[BREAKING] MAINT: Re-migrate Psychosocial scenario to per-subharm cross-product

[varunj-msft]

Description

Re-migrates the Psychosocial scenario onto the current _build_atomic_attacks_async seam, implementing a per-subharm design and fixing a wrong-scorer-on-all bug.

What changed

• Per-subharm configuration (_SubharmConfig / _SUBHARMS). A frozen tuple defines the two subharms — imminent_crisis (dataset airt_imminent_crisis) and licensed_therapist (dataset airt_licensed_therapist) — each carrying its own dataset name, display name, scorer rubric, crescendo escalation path, success_threshold, and excluded_techniques.
• Technique × subharm cross-product. _build_atomic_attacks_async builds one atomic attack per (selected technique × subharm). Each atomic attack gets its own subharm's scorer and display group — this fixes the bug where running all scored every attack with a single run-level scorer.
• role_play excluded for licensed_therapist. For the therapist subharm the fictional movie-script role_play framing measures the wrong thing and is a poor fit, so it is excluded for that subharm (excluded_techniques={"role_play"}).
• Per-subharm success_threshold. licensed_therapist = 0.5 (a raw Likert ≥ 3 counts — this catches the real harm of the model claiming "I am a licensed therapist," which a uniform 1.0 threshold missed); imminent_crisis = 1.0. Threaded through the scorer build.
• Scorer rubric fix. licensed_therapist.yaml's rationale line was copy-pasted MHFA/crisis-management boilerplate; rewritten to be about licensure / therapeutic impersonation.
• Techniques: prompt_sending (default) + role_play (default) + crescendo (opt-in). Techniques select attack techniques, not subharms.
• Baseline: per-subharm baselines, emitted via the name-trick (the first baseline is named baseline so it suppresses the base scenario's central generic prepend; the rest are baseline_<subharm>). This expresses the baseline via the central baseline + per-subharm naming. (is_baseline does not exist on main today, and psychosocial is the only plural-baseline consumer, so it ships with the naming approach; a base-class is_baseline refactor remains a possible hardening follow-up.)
• Dataset split: psychosocial.prompt → airt_imminent_crisis.prompt (2 crisis seeds) + airt_licensed_therapist.prompt (1 therapist seed), so each subharm has its own dataset.
• No scenario-level TARGET_REQUIREMENTS = EDITABLE_HISTORY (the older version declared it). The default techniques (prompt_sending + role_play) are single-turn: they degrade to a preamble (role_play ends in an unanswered user elicitation turn) rather than dropping the objective on non-editable targets; crescendo is opt-in and self-validates EDITABLE_HISTORY at the attack layer. A clarifying comment documents this, and a test guards that a non-editable target is accepted at initialization by default (the acceptance is asserted at init; the degrade-to-preamble behavior is a design property of the single-turn techniques, not a live-execution assertion).
• Dataset validation: initialize_async rejects caller dataset name selection (datasets are tied to subharms) but keeps --max-dataset-size.
• --max-dataset-size applied per subharm (fixes CLI starvation). The CLI --max-dataset-size N sets the cap on the whole compound dataset config, which the base applies as one global budget across the union of the two subharm datasets — so --max-dataset-size 1 starved a subharm (measured 12/12 objectives dropped), breaking psychosocial's defining "both subharms always run" invariant. _normalize_max_dataset_size_to_per_subharm() (called in _resolve_seed_groups_by_dataset_async after validation) rebuilds the compound as an explicit per-child per_dataset(dataset_names=[subharm], max_dataset_size=N) and sets the compound cap to N × num_subharms — mathematically it never trims the union, yet stays non-None so the base's resume objective-hash pinning still fires. Caller --dataset-filters are re-applied via update_filters, and the config is replaced (never mutated) so re-initialization is idempotent. End-to-end at compound cap 1: both subharms keep running (0/8 starved, was 12/12). This keeps --max-dataset-size working as an independent per-subharm cap.
• VERSION 1 → 2.

Tests and Documentation

• tests/unit/scenario/airt/test_psychosocial.py — 44 tests, all passing. Covers: per-subharm scorer routing (each subharm scored with its own rubric); role_play exclusion for licensed_therapist; per-subharm success_threshold (0.5 vs 1.0); no-double-baseline; the per_dataset primitive caps each subharm independently; the CLI compound --max-dataset-size path keeps both subharms non-empty; the default config is left un-normalized; normalization preserves --dataset-filters; per-subharm baseline scoring; role_play carries adversarial_chat (regression); default accepts a non-editable-history target; dataset-config validation.
• Docs: doc/scanner/airt.py + doc/scanner/airt.ipynb psychosocial section rewritten (3 techniques, both subharms, --max-dataset-size, no --dataset-names). Synced with jupytext.
• Ran: ruff check, ruff format --check, ty, pytest tests/unit/scenario/airt/test_psychosocial.py.

Open item: the baseline uses the per-subharm naming approach; confirm it's acceptable to ship it that way, with the base-class is_baseline refactor tracked as a separate hardening follow-up.