come out first, then keys as written or encoded. Without it, only
+ * keys as written come out. A route that learns its known values later passes this brief to
+ * scrubPersonaBrief, and an encoded key replaced here would cut a known value that holds one, so
+ * that scrub could no longer find the value whole.
+ */
 export declare function personaBrief(persona: ResolvedPersona, scrub?: (text: string) => string): NonNullable<ActorPersonaRef["brief"]>;
 export declare function scrubPersonaBrief(persona: ActorPersonaRef, scrub: (text: string) => string): ActorPersonaRef;
 export {};

package/dist/study/persona.js

@@ -1,3 +1,4 @@
+import { redactEncodedText } from "../evidence/encoded-text.js";
 import { digestText, redactText } from "../evidence/redaction.js";
 import { isRecord } from "../run/type-guards.js";
 export const PERSONA_BACKGROUND_MAX_BYTES = 32 * 1024;
@@ -136,8 +137,9 @@ export function personaToDirectives(persona) {
         ...(patience ? [`patience:${patience}`] : []),
         ...(skill ? [`skill:${skill}`] : []),
     ];
+    // A live participant's trace records traitsApplied as it is, and the need is free text.
     if (accessibilityNeeds)
-        traitsApplied.push(`accessibility:${accessibilityNeeds}`);
+        traitsApplied.push(`accessibility:${redactEncodedText(accessibilityNeeds)}`);
     if (persona.constraints.length)
         traitsApplied.push(`constraints:${persona.constraints.length}`);
     return {
@@ -166,9 +168,15 @@ export function renderPersonaPromptSection(persona) {
         .filter(Boolean)
         .join("\n\n");
 }
-/** Only the authored persona section; excludes task criteria, runtime grants and inbox URLs. */
-export function personaBrief(persona, scrub = (text) => text) {
-    const original = renderPersonaPromptSection(persona), text = redactText(scrub(original));
+/**
+ * Only the authored persona section; excludes task criteria, runtime grants and inbox URLs. With
+ * `scrub`, the run's known values come out first, then keys as written or encoded. Without it, only
+ * keys as written come out. A route that learns its known values later passes this brief to
+ * scrubPersonaBrief, and an encoded key replaced here would cut a known value that holds one, so
+ * that scrub could no longer find the value whole.
+ */
+export function personaBrief(persona, scrub) {
+    const original = renderPersonaPromptSection(persona), text = scrub === undefined ? redactText(original) : redactEncodedText(scrub(original));
     return {
         compilerVersion: PERSONA_COMPILER_VERSION,
         text,
@@ -180,7 +188,7 @@ export function personaBrief(persona, scrub = (text) => text) {
 export function scrubPersonaBrief(persona, scrub) {
     if (!persona.brief)
         return persona;
-    const text = redactText(scrub(persona.brief.text));
+    const text = redactEncodedText(scrub(persona.brief.text));
     return {
         ...persona,
         brief: {

package/dist/study/plan-base.js

@@ -1,7 +1,7 @@
 // What every route planner shares: the plan fields common to all routes, the frozen residual config,
 // and the requirement and subject helpers.
 import { DEFAULT_OPENAI_CU_MODEL } from "../actors/computer-use/openai-provider.js";
-import { redactText } from "../evidence/redaction.js";
+import { redactEncodedText } from "../evidence/encoded-text.js";
 // A YAML alias can make a parsed record contain itself (an inline persona that names its own
 // anchor), and structuredClone keeps the cycle, so each object is frozen once.
 function deepFreeze(value, frozen = new WeakSet()) {
@@ -112,8 +112,9 @@ export function planBase(config, input) {
     return {
         studyId: config.id,
         // Every bundle writer takes the title from here, and review.md, run.json and the Observer show
-        // it, so a key or sandbox URL in it would make verify grade the run blocked.
-        ...(config.title === undefined ? {} : { title: redactText(config.title) }),
+        // it, so a key or sandbox URL in it, as written or encoded, would make verify grade the run
+        // blocked.
+        ...(config.title === undefined ? {} : { title: redactEncodedText(config.title) }),
         residual: residualOf(config),
         dryRun: input.dryRun,
         ...(analysis === undefined