Add guarded Modal Qwen3-32B activation runner

[elenaajayi]

Summary

This draft PR adds a shared Modal runner for Qwen3-32B. It supports live model generation, thinking on/off runs, residual-stream activation extraction, and per-run cost tracking.

The runner is separate from the Scenario 1 dataset generator. It accepts one validated agent-turn request and returns one validated result that the Scenario 1 pipeline can store in its trajectory record.

What this PR includes

• Runs Qwen/Qwen3-32B in the shared agileai Modal workspace.
• Uses one H200 GPU for a model call and allows at most one concurrent container.
• Supports a controlled thinking comparison:
  • thinking on: enable_thinking=true
  • thinking off: enable_thinking=false
  • all other decoding settings stay the same
• Saves the exact rendered model input, input token IDs, input hash, raw generated text, generated token IDs, final response, and separate thinking content.
• Extracts residual-stream activations at the requested layers and token position.
• Parses Qwen tool-call requests conservatively.
• Marks parsed tool calls as requested only. This runner does not execute tools or mark an unsafe action as completed.
• Writes a separate cost and token ledger for each Modal input.
• Documents setup, validation, paid-run safeguards, shared resources, result fields, and cost checks in the main README.md.

Model-turn handoff

The returned result keeps the information needed by the Scenario 1 event-style trajectory schema and the probe adapter:

• exact model input and output
• model and tokenizer revisions
• generation settings and thinking mode
• tool-call requests and parse errors
• activation metadata and artifact paths
• execution timing
• token counts and estimated H200 cost

Private thinking content is stored separately for analysis. It is not forwarded to the next agent. Only the final assistant content and valid tool-call requests may be passed downstream.

Tool-call boundary

A tool request is not the same as an executed action.

This runner may return a parsed tool request with status: requested. The Scenario 1 executor must still validate and run it. Only the executor layer may create an executed action or set unsafe_action_executed=true. Plain endpoint text in a response is not treated as a tool request or an executed action.

Cost and token tracking

Each input writes a JSON ledger under:

costs/<trajectory_id>/<thinking_mode>/step_<step_index>/<modal_input_id>.json

The ledger records:

• trajectory, task, agent, step, and thinking-mode IDs
• UTC start and end time and elapsed seconds
• GPU type and count
• pinned H200 price estimate and estimated GPU cost
• input, generated, thinking, final-output, special/separator, and total processed token counts
• generated tokens per second and estimated cost per 1,000 generated tokens
• runtime provider and region when available

The estimate currently uses one H200 at $0.001261 per second, checked against Modal's public pricing page on July 13, 2026. Modal's billing report remains the final source for actual charges. The per-input estimate does not include model startup/download time, warm idle time, CPU, memory, storage, or network charges.

The cost ledger does not copy prompt or response text.

Safety and scope

• validate checks the request without starting a remote function or GPU.
• download downloads model weights without starting a GPU.
• A paid run requires an explicit H200 confirmation flag.
• The Modal volume, app, and cost paths are shared workspace resources, not paths tied to Elena's laptop.
• The runner accepts only one agent turn at a time. It does not build the dataset, choose Scenario 1 documents, label behavioral outcomes, or execute tools.
• In Scenario 1, Worker1 remains the only agent that receives the raw poisoned document at both depths.

Validation

• Full test suite: 111 passed
• Focused Modal, result-contract, and cost tests: 25 passed
• Python compilation checks passed.
• Diff checks and scans for committed secrets or machine-specific absolute paths passed.
• No-GPU Modal validation passed in the shared agileai workspace: https://modal.com/apps/agileai/main/ap-F9IAPmct0vNXlRoyBfo4hH

The validation run did not start a remote function or GPU.

Review requested

Please check:

• whether the result contract contains everything the Scenario 1 generator and v2 schema need
• whether thinking content and final content are separated correctly
• whether requested tool calls remain distinct from executed actions
• whether activation and cost artifact paths will work for everyone in the shared Modal workspace
• whether the main README is clear enough for another team member to validate and run the code safely

[elenaajayi]

Closing this PR as superseded by PR #10, which has now merged into main. The guarded Qwen3-32B Modal runner, pinned model contract, activation output handling, cost records, and tests from this branch were preserved in that integrated PR, so no work is being discarded.