humanish 0.106.1 → 0.108.0

package/dist/routes/terminal/result.js

@@ -1,5 +1,6 @@
 import { OUTCOME_POLICIES, participantHarnessFailed, resultOk, } from "../../run/judge.js";
-import { TERMINAL_PRODUCT_LAB_SCHEMA, } from "./types.js";
+import {} from "./types.js";
+import { studyResultIdentity } from "../../run/study-result.js";
 /**
  * What judge.ts reads from a finished terminal session, after a blown cap has overridden it. It has
  * no engagement or blocker rule: the agent's nonce-verified marker is its declared outcome.
@@ -46,14 +47,14 @@ export function terminalExecutionFailures(args) {
 /** The terminal-product lab result for a live run, from its session, cleanup and cost ledger. */
 export function terminalLabResult(args) {
     const { cwd, labId, actorId, productName, runId, sessionStatus, completionReason, sessionReason, sessionError, sandboxId, cleanup, cost, noSpendProof, capFailure, declaredScorerFailure, judgment, execution, observer, warnings, } = args;
-    // The lab's exit code: verified evidence AND no harness error AND proven cleanup. A blocked/
-    // timed-out agent run is STILL ok-as-evidence at the bundle level (the failure is the evidence),
-    // but the LAB result surfaces ok:false on a harness error or unproven teardown (fail-closed).
+    // The lab's exit code: verified evidence, no harness error and proven cleanup. A blocked/
+    // timed-out agent run is still ok-as-evidence at the bundle level (the failure is the evidence),
+    // but the lab result surfaces ok:false on a harness error or unproven teardown (fail-closed).
     // remaining===0 is the by-id-confirmed-reclaimed state; remaining===1 (still present) and
     // remaining===-1 (kill(id) itself failed) are both unproven by design.
     const cleanupProven = cleanup.killed && cleanup.remaining === 0;
-    // A CONFIG-DECLARED scorer that failed to render a pass (status:"fail" / malformed / throw) fails the
-    // run RESULT too, not just the persisted verdict — the keystone lane's declared rubric is a gate, so
+    // A config-declared scorer that failed to render a pass (status:"fail" / malformed / throw) fails the
+    // run result as well as the persisted verdict: the keystone route's declared rubric is a gate, so
     // its fail must drive exit code. Library callers never set this (additive, back-compat).
     const ok = resultOk({
         judgment,
@@ -62,10 +63,9 @@ export function terminalLabResult(args) {
         policy: OUTCOME_POLICIES.terminal,
     });
     return {
-        schema: TERMINAL_PRODUCT_LAB_SCHEMA,
+        ...studyResultIdentity("terminal", labId),
         ok,
         cwd,
-        labId,
         actor: actorId,
         product: productName,
         dryRun: false,
@@ -97,12 +97,12 @@ export function terminalLabResult(args) {
             : {
                 error: {
                     code: (!cleanupProven
-                        ? "HUMANISH_TERMINAL_LAB_CLEANUP_UNPROVEN"
+                        ? "HUMANISH_TERMINAL_CLEANUP_UNPROVEN"
                         : capFailure !== undefined
-                            ? "HUMANISH_TERMINAL_LAB_CAPS_EXCEEDED"
-                            : "HUMANISH_TERMINAL_LAB_FAILED"),
+                            ? "HUMANISH_TERMINAL_CAPS_EXCEEDED"
+                            : "HUMANISH_TERMINAL_FAILED"),
                     message: !cleanupProven
-                        ? `Live terminal-product run could not prove sandbox teardown (killed=${cleanup.killed}, remaining=${cleanup.remaining}): ${cleanup.reason}. A run that cannot prove teardown fails closed.${sessionError !== undefined ? ` Session failure: ${sessionError}` : ""}`
+                        ? `Live terminal-product run could not prove sandbox teardown (killed=${cleanup.killed}, remaining=${cleanup.remaining}): ${cleanup.reason}. A run that cannot prove its sandbox was removed does not pass.${sessionError !== undefined ? ` Session failure: ${sessionError}` : ""}`
                         : (declaredScorerFailure ??
                             capFailure ??
                             sessionError ??

package/dist/routes/terminal/route.js

@@ -8,39 +8,39 @@
 //      live-sandbox.ts and live-finish.ts); a dry plan publishes its contract bundle (dry-run.ts);
 //   4. automatic analysis of a run that published its final bundle.
 //
-// THE SAFETY CONTRACT (docs/goals/terminal-product-lane/goal.md) is enforced BY CONSTRUCTION in
-// the files each item names, and CHECKED by the verifier (verify/actor.ts
+// The safety contract (`docs/history/goals/terminal-product-lane/goal.md`) is enforced by construction in
+// the files each item names, and checked by the verifier (verify/actor.ts
 // validateTerminalProductEvidence):
-//   1. EXPLICIT KEY PLACEMENT. openai-env (default) injects the raw runtime key command-scoped,
-//      NEVER Sandbox.create({envs}). Opt-in openai-egress sends it only in the host-side E2B
+//   1. Explicit key placement. openai-env (default) injects the raw runtime key command-scoped,
+//      never through Sandbox.create({envs}). Opt-in openai-egress sends it only in the host-side E2B
 //      header transform and passes an inert command placeholder. The proxy is spendable by every
 //      sandbox process from creation; this protects the raw key, not provider spending.
 //      Enforced in credentials.ts and runtime-auth.ts.
-//   2. FAIL-CLOSED CAP. The live key is never exercised without scenario.caps in force: maxUsd
+//   2. Fail-closed cap. The live key is never exercised without scenario.caps in force: maxUsd
 //      (default/require 0 = no-spend) + maxMinutes (wall-clock kill of the codex command).
 //      Enforced in plan.ts (caps required), live-sandbox.ts and lifetime.ts (the wall clock).
-//   3. PUBLIC SURFACES ONLY. The mission references only subject.product.publicSurfaces + the
-//      author mission. No clone, no private-source access — nothing is git-cloned in this lane.
+//   3. Public surfaces only. The mission references only subject.product.publicSurfaces + the
+//      author mission. No clone and no private-source access: nothing is git-cloned on this route.
 //      Enforced in session.ts, which composes the prompt.
-//   4. DENY-BY-DEFAULT CREDENTIALS. The command envs are built from an ALLOWLIST of ONLY the
+//   4. Deny-by-default credentials. The command envs are built from an allowlist holding only the
 //      declared runtime key; GITHUB_TOKEN/GH_TOKEN/payment/deploy/db/media keys are excluded by
 //      construction (a banned-name guard also fails closed if one is ever requested).
 //      Enforced in credentials.ts.
-//   5. NO SECRET VALUES IN EVIDENCE. Every captured byte (event stream, transcript, command logs,
+//   5. No secret values in evidence. Every captured byte (event stream, transcript, command logs,
 //      agent report, metadata) passes scrubKnownValues (literal scrub of the runtime key + any
-//      provisioned values, >=4 chars, PRE-truncation) THEN redactText (shape patterns) BEFORE
-//      persisting. The transport is labeled HONESTLY (exec-stream/snapshot, NOT an interactive pty).
+//      provisioned values, >=4 chars, before truncation), then redactText (shape patterns), before
+//      persisting. The transport is labeled exec-stream/snapshot; there is no interactive pty.
 //      Enforced in recorder.ts, with the scrubber session.ts builds.
-//   6. METADATA POSITIVE ALLOWLIST. buildSandboxMetadata(allowlist) is the ONLY way metadata is
+//   6. Metadata positive allowlist. buildSandboxMetadata(allowlist) is the only way metadata is
 //      set; it carries solely non-secret labels (mode/tool/labId/simId/provider/runId).
 //      Enforced in credentials.ts.
-//   7. STDIN DISABLED + INTERVENTIONS LEDGER. stdin is never wired to the codex command; the
-//      bundle ALWAYS carries an interventions ledger (empty array is valid + required-present).
+//   7. Stdin disabled + interventions ledger. stdin is never wired to the codex command; the
+//      bundle always carries an interventions ledger (empty array is valid + required-present).
 //      Enforced in live-sandbox.ts (stdin) and recorder.ts (the ledger).
-//   8. PROVEN CLEANUP, BY ID, NEVER ACCOUNT-WIDE. Sandbox.kill(id) in a finally; the cleanup
-//      proof is BY EXACT ID: kill(id)'s own found-and-killed boolean, confirmed further by
+//   8. Proven cleanup, by id, never account-wide. Sandbox.kill(id) in a finally; the cleanup
+//      proof is by exact id: kill(id)'s own found-and-killed boolean, confirmed further by
 //      Sandbox.getInfo(id) when the SDK exposes it (a thrown SandboxNotFoundError means gone).
-//      humanish NEVER calls Sandbox.list to prove cleanup, so a shared operator key never reaches a
+//      humanish never calls Sandbox.list to prove cleanup, so a shared operator key never reaches a
 //      sandbox it did not create. A live run that cannot prove teardown fails closed.
 //      Enforced in sandbox.ts.
 import { resolveAutomaticAnalysis } from "../../analysis/automatic-config.js";
@@ -50,18 +50,19 @@ import { runScope } from "../../run/run.js";
 import { planTerminalLab } from "./plan.js";
 import { runDryTerminalLab } from "./dry-run.js";
 import { checkLiveTerminalMachine, runLiveTerminalSession } from "./session.js";
-import { terminalInputWithScorer } from "../../lab/route-inputs.js";
-import { TERMINAL_PRODUCT_LAB_SCHEMA, } from "./types.js";
+import { terminalRouteScorer } from "../../lab/adapter-scorer-loader.js";
+import { withLateScorer } from "../../lab/route-inputs.js";
+import {} from "./types.js";
+import { studyResultIdentity } from "../../run/study-result.js";
 /**
  * The config-taking entry point. It plans, returns a refusal with the same envelope and analysis
  * record the route has always returned, and otherwise runs the plan.
  */
 export async function runTerminalProductLab(options) {
-    const { config, dryRun, lab, ...input } = options;
+    const { config, dryRun, ...input } = options;
     const planned = planTerminalLab(config, {
         dryRun,
-        ...(lab === undefined ? {} : { lab }),
-        ...(input.hooks === undefined ? {} : { hooks: input.hooks }),
+        hasCostProbe: input.deps?.costProbe !== undefined,
     });
     if (planned.ok)
         return runTerminalPlan(planned.plan, input);
@@ -71,10 +72,9 @@ export async function runTerminalProductLab(options) {
 export function terminalLabRefusal(options, refusal) {
     const { config, dryRun } = options;
     const refused = {
-        schema: TERMINAL_PRODUCT_LAB_SCHEMA,
+        ...studyResultIdentity("terminal", config.id),
         ok: false,
         cwd: path.resolve(options.cwd),
-        labId: config.id,
         actor: refusal.actor ?? config.actors[0]?.type ?? "",
         product: config.subject.product?.name ?? "",
         dryRun,
@@ -84,7 +84,7 @@ export function terminalLabRefusal(options, refusal) {
     };
     // A refusal starts no run, so a declared or default analysis is recorded as skipped.
     const analysis = resolveAutomaticAnalysis(config.review?.analysis);
-    return completeAutomaticAnalysis(refused, undefined, analysis.ok ? analysis.config : undefined, options.automaticAnalysis, { trigger: config.review?.analysis === undefined ? "default" : "explicit" });
+    return completeAutomaticAnalysis(refused, undefined, analysis.ok ? analysis.config : undefined, options, { trigger: config.review?.analysis === undefined ? "default" : "explicit" });
 }
 /**
  * Run a terminal plan. The run scope gives a direct library caller the same run lifetime the CLI
@@ -106,11 +106,11 @@ export async function admitTerminalPlan(plan, input) {
         return { ok: false, outcome: terminalOutcome(admission.result) };
     return {
         ok: true,
-        run: async (scorer) => terminalOutcome(await runAdmittedTerminalRun(admission.admitted, terminalInputWithScorer(input, scorer))),
+        run: async (scorer) => terminalOutcome(await runAdmittedTerminalRun(admission.admitted, withLateScorer(input, scorer, terminalRouteScorer))),
     };
 }
 function terminalOutcome(result) {
-    return { route: "terminal", backend: "terminal", result };
+    return { route: "terminal", result };
 }
 /**
  * A live plan's local checks, made outside any run scope. A refusal is the result runTerminalPlan
@@ -132,7 +132,7 @@ async function runAdmittedTerminalRun(admitted, input) {
     return completeTerminalAnalysis(admitted.plan, input, result, finished);
 }
 function completeTerminalAnalysis(plan, input, result, finished) {
-    return completeAutomaticAnalysis(result, finished, plan.analysis?.config, input.automaticAnalysis, {
+    return completeAutomaticAnalysis(result, finished, plan.analysis?.config, input, {
         ...(plan.analysis === undefined ? {} : { trigger: plan.analysis.trigger }),
         preferLargerOutput: plan.analysis?.preferLargerOutput === true,
     });
@@ -141,10 +141,9 @@ function completeTerminalAnalysis(plan, input, result, finished) {
 function terminalFailure(plan, input, warnings) {
     const cwd = path.resolve(input.cwd);
     return (code, message) => ({
-        schema: TERMINAL_PRODUCT_LAB_SCHEMA,
+        ...studyResultIdentity("terminal", plan.labId),
         ok: false,
         cwd,
-        labId: plan.labId,
         actor: plan.actor,
         product: plan.product.name,
         dryRun: plan.dryRun,
@@ -157,7 +156,7 @@ async function runTerminalPlanInScope(admitted, input, scope) {
     const cwd = path.resolve(input.cwd);
     const { warnings } = admitted;
     const failed = terminalFailure(admitted.plan, input, warnings);
-    // LIVE path: the real in-sandbox agent session. A separate orchestrator owns the
+    // Live path: the real in-sandbox agent session. A separate orchestrator owns the
     // create -> inject (command-scoped) -> run -> capture -> teardown lifecycle so the dry-run path
     // below stays a pure contract builder. It enforces the safety contract by construction (the
     // keyPlacement-routed command-scoped key, the deny-by-default allowlist, the fail-closed cap,

package/dist/routes/terminal/runtime.d.ts

@@ -6,9 +6,10 @@ export declare function isExactRuntimeVersion(value: unknown): value is string;
 /** Captured Codex CLI output: `codex-cli 0.153.3\n`. Other shapes fail closed. */
 export declare function parseTerminalRuntimeVersion(stdout: string): string | undefined;
 export declare function buildRuntimeVersionCommand(requestedVersion?: string): string;
-export declare function buildRuntimeExecPrefix(version: string, model?: string, reasoningEffort?: ReasoningEffort): string;
+export declare function buildRuntimeExecPrefix(version: string, model: string, reasoningEffort?: ReasoningEffort): string;
 export declare function declaredRuntimeProvenance(args: {
     version?: string;
-    model?: string;
+    model: string;
+    modelSource: "declared" | "humanish_default";
     reasoningEffort?: ReasoningEffort;
 }): ActorRuntimeProvenance;

package/dist/routes/terminal/runtime.js

@@ -26,7 +26,7 @@ export function buildRuntimeExecPrefix(version, model, reasoningEffort) {
     if (!isExactRuntimeVersion(version))
         throw new Error("Codex execution requires a verified exact runtime version.");
     return (`npm_config_update_notifier=false npx -y ${TERMINAL_RUNTIME_PACKAGE}@${version} exec` +
-        (model === undefined ? "" : ` --model ${shellQuote(model)}`) +
+        ` --model ${shellQuote(model)}` +
         (reasoningEffort === undefined
             ? ""
             : ` -c ${shellQuote(`model_reasoning_effort=${JSON.stringify(reasoningEffort)}`)}`));
@@ -37,8 +37,8 @@ export function declaredRuntimeProvenance(args) {
         package: TERMINAL_RUNTIME_PACKAGE,
         requestedVersion: args.version ?? "latest",
         versionStatus: "unobserved",
-        ...(args.model === undefined ? {} : { requestedModel: args.model }),
-        modelStatus: args.model === undefined ? "runtime_default_unobserved" : "declared",
+        requestedModel: args.model,
+        modelStatus: args.modelSource,
         ...(args.reasoningEffort === undefined
             ? {}
             : { requestedReasoningEffort: args.reasoningEffort }),

package/dist/routes/terminal/sandbox.d.ts

@@ -2,13 +2,13 @@ import type { OwnedDesktopAllocation } from "../../substrates/desktop-session.js
 import { E2BDesktopStartupError, type E2BDesktopModule } from "../../substrates/e2b/sdk.js";
 import type { TerminalLedgers } from "./types.js";
 /**
- * Tear the sandbox down and PROVE it BY EXACT ID -- NEVER Sandbox.list (humanish must never
+ * Tear the sandbox down and prove it by exact id, never by Sandbox.list (humanish must never
  * enumerate the operator's E2B account; see docs/principles/invariants-and-defaults.md). The
  * allocation's release (src/substrates/e2b/sandbox.ts) kills the exact id and reads the answer the
  * same way every route does: true is terminated, false or a not-found error is already gone. That
- * is the PRIMARY proof. Where the SDK exposes Sandbox.getInfo(id), a thrown SandboxNotFoundError is
+ * is the primary proof. Where the SDK exposes Sandbox.getInfo(id), a thrown SandboxNotFoundError is
  * a second by-id confirmation that the exact sandbox is gone; a returned SandboxInfo with a live
- * state means teardown is NOT confirmed. Never throws -- teardown failure is recorded, the caller
+ * state means teardown is unconfirmed. Never throws: teardown failure is recorded, and the caller
  * fails closed on an unproven teardown.
  */
 export declare function teardownSandbox(args: {
@@ -25,7 +25,7 @@ export declare function teardownSandbox(args: {
     warnings: string[];
 }): Promise<TerminalLedgers["cleanup"]>;
 /**
- * Race a commands.run promise against the maxMinutes wall-clock (safety contract item 2). The E2B
+ * Race a commands.run promise against the maxMinutes wall-clock. The E2B
  * commands.run timeoutMs is the primary kill; this injected-clock guard is the belt-and-suspenders
  * backstop so a mock CLI (which ignores timeoutMs) is still bounded and fails closed in CI.
  */

package/dist/routes/terminal/sandbox.js

@@ -2,20 +2,20 @@ import { toErrorMessage } from "../../evidence/redaction.js";
 import { E2BDesktopStartupError, isSandboxNotFoundError, } from "../../substrates/e2b/sdk.js";
 import { releaseUnavailableDetail } from "../../substrates/e2b/sandbox.js";
 /**
- * Tear the sandbox down and PROVE it BY EXACT ID -- NEVER Sandbox.list (humanish must never
+ * Tear the sandbox down and prove it by exact id, never by Sandbox.list (humanish must never
  * enumerate the operator's E2B account; see docs/principles/invariants-and-defaults.md). The
  * allocation's release (src/substrates/e2b/sandbox.ts) kills the exact id and reads the answer the
  * same way every route does: true is terminated, false or a not-found error is already gone. That
- * is the PRIMARY proof. Where the SDK exposes Sandbox.getInfo(id), a thrown SandboxNotFoundError is
+ * is the primary proof. Where the SDK exposes Sandbox.getInfo(id), a thrown SandboxNotFoundError is
  * a second by-id confirmation that the exact sandbox is gone; a returned SandboxInfo with a live
- * state means teardown is NOT confirmed. Never throws -- teardown failure is recorded, the caller
+ * state means teardown is unconfirmed. Never throws: teardown failure is recorded, and the caller
  * fails closed on an unproven teardown.
  */
 export async function teardownSandbox(args) {
     const { allocation, sandboxModule, startupCleanup, startupCleanupDetail, requestTimeoutMs, sanitize, recordLifecycle, warnings, } = args;
     if (allocation === undefined || !sandboxModule) {
-        // create() can reject AFTER its constructor acquired a handle. The default loader retains
-        // that authority and reclaims it before rejecting; the lane itself never receives its ID.
+        // create() can reject after its constructor acquired a handle. The default loader retains
+        // that authority and reclaims it before rejecting; the route itself never receives its ID.
         if (startupCleanup === "killed" || startupCleanup === "already_gone") {
             const reason = `desktop startup guard confirmed its acquired sandbox ${startupCleanup === "killed" ? "was killed" : "was already gone"}`;
             recordLifecycle("terminal-lab.cleanup.killed", reason);
@@ -49,12 +49,12 @@ export async function teardownSandbox(args) {
         recordLifecycle("terminal-lab.cleanup.unconfirmed", `Sandbox ${sandboxId} ${reason}.`);
         return { killed: false, remaining: -1, reason };
     }
-    // BY-ID verification only, from here down: NEVER Sandbox.list. A released result is itself proof
+    // By-id verification only, from here down: never Sandbox.list. A released result is itself proof
     // the exact sandbox is gone: terminated when kill(id) found and killed it, already gone when
     // kill(id) answered false or threw not-found (a 404, e.g. the server-side kill-on-timeout raced
     // ahead). Both mean "this id is no longer running." Sandbox.getInfo(id), when the SDK exposes
     // it, adds a second by-id confirmation; the only thing that overturns the release proof is
-    // getInfo returning a LIVE sandbox for this exact id.
+    // getInfo returning a live sandbox for this exact id.
     const killNote = released.reason === "terminated"
         ? "kill(id) returned true (found and killed)"
         : "kill(id) found the exact sandbox already gone (404)";
@@ -85,8 +85,8 @@ export async function teardownSandbox(args) {
                 reason: `reclaimed by id; getInfo(id) confirms the exact sandbox no longer exists (SandboxNotFoundError)`,
             };
         }
-        // getInfo(id) failed for a reason OTHER than "not found" (e.g. a transient network error):
-        // no second by-id confirmation is available, so the RESOLVED kill(id) call stands as the proof
+        // getInfo(id) failed for a reason other than "not found" (e.g. a transient network error):
+        // no second by-id confirmation is available, so the resolved kill(id) call stands as the proof
         // of absence. Never fall back to Sandbox.list.
         const sanitizedError = sanitize(toErrorMessage(error));
         recordLifecycle("terminal-lab.cleanup.killed", `Sandbox ${sandboxId} reclaimed: ${killNote}; getInfo(id) re-verification errored (${sanitizedError}), so kill(id)'s resolved result is the proof.`);
@@ -98,7 +98,7 @@ export async function teardownSandbox(args) {
     }
 }
 /**
- * Race a commands.run promise against the maxMinutes wall-clock (safety contract item 2). The E2B
+ * Race a commands.run promise against the maxMinutes wall-clock. The E2B
  * commands.run timeoutMs is the primary kill; this injected-clock guard is the belt-and-suspenders
  * backstop so a mock CLI (which ignores timeoutMs) is still bounded and fails closed in CI.
  */

package/dist/routes/terminal/session.js

@@ -1,4 +1,5 @@
 import { randomBytes, randomUUID } from "node:crypto";
+import { missingKeys } from "../../lab/requirements.js";
 import { declaredRuntimeProvenance } from "./runtime.js";
 import { digestText, redactText, scrubLiterals } from "../../evidence/redaction.js";
 import { describeMissingKeys } from "../../keys/key-resolution.js";
@@ -15,21 +16,22 @@ import { finishLiveTerminalSession } from "./live-finish.js";
  * a declared scorer. Returns the runtime key's command-scoped placement, or the refusal.
  */
 export function checkLiveTerminalMachine(plan, input, warnings) {
-    const env = input.hooks?.env ?? process.env;
+    const env = input.env ?? process.env;
     const { maxUsd } = plan.caps;
     // planTerminalLab refuses a positive maxUsd without a costProbe, so one is present here.
     if (maxUsd > 0) {
         warnings.push(`scenario.caps.maxUsd=${maxUsd} is checked after the session against the lines the costProbe measures; lines it leaves null (unmeasured) never trip it. scenario.caps.maxMinutes bounds the run while it runs.`);
     }
-    // --- Safety contract item 4: deny-by-default credentials; build the command-scoped allowlist. ---
+    // --- Deny-by-default credentials: build the command-scoped allowlist. ---
     const runtimeEnv = buildRuntimeAuth({ runtimeAuth: plan.runtime.auth, env });
     if (!runtimeEnv.ok)
         return runtimeEnv;
     // The sandbox is created with E2B_API_KEY, so a missing key is refused before the run starts.
-    if (!env.E2B_API_KEY?.trim()) {
+    // The runtime key above is the plan's `key-one-of`; E2B_API_KEY is its only `key`.
+    if (missingKeys(plan.requirements, env).length > 0) {
         return {
             ok: false,
-            code: "HUMANISH_TERMINAL_LAB_KEYS_MISSING",
+            code: "HUMANISH_TERMINAL_KEYS_MISSING",
             message: `Live terminal-product labs need E2B_API_KEY in the environment (values are never persisted). ${describeMissingKeys(["E2B_API_KEY"], env)}`,
         };
     }
@@ -46,9 +48,9 @@ export async function runLiveTerminalSession(args) {
     const { plan, input, cwd, warnings, failed, scope, runtimeEnv } = args;
     const { actor, product } = plan;
     const { maxUsd, maxMinutes } = plan.caps;
-    const hooks = input.hooks ?? {};
-    const env = hooks.env ?? process.env;
-    const now = hooks.now ?? (() => Date.now());
+    const deps = input.deps ?? {};
+    const env = input.env ?? process.env;
+    const now = deps.now ?? (() => Date.now());
     const nowIso = () => new Date(now()).toISOString();
     const prepared = await prepareLivePrompt({ plan, cwd, runtimeEnv, env, warnings });
     const { mission, physicalCwd, persona, composedPrompt, verdictNonce } = prepared;
@@ -61,7 +63,7 @@ export async function runLiveTerminalSession(args) {
         mode: "live",
         lab: plan.lab,
         renderReview: renderTerminalReviewMarkdown,
-        observer: { open: input.open === true, render: hooks.renderObserverFn },
+        observer: { open: input.open === true, render: deps.renderObserver },
         now,
     });
     if (!started.ok)
@@ -77,17 +79,18 @@ export async function runLiveTerminalSession(args) {
     const e2bApiKey = env.E2B_API_KEY?.trim() ?? "";
     // The ledgers + capture buffers, mutated through the live lifecycle.
     const recorder = createTerminalRecorder({ nowIso, sanitize, knownSecretValues });
-    const { version, model, reasoningEffort } = plan.runtime;
+    const { version, model, modelSource, reasoningEffort } = plan.runtime;
     const runtime = declaredRuntimeProvenance({
         ...(version === undefined ? {} : { version }),
-        ...(model === undefined ? {} : { model: sanitize(model) }),
+        model: sanitize(model),
+        modelSource,
         ...(reasoningEffort === undefined ? {} : { reasoningEffort }),
     });
-    recorder.recordLifecycle("terminal-lab.run.created", `Created live terminal-product run ${runId} (actor ${actor}, product ${product.name}). Caps: maxUsd=${maxUsd}, maxMinutes=${maxMinutes}. Subject provenance UNPINNED (public surfaces only).`);
+    recorder.recordLifecycle("terminal-lab.run.created", `Created live terminal-product run ${runId} (actor ${actor}, product ${product.name}). Caps: maxUsd=${maxUsd}, maxMinutes=${maxMinutes}. Subject provenance: unpinned (public pages only).`);
     const session = new LiveTerminalSandbox({
         plan,
         cwd,
-        hooks,
+        deps,
         now,
         nowIso,
         sanitize,
@@ -98,7 +101,7 @@ export async function runLiveTerminalSession(args) {
         maxMinutes,
         e2bApiKey,
         runPaths,
-        metadata: buildSandboxMetadata({ labId: plan.labId, simId: "sim-001", runId }),
+        metadata: buildSandboxMetadata({ labId: plan.labId, recordId: "sim-001", runId }),
         warnings,
         recorder,
     });
@@ -122,7 +125,6 @@ export async function runLiveTerminalSession(args) {
         plan,
         input,
         cwd,
-        hooks,
         sanitize,
         nowIso,
         knownSecretValues,
@@ -144,7 +146,7 @@ export async function runLiveTerminalSession(args) {
 async function prepareLivePrompt(args) {
     const { plan, cwd, runtimeEnv, env, warnings } = args;
     const { product } = plan;
-    // Compose the prompt from PUBLIC surfaces + the author mission ONLY (safety contract item 3).
+    // Compose the prompt from public surfaces and the author mission alone.
     // Inject a per-run verdict nonce: the agent echoes HUMANISH_ACTOR_VERDICT=<status>
     // HUMANISH_ACTOR_NONCE=<nonce>; the scorer verifies the nonce so replayed text cannot forge it.
     const mission = plan.mission ?? defaultMission(product.name);
@@ -158,10 +160,10 @@ async function prepareLivePrompt(args) {
         verdictNonce,
     });
     const promptDigest = digestText(composedPrompt);
-    // --- Safety contract item 5: literal-scrub EVERY known value, then pattern-redact, at the source. ---
-    // The runtime key value (+ any other provisioned value) is scrubbed by LITERAL match before
+    // --- Literal-scrub every known value, then pattern-redact, at the source. ---
+    // The runtime key value (+ any other provisioned value) is scrubbed by literal match before
     // anything persists (a key has no detectable "shape" if it is an arbitrary token); redactText is
-    // the second pass for secret-SHAPED content. Applied PRE-truncation so a cut can never split a
+    // the second pass for secret-shaped content. Applied pre-truncation so a cut can never split a
     // value past the scrubber.
     const knownSecretValues = [runtimeEnv.keyValue, env.E2B_API_KEY?.trim() ?? ""].filter((v) => v.length >= 4);
     const scrubKnownValues = scrubLiterals(knownSecretValues);
@@ -177,8 +179,9 @@ async function prepareLivePrompt(args) {
         sanitize,
     };
 }
-/** Compose the live prompt: PUBLIC surfaces + author mission + the verdict-nonce marker contract. */
+/** Compose the live prompt: public surfaces + author mission + the verdict-nonce marker contract. */
 function composeLivePrompt(args) {
+    // prose-check: model prompt (the terminal agent reads this, not a person)
     return [
         args.personaLine,
         `product: ${args.productName}`,

package/dist/routes/terminal/token-usage.d.ts

@@ -3,7 +3,7 @@ import type { ActorTokenUsage } from "../../actors/contract.js";
  * Accumulate runtime-turn usage from a captured `codex exec --json` stream. A Codex turn may
  * include multiple provider requests; these records cannot establish per-request pricing tiers.
  *
- * Returns undefined when the stream carried no usage record at all, which is the honest "no
+ * Returns undefined when the stream carried no usage record at all, which is the "no
  * signal" case and must stay distinguishable from a measured zero. Per-turn records are preserved
  * in `turns` because long-context pricing can only be computed from per-request sizes
  * (src/run/pricing.ts), and totals cannot say which requests crossed a threshold.

package/dist/routes/terminal/token-usage.js

@@ -1,20 +1,19 @@
-// Provider token accounting for the terminal lane (#531).
+// Provider token accounting for the terminal route.
 //
-// THE GAP THIS CLOSES. A live terminal run reported `cost.lines.provider = null` with source
-// "unmeasured", and the no-spend proof then read `satisfied: true` for `maxUsd: 0` on a run that
-// had demonstrably consumed hundreds of thousands of provider tokens. The statement was honest
-// (it listed provider as unmeasured) but it conflated two very different states: having no signal
-// at all, and knowing exactly how many tokens were spent while lacking a rate to price them.
+// Without these counts, a provider line of `null` with source "unmeasured" would let the no-spend
+// proof read `satisfied: true` for `maxUsd: 0` on a run that consumed hundreds of thousands of
+// provider tokens, conflating two different states: having no signal at all, and knowing exactly
+// how many tokens were spent while lacking a rate to price them.
 //
 // The counts were already in the bundle. `codex exec --json` emits one usage record per turn:
 //   {"type":"turn.completed","usage":{"input_tokens":201536,"cached_input_tokens":170558,
 //    "cache_write_input_tokens":30951,"output_tokens":2283,"reasoning_output_tokens":902}}
 //
-// So the lane can record a MEASURED token fact even when it cannot record a priced one. Rates stay
-// out of this module deliberately: pricing lives in src/run/pricing.ts, and the terminal lane has no
-// real model id to price against (it records `model: "codex"`), so the honest output is
+// So the route can record a measured token fact even when it cannot record a priced one. Rates stay
+// out of this module deliberately: pricing lives in src/run/pricing.ts, and the terminal route has no
+// real model id to price against (it records `model: "codex"`), so the output is
 // tokens-known-rate-unknown rather than a guessed dollar figure.
-// Bounded to a single line on purpose. `[^}]*` would run past a TRUNCATED record's missing brace
+// Bounded to a single line on purpose. `[^}]*` would run past a truncated record's missing brace
 // and swallow the next, valid record's body, silently dropping a real turn from the count.
 const USAGE_RE = /"type"\s*:\s*"turn\.completed"\s*,\s*"usage"\s*:\s*(\{[^}\n]*\})/g;
 function num(value) {
@@ -24,7 +23,7 @@ function num(value) {
  * Accumulate runtime-turn usage from a captured `codex exec --json` stream. A Codex turn may
  * include multiple provider requests; these records cannot establish per-request pricing tiers.
  *
- * Returns undefined when the stream carried no usage record at all, which is the honest "no
+ * Returns undefined when the stream carried no usage record at all, which is the "no
  * signal" case and must stay distinguishable from a measured zero. Per-turn records are preserved
  * in `turns` because long-context pricing can only be computed from per-request sizes
  * (src/run/pricing.ts), and totals cannot say which requests crossed a threshold.

package/dist/routes/terminal/trace.d.ts

@@ -1,5 +1,6 @@
 import type { ActorCompletionReason, ActorPersonaRef, ActorRuntimeProvenance, ActorStatus, ActorTokenUsage, ActorTrace } from "../../actors/contract.js";
 import type { LabRuntimeAuth } from "../../lab/types.js";
+import type { TerminalParticipantText } from "./participant-text.js";
 import { type CommandLogRecord, type TerminalEventRecord } from "./types.js";
 /**
  * Per-chunk sanitization cannot recognize a value split across deliveries. Redact those complete
@@ -10,9 +11,9 @@ export declare function scrubSplitKnownValues(events: TerminalEventRecord[], kno
 /** Redacted, ellipsis-prefixed tail of a captured stream/log for a message field. */
 export declare function tailOf(text: string): string;
 /**
- * Project the live terminal session into the provider-neutral humanish.actor-trace.v1 (lane
- * "terminal", protocol "terminal-exec"). counts.actions/messages drive the no-engagement honesty
- * guard (a real run bumps them; a no-op is caught). No screenshots on this lane.
+ * Project the live terminal session into the provider-neutral humanish.actor-trace.v1 (`lane`
+ * "terminal", protocol "terminal-exec"). counts.actions/messages drive the no-engagement
+ * guard (a real run bumps them; a no-op is caught). No screenshots on this route.
  */
 export declare function buildTerminalActorTrace(args: {
     persona: ActorPersonaRef;
@@ -28,13 +29,9 @@ export declare function buildTerminalActorTrace(args: {
     transcriptTail: string;
     runtimeAuth: LabRuntimeAuth;
     runtime: ActorRuntimeProvenance;
-    /** Runtime-turn aggregate usage parsed from the exec stream (#531). Absent when the stream
+    /** Runtime-turn aggregate usage parsed from the exec stream. Absent when the stream
      *  carried no usage record, which stays distinct from a measured zero. */
     tokenUsage?: ActorTokenUsage;
+    /** The agent's own text and activity, read from the raw stdout as it arrived. */
+    participant: TerminalParticipantText;
 }): ActorTrace;
-/** Count distinct participant items in the retained Codex JSON stdout stream.
- * The caller supplies stdout only, after transport reconciliation and redaction.
- * Lifecycle, usage, launcher diagnostics, and nested command output are not activity.
- * Zero means no recognized item was retained, not that the participant succeeded.
- */
-export declare function countTerminalParticipantItems(stdout: string): number;