python3 -m venv --system-site-packages .venv
source .venv/bin/activate
pip install -r requirements.txt

# download the target models (needs an authenticated Hugging Face CLI)
hf download openai/gpt-oss-20b
hf download google/gemma-4-26B-A4B-it
hf download deepseek-ai/DeepSeek-R1-Distill-Qwen-7B
hf download Qwen/Qwen3-4B-Thinking-2507

export PYTHONPATH=experiments

# reproduction gate: the forge empties the gpt-oss analysis channel while the call still fires
python scripts/h200_gate.py

# E1: chain-of-thought suppression at scale
python experiments/e1_cot_suppression.py

# E2: monitor evasion and refusal bypass (generate traces, then score three monitors)
python experiments/e2b_generate.py
JUDGE=gemma python experiments/e2b_judge.py

# E3: parser leniency
python experiments/e3a_parser_leniency.py                 # deterministic, no model
MODEL=gpt_oss python experiments/e3b_end2end.py
MODEL=gemma   python experiments/e3b_end2end.py
python experiments/e3c_gemma_parser_ab.py                 # same model, two parsers

# E4: generality across reasoning models
MODEL=deepseek-ai/DeepSeek-R1-Distill-Qwen-7B TAG=deepseek python experiments/e4_generality.py
MODEL=Qwen/Qwen3-4B-Thinking-2507 TAG=qwen3 python experiments/e4_generality.py

# E5: defenses
python experiments/e5_defenses.py                         # input sanitization
python experiments/e5_d2_parser_hardening.py              # parser hardening, deterministic

# W1 to W3: ablation, token-level grounding, indirect delivery, cross-stack parser
python experiments/w1_forge_variants.py
python experiments/w1_tokenlevel.py
python experiments/w2_indirect.py
python experiments/w3_truncation_sweep.py

# adaptive empty-reasoning evasion (raw traces, effort sweep, decoy attack, monitor matrix)
python experiments/ad_traces_effort.py
python experiments/ad_decoy.py
python experiments/ad_decoy_judge.py

# regenerate the results figure from the logged JSON
python scripts/make_results_fig.py

experiments/harness.py            shared harness: build an agent, run a message through the
                                  sandbox gym env, and read back the reasoning channel, the
                                  fired tool events, and the predicates
experiments/e1_*.py               chain-of-thought suppression at scale
experiments/e2*_*.py              monitor evasion and refusal bypass (generate, then judge)
experiments/e3*_*.py              parser leniency: deterministic, end-to-end, and A/B
experiments/e4_*.py               generality across reasoning models
experiments/e5_*.py               defenses: sanitization and parser hardening
experiments/w1_*.py               ablation of the injected string and token-level grounding
experiments/w2_*.py               indirect delivery and broader action types
experiments/w3_*.py               truncation robustness of the attack
experiments/ad_*.py               adaptive empty-reasoning evasion and raw traces
experiments/*_probe.py, *_debug.py supporting probes used while building the study
scripts/h200_gate.py              the reproduction gate
scripts/make_results_fig.py       the results figure
results/*.json                    logged measurements produced by the scripts above