humanish 0.110.0 → 0.110.1

package/docs/contracts/study-costs.md

@@ -29,6 +29,14 @@ They do not suddenly include a separate analysis request. The bundle's
 `cost.estimatedTotalUsd`, `status.json`'s `outcome.estimatedCostUsd` and the run
 index's `estimatedCostUsd` stay participants and desktops only.
 
+Each study's `passed` counts the runs that show as passed on every surface
+(`runDisplay` in `src/run/display.ts`): a `pass` verdict and a run whose own `ok`
+is not false. `passRate` divides it by `judged`, the runs with a verdict.
+`totals.verdicts` counts the participants' verdicts; `totals.outcomes` counts
+every selected run by its display state (`passed`, `failed`, `blocked`,
+`timed_out`, `no_verdict`, `dry_run`, `interrupted`, `running`, `unknown`), and
+the human output prints that line.
+
 ## One run's cost
 
 A run's analysis spend has one reader, `readAnalysisAccounting` in

package/docs/decisions/0001-run-bundle-is-the-source-of-truth.md

@@ -18,6 +18,9 @@ the evidence. Everything else is a projection rebuilt from them:
 - `status.json` (`humanish.run-status.v1`) is a liveness index. When it disagrees with `run.json`,
   `run.json` wins. `verify` reads it, with the sandbox and reclaim receipts, only to say a run
   did not finish (`RUN_NOT_FINISHED`). That warning changes no check and no grade.
+- A run's `ok` and execution outcome are in `run.json`'s `outcome`, and `status.json` copies them.
+  A `status.json` written before `run.json` carried an outcome holds the only copy of that run's
+  `ok`, so readers fall back to it for such a run only.
 - Analysis findings cite turns and artifacts in the bundle.
 
 ## Consequences

package/docs/decisions/0003-contained-paths-and-cleanup-authority.md

@@ -1,6 +1,7 @@
 # 0003: Managed paths bind to physical identities; cleanup uses create-time receipts
 
-Accepted in 0.15.1, extended in 0.36.0 (`humanish reclaim`).
+Accepted in 0.15.1, extended in 0.36.0 (`humanish reclaim`) and after 0.110.0 (search by owner
+tags).
 
 ## Context
 
@@ -18,11 +19,16 @@ Separately, an account-wide provider operation once destroyed unrelated infrastr
 - The process that creates a resource cleans it up with the handle it holds. After a crash,
   `humanish reclaim` kills sandboxes by the exact ids journaled at create time in the run's
   `sandbox-receipts.ndjson`, and reports each outcome.
-- No route lists an account's resources to find or verify its own.
+- Nothing lists an account's resources unfiltered. Every sandbox carries its run's owner tags
+  (`tool`, `runId`, `runKey`), and reclaim lists only the sandboxes E2B matches to all three,
+  checks each tag again before it acts, and stops after three pages. A sandbox whose id never
+  reached a receipt, from a create that threw after E2B allocated or a process that died
+  mid-create, is otherwise unreachable until its timeout.
 
 ## Consequences
 
-- A shared operator key is safe to use: humanish reaches only resources it created.
+- A shared operator key is safe to use: humanish reaches only resources it created. `runKey` keeps
+  two projects that reuse a run id from matching each other's sandboxes.
 - An exported bundle does not carry cleanup authority; `export` omits the receipt journal.
 - Unverified git metadata (arbitrary `gitdir:` redirects) is reported as unavailable instead of
   followed.

package/docs/principles/invariants-and-defaults.md

@@ -66,14 +66,17 @@ certify (see the conformance suite).
 6. **Claims match mechanism.** A config field that is parsed but not consumed warns; a
    document that overstates behavior is a defect; an evidence artifact never claims a
    stronger evidence class than its actor and scenario can support.
-7. **Reclamation is by exact created id, never account-wide enumeration.** A route that
-   creates a provider resource (an E2B sandbox, for example) tracks the exact id it created and
-   reclaims and proves cleanup against that id alone (a returned found-and-killed boolean, a
-   getInfo-by-id NotFound check). No route ever calls a provider's list-everything endpoint to
-   discover or verify its own cleanup, because that endpoint enumerates the whole account/team,
-   including resources humanish did not create. This is what makes a single shared operator key
-   safe: humanish only ever reaches a resource it created, never anything else the key's owner
-   is running.
+7. **Reclamation is by exact created id or the run's exact owner tags, never account-wide
+   enumeration.** A route that creates a provider resource (an E2B sandbox, for example) tracks
+   the exact id it created and reclaims and proves cleanup against that id alone (a returned
+   found-and-killed boolean, a getInfo-by-id NotFound check). No route ever calls a provider's
+   list endpoint unfiltered to discover or verify its own cleanup, because that enumerates the
+   whole account/team, including resources humanish did not create. The one listing is reclaim's
+   search for a sandbox whose id never reached the run: every sandbox carries its run's owner
+   tags (`tool`, `runId`, `runKey`), E2B filters by all three, reclaim checks each tag again
+   before it acts, and it reads at most three pages. This is what makes a single shared operator
+   key safe: humanish only ever reaches a resource it created, never anything else the key's
+   owner is running.
    The one narrow exception is an explicit, maintainer-run orphan sweep (never a default, never
    reachable by a normal run) that is itself opt-in gated (an explicit flag or env var) and
    documented as such at its call site.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.110.0",
+  "version": "0.110.1",
   "description": "Synthetic user research for apps, CLIs, and agent-facing product flows.",
   "keywords": [
     "cli",
@@ -56,10 +56,11 @@
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json && pnpm --filter humanish-observer build && pnpm --filter humanish-tui build && node scripts/finish-build.mjs",
-    "check": "pnpm format:check && pnpm lint && pnpm knip && pnpm prose:check && pnpm vocabulary:check && pnpm site-css:check && pnpm typecheck && pnpm test && pnpm tui:test && pnpm build && pnpm guest-media:startup:proof && pnpm cli:startup:test && pnpm cli:preflight:test && pnpm cli:dotenv:test && pnpm tui:smoke",
+    "check": "pnpm format:check && pnpm lint && pnpm knip && pnpm prose:check && pnpm vocabulary:check && pnpm docs:check && pnpm site-css:check && pnpm typecheck && pnpm test && pnpm tui:test && pnpm build && pnpm guest-media:startup:proof && pnpm cli:startup:test && pnpm cli:preflight:test && pnpm cli:dotenv:test && pnpm cli:peer:test && pnpm tui:smoke",
     "cli:startup:test": "node scripts/terminal-startup-exit-proof.mjs",
     "cli:preflight:test": "node scripts/task-route-preflight-proof.mjs",
     "cli:dotenv:test": "node scripts/dotenv-proof.mjs",
+    "cli:peer:test": "node scripts/peer-install-proof.mjs",
     "humanish": "tsx src/cli.ts",
     "pack:dry-run": "npm pack --dry-run",
     "prepack": "pnpm build",
@@ -75,7 +76,7 @@
     "release:dogfood": "node scripts/release-dogfood.mjs",
     "browser-control:proof": "node scripts/browser-control-proof.mjs",
     "docs:generate": "tsx scripts/generate-cli-docs.ts",
-    "docs:check": "tsx scripts/generate-cli-docs.ts --check && tsx scripts/check-doc-paths.ts && tsx scripts/check-doc-symbols.ts && tsx scripts/check-doc-comments.ts",
+    "docs:check": "tsx scripts/generate-cli-docs.ts --check && tsx scripts/check-doc-paths.ts && tsx scripts/check-doc-symbols.ts && tsx scripts/check-doc-comments.ts && tsx scripts/check-doc-study-fields.ts",
     "observer:browser:proof": "node scripts/observer-browser-proof.mjs",
     "observer:iframe:proof": "node --import tsx scripts/observer-iframe-proof.mjs",
     "observer:chrome:proof": "node scripts/observer-chrome-proof.mjs",

package/skills/humanish/SKILL.md

@@ -35,7 +35,7 @@ Everything it shows has a machine-readable equivalent, which is what you want:
 | browsing studies    | `npx humanish study list --json`                                                       |
 | browsing runs       | `npx humanish runs --json`                                                             |
 | starting a run      | `npx humanish run <study> --json --no-open`                                            |
-| a run's outcome     | `npx humanish review --run <id> --json`                                                |
+| a run's findings    | `npx humanish review --run <id> --json`                                                |
 | communication setup | `npx humanish comms providers --json` and `npx humanish comms connections list --json` |
 
 If a human asks you to "open the TUI", tell them the command to type; do not run
@@ -454,7 +454,21 @@ publish their names, screenshots, logs, source snippets, or operational details.
 
 ## Reporting Back
 
-Report:
+After a live run, read its findings before anything else:
+
+```bash
+npx humanish review --run <id>          # the verdict, then each analysis finding
+npx humanish review --run <id> --json   # the same; findings are under `analysis`
+```
+
+Report each finding to the user: its title, impact, confidence and recovery, the participants it
+affected, and the capture files it cites. These come from the post-run analysis of the evidence.
+Label the participant's own report in the review summary as the participant's account. When
+`analysis.state` is not `ready`, report `analysis.message` and the `analysis.next` command in
+place of findings; `analysis.next` is null when no command can produce them. `latest` moves with
+every run, including dry runs, so use the run id the run printed.
+
+Then report:
 
 - files changed in the target repo;
 - exact proof commands run;