humanish 0.109.1 → 0.110.1

package/dist/verify/artifacts.d.ts

@@ -37,6 +37,10 @@ export declare function rawScreenshotStreamIds(bundle: RunBundle, redactedShapeF
 interface RegisteredStreamMedia {
     recordingPaths: Set<string>;
     screenshotPaths: Set<string>;
+    /** The run's raw sandbox ids, from its receipts; any other file holding one is listed below. */
+    sandboxIds?: readonly string[];
+    /** Filled by the scan: files other than the receipts that name a raw sandbox id. */
+    sandboxIdFiles?: string[];
 }
 /**
  * Scans every run file for secret and path patterns and returns the findings. A file that is not

package/dist/verify/artifacts.js

@@ -7,6 +7,8 @@ import { readPlainText } from "../evidence/plain-text.js";
 import { containsSensitive } from "../evidence/redaction.js";
 import { isLocalEvidenceArtifactPath, isRiskyPublicArtifactPath, validatePreparedRunArtifactPaths, } from "../run/paths.js";
 import { openContainedRegularFile } from "../run/contained-output.js";
+import { holdsKeyedSandboxId } from "../run/sandbox-ids.js";
+import { SANDBOX_RECEIPTS_ARTIFACT } from "../run/sandbox-receipts.js";
 import { readSafeRunArtifactBytes, readSafeRunArtifactJson } from "../run/locate.js";
 import { isRecord } from "../run/type-guards.js";
 import { TERMINAL_EVENTS_ARTIFACT } from "../run/terminal-contract.js";
@@ -348,6 +350,12 @@ async function scanRunPublicSafetyDirectory(runPaths, relativeDirectory, finding
             unscanned.push(relativePath);
             continue;
         }
+        // A receipt's id in any other file, or a raw id at a sandbox-id key, which an older run or
+        // export copy can hold with no receipt to name it.
+        if (relativePath !== SANDBOX_RECEIPTS_ARTIFACT &&
+            (media.sandboxIds?.some((id) => decoded.text.includes(id)) ||
+                holdsKeyedSandboxId(relativePath, decoded.text)))
+            media.sandboxIdFiles?.push(relativePath);
         // serve renders observer/index.html from run.json and export regenerates it, so the on-disk
         // copy reaches neither. It embeds the Observer's own base64 fonts and scripts.
         const scan = scanEncodedTextCached(decoded.text, {

package/dist/verify/liveness.d.ts

@@ -1,7 +1,23 @@
 import type { RunBundle } from "../run/bundle.js";
 import type { PreparedRunArtifactPaths } from "../run/paths.js";
+/** What verify can say about a run that is not finished. */
+export interface UnfinishedRun {
+    liveness: "running" | "interrupted";
+    /**
+     * clean: the run's reclaim receipt records every sandbox gone and a finished search of E2B by
+     * the run's tags. unconfirmed: it records a sandbox not confirmed gone, or the run journaled one
+     * it does not cover. unknown: there is no reclaim receipt, or it records no finished tag search
+     * (written by humanish 0.110.0 or earlier, or by a reclaim that did not finish), so a sandbox whose
+     * id never reached a receipt could still run.
+     */
+    sandboxes: "clean" | "unconfirmed" | "unknown";
+}
 /**
- * One warning when the run is not finished, by the run index's rule: its status record when it
- * has a usable one, else a participant still `running` in its bundle's `simulations[]`. Empty for a finished run.
+ * One warning, and the unfinished-run facts, when the run is not finished, by the run index's
+ * rule: its status record when it has a usable one, else a participant still `running` in its
+ * bundle's `simulations[]`. Nothing for a finished run.
  */
-export declare function runNotFinishedWarnings(runPaths: PreparedRunArtifactPaths, bundle: RunBundle, nowMs?: number): Promise<string[]>;
+export declare function runNotFinished(runPaths: PreparedRunArtifactPaths, bundle: RunBundle, nowMs?: number): Promise<{
+    warnings: string[];
+    unfinished?: UnfinishedRun;
+}>;

package/dist/verify/liveness.js

@@ -1,6 +1,8 @@
-// `humanish verify`'s RUN_NOT_FINISHED warning. Verify checks the integrity of what a run wrote,
-// and a run killed mid-way leaves an in-progress bundle that passes those checks. The warning says
-// what verify saw on disk, so `ok: true` is not read as "the run finished". It never flips `ok`.
+// `humanish verify`'s RUN_NOT_FINISHED warning and the unfinished-run facts its one-line output
+// leads with. Verify checks the integrity of what a run wrote, and a run killed mid-way leaves an
+// in-progress bundle that passes those checks. The warning says what verify saw on disk, so
+// `ok: true` is not read as "the run finished" or "its sandboxes stopped". It never flips `ok`.
+import { sandboxIdDigest } from "../evidence/redaction.js";
 import path from "node:path";
 import { readRunJsonIfExists, readRunTextIfExists } from "../run/locate.js";
 import { isRecord } from "../run/type-guards.js";
@@ -8,19 +10,21 @@ import { RECLAIM_RECEIPT_ARTIFACT } from "../run/reclaim.js";
 import { runLiveness } from "../run/run-index.js";
 import { parseSandboxReceipts, SANDBOX_RECEIPTS_ARTIFACT } from "../run/sandbox-receipts.js";
 import { RUN_STATUS_FILE } from "../run/status.js";
+import { plural } from "../run/text.js";
 /** The stable code every RUN_NOT_FINISHED warning starts with. */
 const RUN_NOT_FINISHED = "RUN_NOT_FINISHED";
 const GONE_STATES = new Set(["killed", "already-gone"]);
 /**
- * One warning when the run is not finished, by the run index's rule: its status record when it
- * has a usable one, else a participant still `running` in its bundle's `simulations[]`. Empty for a finished run.
+ * One warning, and the unfinished-run facts, when the run is not finished, by the run index's
+ * rule: its status record when it has a usable one, else a participant still `running` in its
+ * bundle's `simulations[]`. Nothing for a finished run.
  */
-export async function runNotFinishedWarnings(runPaths, bundle, nowMs = Date.now()) {
+export async function runNotFinished(runPaths, bundle, nowMs = Date.now()) {
     const runId = path.basename(runPaths.absoluteRunRoot);
     const status = await readRunJsonIfExists(runPaths, RUN_STATUS_FILE);
     const { liveness, record } = runLiveness(runId, status, bundle, nowMs);
     if (liveness === "finished")
-        return [];
+        return { warnings: [] };
     const seen = [];
     if (record === undefined) {
         const running = bundle.simulations.filter((simulation) => simulation.status === "running");
@@ -38,38 +42,59 @@ export async function runNotFinishedWarnings(runPaths, bundle, nowMs = Date.now(
     const runningStreams = bundle.streams.filter((stream) => stream.status === "running").length;
     seen.push(`${runningStreams} of ${bundle.streams.length} streams are still running`);
     const reclaim = await reclaimState(runPaths, runId);
-    return [
-        `${RUN_NOT_FINISHED}: ${seen.join("; ")}.${reclaim === "" ? "" : ` ${reclaim}`} Verify ok covers the integrity of what was written; it does not mean the run finished.`,
-    ];
+    return {
+        warnings: [
+            `${RUN_NOT_FINISHED}: ${seen.join("; ")}. ${reclaim.text} Verify ok covers the integrity of what was written; it does not mean the run finished.`,
+        ],
+        unfinished: { liveness, sandboxes: reclaim.sandboxes },
+    };
 }
-/** What the reclaim receipt says about the sandboxes this run journaled, or what to run. */
+/** What the reclaim receipt says about this run's sandboxes, and what to run. */
 async function reclaimState(runPaths, runId) {
     const journal = await readRunTextIfExists(runPaths, SANDBOX_RECEIPTS_ARTIFACT);
-    const journaled = new Set((journal === null ? [] : parseSandboxReceipts(journal)).map((receipt) => receipt.sandboxId));
-    const receipt = await readRunJsonIfExists(runPaths, RECLAIM_RECEIPT_ARTIFACT);
-    const outcomes = reclaimOutcomes(receipt, runId);
-    if (outcomes !== undefined) {
-        const gone = outcomes.filter((outcome) => GONE_STATES.has(outcome.state)).length;
-        const reclaimed = new Set(outcomes.map((outcome) => outcome.sandboxId));
-        const missing = [...journaled].filter((id) => !reclaimed.has(id)).length;
-        return `${RECLAIM_RECEIPT_ARTIFACT} records ${gone} of ${outcomes.length} sandboxes gone${missing === 0 ? "" : `, and ${missing} journaled sandboxes are not in it`}.`;
-    }
-    if (journaled.size === 0)
-        return "";
-    return `It has no ${RECLAIM_RECEIPT_ARTIFACT}; \`humanish reclaim --run ${runId}\` stops the ${journaled.size} sandboxes it journaled.`;
+    // Matched by digest: a reclaim receipt names each sandbox by digest, and one written before it
+    // did holds the raw id, which is digested here.
+    const journaled = new Set((journal === null ? [] : parseSandboxReceipts(journal)).map((receipt) => sandboxIdDigest(receipt.sandboxId)));
+    const command = `\`humanish reclaim --run ${runId}\``;
+    const receipt = reclaimReceipt(await readRunJsonIfExists(runPaths, RECLAIM_RECEIPT_ARTIFACT), runId);
+    if (receipt === undefined)
+        return {
+            sandboxes: "unknown",
+            text: `Sandboxes unknown: it has no ${RECLAIM_RECEIPT_ARTIFACT} and journaled ${plural(journaled.size, "sandbox", "sandboxes")}; ${command} stops those and searches E2B by this run's tags for any whose id never reached a receipt.`,
+        };
+    const { outcomes } = receipt;
+    const gone = outcomes.filter((outcome) => GONE_STATES.has(outcome.state)).length;
+    const reclaimed = new Set(outcomes.map((outcome) => outcome.digest));
+    const missing = [...journaled].filter((id) => !reclaimed.has(id)).length;
+    const recorded = `${RECLAIM_RECEIPT_ARTIFACT} records ${gone} of ${outcomes.length} sandboxes gone${missing === 0 ? "" : `, and ${missing} journaled sandboxes are not in it`}`;
+    if (gone < outcomes.length || missing > 0)
+        return {
+            sandboxes: "unconfirmed",
+            text: `Sandboxes unconfirmed: ${recorded}; ${command} retries.`,
+        };
+    if (receipt.state === "clean")
+        return {
+            sandboxes: "clean",
+            text: `Sandboxes clean: ${recorded}, and E2B listed none still tagged with this run.`,
+        };
+    return {
+        sandboxes: "unknown",
+        text: `Sandboxes unknown: ${recorded}, but it records no finished search of E2B by this run's tags; ${command} searches.`,
+    };
 }
-/** The outcomes of a reclaim receipt written for this run, or undefined when there is none. */
-function reclaimOutcomes(receipt, runId) {
+/** A reclaim receipt written for this run, or undefined when there is none. */
+function reclaimReceipt(receipt, runId) {
     if (!isRecord(receipt) || receipt.runId !== runId || !Array.isArray(receipt.outcomes))
         return undefined;
     const outcomes = [];
     for (const outcome of receipt.outcomes) {
         if (!isRecord(outcome))
             return undefined;
-        const { sandboxId, state } = outcome;
+        const { sandboxId, sandboxIdDigest: recorded, state } = outcome;
         if (typeof sandboxId !== "string" || typeof state !== "string")
             return undefined;
-        outcomes.push({ sandboxId, state });
+        const digest = typeof recorded === "string" ? recorded : sandboxIdDigest(sandboxId);
+        outcomes.push({ digest, state });
     }
-    return outcomes;
+    return typeof receipt.state === "string" ? { state: receipt.state, outcomes } : { outcomes };
 }

package/dist/verify/verify.d.ts

@@ -1,4 +1,5 @@
 import { type PreparedRunArtifactPaths } from "../run/paths.js";
+import { type UnfinishedRun } from "./liveness.js";
 export declare const VERIFY_SCHEMA = "humanish.verify-result.v1";
 export interface VerifyResult {
     schema: typeof VERIFY_SCHEMA;
@@ -16,11 +17,13 @@ export interface VerifyResult {
     shareSafety: {
         status: "share_ready" | "local_only" | "blocked";
         reasons: Array<{
-            code: "VERIFY_FAILED" | "PUBLIC_SAFETY_FINDINGS" | "ANALYSIS_UNVERIFIED" | "RAW_SCREENSHOTS" | "CONTINUOUS_MEDIA" | "REAL_COMMUNICATIONS" | "UNSCANNED_ARTIFACT";
+            code: "VERIFY_FAILED" | "PUBLIC_SAFETY_FINDINGS" | "ANALYSIS_UNVERIFIED" | "RAW_SCREENSHOTS" | "RAW_SANDBOX_ID" | "CONTINUOUS_MEDIA" | "REAL_COMMUNICATIONS" | "UNSCANNED_ARTIFACT";
             message: string;
         }>;
     };
     warnings: string[];
+    /** Present when the run is not finished: its liveness and what is known of its sandboxes. */
+    unfinished?: UnfinishedRun;
     error?: {
         code: "HUMANISH_RUN_NOT_FOUND" | "HUMANISH_INVALID_RUN_BUNDLE";
         message: string;

package/dist/verify/verify.js

@@ -2,7 +2,8 @@ import path from "node:path";
 import { listAnalysisExecutions } from "../analysis/store-executions.js";
 import { loadAnalysis } from "../analysis/load.js";
 import { analysisSharingProblems } from "../analysis/sharing.js";
-import { containsSensitive } from "../evidence/redaction.js";
+import { containsSensitive, REDACTED_SANDBOX_ID } from "../evidence/redaction.js";
+import { keyedSandboxIds, readRunSandboxIds } from "../run/sandbox-ids.js";
 import { validatePreparedRunArtifactPaths } from "../run/paths.js";
 import { RUN_BUNDLE_FILE, RUN_BUNDLE_SCHEMA } from "../run/bundle.js";
 import { isCleanupResult, isRunBundle } from "../run/bundle-shape.js";
@@ -12,7 +13,7 @@ import { runNotFoundMessage } from "../run/run-not-found.js";
 import { actorVerdictConsistencyFindings, noEngagementActorFindings, validateCodexAppServerEvidence, validateTerminalProductEvidence, } from "./actor.js";
 import { invalidRunEvidenceReferences, MAX_REPORTED_FINDINGS, missingLocalEvidenceArtifacts, rawScreenshotPostureWarnings, rawScreenshotStreamIds, redactedShapeFramePaths, scanRunPublicSafetyArtifacts, streamScreenshotPaths, } from "./artifacts.js";
 import { flatContextWarnings } from "./context-growth.js";
-import { runNotFinishedWarnings } from "./liveness.js";
+import { runNotFinished } from "./liveness.js";
 import { costAndReceiptFindings } from "./costs.js";
 import { rerunLineageFindings } from "./rerun.js";
 import { sharedWorldEvidenceFindings } from "./shared-world.js";
@@ -83,11 +84,17 @@ export async function verifyResolvedRun(cwd, runInput, runPaths) {
     }));
     const derivedPublicSafetyFindings = [];
     const unscannedArtifacts = [];
+    const sandboxIdFiles = [];
     const publicSafetyFindings = await scanRunPublicSafetyArtifacts(runPaths, derivedPublicSafetyFindings, {
         recordingPaths: new Set(isRunBundle(bundle)
             ? bundle.streams.flatMap((stream) => (stream.recording ? [stream.recording.path] : []))
             : []),
         screenshotPaths: isRunBundle(bundle) ? streamScreenshotPaths(bundle) : new Set(),
+        // A run from before 0.110 with no receipts still names its ids in run.json.
+        sandboxIds: [
+            ...new Set([...(await readRunSandboxIds(runPaths)), ...keyedSandboxIds(bundle)]),
+        ],
+        sandboxIdFiles,
     }, unscannedArtifacts);
     // JSON escapes can hide a sensitive value from the byte scan while the
     // decoded recording exposes it to Observer, feedback, or analysis input.
@@ -130,13 +137,16 @@ export async function verifyResolvedRun(cwd, runInput, runPaths) {
             message: "Derived analysis contains sensitive text or unsafe artifact paths; sharing is blocked, original recording remains independently verifiable.",
         });
     const ok = checks.every((check) => check.ok);
+    const notFinished = isRunBundle(bundle)
+        ? await runNotFinished(runPaths, bundle)
+        : { warnings: [], unfinished: undefined };
     const warnings = isRunBundle(bundle)
         ? [
             ...rawScreenshotPostureWarnings(bundle, redactedShapeFrames),
             ...undeclaredSubjectStateWarnings(bundle),
             ...desktopGeometryWarnings(bundle),
             ...flatContextWarnings(bundle),
-            ...(await runNotFinishedWarnings(runPaths, bundle)),
+            ...notFinished.warnings,
         ]
         : [];
     const shareSafety = isRunBundle(bundle)
@@ -146,6 +156,7 @@ export async function verifyResolvedRun(cwd, runInput, runPaths) {
             publicSafetyFindings,
             unscannedArtifacts,
             redactedShapeFrames,
+            sandboxIdFiles,
         })
         : {
             status: "blocked",
@@ -167,6 +178,7 @@ export async function verifyResolvedRun(cwd, runInput, runPaths) {
         checks,
         shareSafety,
         warnings,
+        ...(notFinished.unfinished === undefined ? {} : { unfinished: notFinished.unfinished }),
         ...(ok
             ? {}
             : {
@@ -366,6 +378,18 @@ function buildShareSafety(args) {
             message: `The public-safety scan cannot read ${plural(paths.length, "file")} as text that ${paths.length === 1 ? "is not a stream screenshot under screenshots/ or a registered recording" : "are not stream screenshots under screenshots/ or registered recordings"}: ${shown}${more > 0 ? ` and ${more} more` : ""}. Review them before sharing.`,
         });
     }
+    // Runs from 0.110 keep raw sandbox ids only in sandbox-receipts.ndjson. An earlier run records
+    // them in run.json, and any file that names one is not share-ready as it is.
+    const rawResources = (args.bundle.providerResources ?? []).some((resource) => resource.id !== REDACTED_SANDBOX_ID);
+    if (rawResources || args.sandboxIdFiles.length > 0) {
+        const files = [
+            ...new Set([...(rawResources ? [RUN_BUNDLE_FILE] : []), ...args.sandboxIdFiles]),
+        ];
+        reasons.push({
+            code: "RAW_SANDBOX_ID",
+            message: `Raw sandbox ids appear in ${files.sort().join(", ")}. Runs from 0.110 keep them only in sandbox-receipts.ndjson; \`humanish export --format bundle --redact-screenshots\` writes a copy without them.`,
+        });
+    }
     const rawStreamIds = rawScreenshotStreamIds(args.bundle, args.redactedShapeFrames);
     if (rawStreamIds.length > 0) {
         reasons.push({

package/docs/architecture/actor-contract.md

@@ -444,7 +444,8 @@ traits: { patience, skill, accessibilityNeeds? }, constraints[], sourceDigest }`
      receives them as thread/start `baseInstructions` (`threadStartParams` in
      `src/actors/codex/restricted-launch.ts`), on an ephemeral read-only thread whose only
      dynamic tool is `humanish_ui`. A local-agent Claude Code runs one `claude -p`
-     stream-json session with `--allowedTools Read`; the instructions open its first user
+     stream-json session restricted to Read in its folder (`claudeParticipantFlags` in
+     `src/actors/local-agent/claude-participant.ts`); the instructions open its first user
      message (`promptFor` in `src/actors/local-agent/cli.ts`), and later turns rely on the
      session's memory. `HUMANISH_LOCAL_AGENT_ONE_SHOT` instead spawns one `claude -p` per
      turn, which resends the instructions every turn.

package/docs/architecture/observer.md

@@ -93,10 +93,23 @@ Served data may also include `runtime` with `state`, `observedAt`, and
 `source: "local-run-status"`. This is a current observation of a contained,
 matching `status.json`; it never changes the run's recorded verdict or participant
 outcomes. A fresh heartbeat means running, an explicitly finalized record means
-finished, and stale or invalid timing means unknown. Missing, malformed, or
-mismatched records omit the observation. A stale heartbeat alone does not prove
-interruption, and stored PIDs are neither probed nor returned. Static rendering
-and export do not create this served-only observation.
+finished, a record the CLI's signal handler wrote means interrupted, and stale or
+invalid timing means unknown. Missing, malformed, or mismatched records omit the
+observation. A stale heartbeat alone does not prove interruption, and stored PIDs
+are neither probed nor returned. Static rendering and export do not create this
+served-only observation.
+
+`run.display` says whether the run passed: `{ state, label, tone, reason? }` from
+`runDisplay` (`src/run/display.ts`), the function every surface that shows a run's
+result calls. `state` is `passed` only when `run.status` (the verdict) is `pass` and
+`run.json`'s `outcome` does not record the run as failed. A run whose execution
+failed under a pass verdict is `failed`, with the first failure in `reason`.
+`blocked`, `timed_out`, `no_verdict`, `interrupted`, `running`, `dry_run` and
+`unknown` are the other states. For a `run.json` without an `outcome`, the served
+Observer and `observe` read `status.json` for liveness and, on a run recorded
+before `run.json` carried an outcome, for its ok. The sidebar's dot is the pass
+accent only for `passed`. observer-data.json written before `display` existed
+keeps the verdict reading.
 
 Watch is deliberately distinct from `humanish observe --all`. Watch serves one
 attached run, and the process that created it may inject runtime stream URLs
@@ -167,9 +180,11 @@ origin-dependent scripts and modules in those artifacts may require independent
 hosting. See the [CSP sandbox standard](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/sandbox).
 
 History entries may include `runtimeState` from the same contained local status
-read as the Observer. Their existing `status` remains the recorded verdict.
-Running filters should use runtime state when present, preserving the difference
-between an active study and its provisional evidence outcome.
+read as the Observer, and `display` from the run's Observer data. Their existing
+`status` remains the recorded verdict. The library's pip color and the sidebar's
+label read `display`. Running filters should use runtime state when present,
+preserving the difference between an active study and its provisional evidence
+outcome.
 
 ## UI Shape
 

package/docs/architecture/restricted-codex-analysis.md

@@ -176,7 +176,7 @@ the following, on Linux x64:
    runs this check; see "The qualifier" below.
 3. One hosted participant study with the candidate first on `PATH` (for example
    `PATH=<evidence>/npm-<version>/node_modules/.bin:$PATH pnpm humanish run <study>
---env-file <file with E2B_API_KEY only>`) reached its goal in the final capture, with a
+--dotenv <file with E2B_API_KEY only>`) reached its goal in the final capture, with a
    verified request receipt, `humanish verify --run <id>` passing and the automatic Codex
    analysis recording the release. Keep `OPENAI_API_KEY` out of that environment so the
    participant stays on ChatGPT-account billing.

package/docs/architecture/task-protocol-support.md

@@ -5,20 +5,20 @@ participant; hidden success criteria go only to the observation tracker. A route
 that cannot carry both halves refuses the declaration before execution. Removing
 `tasks` is an explicit choice to run a mission-only study, not an automatic fallback.
 
-| Execution path                                        | Task support | Mechanism                                                                                     |
-| ----------------------------------------------------- | ------------ | --------------------------------------------------------------------------------------------- |
-| CUA, app-url, one participant or fan-out              | Supported    | The participant prompt composer renders goals; the CUA loop tracks observations               |
-| CUA, provisioned clone or local-tree, separate worlds | Supported    | Same prompt composer and loop                                                                 |
-| CUA, local-app with caller executor/provider          | Supported    | Same loop; the caller supplies observations                                                   |
-| CUA, desktop-cli                                      | Supported    | Same prompt and tracker; unavailable criterion inputs remain unmeasured                       |
-| Shared-world, provisioned or external-public          | Rejected     | Actor specs omit the protocol before CUA session dispatch                                     |
-| Terminal-product                                      | Rejected     | Terminal prompt and result contract do not implement tasks                                    |
-| Scripted-browser, local or provisioned                | Rejected     | Scenario steps drive the participant; no task protocol is consumed                            |
-| Synthetic (`this-repo`)                               | Rejected     | Study dispatch does not pass task declarations to the dry-run engine                          |
-| Any second or later `actors[]` entry                  | Rejected     | Current runners consume only the first actor; declare every participant under the first actor |
+| Execution path                                        | Task support | Mechanism                                                                       |
+| ----------------------------------------------------- | ------------ | ------------------------------------------------------------------------------- |
+| CUA, app-url, one participant or fan-out              | Supported    | The participant prompt composer renders goals; the CUA loop tracks observations |
+| CUA, provisioned clone or local-tree, separate worlds | Supported    | Same prompt composer and loop                                                   |
+| CUA, local-app with caller executor/provider          | Supported    | Same loop; the caller supplies observations                                     |
+| CUA, desktop-cli                                      | Supported    | Same prompt and tracker; unavailable criterion inputs remain unmeasured         |
+| Shared-world, provisioned or external-public          | Rejected     | Actor specs omit the protocol before CUA session dispatch                       |
+| Terminal-product                                      | Rejected     | Terminal prompt and result contract do not implement tasks                      |
+| Scripted-browser, local or provisioned                | Rejected     | Scenario steps drive the participant; no task protocol is consumed              |
+| Preview (`this-repo`)                                 | Rejected     | Study dispatch does not pass task declarations to the dry-run engine            |
 
-Both registered CUA actors (`openai-computer-use` and `local-agent`) share the CUA
-session loop. Their task support does not depend on which provider chooses actions.
+A study has one `actor`, and its participants go in `participants`, so every participant
+gets the same tasks. Both registered CUA actors (`openai-computer-use` and `local-agent`) share
+the CUA session loop. Their task support does not depend on which provider chooses actions.
 Custom session hooks remain caller-owned implementations of that same contract;
 this preflight does not certify arbitrary hook behavior.
 

package/docs/architecture/terminal-product-route.md

@@ -33,7 +33,7 @@ fail-closed cross-validation, and forward-declared warnings.
 | `execution.runtimeAuth`           | `openai-env` (default) or opt-in `openai-egress`; names-only durable evidence                                                                               |
 | `execution.runtime.version`       | Optional exact `@openai/codex` version; observed before keyed execution                                                                                     |
 | `actor.model` / `reasoningEffort` | Passed to Codex as `--model` (default `gpt-5.6-sol`) and `-c model_reasoning_effort`; declarations, not observed provider identity                          |
-| `caps`                            | `{ maxUsd, maxJobs, maxMinutes }`: the blast-radius budget; `maxUsd > 0` is refused unless a `costProbe` measures spend                                     |
+| `caps`                            | `{ maxUsd, maxJobs, maxMinutes }`: the blast-radius budget; `maxUsd > 0` is refused: no adopter cost source exists until issue 347 lands                    |
 | `policies`                        | `allowPrivateRepoAccess` / `allowProviderCredentials` / `allowPaymentCredentials` / `allowGitHubMutation`, all default false                                |
 | `actor.type`                      | `codex-exec`: a registered terminal actor (`keyPlacement: in-sandbox-command-scoped`)                                                                       |
 | route                             | `terminal` → `runTerminalProductStudy` ([`src/routes/terminal/route.ts`](https://github.com/danielgwilson/humanish/blob/main/src/routes/terminal/route.ts)) |

package/docs/contracts/run-bundle.md

@@ -70,6 +70,15 @@ artifacts:
 review:
   schema: humanish.review.v1
   verdict: "contract_proof_only|pass|fail|blocked|timed_out"
+outcome: # optional, additive: how the run ended (Run Outcome below)
+  state: "finished"
+  ok: false
+  execution:
+    succeeded: false
+    failures:
+      - kind: "harness|provider-cleanup|provider-policy|sandbox-cleanup|evidence|cap|run"
+        message: "<public-safe message>"
+    warnings: [] # omitted when empty
 redaction:
   status: "passed"
   notes: "<public-safe note>"
@@ -100,6 +109,59 @@ Persisted `run.json` files must not contain absolute local target paths. Runtime
 commands may return the caller's working directory in process-local JSON
 responses, but durable run bundles use the public-safe `[target-cwd]` marker.
 
+## Run Outcome
+
+`outcome` records how the run ended as an execution. `review.verdict` is what the
+participants experienced; `outcome.ok` is the route result's `ok`, which
+`humanish run --json` prints as `runOk`. The two differ: a terminal run whose agent passed but whose sandbox
+teardown is unproven has verdict `pass` and `ok: false`.
+
+```yaml
+# Run.finish published the final bundle.
+outcome:
+  state: finished
+  ok: true
+  execution:
+    succeeded: true
+    failures: []
+    warnings: # omitted when empty
+      - kind: sandbox-cleanup
+        message: "lane-01: Sandbox release is unconfirmed. Reclaim it by recorded id with `humanish reclaim --run <id>`."
+---
+# The CLI's signal handler stopped the run before it finished.
+outcome:
+  state: interrupted
+  ok: false
+  signal: SIGINT # or SIGTERM, SIGHUP
+  at: "<ISO timestamp>"
+```
+
+`Run.finish` (`src/run/run.ts`) writes `finished` with the route's `ok` and its
+execution outcome (`judgeExecution` in `src/run/judge.ts`). Each route's policy in
+`OUTCOME_POLICIES` decides which failure kinds fail the run and which only warn.
+An Observer that does not render is an `evidence` failure known only after
+`run.json` is on disk: `FinishedRun.renderObserver` adds it to `outcome` and to
+`status.json` before the route returns, and no Observer page exists that could
+show the run without it. Messages pass the same redaction and sandbox id scrub
+as the rest of the bundle.
+
+When a signal stops a live run, the handler writes `interrupted` into the last
+flushed `run.json`, and every later write of that run keeps it. A run stopped
+before its first flush has no `run.json`; its `status.json` is the record.
+
+`outcome` is absent while a run is in progress, when its process died without
+writing it, and on runs recorded before the field existed. For those, readers
+take liveness from `status.json` and, for an older finished run, its `ok` and
+`execution` from `status.json`'s `outcome`. That record is the only copy of an
+older run's `ok`; for a run with `outcome` in `run.json`, `status.json` copies it.
+
+Every surface that shows whether a run passed calls `runDisplay`
+(`src/run/display.ts`) with the run's liveness, verdict and `ok`: the Observer
+(`observer-data.json` `run.display`), its run library, the served Observer,
+`humanish runs`, `humanish review`, `humanish stats`, the TUI and `review.md`'s
+`outcome` line. A run
+shows as `passed` only when its verdict is `pass` and its `ok` is not false.
+
 ## Recorded session stop causes
 
 An actor trace may include `stopCause` alongside its unchanged `status`,
@@ -525,6 +587,10 @@ bundle is safe to promote into a public issue. Public promotion should branch on
 
 - `share_ready`: feedback draft commands may render public issue payloads;
 - `local_only`: keep the run local; only supported redaction-only cases can produce a shareable derivative;
+  `RAW_SANDBOX_ID` is one: a file other than `sandbox-receipts.ndjson` names one of the run's raw
+  sandbox ids, which verify reads from the receipts and from any raw `providerResources[].id` in
+  `run.json`, or a JSON file holds a raw id at a sandbox-id key. Runs from 0.110 keep raw ids only in the receipts, so it fires on runs recorded
+  before 0.110, whose `run.json` holds them, until they are exported;
 - `blocked`: fix the verification or public-safety failure first.
 
 `ok: true` also does not mean the run finished. A run killed mid-way leaves an
@@ -539,10 +605,19 @@ writing; an older one reads as interrupted. The warning names what verify saw:
 - the record's state and its last `updatedAt`, or the running `simulations[]` entries when
   there is no usable record;
 - how many streams are still `running`;
-- what `reclaim-receipt.json` records: how many of the run's sandboxes are gone
-  (killed or already gone), and how many journaled sandboxes it does not cover;
-- with journaled sandboxes and no reclaim receipt, the command that stops them:
-  `humanish reclaim --run <id>`.
+- the sandbox state, and what `reclaim-receipt.json` records: how many of the run's
+  sandboxes are gone (killed or already gone), and how many journaled sandboxes it does
+  not cover. It matches its outcomes to the receipts by `sandboxIdDigest`; a reclaim
+  receipt from before 0.110 names raw ids, which are digested to match;
+- with no reclaim receipt, the command that stops the journaled sandboxes and searches
+  E2B by the run's owner tags: `humanish reclaim --run <id>`.
+
+The result also carries `unfinished: { liveness, sandboxes }`, and the one-line output
+leads with it, for example `verified <id> (interrupted, sandboxes unknown) · share_ready`.
+`sandboxes` is `clean` only when the reclaim receipt records every sandbox gone and its
+`state` is `clean`, which means the search by tag finished. It is `unconfirmed` when the
+receipt records a sandbox not gone or misses a journaled one, and `unknown` otherwise,
+including a receipt from humanish 0.110.0 or earlier, which did not search by tag.
 
 The local-evidence check includes screenshots declared only by
 `streams[].actor.items[].screenshotRef` or `streams[].liveActor.items[].screenshotRef`,
@@ -634,9 +709,17 @@ finding is true. Its own bytes are not included in its hash inventory. Feedback
 commands can subsequently generate new derivative-local artifacts.
 
 The derivative names no sandbox. In every JSON and NDJSON file it copies, the
-values at `sandboxId`, `subjectSandboxId` and each `providerResources[].id` read
-`[redacted-sandbox-id]`; `sandbox-receipts.ndjson` is omitted. The source keeps
-its raw ids, which cleanup and reclaim read.
+values at `sandboxId`, `subjectSandboxId`, each `providerResources[].id` and each
+cleanup.json `resources[].id` read `[redacted-sandbox-id]`, with the id's digest
+beside them. In every text file it copies, Markdown, logs and YAML included, each
+id the source names becomes `[redacted-sandbox-id <digest>]`: the ids in its
+`sandbox-receipts.ndjson`, and any raw id at one of those keys, which is where a
+run recorded before 0.110 with no receipts names them. Only those exact ids are
+replaced, so the rest of each file is unchanged. In YAML the label is
+`redacted-sandbox-id-<digest>`, without brackets, so a value keeps its type.
+An id that appears only in free text, in a run with no receipts, is not known to
+export. `sandbox-receipts.ndjson` is omitted, and the source keeps its raw ids,
+which reclaim reads.
 
 PNG files that actor traces reference as stream screenshots are re-encoded as
 blurred thumbnails. A PNG that nothing in `run.json` cites is omitted and