The CLI backend applies --max-dataset-size N by setting the cap on the
whole compound dataset config, which the base then applies as one global
budget across the union of the two subharm datasets. At a small N (e.g.
--max-dataset-size 1) this drew every surviving seed from one subharm and
starved the other, silently dropping a whole subharm and breaking the
scenario's "both subharms always run" invariant (measured: a subharm was
starved on every run at N=1).

Normalize the incoming compound-level cap into an explicit per-child
compound so the cap applies to each subharm independently. The compound
cap is set to N * <number of subharms> -- large enough it can never trim
the union, yet non-None so the base still pins sampled objective hashes
for resume. Caller-supplied --dataset-filters are carried over to the
rebuilt config. The default and programmatic per_dataset paths (compound
cap None) are left untouched.

- Rename the test that only exercised the per_dataset primitive; add
  regression tests for the CLI compound-cap path, the default no-op path,
  and dataset-filter preservation.

…oduct

Rewrite the Psychosocial AIRT scenario from scratch, modeled on the healthy
garak.encoding (converter-as-technique enum) and airt.scam
(with_simulated_conversation) patterns.

- Primary axis is sub_harm (imminent_crisis / licensed_therapist), a plain
  string param defaulting to 'all'. Each sub-harm owns its dataset, escalation
  prompt, and an inline conversation-level scorer (no rubric-path lookup table,
  no _build_scorer indirection).
- Base technique is a simulated crescendo per sub-harm; converters layer on top
  as the PsychosocialTechnique enum (DEFAULT = none/tone_soften/
  persuasion_logical_appeal; ALL = ~19 converters + live Crescendo).
- Keep dataset_config (so --max-dataset-size works) but hard-bind dataset names
  to the selected sub-harms. Drop CompoundDatasetAttackConfiguration.
- Per-sub-harm baselines via the _build_baseline_atomic_attacks hook.
- Add escalation_crisis_simulated.yaml (renders with objective/max_turns only)
  for the simulated-conversation flow.
- Rewrite tests and sync doc/scanner/airt.{py,ipynb}.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b7009abc-fe0b-4d7e-a39a-971a396e9eef

Each sub-harm now owns a build_scorer callable that spells out its scorer
(rubric + threshold) next to the dataset it pairs with, replacing the shared
_conversation_scorer helper. Adds a test asserting each sub-harm builds a scorer.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b7009abc-fe0b-4d7e-a39a-971a396e9eef

…dardizing-Scenarios-Psychosocial-v2

…dardizing-Scenarios-Psychosocial-v2

Remove the overloaded per-scenario baseline hook. The base Scenario now
derives baselines from the already-built technique cells, grouping by
objective-scorer identity: one shared scorer yields a single "baseline",
per-population scorers (e.g. psychosocial sub-harms) yield one
"<display_group>_baseline" per group. No scenario hand-rolls baselines.

- scenario.py: concrete _build_baseline_atomic_attacks derivation; delete
  singular _build_baseline_atomic_attack.
- psychosocial.py: delete the baseline override (now derived identically).
- atomic_attack.py: public objective_scorer property for grouping.
- matrix_atomic_attack_builder.py: build_baseline_atomic_attack gains
  atomic_attack_name/display_group/objective_scorer passthrough.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b7009abc-fe0b-4d7e-a39a-971a396e9eef

The base Scenario no longer builds baselines. It only resolves
BASELINE_ATTACK_POLICY into self._include_baseline (carried on
ScenarioContext.include_baseline). Each scenario emits its own baseline:

- Matrix scenarios (cyber, leakage, rapid_response, doctor, benchmark) get
  it for free -- the matrix builder reads context.include_baseline.
- build_matrix_atomic_attacks no longer takes a redundant include_baseline
  arg; it reads it from the context it already receives.
- Custom scenarios (adaptive, jailbreak, scam, encoding, web_injection,
  red_team_agent) prepend one gated build_baseline_atomic_attack call.
- Psychosocial emits its per-sub-harm baselines inline.

Removes Scenario._build_baseline_atomic_attacks and the central prepend in
initialize_async. Updates tests accordingly.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b7009abc-fe0b-4d7e-a39a-971a396e9eef

…ection

The CLI flag is --techniques/-t (--strategies never existed). Corrects it in
the airt.py notebook and psychosocial.py docstrings, and trims the notebook's
Psychosocial section to the sibling house style (short description + bash +
Available techniques), dropping impl details and outdated content (MHFA/ALGEE,
create_conversation_scorer, YAML rubric internals, brittle converter counts).
Regenerated airt.ipynb and re-ran the minimal cell.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b7009abc-fe0b-4d7e-a39a-971a396e9eef