humanish 0.15.2 → 0.15.3

package/docs/architecture/actor-contract.md

@@ -1,27 +1,34 @@
 # Actor Contract
 
-Date: 2026-06-06 (updated 2026-06-11)
-
-Status: accepted design, partially implemented. Shipped: the evidence schema
-`humanish.actor-trace.v1` (`src/actor-contract.ts`) and a registry of five
-actors (`src/actor-registry.ts`: `codex-app-server`, `pi-agent-core`,
-`claude-agent-sdk`, `openai-computer-use`, `scripted-browser`), with
-`actors[0].type` a real dispatch key on the computer-use and scripted-browser
-lab routes. Not yet shipped (roadmap, not near-term claims): the full
-`Actor.run(input)` interface, `RedactionHooks` injection, `ApprovalPolicy`,
-`StagehandCuaActor`, and the `persona-fidelity` verify check. Decision 6's
-capture-time screenshot stance was recanted in 0.6.0; see the inline notes and
-the capture-vs-publish rule in
+Date: 2026-06-06 (current-state note updated 2026-07-14)
+
+Status: accepted contract with a partially open extension surface. Shipped:
+the evidence schema `humanish.actor-trace.v1` (`src/actor-contract.ts`) and a
+closed first-party registry of six descriptors (`src/actor-registry.ts`:
+`codex-app-server`, `pi-agent-core`, `claude-agent-sdk`,
+`openai-computer-use`, `scripted-browser`, `codex-exec`). `actors[0].type` is a
+real dispatch key on the computer-use, scripted-browser, and terminal-product
+routes. Product scoring, feedback, and artifact hooks are extension seams, but
+public out-of-tree actor registration and its conformance certification are not
+shipped. Also not shipped: the full `Actor.run(input)` interface,
+`RedactionHooks` injection, `ApprovalPolicy`, `StagehandCuaActor`, and the
+`persona-fidelity` verify check. Decision 6's capture-time screenshot stance
+was recanted in 0.6.0; see the inline notes and the capture-vs-publish rule in
 [`docs/principles/invariants-and-defaults.md`](../principles/invariants-and-defaults.md).
 
+`codex-exec` is a real dispatch key for terminal-product labs, but the exported
+descriptor `runSession` is a fail-closed compatibility entry. Live execution is
+owned by `runTerminalProductLab`, which coordinates sandbox creation,
+command-scoped runtime auth, evidence, caps, and by-id cleanup.
+
 ## Context
 
-> 2026-06-11: this section describes the world as it stood when the design was
-> accepted (one real actor, hardcoded dispatch). That ceiling has since been
-> removed — the registry now holds the four actors listed in the status note.
+> Historical context: this section describes the world as it stood when the
+> design was accepted (one real actor, hardcoded dispatch). The current state is
+> the six-descriptor first-party registry described in the status note above.
 
-An actor is the thing that drives a persona scenario and produces evidence. Today
-Humanish has exactly one real actor: the local Codex integration in
+An actor is the thing that drives a persona scenario and produces evidence. At
+design time Humanish had exactly one real actor: the local Codex integration in
 `src/codex-app-server.ts` (plus the `codex-exec` and `codex-tui` variants in
 `src/run.ts`). The actor selection is a hardcoded `if (actor === ...)` dispatch,
 `RunStream.codex` is Codex-shaped, and the evidence schema is
@@ -91,6 +98,9 @@ API surface.
 
 ## The contract
 
+The excerpt below shows the central contract fields; exported source types are
+authoritative.
+
 ```ts
 export const ACTOR_TRACE_SCHEMA = "humanish.actor-trace.v1";
 
@@ -127,20 +137,21 @@ export interface ActorTraceItem {
 export interface ActorCapabilities {
   headless: boolean;
   structuredTrace: boolean;
-  lanes: Array<"code" | "app" | "computer-use" | "scripted-browser">;
+  lanes: Array<"code" | "app" | "computer-use" | "scripted-browser" | "terminal">;
   producesScreenshots: boolean;
   byoModel: boolean;
   preGrantableApprovals: boolean;   // can run unattended without a human prompt
   inProcessTools: boolean;          // can inject product tools without a subprocess
   license: "open" | "source-available" | "proprietary";
+  keyPlacement?: "external" | "in-sandbox-command-scoped";
 }
 
 export interface ActorTrace {
   schema: typeof ACTOR_TRACE_SCHEMA;
-  provider: string;              // "codex-app-server" | "pi-agent-core" | "claude-agent-sdk" | "openai-responses-cu" | "browser-persona"
+  provider: string;              // e.g. "codex-app-server" | "pi-agent-core" | "claude-agent-sdk" | "openai-responses-cu" | "browser-persona" | "codex"
   providerVersion?: string;
-  protocol: "json-rpc" | "json-stream" | "in-process-sdk" | "cua-loop" | "scripted-steps";
-  lane: "code" | "app" | "computer-use" | "scripted-browser";
+  protocol: "json-rpc" | "json-stream" | "in-process-sdk" | "cua-loop" | "scripted-steps" | "terminal-exec";
+  lane: "code" | "app" | "computer-use" | "scripted-browser" | "terminal";
   persona: { id: string; traitsApplied: string[]; promptDigest: string };  // proves traits were threaded
   // "raw" = full-fidelity frames retained (valid for LOCAL use; redact before
   // publishing); "blurred"/"ocr_scrubbed" = publish-safe; "n/a" = none captured.

package/docs/architecture/observer.md

@@ -1,16 +1,22 @@
 # Observer Architecture
 
-Date: 2026-06-01
+Date: 2026-06-01 (current-state note updated 2026-07-14)
 
-Status: implemented for synthetic stream contracts and local `codex-exec`
-active-run Observer snapshots; broader live actor adapters next.
+Status: implemented for synthetic streams and persisted live browser,
+terminal-product, fan-out, and sequential/concurrent shared-world evidence.
+Plain computer-use and shared-world runs can publish an in-progress bundle to
+an attached loopback Observer without persisting runtime stream-auth URLs. The
+version-pinned README image is a synthetic technical sample, not real-application
+proof.
 
 ## Decision
 
 The Observer is a mission-control surface over durable run artifacts, not a
 static report page.
 
-Every run writes immutable local evidence under `.humanish/runs/<run-id>/`:
+Every run writes durable local evidence under `.humanish/runs/<run-id>/`. Active
+runs refresh their bundle and Observer projection; later review, feedback, or
+Observer commands may add derived artifacts:
 
 ```text
 .humanish/runs/<run-id>/
@@ -25,7 +31,7 @@ Every run writes immutable local evidence under `.humanish/runs/<run-id>/`:
 
 `run.json` remains the source bundle. `observer/observer-data.json` is the
 normalized view model consumed by the Observer. `events.ndjson` is the appendable
-event stream contract that live adapters will update while a run is active.
+event stream contract that live adapters update while a run is active.
 
 ## Stream Model
 
@@ -95,12 +101,12 @@ A host adapter may provide:
 If no embed URL exists, the Observer still renders the Codex-style timeline and
 session contract instead of failing the lane.
 
-## Current Gaps
+## Historical slice and remaining gaps
 
-This slice implemented the Observer substrate, synthetic stream contracts, and
-active-run Observer snapshots for local `codex-exec`.
+The original 2026-06-01 slice implemented the Observer substrate and synthetic
+stream contracts; local `codex-exec` active-run snapshots followed.
 
-Since shipped (updated 2026-06-11):
+Subsequent additions through 2026-06-11 included:
 
 - Playwright-backed browser proof with scripted, app-specific
   `browser.steps` authored in `humanish/scenarios/*.yaml` (`src/run.ts`);

package/docs/architecture/state-driven-executor.md

@@ -134,9 +134,9 @@ import { runLab, parseLabConfig, type CuaExecutor, type CuaProvider } from "huma
 
 // local-app YAML (shareable; fails closed without hooks):
 //   schema: humanish.lab.v2
-//   id: pixel-bae-state
+//   id: downstream-local-app-state
 //   subject: { source: local-app, appUrl: http://localhost:5173 }
-//   actors: [{ type: openai-computer-use, persona: pixel-pat, mission: "…" }]
+//   actors: [{ type: openai-computer-use, persona: curious-tester, mission: "…" }]
 //   scenario: { mode: live }
 const parsed = parseLabConfig(yaml);
 if (!parsed.ok) throw new Error(parsed.error.message);
@@ -199,5 +199,5 @@ Read every optional field defensively, and spread-omit optional fields
   surface with no precedent in this repo (the scripted lane loads only declarative
   YAML; serve commands run isolated inside the disposable E2B sandbox). It earns
   its place only behind its own clamping / trust / digest-pinning design.
-  pixel-bae does not need it: a library caller builds the bridge in their own
+  the validated library consumer does not need it: a caller builds the bridge in its own
   trusted code (entry point 2 above).

package/docs/architecture/terminal-product-lane.md

@@ -1,11 +1,14 @@
 # Terminal-product real-agent lane (issue #154)
 
-Date: 2026-06-16
-
-Status: SLICE 1 shipped — the config + routing skeleton, DRY-RUN only. The live
-in-sandbox backend, the command-scoped credential boundary, cleanup,
-interventions, the cost/no-spend ledger, and the product-adapter extension seam
-are later slices. See the ratified goal packet
+Date: 2026-06-16 (current-state note updated 2026-07-14)
+
+Status: live terminal-product route shipped in `0.8.0`. The in-sandbox backend,
+command-scoped credential placement, exact-id cleanup proof, an interventions ledger,
+cost/no-spend ledger, caps, and product scoring/feedback hooks are implemented;
+the kept 2026-07-09 live receipt verifies 15/15 checks and `share_ready` at a
+`$0` cap. That capability receipt is not adopter replacement: no deletion
+branch has yet removed the reference adopter's bespoke generic study harness.
+See the ratified goal packet
 ([`docs/goals/terminal-product-lane/goal.md`](../goals/terminal-product-lane/goal.md))
 for the full slice plan and the safety contract.
 
@@ -33,7 +36,7 @@ fail-closed cross-validation, and forward-declared warnings.
 | `subject.product` | `{ name, publicSurfaces[] }` — the only world the agent sees |
 | `execution.target` | `e2b-terminal` (or absent → implied) |
 | `execution.terminal` | `{ transport: exec-stream, stdin: disabled }` |
-| `execution.runtimeAuth` | `openai-env` (names-only evidence this slice) |
+| `execution.runtimeAuth` | `openai-env` (names-only durable evidence) |
 | `scenario.caps` | `{ maxUsd, maxJobs, maxMinutes }` — the blast-radius budget |
 | `policies` | `allowPrivateRepoAccess` / `allowProviderCredentials` / `allowPaymentCredentials` / `allowGitHubMutation`, all DEFAULT FALSE |
 | `actors[0].type` | `codex-exec` — a registered terminal actor (`keyPlacement: in-sandbox-command-scoped`) |
@@ -54,16 +57,16 @@ blast radius is bounded by key scoping and budgets, not by hoping.*
 
 The inversion is declared as registry metadata, not a code convention: the
 terminal actor's capabilities carry `keyPlacement: "in-sandbox-command-scoped"`.
-SLICE 1 ships the DECLARED field + value (the contract is honest about where the
-key would go); SLICE 2's engine enforces command-scoped injection (only into the
+SLICE 1 shipped the DECLARED field + value (the contract was honest about where
+the key would go); SLICE 2's engine added command-scoped injection (only into the
 per-command `envs` of the `codex` invocation, never `Sandbox.create({envs})`)
 keyed off that capability, plus the deny-by-default credential allowlist, the
 positive-allowlist sandbox metadata, the cleanup proof, the interventions ledger,
 and a minimal fail-closed cap.
 
-## SLICE 1 scope (DRY-RUN only — what is honest now)
+## Historical SLICE 1 scope (DRY-RUN only when shipped)
 
-`runTerminalProductLab` implements ONLY the dry-run path: it builds a valid
+At SLICE 1, `runTerminalProductLab` implemented only the dry-run path: it built a valid
 `humanish.run-bundle.v1` contract bundle, honestly labeled contract-only, with:
 
 - the subject declared as a terminal-product with its public surfaces, provenance
@@ -76,22 +79,22 @@ and a minimal fail-closed cap.
 - a terminal-kind stream that is an honest **contract placeholder**: stdin
   disabled, empty tail, `transport: snapshot` — **not** `pty` (captured
   non-interactive exec output is never an interactive PTY; invariant 6 + the
-  goal packet's PTY ruling). SLICE 2 fills the redacted exec-stream capture;
+  goal packet's PTY ruling). SLICE 2 later added redacted exec-stream capture;
 - empty/placeholder ledgers (substrate lifecycle, command log, terminal event
-  stream, interventions, cost) that SLICE 2/3 fill.
+  stream, interventions, cost) that SLICE 2/3 later filled.
 
-The dry-run bundle passes the EXISTING `verifyRun`. Terminal-specific verifier
+The dry-run bundle passed the existing `verifyRun`. Terminal-specific verifier
 checks (terminal/transcript presence, lifecycle, cleanup, interventions,
-metadata allowlist, no-credential-in-artifacts, no-spend) are SLICE 2/3.
+metadata allowlist, no-credential-in-artifacts, no-spend) landed in SLICE 2/3.
 
-A non-dry-run (live) call returns a structured `HUMANISH_TERMINAL_AGENT_NOT_IMPLEMENTED`
-failure (fail-closed, clear code) — it never creates a sandbox, never injects a
-key, never spends. SLICE 2 implements the real session.
+At SLICE 1, a non-dry-run call returned a structured
+`HUMANISH_TERMINAL_AGENT_NOT_IMPLEMENTED` failure before launch or spend.
+SLICE 2 implemented the real session.
 
 The DI seams SLICE 2 needs (`loadModule`, `buildSandbox`, `runtimeAuthEnv`,
 `detachedTimers`) are declared on `TerminalProductLabHooks` and threaded through
-`RunLabOptions.terminalHooks`, mirroring `cuaHooks` / `scriptedHooks` — but only
-the dry-run path is implemented this slice.
+`RunLabOptions.terminalHooks`, mirroring `cuaHooks` / `scriptedHooks`; only the
+dry-run path was implemented in that slice.
 
 ## SLICE 4 — the product-adapter extension seam (layer 6)
 
@@ -130,12 +133,13 @@ any malformed score/candidate with a warning, and `verifyRun` re-checks the
 surviving shapes — a bad extension never poisons a verifiable bundle. Proven by
 `tests/terminal-product-adapter-seam.test.ts` (a thin in-repo example adapter
 typing against the barrel only, registering a scorer, attaching namespaced nouns,
-emitting a candidate; the bundle verifies). No live rung — the seam is contract,
-not spend.
+emitting a candidate; the bundle verifies). At SLICE 4 this was contract proof,
+not a live rung; the later end-to-end lane receipt is linked from the status
+note.
 
-The adopter's real scorecard is its OWN thin extension; the live receipt for the
-end-to-end lane is tracked under #159, and true duplex PTY replay is deferred to
-SLICE 5.
+The adopter's real scorecard is its OWN thin extension. The end-to-end lane's
+live receipt is kept under the terminal-product goal, and true duplex PTY replay
+is deferred to SLICE 5.
 
 ## The reference adopter (codename-neutral)
 

package/docs/contracts/adapter-fixtures.md

@@ -1,8 +1,10 @@
 # Adapter Fixture Parity Contract
 
-Date: 2026-06-02
+Date: 2026-06-02 (current-state note updated 2026-07-14)
 
-Status: v0 draft contract for public-safe adapter fixture parity.
+Status: committed contract fixtures with passing parity checks. A fixture
+proves that core can carry an adapter-owned evidence shape; it does not prove a
+live adopter integration or satisfy a deletion-branch depth phase.
 
 ## Purpose
 

package/docs/contracts/core.md

@@ -1,8 +1,11 @@
 # Core Contract
 
-Date: 2026-06-02
+Date: 2026-06-02 (current-state note updated 2026-07-14)
 
-Status: v0 draft contract with tested primitive helpers in `src/core`.
+Status: the listed primitives are shipped and tested. This document does not
+claim that every producer already uses one centralized store: run identity,
+history, and provider-resource lifecycle still span route-specific code and
+remain consolidation work.
 
 ## Purpose
 
@@ -19,7 +22,9 @@ setup, or repository-specific proof language.
 Core records must be safe to include in public run bundles by default:
 
 - artifact paths are relative;
-- run ids contain only lowercase letters, numbers, and dashes;
+- ids produced by the core run-id builder contain only lowercase letters,
+  numbers, and dashes; runtime readers separately accept existing IDs that are
+  any safe single path segment;
 - git state summarizes status without branch names, remotes, file names, file
   paths, or absolute working directories;
 - lifecycle and timing records are explicit inputs, not inferred prose;
@@ -29,7 +34,7 @@ Core records must be safe to include in public run bundles by default:
 
 | Primitive | Contract |
 | --- | --- |
-| Run id | Deterministic from explicit prefix, timestamp, and entropy; valid ids match `^[a-z0-9][a-z0-9-]{0,127}$`. |
+| Run id | The core builder is deterministic from explicit prefix, timestamp, and entropy, and emits ids matching `^[a-z0-9][a-z0-9-]{0,127}$`. Runtime artifact binding uses the broader compatibility rule in `src/run-paths.ts`: one non-empty segment, excluding `.`, `..`, separators, and NUL. |
 | Artifact layout | Builds stable relative pointers under `.humanish/runs/<run-id>/` plus `.humanish/runs/latest.json`. |
 | Latest pointer | `{ schema, runId, path, updatedAt }` using `humanish.latest-run.v1`. |
 | History entry | `{ schema, runId, createdAt, mode, path }` using `humanish.run-history-entry.v1`. |

package/docs/contracts/feedback.md

@@ -1,8 +1,10 @@
 # Feedback Contract
 
-Date: 2026-06-01
+Date: 2026-06-01 (current-state note updated 2026-07-14)
 
-Status: v0 local issue draft generation with run-candidate support.
+Status: local feedback candidate, draft, verification, Markdown, and issue-URL
+generation are shipped. These commands do not mutate GitHub, and public output
+fails closed unless the run verifies as `share_ready`.
 
 ## Purpose
 

package/docs/contracts/policy.md

@@ -1,9 +1,11 @@
 # Policy Contract
 
-Date: 2026-06-02
+Date: 2026-06-02 (current-state note updated 2026-07-14)
 
-Status: v0 draft contract for credential, network, spend, redaction, and
-assisted-run boundaries.
+Status: shipped policy reference for credential, network, spend, redaction,
+sharing, and assisted-run boundaries. Support remains route-specific; the
+parser, route validation, and verifier determine whether a declared field is
+consumed, rejected, or reported as a warning.
 
 Safety amendment (2026-07-14): beginning with `0.15.1`, stored provider IDs are
 evidence and never authorize core provider mutation. The bundled OSS meta-lab

package/docs/contracts/run-bundle.md

@@ -1,9 +1,11 @@
 # Run Bundle Contract
 
-Date: 2026-06-02
+Date: 2026-06-02 (current-state note updated 2026-07-14)
 
-Status: v0 draft contract for bundle identity, layout, source state, history,
-lifecycle, and timing primitives.
+Status: `humanish.run-bundle.v1` is the shipped evidence contract. The
+TypeScript shape and fail-closed verification in `src/run.ts` are
+authoritative; this document explains the stable public fields and extension
+rules rather than independently versioning the runtime.
 
 ## Purpose
 

package/docs/contracts/schemas.md

@@ -1,10 +1,12 @@
 # Contract Schema Index
 
-Date: 2026-06-02 (updated 2026-06-24)
+Date: 2026-06-02 (current-state note updated 2026-07-14)
 
-Status: schema map aligned to the shipped v0.6.x surface. Rows marked
-"reserved" name layering intent only — no code emits or validates them yet.
-Do not emit a reserved schema.
+Status: reference map for the major contracts shipped through source version
+`0.15.3`; it is not an exhaustive inventory of command/result envelopes. Exported types,
+schema constants, parsers, and validators in `src/` are authoritative. Rows
+marked "reserved" name layering intent only — no code emits or validates them
+yet. Do not emit a reserved schema.
 
 ## Purpose
 
@@ -110,9 +112,13 @@ A lab is a composition over code primitives, not a hardcoded kind:
   appear in `subject.env`) pointing at state the lab does not control,
   recorded as UNPINNED in provenance. Commands persist in evidence as
   sha256-16 digests only, never as text;
-- `actors`: who drives it. On the computer-use and scripted-browser routes
-  `actors[0].type` is a real dispatch key resolved against the actor registry;
-  elsewhere it is a descriptive label (e.g. `synthetic-persona`).
+- `actors`: who drives it. On computer-use (including shared-world),
+  scripted-browser, and terminal-product routes, `actors[0].type` is a real
+  dispatch key resolved against the actor registry. On synthetic and meta-lab
+  routes it remains a descriptive label (e.g. `synthetic-persona`). The
+  `codex-exec` descriptor's direct `runSession` member is a fail-closed
+  compatibility entry, not the live runner; the terminal-product lab route
+  owns the live sandbox, auth, cap, evidence, and cleanup lifecycle.
   `actors[0].count` carries route-specific meanings: synthetic route lane
   count (simCount); scripted-browser route surface roster (1 = desktop,
   2 = desktop + mobile, default 1); computer-use **E2B** route the HOMOGENEOUS
@@ -188,12 +194,14 @@ A lab is a composition over code primitives, not a hardcoded kind:
   `terminal.transport` is `exec-stream` — captured NON-interactive exec output
   (stdin disabled); `pty` is rejected because labeling captured exec output as
   an interactive PTY would overstate the mechanism (invariant 6; a true duplex
-  PTY transport is a deferred slice). `terminal.stdin` defaults to `disabled`
+  PTY transport does not ship). `terminal.stdin` defaults to `disabled`
   (`sent`/assisted input is rejected until the interventions ledger + a
   non-comparable marker exist). `runtimeAuth: openai-env` declares the agent's
-  runtime-auth channel — recorded as NAMES ONLY; the command-scoped injection
-  (`keyPlacement: in-sandbox-command-scoped`) is enforced by the engine in a
-  later slice;
+  runtime-auth channel — recorded as NAMES ONLY. On a live run, the engine
+  resolves the registered terminal descriptor and requires
+  `keyPlacement: in-sandbox-command-scoped` before creating a sandbox. The key
+  is passed only to the agent command, never to `Sandbox.create` or metadata;
+  a dry-run neither reads nor injects it;
 - `scenario`: `mode: dry-run` (contract evidence, no spend) or `live`.
   `scenario.ref` is CONSUMED (and REQUIRED) on the scripted-browser route: it
   resolves a committed scenario (`humanish/scenarios/<ref>.yaml` or a repo
@@ -483,9 +491,10 @@ world ("M of N"); PROVEN CONCURRENCY (overlapping windows); and system-state evo
 under load (the stateSeries) with best-effort temporal correlation. It CANNOT claim
 strict causal attribution of a delta to an actor (concurrent ⇒ ambiguous), determinism
 of exact state, per-action granularity, or concurrency-SAFETY (races are OBSERVED, never
-PROVEN absent). HONESTY: the deterministic $0 gate proves the plumbing + the attribution
-contract; the concurrency CAPABILITY at scale is backed only by a separately-authorized
-live receipt.
+PROVEN absent). HONESTY: the deterministic $0 gate proves the plumbing + the
+attribution contract. A kept 2026-06-17 live receipt separately proves one
+bounded three-persona trial against a synthetic plane. Neither the deterministic
+gate nor that receipt proves scale, repeatability, or adopter-harness replacement.
 
 ## Adapter
 
@@ -639,27 +648,29 @@ inside run bundles (per-stream transport and status) and lab execution config
 
 ## Terminal Cost Ledger And No-Spend Proof
 
-The terminal-product lane (`src/e2b-terminal-lab.ts`) places a real provider key
-INSIDE the sandbox, so the no-spend claim must be REAL — derived from a ledger,
-never asserted. The live run writes both to `terminal-ledgers.json` (a `cost`
-block + a `noSpendProof` block, additive to `humanish.terminal-ledgers.v1`).
+The terminal-product lane (`src/e2b-terminal-lab.ts`) passes a real provider key
+only to the in-sandbox agent command, never to sandbox-global env or metadata,
+so the no-spend claim must be REAL — derived from a ledger, never asserted. The
+live run writes both to `terminal-ledgers.json` (a `cost` block + a
+`noSpendProof` block, additive to `humanish.terminal-ledgers.v1`).
 
 The cost ledger (`humanish.terminal-cost-ledger.v1`) has one line per category —
 `product`, `media`, `payment`, `provider` — and follows a strict **null
 discipline** that distinguishes three states and never conflates them:
 
 - `usd: 0` — **known zero**: the category was metered and billed nothing.
-- `usd: null` — **not measured**: no spend signal exists for the category this
-  slice. `null` is written explicitly (never `undefined`-omitted, never guessed
+- `usd: null` — **not measured**: no spend signal exists for the category on
+  this run. `null` is written explicitly (never `undefined`-omitted, never guessed
   to `0`). A line with `null` says "this category exists but we did not measure
   it"; the no-spend proof reports it as unmeasured and does NOT claim it is zero.
 - line **absent** — **not applicable** (n/a) to the lane/run.
 
 `knownTotalUsd` sums ONLY the non-null lines (a `null` line contributes nothing
 and is never coerced to `0`); `fullyMeasured` is true only when no line is null.
-This slice meters only the `provider` line, populated from the actor trace's
-`tokenUsage.costUsd` when present (else `null`); `product`/`media`/`payment` are
-`null` until the SLICE-4 adapter supplies them.
+Core meters only the `provider` line, populated from the actor trace's
+`tokenUsage.costUsd` when present (else `null`); `product`/`media`/`payment`
+remain `null` unless an adapter supplies those signals through the shipped
+cost-probe seam.
 
 ```yaml
 schema: humanish.terminal-cost-ledger.v1

package/docs/goals/current.md

@@ -1,6 +1,6 @@
 # Current Goals
 
-Status date: 2026-07-14 (rev 14)
+Status date: 2026-07-14 (rev 15)
 
 This page is the current public-safe operating goal for `humanish`. Keep it
 short enough to reread before a coding session and concrete enough that future
@@ -16,7 +16,39 @@ Humanish should be the open-source CLI that lets a maintainer ask:
 The answer should be observable, verifiable, public-safe, and easy to turn into
 actionable feedback.
 
-## Current Safety State (`0.15.1`)
+## Current Program Truth (source `0.15.3`)
+
+The package source and repository implementation in this tree agree on these
+points:
+
+The immutable 2026-06-10 proof-roadmap packet is paired with a
+[current implementation checkpoint](https://github.com/danielgwilson/humanish/blob/main/docs/goals/proof-roadmap/README.md).
+
+| Surface | Shipped | Still unproven or unbuilt |
+| --- | --- | --- |
+| Actor execution | Six first-party registry descriptors; computer-use, scripted-browser, and terminal-product dispatch paths | Public out-of-tree actor registration and conformance certification |
+| Persona scale | Bounded per-lane-world fan-out, including differentiated lanes and roster expansion; kept deterministic and live receipts | A completed first-party deletion branch that replaces a bespoke generic harness |
+| Shared state | Sequential and concurrent single-origin shared-world execution; sequential has deterministic proof, concurrent has deterministic and kept live proof | Multi-origin shared-world runtime/schema support; real-adopter deletion proof |
+| Subject sources/routes | Six declared sources: `this-repo`, `clone`, `app-url`, `local-app`, `terminal-product`, and `local-tree`; support is route-specific and `this-repo` remains dry-run-only | One centralized run/resource lifecycle boundary across all routes |
+| Public proof | Version-pinned synthetic Observer sample shipped in the npm payload | A legible Observer hero from one verified real public-application run |
+| OSS meta-lab | Dry-run contract and separate disposable smoke harness | Live meta-lab execution; disabled until repository instructions and actor credentials have an isolated boundary |
+
+Capability proof and adopter replacement are different gates. A deterministic
+test or kept live receipt proves that a Humanish mechanism works. The depth-axis
+goal is met only when an adopter produces decision-equivalent evidence on a
+green branch that deletes its bespoke generic harness and retains at most a
+thin product-specific extension. No first-party deletion branch had met that
+bar as of this status date.
+
+Multi-origin shared-world has a ratified core-design direction, but the
+implementation gate is still closed. A real adopter must first show a concrete
+cross-origin need that the single-origin path or a downstream facade cannot
+serve cleanly; the implementation packet then requires maintainer review before
+build work starts. The current amendment is
+[`docs/goals/multi-origin-shared-world/README.md`](https://github.com/danielgwilson/humanish/blob/main/docs/goals/multi-origin-shared-world/README.md);
+the dated design packet remains unchanged.
+
+## Current Safety Boundary
 
 - Managed run, Observer, feedback, lab, actor-output, and source-archive paths
   bind to validated physical filesystem identities and fail closed on unsafe
@@ -241,8 +273,9 @@ ONE shared world.
   host-side commit/dirty when the packed root is a git work tree; local-tree has no repo/publicRepo
   field. The N actor desktops on the concurrent route still drive the harness-minted getHost URL
   exactly as before; only the subject's provisioning + provenance source changed. The multi-origin
-  design (`docs/goals/multi-origin-shared-world/design.md`) remains a separate, still-held
-  downstream slice. `next patch`
+  design (`docs/goals/multi-origin-shared-world/design.md`) remains a separate,
+  ratified but implementation-gated downstream slice. It is not part of
+  `0.15.3`.
 
 Adopter-driven engine features (0.11.0; surfaced by real bespoke-sim migrations):
 
@@ -302,7 +335,7 @@ Evidence hygiene and readback polish (0.12.16):
   (`local_only`), while feedback draft/issue commands require `share_ready` and fail
   closed with structured reasons. `done`
 
-Attached CUA live Observer (next patch):
+Attached CUA live Observer (shipped):
 
 - Plain computer-use labs now honor the same attached `onObserverReady` lifecycle as shared-world
   labs: a live CUA run writes an in-progress bundle before actor sessions complete, loopback
@@ -356,7 +389,7 @@ Minimum acceptance:
 Make the maintainer `oss` lab report nested lane health back into the
 top-level Observer instead of relying on a human watching the desktops.
 
-The `0.15.1` safety state above governs this lane. The completed bullets below
+The current safety boundary above governs this lane. The completed bullets below
 record prior capability and evidence shape; they do not mean the live
 entrypoint is currently enabled.
 
@@ -414,15 +447,31 @@ Stop and correct course if:
 
 ## Best Next Work
 
-The next most useful engineering slice is repeated agent dogfood against real
-apps and tools, while preserving the public-safety boundary:
-
-- public/open-source fixture proof for publishable examples;
-- private maintainer dogfood through the repo-only public-safe packet, which is
-  intentionally not part of the npm payload, at
-  [`docs/goals/private-repo-agent-dogfood/goal.md`](https://github.com/danielgwilson/humanish/blob/main/docs/goals/private-repo-agent-dogfood/goal.md);
-- then richer provider-backed app-specific browser persona manifests.
-
-That sequence keeps the package honest: first prove a new maintainer or agent
-can start, then prove Humanish can observe real product behavior, then use the
-failures to improve the harness.
+After the public-truth reset, take one bounded public-proof side task: capture a
+verified, legible four-lane Observer from a commit-pinned public application.
+That run treats the application as a study subject, not a Humanish adopter, and
+must not imply endorsement. Stop and return to this order if the capture would
+require an Observer redesign or broader architecture work.
+
+The next engineering proof slice remains the first depth-axis deletion branch:
+run an existing first-party consumer web-app study through current Humanish,
+compare the decision outputs, and delete the adopter's bespoke generic harness
+while retaining only a thin product extension. The public-application capture
+does not satisfy this depth gate.
+
+After that checkpoint, re-evaluate this order rather than treating it as an
+automatic queue:
+
+1. centralize run identity, history, and provider ownership behind tested
+   `RunStore` and `ResourceLease` interfaces, and make generated first-run
+   source load-bearing or explicitly optional;
+2. complete the agent-skill deletion branch and use it to force the real
+   external extension budget;
+3. implement multi-origin shared-world only if its adopter gate opens and the
+   ratified packet passes maintainer review;
+4. complete the multi-app adopter deletion branch;
+5. establish the external stratified panel.
+
+The existing version-pinned README hero is a synthetic technical sample. It
+proves package/Observer rendering and public-safe asset delivery, not
+real-application evidence.