Active user attribute set, latest activities, guarded changes to used values, artefact links, durations and averages; irreversible showcase step

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 295952@bnt-lap001
Assistant-Session: e93f64ad-516c-46eb-9666-aad8d300c477

docs/maturity-and-projects.md

@@ -132,6 +132,15 @@ Every attribute has:
 
 Values are never secret (`secret` is not allowed; secret markers are refused). Only references to secrets are allowed.
 
+### The active user: `user-attributes`
+
+One attribute set lives in the app rather than in any project: `user-attributes`, holding the active user's `operator` (one word) and an
+optional `display_name`. It comes from the `RTUT_USER` environment variable, else from the user's saved settings (`/user` page,
+`~/.config/runbook-tutorials/user-attributes.yaml`), else from the operating-system login. Forms that used to ask "your name" (starting a
+run, reviewing a runbook, starting a project run) show who you are running as and link to that page. Any project can reuse the set
+(`attribute_sets: [user-attributes]`); a repository may define its own set of that id, which then takes precedence. If the UI later runs
+behind a login, the login fills the same attribute.
+
 ### Layers, in order (later wins)
 
 attribute sets listed by the project (each after its own `extends`) then the project's own `attributes`, then the target's

docs/pack-spec-v0.2.md

@@ -183,7 +183,7 @@ generic warning), (2) require an explicit confirmation, and (3) record a
 
 An item passed over by push-through gets the distinct state `pushed` (steps, gates and datapoints): not done, not set, not an error.
 
-Every override, waiver and push-through is a **deviation** in the run record:
+Every override, waiver, push-through and change of a value that steps already used (`changed-after-use`) is a **deviation** in the run record:
 `kind` (`override|waiver|push-through`), `item` (step or gate id), `mode`,
 `unmet` (what was not satisfied), `risk_acknowledged`, `reason` (required for
 overrides and waivers; automatic text for push-through), `who`, `at`. A run with

docs/run-spec.md

@@ -106,6 +106,29 @@ Rules the engine enforces:
 - **Modes** are `manual` and `auto-confirm`. Auto-confirm applies confirmation only; running the step's own
   command is a separate, later level ("auto-pilot with execution", RBT-WP-0006).
 
+## Changing a value after steps used it
+
+A v0.1 run fixes its parameters when it starts. In a v0.2 run datapoints can be edited (guided flow questions, data view), but a value
+that steps have already started with is *in use*. Changing it needs the operator's override (a reason and an acknowledged risk), only in
+manual mode, and is recorded as a `changed-after-use` deviation naming the steps and the previous value. A save containing any such
+change is refused as a whole unless the override is given, so a refused save applies nothing. Values nobody used yet change freely,
+which is what the questionnaire is for. A run with any deviation never counts towards maturity.
+
+## Timestamps and durations
+
+`created` is the start and `finished` (set when the run is closed) the end. `elapsed` is start to finish, or to now while the run is
+unfinished; `working` is the time steps were in progress; each step has its own `started` and `finished`. The runbook's score carries
+the average, median and fastest **elapsed time of succeeded runs only**: unfinished, failed and abandoned runs say nothing about how
+long a working run takes. The UI shows this on the run, on each finished step, in the runs list and next to the score.
+
+## Artefacts: open and download
+
+An artefact is a reference to something a run produced. The UI links it when it is a URL, or when it is exactly the artefact's
+resolved local file (`GET /run/<i>/<run>/artefact/<id>`, `?download=1` for an attachment). It refuses, with the reason: a file that
+does not exist yet, anything that is not a regular file, files over 5 MB, files in sensitive places (`.ssh`, `.gnupg`, `.aws`, `.kube`,
+`.git`, key and certificate files, run records), and files whose beginning looks like a secret. Text is served as plain text, never as a
+page, with `nosniff` and a sandboxing CSP; other content is only offered as a download. Symlinks are judged by their real target.
+
 ## Context and revision
 
 Every run (v0.1 and v0.2) records `pack_digest`, the revision of the pack directory it used (a hash of its files,