humanish 0.111.3 → 0.112.0

package/dist/routes/shared-world/bundle.js

@@ -9,13 +9,14 @@ import { commandDigestOf } from "../../subject/state.js";
 import { buildRunCostSummary, desktopSpanToMinutes } from "../../run/cost-summary.js";
 import { participantFactsOf } from "../computer-use/participant-facts.js";
 import { participantFeedbackCandidates } from "../computer-use/participant-feedback.js";
-import { judgeSharedWorld, participantPassed, sharedWorldShortfall, verdictText, } from "../../run/judge.js";
-import { reviewOutcome } from "../../run/display.js";
+import { judgeSharedWorld, judgeParticipantRecords, participantPassed, sharedWorldShortfall, } from "../../run/judge.js";
+import { renderReviewMarkdown } from "../../run/review-markdown.js";
 import { combineCheckpointDigest } from "./checkpoints.js";
 import { hostOriginDigest } from "./provenance.js";
 import { participantEvent, participantIds } from "../../run/participant-records.js";
 import { sharedWorldParticipantRecords } from "./bundle-records.js";
 import { CONCURRENT_ATTRIBUTION_LIMITS, EXTERNAL_PUBLIC_ATTRIBUTION_LIMITS, } from "./types.js";
+import { gapsListClause } from "../../run/outcomes.js";
 import { plural } from "../../run/text.js";
 /** Max windows live at the same instant (sweep over start/end points). The simultaneity
  *  count: the participant count says how many existed; this says how many ever ran at once. */
@@ -63,33 +64,39 @@ export function actorRunPassed(result) {
     return result !== undefined && participantPassed(participantFactsOf(result.outcome));
 }
 /**
- * Keep three different claims separate in the stakeholder roll-up:
- *
- * - `outcome.ok` says the actor session passed the harness's credibility checks;
- * - `completionReason` says how the participant session ended;
- * - shared-world convergence is reported by the plane-specific summary alongside this line.
- *
- * None of those is adopter-scored proof that the mission text was completed. In particular, a
- * productive `budget_reached` session can coexist with lobby convergence without becoming a
- * `goal_satisfied` result.
+ * The run's summary in plain sentences: who took part, how many reached the goal, and what the
+ * world showed. A participant reached the goal when its session passed the judge's checks and
+ * ended at the goal, so a productive `budget_reached` session does not count even when the lobby
+ * converged. Each participant's ending stays in `sharedWorld.outcomes`, and the plane, topology
+ * and attribution limits stay in the bundle's events and `sharedWorld` block.
  */
-function formatSharedWorldActorOutcomes(outcomes, expectedCount) {
-    const passedSessions = outcomes.filter((outcome) => outcome.ok).length;
-    const goalSatisfiedSessions = outcomes.filter((outcome) => outcome.ok && outcome.completionReason === "goal_satisfied").length;
-    const completionReasonCounts = new Map();
-    for (const outcome of outcomes) {
-        const reason = outcome.completionReason ?? "not_recorded";
-        completionReasonCounts.set(reason, (completionReasonCounts.get(reason) ?? 0) + 1);
+function sharedWorldSummary(args, facts) {
+    const count = args.actorSpecs.length;
+    const people = plural(count, "participant");
+    const app = facts.external ? "one public app" : "one shared app";
+    if (args.dryRun) {
+        const served = facts.external ? ", as it is deployed" : ", served from a sandbox";
+        return `Dry run: ${people} would use ${app} at the same time${served}. No sandboxes were launched and $0 was spent.`;
     }
-    for (let missing = outcomes.length; missing < expectedCount; missing += 1) {
-        completionReasonCounts.set("not_recorded", (completionReasonCounts.get("not_recorded") ?? 0) + 1);
+    if (facts.inProgress) {
+        return `${people} ${count === 1 ? "is" : "are"} using ${app} at the same time. The run is still going, so nothing here is final.`;
     }
-    const completionReasons = [...completionReasonCounts.entries()]
-        // ASCII contract tokens: compare directly so bundle text is byte-stable across host locales.
-        .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
-        .map(([reason, count]) => `${reason} ${count}/${expectedCount}`)
-        .join(", ");
-    return `${passedSessions}/${plural(expectedCount, "actor session")} passed credibility checks; mission endpoint: ${goalSatisfiedSessions}/${expectedCount} ended goal_satisfied; completion reasons: ${completionReasons}`;
+    const passed = facts.outcomes.filter((outcome) => outcome.ok);
+    const reached = passed.filter((outcome) => outcome.completionReason === "goal_satisfied").length;
+    const together = facts.overlaps ? " at the same time" : ", but never at the same time";
+    // A participant who did not pass has a gap line; one who passed but stopped short has none.
+    const rest = [
+        passed.length > reached ? `; ${passed.length - reached} ended without reaching it` : "",
+        gapsListClause(count - passed.length, count),
+    ].join("");
+    const world = facts.external
+        ? args.lobbyConvergenceDigest
+            ? `All ${count} ended up in the same lobby.`
+            : "humanish did not see them all end up in the same lobby."
+        : facts.deltas === 0
+            ? "The app's shared state did not change during the run."
+            : `The app's shared state changed ${plural(facts.deltas, "time")} during the run.`;
+    return `${people} used ${app}${together}. ${reached} of ${count} reached the goal${rest}. ${world}`;
 }
 /** The run's first two events: its creation and the shared plane's provenance. */
 function planeEvents(args, external) {
@@ -234,19 +241,13 @@ function sharedWorldEvidence(args, external, inProgress, planeCommit) {
  * A finished run's gaps: each participant that did not pass, or, when every participant passed, the
  * world shortfall that failed the run.
  */
-function finishedGaps(actorResults, shortfall) {
-    const participantGaps = actorResults
-        .filter((result) => result.outcome.sessionError !== undefined ||
-        result.outcome.noEngagement ||
-        result.outcome.selfReportedBlocker ||
-        result.outcome.session === undefined ||
-        result.outcome.session.status !== "passed")
-        .map((result) => `${result.spec.planned.id}: ${result.outcome.sessionError ?? result.outcome.session?.reason ?? "did not pass"}`);
+function finishedGaps(participants, shortfall) {
+    const participantGaps = participants.flatMap((participant) => participant.gapLine === undefined ? [] : [participant.gapLine]);
     return participantGaps.length === 0 && shortfall !== undefined ? [shortfall] : participantGaps;
 }
 /** Records the concurrency event and returns the review. */
-function concurrencyReview(args, external, inProgress, evidence, events, nextEventId) {
-    const { plan, descriptor, run: { createdAt }, dryRun, actorSpecs, actorResults, } = args;
+function concurrencyReview(args, external, inProgress, evidence, events, nextEventId, participants) {
+    const { plan, run: { createdAt }, dryRun, } = args;
     const { sharedWorld, windows, stateSeries, outcomes } = evidence;
     const overlaps = args.judgment.world.overlap;
     const deltas = (stateSeries ?? []).filter((snapshot, i) => i > 0 && snapshot.digest !== (stateSeries ?? [])[i - 1].digest).length;
@@ -268,25 +269,12 @@ function concurrencyReview(args, external, inProgress, evidence, events, nextEve
         message: `Concurrency: ${plural(windows.length, "participant")}${dryRun ? " (dry run; $0)" : `, up to ${maxLive} live at once (cap ${capForReport}), overlap ${overlaps ? "shown" : "not observed"}`}; ${stateSeriesLabel}${convergenceLabel}. Attribution ceiling: ${sharedWorld.attributionLimits.join(", ")}. ${dryRun ? "This dry run proves nothing about live concurrency, scale, or adoption." : "This run reports only its own observed overlap and state changes; it does not prove scale, repeatability, or adopter-harness replacement."}`,
     });
     // The judge's verdict (judgeSharedWorld): every participant produced a terminal, engaged, passed
-    // session. Mission endpoint and completion reasons are reported separately below; `outcomes[].ok`
-    // is not renamed into mission success.
-    const verdict = args.judgment.verdict;
-    const actorOutcomeSummary = formatSharedWorldActorOutcomes(outcomes, actorSpecs.length);
+    // session and the world showed the concurrency verify requires.
     const review = {
         schema: REVIEW_SCHEMA,
-        verdict,
-        // Plane-class-aware: the external-public plane has no getHost/clone/seed and carries no
-        // authoritative state series, so its summary must not claim a getHost-exposed plane (dry-run) nor
-        // report "state delta(s) under load" (live). It reports lobby convergence instead.
-        summary: dryRun
-            ? external
-                ? `Concurrent shared-world dry run: ${plural(actorSpecs.length, "persona")} declared against one public deployment, used as it is (no sandbox, clone or seed); no sandboxes launched, $0 spent.`
-                : `Concurrent shared-world dry run: ${plural(actorSpecs.length, "persona")} declared against one app served at a public sandbox URL (${descriptor.id}); no sandboxes launched, $0 spent.`
-            : inProgress
-                ? `In-progress concurrent shared-world Observer snapshot: ${plural(actorSpecs.length, "persona")} running against one shared app; final verification is pending.`
-                : external
-                    ? `Concurrent shared-world (one public deployment, ${actorSpecs.length} personas at once): swarm ${verdict === "pass" ? "ran coherently" : "did not run coherently"}; ${actorOutcomeSummary}; overlap ${overlaps ? "proven" : "not observed"}; ${args.lobbyConvergenceDigest ? `${actorSpecs.length} participants converged on one lobby` : "lobby convergence not observed"}.`
-                    : `Concurrent shared-world (one shared app, ${actorSpecs.length} personas at once): swarm ${verdict === "pass" ? "ran coherently" : "did not run coherently"}; ${actorOutcomeSummary}; overlap ${overlaps ? "proven" : "not observed"}; ${plural(deltas, "state delta")} under load.`,
+        verdict: args.judgment.verdict,
+        // The external-public app has no state series, so its summary reports the lobby instead.
+        summary: sharedWorldSummary(args, { external, inProgress, overlaps, deltas, outcomes }),
         gaps: dryRun
             ? [
                 "This dry run launched no concurrent shared-world session; it checks the evidence shape only, not live behavior, scale, or adopter-harness replacement.",
@@ -295,7 +283,7 @@ function concurrencyReview(args, external, inProgress, evidence, events, nextEve
                 ? [
                     "Final actor traces, screenshots, state deltas, and verification are pending; this Observer is for live watch only.",
                 ]
-                : finishedGaps(actorResults, sharedWorldShortfall(args.judgment.world)),
+                : finishedGaps(participants, sharedWorldShortfall(args.judgment.world)),
     };
     return review;
 }
@@ -306,15 +294,26 @@ export function buildConcurrentSharedWorldBundle(args) {
     const external = (args.planeClass ?? "provisioned-getHost") === "external-public";
     const simulations = [];
     const streams = [];
-    // Public-safe label only: neither the raw getHost URL (provisioned) nor the raw public origin
-    // (external-public) lands in the bundle. The plane identity is a digest (plane.hostDigest on
-    // getHost; plane.publicOriginDigest on external-public).
-    const appUrl = external ? "[external-public-plane]" : "[provisioned-subject]";
     const planeCommit = external ? undefined : dryRun ? undefined : args.subjectCommit;
     const events = planeEvents(args, external);
     let eventSeq = 2;
     const nextEventId = (suffix) => `event-${String(eventSeq++).padStart(3, "0")}-${suffix}`;
-    const recordContext = { args, external, inProgress, appUrl, nextEventId };
+    const judgment = judgeParticipantRecords(actorSpecs.map((spec, index) => ({
+        ...participantFactsOf(actorResults[index]?.outcome),
+        id: spec.planned.id,
+        inProgress: inProgress && actorResults[index] === undefined,
+    })), {
+        runningReason: "Actor desktop is running; the attached Observer hydrates the runtime stream URL without persisting it.",
+        sessionLabel: "Participant",
+        missingSessionMessage: "Actor did not produce a terminal session.",
+    });
+    const recordContext = {
+        args,
+        external,
+        inProgress,
+        nextEventId,
+        participants: judgment.participants,
+    };
     actorSpecs.forEach((spec, index) => {
         const records = sharedWorldParticipantRecords(recordContext, spec, index);
         simulations.push(records.simulation);
@@ -323,7 +322,7 @@ export function buildConcurrentSharedWorldBundle(args) {
     });
     const evidence = sharedWorldEvidence(args, external, inProgress, planeCommit);
     const { sharedWorld } = evidence;
-    const review = concurrencyReview(args, external, inProgress, evidence, events, nextEventId);
+    const review = concurrencyReview(args, external, inProgress, evidence, events, nextEventId, judgment.participants.filter((_, index) => actorResults[index] !== undefined));
     const anyRaw = actorResults.some((result) => result.outcome.session?.trace.redaction.screenshots === "raw");
     const ranLive = actorResults.some((result) => result.outcome.session !== undefined || result.outcome.sessionError !== undefined);
     const cost = concurrentCostSummary(args, inProgress);
@@ -335,7 +334,7 @@ export function buildConcurrentSharedWorldBundle(args) {
         }),
         persona: {
             id: actorSpecs[0]?.persona.id ?? "concurrent-persona",
-            name: `Concurrent shared-world swarm (${actorSpecs.length} personas)`,
+            name: `${plural(actorSpecs.length, "participant")} in one ${external ? "public" : "shared"} app`,
             source: `study:${plan.studyId}`,
             sourceDigest: actorSpecs[0]?.persona.promptDigest ?? args.seedDigest,
         },
@@ -456,27 +455,20 @@ function declaredStateDigest(state) {
     const probes = state?.checkpoint ?? [];
     return combineCheckpointDigest(probes.map((probe) => `${probe.name}=${commandDigestOf(probe.command)}`));
 }
-export function renderConcurrentReviewMarkdown(bundle) {
+export function renderConcurrentReviewMarkdown(bundle, status) {
     const plane = bundle.events.find((event) => event.type === "concurrent-shared-world.plane.provenance");
     const concurrency = bundle.events.find((event) => event.type === "concurrent-shared-world.concurrency");
     const sw = bundle.sharedWorld;
-    return [
-        `# ${bundle.scenario.title}`,
-        "",
-        `- run: ${bundle.runId}`,
-        `- mode: ${bundle.mode}`,
-        `- attribution class: ${bundle.attributionClass ?? "isolated"}`,
-        `- topology: ${sw?.topology ?? "(none)"} / ${sw?.topologyMode ?? "(none)"}`,
-        `- personas: ${sw?.roleCount ?? 0}`,
-        `- verdict: ${verdictText(bundle.review.verdict, bundle.mode)}`,
-        `- outcome: ${reviewOutcome(bundle)}`,
-        `- summary: ${bundle.review.summary}`,
+    return renderReviewMarkdown(bundle, [
         ...(plane ? [`- plane: ${plane.message}`] : []),
         ...(concurrency ? [`- concurrency: ${concurrency.message}`] : []),
         ...(sw ? [`- attribution limits: ${sw.attributionLimits.join(", ")}`] : []),
-        ...(bundle.review.gaps.length > 0
-            ? ["", "## Gaps", ...bundle.review.gaps.map((gap) => `- ${gap}`)]
-            : []),
-        "",
-    ].join("\n");
+    ], {
+        status,
+        beforeVerdict: [
+            `- attribution class: ${bundle.attributionClass ?? "isolated"}`,
+            `- topology: ${sw?.topology ?? "(none)"} / ${sw?.topologyMode ?? "(none)"}`,
+            `- personas: ${sw?.roleCount ?? 0}`,
+        ],
+    });
 }

package/dist/routes/shared-world/participant-specs.d.ts

@@ -1,5 +1,5 @@
 import type { SharedWorldPlan } from "../../study/plan-types.js";
-import type { Participant, SharedWorldParticipant } from "../../study/plan-participants.js";
+import type { SharedWorldParticipant } from "../../study/plan-participants.js";
 import type { RunBundle } from "../../run/bundle.js";
 import type { DesktopParticipantRun, ParticipantRunOutcome } from "../computer-use/types.js";
 import { type DesktopParticipantDeps } from "../computer-use/participant-deps.js";
@@ -8,7 +8,6 @@ export declare function defaultSessionTimeoutMs(plan: SharedWorldPlan): number;
 /** Resolve an actor's participant URL against the harness-minted getHost base (entry is a
  *  same-origin relative path, validated at parse against serve.url). */
 export declare function resolveActorEntryUrl(baseUrl: string, entry: string | undefined): string;
-export declare function participantTaxonomyLabel(labels: Participant["labels"]): string;
 /** Thread the host-yielded lobby code into a follower's mission at runtime (external-public route).
  *  The code flows into the follower's join instruction; it is persisted only as the composed prompt
  *  the model reads (never a raw bundle field), and humanish scrubs the code from all narration. The

package/dist/routes/shared-world/participant-specs.js

@@ -45,14 +45,6 @@ export function resolveActorEntryUrl(baseUrl, entry) {
         return baseUrl;
     }
 }
-export function participantTaxonomyLabel(labels) {
-    const parts = [
-        labels.actorType ? `type:${labels.actorType}` : undefined,
-        labels.surface ? `surface:${labels.surface}` : undefined,
-        labels.caseGroup ? `case:${labels.caseGroup}` : undefined,
-    ].filter((part) => part !== undefined);
-    return parts.length > 0 ? ` (${parts.join(" / ")})` : "";
-}
 /** Build one participant's DesktopParticipantRun from its plan (each participant has its own
  *  desktop, so its own device). */
 function buildActorSpec(participant, personas) {

package/dist/routes/shared-world/result.js

@@ -3,9 +3,9 @@
 import { redactText } from "../../evidence/redaction.js";
 import { adapterScoreFailureMessage, applyBrowserScorer } from "../../study/adapter-extension.js";
 import { attachObserverRuntimeStreamUrls } from "../../observer/render.js";
-import { foldScorerFailures, judgeExecution, sandboxCleanupFailure, OUTCOME_POLICIES, resultOk, sharedWorldShortfall, } from "../../run/judge.js";
+import { foldScorerFailures, judgeParticipantRecords, judgeExecution, sandboxCleanupFailure, OUTCOME_POLICIES, resultOk, sharedWorldShortfall, } from "../../run/judge.js";
 import { validatePreparedRunArtifactPaths } from "../../run/paths.js";
-import { participantExecutionFailures } from "../computer-use/participant-facts.js";
+import { participantExecutionFailures, participantFactsOf, } from "../computer-use/participant-facts.js";
 import { participantCapWarning } from "../computer-use/participant-model.js";
 import { resolveSubjectState } from "../computer-use/subject-projection.js";
 import { actorRunPassed, buildConcurrentSharedWorldBundle, judgeSharedWorldRun, maxSimultaneousWindows, } from "./bundle.js";
@@ -70,14 +70,10 @@ function concurrentParticipantResults(actorSpecs, actorResults, dryRun) {
                 : {
                     error: {
                         code: "HUMANISH_SHARED_WORLD_FAILED",
-                        message: result.outcome.sessionError ??
-                            (result.outcome.noEngagement
-                                ? "Actor took no actions and produced no message (likely a blank/still-loading screen); not a credible goal_satisfied."
-                                : result.outcome.selfReportedBlocker
-                                    ? "Actor reported goal_satisfied while its final message described a blocker or asked for missing instructions; not a credible pass."
-                                    : session?.completionReason === "harness_error"
-                                        ? `Participant ended with a harness error: ${session.reason}`
-                                        : "Actor did not produce a terminal session."),
+                        message: judgeParticipantRecords([participantFactsOf(result.outcome)], {
+                            sessionLabel: "Participant",
+                            missingSessionMessage: "Actor did not produce a terminal session.",
+                        }).participants[0].notPassedMessage,
                     },
                 }),
         };
@@ -126,7 +122,7 @@ function concurrentStudyError(args) {
     if (passed === participantCount && args.shortfall !== undefined) {
         return {
             code: "HUMANISH_SHARED_WORLD_FAILED",
-            message: `Concurrent shared-world run did not run coherently. ${args.shortfall}`,
+            message: `The shared-world run failed although every participant passed. ${args.shortfall}`,
         };
     }
     if (passed === participantCount && args.executionFailure !== undefined) {
@@ -137,7 +133,7 @@ function concurrentStudyError(args) {
     }
     return {
         code: "HUMANISH_SHARED_WORLD_FAILED",
-        message: `Concurrent shared-world run did not run coherently: ${passed}/${plural(participantCount, "actor")} reached a terminal, engaged passed session.`,
+        message: `The shared-world run failed: ${passed} of ${plural(participantCount, "participant")} passed. The run's review.md lists what happened to the others.`,
     };
 }
 /**

package/dist/routes/terminal/bundle.d.ts

@@ -71,4 +71,4 @@ export declare function buildLiveTerminalProductBundle(args: {
      *  the review names, beside the agent's own verdict. */
     capFailure?: string;
 }): RunBundle;
-export declare function renderTerminalReviewMarkdown(bundle: RunBundle): string;
+export declare function renderTerminalReviewMarkdown(bundle: RunBundle, status?: unknown): string;

package/dist/routes/terminal/bundle.js

@@ -1,12 +1,14 @@
 import { redactText } from "../../evidence/redaction.js";
 import { participantAssignment } from "../../study/participant-assignment.js";
 import { REVIEW_SCHEMA, bundleArtifacts, bundleHead, } from "../../run/bundle.js";
-import { verdictText } from "../../run/judge.js";
-import { reviewOutcome } from "../../run/display.js";
+import {} from "../../run/judge.js";
+import { renderReviewMarkdown } from "../../run/review-markdown.js";
 import {} from "../../run/streams.js";
 import { participantEvent, participantIds, participantRecord, participantStream, } from "../../run/participant-records.js";
 import { TERMINAL_EVENTS_ARTIFACT, TERMINAL_LEDGERS_ARTIFACT, TERMINAL_TRANSCRIPT_ARTIFACT, } from "../../run/terminal-contract.js";
 import { DEFAULT_RUNTIME_AUTH } from "./runtime-auth.js";
+import { participantCaption } from "../../run/participant-caption.js";
+import { formatParticipantOutcomes, tallyParticipantOutcomes } from "../../run/outcomes.js";
 import { describeMeasuredSpend, noSpendLineMeasured, noSpendNotEstablished } from "./ledger.js";
 /**
  * Project the terminal-product run into a humanish.run-bundle.v1 (no schema change: a new
@@ -80,7 +82,7 @@ export function buildTerminalProductBundle(args) {
     const review = {
         schema: REVIEW_SCHEMA,
         verdict: args.verdict,
-        summary: reason,
+        summary: `Dry run: 1 participant would try ${args.productName} from a terminal. No sandbox was created, no key was used and $0 was spent.`,
         gaps: [
             "This dry run did not execute the live in-sandbox agent route; it checks the evidence shape only, not live behavior, scale, or adoption.",
             "No exec-stream, transcript, substrate, cost, or cleanup artifacts were produced because no live session ran; live verification requires those artifacts.",
@@ -164,7 +166,7 @@ export function buildLiveTerminalProductBundle(args) {
     const review = {
         schema: REVIEW_SCHEMA,
         verdict: args.verdict,
-        summary: args.sessionReason,
+        summary: `1 participant took part: ${formatParticipantOutcomes(tallyParticipantOutcomes([args.trace.status]))}. How it ended: ${args.sessionReason}`,
         gaps: [
             ...(args.trace.status === "passed"
                 ? []
@@ -212,7 +214,7 @@ function terminalParticipant(args, session) {
     const stream = participantStream(TERMINAL_IDS, {
         assignment: participantAssignment({ mission: args.mission }),
         kind: "terminal",
-        label: `Terminal agent · ${args.studyId}`,
+        label: participantCaption({ personaId: args.persona.id }),
         status: session.status,
         transport: "snapshot",
         updatedAt: session.updatedAt,
@@ -275,25 +277,14 @@ function describeCaps(caps) {
         parts.push(`maxMinutes=${caps.maxMinutes}`);
     return parts.length > 0 ? parts.join(", ") : "empty";
 }
-export function renderTerminalReviewMarkdown(bundle) {
+export function renderTerminalReviewMarkdown(bundle, status) {
     const subject = bundle.events.find((event) => event.type === "terminal-lab.subject.declared");
     const credentials = bundle.events.find((event) => event.type === "terminal-lab.credentials.declared");
     const caps = bundle.events.find((event) => event.type === "terminal-lab.caps.declared");
-    return [
-        `# ${bundle.scenario.title}`,
-        "",
-        `- run: ${bundle.runId}`,
-        `- mode: ${bundle.mode}`,
-        `- verdict: ${verdictText(bundle.review.verdict, bundle.mode)}`,
-        `- outcome: ${reviewOutcome(bundle)}`,
-        `- summary: ${bundle.review.summary}`,
+    return renderReviewMarkdown(bundle, [
         `- mission: ${bundle.scenario.goal}`,
         ...(subject ? [`- subject: ${subject.message}`] : []),
         ...(credentials ? [`- credentials: ${credentials.message}`] : []),
         ...(caps ? [`- caps: ${caps.message}`] : []),
-        ...(bundle.review.gaps.length > 0
-            ? ["", "## Gaps", ...bundle.review.gaps.map((gap) => `- ${gap}`)]
-            : []),
-        "",
-    ].join("\n");
+    ], { status });
 }

package/dist/routes/terminal/credentials.js

@@ -1,5 +1,18 @@
 import { DEFAULT_RUNTIME_AUTH, E2B_SYSTEM_CA_BUNDLE, OPENAI_EGRESS_PLACEHOLDER, } from "./runtime-auth.js";
 import { TERMINAL_PRODUCT_STUDY_PROVIDER_METADATA } from "./types.js";
+/**
+ * Where the study's runtime auth puts the key, as a sentence for the missing-key refusal. Typed
+ * `unknown` because a config that skipped the planner may hold a mode the type does not list.
+ */
+function keyPlacement(runtimeAuth) {
+    if (runtimeAuth === undefined)
+        return ` \`execution.runtimeAuth\` is unset, so the default ${DEFAULT_RUNTIME_AUTH} keeps the key outside the sandbox in an E2B header transform.`;
+    if (runtimeAuth === "openai-egress")
+        return " `execution.runtimeAuth: openai-egress` keeps the key outside the sandbox in an E2B header transform.";
+    if (runtimeAuth === "openai-env")
+        return " `execution.runtimeAuth: openai-env` passes the key to the codex command only.";
+    return "";
+}
 /**
  * Resolve the runtime key on the host. openai-egress, the default, returns an inert command env
  * while retaining the actual value for the external transform and literal redaction; openai-env
@@ -38,7 +51,7 @@ export function buildRuntimeAuth(args) {
         return {
             ok: false,
             code: "HUMANISH_TERMINAL_RUNTIME_AUTH_MISSING",
-            message: `Live terminal-product studies declare runtimeAuth "${String(args.runtimeAuth)}" and need ${ALLOWED_RUNTIME_KEY_NAMES.join(" or ")} in the environment (pass via --dotenv; the selected auth mode places the value in command-scoped env or an external E2B header transform; the value is never persisted).`,
+            message: `Live terminal-product studies need ${ALLOWED_RUNTIME_KEY_NAMES.join(" or ")} in the environment, and neither is set.${keyPlacement(args.runtimeAuth)} Pass one with --dotenv; the value is never persisted.`,
         };
     }
     const keyValue = args.env[keyName];

package/dist/routes/terminal/dry-run.js

@@ -124,6 +124,7 @@ function runtimeDeclaredEvent(runtime, createdAt) {
         level: "info",
         type: "terminal-lab.runtime.declared",
         message: redactText(JSON.stringify(declaredRuntimeProvenance({
+            doNotTrack: runtime.doNotTrack,
             ...(version === undefined ? {} : { version }),
             model,
             modelSource,

package/dist/routes/terminal/live-finish.js

@@ -19,14 +19,17 @@ function buildLiveTrace(inputs) {
     const { session } = inputs;
     const { createdAt } = inputs.run;
     const { terminalEvents, commandLog, discardedPrefixes } = inputs.recorder;
-    // Prefix reconciliation may cut through a known key. Scrub literal values across the retained
-    // chunks before any transcript/trace/event artifact is persisted. Check both each stream and
+    // Prefix reconciliation may cut through a known key. Scrub the known values, as written and in
+    // each encoded form, across the retained chunks before any transcript/trace/event artifact is
+    // persisted. Check both each stream and
     // the combined event order that the transcript uses; either view can assemble a split value.
-    scrubSplitKnownValues(terminalEvents, inputs.run.secrets.values(), discardedPrefixes);
+    scrubSplitKnownValues(terminalEvents, (text) => inputs.run.secrets.spans(text), discardedPrefixes);
     // Build the actor trace first (the cost ledger reads its tokenUsage). A session past the cap
     // ends its transcript with what was not stored, and its trace says the same.
     const cut = inputs.recorder.transcriptCut();
-    const normalizedTranscript = `${normalizeLocalActorTranscript(terminalEvents.map((e) => e.chunk).join(""))}${cut ? `\n[humanish] ${cut.notice}` : ""}`;
+    // Normalizing removes terminal escape sequences, which rejoins a value one of them split, so the
+    // transcript is sanitized again after it.
+    const normalizedTranscript = `${sanitize(normalizeLocalActorTranscript(terminalEvents.map((e) => e.chunk).join("")))}${cut ? `\n[humanish] ${cut.notice}` : ""}`;
     // Parsed from the full stream: usage records arrive once per turn, and the tail
     // would drop all but the last. Records past the cap were kept as they arrived.
     const terminalTokenUsage = parseTerminalTokenUsage([normalizedTranscript, ...(cut?.usage ?? [])].join("\n"));

package/dist/routes/terminal/live-sandbox.js

@@ -261,7 +261,10 @@ export class LiveTerminalSandbox {
                 // The install step may run the product itself (release:dogfood's does: `humanish init
                 // --yes`); on the 0.67.0 dogfood that one command arrived unmarked while the participant's
                 // nine others carried the marker.
-                envs: { HUMANISH_STUDY_PARTICIPANT: "1" },
+                envs: {
+                    HUMANISH_STUDY_PARTICIPANT: "1",
+                    ...(plan.runtime.doNotTrack ? { DO_NOT_TRACK: "1" } : {}),
+                },
                 requestTimeoutMs,
                 timeoutMs: PRODUCT_SETUP_TIMEOUT_MS,
             });
@@ -314,7 +317,11 @@ export class LiveTerminalSandbox {
                 // The selected command env (raw key or inert placeholder). The participant
                 // marker rides the same command: humanish telemetry from inside a study reads as a new
                 // adopter otherwise.
-                envs: { ...runtimeEnv.envs, HUMANISH_STUDY_PARTICIPANT: "1" },
+                envs: {
+                    ...runtimeEnv.envs,
+                    HUMANISH_STUDY_PARTICIPANT: "1",
+                    ...(plan.runtime.doNotTrack ? { DO_NOT_TRACK: "1" } : {}),
+                },
                 requestTimeoutMs,
                 timeoutMs: wallClockMs,
                 onStdout: (data) => recordStreamedTerminalChunk("stdout", data),

package/dist/routes/terminal/plan.js

@@ -69,6 +69,7 @@ export function planTerminalStudy(config, input) {
         ...(actor?.persona === undefined ? {} : { personaId: actor.persona }),
         ...(actor?.mission === undefined ? {} : { mission: actor.mission }),
         runtime: {
+            doNotTrack: config.execution?.terminal?.doNotTrack !== false,
             ...(runtimeVersion === undefined ? {} : { version: runtimeVersion }),
             // Codex's own default can change with any release and its JSON stream does not name it, so
             // the route always passes a model: the declared one, else humanish's participant default.

package/dist/routes/terminal/runtime.d.ts

@@ -8,6 +8,7 @@ export declare function parseTerminalRuntimeVersion(stdout: string): string | un
 export declare function buildRuntimeVersionCommand(requestedVersion?: string): string;
 export declare function buildRuntimeExecPrefix(version: string, model: string, reasoningEffort?: ReasoningEffort): string;
 export declare function declaredRuntimeProvenance(args: {
+    doNotTrack: boolean;
     version?: string;
     model: string;
     modelSource: "declared" | "humanish_default";

package/dist/routes/terminal/runtime.js

@@ -35,6 +35,7 @@ export function declaredRuntimeProvenance(args) {
     return {
         schema: "humanish.actor-runtime.v1",
         package: TERMINAL_RUNTIME_PACKAGE,
+        doNotTrack: args.doNotTrack,
         requestedVersion: args.version ?? "latest",
         versionStatus: "unobserved",
         requestedModel: args.model,

package/dist/routes/terminal/session.js

@@ -70,11 +70,12 @@ export async function runLiveTerminalSession(args) {
     const recorder = createTerminalRecorder({
         nowIso,
         sanitize,
-        knownSecretValues: run.secrets.values(),
+        knownSecretValues: run.secrets.forms(),
         verdictNonce,
     });
     const { version, model, modelSource, reasoningEffort } = plan.runtime;
     const runtime = declaredRuntimeProvenance({
+        doNotTrack: plan.runtime.doNotTrack,
         ...(version === undefined ? {} : { version }),
         model: sanitize(model),
         modelSource,

package/dist/routes/terminal/trace.d.ts

@@ -5,9 +5,11 @@ import { type CommandLogRecord, type TerminalEventRecord } from "./types.js";
 /**
  * Per-chunk sanitization cannot recognize a value split across deliveries. Redact those complete
  * known values before persistence without collapsing events or changing stdout/stderr ordering.
- * Work backwards through matches so edits to later text leave earlier offsets valid.
+ * `spansOf` finds them in the joined text: RunSecrets.spans, which also finds a value in an
+ * encoded form or split by a terminal escape sequence. Work backwards through the spans so edits
+ * to later text leave earlier offsets valid.
  */
-export declare function scrubSplitKnownValues(events: TerminalEventRecord[], knownValues: readonly string[], discardedPrefixes: Record<"stdout" | "stderr" | "combined", string>): void;
+export declare function scrubSplitKnownValues(events: TerminalEventRecord[], spansOf: (text: string) => ReadonlyArray<readonly [number, number]>, discardedPrefixes: Record<"stdout" | "stderr" | "combined", string>): void;
 /** Redacted, ellipsis-prefixed tail of a captured stream/log for a message field. */
 export declare function tailOf(text: string): string;
 /**