One catalog task as every caller may see it.
#1263 — this schema deliberately has NO expected_output field, for any
task, secret or not. #1222/#1261 stopped the arena from sending the
answer key, but every request still carries task_id and the anonymous
GET /tasks / GET /tasks/{id} returned the key for every non-secret
task, so an endpoint could look it up mid-run (confirmed on production,
2026-10-16). Removing the field — rather than nulling it per caller — is
the same shape of guarantee RunRead carries: no present or future read
surface that reuses this schema can leak it. The only echo is
TaskAdminRead on the admin-only create endpoint.
has_expected_output tells the UI whether grading compares against a
reference text or only requires a non-empty response (the same fact the
run trace exposes as expected_output_shape). It never carries the text.
RES-014-C1 — is_secret/suite_id/suite_version are surfaced so
callers know a task is a holdout (the marker is public; only the ANSWER is
secret).