humanish 0.0.1 → 0.15.0

package/dist/e2b-terminal-lab.js

@@ -0,0 +1,1467 @@
+// The terminal-product lab backend: a real autonomous agent (Codex) studying a CLI/product from
+// PUBLIC SURFACES ONLY, running INSIDE an E2B shell with command-scoped runtime auth, capturing
+// its non-interactive exec output (stdin disabled) as a redacted event stream + normalized
+// transcript, capped at no-spend, emitting durable terminal/substrate/cost/no-spend/cleanup/
+// intervention proof. Mirrors cua-actor-lab.ts / scripted-browser-lab.ts.
+//
+// SLICE 2 SCOPE: BOTH paths are now implemented.
+//   - DRY-RUN: a contract-only `humanish.run-bundle.v1`, honestly labeled (unchanged from SLICE 1).
+//   - LIVE: the real create -> inject (command-scoped) -> run `codex exec --json` -> capture
+//     (scrub+redact at the source) -> score (verdict-nonce marker) -> teardown (proven cleanup)
+//     orchestrator on the @e2b/desktop commands.run surface.
+//
+// THE SAFETY CONTRACT (docs/goals/terminal-product-lane/goal.md) is enforced BY CONSTRUCTION here
+// and CHECKED by the verifier (run.ts validateTerminalProductEvidence):
+//   1. COMMAND-SCOPED KEY. The runtime LLM key is injected ONLY into the per-command `envs` of the
+//      `codex exec` invocation (commands.run({envs})), NEVER Sandbox.create({envs}) — driven off
+//      the registered actor's keyPlacement: "in-sandbox-command-scoped" capability (engine-
+//      enforced: a terminal actor lacking that metadata FAILS CLOSED before any sandbox exists).
+//   2. FAIL-CLOSED CAP. The live key is never exercised without scenario.caps in force: maxUsd
+//      (default/require 0 = no-spend) + maxMinutes (wall-clock kill of the codex command).
+//   3. PUBLIC SURFACES ONLY. The mission references only subject.product.publicSurfaces + the
+//      author mission. No clone, no private-source access — nothing is git-cloned in this lane.
+//   4. DENY-BY-DEFAULT CREDENTIALS. The command envs are built from an ALLOWLIST of ONLY the
+//      declared runtime key; GITHUB_TOKEN/GH_TOKEN/payment/deploy/db/media keys are excluded by
+//      construction (a banned-name guard also fails closed if one is ever requested).
+//   5. NO SECRET VALUES IN EVIDENCE. Every captured byte (event stream, transcript, command logs,
+//      agent report, metadata) passes scrubKnownValues (literal scrub of the runtime key + any
+//      provisioned values, >=4 chars, PRE-truncation) THEN redactText (shape patterns) BEFORE
+//      persisting. The transport is labeled HONESTLY (exec-stream/snapshot, NOT an interactive pty).
+//   6. METADATA POSITIVE ALLOWLIST. buildSandboxMetadata(allowlist) is the ONLY way metadata is
+//      set; it carries solely non-secret labels (mode/tool/labId/simId/provider/runId).
+//   7. STDIN DISABLED + INTERVENTIONS LEDGER. stdin is never wired to the codex command; the
+//      bundle ALWAYS carries an interventions ledger (empty array is valid + required-present).
+//   8. PROVEN CLEANUP, BY ID, NEVER ACCOUNT-WIDE. Sandbox.kill(id) in a finally; the cleanup
+//      proof is BY EXACT ID: kill(id)'s own found-and-killed boolean, confirmed further by
+//      Sandbox.getInfo(id) when the SDK exposes it (a thrown SandboxNotFoundError means gone).
+//      humanish NEVER calls Sandbox.list to prove cleanup, so a shared operator key never reaches a
+//      sandbox it did not create. A live run that cannot prove teardown fails closed.
+import { randomBytes, randomUUID } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { ACTOR_TRACE_SCHEMA, TERMINAL_AGENT_CAPABILITIES } from "./actor-contract.js";
+import { actorRegistry, isTerminalActorDescriptor } from "./actor-registry.js";
+import { toErrorMessage } from "./command-failure.js";
+import { isSandboxNotFoundError, loadE2BDesktopModule } from "./e2b-desktop-launch.js";
+import { renderObserver } from "./observer.js";
+import { digestText, redactedTail, redactText } from "./redaction.js";
+import { buildRunSource, extractLocalActorVerdict, normalizeLocalActorTranscript, PUBLIC_TARGET_CWD, REVIEW_SCHEMA, RUN_BUNDLE_SCHEMA } from "./run.js";
+import { TERMINAL_AGENT_NOT_IMPLEMENTED_CODE } from "./terminal-agent-actor.js";
+/** Provider-neutral metadata constant: the lane's non-secret tag (mirrors CUA_ACTOR_LAB_PROVIDER_METADATA). */
+export const TERMINAL_PRODUCT_LAB_PROVIDER_METADATA = {
+    mode: "terminal-product-lab",
+    tool: "humanish"
+};
+// The terminal-product ledger schemas the verifier asserts present on a LIVE bundle. They ride the
+// existing terminal stream + events (humanish.run-bundle.v1 is unchanged); these constants name the
+// artifact files so the producer and verifier cannot drift on the path.
+export const TERMINAL_EVENTS_ARTIFACT = "terminal-events.ndjson";
+export const TERMINAL_TRANSCRIPT_ARTIFACT = "terminal-transcript.txt";
+export const TERMINAL_LEDGERS_ARTIFACT = "terminal-ledgers.json";
+/** The in-sandbox working directory for the agent (a scratch dir; nothing is cloned into it). */
+const SANDBOX_WORKDIR = "/home/user/study";
+// Server-side reclamation buffer past the codex command's own wall-clock (caps.maxMinutes) kill.
+const SANDBOX_TIMEOUT_BUFFER_MS = 5 * 60_000;
+const DEFAULT_REQUEST_TIMEOUT_MS = 60_000;
+// The runtime-bootstrap step (ensure Node/npm) can run an apt-get install; the SDK's commands.run
+// timeoutMs default (60s) is far too short for that, so this step gets an explicit generous budget.
+const RUNTIME_BOOTSTRAP_TIMEOUT_MS = 300_000;
+// UNKEYED (no envs) shell command that ensures Node/npm are present before the keyed codex exec.
+// Reuses the oss-meta-lab.ts ensure_node() shape: check node's major version, else install
+// Node 22 via NodeSource plus passwordless sudo (the stock @e2b/desktop image ships neither codex
+// nor a recent Node, per issue #159). A final presence check makes the whole command exit non-zero
+// (so the bootstrap step fails closed) if the install still leaves node/npm missing.
+const RUNTIME_BOOTSTRAP_COMMAND = [
+    `node_major=0`,
+    `if command -v node >/dev/null 2>&1; then node_major=$(node -e 'console.log(Number(process.versions.node.split(".")[0]))' 2>/dev/null || echo 0); fi`,
+    `if command -v node >/dev/null 2>&1 && command -v npm >/dev/null 2>&1 && [ "$node_major" -ge 20 ]; then exit 0; fi`,
+    `sudo -n apt-get update`,
+    `sudo -n apt-get install -y ca-certificates curl gnupg`,
+    `curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -n -E bash -`,
+    `sudo -n apt-get install -y nodejs`,
+    `command -v node >/dev/null 2>&1 && command -v npm >/dev/null 2>&1`
+].join(" && ");
+// How much of a captured stream / log tail rides a (redacted) message field.
+const TAIL_CHARS = 2000;
+// Hard cap on the retained event-stream + transcript size, so a runaway agent cannot balloon the
+// bundle. Redaction runs PRE-truncation so a cut can never split a secret past the scrubber.
+const MAX_TRANSCRIPT_BYTES = 512 * 1024;
+export const TERMINAL_PRODUCT_LAB_SCHEMA = "humanish.terminal-lab-result.v1";
+export async function runTerminalProductLab(options) {
+    const { config, dryRun } = options;
+    const cwd = path.resolve(options.cwd);
+    const hooks = options.hooks ?? {};
+    const render = hooks.renderObserverFn ?? renderObserver;
+    const warnings = [];
+    const actorType = config.actors[0]?.type ?? "";
+    const product = config.subject.product;
+    const failed = (code, message, extras) => ({
+        schema: TERMINAL_PRODUCT_LAB_SCHEMA,
+        ok: false,
+        cwd,
+        labId: config.id,
+        actor: extras?.actor ?? actorType,
+        product: extras?.product ?? product?.name ?? "",
+        dryRun,
+        runId: options.runId ?? "not-created",
+        warnings,
+        error: { code, message }
+    });
+    // Resolve the actor through the registry — the parse layer already validated this, but the
+    // engine fails closed rather than trusting a config that arrived through another door
+    // (runTerminalProductLab is itself exported npm surface).
+    const descriptor = actorRegistry[actorType];
+    if (!descriptor || !isTerminalActorDescriptor(descriptor)) {
+        return failed("HUMANISH_TERMINAL_LAB_ACTOR_UNSUPPORTED", `actors[0].type "${actorType}" is not a registered terminal actor.`);
+    }
+    // Re-enforce the subject shape at the engine (the parser rejects these too, but this is exported
+    // npm surface). A terminal-product subject MUST declare product.name + public surfaces.
+    if (!product || !product.name || product.publicSurfaces.length === 0) {
+        return failed("HUMANISH_TERMINAL_LAB_SUBJECT_INVALID", "terminal-product subjects require `subject.product` with a name and at least one public surface URL.", { actor: descriptor.id });
+    }
+    // LIVE path: the real in-sandbox agent session. A separate orchestrator owns the
+    // create -> inject (command-scoped) -> run -> capture -> teardown lifecycle so the dry-run path
+    // below stays a pure contract builder. It enforces the safety contract by construction (the
+    // keyPlacement-routed command-scoped key, the deny-by-default allowlist, the fail-closed cap,
+    // the proven cleanup) and fails closed before any sandbox/key/spend on any precondition miss.
+    if (!dryRun) {
+        return runLiveTerminalSession({ options, cwd, config, descriptorId: descriptor.id, product, warnings, render, failed });
+    }
+    const mission = config.actors[0]?.mission ?? defaultMission(product.name);
+    const personaId = config.actors[0]?.persona ?? "autonomous-terminal-agent";
+    // The composed prompt = mission + persona + public-surface manifest. Only the AUTHOR mission
+    // goes plaintext into evidence (it is public-safe committed lab text); the full composed prompt
+    // is recorded as a DIGEST (the safety contract's mission ruling).
+    const composedPrompt = composePrompt({ mission, personaId, productName: product.name, publicSurfaces: product.publicSurfaces });
+    const promptDigest = digestText(composedPrompt);
+    const persona = { id: personaId, traitsApplied: [], promptDigest };
+    const runId = options.runId ?? makeTerminalRunId();
+    const artifactRoot = path.join(cwd, ".humanish", "runs", runId);
+    const createdAt = new Date().toISOString();
+    await mkdir(artifactRoot, { recursive: true });
+    const source = await buildRunSource({
+        capturedAt: createdAt,
+        cwd,
+        humanishSource: "present",
+        packageName: "humanish"
+    });
+    const bundle = buildTerminalProductBundle({
+        actorId: descriptor.id,
+        createdAt,
+        dryRun,
+        labId: config.id,
+        ...(config.title ? { labTitle: config.title } : {}),
+        mission,
+        persona,
+        productName: product.name,
+        publicSurfaces: product.publicSurfaces,
+        ...(config.scenario?.caps ? { caps: config.scenario.caps } : {}),
+        ...(config.execution?.runtimeAuth ? { runtimeAuth: config.execution.runtimeAuth } : {}),
+        stdin: config.execution?.terminal?.stdin ?? "disabled",
+        policies: {
+            allowPrivateRepoAccess: config.policies?.allowPrivateRepoAccess ?? false,
+            allowProviderCredentials: config.policies?.allowProviderCredentials ?? false,
+            allowPaymentCredentials: config.policies?.allowPaymentCredentials ?? false,
+            allowGitHubMutation: config.policies?.allowGitHubMutation ?? false
+        },
+        runId,
+        source
+    });
+    await writeFile(path.join(artifactRoot, "run.json"), `${JSON.stringify(bundle, null, 2)}\n`, "utf8");
+    await writeFile(path.join(artifactRoot, "review.json"), `${JSON.stringify(bundle.review, null, 2)}\n`, "utf8");
+    await writeFile(path.join(artifactRoot, "review.md"), renderTerminalReviewMarkdown(bundle), "utf8");
+    await writeFile(path.join(artifactRoot, "events.ndjson"), `${bundle.events.map((event) => JSON.stringify(event)).join("\n")}\n`, "utf8");
+    // Keep `verify --run latest` honest: point it at THIS run (mirrors run.ts's RunPointer).
+    await writeFile(path.join(cwd, ".humanish", "runs", "latest.json"), `${JSON.stringify({
+        schema: "humanish.latest-run.v1",
+        runId,
+        path: path.join(".humanish", "runs", runId),
+        updatedAt: createdAt
+    }, null, 2)}\n`, "utf8");
+    const observer = await render(cwd, runId, { open: options.open === true });
+    const ok = observer.ok;
+    return {
+        schema: TERMINAL_PRODUCT_LAB_SCHEMA,
+        ok,
+        cwd,
+        labId: config.id,
+        actor: descriptor.id,
+        product: product.name,
+        dryRun,
+        runId,
+        observer,
+        warnings: [...warnings, ...observer.warnings],
+        ...(ok
+            ? {}
+            : {
+                error: {
+                    code: "HUMANISH_TERMINAL_LAB_FAILED",
+                    message: observer.error?.message ?? "Observer failed for the terminal-product lab run."
+                }
+            })
+    };
+}
+/** The four cost categories, in a fixed order so the ledger shape is stable across runs. */
+const COST_CATEGORIES = ["product", "media", "payment", "provider"];
+/**
+ * Build the spend ledger from the captured session. THE NULL DISCIPLINE (issue #154):
+ *   - The `provider` line is populated from the actor trace's tokenUsage.costUsd when the trace
+ *     CARRIES it (a measured value, incl. a measured 0). When the trace carries NO costUsd, the
+ *     provider line is `null` = NOT MEASURED (never guessed to 0 just because no-spend was intended).
+ *   - product/media/payment are `null` this slice: the lane has NO product-spend signal yet (that is
+ *     the adapter's job in SLICE 4). The LEDGER SHAPE + the null discipline ship now; the signal does not.
+ * `injectedLines` lets a test (and, later, the SLICE-4 adapter) supply known spend for a category,
+ * exercising the fail-closed cap enforcement deterministically without a real billable run.
+ */
+function buildCostLedger(args) {
+    const providerLine = typeof args.tokenCostUsd === "number"
+        ? {
+            usd: args.tokenCostUsd,
+            source: "provider-token-usage",
+            note: `Provider spend metered from the actor trace tokenUsage.costUsd (${args.tokenCostUsd} USD).`
+        }
+        : {
+            usd: null,
+            source: "unmeasured",
+            note: "Provider spend NOT MEASURED: the actor trace carried no tokenUsage.costUsd this run. Recorded null (not guessed to 0)."
+        };
+    const unmeasured = (category) => ({
+        usd: null,
+        count: null,
+        source: "unmeasured",
+        note: `${category} spend NOT MEASURED this slice: the terminal-product lane has no ${category}-spend signal yet (the adapter supplies it in SLICE 4). Recorded null (never guessed to 0).`
+    });
+    const lines = {
+        product: args.injectedLines?.product ?? unmeasured("product"),
+        media: args.injectedLines?.media ?? unmeasured("media"),
+        payment: args.injectedLines?.payment ?? unmeasured("payment"),
+        provider: args.injectedLines?.provider ?? providerLine
+    };
+    // knownTotalUsd sums ONLY the non-null lines. A null line contributes NOTHING — it is never
+    // coerced to 0 (that would let an unmeasured category masquerade as a measured zero).
+    let knownTotalUsd = 0;
+    let fullyMeasured = true;
+    for (const category of COST_CATEGORIES) {
+        const usd = lines[category].usd;
+        if (usd === null) {
+            fullyMeasured = false;
+        }
+        else {
+            knownTotalUsd += usd;
+        }
+    }
+    return {
+        schema: "humanish.terminal-cost-ledger.v1",
+        currency: "usd",
+        lines,
+        knownTotalUsd: roundUsd(knownTotalUsd),
+        fullyMeasured
+    };
+}
+/** Derive the no-spend proof from the ledger. It is HONEST: it vouches for known-zero lines and
+ *  explicitly lists the unmeasured (null) lines it cannot vouch for — never claiming zero on null. */
+function buildNoSpendProof(ledger, maxUsd) {
+    const knownZeroLines = [];
+    const knownNonZeroLines = [];
+    const unmeasuredLines = [];
+    for (const category of COST_CATEGORIES) {
+        const usd = ledger.lines[category].usd;
+        if (usd === null)
+            unmeasuredLines.push(category);
+        else if (usd === 0)
+            knownZeroLines.push(category);
+        else
+            knownNonZeroLines.push(category);
+    }
+    // satisfied only when every KNOWN line is within the cap (for a no-spend run, maxUsd 0 => every
+    // known line must be exactly 0). Unmeasured lines do NOT make it satisfied — they are reported
+    // separately as the proof's honest blind spot.
+    const cap = maxUsd ?? 0;
+    const satisfied = knownNonZeroLines.length === 0 && ledger.knownTotalUsd <= cap;
+    const statement = [
+        satisfied
+            ? `No-spend proof SATISFIED for maxUsd=${cap}: every MEASURED spend line is zero (known total ${ledger.knownTotalUsd} USD).`
+            : `No-spend proof NOT satisfied for maxUsd=${cap}: known spend total ${ledger.knownTotalUsd} USD${knownNonZeroLines.length > 0 ? ` (non-zero: ${knownNonZeroLines.join(", ")})` : ""}.`,
+        unmeasuredLines.length > 0
+            ? `UNMEASURED (null, NOT claimed zero): ${unmeasuredLines.join(", ")}. The proof does not vouch for these — they carry no spend signal this slice.`
+            : "All applicable spend lines were measured."
+    ].join(" ");
+    return {
+        schema: "humanish.terminal-no-spend-proof.v1",
+        maxUsd,
+        satisfied,
+        knownZeroLines,
+        knownNonZeroLines,
+        unmeasuredLines,
+        knownTotalUsd: ledger.knownTotalUsd,
+        statement
+    };
+}
+/**
+ * Full caps enforcement (fail-closed, not advisory). Returns a structured violation when a KNOWN
+ * (measured) spend line exceeds maxUsd, or a known billable-job count exceeds maxJobs. Unknowns
+ * (`null`) NEVER trip the cap (we cannot claim a violation we did not measure) — but they also never
+ * grant a green pass: the no-spend proof reports them as unmeasured. maxMinutes is wall-clock and is
+ * enforced separately (runWithWallClock); it is not a ledger-derived cap.
+ */
+function evaluateCapsAgainstLedger(ledger, caps) {
+    if (caps.maxUsd !== undefined && ledger.knownTotalUsd > caps.maxUsd) {
+        const overLines = COST_CATEGORIES.filter((c) => ledger.lines[c].usd !== null && ledger.lines[c].usd > 0);
+        return {
+            ok: false,
+            message: `Observed KNOWN spend ${ledger.knownTotalUsd} USD exceeds scenario.caps.maxUsd=${caps.maxUsd}${overLines.length > 0 ? ` (non-zero lines: ${overLines.join(", ")})` : ""}. The run fails closed: the cap is a fail-closed mechanism, not an advisory.`
+        };
+    }
+    if (caps.maxJobs !== undefined) {
+        let knownJobs = 0;
+        for (const category of COST_CATEGORIES) {
+            const count = ledger.lines[category].count;
+            if (typeof count === "number")
+                knownJobs += count;
+        }
+        if (knownJobs > caps.maxJobs) {
+            return {
+                ok: false,
+                message: `Observed KNOWN billable-job count ${knownJobs} exceeds scenario.caps.maxJobs=${caps.maxJobs}. The run fails closed.`
+            };
+        }
+    }
+    return { ok: true };
+}
+/** Round a USD sum to 6 decimals so a float-accumulated total never carries spurious precision. */
+function roundUsd(value) {
+    return Math.round(value * 1_000_000) / 1_000_000;
+}
+/**
+ * Build the per-command runtime-auth env from a DENY-BY-DEFAULT ALLOWLIST containing ONLY the
+ * declared runtime key (safety contract item 4). The key NAME is derived from the actor's
+ * keyPlacement capability plus the declared runtimeAuth channel, not a hardcoded string the caller
+ * can widen. Banned credential names (GitHub/payment/deploy/db/media) are excluded by construction
+ * AND guarded: if a banned name is ever requested the lane fails closed. Returns the allowlisted
+ * env (values from `env`) and the resolved key name, or a structured failure.
+ *
+ * Engine-enforced placement (safety contract item 1): the key is only ever returned as a
+ * COMMAND-scoped env here; the caller passes it to commands.run({envs}), never Sandbox.create.
+ */
+function buildCommandScopedRuntimeEnv(args) {
+    // The "openai-env" channel accepts CODEX_API_KEY or OPENAI_API_KEY as the runtime key SOURCE
+    // name, read in this preference order. CODEX_API_KEY is preferred: the official Codex docs
+    // (developers.openai.com/codex/noninteractive) document it as the channel for a SINGLE codex exec
+    // invocation, which is exactly this lane's shape (no persisted auth.json/CODEX_HOME, per-command
+    // envs only). A dated in-repo receipt
+    // (docs/goals/humanish-recursive-proof-critical-point/receipts/actor-required-attempt.md) shows a
+    // job-wide OPENAI_API_KEY alone failing bearer auth for this same pinned-exec pattern. When the
+    // operator only exported OPENAI_API_KEY, its value is ALSO injected under CODEX_API_KEY below, so
+    // the documented exec auth channel is always populated regardless of which name the operator
+    // used. The ALLOWLIST is exactly these two names; everything else is denied by construction.
+    const ALLOWED_RUNTIME_KEY_NAMES = ["CODEX_API_KEY", "OPENAI_API_KEY"];
+    // Tripwire (safety contract item 4): if a FUTURE widening of ALLOWED_RUNTIME_KEY_NAMES ever
+    // added a clearly-non-runtime credential (a GitHub/payment/deploy/db secret), fail closed. The
+    // generic `*_KEY` shape is deliberately NOT a tripwire here, since a runtime key legitimately
+    // ends in _KEY (CODEX_API_KEY/OPENAI_API_KEY), so testing it against the generic shape would
+    // false-positive on the very key this lane exists to inject. The positive allowlist itself is
+    // the real boundary: the command env is built from exactly these names and nothing else (so
+    // GITHUB_TOKEN/payment/db keys present in the operator env are never forwarded, proven by the
+    // deterministic test).
+    if (ALLOWED_RUNTIME_KEY_NAMES.some((name) => isNonRuntimeCredentialName(name))) {
+        return {
+            ok: false,
+            code: "HUMANISH_TERMINAL_LAB_CREDENTIAL_DENIED",
+            message: "Internal invariant violated: a runtime-key allowlist entry is a non-runtime credential (GitHub/payment/deploy/db)."
+        };
+    }
+    const keyName = ALLOWED_RUNTIME_KEY_NAMES.find((name) => (args.env[name]?.trim() ?? "").length > 0);
+    if (!keyName) {
+        return {
+            ok: false,
+            code: "HUMANISH_TERMINAL_LAB_RUNTIME_AUTH_MISSING",
+            message: `Live terminal-product labs declare runtimeAuth "${String(args.runtimeAuth)}" and need ${ALLOWED_RUNTIME_KEY_NAMES.join(" or ")} in the environment (pass via --env-file; the value is injected ONLY into the command-scoped codex invocation and is never persisted).`
+        };
+    }
+    const keyValue = args.env[keyName];
+    // The command-scoped env is the ALLOWLIST: exactly the runtime key name(s), nothing else. No
+    // GITHUB_TOKEN/GH_TOKEN, no payment/deploy/db/media key, excluded by construction. When the
+    // SOURCE was OPENAI_API_KEY, the SAME value is also injected as CODEX_API_KEY so codex exec's
+    // documented single-invocation auth channel is populated either way (see the comment above).
+    const envs = keyName === "OPENAI_API_KEY" ? { CODEX_API_KEY: keyValue, OPENAI_API_KEY: keyValue } : { [keyName]: keyValue };
+    return {
+        ok: true,
+        envs,
+        keyName,
+        keyValue
+    };
+}
+// Clearly-non-runtime credential NAME shapes. Used as the runtime-key allowlist tripwire (a
+// runtime key must never be one of these). Deliberately EXCLUDES the generic `*_KEY` shape: the
+// runtime key this lane injects (CODEX_API_KEY/OPENAI_API_KEY) legitimately ends in _KEY, so the
+// generic shape would false-positive on it. The positive allowlist, not a denylist, is what
+// keeps every OTHER operator-env credential (GitHub/payment/deploy/db/media keys) out of the
+// sandbox: the command env is built from exactly the allowlisted runtime key and nothing else.
+const NON_RUNTIME_CREDENTIAL_NAME_PATTERNS = [
+    /^GITHUB_TOKEN$/i,
+    /^GH_TOKEN$/i,
+    /TOKEN$/i, // deploy tokens, write tokens
+    /SECRET/i, // *_SECRET, payment secrets
+    /PASSWORD/i,
+    /DATABASE_URL/i,
+    /(^|_)DSN$/i,
+    /STRIPE/i,
+    /AWS_/i
+];
+/** True when `name` is a clearly-non-runtime credential (cannot be a runtime-key allowlist entry). */
+function isNonRuntimeCredentialName(name) {
+    return NON_RUNTIME_CREDENTIAL_NAME_PATTERNS.some((pattern) => pattern.test(name));
+}
+/**
+ * Build the sandbox metadata from a POSITIVE ALLOWLIST (safety contract item 6). This is the ONLY
+ * way metadata is set on the terminal lane — it carries solely non-secret labels and rejects any
+ * value that is not a plain short label. A verifier check asserts the persisted metadata has no
+ * prompt/token/secret shapes; this builder makes that true by construction.
+ */
+export function buildSandboxMetadata(allowlist) {
+    return {
+        mode: TERMINAL_PRODUCT_LAB_PROVIDER_METADATA.mode,
+        tool: TERMINAL_PRODUCT_LAB_PROVIDER_METADATA.tool,
+        provider: "codex",
+        labId: allowlist.labId,
+        simId: allowlist.simId,
+        // The run id is a harness-minted token (terminal-<ts>-<hex>), not user data.
+        runId: allowlist.runId
+    };
+}
+/**
+ * The live in-sandbox agent session orchestrator (mirror of runCuaActorLab's E2B branch). Enforces
+ * the 8-point safety contract by construction; fails closed before any sandbox/key/spend on any
+ * precondition miss. Persists the substrate-lifecycle/command-log/interventions/cleanup ledgers,
+ * the redacted terminal event stream + normalized transcript, the agent report, and the
+ * provider-neutral actor trace; tears the sandbox down in a finally and proves the teardown.
+ */
+async function runLiveTerminalSession(args) {
+    const { options, cwd, config, descriptorId, product, warnings, render, failed } = args;
+    const hooks = options.hooks ?? {};
+    const env = hooks.env ?? process.env;
+    const now = hooks.now ?? (() => Date.now());
+    const nowIso = () => new Date(now()).toISOString();
+    // --- Safety contract item 1: ENGINE-ENFORCED command-scoped key placement. ---
+    // Drive the placement off the registered actor's keyPlacement CAPABILITY, not a code convention.
+    // A terminal actor that does not declare in-sandbox-command-scoped placement FAILS CLOSED here,
+    // before any sandbox exists — the engine refuses to guess where the key goes.
+    const descriptor = actorRegistry[descriptorId];
+    const keyPlacement = descriptor?.capabilities.keyPlacement;
+    if (keyPlacement !== "in-sandbox-command-scoped") {
+        return failed("HUMANISH_TERMINAL_LAB_KEYPLACEMENT_INVALID", `Terminal actor "${descriptorId}" must declare keyPlacement "in-sandbox-command-scoped" for the live lane (got "${String(keyPlacement)}"). The engine routes the runtime key by this capability; without it the lane cannot place the key safely and fails closed.`, { actor: descriptorId });
+    }
+    // --- Safety contract item 2: a fail-closed cap MUST be in force before the live key runs. ---
+    const caps = config.scenario?.caps;
+    const maxUsd = caps?.maxUsd;
+    const maxMinutes = caps?.maxMinutes;
+    if (caps === undefined || maxUsd === undefined || maxMinutes === undefined || maxMinutes <= 0) {
+        return failed("HUMANISH_TERMINAL_LAB_CAPS_MISSING", "A live terminal-product run places a real key inside the sandbox and so REQUIRES a fail-closed cap: scenario.caps with maxUsd (0 = no-spend) and a positive maxMinutes (the codex command's wall-clock kill). The live key is never exercised without a cap in force.", { actor: descriptorId });
+    }
+    // SLICE 3: maxUsd is now ENFORCED fail-closed against the cost ledger (evaluateCapsAgainstLedger,
+    // after the session) — not advisory. A positive maxUsd is permitted, but the lane still has no
+    // PRODUCT-spend signal (product/media/payment lines are null = unmeasured; only the provider line
+    // is measurable, from tokenUsage). So a positive budget is honestly bounded by what is MEASURED:
+    // the known total (provider, when present) must stay <= maxUsd, and the no-spend proof reports the
+    // unmeasured lines rather than guessing them zero. Warn so the operator knows a positive budget is
+    // only as strong as the (currently provider-only) spend signal.
+    if (maxUsd > 0) {
+        warnings.push(`scenario.caps.maxUsd=${maxUsd} declares a non-zero spend budget. SLICE 3 enforces maxUsd fail-closed against the cost ledger, but the only spend signal this slice meters is the provider line (from tokenUsage); product/media/payment are recorded null (UNMEASURED, never guessed zero) until the SLICE-4 adapter supplies them. The no-spend proof reports the unmeasured lines honestly.`);
+    }
+    // --- Safety contract item 4: deny-by-default credentials; build the command-scoped allowlist. ---
+    const runtimeEnv = buildCommandScopedRuntimeEnv({ runtimeAuth: config.execution?.runtimeAuth, env });
+    if (!runtimeEnv.ok) {
+        return failed(runtimeEnv.code, runtimeEnv.message, { actor: descriptorId });
+    }
+    // Compose the prompt from PUBLIC surfaces + the author mission ONLY (safety contract item 3).
+    // Inject a per-run verdict nonce: the agent echoes HUMANISH_ACTOR_VERDICT=<status>
+    // HUMANISH_ACTOR_NONCE=<nonce>; the scorer verifies the nonce so replayed text cannot forge it.
+    const mission = config.actors[0]?.mission ?? defaultMission(product.name);
+    const personaId = config.actors[0]?.persona ?? "autonomous-terminal-agent";
+    const verdictNonce = randomUUID().slice(0, 12);
+    const composedPrompt = composeLivePrompt({
+        mission,
+        personaId,
+        productName: product.name,
+        publicSurfaces: product.publicSurfaces,
+        verdictNonce
+    });
+    const promptDigest = digestText(composedPrompt);
+    const persona = { id: personaId, traitsApplied: [], promptDigest };
+    // --- Safety contract item 5: literal-scrub EVERY known value, then pattern-redact, at the source. ---
+    // The runtime key value (+ any other provisioned value) is scrubbed by LITERAL match before
+    // anything persists (a key has no detectable "shape" if it is an arbitrary token); redactText is
+    // the second pass for secret-SHAPED content. Applied PRE-truncation so a cut can never split a
+    // value past the scrubber.
+    const knownSecretValues = [runtimeEnv.keyValue, env.E2B_API_KEY?.trim() ?? ""].filter((v) => v.length >= 4);
+    const scrubKnownValues = (text) => knownSecretValues.reduce((current, value) => current.split(value).join("[REDACTED_SECRET]"), text);
+    const sanitize = (text) => redactText(scrubKnownValues(text));
+    const runId = options.runId ?? makeTerminalRunId();
+    const artifactRoot = path.join(cwd, ".humanish", "runs", runId);
+    const createdAt = nowIso();
+    await mkdir(artifactRoot, { recursive: true });
+    const source = await buildRunSource({ capturedAt: createdAt, cwd, humanishSource: "present", packageName: "humanish" });
+    const e2bApiKey = env.E2B_API_KEY?.trim() ?? "";
+    // The ledgers + capture buffers, mutated through the live lifecycle.
+    const lifecycle = [];
+    const commandLog = [];
+    const terminalEvents = [];
+    const interventions = []; // ALWAYS empty this slice (no assisted-input path).
+    let transcriptBytes = 0;
+    let cleanup = { killed: false, remaining: -1, reason: "teardown not reached" };
+    const recordLifecycle = (event, message) => {
+        lifecycle.push({ at: nowIso(), event, message: sanitize(message) });
+    };
+    const appendTerminalChunk = (stream, raw) => {
+        if (transcriptBytes >= MAX_TRANSCRIPT_BYTES)
+            return;
+        transcriptBytes += Buffer.byteLength(raw, "utf8");
+        // Scrub THEN redact at the SOURCE — raw bytes never leave this function (safety contract item 5).
+        terminalEvents.push({ at: nowIso(), stream, chunk: sanitize(raw) });
+    };
+    let sandbox;
+    let sandboxModule;
+    let sandboxId;
+    let sessionStatus = "failed";
+    let completionReason = "harness_error";
+    let sessionReason = "live terminal-product session did not start";
+    let sessionError;
+    let timedOut = false;
+    recordLifecycle("terminal-lab.run.created", `Created live terminal-product run ${runId} (actor ${descriptorId}, product ${product.name}). Caps: maxUsd=${maxUsd}, maxMinutes=${maxMinutes}. Subject provenance UNPINNED (public surfaces only).`);
+    const requestTimeoutMs = DEFAULT_REQUEST_TIMEOUT_MS;
+    const wallClockMs = maxMinutes * 60_000;
+    const sandboxTimeoutMs = wallClockMs + SANDBOX_TIMEOUT_BUFFER_MS;
+    const metadata = buildSandboxMetadata({ labId: config.id, simId: "sim-001", runId });
+    try {
+        sandboxModule = await (hooks.loadModule ?? loadE2BDesktopModule)();
+        // SAFETY CONTRACT ITEM 1 (enforced HERE): Sandbox.create carries metadata (positive allowlist)
+        // + lifecycle kill-on-timeout, and DELIBERATELY NO `envs` — the runtime key is NEVER passed
+        // sandbox-global. It is injected ONLY into the per-command codex `envs` below.
+        sandbox = await sandboxModule.Sandbox.create({
+            apiKey: e2bApiKey,
+            requestTimeoutMs,
+            timeoutMs: sandboxTimeoutMs,
+            metadata,
+            lifecycle: { onTimeout: "kill" }
+            // NOTE: no `envs` key — see the credential boundary above. (A sandbox-global key would leak
+            // into every process in the sandbox; command-scoped bounds it to the codex invocation.)
+        });
+        sandboxId = sandbox.sandboxId;
+        recordLifecycle("terminal-lab.sandbox.created", `E2B shell sandbox ${sandboxId} created with positive-allowlist metadata and kill-on-timeout; NO sandbox-global env (runtime key is command-scoped).`);
+        // Readiness: a tiny in-sandbox probe (no key) confirms the shell answers before the keyed run.
+        const ready = await sandbox.commands.run(`mkdir -p ${SANDBOX_WORKDIR} && echo HUMANISH_SHELL_READY`, { requestTimeoutMs });
+        recordLifecycle("terminal-lab.sandbox.ready", `Shell readiness probe exit=${ready.exitCode ?? "null"}; workdir ${SANDBOX_WORKDIR} prepared.`);
+        // --- Runtime bootstrap: ensure Node/npm are present (UNKEYED, no envs) before the keyed exec. ---
+        // The stock @e2b/desktop image does not ship a recent Node (issue #159); codex is now invoked
+        // via `npx` (buildCodexExecCommand), which needs Node/npm on PATH. Reuses the proven
+        // oss-meta-lab.ts ensure_node() shape: a node major-version check, else install Node 22 via
+        // NodeSource plus passwordless sudo. UNKEYED: no runtime key touches this step. An apt-get
+        // install can exceed the SDK's default 60s commands.run timeout, so this step gets an
+        // explicit, generous timeoutMs (requestTimeoutMs is passed through unchanged, as everywhere else).
+        const bootstrapStartedAt = now();
+        let bootstrapError;
+        try {
+            const bootstrap = await sandbox.commands.run(RUNTIME_BOOTSTRAP_COMMAND, {
+                requestTimeoutMs,
+                timeoutMs: RUNTIME_BOOTSTRAP_TIMEOUT_MS
+            });
+            if ((bootstrap.exitCode ?? 1) !== 0) {
+                bootstrapError = `runtime bootstrap exited ${bootstrap.exitCode ?? "null"}`;
+            }
+        }
+        catch (error) {
+            bootstrapError = toErrorMessage(error);
+        }
+        const bootstrapDurationMs = Math.max(0, now() - bootstrapStartedAt);
+        recordLifecycle("terminal-lab.runtime.bootstrapped", bootstrapError
+            ? `Runtime bootstrap FAILED after ${bootstrapDurationMs}ms: ${bootstrapError}. codex exec runs via npx and needs Node/npm present; the lane fails closed rather than attempting an exec with no runtime.`
+            : `Runtime bootstrap ensured Node/npm present in ${bootstrapDurationMs}ms (codex exec runs via npx).`);
+        if (bootstrapError) {
+            // Fail closed as a structured lane status (never a raw throw): no codex exec is attempted
+            // without a proven runtime; this mirrors the exec-error status assignment below so the
+            // bundle and verify surface the failure the same way.
+            sessionStatus = "failed";
+            completionReason = "harness_error";
+            sessionError = sanitize(bootstrapError);
+            sessionReason = `runtime bootstrap could not ensure Node/npm before codex exec: ${sessionError}`;
+        }
+        else {
+            // --- The keyed run: `codex exec --json` non-interactively (stdin disabled). ---
+            // The runtime key is injected ONLY here, command-scoped (safety contract item 1). stdin is
+            // never wired (safety contract item 7) — commands.run takes no stdin channel. The command's
+            // wall-clock is bounded by maxMinutes (safety contract item 2): commands.run timeoutMs +
+            // an injected-clock guard so a mock/real run that exceeds it is killed and fails closed.
+            const codexCommand = buildCodexExecCommand({ workdir: SANDBOX_WORKDIR, prompt: composedPrompt });
+            const commandDigest = digestText(codexCommand);
+            const startedAt = now();
+            recordLifecycle("terminal-lab.exec.started", `Launching codex exec (command-scoped runtime key ${runtimeEnv.keyName}); wall-clock bound ${wallClockMs}ms.`);
+            let exitCode;
+            let runError;
+            try {
+                const result = await runWithWallClock(sandbox.commands.run(codexCommand, {
+                    envs: runtimeEnv.envs, // <-- THE command-scoped key channel. The ONLY place the key goes.
+                    requestTimeoutMs,
+                    timeoutMs: wallClockMs,
+                    onStdout: (data) => appendTerminalChunk("stdout", data),
+                    onStderr: (data) => appendTerminalChunk("stderr", data)
+                }), wallClockMs, now);
+                if (result.timedOut) {
+                    timedOut = true;
+                }
+                else {
+                    exitCode = result.value.exitCode;
+                    // Some SDK shapes return final stdout/stderr in the result too (not only via callbacks).
+                    if (result.value.stdout)
+                        appendTerminalChunk("stdout", result.value.stdout);
+                    if (result.value.stderr)
+                        appendTerminalChunk("stderr", result.value.stderr);
+                    if (result.value.error)
+                        runError = result.value.error;
+                }
+            }
+            catch (error) {
+                runError = toErrorMessage(error);
+            }
+            const durationMs = Math.max(0, now() - startedAt);
+            commandLog.push({
+                at: nowIso(),
+                label: "codex-exec",
+                commandDigest,
+                envNames: Object.keys(runtimeEnv.envs), // NAMES only — the credential evidence (item 4).
+                ...(exitCode === undefined ? {} : { exitCode }),
+                ...(timedOut ? { timedOut: true } : {}),
+                durationMs
+            });
+            // Score by the verdict-nonce marker over the SCRUBBED+REDACTED, NORMALIZED transcript — the
+            // exact same logic the local-actor lanes use (extractLocalActorVerdict/normalizeLocalActorTranscript).
+            const rawTranscript = terminalEvents.map((e) => e.chunk).join("");
+            const normalizedTranscript = normalizeLocalActorTranscript(rawTranscript);
+            const markerStatus = extractLocalActorVerdict(normalizedTranscript, verdictNonce);
+            if (timedOut) {
+                sessionStatus = "timed_out";
+                completionReason = "timed_out";
+                sessionReason = `codex exec exceeded the maxMinutes wall-clock (${maxMinutes}m); killed and failed closed.`;
+                recordLifecycle("terminal-lab.exec.timed_out", sessionReason);
+            }
+            else if (runError) {
+                sessionStatus = "failed";
+                completionReason = "harness_error";
+                sessionError = sanitize(runError);
+                sessionReason = `codex exec could not run: ${sessionError}`;
+                recordLifecycle("terminal-lab.exec.error", sessionReason);
+            }
+            else if (markerStatus) {
+                sessionStatus = markerStatus;
+                completionReason = markerStatus === "passed" ? "goal_satisfied" : markerStatus === "blocked" ? "blocked_approval" : "gave_up";
+                sessionReason = `agent reported ${markerStatus} verdict marker (nonce-verified)`;
+                recordLifecycle("terminal-lab.exec.completed", `codex exec exit=${exitCode ?? "null"}; ${sessionReason}.`);
+            }
+            else {
+                // No nonce-verified verdict: the agent did not (credibly) report a terminal status. A run
+                // that exited 0 but printed no verified marker is BLOCKED evidence (the failure IS the
+                // evidence — still structurally verifiable), not a silent pass.
+                sessionStatus = "blocked";
+                completionReason = "gave_up";
+                sessionReason = `codex exec exit=${exitCode ?? "null"} but no nonce-verified HUMANISH_ACTOR_VERDICT marker was emitted; recorded as blocked (the missing verdict is the evidence).`;
+                recordLifecycle("terminal-lab.exec.blocked", sessionReason);
+            }
+        }
+    }
+    catch (error) {
+        sessionError = sanitize(toErrorMessage(error));
+        sessionStatus = "failed";
+        completionReason = "harness_error";
+        sessionReason = `live terminal-product session failed: ${sessionError}`;
+        recordLifecycle("terminal-lab.session.error", sessionReason);
+    }
+    finally {
+        // --- Safety contract item 8: PROVEN cleanup, BY EXACT ID, never Sandbox.list. ---
+        cleanup = await teardownSandbox({
+            sandboxModule,
+            sandbox,
+            requestTimeoutMs,
+            sanitize,
+            recordLifecycle,
+            warnings
+        });
+    }
+    // Build the actor trace FIRST (the cost ledger reads its tokenUsage).
+    const normalizedTranscript = normalizeLocalActorTranscript(terminalEvents.map((e) => e.chunk).join(""));
+    const trace = buildTerminalActorTrace({
+        persona,
+        productName: product.name,
+        status: sessionStatus,
+        completionReason,
+        reason: sanitize(sessionReason),
+        createdAt,
+        completedAt: nowIso(),
+        durationMs: commandLog[0]?.durationMs ?? 0,
+        terminalEvents,
+        commandLog,
+        transcriptTail: tailOf(normalizedTranscript)
+    });
+    // --- SLICE 3: the spend ledger + no-spend proof + FULL caps enforcement (fail-closed). ---
+    // The cost ledger is DERIVED, with the null discipline: provider spend from the trace's
+    // tokenUsage.costUsd when present (else null = NOT MEASURED), product/media/payment null this
+    // slice (no signal yet — SLICE 4). The costProbe hook lets the deterministic test inject KNOWN
+    // spend to exercise the fail-closed cap without a real billable run.
+    const injectedLines = hooks.costProbe?.({ ...(trace.tokenUsage?.costUsd === undefined ? {} : { tokenCostUsd: trace.tokenUsage.costUsd }) });
+    const cost = buildCostLedger({
+        ...(trace.tokenUsage?.costUsd === undefined ? {} : { tokenCostUsd: trace.tokenUsage.costUsd }),
+        ...(injectedLines ? { injectedLines } : {})
+    });
+    const noSpendProof = buildNoSpendProof(cost, maxUsd ?? null);
+    recordLifecycle("terminal-lab.cost.measured", `Cost ledger: known total ${cost.knownTotalUsd} USD${cost.fullyMeasured ? " (fully measured)" : ` (lower bound; unmeasured: ${noSpendProof.unmeasuredLines.join(", ") || "none"})`}. No-spend proof ${noSpendProof.satisfied ? "satisfied" : "NOT satisfied"} for maxUsd=${maxUsd ?? "null"}.`);
+    // FULL caps enforcement (fail-closed, NOT advisory): if a KNOWN spend line exceeds maxUsd (or a
+    // known job count exceeds maxJobs), the run fails closed — never a green pass. Unknowns (null) do
+    // NOT trip the cap (we cannot claim a violation we did not measure) but never grant a pass either
+    // (the no-spend proof reports them as unmeasured). maxMinutes is already wall-clock-enforced above.
+    const capCheck = evaluateCapsAgainstLedger(cost, caps);
+    let capsExceeded = false;
+    if (!capCheck.ok) {
+        capsExceeded = true;
+        sessionStatus = "failed";
+        completionReason = "harness_error";
+        sessionError = capCheck.message;
+        sessionReason = capCheck.message;
+        recordLifecycle("terminal-lab.caps.exceeded", capCheck.message);
+        // Reflect the fail-closed verdict in the trace the bundle/observer reads (so the run cannot show
+        // a passing agent verdict while the cap was blown).
+        trace.status = "failed";
+        trace.completionReason = "harness_error";
+        trace.reason = capCheck.message;
+    }
+    // Assemble + persist the ledgers (now carrying the cost block + no-spend proof), the redacted
+    // event stream, the normalized transcript, the actor trace, and the run bundle.
+    const ledgers = {
+        schema: "humanish.terminal-ledgers.v1",
+        lifecycle,
+        commandLog,
+        interventions, // ALWAYS present, ALWAYS empty (no assisted-input path this slice).
+        cleanup,
+        cost,
+        noSpendProof
+    };
+    await writeFile(path.join(artifactRoot, TERMINAL_EVENTS_ARTIFACT), `${terminalEvents.map((e) => JSON.stringify(e)).join("\n")}${terminalEvents.length > 0 ? "\n" : ""}`, "utf8");
+    await writeFile(path.join(artifactRoot, TERMINAL_TRANSCRIPT_ARTIFACT), `${normalizedTranscript}\n`, "utf8");
+    await writeFile(path.join(artifactRoot, TERMINAL_LEDGERS_ARTIFACT), `${JSON.stringify(ledgers, null, 2)}\n`, "utf8");
+    await writeFile(path.join(artifactRoot, "actor.json"), `${JSON.stringify(trace, null, 2)}\n`, "utf8");
+    const bundle = buildLiveTerminalProductBundle({
+        actorId: descriptorId,
+        createdAt,
+        labId: config.id,
+        ...(config.title ? { labTitle: config.title } : {}),
+        mission,
+        persona,
+        productName: product.name,
+        publicSurfaces: product.publicSurfaces,
+        caps,
+        runtimeAuthKeyName: runtimeEnv.keyName,
+        policies: {
+            allowPrivateRepoAccess: config.policies?.allowPrivateRepoAccess ?? false,
+            allowProviderCredentials: config.policies?.allowProviderCredentials ?? false,
+            allowPaymentCredentials: config.policies?.allowPaymentCredentials ?? false,
+            allowGitHubMutation: config.policies?.allowGitHubMutation ?? false
+        },
+        runId,
+        source,
+        trace,
+        ledgers,
+        ...(sandboxId ? { sandboxId } : {}),
+        ...(sessionError ? { sessionError } : {}),
+        sessionReason: sanitize(sessionReason)
+    });
+    // --- THE LAYER-6 EXTENSION SEAM (issue #154 acceptance #8). ---
+    // When a thin adapter registered a scorer / feedback strategy, the lane calls it over the
+    // FULLY-ASSEMBLED, redacted evidence and attaches the results to the bundle WITHOUT knowing any
+    // product noun: the namespaced RunAdapterScore lands on bundle.adapterScore, and the derived
+    // feedback candidates (each carrying its own namespaced product-noun block) are appended to
+    // bundle.feedbackCandidates. Core's mission-based verdict (bundle.review) is left UNCHANGED — the
+    // adapter score is additive, not a replacement. The adapter payloads pass the same scrub+redact
+    // the rest of the bundle does (the adapter is trusted in-repo code, but the harness never relies
+    // on that for secret values) and are validated fail-closed by the bundle verifier downstream.
+    await applyAdapterExtensionSeam({ hooks, bundle, trace, ledgers, product: product.name, labId: config.id, runId, sanitize, warnings });
+    await writeFile(path.join(artifactRoot, "run.json"), `${JSON.stringify(bundle, null, 2)}\n`, "utf8");
+    await writeFile(path.join(artifactRoot, "review.json"), `${JSON.stringify(bundle.review, null, 2)}\n`, "utf8");
+    await writeFile(path.join(artifactRoot, "review.md"), renderTerminalReviewMarkdown(bundle), "utf8");
+    await writeFile(path.join(artifactRoot, "events.ndjson"), `${bundle.events.map((event) => JSON.stringify(event)).join("\n")}\n`, "utf8");
+    await writeFile(path.join(cwd, ".humanish", "runs", "latest.json"), `${JSON.stringify({ schema: "humanish.latest-run.v1", runId, path: path.join(".humanish", "runs", runId), updatedAt: createdAt }, null, 2)}\n`, "utf8");
+    const observer = await render(cwd, runId, { open: options.open === true });
+    // The lab's exit code: verified evidence AND no harness error AND proven cleanup. A blocked/
+    // timed-out agent run is STILL ok-as-evidence at the bundle level (the failure is the evidence),
+    // but the LAB result surfaces ok:false on a harness error or unproven teardown (fail-closed).
+    // remaining===0 is the by-id-confirmed-reclaimed state; remaining===1 (still present) and
+    // remaining===-1 (kill(id) itself failed) are both unproven by design.
+    const cleanupProven = cleanup.killed && cleanup.remaining === 0;
+    const ok = observer.ok && completionReason !== "harness_error" && cleanupProven;
+    return {
+        schema: TERMINAL_PRODUCT_LAB_SCHEMA,
+        ok,
+        cwd,
+        labId: config.id,
+        actor: descriptorId,
+        product: product.name,
+        dryRun: false,
+        runId,
+        session: { status: sessionStatus, completionReason, reason: sanitize(sessionReason) },
+        ...(sandboxId
+            ? { sandbox: { sandboxId, killed: cleanup.killed, remaining: cleanup.remaining } }
+            : {}),
+        cost: {
+            knownTotalUsd: cost.knownTotalUsd,
+            fullyMeasured: cost.fullyMeasured,
+            lines: {
+                product: cost.lines.product.usd,
+                media: cost.lines.media.usd,
+                payment: cost.lines.payment.usd,
+                provider: cost.lines.provider.usd
+            }
+        },
+        noSpend: {
+            satisfied: noSpendProof.satisfied,
+            maxUsd: noSpendProof.maxUsd,
+            knownZeroLines: noSpendProof.knownZeroLines,
+            unmeasuredLines: noSpendProof.unmeasuredLines
+        },
+        observer,
+        warnings: [...warnings, ...observer.warnings],
+        ...(ok
+            ? {}
+            : {
+                error: {
+                    code: (!cleanupProven
+                        ? "HUMANISH_TERMINAL_LAB_CLEANUP_UNPROVEN"
+                        : capsExceeded
+                            ? "HUMANISH_TERMINAL_LAB_CAPS_EXCEEDED"
+                            : "HUMANISH_TERMINAL_LAB_FAILED"),
+                    message: !cleanupProven
+                        ? `Live terminal-product run could not prove sandbox teardown (killed=${cleanup.killed}, remaining=${cleanup.remaining}): ${cleanup.reason}. A run that cannot prove teardown fails closed.`
+                        : sessionError ?? observer.error?.message ?? sessionReason
+                }
+            })
+    };
+}
+/**
+ * Run the layer-6 product-adapter extension seam (issue #154 acceptance #8) over the assembled
+ * evidence and attach its results to the bundle IN PLACE — without core knowing any product noun.
+ *
+ *  - `score`: when present, the returned namespaced `RunAdapterScore` lands on `bundle.adapterScore`.
+ *    Core's mission-based verdict (`bundle.review`) is UNCHANGED — the adapter score is additive.
+ *  - `deriveFeedback`: when present, the returned candidates are appended to
+ *    `bundle.feedbackCandidates`; each carries its own namespaced `adapter` product-noun block.
+ *
+ * Defense in depth: the adapter's namespaced payloads are re-serialized through the run's scrub +
+ * redact (the adapter is trusted in-repo code, but the harness never relies on that for secret
+ * values), and any candidate / score that does not satisfy core's exported shape is DROPPED with a
+ * warning (a malformed adapter output never poisons a verifiable bundle). The bundle verifier
+ * re-checks the surviving shapes downstream, so the seam stays fail-closed end to end.
+ */
+async function applyAdapterExtensionSeam(args) {
+    const { hooks, bundle, trace, ledgers, product, labId, runId, sanitize, warnings } = args;
+    if (!hooks.score && !hooks.deriveFeedback)
+        return;
+    const ctx = { bundle, trace, ledgers, product, labId, runId };
+    // Scrub + redact an arbitrary adapter payload by round-tripping it through the run's sanitizer.
+    // Strings are scrubbed individually so a planted secret in any nested string value is caught.
+    const scrubValue = (value) => JSON.parse(sanitize(JSON.stringify(value)));
+    if (hooks.score) {
+        try {
+            const score = await hooks.score(ctx);
+            const cleaned = scrubValue(score);
+            if (isAdapterScoreShape(cleaned)) {
+                bundle.adapterScore = cleaned;
+            }
+            else {
+                warnings.push("terminalHooks.score returned a value that is not a well-formed humanish.adapter-score.v1 (non-empty namespace + status + numeric score + summary); dropped so the bundle stays verifiable.");
+            }
+        }
+        catch (error) {
+            warnings.push(`terminalHooks.score threw (${sanitize(error instanceof Error ? error.message : String(error))}); dropped so the bundle stays verifiable.`);
+        }
+    }
+    if (hooks.deriveFeedback) {
+        try {
+            const candidates = await hooks.deriveFeedback(ctx);
+            const accepted = [];
+            for (const candidate of Array.isArray(candidates) ? candidates : []) {
+                const cleaned = scrubValue(candidate);
+                if (isAdapterFeedbackCandidateShape(cleaned))
+                    accepted.push(cleaned);
+                else
+                    warnings.push("terminalHooks.deriveFeedback returned a candidate that is not a well-formed humanish.feedback-candidate.v1 (or its adapter block lacked a non-empty namespace + data record); dropped so the bundle stays verifiable.");
+            }
+            if (accepted.length > 0) {
+                bundle.feedbackCandidates = [...bundle.feedbackCandidates, ...accepted];
+            }
+        }
+        catch (error) {
+            warnings.push(`terminalHooks.deriveFeedback threw (${sanitize(error instanceof Error ? error.message : String(error))}); dropped so the bundle stays verifiable.`);
+        }
+    }
+}
+/** Structural guard for an adapter-returned RunAdapterScore (mirrors run.ts isRunAdapterScore, kept
+ *  local so the lane fails closed at the seam BEFORE the bundle verifier re-checks it). */
+function isAdapterScoreShape(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+        && value.schema === "humanish.adapter-score.v1"
+        && typeof value.namespace === "string"
+        && value.namespace.trim().length > 0
+        && ["pass", "partial", "fail"].includes(value.status)
+        && typeof value.score === "number"
+        && Number.isFinite(value.score)
+        && typeof value.summary === "string";
+}
+/** Structural guard for an adapter-returned feedback candidate. Requires the core shape AND (when an
+ *  adapter block is present) a non-empty namespace + data record — so a malformed product-noun block
+ *  fails closed at the seam. */
+function isAdapterFeedbackCandidateShape(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const candidate = value;
+    const baseOk = candidate.schema === "humanish.feedback-candidate.v1"
+        && typeof candidate.id === "string"
+        && typeof candidate.summary === "string" && candidate.summary.trim().length > 0
+        && Array.isArray(candidate.evidence)
+        && typeof candidate.redaction === "object" && candidate.redaction !== null && candidate.redaction.status === "passed";
+    if (!baseOk)
+        return false;
+    if (candidate.adapter !== undefined) {
+        const adapter = candidate.adapter;
+        if (typeof adapter !== "object" || adapter === null
+            || typeof adapter.namespace !== "string" || adapter.namespace.trim().length === 0
+            || typeof adapter.data !== "object" || adapter.data === null || Array.isArray(adapter.data)) {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Tear the sandbox down and PROVE it BY EXACT ID -- NEVER Sandbox.list (humanish must never
+ * enumerate the operator's E2B account; see docs/principles/invariants-and-defaults.md). After
+ * Sandbox.kill(id) resolves, its own boolean return ("found and killed", per the SDK) is the
+ * PRIMARY proof. Where the SDK exposes Sandbox.getInfo(id), a thrown SandboxNotFoundError is a
+ * second by-id confirmation that the exact sandbox is gone; a returned SandboxInfo with a live
+ * state means teardown is NOT confirmed. Never throws -- teardown failure is recorded, the
+ * caller fails closed on an unproven teardown.
+ */
+async function teardownSandbox(args) {
+    const { sandboxModule, sandbox, requestTimeoutMs, sanitize, recordLifecycle, warnings } = args;
+    if (!sandbox || !sandboxModule) {
+        recordLifecycle("terminal-lab.cleanup.skipped", "No sandbox was created; nothing to reclaim.");
+        return { killed: false, remaining: 0, reason: "no sandbox created" };
+    }
+    if (typeof sandboxModule.Sandbox.kill !== "function") {
+        return { killed: false, remaining: -1, reason: "installed @e2b/desktop SDK does not expose Sandbox.kill; server-side kill-on-timeout will reclaim the sandbox" };
+    }
+    let killResult = false;
+    try {
+        killResult = (await sandboxModule.Sandbox.kill(sandbox.sandboxId, { requestTimeoutMs })) === true;
+    }
+    catch (error) {
+        const sanitizedError = sanitize(toErrorMessage(error));
+        warnings.push(`Sandbox teardown failed (server-side kill-on-timeout will reclaim it): ${sanitizedError}`);
+        recordLifecycle("terminal-lab.cleanup.kill_error", `Sandbox ${sandbox.sandboxId} kill(id) failed: ${sanitizedError}`);
+        return { killed: false, remaining: -1, reason: `kill(id) failed: ${sanitizedError} (server-side kill-on-timeout will reclaim it)` };
+    }
+    // BY-ID verification only, from here down: NEVER Sandbox.list. A kill(id) call that RESOLVES is
+    // itself proof the exact sandbox is gone: kill(id) returns true when it found and killed the
+    // sandbox, and false ONLY on a 404 (the exact id was already gone, e.g. the server-side
+    // kill-on-timeout raced ahead). Both mean "this id is no longer running." Sandbox.getInfo(id),
+    // when the SDK exposes it, adds a second by-id confirmation; the only thing that overturns the
+    // kill proof is getInfo returning a LIVE sandbox for this exact id.
+    const killNote = killResult
+        ? "kill(id) returned true (found and killed)"
+        : "kill(id) returned false (404: the exact sandbox was already gone)";
+    if (typeof sandboxModule.Sandbox.getInfo !== "function") {
+        recordLifecycle("terminal-lab.cleanup.killed", `Sandbox ${sandbox.sandboxId} reclaimed: ${killNote}; the installed SDK has no getInfo(id) to re-verify, so kill(id)'s own result is the proof.`);
+        return { killed: true, remaining: 0, reason: `reclaimed by id; ${killNote} and the installed SDK does not expose Sandbox.getInfo to re-verify` };
+    }
+    try {
+        const info = await sandboxModule.Sandbox.getInfo(sandbox.sandboxId, { requestTimeoutMs });
+        const state = info.state ?? "unknown";
+        recordLifecycle("terminal-lab.cleanup.unconfirmed", `Sandbox ${sandbox.sandboxId} ${killNote}, but getInfo(id) still reports state=${state} (not confirmed reclaimed by id).`);
+        return { killed: true, remaining: 1, reason: `${killNote} but getInfo(id) still reports state=${state}; this sandbox's teardown is not confirmed by id` };
+    }
+    catch (error) {
+        if (isSandboxNotFoundError(error)) {
+            recordLifecycle("terminal-lab.cleanup.verified", `Sandbox ${sandbox.sandboxId} reclaimed; getInfo(id) confirms it no longer exists (SandboxNotFoundError) -- by exact id, never re-listed.`);
+            return { killed: true, remaining: 0, reason: `reclaimed by id; getInfo(id) confirms the exact sandbox no longer exists (SandboxNotFoundError)` };
+        }
+        // getInfo(id) failed for a reason OTHER than "not found" (e.g. a transient network error):
+        // no second by-id confirmation is available, so the RESOLVED kill(id) call stands as the proof
+        // of absence. Never fall back to Sandbox.list.
+        const sanitizedError = sanitize(toErrorMessage(error));
+        recordLifecycle("terminal-lab.cleanup.killed", `Sandbox ${sandbox.sandboxId} reclaimed: ${killNote}; getInfo(id) re-verification errored (${sanitizedError}), so kill(id)'s resolved result is the proof.`);
+        return { killed: true, remaining: 0, reason: `reclaimed by id; ${killNote} and getInfo(id) re-verification errored (${sanitizedError}), so kill(id)'s resolved result is the proof` };
+    }
+}
+/**
+ * Race a commands.run promise against the maxMinutes wall-clock (safety contract item 2). The E2B
+ * commands.run timeoutMs is the primary kill; this injected-clock guard is the belt-and-suspenders
+ * backstop so a mock CLI (which ignores timeoutMs) is still bounded and fails closed in CI.
+ */
+async function runWithWallClock(promise, wallClockMs, now) {
+    let timer;
+    const start = now();
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(() => resolve({ timedOut: true }), wallClockMs);
+        timer.unref?.();
+    });
+    const value = await Promise.race([
+        promise.then((v) => ({ timedOut: false, value: v })),
+        timeout
+    ]);
+    if (timer)
+        clearTimeout(timer);
+    // Guard against a clock that advanced past the budget even if the race resolved on the promise.
+    if (!value.timedOut && now() - start >= wallClockMs) {
+        return { timedOut: true };
+    }
+    return value;
+}
+/** Build the in-sandbox `codex exec` command (non-interactive, JSON, stdin disabled by mechanism). */
+function buildCodexExecCommand(args) {
+    // The prompt is passed via a heredoc on stdin of a wrapper? NO, stdin is DISABLED (item 7), so
+    // the prompt rides as the final positional arg, shell-quoted. codex exec --json runs once and
+    // exits (no interactive loop). --skip-git-repo-check: the workdir is a fresh scratch dir.
+    // Pinned via npx (never an ambient/preinstalled `codex` binary, which the stock @e2b/desktop
+    // image does not ship, per issue #159); npm_config_update_notifier=false silences npx's own
+    // update check so it cannot leak into the captured stdout the scorer/redactor parse.
+    const quotedPrompt = `'${args.prompt.replace(/'/g, "'\\''")}'`;
+    // --dangerously-bypass-approvals-and-sandbox: codex's OWN inner sandbox is
+    // redundant here and blocks the network/file access the study mission needs.
+    // The E2B sandbox is the trust boundary (the disposable machine); the sibling
+    // oss-meta-lab lane carries the same flag at both live call sites for the
+    // same reason, and exec mode has no interactive approval channel at all.
+    return `cd ${args.workdir} && npm_config_update_notifier=false npx -y @openai/codex@latest exec --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check --json ${quotedPrompt}`;
+}
+/** Compose the live prompt: PUBLIC surfaces + author mission + the verdict-nonce marker contract. */
+function composeLivePrompt(args) {
+    return [
+        `persona: ${args.personaId}`,
+        `product: ${args.productName}`,
+        `public-surfaces: ${args.publicSurfaces.join(" ")}`,
+        `mission: ${args.mission}`,
+        "",
+        "Work ONLY from the public surfaces above. Do NOT clone or inspect any private repository.",
+        `When finished, print exactly one final machine-readable line in this format: HUMANISH_ACTOR_VERDICT=<status> HUMANISH_ACTOR_NONCE=${args.verdictNonce} where <status> is passed, blocked, or failed.`
+    ].join("\n");
+}
+/** Redacted, ellipsis-prefixed tail of a captured stream/log for a message field. */
+function tailOf(text) {
+    return redactedTail(text, TAIL_CHARS);
+}
+/**
+ * Project the live terminal session into the provider-neutral humanish.actor-trace.v1 (lane
+ * "terminal", protocol "terminal-exec"). counts.actions/messages drive the no-engagement honesty
+ * guard (a real run bumps them; a no-op is caught). No screenshots on this lane.
+ */
+function buildTerminalActorTrace(args) {
+    const items = [
+        ...args.commandLog.map((entry, index) => ({
+            id: `command-${String(index + 1).padStart(3, "0")}`,
+            kind: "command",
+            lifecycle: "completed",
+            ...(entry.exitCode === undefined ? {} : { status: String(entry.exitCode) }),
+            title: `${entry.label} (${entry.envNames.join(",") || "no command-scoped env"})`,
+            command: {
+                ...(entry.exitCode === undefined ? {} : { exitCode: entry.exitCode }),
+                outputTail: args.transcriptTail
+            }
+        })),
+        // One message item carrying the (already-redacted) transcript tail so the trace shows the agent
+        // narrated SOMETHING — the engagement signal the no-engagement guard reads.
+        ...(args.terminalEvents.length > 0
+            ? [{ id: "message-001", kind: "message", lifecycle: "completed", title: "agent terminal output", text: args.transcriptTail }]
+            : [])
+    ];
+    return {
+        schema: ACTOR_TRACE_SCHEMA,
+        provider: "codex",
+        protocol: "terminal-exec",
+        lane: "terminal",
+        persona: args.persona,
+        redaction: {
+            status: "passed",
+            screenshots: "n/a",
+            notes: "Terminal exec output captured via commands.run onStdout/onStderr, scrubbed (literal known values) then redacted (shape patterns) AT THE SOURCE before persisting; no screenshots on this lane."
+        },
+        startedAt: args.createdAt,
+        completedAt: args.completedAt,
+        durationMs: args.durationMs,
+        status: args.status,
+        completionReason: args.completionReason,
+        reason: args.reason,
+        ids: { model: "codex" },
+        counts: {
+            commands: args.commandLog.length,
+            // actions == executed commands; messages == 1 when the agent produced any output. The
+            // no-engagement guard (run.ts) reads these: a real run bumps them, a no-op is caught.
+            actions: args.commandLog.length,
+            messages: args.terminalEvents.length > 0 ? 1 : 0,
+            terminalEvents: args.terminalEvents.length
+        },
+        items,
+        capabilities: TERMINAL_AGENT_CAPABILITIES
+    };
+}
+/**
+ * Project the terminal-product lab run into a humanish.run-bundle.v1 (no schema change — a new
+ * producer only). DRY-RUN: a contract bundle. The terminal stream is a contract placeholder
+ * (stdin disabled, no captured tail — honest: nothing ran), the subject is declared UNPINNED, and
+ * the caps/policies/runtime-auth declarations + empty ledgers are recorded so SLICE 2 has a stable
+ * shape to fill. Exported for the bundle-builder tests.
+ */
+export function buildTerminalProductBundle(args) {
+    const reason = "Contract bundle only: dry-run declared the terminal-product study contract without creating an E2B sandbox, injecting any key, or spending. The live in-sandbox agent session is SLICE 2.";
+    const simulation = {
+        id: "sim-001",
+        index: 1,
+        personaId: args.persona.id,
+        scenarioId: `terminal-${args.labId}`,
+        status: "contract_proof_only",
+        streamKind: "terminal",
+        mode: "cli-sim",
+        progress: 100,
+        currentStep: reason,
+        summary: `Contract lane for the terminal agent (${args.actorId}) studying ${args.productName} from public surfaces.`,
+        streamIds: ["stream-001"],
+        startedAt: args.createdAt,
+        updatedAt: args.createdAt
+    };
+    // The terminal stream is a CONTRACT PLACEHOLDER on the dry-run path: stdin is disabled and no
+    // exec output was captured, so the tail is empty and transport stays "snapshot" — NOT "pty"
+    // (captured non-interactive exec output is never an interactive PTY; invariant 6 + the PTY
+    // ruling). SLICE 2 fills terminal.tail from the redacted exec-stream capture.
+    const stream = {
+        id: "stream-001",
+        simId: "sim-001",
+        kind: "terminal",
+        label: `Terminal agent — ${args.labId}`,
+        status: "contract_proof_only",
+        transport: "snapshot",
+        updatedAt: args.createdAt,
+        embed: { kind: "placeholder", title: `Terminal agent (${args.productName})` },
+        terminal: {
+            title: `${args.actorId} exec (stdin ${args.stdin})`,
+            format: "plain",
+            stdin: args.stdin,
+            tail: ""
+        },
+        ui: {
+            intent: `Watch the terminal agent discover and use ${args.productName} from its public surfaces.`,
+            state: reason
+        },
+        artifacts: [
+            { label: "run bundle", path: "run.json", kind: "bundle" },
+            { label: "review", path: "review.md", kind: "review" },
+            { label: "events", path: "events.ndjson", kind: "events" }
+        ]
+    };
+    const capsText = describeCaps(args.caps);
+    const events = [
+        {
+            id: "event-000-created",
+            at: args.createdAt,
+            level: "info",
+            type: "terminal-lab.run.created",
+            message: `Created terminal-product lab run for ${args.labId} (actor ${args.actorId}, product ${args.productName}).`
+        },
+        {
+            id: "event-001-subject",
+            at: args.createdAt,
+            level: "info",
+            type: "terminal-lab.subject.declared",
+            // Invariant 5: provenance recorded or its absence DECLARED. The agent drives PUBLIC surfaces,
+            // not a clone, so the subject provenance is explicitly UNPINNED; evidence binds to the
+            // composed-prompt digest. Public surfaces are recorded (they are public by declaration).
+            message: `Subject product declared: ${args.productName}; public surfaces: ${args.publicSurfaces.join(", ")}. The lab did not provision/clone the product — subject provenance is UNPINNED (a public-surface study cannot be commit-pinned); evidence binds to the composed-prompt digest ${args.persona.promptDigest}.`,
+            simId: "sim-001",
+            streamId: "stream-001"
+        },
+        {
+            id: "event-002-credentials",
+            at: args.createdAt,
+            level: "info",
+            type: "terminal-lab.credentials.declared",
+            // Names-only evidence (invariant 1): the runtime-auth CHANNEL is declared; no value is ever
+            // recorded. The deny-by-default policies are recorded so the credential posture is auditable.
+            message: `Runtime auth channel: ${args.runtimeAuth ?? "none declared"} (names only; values never persist; command-scoped injection is SLICE 2). Credential policies (deny-by-default): allowPrivateRepoAccess=${args.policies.allowPrivateRepoAccess}, allowProviderCredentials=${args.policies.allowProviderCredentials}, allowPaymentCredentials=${args.policies.allowPaymentCredentials}, allowGitHubMutation=${args.policies.allowGitHubMutation}.`,
+            simId: "sim-001",
+            streamId: "stream-001"
+        },
+        {
+            id: "event-003-caps",
+            at: args.createdAt,
+            level: "info",
+            type: "terminal-lab.caps.declared",
+            message: `Spend/job/time caps: ${capsText}. The live key is never exercised without a fail-closed cap in force (SLICE 2); the no-spend proof is derived from a real ledger (SLICE 3).`,
+            simId: "sim-001",
+            streamId: "stream-001"
+        },
+        {
+            id: "event-004-contract",
+            at: args.createdAt,
+            level: "info",
+            type: "terminal-lab.contract.ready",
+            message: "Dry-run contract bundle ready; the live in-sandbox agent session, the captured exec stream, and the credential boundary are SLICE 2. Switch scenario.mode to live once SLICE 2 lands.",
+            simId: "sim-001",
+            streamId: "stream-001"
+        }
+    ];
+    const review = {
+        schema: REVIEW_SCHEMA,
+        verdict: "contract_proof_only",
+        summary: reason,
+        gaps: [
+            "Live in-sandbox agent session not yet run (dry-run contract only; SLICE 2).",
+            "Captured exec-stream / transcript / substrate / cost / cleanup ledgers are placeholders this slice (SLICE 2/3 fill them)."
+        ]
+    };
+    return {
+        schema: RUN_BUNDLE_SCHEMA,
+        runId: args.runId,
+        mode: args.dryRun ? "dry-run" : "live",
+        simCount: 1,
+        createdAt: args.createdAt,
+        cwd: PUBLIC_TARGET_CWD,
+        artifactRoot: path.join(".humanish", "runs", args.runId),
+        source: args.source,
+        persona: {
+            id: args.persona.id,
+            name: `Autonomous terminal agent (${args.persona.id})`,
+            source: `lab:${args.labId}`,
+            sourceDigest: args.persona.promptDigest
+        },
+        scenario: {
+            id: `terminal-${args.labId}`,
+            title: args.labTitle ?? `Terminal-product lab: ${args.labId}`,
+            // The author mission is public-safe committed lab text — recorded plaintext as the goal,
+            // redacted defensively before persisting (it never carries a secret, but the harness never
+            // trusts that). The full composed prompt is bound by digest, not text.
+            goal: redactText(args.mission),
+            source: `lab:${args.labId}`,
+            sourceDigest: args.persona.promptDigest
+        },
+        lifecycle: [
+            {
+                at: args.createdAt,
+                event: "terminal-lab.run.created",
+                message: `Created terminal-product lab run with one in-sandbox agent lane (actor ${args.actorId}, product ${args.productName}).`
+            }
+        ],
+        simulations: [simulation],
+        streams: [stream],
+        events,
+        redaction: {
+            status: "passed",
+            notes: "Dry-run contract bundle: no sandbox ran, no key was injected, no exec output was captured. The author mission is public-safe committed lab text (redacted defensively); the composed prompt is bound by digest. Live capture (scrubKnownValues then redactText, at the source) is SLICE 2."
+        },
+        artifacts: {
+            run: "run.json",
+            reviewJson: "review.json",
+            reviewMarkdown: "review.md",
+            observerData: "observer/observer-data.json",
+            events: "events.ndjson"
+        },
+        review,
+        feedbackCandidates: []
+    };
+}
+/**
+ * Build the LIVE terminal-product run bundle (mode "live") from the captured session: the actor
+ * trace seam (stream.actor = trace), the substrate-lifecycle events, the terminal stream with the
+ * redacted transcript tail, and references to the written evidence artifacts (terminal event
+ * stream, transcript, ledgers, actor trace). verifyRun's terminal-product check (gated on
+ * mode==="live") enforces the ledgers + proven cleanup + interventions-present over this bundle.
+ */
+export function buildLiveTerminalProductBundle(args) {
+    const simStatus = args.trace.status === "passed"
+        ? "passed"
+        : args.trace.status === "blocked"
+            ? "blocked"
+            : args.trace.status === "timed_out"
+                ? "timed_out"
+                : "failed";
+    const messageItem = args.trace.items.find((item) => item.kind === "message");
+    const tail = (messageItem?.text ?? args.trace.reason).slice(0, 2000);
+    const simulation = {
+        id: "sim-001",
+        index: 1,
+        personaId: args.persona.id,
+        scenarioId: `terminal-${args.labId}`,
+        status: simStatus,
+        streamKind: "terminal",
+        mode: "cli-sim",
+        progress: 100,
+        currentStep: args.sessionReason,
+        summary: `Terminal agent (${args.actorId}) studied ${args.productName} from public surfaces (${args.trace.status}).`,
+        streamIds: ["stream-001"],
+        startedAt: args.createdAt,
+        updatedAt: args.trace.completedAt
+    };
+    // transport "snapshot": the persisted tail is a redacted snapshot of the captured exec output,
+    // NOT an interactive PTY (stdin disabled). The actor trace seam carries the structured evidence.
+    const stream = {
+        id: "stream-001",
+        simId: "sim-001",
+        kind: "terminal",
+        label: `Terminal agent — ${args.labId}`,
+        status: simStatus,
+        transport: "snapshot",
+        updatedAt: args.trace.completedAt,
+        embed: { kind: "placeholder", title: `Terminal agent (${args.productName})` },
+        terminal: {
+            title: `${args.actorId} exec (stdin disabled)`,
+            format: "plain",
+            stdin: "disabled",
+            tail
+        },
+        ui: {
+            intent: `Watch the terminal agent discover and use ${args.productName} from its public surfaces.`,
+            state: args.sessionReason
+        },
+        actor: args.trace,
+        artifacts: [
+            { label: "run bundle", path: "run.json", kind: "bundle" },
+            { label: "review", path: "review.md", kind: "review" },
+            { label: "event log", path: "events.ndjson", kind: "events" },
+            { label: "actor trace", path: "actor.json", kind: "trace" },
+            { label: "terminal event stream", path: TERMINAL_EVENTS_ARTIFACT, kind: "log" },
+            { label: "terminal transcript", path: TERMINAL_TRANSCRIPT_ARTIFACT, kind: "log" },
+            { label: "terminal ledgers", path: TERMINAL_LEDGERS_ARTIFACT, kind: "log" }
+        ]
+    };
+    // Substrate-lifecycle ledger -> bundle events (each already sanitized when recorded).
+    const lifecycleEvents = args.ledgers.lifecycle.map((record, index) => ({
+        id: `event-${String(index).padStart(3, "0")}-${record.event}`,
+        at: record.at,
+        level: record.event.includes("error") || record.event.includes("timed_out") || record.event.includes("exceeded") ? "warn" : "info",
+        type: record.event,
+        message: record.message,
+        simId: "sim-001",
+        streamId: "stream-001"
+    }));
+    // Surface the no-spend proof as a first-class bundle event so the Observer/review can SHOW it.
+    // It is DERIVED from the cost ledger (never asserted): it lists the known-zero lines it vouches
+    // for AND the unmeasured (null) lines it explicitly cannot vouch for.
+    const noSpend = args.ledgers.noSpendProof;
+    lifecycleEvents.push({
+        id: "event-cost-no-spend-proof",
+        at: args.trace.completedAt,
+        level: noSpend.satisfied ? "info" : "warn",
+        type: "terminal-lab.no-spend.proof",
+        message: noSpend.statement,
+        simId: "sim-001",
+        streamId: "stream-001"
+    });
+    const verdict = args.trace.status === "passed"
+        ? "pass"
+        : args.trace.status === "blocked"
+            ? "blocked"
+            : args.trace.status === "timed_out"
+                ? "timed_out"
+                : "fail";
+    const review = {
+        schema: REVIEW_SCHEMA,
+        verdict,
+        summary: args.sessionReason,
+        gaps: [
+            ...(args.trace.status === "passed" ? [] : [`Agent session ended ${args.trace.status}: ${args.sessionReason}`]),
+            // Honesty gap: the no-spend proof always declares which spend lines it could NOT measure, so a
+            // green run never silently over-claims a fully-proven $0.
+            ...(noSpend.unmeasuredLines.length > 0
+                ? [`No-spend proof is partial: ${noSpend.unmeasuredLines.join(", ")} spend was UNMEASURED this slice (recorded null, not claimed zero; the SLICE-4 adapter supplies these signals).`]
+                : [])
+        ]
+    };
+    return {
+        schema: RUN_BUNDLE_SCHEMA,
+        runId: args.runId,
+        mode: "live",
+        simCount: 1,
+        createdAt: args.createdAt,
+        cwd: PUBLIC_TARGET_CWD,
+        artifactRoot: path.join(".humanish", "runs", args.runId),
+        source: args.source,
+        persona: {
+            id: args.persona.id,
+            name: `Autonomous terminal agent (${args.persona.id})`,
+            source: `lab:${args.labId}`,
+            sourceDigest: args.persona.promptDigest
+        },
+        scenario: {
+            id: `terminal-${args.labId}`,
+            title: args.labTitle ?? `Terminal-product lab: ${args.labId}`,
+            goal: redactText(args.mission),
+            source: `lab:${args.labId}`,
+            sourceDigest: args.persona.promptDigest
+        },
+        lifecycle: args.ledgers.lifecycle.map((record) => ({ at: record.at, event: record.event, message: record.message })),
+        simulations: [simulation],
+        streams: [stream],
+        events: lifecycleEvents,
+        redaction: {
+            status: "passed",
+            notes: `Live terminal-product run: the in-sandbox agent's output was captured via commands.run onStdout/onStderr and scrubbed (literal known values incl. the runtime key) THEN redacted (shape patterns) AT THE SOURCE before persisting. The runtime key (${args.runtimeAuthKeyName}) was injected ONLY into the command-scoped codex invocation, never sandbox-global env or metadata; only its NAME appears in evidence. Subject provenance is UNPINNED (public-surface study).`
+        },
+        artifacts: {
+            run: "run.json",
+            reviewJson: "review.json",
+            reviewMarkdown: "review.md",
+            observerData: "observer/observer-data.json",
+            events: "events.ndjson"
+        },
+        review,
+        feedbackCandidates: []
+    };
+}
+function describeCaps(caps) {
+    if (!caps)
+        return "none declared (a live run REQUIRES caps in SLICE 2)";
+    const parts = [];
+    if (caps.maxUsd !== undefined)
+        parts.push(`maxUsd=${caps.maxUsd}`);
+    if (caps.maxJobs !== undefined)
+        parts.push(`maxJobs=${caps.maxJobs}`);
+    if (caps.maxMinutes !== undefined)
+        parts.push(`maxMinutes=${caps.maxMinutes}`);
+    return parts.length > 0 ? parts.join(", ") : "empty";
+}
+/** The default mission when the lab omits one. Public-safe, product-neutral author text. */
+function defaultMission(productName) {
+    return `You are an autonomous agent. Discover ${productName} from its public surfaces and determine whether it can help with a durable real task. Stay within the declared no-spend caps. Leave feedback if the workflow is confusing.`;
+}
+/** Compose the full prompt the agent would run. Bound to evidence by DIGEST only. */
+function composePrompt(args) {
+    return [
+        `persona: ${args.personaId}`,
+        `product: ${args.productName}`,
+        `public-surfaces: ${args.publicSurfaces.join(" ")}`,
+        `mission: ${args.mission}`
+    ].join("\n");
+}
+function renderTerminalReviewMarkdown(bundle) {
+    const subject = bundle.events.find((event) => event.type === "terminal-lab.subject.declared");
+    const credentials = bundle.events.find((event) => event.type === "terminal-lab.credentials.declared");
+    const caps = bundle.events.find((event) => event.type === "terminal-lab.caps.declared");
+    return [
+        `# ${bundle.scenario.title}`,
+        "",
+        `- run: ${bundle.runId}`,
+        `- mode: ${bundle.mode}`,
+        `- verdict: ${bundle.review.verdict}`,
+        `- summary: ${bundle.review.summary}`,
+        `- mission: ${bundle.scenario.goal}`,
+        ...(subject ? [`- subject: ${subject.message}`] : []),
+        ...(credentials ? [`- credentials: ${credentials.message}`] : []),
+        ...(caps ? [`- caps: ${caps.message}`] : []),
+        ...(bundle.review.gaps.length > 0 ? ["", "## Gaps", ...bundle.review.gaps.map((gap) => `- ${gap}`)] : []),
+        ""
+    ].join("\n");
+}
+function makeTerminalRunId() {
+    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    return `terminal-${stamp}-${randomBytes(4).toString("hex")}`;
+}
+//# sourceMappingURL=e2b-terminal-lab.js.map