humanish 0.107.0 → 0.109.0

package/dist/routes/terminal/bundle.js

@@ -1,27 +1,28 @@
 import { redactText } from "../../evidence/redaction.js";
-import { participantAssignment } from "../../lab/participant-assignment.js";
+import { participantAssignment } from "../../study/participant-assignment.js";
 import { REVIEW_SCHEMA, bundleArtifacts, bundleHead, } from "../../run/bundle.js";
+import { verdictText } from "../../run/judge.js";
 import {} from "../../run/streams.js";
 import { participantEvent, participantIds, participantRecord, participantStream, } from "../../run/participant-records.js";
 import { TERMINAL_EVENTS_ARTIFACT, TERMINAL_LEDGERS_ARTIFACT, TERMINAL_TRANSCRIPT_ARTIFACT, } from "../../run/terminal-contract.js";
 import { describeMeasuredSpend, noSpendLineMeasured, noSpendNotEstablished } from "./ledger.js";
 /**
- * Project the terminal-product lab run into a humanish.run-bundle.v1 (no schema change — a new
- * producer only). DRY-RUN: a contract bundle. The terminal stream is a contract placeholder
+ * Project the terminal-product run into a humanish.run-bundle.v1 (no schema change: a new
+ * producer only). Dry run: a contract bundle. The terminal stream is a contract placeholder
  * (stdin disabled, no captured tail, because nothing ran), the subject is declared unpinned, and
  * the caps/policies/runtime-auth declarations are recorded without pretending that live ledgers
  * exist. The shipped live builder fills the same evidence contract. Exported for tests.
  */
 export function buildTerminalProductBundle(args) {
-    const reason = "Contract bundle only: dry-run declared the terminal-product study contract without creating an E2B sandbox, injecting any key, or spending. This run did not execute an agent or prove live behavior.";
+    const reason = "Dry run: the terminal-product study was declared without creating an E2B sandbox, injecting any key, or spending. This run did not execute an agent or prove live behavior.";
     // The terminal stream is a contract placeholder on the dry-run path: stdin is disabled and no
     // exec output was captured, so the tail is empty and transport stays "snapshot", never "pty"
-    // (captured non-interactive exec output is never an interactive PTY; invariant 6 + the PTY
-    // ruling). The shipped live builder fills terminal.tail from redacted exec-stream capture.
+    // (captured non-interactive exec output is never an interactive PTY). The shipped live builder
+    // fills terminal.tail from redacted exec-stream capture.
     const { simulation, stream } = terminalParticipant(args, {
         status: "contract_proof_only",
         reason,
-        summary: `Contract participant for the terminal agent (${args.actorId}) studying ${args.productName} from public surfaces.`,
+        summary: `Dry-run participant for the terminal agent (${args.actorId}) studying ${args.productName} from public surfaces.`,
         updatedAt: args.run.createdAt,
         stdin: args.stdin,
         tail: "",
@@ -38,24 +39,24 @@ export function buildTerminalProductBundle(args) {
             at: args.run.createdAt,
             level: "info",
             type: "terminal-lab.run.created",
-            message: `Created terminal-product lab run for ${args.labId} (actor ${args.actorId}, product ${args.productName}).`,
+            message: `Created a terminal-product run for ${args.studyId} (actor ${args.actorId}, product ${args.productName}).`,
         },
         participantEvent(TERMINAL_IDS, {
             id: "event-001-subject",
             at: args.run.createdAt,
             level: "info",
             type: "terminal-lab.subject.declared",
-            // Invariant 5: provenance recorded or its absence declared. The agent drives public surfaces
+            // Provenance is recorded or its absence declared. The agent drives public surfaces
             // and nothing is cloned, so the subject provenance is explicitly unpinned; evidence binds to the
             // composed-prompt digest. Public surfaces are recorded (they are public by declaration).
-            message: `Subject product declared: ${args.productName}; public surfaces: ${args.publicSurfaces.join(", ")}. The lab did not provision/clone the product — subject provenance is UNPINNED (a public-surface study cannot be commit-pinned); evidence binds to the composed-prompt digest ${args.persona.promptDigest}.`,
+            message: `Subject product declared: ${args.productName}; public surfaces: ${args.publicSurfaces.join(", ")}. humanish did not provision or clone the product, so its provenance is unpinned: a study of public pages has no commit to pin. The evidence is tied to the prompt digest ${args.persona.promptDigest}.`,
         }),
         participantEvent(TERMINAL_IDS, {
             id: "event-002-credentials",
             at: args.run.createdAt,
             level: "info",
             type: "terminal-lab.credentials.declared",
-            // Names-only evidence (invariant 1): the runtime-auth channel is declared; no value is ever
+            // Names-only evidence: the runtime-auth channel is declared; no value is ever
             // recorded. The deny-by-default policies are recorded so the credential posture is auditable.
             message: `Runtime auth channel: ${args.runtimeAuth ?? "none declared"} (names only; values never persist; the live engine applies the selected key placement, while this dry-run performs no injection). Credential policies (deny-by-default): allowPrivateRepoAccess=${args.policies.allowPrivateRepoAccess}, allowProviderCredentials=${args.policies.allowProviderCredentials}, allowPaymentCredentials=${args.policies.allowPaymentCredentials}, allowGitHubMutation=${args.policies.allowGitHubMutation}.`,
         }),
@@ -64,14 +65,14 @@ export function buildTerminalProductBundle(args) {
             at: args.run.createdAt,
             level: "info",
             type: "terminal-lab.caps.declared",
-            message: `Spend/job/time caps: ${capsText}. A live run never exercises the runtime key without a fail-closed cap; its no-spend proof is derived from the persisted cost ledger. This dry-run spends $0 by mechanism.`,
+            message: `Spend, job and time caps: ${capsText}. A live run uses the runtime key only while a cap is in force, and derives its no-spend proof from the recorded cost ledger. This dry run spends $0: it makes no model request.`,
         }),
         participantEvent(TERMINAL_IDS, {
             id: "event-004-contract",
             at: args.run.createdAt,
             level: "info",
             type: "terminal-lab.contract.ready",
-            message: "Dry-run contract bundle ready. Switch scenario.mode to live with the required runtime auth and caps to exercise the in-sandbox agent route, captured exec stream, and declared runtime-auth placement.",
+            message: "Dry-run bundle ready. Switch scenario.mode to live with the required runtime auth and caps to exercise the in-sandbox agent route, captured exec stream, and declared runtime-auth placement.",
         }),
     ];
     const review = {
@@ -79,7 +80,7 @@ export function buildTerminalProductBundle(args) {
         verdict: args.verdict,
         summary: reason,
         gaps: [
-            "This dry-run did not execute the live in-sandbox agent route; it proves contract shape only, not live behavior, scale, or adoption.",
+            "This dry run did not execute the live in-sandbox agent route; it checks the evidence shape only, not live behavior, scale, or adoption.",
             "No exec-stream, transcript, substrate, cost, or cleanup artifacts were produced because no live session ran; live verification requires those artifacts.",
         ],
     };
@@ -88,13 +89,13 @@ export function buildTerminalProductBundle(args) {
             {
                 at: args.run.createdAt,
                 event: "terminal-lab.run.created",
-                message: `Created terminal-product lab run with one in-sandbox agent participant (actor ${args.actorId}, product ${args.productName}).`,
+                message: `Created a terminal-product run with one in-sandbox agent participant (actor ${args.actorId}, product ${args.productName}).`,
             },
         ],
         simulation,
         stream,
         events,
-        redactionNotes: "Dry-run contract bundle: no sandbox ran, no key was injected, no exec output was captured. The author mission is public-safe committed lab text (redacted defensively); the composed prompt is bound by digest. The shipped live path applies scrubKnownValues then redactText at the capture source before persistence.",
+        redactionNotes: "Dry-run bundle: no sandbox ran, no key was injected, no exec output was captured. The author mission is public-safe committed study text (redacted defensively); the composed prompt is bound by digest. The shipped live path applies scrubKnownValues then redactText at the capture source before persistence.",
         review,
     });
 }
@@ -167,8 +168,8 @@ export function buildLiveTerminalProductBundle(args) {
                 ? []
                 : [`Agent session ended ${args.trace.status}: ${args.sessionReason}`]),
             ...(args.capFailure === undefined ? [] : [args.capFailure]),
-            // Honesty gap: the no-spend proof always declares which spend lines it could not measure, so a
-            // green run never silently over-claims a fully-proven $0.
+            // Measurement gap: the no-spend proof always declares which spend lines it could not measure,
+            // so a green run never silently over-claims a fully-proven $0.
             ...(noSpend.unmeasuredLines.length > 0
                 ? [
                     `${noSpendLineMeasured(noSpend) ? noSpendNotEstablished(noSpend.maxUsd ?? 0) : "No-spend proof is partial."} ${describeMeasuredSpend(args.ledgers.cost, args.trace.tokenUsage)} An adapter may supply the missing signals through costProbe.`,
@@ -185,7 +186,7 @@ export function buildLiveTerminalProductBundle(args) {
         simulation,
         stream,
         events: lifecycleEvents,
-        redactionNotes: `Live terminal-product run: the in-sandbox agent's output was captured via commands.run onStdout/onStderr and scrubbed (literal known values incl. the runtime key) THEN redacted (shape patterns) AT THE SOURCE before persisting. ${args.runtimeAuth === "openai-egress" ? `Runtime auth openai-egress: the raw key from ${args.runtimeAuthKeyName} is reserved for E2B's external api.openai.com HTTPS header transform. ${args.ledgers.commandLog.some((command) => command.label === "codex-exec") ? "Codex received an inert CODEX_API_KEY placeholder." : "Codex was not launched."} Any created sandbox retains a spendable OpenAI proxy capability until teardown; additional provider calls may not appear in the Codex usage ledger.` : `Runtime auth openai-env: the runtime key (${args.runtimeAuthKeyName}) was injected ONLY into the command-scoped codex invocation, never sandbox-global env or metadata; only its NAME appears in evidence.`} Subject provenance is UNPINNED (public-surface study).`,
+        redactionNotes: `Live terminal-product run: the in-sandbox agent's output was captured via commands.run onStdout/onStderr and had known values (including the runtime key) scrubbed, then shape patterns redacted, before anything was stored. ${args.runtimeAuth === "openai-egress" ? `Runtime auth openai-egress: the raw key from ${args.runtimeAuthKeyName} is reserved for E2B's external api.openai.com HTTPS header transform. ${args.ledgers.commandLog.some((command) => command.label === "codex-exec") ? "Codex received an inert CODEX_API_KEY placeholder." : "Codex was not launched."} Any created sandbox retains a spendable OpenAI proxy capability until teardown; additional provider calls may not appear in the Codex usage ledger.` : `Runtime auth openai-env: the runtime key (${args.runtimeAuthKeyName}) was passed only to the codex command, never to sandbox-wide environment variables or metadata; only its name appears in evidence.`} Subject provenance is unpinned (a study of public pages).`,
         review,
         ...(args.cost === undefined ? {} : { cost: args.cost }),
     });
@@ -196,7 +197,7 @@ const TERMINAL_IDS = participantIds(0);
 function terminalParticipant(args, session) {
     const simulation = participantRecord(TERMINAL_IDS, 1, {
         personaId: args.persona.id,
-        scenarioId: `terminal-${args.labId}`,
+        scenarioId: `terminal-${args.studyId}`,
         status: session.status,
         streamKind: "terminal",
         mode: "cli-sim",
@@ -209,7 +210,7 @@ function terminalParticipant(args, session) {
     const stream = participantStream(TERMINAL_IDS, {
         assignment: participantAssignment({ mission: args.mission }),
         kind: "terminal",
-        label: `Terminal agent — ${args.labId}`,
+        label: `Terminal agent · ${args.studyId}`,
         status: session.status,
         transport: "snapshot",
         updatedAt: session.updatedAt,
@@ -236,17 +237,17 @@ function terminalRunBundle(args, parts) {
         persona: {
             id: args.persona.id,
             name: `Autonomous terminal agent (${args.persona.id})`,
-            source: `lab:${args.labId}`,
+            source: `study:${args.studyId}`,
             sourceDigest: args.persona.promptDigest,
         },
         scenario: {
-            id: `terminal-${args.labId}`,
-            title: args.labTitle ?? `Terminal-product lab: ${args.labId}`,
-            // The author mission is public-safe committed lab text — recorded plaintext as the goal,
+            id: `terminal-${args.studyId}`,
+            title: args.studyTitle ?? `Terminal-product run: ${args.studyId}`,
+            // The author mission is public-safe committed study text. It is recorded plaintext as the goal,
             // redacted defensively before persisting (it never carries a secret, but the harness never
             // trusts that). The full composed prompt is bound by digest, not text.
             goal: redactText(args.mission),
-            source: `lab:${args.labId}`,
+            source: `study:${args.studyId}`,
             sourceDigest: args.persona.promptDigest,
         },
         lifecycle: parts.lifecycle,
@@ -281,7 +282,7 @@ export function renderTerminalReviewMarkdown(bundle) {
         "",
         `- run: ${bundle.runId}`,
         `- mode: ${bundle.mode}`,
-        `- verdict: ${bundle.review.verdict}`,
+        `- verdict: ${verdictText(bundle.review.verdict, bundle.mode)}`,
         `- summary: ${bundle.review.summary}`,
         `- mission: ${bundle.scenario.goal}`,
         ...(subject ? [`- subject: ${subject.message}`] : []),

package/dist/routes/terminal/credentials.d.ts

@@ -1,4 +1,4 @@
-import type { LabRuntimeAuth } from "../../lab/types.js";
+import type { StudyRuntimeAuth } from "../../study/types.js";
 /**
  * Resolve the runtime key on the host. Legacy openai-env passes it command-scoped; openai-egress
  * returns an inert command env while retaining the actual value for the external transform and
@@ -7,28 +7,28 @@ import type { LabRuntimeAuth } from "../../lab/types.js";
  */
 export declare function buildRuntimeAuth(args: {
     /** Undefined retains the historical openai-env default. */
-    runtimeAuth: LabRuntimeAuth | undefined;
+    runtimeAuth: StudyRuntimeAuth | undefined;
     /** The operator environment the key value is read from (process.env or a test fake). */
     env: Record<string, string | undefined>;
 }): {
     ok: true;
-    mode: LabRuntimeAuth;
+    mode: StudyRuntimeAuth;
     envs: Record<string, string>;
     keyName: string;
     keyValue: string;
 } | {
     ok: false;
-    code: "HUMANISH_TERMINAL_LAB_RUNTIME_AUTH_MISSING" | "HUMANISH_TERMINAL_LAB_CREDENTIAL_DENIED";
+    code: "HUMANISH_TERMINAL_RUNTIME_AUTH_MISSING" | "HUMANISH_TERMINAL_CREDENTIAL_DENIED";
     message: string;
 };
 /**
- * Build the sandbox metadata from a positive allowlist (safety contract item 6). This is the only
- * way metadata is set on the terminal route — it carries solely non-secret labels and rejects any
+ * Build the sandbox metadata from a positive allowlist. This is the only
+ * way metadata is set on the terminal route. It carries solely non-secret labels and rejects any
  * value that is not a plain short label. A verifier check asserts the persisted metadata has no
  * prompt/token/secret shapes; this builder makes that true by construction.
  */
 export declare function buildSandboxMetadata(allowlist: {
-    labId: string;
-    simId: string;
+    studyId: string;
+    recordId: string;
     runId: string;
 }): Record<string, string>;

package/dist/routes/terminal/credentials.js

@@ -1,5 +1,5 @@
 import { E2B_SYSTEM_CA_BUNDLE, OPENAI_EGRESS_PLACEHOLDER } from "./runtime-auth.js";
-import { TERMINAL_PRODUCT_LAB_PROVIDER_METADATA } from "./types.js";
+import { TERMINAL_PRODUCT_STUDY_PROVIDER_METADATA } from "./types.js";
 /**
  * Resolve the runtime key on the host. Legacy openai-env passes it command-scoped; openai-egress
  * returns an inert command env while retaining the actual value for the external transform and
@@ -12,13 +12,13 @@ export function buildRuntimeAuth(args) {
     // (developers.openai.com/codex/noninteractive) document it as the channel for a single codex exec
     // invocation, which is exactly this route's shape (no persisted auth.json/CODEX_HOME, per-command
     // envs only). A dated in-repo receipt
-    // (docs/goals/humanish-recursive-proof-critical-point/receipts/actor-required-attempt.md) shows a
+    // (docs/history/goals/humanish-recursive-proof-critical-point/receipts/actor-required-attempt.md) shows a
     // job-wide OPENAI_API_KEY alone failing bearer auth for this same pinned-exec pattern. When the
     // operator only exported OPENAI_API_KEY, its value is also injected under CODEX_API_KEY below, so
     // the documented exec auth channel is always populated regardless of which name the operator
     // used. The allowlist is exactly these two names; everything else is denied by construction.
     const ALLOWED_RUNTIME_KEY_NAMES = ["CODEX_API_KEY", "OPENAI_API_KEY"];
-    // Tripwire (safety contract item 4): if a future widening of ALLOWED_RUNTIME_KEY_NAMES ever
+    // Tripwire (deny-by-default credentials): if a future widening of ALLOWED_RUNTIME_KEY_NAMES ever
     // added a clearly-non-runtime credential (a GitHub/payment/deploy/db secret), fail closed. The
     // generic `*_KEY` shape is deliberately left out of the tripwire, since a runtime key legitimately
     // ends in _KEY (CODEX_API_KEY/OPENAI_API_KEY), so testing it against the generic shape would
@@ -29,7 +29,7 @@ export function buildRuntimeAuth(args) {
     if (ALLOWED_RUNTIME_KEY_NAMES.some((name) => isNonRuntimeCredentialName(name))) {
         return {
             ok: false,
-            code: "HUMANISH_TERMINAL_LAB_CREDENTIAL_DENIED",
+            code: "HUMANISH_TERMINAL_CREDENTIAL_DENIED",
             message: "Internal invariant violated: a runtime-key allowlist entry is a non-runtime credential (GitHub/payment/deploy/db).",
         };
     }
@@ -37,8 +37,8 @@ export function buildRuntimeAuth(args) {
     if (!keyName) {
         return {
             ok: false,
-            code: "HUMANISH_TERMINAL_LAB_RUNTIME_AUTH_MISSING",
-            message: `Live terminal-product labs declare runtimeAuth "${String(args.runtimeAuth)}" and need ${ALLOWED_RUNTIME_KEY_NAMES.join(" or ")} in the environment (pass via --env-file; the selected auth mode places the value in command-scoped env or an external E2B header transform; the value is never persisted).`,
+            code: "HUMANISH_TERMINAL_RUNTIME_AUTH_MISSING",
+            message: `Live terminal-product studies declare runtimeAuth "${String(args.runtimeAuth)}" and need ${ALLOWED_RUNTIME_KEY_NAMES.join(" or ")} in the environment (pass via --env-file; the selected auth mode places the value in command-scoped env or an external E2B header transform; the value is never persisted).`,
         };
     }
     const keyValue = args.env[keyName];
@@ -84,18 +84,18 @@ function isNonRuntimeCredentialName(name) {
     return NON_RUNTIME_CREDENTIAL_NAME_PATTERNS.some((pattern) => pattern.test(name));
 }
 /**
- * Build the sandbox metadata from a positive allowlist (safety contract item 6). This is the only
- * way metadata is set on the terminal route — it carries solely non-secret labels and rejects any
+ * Build the sandbox metadata from a positive allowlist. This is the only
+ * way metadata is set on the terminal route. It carries solely non-secret labels and rejects any
  * value that is not a plain short label. A verifier check asserts the persisted metadata has no
  * prompt/token/secret shapes; this builder makes that true by construction.
  */
 export function buildSandboxMetadata(allowlist) {
     return {
-        mode: TERMINAL_PRODUCT_LAB_PROVIDER_METADATA.mode,
-        tool: TERMINAL_PRODUCT_LAB_PROVIDER_METADATA.tool,
+        mode: TERMINAL_PRODUCT_STUDY_PROVIDER_METADATA.mode,
+        tool: TERMINAL_PRODUCT_STUDY_PROVIDER_METADATA.tool,
         provider: "codex",
-        labId: allowlist.labId,
-        simId: allowlist.simId,
+        labId: allowlist.studyId,
+        recordId: allowlist.recordId,
         // The run id is a harness-minted token (terminal-<ts>-<hex>), not user data.
         runId: allowlist.runId,
     };

package/dist/routes/terminal/dry-run.d.ts

@@ -1,11 +1,11 @@
-import type { TerminalPlan } from "../../lab/plan-types.js";
+import type { TerminalPlan } from "../../study/plan-types.js";
 import type { RunScope } from "../../run/run.js";
-import { type RunLiveTerminalSessionArgs, type TerminalProductLabResult, type TerminalRunInput } from "./types.js";
+import { type RunLiveTerminalSessionArgs, type TerminalProductStudyResult, type TerminalRunInput } from "./types.js";
 /**
  * The dry-run path: a contract bundle with the persona and prompt digest bound, published through
  * the run scope with no sandbox, key or spend.
  */
-export declare function runDryTerminalLab(args: {
+export declare function runDryTerminalStudy(args: {
     plan: Extract<TerminalPlan, {
         readonly dryRun: true;
     }>;
@@ -14,7 +14,7 @@ export declare function runDryTerminalLab(args: {
     warnings: string[];
     failed: RunLiveTerminalSessionArgs["failed"];
     scope: RunScope;
-}): Promise<TerminalProductLabResult>;
+}): Promise<TerminalProductStudyResult>;
 /** Compose the full prompt the agent would run. Bound to evidence by digest only. */
 export declare function composePrompt(args: {
     mission: string;

package/dist/routes/terminal/dry-run.js

@@ -1,7 +1,7 @@
 // The terminal route's dry run: a contract-only bundle with the persona and prompt digest bound,
 // published through the run scope with no sandbox, key or spend. session.ts holds the live path.
 import { digestText, redactText, scrubLiterals } from "../../evidence/redaction.js";
-import { participantAssignment } from "../../lab/participant-assignment.js";
+import { participantAssignment } from "../../study/participant-assignment.js";
 import { buildRunSource } from "../../run/bundle.js";
 import { judgeExecution, judgeTerminal, OUTCOME_POLICIES, resultOk } from "../../run/judge.js";
 import { validatePreparedRunArtifactPaths } from "../../run/paths.js";
@@ -9,12 +9,13 @@ import { buildTerminalProductBundle, renderTerminalReviewMarkdown } from "./bund
 import { resolveTerminalPersona, terminalPersonaRef } from "./persona.js";
 import { declaredRuntimeProvenance } from "./runtime.js";
 import { defaultMission, makeTerminalRunId } from "./session.js";
-import { TERMINAL_PRODUCT_LAB_SCHEMA, } from "./types.js";
+import {} from "./types.js";
+import { studyResultIdentity } from "../../run/study-result.js";
 /**
  * The dry-run path: a contract bundle with the persona and prompt digest bound, published through
  * the run scope with no sandbox, key or spend.
  */
-export async function runDryTerminalLab(args) {
+export async function runDryTerminalStudy(args) {
     const { plan, input, cwd, warnings, failed, scope } = args;
     const { product } = plan;
     const { evidenceMission, physicalCwd, persona } = await prepareDryPersona({
@@ -28,7 +29,7 @@ export async function runDryTerminalLab(args) {
         runId: input.runId,
         mintRunId: makeTerminalRunId,
         mode: "dry-run",
-        lab: plan.lab,
+        study: plan.study,
         renderReview: renderTerminalReviewMarkdown,
         observer: { open: input.open === true, render: input.deps?.renderObserver },
     });
@@ -48,8 +49,8 @@ export async function runDryTerminalLab(args) {
         run,
         actorId: plan.actor,
         dryRun: true,
-        labId: plan.labId,
-        ...(plan.title ? { labTitle: plan.title } : {}),
+        studyId: plan.studyId,
+        ...(plan.title ? { studyTitle: plan.title } : {}),
         mission: evidenceMission,
         persona,
         productName: product.name,
@@ -76,16 +77,15 @@ export async function runDryTerminalLab(args) {
         : [
             {
                 kind: "evidence",
-                message: observer.error?.message ?? "Observer failed for the terminal-product lab run.",
+                message: observer.error?.message ?? "Observer failed for the terminal-product run.",
             },
         ], policy);
     const ok = resultOk({ judgment, execution, scorerFailures: [], policy });
     await finished.recordOutcome({ ok, execution });
     return {
-        schema: TERMINAL_PRODUCT_LAB_SCHEMA,
+        ...studyResultIdentity("terminal", plan.studyId),
         ok,
         cwd,
-        labId: plan.labId,
         actor: plan.actor,
         product: product.name,
         dryRun: true,
@@ -96,8 +96,8 @@ export async function runDryTerminalLab(args) {
             ? {}
             : {
                 error: {
-                    code: "HUMANISH_TERMINAL_LAB_FAILED",
-                    message: observer.error?.message ?? "Observer failed for the terminal-product lab run.",
+                    code: "HUMANISH_TERMINAL_FAILED",
+                    message: observer.error?.message ?? "Observer failed for the terminal-product run.",
                 },
             }),
     };
@@ -116,7 +116,7 @@ async function prepareDryPersona(args) {
     const evidenceMission = participantAssignment({ mission }, scrubLiterals(knownSecretValues)).mission;
     const terminalPersona = await resolveTerminalPersona({ plan, cwd, warnings });
     // The composed prompt = mission + persona + public-surface manifest. Only the author mission
-    // goes plaintext into evidence (it is public-safe committed lab text); the full composed prompt
+    // goes plaintext into evidence (it is public-safe committed study text); the full composed prompt
     // is recorded as a digest (the safety contract's mission ruling).
     const composedPrompt = composePrompt({
         mission,

package/dist/routes/terminal/encoding.js

@@ -6,7 +6,7 @@
 // as a replacement glyph. Every ASCII character on the same screen was fine, which is exactly the
 // signature.
 //
-// The honest fix is not "stop using em dashes" — it is to ask what the terminal can render and mean
+// The fix is not "stop using em dashes". It is to ask what the terminal can render and mean
 // it. A surface that emits characters its own terminal cannot decode is not being expressive, it is
 // producing garbage that reads as a bug in the tool.
 const UTF8 = /utf-?8/i;
@@ -23,7 +23,7 @@ export function terminalRendersUnicode(env = process.env) {
     const declared = env.LC_ALL ?? env.LC_CTYPE ?? env.LANG;
     if (declared === undefined || declared.trim().length === 0) {
         // Nothing declared at all. A bare login shell on a stock image lands here, and that is the
-        // case the participant hit — assume it cannot, because the failure is silent and ugly while
+        // case the participant hit. Assume it cannot, because the failure is silent and ugly while
         // the fallback is merely plainer.
         return false;
     }

package/dist/routes/terminal/ledger.d.ts

@@ -1,9 +1,9 @@
 import type { ActorTokenUsage } from "../../actors/contract.js";
-import type { LabScenarioCaps } from "../../lab/types.js";
+import type { StudyScenarioCaps } from "../../study/types.js";
 import { type CostCategory } from "../../run/terminal-contract.js";
 import type { CostLine, NoSpendProof, TerminalCostLedger } from "./types.js";
 /**
- * Build the spend ledger from the captured session. The null discipline (issue #154):
+ * Build the spend ledger from the captured session. The null discipline:
  *   - The `provider` line is populated from the actor trace's tokenUsage.costUsd when the trace
  *     carries it (a measured value, incl. a measured 0). When the trace carries no costUsd, the
  *     provider line is `null` = not measured (never guessed to 0 just because no-spend was intended).
@@ -14,7 +14,7 @@ import type { CostLine, NoSpendProof, TerminalCostLedger } from "./types.js";
  */
 export declare function buildCostLedger(args: {
     tokenCostUsd?: number;
-    /** Measured token counts, when the run produced them but no rate could price them (#531). */
+    /** Measured token counts, when the run produced them but no rate could price them. */
     tokenUsage?: ActorTokenUsage;
     injectedLines?: Partial<Record<CostCategory, CostLine>>;
 }): TerminalCostLedger;
@@ -32,7 +32,7 @@ export declare function noSpendNotEstablished(maxUsd: number): string;
  */
 export declare function describeMeasuredSpend(ledger: TerminalCostLedger, tokenUsage?: ActorTokenUsage): string;
 /** Derive the no-spend proof from the ledger. It vouches for known-zero lines and
- *  explicitly lists the unmeasured (null) lines it cannot vouch for — never claiming zero on null. */
+ *  explicitly lists the unmeasured (null) lines it cannot vouch for. It never claims zero on null. */
 export declare function buildNoSpendProof(ledger: TerminalCostLedger, maxUsd: number | null, tokenUsage?: ActorTokenUsage): NoSpendProof;
 /**
  * Fail-closed caps enforcement. Returns a structured violation when a known
@@ -41,7 +41,7 @@ export declare function buildNoSpendProof(ledger: TerminalCostLedger, maxUsd: nu
  * grant a green pass: the no-spend proof reports them as unmeasured. maxMinutes is wall-clock and is
  * enforced separately (runWithWallClock); it is not a ledger-derived cap.
  */
-export declare function evaluateCapsAgainstLedger(ledger: TerminalCostLedger, caps: LabScenarioCaps): {
+export declare function evaluateCapsAgainstLedger(ledger: TerminalCostLedger, caps: StudyScenarioCaps): {
     ok: true;
 } | {
     ok: false;

package/dist/routes/terminal/ledger.js

@@ -2,7 +2,7 @@ import { describeTokenUsage } from "./token-usage.js";
 import { round6 } from "../../run/pricing.js";
 import { COST_CATEGORIES } from "../../run/terminal-contract.js";
 /**
- * Build the spend ledger from the captured session. The null discipline (issue #154):
+ * Build the spend ledger from the captured session. The null discipline:
  *   - The `provider` line is populated from the actor trace's tokenUsage.costUsd when the trace
  *     carries it (a measured value, incl. a measured 0). When the trace carries no costUsd, the
  *     provider line is `null` = not measured (never guessed to 0 just because no-spend was intended).
@@ -22,24 +22,24 @@ export function buildCostLedger(args) {
             ? {
                 // Tokens counted, no rate to price them. This stays `usd: null` because a guessed
                 // dollar figure would be worse than none, but the note carries the measured fact so a
-                // reader never mistakes "no charge recorded" for "nothing was consumed" (#531).
+                // reader never mistakes "no charge recorded" for "nothing was consumed".
                 usd: null,
                 source: "unpriced-token-usage",
-                note: `Provider spend UNPRICED: the run consumed ${describeTokenUsage(args.tokenUsage)}, ` +
-                    "but the terminal participant records the model as `codex` and src/run/pricing.ts carries no " +
-                    "rate for it, so no dollar figure is claimed. Tokens are a MEASURED fact here; the " +
-                    "price is the unknown. Recorded null (never guessed to 0).",
+                note: `Provider spend unpriced: the run consumed ${describeTokenUsage(args.tokenUsage)}, ` +
+                    "but the terminal participant records the model as `codex` and humanish has no rate " +
+                    "for it, so no dollar figure is given. The token count is measured; the price is " +
+                    "not known. Recorded as null, never guessed as 0.",
             }
             : {
                 usd: null,
                 source: "unmeasured",
-                note: "Provider spend NOT MEASURED: the actor trace carried no tokenUsage.costUsd this run. Recorded null (not guessed to 0).",
+                note: "Provider spend not measured: the actor trace carried no tokenUsage.costUsd in this run, so it is recorded as null and not guessed as 0.",
             };
     const unmeasured = (category) => ({
         usd: null,
         count: null,
         source: "unmeasured",
-        note: `${category} spend NOT MEASURED: core has no ${category}-spend signal for this run; an adapter may supply one through costProbe. Recorded null (never guessed to 0).`,
+        note: `${category} spend not measured: humanish has no ${category} spend signal for this run, and an adapter may supply one through costProbe. Recorded as null, never guessed as 0.`,
     });
     const lines = {
         product: args.injectedLines?.product ?? unmeasured("product"),
@@ -99,7 +99,7 @@ export function describeMeasuredSpend(ledger, tokenUsage) {
         .join(" ");
 }
 /** Derive the no-spend proof from the ledger. It vouches for known-zero lines and
- *  explicitly lists the unmeasured (null) lines it cannot vouch for — never claiming zero on null. */
+ *  explicitly lists the unmeasured (null) lines it cannot vouch for. It never claims zero on null. */
 export function buildNoSpendProof(ledger, maxUsd, tokenUsage) {
     const knownZeroLines = [];
     const knownNonZeroLines = [];
@@ -115,14 +115,14 @@ export function buildNoSpendProof(ledger, maxUsd, tokenUsage) {
     }
     // satisfied only when every known line is within the cap (for a no-spend run, maxUsd 0 => every
     // known line must be exactly 0). Unmeasured lines never make it satisfied; they are reported
-    // separately as the proof's honest blind spot.
+    // separately as the proof's blind spot.
     const cap = maxUsd ?? 0;
     const satisfied = knownNonZeroLines.length === 0 && ledger.knownTotalUsd <= cap;
     const verdict = !satisfied
-        ? `No-spend proof NOT satisfied for maxUsd=${cap}: known spend total ${ledger.knownTotalUsd} USD${knownNonZeroLines.length > 0 ? ` (non-zero: ${knownNonZeroLines.join(", ")})` : ""}.`
+        ? `No-spend proof not satisfied for maxUsd=${cap}: known spend total ${ledger.knownTotalUsd} USD${knownNonZeroLines.length > 0 ? ` (non-zero: ${knownNonZeroLines.join(", ")})` : ""}.`
         : noSpendLineMeasured({ knownZeroLines, knownNonZeroLines })
             ? noSpendNotEstablished(cap)
-            : `No-spend proof SATISFIED for maxUsd=${cap} on the measured lines (known total ${ledger.knownTotalUsd} USD).`;
+            : `No-spend proof satisfied for maxUsd=${cap} on the measured lines (known total ${ledger.knownTotalUsd} USD).`;
     const statement = [verdict, describeMeasuredSpend(ledger, tokenUsage)]
         .filter((part) => part.length > 0)
         .join(" ");
@@ -149,7 +149,7 @@ export function evaluateCapsAgainstLedger(ledger, caps) {
         const overLines = COST_CATEGORIES.filter((c) => ledger.lines[c].usd !== null && ledger.lines[c].usd > 0);
         return {
             ok: false,
-            message: `Observed KNOWN spend ${ledger.knownTotalUsd} USD exceeds scenario.caps.maxUsd=${caps.maxUsd}${overLines.length > 0 ? ` (non-zero lines: ${overLines.join(", ")})` : ""}. The run fails closed: the cap is a fail-closed mechanism, not an advisory.`,
+            message: `Stopped: measured spend ${ledger.knownTotalUsd} USD passed scenario.caps.maxUsd=${caps.maxUsd}${overLines.length > 0 ? ` (non-zero lines: ${overLines.join(", ")})` : ""}. The cap stops the run; it is not a warning.`,
         };
     }
     if (caps.maxJobs !== undefined) {
@@ -162,7 +162,7 @@ export function evaluateCapsAgainstLedger(ledger, caps) {
         if (knownJobs > caps.maxJobs) {
             return {
                 ok: false,
-                message: `Observed KNOWN billable-job count ${knownJobs} exceeds scenario.caps.maxJobs=${caps.maxJobs}. The run fails closed.`,
+                message: `Stopped: ${knownJobs} measured billable jobs passed scenario.caps.maxJobs=${caps.maxJobs}.`,
             };
         }
     }

package/dist/routes/terminal/lifetime.d.ts

@@ -1,6 +1,6 @@
 /**
  * The most the sandbox runs before the codex command starts: the Node bootstrap, the runtime
- * version check and, when the lab declares `subject.product.install`, the product setup.
+ * version check and, when the study declares `subject.product.install`, the product setup.
  */
 export declare function terminalPreExecBudgetMs(productInstall: boolean): number;
 /** The terminal sandbox's server-side timeout for a codex command bounded at `maxMinutes`. */

package/dist/routes/terminal/lifetime.js

@@ -7,7 +7,7 @@ import { TERMINAL_RUNTIME_VERSION_TIMEOUT_MS } from "./runtime.js";
 import { PRODUCT_SETUP_TIMEOUT_MS, TERMINAL_SANDBOX_TIMEOUT_BUFFER_MS } from "./types.js";
 /**
  * The most the sandbox runs before the codex command starts: the Node bootstrap, the runtime
- * version check and, when the lab declares `subject.product.install`, the product setup.
+ * version check and, when the study declares `subject.product.install`, the product setup.
  */
 export function terminalPreExecBudgetMs(productInstall) {
     return (NODE_BOOTSTRAP_TIMEOUT_MS +

package/dist/routes/terminal/live-finish.d.ts

@@ -2,7 +2,7 @@ import type { ActorPersonaRef } from "../../actors/contract.js";
 import type { RunBundle } from "../../run/bundle.js";
 import type { RunScope } from "../../run/run.js";
 import type { LiveSandboxInputs, LiveTerminalSandbox } from "./live-sandbox.js";
-import type { RunLiveTerminalSessionArgs, TerminalProductLabResult } from "./types.js";
+import type { RunLiveTerminalSessionArgs, TerminalProductStudyResult } from "./types.js";
 type StartedRun = Extract<Awaited<ReturnType<RunScope["startRun"]>>, {
     ok: true;
 }>["run"];
@@ -26,5 +26,5 @@ export interface LiveFinishInputs {
     /** The session's outcome; a blown cap overrides it. */
     session: LiveTerminalSandbox;
 }
-export declare function finishLiveTerminalSession(inputs: LiveFinishInputs): Promise<TerminalProductLabResult>;
+export declare function finishLiveTerminalSession(inputs: LiveFinishInputs): Promise<TerminalProductStudyResult>;
 export {};