humanish 0.110.0 → 0.110.1

package/dist/routes/terminal/ledger.d.ts

@@ -7,9 +7,9 @@ import type { CostLine, NoSpendProof, TerminalCostLedger } from "./types.js";
  *   - The `provider` line is populated from the actor trace's tokenUsage.costUsd when the trace
  *     carries it (a measured value, incl. a measured 0). When the trace carries no costUsd, the
  *     provider line is `null` = not measured (never guessed to 0 just because no-spend was intended).
- *   - product/media/payment are `null` by default: core has no signal for those categories; an
- *     adapter may provide one through the shipped costProbe seam.
- * `injectedLines` lets a test or adapter supply known spend for a category,
+ *   - product/media/payment are `null` by default: core has no signal for those categories, and
+ *     only a test can supply one, through `StudyDeps.costProbe`.
+ * `injectedLines` lets a test supply known spend for a category,
  * exercising the fail-closed cap enforcement deterministically without a real billable run.
  */
 export declare function buildCostLedger(args: {

package/dist/routes/terminal/ledger.js

@@ -6,9 +6,9 @@ import { COST_CATEGORIES } from "../../run/terminal-contract.js";
  *   - The `provider` line is populated from the actor trace's tokenUsage.costUsd when the trace
  *     carries it (a measured value, incl. a measured 0). When the trace carries no costUsd, the
  *     provider line is `null` = not measured (never guessed to 0 just because no-spend was intended).
- *   - product/media/payment are `null` by default: core has no signal for those categories; an
- *     adapter may provide one through the shipped costProbe seam.
- * `injectedLines` lets a test or adapter supply known spend for a category,
+ *   - product/media/payment are `null` by default: core has no signal for those categories, and
+ *     only a test can supply one, through `StudyDeps.costProbe`.
+ * `injectedLines` lets a test supply known spend for a category,
  * exercising the fail-closed cap enforcement deterministically without a real billable run.
  */
 export function buildCostLedger(args) {
@@ -39,7 +39,7 @@ export function buildCostLedger(args) {
         usd: null,
         count: null,
         source: "unmeasured",
-        note: `${category} spend not measured: humanish has no ${category} spend signal for this run, and an adapter may supply one through costProbe. Recorded as null, never guessed as 0.`,
+        note: `${category} spend not measured: humanish has no ${category} spend signal, and a study cannot supply one. Recorded as null, never guessed as 0.`,
     });
     const lines = {
         product: args.injectedLines?.product ?? unmeasured("product"),
@@ -149,7 +149,7 @@ export function evaluateCapsAgainstLedger(ledger, caps) {
         const overLines = COST_CATEGORIES.filter((c) => ledger.lines[c].usd !== null && ledger.lines[c].usd > 0);
         return {
             ok: false,
-            message: `Stopped: measured spend ${ledger.knownTotalUsd} USD passed scenario.caps.maxUsd=${caps.maxUsd}${overLines.length > 0 ? ` (non-zero lines: ${overLines.join(", ")})` : ""}. The cap stops the run; it is not a warning.`,
+            message: `Stopped: measured spend ${ledger.knownTotalUsd} USD passed caps.maxUsd=${caps.maxUsd}${overLines.length > 0 ? ` (non-zero lines: ${overLines.join(", ")})` : ""}. The cap stops the run; it is not a warning.`,
         };
     }
     if (caps.maxJobs !== undefined) {
@@ -162,7 +162,7 @@ export function evaluateCapsAgainstLedger(ledger, caps) {
         if (knownJobs > caps.maxJobs) {
             return {
                 ok: false,
-                message: `Stopped: ${knownJobs} measured billable jobs passed scenario.caps.maxJobs=${caps.maxJobs}.`,
+                message: `Stopped: ${knownJobs} measured billable jobs passed caps.maxJobs=${caps.maxJobs}.`,
             };
         }
     }

package/dist/routes/terminal/live-finish.js

@@ -9,7 +9,7 @@ import { normalizeLocalActorTranscript, TERMINAL_EVENTS_ARTIFACT, TERMINAL_LEDGE
 import { applyAdapterExtensionSeam } from "./adapter.js";
 import { buildLiveTerminalProductBundle } from "./bundle.js";
 import { buildCostLedger, buildNoSpendProof, describeMeasuredSpend, evaluateCapsAgainstLedger, noSpendLineMeasured, noSpendNotEstablished, } from "./ledger.js";
-import { foldScorerFailures, judgeExecution, judgeTerminal, OUTCOME_POLICIES, } from "../../run/judge.js";
+import { foldScorerFailures, judgeExecution, judgeTerminal, OUTCOME_POLICIES, resultOk, } from "../../run/judge.js";
 import { terminalExecutionFailures, terminalStudyResult, terminalParticipantFacts, } from "./result.js";
 import { parseTerminalTokenUsage } from "./token-usage.js";
 import { buildTerminalActorTrace, scrubSplitKnownValues, tailOf } from "./trace.js";
@@ -60,7 +60,7 @@ async function settleLiveLedgers(inputs, trace, normalizedTranscript) {
     // --- Spend ledger + no-spend proof + full caps enforcement (fail-closed). ---
     // The cost ledger is derived, with the null discipline: provider spend from the trace's
     // tokenUsage.costUsd when present (else null = not measured), product/media/payment null by
-    // default (core has no signal). The costProbe hook lets tests or adapters inject known
+    // default (core has no signal). The costProbe hook lets tests inject known
     // spend to exercise the fail-closed cap without a real billable run.
     const injectedLines = costProbe?.(trace.tokenUsage?.costUsd === undefined ? {} : { tokenCostUsd: trace.tokenUsage.costUsd });
     if (costProbe)
@@ -171,19 +171,24 @@ export async function finishLiveTerminalSession(inputs) {
     // The one final verdict fold: scoring can only make the judged verdict stricter.
     bundle.review = foldScorerFailures(bundle.review, scorer.failures);
     await validatePreparedRunArtifactPaths(runPaths);
-    const finished = await run.finish(bundle);
-    const observer = await finished.renderObserver();
-    await validatePreparedRunArtifactPaths(runPaths);
     // A failing agent is captured evidence on this route: only the execution and a declared scorer
-    // fail ok.
+    // fail ok. A declared scorer that did not render a pass (status:"fail", malformed or thrown) is a
+    // gate, so it fails ok as well as the persisted verdict.
+    const policy = OUTCOME_POLICIES.terminal;
     const execution = judgeExecution(terminalExecutionFailures({
         participant,
         capFailure,
         sessionReason: sanitize(session.reason),
         cleanup: session.cleanup,
-        observer,
-    }), OUTCOME_POLICIES.terminal);
-    const result = terminalStudyResult({
+    }), policy);
+    const finished = await run.finish(bundle, {
+        ok: resultOk({ judgment, execution, scorerFailures: scorer.failures, policy }),
+        execution,
+        policy,
+    });
+    const observer = await finished.renderObserver();
+    await validatePreparedRunArtifactPaths(runPaths);
+    return terminalStudyResult({
         cwd,
         studyId: plan.studyId,
         actorId: plan.actor,
@@ -199,13 +204,10 @@ export async function finishLiveTerminalSession(inputs) {
         noSpendProof,
         capFailure,
         declaredScorerFailure: scorer.failures[0],
-        judgment,
-        execution,
+        ok: finished.outcome.ok,
         observer,
         warnings,
     });
-    await finished.recordOutcome({ ok: result.ok, execution });
-    return result;
 }
 /** Persist the terminal evidence: redacted events, normalized transcript, ledgers, actor trace. */
 async function writeTerminalEvidence(runPaths, evidence) {

package/dist/routes/terminal/plan.js

@@ -35,7 +35,7 @@ export function planTerminalStudy(config, input) {
     const actorType = config.actors[0]?.type ?? "";
     const descriptor = actorRegistry[actorType];
     if (!descriptor || !isTerminalActorDescriptor(descriptor))
-        return refuse("HUMANISH_TERMINAL_ACTOR_UNSUPPORTED", `actors[0].type "${actorType}" is not a registered terminal actor.`);
+        return refuse("HUMANISH_TERMINAL_ACTOR_UNSUPPORTED", `actor.type "${actorType}" is not a registered terminal actor.`);
     const runtimeVersion = config.execution?.runtime?.version;
     const actor = config.actors[0];
     if ((config.execution?.runtime !== undefined && !isExactRuntimeVersion(runtimeVersion)) ||
@@ -87,14 +87,14 @@ export function planTerminalStudy(config, input) {
     const maxUsd = caps?.maxUsd;
     const maxMinutes = caps?.maxMinutes;
     if (caps === undefined || maxUsd === undefined || maxMinutes === undefined || maxMinutes <= 0)
-        return refuse("HUMANISH_TERMINAL_CAPS_MISSING", "A live terminal-product run gives the agent in the sandbox access to a model provider, so it needs a cap: set scenario.caps with maxUsd (0 means no spend) and a positive maxMinutes (the time limit for the codex command). The key is used only while the cap is in force.", descriptor.id);
+        return refuse("HUMANISH_TERMINAL_CAPS_MISSING", "A live terminal-product run gives the agent in the sandbox access to a model provider, so it needs a cap: set caps with maxUsd (0 means no spend) and a positive maxMinutes (the time limit for the codex command). The key is used only while the cap is in force.", descriptor.id);
     // maxUsd is checked against the cost ledger after the session, and only known lines can trip it.
     // The ledger's provider line takes only provider-reported cost, which Codex does not report (the
     // token estimate in run.json is not a measurement), and core has no product, media or payment
     // signal, so without a costProbe every line is null and a positive maxUsd could never trip. That
     // cap would promise a bound nothing enforces, so it is refused; maxMinutes bounds a live run.
     if (maxUsd > 0 && input.hasCostProbe !== true)
-        return refuse("HUMANISH_TERMINAL_UNPRICED_CAP", `scenario.caps.maxUsd=${maxUsd} cannot be enforced: Codex reports no provider cost for the participant (its token cost is only estimated after the run) and no product, media or payment spend is measured, so a positive dollar cap can never trip. Set scenario.caps.maxUsd to 0 and bound the run with scenario.caps.maxMinutes, the codex command's wall-clock kill. No sandbox was created and the runtime key was not used.`, descriptor.id);
+        return refuse("HUMANISH_TERMINAL_UNPRICED_CAP", `caps.maxUsd=${maxUsd} cannot be enforced: Codex reports no provider cost for the participant (its token cost is only estimated after the run) and no product, media or payment spend is measured, so a positive dollar cap can never trip. Set caps.maxUsd to 0 and bound the run with caps.maxMinutes, the codex command's wall-clock kill. No sandbox was created and the runtime key was not used.`, descriptor.id);
     // The sandbox's timeout covers the steps before the codex command, maxMinutes and the teardown
     // buffer, and E2B refuses a sandbox over an hour. Refuse here, with the arithmetic, rather than
     // after the plan prints, from a provider 400 that names neither knob.
@@ -102,7 +102,7 @@ export function planTerminalStudy(config, input) {
     const sandboxTimeoutMs = terminalSandboxTimeoutMs({ maxMinutes, productInstall });
     if (sandboxTimeoutMs > MAX_SANDBOX_MS) {
         const headroomMinutes = (sandboxTimeoutMs - maxMinutes * 60_000) / 60_000;
-        return refuse("HUMANISH_TERMINAL_CAPS_INVALID", `scenario.caps.maxMinutes ${maxMinutes} derives a ${sandboxTimeoutMs / 60_000}m sandbox deadline, and a sandbox may not live longer than ${MAX_SANDBOX_MS / 60_000}m. The deadline is maxMinutes plus ${headroomMinutes}m: the Node bootstrap (${NODE_BOOTSTRAP_TIMEOUT_MS / 60_000}m), the runtime version check (${TERMINAL_RUNTIME_VERSION_TIMEOUT_MS / 60_000}m)${productInstall ? `, the product setup (${PRODUCT_SETUP_TIMEOUT_MS / 60_000}m)` : ""} and the teardown buffer (${TERMINAL_SANDBOX_TIMEOUT_BUFFER_MS / 60_000}m). Lower scenario.caps.maxMinutes to at most ${MAX_SANDBOX_MS / 60_000 - headroomMinutes}. No sandbox was created and the runtime key was not used.`, descriptor.id);
+        return refuse("HUMANISH_TERMINAL_CAPS_INVALID", `caps.maxMinutes ${maxMinutes} derives a ${sandboxTimeoutMs / 60_000}m sandbox deadline, and a sandbox may not live longer than ${MAX_SANDBOX_MS / 60_000}m. The deadline is maxMinutes plus ${headroomMinutes}m: the Node bootstrap (${NODE_BOOTSTRAP_TIMEOUT_MS / 60_000}m), the runtime version check (${TERMINAL_RUNTIME_VERSION_TIMEOUT_MS / 60_000}m)${productInstall ? `, the product setup (${PRODUCT_SETUP_TIMEOUT_MS / 60_000}m)` : ""} and the teardown buffer (${TERMINAL_SANDBOX_TIMEOUT_BUFFER_MS / 60_000}m). Lower caps.maxMinutes to at most ${MAX_SANDBOX_MS / 60_000 - headroomMinutes}. No sandbox was created and the runtime key was not used.`, descriptor.id);
     }
     return {
         ok: true,

package/dist/routes/terminal/result.d.ts

@@ -1,6 +1,6 @@
 import type { ObserverResult } from "../../observer/render.js";
 import type { ActorCompletionReason, ActorStatus, ActorTrace } from "../../actors/contract.js";
-import { type ExecutionFailure, type ExecutionOutcome, type Judgment, type ParticipantFacts } from "../../run/judge.js";
+import { type ExecutionFailure, type ParticipantFacts } from "../../run/judge.js";
 import { type NoSpendProof, type TerminalCostLedger, type TerminalLedgers, type TerminalProductStudyResult } from "./types.js";
 /**
  * What judge.ts reads from a finished terminal session, after a blown cap has overridden it. It has
@@ -8,8 +8,9 @@ import { type NoSpendProof, type TerminalCostLedger, type TerminalLedgers, type
  */
 export declare function terminalParticipantFacts(trace: ActorTrace, sessionError: string | undefined): ParticipantFacts;
 /**
- * The live run's execution failures: a harness error, a blown spend cap, an unproven sandbox
- * teardown, and an Observer that failed.
+ * The live run's execution failures before the Observer renders: a harness error, a blown spend
+ * cap and an unproven sandbox teardown. FinishedRun.renderObserver adds an Observer that did not
+ * render.
  */
 export declare function terminalExecutionFailures(args: {
     participant: ParticipantFacts;
@@ -18,7 +19,6 @@ export declare function terminalExecutionFailures(args: {
     /** Already scrubbed and redacted. */
     sessionReason: string;
     cleanup: TerminalLedgers["cleanup"];
-    observer: Pick<ObserverResult, "ok" | "error">;
 }): ExecutionFailure[];
 /** The terminal-product study result for a live run, from its session, cleanup and cost ledger. */
 export declare function terminalStudyResult(args: {
@@ -39,9 +39,8 @@ export declare function terminalStudyResult(args: {
     /** The cap check's message when known spend or jobs exceeded the caps. */
     capFailure: string | undefined;
     declaredScorerFailure: string | undefined;
-    /** The run's judgment. On this evidence route ok does not read whether the agent passed. */
-    judgment: Judgment;
-    execution: ExecutionOutcome;
+    /** run.json's outcome.ok (FinishedRun.outcome). On this evidence route it does not read whether the agent passed. */
+    ok: boolean;
     observer: ObserverResult;
     warnings: string[];
 }): TerminalProductStudyResult;

package/dist/routes/terminal/result.js

@@ -1,4 +1,4 @@
-import { OUTCOME_POLICIES, participantHarnessFailed, resultOk, } from "../../run/judge.js";
+import { participantHarnessFailed, } from "../../run/judge.js";
 import {} from "./types.js";
 import { studyResultIdentity } from "../../run/study-result.js";
 /**
@@ -16,11 +16,12 @@ export function terminalParticipantFacts(trace, sessionError) {
     };
 }
 /**
- * The live run's execution failures: a harness error, a blown spend cap, an unproven sandbox
- * teardown, and an Observer that failed.
+ * The live run's execution failures before the Observer renders: a harness error, a blown spend
+ * cap and an unproven sandbox teardown. FinishedRun.renderObserver adds an Observer that did not
+ * render.
  */
 export function terminalExecutionFailures(args) {
-    const { participant, cleanup, observer } = args;
+    const { participant, cleanup } = args;
     return [
         ...(participantHarnessFailed(participant)
             ? [{ kind: "harness", message: participant.sessionError ?? args.sessionReason }]
@@ -34,34 +35,17 @@ export function terminalExecutionFailures(args) {
                     message: `Sandbox teardown unproven (killed=${cleanup.killed}, remaining=${cleanup.remaining}): ${cleanup.reason}`,
                 },
             ]),
-        ...(observer.ok
-            ? []
-            : [
-                {
-                    kind: "evidence",
-                    message: observer.error?.message ?? "Observer failed for the terminal-product run.",
-                },
-            ]),
     ];
 }
 /** The terminal-product study result for a live run, from its session, cleanup and cost ledger. */
 export function terminalStudyResult(args) {
-    const { cwd, studyId, actorId, productName, runId, sessionStatus, completionReason, sessionReason, sessionError, sandboxId, cleanup, cost, noSpendProof, capFailure, declaredScorerFailure, judgment, execution, observer, warnings, } = args;
+    const { cwd, studyId, actorId, productName, runId, sessionStatus, completionReason, sessionReason, sessionError, sandboxId, cleanup, cost, noSpendProof, capFailure, declaredScorerFailure, ok, observer, warnings, } = args;
     // The run's exit code: verified evidence, no harness error and proven cleanup. A blocked/
     // timed-out agent run is still ok-as-evidence at the bundle level (the failure is the evidence),
     // but the study result surfaces ok:false on a harness error or unproven teardown (fail-closed).
     // remaining===0 is the by-id-confirmed-reclaimed state; remaining===1 (still present) and
     // remaining===-1 (kill(id) itself failed) are both unproven by design.
     const cleanupProven = cleanup.killed && cleanup.remaining === 0;
-    // A config-declared scorer that failed to render a pass (status:"fail" / malformed / throw) fails the
-    // run result as well as the persisted verdict: the keystone route's declared rubric is a gate, so
-    // its fail must drive exit code. Library callers never set this (additive, back-compat).
-    const ok = resultOk({
-        judgment,
-        execution,
-        scorerFailures: declaredScorerFailure === undefined ? [] : [declaredScorerFailure],
-        policy: OUTCOME_POLICIES.terminal,
-    });
     return {
         ...studyResultIdentity("terminal", studyId),
         ok,

package/dist/routes/terminal/session.js

@@ -20,7 +20,7 @@ export function checkLiveTerminalMachine(plan, input, warnings) {
     const { maxUsd } = plan.caps;
     // planTerminalStudy refuses a positive maxUsd without a costProbe, so one is present here.
     if (maxUsd > 0) {
-        warnings.push(`scenario.caps.maxUsd=${maxUsd} is checked after the session against the lines the costProbe measures; lines it leaves null (unmeasured) never trip it. scenario.caps.maxMinutes bounds the run while it runs.`);
+        warnings.push(`caps.maxUsd=${maxUsd} is checked after the session against the measured cost lines; a line left null (unmeasured) never trips it. caps.maxMinutes bounds the run while it runs.`);
     }
     // --- Deny-by-default credentials: build the command-scoped allowlist. ---
     const runtimeEnv = buildRuntimeAuth({ runtimeAuth: plan.runtime.auth, env });

package/dist/run/bundle-shape.d.ts

@@ -1,6 +1,8 @@
-import { type ReviewSummary, type RunAdapterScore, type RunBundle } from "./bundle.js";
+import { type ReviewSummary, type RunAdapterScore, type RunBundle, type RunOutcome } from "./bundle.js";
 import { type StoredCleanupResult, type RunPointer } from "./results.js";
 export declare function isRunBundle(value: unknown): value is RunBundle;
+/** run.json's `outcome`: a finished run's ok and execution outcome, or the signal that stopped it. */
+export declare function isRunOutcome(value: unknown): value is RunOutcome;
 export declare function isCleanupResult(value: unknown): value is StoredCleanupResult;
 export declare function isRunAdapterScore(value: unknown): value is RunAdapterScore;
 export declare const ARCHIVE_SHA256_PATTERN: RegExp;

package/dist/run/bundle-shape.js

@@ -5,6 +5,7 @@ import { CLEANUP_SCHEMA, } from "./results.js";
 import { isRunSimulationStatus, isRunStream, isRunStreamKind } from "./stream-shape.js";
 import { isLocalEvidenceArtifactPath } from "./paths.js";
 import { isRunFeedbackCandidate } from "./feedback-shape.js";
+import { EXECUTION_FAILURE_KINDS } from "./judge.js";
 import { isSharedWorldEvidence } from "./shared-world-shape.js";
 import { isNonNegativeSafeInteger, isPositiveSafeInteger, isRecord } from "./type-guards.js";
 export function isRunBundle(value) {
@@ -64,7 +65,30 @@ export function isRunBundle(value) {
                 value.adapterArtifacts.every(isRunAdapterArtifact))) &&
         (value.providerResources === undefined ||
             (Array.isArray(value.providerResources) &&
-                value.providerResources.every(isRunProviderResource))));
+                value.providerResources.every(isRunProviderResource))) &&
+        (value.outcome === undefined || isRunOutcome(value.outcome)));
+}
+function isExecutionFailureList(value) {
+    return (Array.isArray(value) &&
+        value.every((failure) => isRecord(failure) &&
+            typeof failure.kind === "string" &&
+            EXECUTION_FAILURE_KINDS.includes(failure.kind) &&
+            typeof failure.message === "string"));
+}
+/** run.json's `outcome`: a finished run's ok and execution outcome, or the signal that stopped it. */
+export function isRunOutcome(value) {
+    if (!isRecord(value))
+        return false;
+    if (value.state === "interrupted")
+        return (value.ok === false &&
+            (value.signal === "SIGINT" || value.signal === "SIGTERM" || value.signal === "SIGHUP") &&
+            typeof value.at === "string");
+    return (value.state === "finished" &&
+        typeof value.ok === "boolean" &&
+        isRecord(value.execution) &&
+        typeof value.execution.succeeded === "boolean" &&
+        isExecutionFailureList(value.execution.failures) &&
+        (value.execution.warnings === undefined || isExecutionFailureList(value.execution.warnings)));
 }
 function isRunProviderResource(value) {
     return (isRecord(value) &&

package/dist/run/bundle.d.ts

@@ -1,7 +1,9 @@
 import type { CommsReceivingEvidence } from "../comms/receiving-types.js";
 import { type CapturedGitState } from "./git-state.js";
+import type { ExecutionOutcome } from "./judge.js";
 import type { SharedWorldEvidence } from "./shared-world-evidence.js";
 import { type RunStudyProvenance } from "./study-provenance.js";
+import type { RunInterruptSignal } from "./status.js";
 import type { RunSimulationStatus, RunStream, RunStreamKind } from "./streams.js";
 export declare const RUN_BUNDLE_SCHEMA = "humanish.run-bundle.v1";
 /** The run bundle file, relative to the run directory. */
@@ -252,6 +254,13 @@ export interface RunBundle {
         events: string;
     };
     review: ReviewSummary;
+    /**
+     * How the run ended as an execution. `review.verdict` is what the participants experienced;
+     * this is whether the run worked, which no surface may show as a pass when `ok` is false. Absent
+     * while the run is in progress, when its process died without writing it, and on runs recorded
+     * before this field, whose status.json holds the outcome instead.
+     */
+    outcome?: RunOutcome;
     feedbackCandidates: RunFeedbackCandidate[];
     /** Structured subject provenance. Optional and additive: emitted by the
      * computer-use and shared-world backends and the clone scripted-browser route; tolerated absent
@@ -347,6 +356,21 @@ export interface RunBundle {
      */
     cost?: RunCostSummary;
 }
+/**
+ * How a run ended. `finished`: Run.finish published the final bundle with the route result's `ok`
+ * and its execution outcome (`judgeExecution` in src/run/judge.ts). `interrupted`: the CLI's signal
+ * handler stopped the run before it finished; run.json is then the last live flush.
+ */
+export type RunOutcome = {
+    state: "finished";
+    ok: boolean;
+    execution: ExecutionOutcome;
+} | {
+    state: "interrupted";
+    ok: false;
+    signal: RunInterruptSignal;
+    at: string;
+};
 /**
  * One contributing cost line of a RunCostSummary. A line is present even when it cannot be priced
  * (it records that we tried and could not): an unpriceable line carries estimatedCostUsd: null + a

package/dist/run/display.d.ts

@@ -0,0 +1,59 @@
+import type { RunOutcome } from "./bundle.js";
+import type { ExecutionFailure } from "./judge.js";
+import { type RunLiveness } from "./status.js";
+/** The states a run is shown in. */
+export type RunDisplayState = "running" | "interrupted" | "passed" | "failed" | "blocked" | "timed_out" | "no_verdict" | "dry_run" | "unknown";
+/** A run as a surface shows it. */
+export interface RunDisplay {
+    state: RunDisplayState;
+    /** The state in words: "passed", "timed out", "no verdict". */
+    label: string;
+    /** How a surface colors it: `pass` only for `passed`, `fail` only for `failed`. */
+    tone: "pass" | "fail" | "warn" | "live" | "neutral";
+    /** The first execution failure that failed the run, as `kind: message`. */
+    reason?: string;
+}
+/** What runDisplay reads: whether the run is alive, what its participants experienced, and its ok. */
+export interface RunDisplayFacts {
+    liveness: RunLiveness;
+    mode?: string | null | undefined;
+    /** `review.verdict`. */
+    verdict?: string | undefined;
+    /** The run's own ok from run.json's outcome; absent when the run recorded none. */
+    ok?: boolean | undefined;
+    /** The first execution failure that failed the run. */
+    failure?: ExecutionFailure | undefined;
+}
+/**
+ * A run's state. A live or interrupted run is that, whatever its last flush said. A finished run
+ * shows its participants' blocked, timed-out or failed verdict; otherwise a run whose ok is false
+ * is failed, even with a pass verdict, because its execution failed. Only then does a pass verdict
+ * show as passed.
+ */
+export declare function runDisplay(facts: RunDisplayFacts): RunDisplay;
+/** A state in words: "passed", "timed out", "no verdict". */
+export declare function runDisplayLabel(state: RunDisplayState): string;
+/** What bundleDisplayFacts reads from run.json; a listing reads it from an unchecked file. */
+export interface DisplayedBundle {
+    runId: string;
+    mode?: string | undefined;
+    review?: {
+        verdict?: string | undefined;
+    } | undefined;
+    simulations?: ReadonlyArray<{
+        status?: string | undefined;
+    } | undefined> | undefined;
+    outcome?: RunOutcome | undefined;
+}
+/**
+ * The facts for a run from its bundle. run.json's `outcome` decides when it has one. A bundle
+ * without one is in progress, or was recorded before the field existed: its status record, when
+ * given and naming the run, then says whether the run is alive and, for the older run, holds its ok.
+ * With no record, a bundle whose simulations are still running is live.
+ */
+export declare function bundleDisplayFacts(bundle: DisplayedBundle, status?: unknown, nowMs?: number): RunDisplayFacts;
+/**
+ * How review.md says the run ended: the display of the bundle it is rendered from, so a run whose
+ * execution failed never reads as a pass beside its participants' verdict.
+ */
+export declare function reviewOutcome(bundle: DisplayedBundle): string;

package/dist/run/display.js

@@ -0,0 +1,106 @@
+// How a run reads wherever a surface says whether it passed: the TUI, the Observer and its run
+// library, `humanish runs`, `humanish stats` and review.md. Each of them calls runDisplay with the
+// same facts, so a run whose own ok is false shows as a pass on none of them, and two surfaces
+// cannot disagree about one run.
+import { classifyRunStatus, isRunStatusRecord } from "./status.js";
+const LABELS = {
+    running: "running",
+    interrupted: "interrupted",
+    passed: "passed",
+    failed: "failed",
+    blocked: "blocked",
+    timed_out: "timed out",
+    no_verdict: "no verdict",
+    dry_run: "dry run",
+    unknown: "unknown",
+};
+const TONES = {
+    running: "live",
+    interrupted: "warn",
+    passed: "pass",
+    failed: "fail",
+    blocked: "warn",
+    timed_out: "warn",
+    no_verdict: "warn",
+    dry_run: "neutral",
+    unknown: "neutral",
+};
+function shown(state, reason) {
+    return {
+        state,
+        label: LABELS[state],
+        tone: TONES[state],
+        ...(reason === undefined ? {} : { reason }),
+    };
+}
+/**
+ * A run's state. A live or interrupted run is that, whatever its last flush said. A finished run
+ * shows its participants' blocked, timed-out or failed verdict; otherwise a run whose ok is false
+ * is failed, even with a pass verdict, because its execution failed. Only then does a pass verdict
+ * show as passed.
+ */
+export function runDisplay(facts) {
+    if (facts.liveness === "running")
+        return shown("running");
+    if (facts.liveness === "interrupted")
+        return shown("interrupted");
+    const reason = facts.ok === false && facts.failure !== undefined
+        ? `${facts.failure.kind}: ${facts.failure.message}`
+        : undefined;
+    if (facts.verdict === "blocked")
+        return shown("blocked", reason);
+    if (facts.verdict === "timed_out")
+        return shown("timed_out", reason);
+    if (facts.verdict === "fail" || facts.ok === false)
+        return shown("failed", reason);
+    if (facts.verdict === "pass")
+        return shown("passed");
+    if (facts.verdict === "contract_proof_only")
+        return shown(facts.mode === "dry-run" ? "dry_run" : "no_verdict");
+    return shown("unknown");
+}
+/** A state in words: "passed", "timed out", "no verdict". */
+export function runDisplayLabel(state) {
+    return LABELS[state];
+}
+/** A display as one line of text: the label, then why the run failed when it says. */
+function runDisplayLine(display) {
+    return display.reason === undefined ? display.label : `${display.label}: ${display.reason}`;
+}
+/**
+ * The facts for a run from its bundle. run.json's `outcome` decides when it has one. A bundle
+ * without one is in progress, or was recorded before the field existed: its status record, when
+ * given and naming the run, then says whether the run is alive and, for the older run, holds its ok.
+ * With no record, a bundle whose simulations are still running is live.
+ */
+export function bundleDisplayFacts(bundle, status, nowMs = Date.now()) {
+    const base = { mode: bundle.mode, verdict: bundle.review?.verdict };
+    const outcome = bundle.outcome;
+    if (outcome?.state === "interrupted")
+        return { ...base, liveness: "interrupted" };
+    if (outcome?.state === "finished")
+        return {
+            ...base,
+            liveness: "finished",
+            ok: outcome.ok,
+            failure: outcome.execution.failures[0],
+        };
+    if (isRunStatusRecord(status) && status.runId === bundle.runId)
+        return {
+            ...base,
+            liveness: classifyRunStatus(status, nowMs),
+            ...(typeof status.outcome?.ok === "boolean" ? { ok: status.outcome.ok } : {}),
+            ...(status.outcome?.execution?.failures[0] === undefined
+                ? {}
+                : { failure: status.outcome.execution.failures[0] }),
+        };
+    const inProgress = (bundle.simulations ?? []).some((simulation) => simulation?.status === "running");
+    return { ...base, liveness: inProgress ? "running" : "finished" };
+}
+/**
+ * How review.md says the run ended: the display of the bundle it is rendered from, so a run whose
+ * execution failed never reads as a pass beside its participants' verdict.
+ */
+export function reviewOutcome(bundle) {
+    return runDisplayLine(runDisplay(bundleDisplayFacts(bundle)));
+}

package/dist/run/dry-run.js

@@ -10,6 +10,7 @@ import { participantEvent, participantIdsOf, participantRecord, participantStrea
 import { implicitProjectDirectoryExists, readPackageName, validateCwd } from "./project.js";
 import { loadDryRunInputs } from "./dry-run-inputs.js";
 import { judgeExecution, judgePreview, OUTCOME_POLICIES, resultOk, verdictText, } from "./judge.js";
+import { reviewOutcome } from "./display.js";
 /**
  * The preview route's run. The run scope closes the run it started on every exit, including
  * the fail-closed ones. It renders an Observer only when `options.observer` asks for one.
@@ -123,16 +124,17 @@ async function runDryRunInScope(options, scope) {
         review: createReviewSummary(judgment.verdict),
         feedbackCandidates: [],
     };
-    const finished = await run.finish(bundle);
-    const observer = options.observer === undefined ? undefined : await renderPreviewObserver(finished, warnings);
     // The preview's policy keeps an Observer that did not render a warning: the bundle is still
     // evidence, and `export` can render it later.
     const policy = OUTCOME_POLICIES.preview;
-    const execution = judgeExecution(observer === undefined || observer.ok
-        ? []
-        : [{ kind: "evidence", message: observer.error?.message ?? "render failed" }], policy);
-    const ok = resultOk({ judgment, execution, scorerFailures: [], policy });
-    await finished.recordOutcome({ ok, execution });
+    const execution = judgeExecution([], policy);
+    const finished = await run.finish(bundle, {
+        ok: resultOk({ judgment, execution, scorerFailures: [], policy }),
+        execution,
+        policy,
+    });
+    const observer = options.observer === undefined ? undefined : await renderPreviewObserver(finished, warnings);
+    const { ok } = finished.outcome;
     return {
         schema: "humanish.run-result.v1",
         ok,
@@ -175,6 +177,8 @@ Mode: ${bundle.mode}
 
 Verdict: ${verdictText(bundle.review.verdict, bundle.mode)}
 
+Outcome: ${reviewOutcome(bundle)}
+
 ${bundle.review.summary}
 
 ## Public-Safety

package/dist/run/judge.d.ts

@@ -91,8 +91,9 @@ export interface Judgment {
 }
 /** The judgment for a verdict: a run passes when its verdict is pass, and a dry run passes. */
 export declare function judgmentOf(verdict: Verdict, dryRun: boolean): Judgment;
-/** What kind of execution failure a run recorded. */
-type ExecutionFailureKind = "harness" | "provider-cleanup" | "provider-policy" | "sandbox-cleanup" | "evidence" | "cap" | "run";
+/** The kinds of execution failure a run records. */
+export declare const EXECUTION_FAILURE_KINDS: readonly ["harness", "provider-cleanup", "provider-policy", "sandbox-cleanup", "evidence", "cap", "run"];
+type ExecutionFailureKind = (typeof EXECUTION_FAILURE_KINDS)[number];
 /** One way the run failed as an execution. The message is scrubbed; status.json shows it. */
 export interface ExecutionFailure {
     kind: ExecutionFailureKind;

package/dist/run/judge.js

@@ -108,6 +108,16 @@ export function verdictForStatus(status) {
 export function judgmentOf(verdict, dryRun) {
     return { verdict, passed: dryRun || verdict === "pass" };
 }
+/** The kinds of execution failure a run records. */
+export const EXECUTION_FAILURE_KINDS = [
+    "harness",
+    "provider-cleanup",
+    "provider-policy",
+    "sandbox-cleanup",
+    "evidence",
+    "cap",
+    "run",
+];
 /**
  * The execution failure for one sandbox whose release is unconfirmed. `warning` is the route's
  * release warning, already scrubbed. `recovery` says how to release it by hand; without one,

package/dist/run/pricing.js

@@ -101,7 +101,7 @@ const DESKTOP_RESOURCE_RATE = {
  * since an npm install cannot edit this file.
  */
 export function unpricedCapMessage(model) {
-    return `execution.caps sets a spend cap (maxUsd or maxTotalUsd), but humanish has no rate for model "${model}", so it cannot enforce the cap and refuses to start. Priced models: ${Object.keys(MODEL_RATES).sort().join(", ")}. Use one of them, or remove maxUsd and maxTotalUsd to run without a cap.`;
+    return `caps sets a spend cap (maxUsd or maxTotalUsd), but humanish has no rate for model "${model}", so it cannot enforce the cap and refuses to start. Priced models: ${Object.keys(MODEL_RATES).sort().join(", ")}. Use one of them, or remove maxUsd and maxTotalUsd to run without a cap.`;
 }
 export const DESKTOP_RATE = {
     usdPerMinute: 0.00888,

package/dist/run/projection.d.ts

@@ -99,8 +99,6 @@ export declare function listWindow(args: {
     start: number;
     end: number;
 };
-/** The label for a run's state, in the register the surfaces share. */
-export declare function livenessLabel(entry: Pick<RunIndexEntry, "liveness" | "verdict">): string;
 /** A study as the study list shows it: what is declared, joined to what actually happened. */
 export interface StudyRow {
     /**