Run History filter

The filter box on the Runs tab of Run History uses the shared syntax. Its placeholder is filter e.g. process.exe contains "sample" && run.has_static. The status line shows how many runs match, for example 3 of 12 runs.

The filter box and the match count above the runs. Antinomie 0.8.0, synthetic data.

Completion, Help → Filter guide and the right-click menu offer one name per value. Those are the names below.

Fields

Field	Type	Meaning
entry.kind	text	Evidence category (run)
entry.id	text	Recorded run identity
entry.name	text	Name you gave the run; missing when unnamed
tag	text list	Your tags
vm.id, boot.id	text	Recorded VM and boot identity
session.id	integer	Run session identity
process.exe	text	Launched root executable
sample New in 0.8.0	text	The library sample the run executed, by the name it had; missing for other programs
sample.sha256 New in 0.8.0	text	SHA-256 of the library sample the run executed
process.argv	text list	Launch arguments, matched one at a time
process.cwd	text	Launch working directory
process.pid	integer	Root process ID
process.cookie	integer	Boot-scoped root task cookie
process.uid, process.gid	integer	Requested launch user and group ID
run.state	text	The Tree status column’s words: Unknown, Running, Stop requested, Finished, Stopped, PTY closed, Recording ended
run.root_exit	text	The Root exit column’s words, such as Exit 0 or Signal 9
root.exit_code	integer	Normal root exit code; missing for other outcomes
root.signal	integer	Root termination signal; missing on normal exit
run.error	text	Recording failure; missing on success
run.started_ms	integer	Recorded start time; missing on legacy records
run.ended_ms	integer	Recorded tree completion time; missing until observed
run.duration_ms	integer	Recorded elapsed time
run.child_count	integer	Observed total descendants
tree.live, tree.total	integer	Live and total task count
entry.size	integer	Saved size in bytes
entry.complete	boolean	Evidence completeness
run.has_static	boolean	A static-analysis report exists
run.has_core, run.has_memory, run.has_network	boolean	A core, memory or network artifact exists
run.loss.transport, run.loss.ui, run.loss.storage	integer	Boot-scope TRL, UIL and STL at run finalization
terminal.eof	boolean	The terminal stream has ended
capture.network, capture.memory_on_exit, capture.core_on_exit	boolean	The launch asked for a network capture, a RAM dump or a process core

Time and artifact fields are read from the run’s saved metadata in the background, so they can appear a moment after the list.

Examples

process.exe contains "sample" && run.has_static
run.state == "Running"
run.root_exit != "Exit 0"
tag == "needs review"
lower(process.exe) contains "wget"
run.has_network && !run.has_core
run.loss.storage > 0
run.duration_ms > 60000
exists(run.error)
process.argv contains "--install"
sample == "install.sh"
exists(sample) && run.root_exit != "Exit 0"

A run of a library sample: the Sample column, and the sample field, name it. Antinomie 0.8.0, a recorded run.

Older names still accepted

Filters saved or remembered under older names keep working: each is rewritten to the canonical field. They are not offered by completion or the guide.

Older name	Canonical field
id, run.id	entry.id
name	entry.name
tags, entry.tag	tag
path, run.path, entry.path	process.exe
args, run.args	process.argv
cwd	process.cwd
pid, process.tgid	process.pid
task	process.cookie
uid, gid	process.uid, process.gid
state, status, entry.state, run.tree_state, process.state	run.state
error	run.error
entry.time_ms	run.started_ms
analysis.available	run.has_static

Older state values still work too: run.state accepts StopRequested, TerminalClosed and Finalized for Stop requested, PTY closed and Recording ended, and run.root_exit accepts lower-case exit 0 for Exit 0.