Support

RunSpecimen is a local CLI. Help is documentation- and issue-based — there is no hosted support portal or guaranteed response SLA.

Documentation

• PyPI package (0.2.0rc16)
• v0.2.0-rc.16 release notes and assets
• User guide
• About
• FAQ
• FAQ: GHSA-8357-m9wf-gjh9 signal-cleanup fix
• Security advisory GHSA-8357-m9wf-gjh9
• Incident bundle spec
• Remote confirm card spec
• ADR-004 remote human confirm

Bugs and product questions

Open an issue on github.com/darashkevich/runspecimen. Include the RunSpecimen version, Python version, OS, and the relevant command when you can.

Interrupted runs and incidents

Use runspecimen recovery-status to determine whether a run was interrupted. Abandonment is an audited, real-TTY decision; the old run ID remains permanently terminal. Do not remove state files or assume recovery makes an untrusted payload safe. In 0.2.0rc3–0.2.0rc15, runspecimen run could orphan an approved contract on SIGTERM/SIGHUP (GHSA-8357-m9wf-gjh9). Upgrade with python3 -m pip install --upgrade --pre runspecimen==0.2.0rc16. Residual limits remain: a setsid() descendant can outlive cleanup; SIGKILL of both the supervisor and the bind watchdog can still orphan work; an unwritable state directory can leave a stale phase=running record. For a reconstructable local pack, runspecimen bundle copies run evidence without pairing tokens or Mac challenge secrets. That pack is not a hosted vault.

Security reports

RunSpecimen is an orchestration and evidence layer, not an OS sandbox. For a suspected vulnerability, do not include secrets, private receipts, or proprietary contracts in a public report. Provide a minimal reproduction and keep the report private to the maintainers of the distribution you received, until a dedicated private reporting address is published. See SECURITY.md.

Last updated: 2026-11-01