humanish 0.110.0 → 0.110.2

package/dist/verify/liveness.d.ts

@@ -1,7 +1,23 @@
 import type { RunBundle } from "../run/bundle.js";
 import type { PreparedRunArtifactPaths } from "../run/paths.js";
+/** What verify can say about a run that is not finished. */
+export interface UnfinishedRun {
+    liveness: "running" | "interrupted";
+    /**
+     * clean: the run's reclaim receipt records every sandbox gone and a finished search of E2B by
+     * the run's tags. unconfirmed: it records a sandbox not confirmed gone, or the run journaled one
+     * it does not cover. unknown: there is no reclaim receipt, or it records no finished tag search
+     * (written by humanish 0.110.0 or earlier, or by a reclaim that did not finish), so a sandbox whose
+     * id never reached a receipt could still run.
+     */
+    sandboxes: "clean" | "unconfirmed" | "unknown";
+}
 /**
- * One warning when the run is not finished, by the run index's rule: its status record when it
- * has a usable one, else a participant still `running` in its bundle's `simulations[]`. Empty for a finished run.
+ * One warning, and the unfinished-run facts, when the run is not finished, by the run index's
+ * rule: its status record when it has a usable one, else a participant still `running` in its
+ * bundle's `simulations[]`. Nothing for a finished run.
  */
-export declare function runNotFinishedWarnings(runPaths: PreparedRunArtifactPaths, bundle: RunBundle, nowMs?: number): Promise<string[]>;
+export declare function runNotFinished(runPaths: PreparedRunArtifactPaths, bundle: RunBundle, nowMs?: number): Promise<{
+    warnings: string[];
+    unfinished?: UnfinishedRun;
+}>;

package/dist/verify/liveness.js

@@ -1,6 +1,7 @@
-// `humanish verify`'s RUN_NOT_FINISHED warning. Verify checks the integrity of what a run wrote,
-// and a run killed mid-way leaves an in-progress bundle that passes those checks. The warning says
-// what verify saw on disk, so `ok: true` is not read as "the run finished". It never flips `ok`.
+// `humanish verify`'s RUN_NOT_FINISHED warning and the unfinished-run facts its one-line output
+// leads with. Verify checks the integrity of what a run wrote, and a run killed mid-way leaves an
+// in-progress bundle that passes those checks. The warning says what verify saw on disk, so
+// `ok: true` is not read as "the run finished" or "its sandboxes stopped". It never flips `ok`.
 import { sandboxIdDigest } from "../evidence/redaction.js";
 import path from "node:path";
 import { readRunJsonIfExists, readRunTextIfExists } from "../run/locate.js";
@@ -9,19 +10,22 @@ import { RECLAIM_RECEIPT_ARTIFACT } from "../run/reclaim.js";
 import { runLiveness } from "../run/run-index.js";
 import { parseSandboxReceipts, SANDBOX_RECEIPTS_ARTIFACT } from "../run/sandbox-receipts.js";
 import { RUN_STATUS_FILE } from "../run/status.js";
+import { plural } from "../run/text.js";
+import { cli } from "../cli/invocation.js";
 /** The stable code every RUN_NOT_FINISHED warning starts with. */
 const RUN_NOT_FINISHED = "RUN_NOT_FINISHED";
 const GONE_STATES = new Set(["killed", "already-gone"]);
 /**
- * One warning when the run is not finished, by the run index's rule: its status record when it
- * has a usable one, else a participant still `running` in its bundle's `simulations[]`. Empty for a finished run.
+ * One warning, and the unfinished-run facts, when the run is not finished, by the run index's
+ * rule: its status record when it has a usable one, else a participant still `running` in its
+ * bundle's `simulations[]`. Nothing for a finished run.
  */
-export async function runNotFinishedWarnings(runPaths, bundle, nowMs = Date.now()) {
+export async function runNotFinished(runPaths, bundle, nowMs = Date.now()) {
     const runId = path.basename(runPaths.absoluteRunRoot);
     const status = await readRunJsonIfExists(runPaths, RUN_STATUS_FILE);
     const { liveness, record } = runLiveness(runId, status, bundle, nowMs);
     if (liveness === "finished")
-        return [];
+        return { warnings: [] };
     const seen = [];
     if (record === undefined) {
         const running = bundle.simulations.filter((simulation) => simulation.status === "running");
@@ -39,30 +43,48 @@ export async function runNotFinishedWarnings(runPaths, bundle, nowMs = Date.now(
     const runningStreams = bundle.streams.filter((stream) => stream.status === "running").length;
     seen.push(`${runningStreams} of ${bundle.streams.length} streams are still running`);
     const reclaim = await reclaimState(runPaths, runId);
-    return [
-        `${RUN_NOT_FINISHED}: ${seen.join("; ")}.${reclaim === "" ? "" : ` ${reclaim}`} Verify ok covers the integrity of what was written; it does not mean the run finished.`,
-    ];
+    return {
+        warnings: [
+            `${RUN_NOT_FINISHED}: ${seen.join("; ")}. ${reclaim.text} Verify ok covers the integrity of what was written; it does not mean the run finished.`,
+        ],
+        unfinished: { liveness, sandboxes: reclaim.sandboxes },
+    };
 }
-/** What the reclaim receipt says about the sandboxes this run journaled, or what to run. */
+/** What the reclaim receipt says about this run's sandboxes, and what to run. */
 async function reclaimState(runPaths, runId) {
     const journal = await readRunTextIfExists(runPaths, SANDBOX_RECEIPTS_ARTIFACT);
     // Matched by digest: a reclaim receipt names each sandbox by digest, and one written before it
     // did holds the raw id, which is digested here.
     const journaled = new Set((journal === null ? [] : parseSandboxReceipts(journal)).map((receipt) => sandboxIdDigest(receipt.sandboxId)));
-    const receipt = await readRunJsonIfExists(runPaths, RECLAIM_RECEIPT_ARTIFACT);
-    const outcomes = reclaimOutcomes(receipt, runId);
-    if (outcomes !== undefined) {
-        const gone = outcomes.filter((outcome) => GONE_STATES.has(outcome.state)).length;
-        const reclaimed = new Set(outcomes.map((outcome) => outcome.digest));
-        const missing = [...journaled].filter((id) => !reclaimed.has(id)).length;
-        return `${RECLAIM_RECEIPT_ARTIFACT} records ${gone} of ${outcomes.length} sandboxes gone${missing === 0 ? "" : `, and ${missing} journaled sandboxes are not in it`}.`;
-    }
-    if (journaled.size === 0)
-        return "";
-    return `It has no ${RECLAIM_RECEIPT_ARTIFACT}; \`humanish reclaim --run ${runId}\` stops the ${journaled.size} sandboxes it journaled.`;
+    const command = `\`${cli(`reclaim --run ${runId}`)}\``;
+    const receipt = reclaimReceipt(await readRunJsonIfExists(runPaths, RECLAIM_RECEIPT_ARTIFACT), runId);
+    if (receipt === undefined)
+        return {
+            sandboxes: "unknown",
+            text: `Sandboxes unknown: it has no ${RECLAIM_RECEIPT_ARTIFACT} and journaled ${plural(journaled.size, "sandbox", "sandboxes")}; ${command} stops those and searches E2B by this run's tags for any whose id never reached a receipt.`,
+        };
+    const { outcomes } = receipt;
+    const gone = outcomes.filter((outcome) => GONE_STATES.has(outcome.state)).length;
+    const reclaimed = new Set(outcomes.map((outcome) => outcome.digest));
+    const missing = [...journaled].filter((id) => !reclaimed.has(id)).length;
+    const recorded = `${RECLAIM_RECEIPT_ARTIFACT} records ${gone} of ${outcomes.length} sandboxes gone${missing === 0 ? "" : `, and ${missing} journaled sandboxes are not in it`}`;
+    if (gone < outcomes.length || missing > 0)
+        return {
+            sandboxes: "unconfirmed",
+            text: `Sandboxes unconfirmed: ${recorded}; ${command} retries.`,
+        };
+    if (receipt.state === "clean")
+        return {
+            sandboxes: "clean",
+            text: `Sandboxes clean: ${recorded}, and E2B listed none still tagged with this run.`,
+        };
+    return {
+        sandboxes: "unknown",
+        text: `Sandboxes unknown: ${recorded}, but it records no finished search of E2B by this run's tags; ${command} searches.`,
+    };
 }
-/** The outcomes of a reclaim receipt written for this run, or undefined when there is none. */
-function reclaimOutcomes(receipt, runId) {
+/** A reclaim receipt written for this run, or undefined when there is none. */
+function reclaimReceipt(receipt, runId) {
     if (!isRecord(receipt) || receipt.runId !== runId || !Array.isArray(receipt.outcomes))
         return undefined;
     const outcomes = [];
@@ -75,5 +97,5 @@ function reclaimOutcomes(receipt, runId) {
         const digest = typeof recorded === "string" ? recorded : sandboxIdDigest(sandboxId);
         outcomes.push({ digest, state });
     }
-    return outcomes;
+    return typeof receipt.state === "string" ? { state: receipt.state, outcomes } : { outcomes };
 }

package/dist/verify/verify.d.ts

@@ -1,4 +1,5 @@
 import { type PreparedRunArtifactPaths } from "../run/paths.js";
+import { type UnfinishedRun } from "./liveness.js";
 export declare const VERIFY_SCHEMA = "humanish.verify-result.v1";
 export interface VerifyResult {
     schema: typeof VERIFY_SCHEMA;
@@ -21,6 +22,8 @@ export interface VerifyResult {
         }>;
     };
     warnings: string[];
+    /** Present when the run is not finished: its liveness and what is known of its sandboxes. */
+    unfinished?: UnfinishedRun;
     error?: {
         code: "HUMANISH_RUN_NOT_FOUND" | "HUMANISH_INVALID_RUN_BUNDLE";
         message: string;

package/dist/verify/verify.js

@@ -13,12 +13,13 @@ import { runNotFoundMessage } from "../run/run-not-found.js";
 import { actorVerdictConsistencyFindings, noEngagementActorFindings, validateCodexAppServerEvidence, validateTerminalProductEvidence, } from "./actor.js";
 import { invalidRunEvidenceReferences, MAX_REPORTED_FINDINGS, missingLocalEvidenceArtifacts, rawScreenshotPostureWarnings, rawScreenshotStreamIds, redactedShapeFramePaths, scanRunPublicSafetyArtifacts, streamScreenshotPaths, } from "./artifacts.js";
 import { flatContextWarnings } from "./context-growth.js";
-import { runNotFinishedWarnings } from "./liveness.js";
+import { runNotFinished } from "./liveness.js";
 import { costAndReceiptFindings } from "./costs.js";
 import { rerunLineageFindings } from "./rerun.js";
 import { sharedWorldEvidenceFindings } from "./shared-world.js";
 import { subjectStateFindings, undeclaredSubjectStateWarnings } from "./subject.js";
 import { plural } from "../run/text.js";
+import { cli } from "../cli/invocation.js";
 export const VERIFY_SCHEMA = "humanish.verify-result.v1";
 // The UNSCANNED_ARTIFACT reason names this many paths and counts the rest.
 const MAX_LISTED_UNSCANNED = 10;
@@ -137,13 +138,16 @@ export async function verifyResolvedRun(cwd, runInput, runPaths) {
             message: "Derived analysis contains sensitive text or unsafe artifact paths; sharing is blocked, original recording remains independently verifiable.",
         });
     const ok = checks.every((check) => check.ok);
+    const notFinished = isRunBundle(bundle)
+        ? await runNotFinished(runPaths, bundle)
+        : { warnings: [], unfinished: undefined };
     const warnings = isRunBundle(bundle)
         ? [
             ...rawScreenshotPostureWarnings(bundle, redactedShapeFrames),
             ...undeclaredSubjectStateWarnings(bundle),
             ...desktopGeometryWarnings(bundle),
             ...flatContextWarnings(bundle),
-            ...(await runNotFinishedWarnings(runPaths, bundle)),
+            ...notFinished.warnings,
         ]
         : [];
     const shareSafety = isRunBundle(bundle)
@@ -175,6 +179,7 @@ export async function verifyResolvedRun(cwd, runInput, runPaths) {
         checks,
         shareSafety,
         warnings,
+        ...(notFinished.unfinished === undefined ? {} : { unfinished: notFinished.unfinished }),
         ...(ok
             ? {}
             : {
@@ -383,7 +388,7 @@ function buildShareSafety(args) {
         ];
         reasons.push({
             code: "RAW_SANDBOX_ID",
-            message: `Raw sandbox ids appear in ${files.sort().join(", ")}. Runs from 0.110 keep them only in sandbox-receipts.ndjson; \`humanish export --format bundle --redact-screenshots\` writes a copy without them.`,
+            message: `Raw sandbox ids appear in ${files.sort().join(", ")}. Runs from 0.110 keep them only in sandbox-receipts.ndjson; \`${cli("export --format bundle --redact-screenshots")}\` writes a copy without them.`,
         });
     }
     const rawStreamIds = rawScreenshotStreamIds(args.bundle, args.redactedShapeFrames);

package/docs/architecture/actor-contract.md

@@ -444,7 +444,8 @@ traits: { patience, skill, accessibilityNeeds? }, constraints[], sourceDigest }`
      receives them as thread/start `baseInstructions` (`threadStartParams` in
      `src/actors/codex/restricted-launch.ts`), on an ephemeral read-only thread whose only
      dynamic tool is `humanish_ui`. A local-agent Claude Code runs one `claude -p`
-     stream-json session with `--allowedTools Read`; the instructions open its first user
+     stream-json session restricted to Read in its folder (`claudeParticipantFlags` in
+     `src/actors/local-agent/claude-participant.ts`); the instructions open its first user
      message (`promptFor` in `src/actors/local-agent/cli.ts`), and later turns rely on the
      session's memory. `HUMANISH_LOCAL_AGENT_ONE_SHOT` instead spawns one `claude -p` per
      turn, which resends the instructions every turn.

package/docs/architecture/observer.md

@@ -93,10 +93,23 @@ Served data may also include `runtime` with `state`, `observedAt`, and
 `source: "local-run-status"`. This is a current observation of a contained,
 matching `status.json`; it never changes the run's recorded verdict or participant
 outcomes. A fresh heartbeat means running, an explicitly finalized record means
-finished, and stale or invalid timing means unknown. Missing, malformed, or
-mismatched records omit the observation. A stale heartbeat alone does not prove
-interruption, and stored PIDs are neither probed nor returned. Static rendering
-and export do not create this served-only observation.
+finished, a record the CLI's signal handler wrote means interrupted, and stale or
+invalid timing means unknown. Missing, malformed, or mismatched records omit the
+observation. A stale heartbeat alone does not prove interruption, and stored PIDs
+are neither probed nor returned. Static rendering and export do not create this
+served-only observation.
+
+`run.display` says whether the run passed: `{ state, label, tone, reason? }` from
+`runDisplay` (`src/run/display.ts`), the function every surface that shows a run's
+result calls. `state` is `passed` only when `run.status` (the verdict) is `pass` and
+`run.json`'s `outcome` does not record the run as failed. A run whose execution
+failed under a pass verdict is `failed`, with the first failure in `reason`.
+`blocked`, `timed_out`, `no_verdict`, `interrupted`, `running`, `dry_run` and
+`unknown` are the other states. For a `run.json` without an `outcome`, the served
+Observer and `observe` read `status.json` for liveness and, on a run recorded
+before `run.json` carried an outcome, for its ok. The sidebar's dot is the pass
+accent only for `passed`. observer-data.json written before `display` existed
+keeps the verdict reading.
 
 Watch is deliberately distinct from `humanish observe --all`. Watch serves one
 attached run, and the process that created it may inject runtime stream URLs
@@ -167,9 +180,11 @@ origin-dependent scripts and modules in those artifacts may require independent
 hosting. See the [CSP sandbox standard](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/sandbox).
 
 History entries may include `runtimeState` from the same contained local status
-read as the Observer. Their existing `status` remains the recorded verdict.
-Running filters should use runtime state when present, preserving the difference
-between an active study and its provisional evidence outcome.
+read as the Observer, and `display` from the run's Observer data. Their existing
+`status` remains the recorded verdict. The library's pip color and the sidebar's
+label read `display`. Running filters should use runtime state when present,
+preserving the difference between an active study and its provisional evidence
+outcome.
 
 ## UI Shape
 

package/docs/architecture/task-protocol-support.md

@@ -5,20 +5,20 @@ participant; hidden success criteria go only to the observation tracker. A route
 that cannot carry both halves refuses the declaration before execution. Removing
 `tasks` is an explicit choice to run a mission-only study, not an automatic fallback.
 
-| Execution path                                        | Task support | Mechanism                                                                                     |
-| ----------------------------------------------------- | ------------ | --------------------------------------------------------------------------------------------- |
-| CUA, app-url, one participant or fan-out              | Supported    | The participant prompt composer renders goals; the CUA loop tracks observations               |
-| CUA, provisioned clone or local-tree, separate worlds | Supported    | Same prompt composer and loop                                                                 |
-| CUA, local-app with caller executor/provider          | Supported    | Same loop; the caller supplies observations                                                   |
-| CUA, desktop-cli                                      | Supported    | Same prompt and tracker; unavailable criterion inputs remain unmeasured                       |
-| Shared-world, provisioned or external-public          | Rejected     | Actor specs omit the protocol before CUA session dispatch                                     |
-| Terminal-product                                      | Rejected     | Terminal prompt and result contract do not implement tasks                                    |
-| Scripted-browser, local or provisioned                | Rejected     | Scenario steps drive the participant; no task protocol is consumed                            |
-| Synthetic (`this-repo`)                               | Rejected     | Study dispatch does not pass task declarations to the dry-run engine                          |
-| Any second or later `actors[]` entry                  | Rejected     | Current runners consume only the first actor; declare every participant under the first actor |
+| Execution path                                        | Task support | Mechanism                                                                       |
+| ----------------------------------------------------- | ------------ | ------------------------------------------------------------------------------- |
+| CUA, app-url, one participant or fan-out              | Supported    | The participant prompt composer renders goals; the CUA loop tracks observations |
+| CUA, provisioned clone or local-tree, separate worlds | Supported    | Same prompt composer and loop                                                   |
+| CUA, local-app with caller executor/provider          | Supported    | Same loop; the caller supplies observations                                     |
+| CUA, desktop-cli                                      | Supported    | Same prompt and tracker; unavailable criterion inputs remain unmeasured         |
+| Shared-world, provisioned or external-public          | Rejected     | Actor specs omit the protocol before CUA session dispatch                       |
+| Terminal-product                                      | Rejected     | Terminal prompt and result contract do not implement tasks                      |
+| Scripted-browser, local or provisioned                | Rejected     | Scenario steps drive the participant; no task protocol is consumed              |
+| Preview (`this-repo`)                                 | Rejected     | Study dispatch does not pass task declarations to the dry-run engine            |
 
-Both registered CUA actors (`openai-computer-use` and `local-agent`) share the CUA
-session loop. Their task support does not depend on which provider chooses actions.
+A study has one `actor`, and its participants go in `participants`, so every participant
+gets the same tasks. Both registered CUA actors (`openai-computer-use` and `local-agent`) share
+the CUA session loop. Their task support does not depend on which provider chooses actions.
 Custom session hooks remain caller-owned implementations of that same contract;
 this preflight does not certify arbitrary hook behavior.
 

package/docs/architecture/terminal-product-route.md

@@ -1,7 +1,7 @@
 # Terminal-product route
 
 The live terminal-product route has shipped since `0.8.0`, with the in-sandbox runtime,
-command-scoped credential placement, exact-id cleanup proof, an interventions ledger, a cost and
+explicit credential placement (an E2B egress proxy by default, or command-scoped), exact-id cleanup proof, an interventions ledger, a cost and
 no-spend ledger, caps, and product scoring and feedback hooks. The
 [original plan](https://github.com/danielgwilson/humanish/blob/main/docs/history/goals/terminal-product-lane/goal.md)
 holds the build order and the safety contract.
@@ -30,10 +30,10 @@ fail-closed cross-validation, and forward-declared warnings.
 | `subject.product`                 | `{ name, publicSurfaces[], install?, workdir?, upload? }`: the only world the agent sees                                                                    |
 | `execution.target`                | `e2b-terminal` (or absent → implied)                                                                                                                        |
 | `execution.terminal`              | `{ transport: exec-stream, stdin: disabled }`                                                                                                               |
-| `execution.runtimeAuth`           | `openai-env` (default) or opt-in `openai-egress`; names-only durable evidence                                                                               |
+| `execution.runtimeAuth`           | `openai-egress` (default) or opt-in `openai-env`; names-only durable evidence                                                                               |
 | `execution.runtime.version`       | Optional exact `@openai/codex` version; observed before keyed execution                                                                                     |
 | `actor.model` / `reasoningEffort` | Passed to Codex as `--model` (default `gpt-5.6-sol`) and `-c model_reasoning_effort`; declarations, not observed provider identity                          |
-| `caps`                            | `{ maxUsd, maxJobs, maxMinutes }`: the blast-radius budget; `maxUsd > 0` is refused unless a `costProbe` measures spend                                     |
+| `caps`                            | `{ maxUsd, maxJobs, maxMinutes }`: the blast-radius budget; `maxUsd > 0` is refused: no adopter cost source exists until issue 347 lands                    |
 | `policies`                        | `allowPrivateRepoAccess` / `allowProviderCredentials` / `allowPaymentCredentials` / `allowGitHubMutation`, all default false                                |
 | `actor.type`                      | `codex-exec`: a registered terminal actor (`keyPlacement: in-sandbox-command-scoped`)                                                                       |
 | route                             | `terminal` → `runTerminalProductStudy` ([`src/routes/terminal/route.ts`](https://github.com/danielgwilson/humanish/blob/main/src/routes/terminal/route.ts)) |
@@ -86,11 +86,8 @@ product's no-spend boundary still needs separate interpretation.
 
 ## Runtime auth: raw-key placement and remaining provider access
 
-`execution.runtimeAuth: openai-env` remains the compatible default. It supplies
-`CODEX_API_KEY` command-scoped to Codex, with `OPENAI_API_KEY` also supplied when
-that was the host source. Child processes can read and use the raw key.
-
-Opt in to keeping the raw key outside the sandbox:
+`execution.runtimeAuth: openai-egress` is the default: a study that declares no
+`runtimeAuth` keeps the raw key outside the sandbox, as if it declared:
 
 ```yaml
 execution:
@@ -115,7 +112,7 @@ output and errors, including errors during sandbox creation.
 This mode supports the default OpenAI endpoint only. humanish explicitly sets Codex's
 built-in `openai` provider and `openai_base_url` to `https://api.openai.com/v1` for
 that invocation. It does not support a custom provider, proxy base URL, or regional
-endpoint under this mode. `openai-env` retains its existing command behavior. E2B
+endpoint under this mode; a study that needs one declares `openai-env`. E2B
 header rules are a public-beta capability;
 `tests/routes/terminal/runtime-auth.test.ts` checks the local contract against the
 installed Desktop SDK (the lockfile has `@e2b/desktop` 2.4.0, resolving `e2b` 2.49.0).
@@ -136,6 +133,11 @@ requests can fail. E2B domain allowlists are routing controls rather than strict
 destination isolation on shared infrastructure. An existing exact OpenAI host
 rule is rejected instead of silently overwritten.
 
+`execution.runtimeAuth: openai-env` is the opt-in alternative. It supplies
+`CODEX_API_KEY` command-scoped to Codex, with `OPENAI_API_KEY` also supplied when
+that was the host source. Child processes can read and use the raw key, and so can
+anything the agent runs or a page it reads asks it to run.
+
 Evidence records the selected auth mode and the residual proxy capability.
 Resolved live actor traces use `keyPlacement: external` in `openai-egress`; the
 actor registry continues to describe the default `in-sandbox-command-scoped`
@@ -197,10 +199,10 @@ deadline.
 
 ## The original command-scoped safety contract
 
-The default mode **inverts** the credential-placement default of every other E2B route.
-On the computer-use route the model's key stays _outside_ the sandbox; here the
-agent-under-test runs _inside_ with a real `OPENAI_API_KEY`/`CODEX_API_KEY` and
-is **presumed exfiltratable**. The placement rule in invariants-and-defaults.md
+The `openai-env` mode **inverts** the credential-placement default of every other E2B route.
+On the computer-use route the model's key stays _outside_ the sandbox; under `openai-env` the
+agent-under-test runs _inside_ with a real `OPENAI_API_KEY`/`CODEX_API_KEY` and is **presumed
+exfiltratable**. The placement rule in invariants-and-defaults.md
 applies: _keys live where the keyed process runs, and nowhere else;
 blast radius is bounded by key scoping and budgets, not by hoping._
 

package/docs/contracts/run-bundle.md

@@ -70,6 +70,15 @@ artifacts:
 review:
   schema: humanish.review.v1
   verdict: "contract_proof_only|pass|fail|blocked|timed_out"
+outcome: # optional, additive: how the run ended (Run Outcome below)
+  state: "finished"
+  ok: false
+  execution:
+    succeeded: false
+    failures:
+      - kind: "harness|provider-cleanup|provider-policy|sandbox-cleanup|evidence|cap|run"
+        message: "<public-safe message>"
+    warnings: [] # omitted when empty
 redaction:
   status: "passed"
   notes: "<public-safe note>"
@@ -100,6 +109,59 @@ Persisted `run.json` files must not contain absolute local target paths. Runtime
 commands may return the caller's working directory in process-local JSON
 responses, but durable run bundles use the public-safe `[target-cwd]` marker.
 
+## Run Outcome
+
+`outcome` records how the run ended as an execution. `review.verdict` is what the
+participants experienced; `outcome.ok` is the route result's `ok`, which
+`humanish run --json` prints as `runOk`. The two differ: a terminal run whose agent passed but whose sandbox
+teardown is unproven has verdict `pass` and `ok: false`.
+
+```yaml
+# Run.finish published the final bundle.
+outcome:
+  state: finished
+  ok: true
+  execution:
+    succeeded: true
+    failures: []
+    warnings: # omitted when empty
+      - kind: sandbox-cleanup
+        message: "lane-01: Sandbox release is unconfirmed. Reclaim it by recorded id with `humanish reclaim --run <id>`."
+---
+# The CLI's signal handler stopped the run before it finished.
+outcome:
+  state: interrupted
+  ok: false
+  signal: SIGINT # or SIGTERM, SIGHUP
+  at: "<ISO timestamp>"
+```
+
+`Run.finish` (`src/run/run.ts`) writes `finished` with the route's `ok` and its
+execution outcome (`judgeExecution` in `src/run/judge.ts`). Each route's policy in
+`OUTCOME_POLICIES` decides which failure kinds fail the run and which only warn.
+An Observer that does not render is an `evidence` failure known only after
+`run.json` is on disk: `FinishedRun.renderObserver` adds it to `outcome` and to
+`status.json` before the route returns, and no Observer page exists that could
+show the run without it. Messages pass the same redaction and sandbox id scrub
+as the rest of the bundle.
+
+When a signal stops a live run, the handler writes `interrupted` into the last
+flushed `run.json`, and every later write of that run keeps it. A run stopped
+before its first flush has no `run.json`; its `status.json` is the record.
+
+`outcome` is absent while a run is in progress, when its process died without
+writing it, and on runs recorded before the field existed. For those, readers
+take liveness from `status.json` and, for an older finished run, its `ok` and
+`execution` from `status.json`'s `outcome`. That record is the only copy of an
+older run's `ok`; for a run with `outcome` in `run.json`, `status.json` copies it.
+
+Every surface that shows whether a run passed calls `runDisplay`
+(`src/run/display.ts`) with the run's liveness, verdict and `ok`: the Observer
+(`observer-data.json` `run.display`), its run library, the served Observer,
+`humanish runs`, `humanish review`, `humanish stats`, the TUI and `review.md`'s
+`outcome` line. A run
+shows as `passed` only when its verdict is `pass` and its `ok` is not false.
+
 ## Recorded session stop causes
 
 An actor trace may include `stopCause` alongside its unchanged `status`,
@@ -523,7 +585,9 @@ shareSafety:
 bundle is safe to promote into a public issue. Public promotion should branch on
 `shareSafety.status`:
 
-- `share_ready`: feedback draft commands may render public issue payloads;
+- `share_ready`: feedback draft commands may render public issue payloads, and `observe --all --safe`
+  serves the run. The folder still holds `sandbox-receipts.ndjson` (raw sandbox ids) and `status.json`
+  (the recording pid); no Observer server serves them and bundle export omits them;
 - `local_only`: keep the run local; only supported redaction-only cases can produce a shareable derivative;
   `RAW_SANDBOX_ID` is one: a file other than `sandbox-receipts.ndjson` names one of the run's raw
   sandbox ids, which verify reads from the receipts and from any raw `providerResources[].id` in
@@ -543,12 +607,19 @@ writing; an older one reads as interrupted. The warning names what verify saw:
 - the record's state and its last `updatedAt`, or the running `simulations[]` entries when
   there is no usable record;
 - how many streams are still `running`;
-- what `reclaim-receipt.json` records: how many of the run's sandboxes are gone
-  (killed or already gone), and how many journaled sandboxes it does not cover. It
-  matches its outcomes to the receipts by `sandboxIdDigest`; a reclaim receipt from
-  before 0.110 names raw ids, which are digested to match;
-- with journaled sandboxes and no reclaim receipt, the command that stops them:
-  `humanish reclaim --run <id>`.
+- the sandbox state, and what `reclaim-receipt.json` records: how many of the run's
+  sandboxes are gone (killed or already gone), and how many journaled sandboxes it does
+  not cover. It matches its outcomes to the receipts by `sandboxIdDigest`; a reclaim
+  receipt from before 0.110 names raw ids, which are digested to match;
+- with no reclaim receipt, the command that stops the journaled sandboxes and searches
+  E2B by the run's owner tags: `humanish reclaim --run <id>`.
+
+The result also carries `unfinished: { liveness, sandboxes }`, and the one-line output
+leads with it, for example `verified <id> (interrupted, sandboxes unknown) · share_ready`.
+`sandboxes` is `clean` only when the reclaim receipt records every sandbox gone and its
+`state` is `clean`, which means the search by tag finished. It is `unconfirmed` when the
+receipt records a sandbox not gone or misses a journaled one, and `unknown` otherwise,
+including a receipt from humanish 0.110.0 or earlier, which did not search by tag.
 
 The local-evidence check includes screenshots declared only by
 `streams[].actor.items[].screenshotRef` or `streams[].liveActor.items[].screenshotRef`,
@@ -589,6 +660,16 @@ trace references outside `screenshots/`. An unregistered
 `.mp4`, and a file or directory whose name contains `\`, are public-safety
 findings and block the run.
 
+The patterns live in `src/evidence/redaction.ts`: provider key formats (OpenAI,
+Anthropic, E2B, GitHub, GitLab, npm, Vercel, AWS, Google, Stripe, Slack,
+SendGrid, Hugging Face), JWTs, bearer and basic `Authorization` values, private
+key headers, database URLs with a password, the password in any URL's user info,
+credential query and fragment parameters with a value of 16 characters or more,
+credential-named upper-case variables set to a value of 16 characters or more
+with a digit and a letter, an AWS secret access key next to its name, E2B URLs, and Linux,
+macOS and Windows local paths. `tests/verify/secret-formats.test.ts` lists the
+formats and the ordinary values that must not match.
+
 Before matching, the scan undoes JSON and JS escapes, percent-encoding and HTML
 character references, the decoding bundle export applies (`decodeEscapes`), and
 then JSON whitespace escapes and quoted-printable. It reads inside base64 runs of
@@ -604,9 +685,13 @@ wrapped across lines, and inside hex runs of 32 characters or more:
 
 `observer/index.html` is exempt from that base64 rule: serve renders it from
 `run.json`, export regenerates it, and it embeds the Observer's own base64 fonts.
-Its text is still scanned. Known limits: base64 split across separate strings,
-nesting deeper than three levels, and encodings a pattern scan cannot undo (such
-as encryption) still grade `share_ready`. `tests/verify/encoding-coverage.test.ts`
+Its text is still scanned. A base64 run of up to 4096 characters is also read one
+slash-separated piece at a time, and from just after each slash in its first 64
+characters, so a URL path before an encoded key cannot shift its decoding. Known
+limits: base64 split across separate strings, nesting deeper than three levels,
+base64 that holds a slash itself and starts more than 64 characters into a longer
+run, and encodings a pattern scan cannot undo (such as encryption) still grade
+`share_ready`. `tests/verify/encoding-coverage.test.ts`
 records each case.
 
 Real email receiving adds `publication.restrictions: [real-communications]` and