humanish 0.105.0 → 0.106.1

package/docs/release/0.20.0-external-public-shared-world.md

@@ -1,43 +0,0 @@
-# 0.20.0 — External-public shared-world plane + CDP lobby-code handoff
-
-Additive minor release. No breaking change to the provisioned-getHost path, its schema, or its verify
-asserts (byte-stable; a snapshot regression pins it).
-
-## Highlights
-
-- **External-public shared-world plane class** (`sharedWorld.planeClass: "external-public"`). A real,
-  operator-OWNED public deployment can now be the shared plane DIRECTLY: `subject.source: app-url` +
-  `subject.topology: shared-world` + `policies.allowPublicTargets: true` +
-  `execution.concurrency > 1`. NO getHost, NO clone, NO subject sandbox, NO seed. The N>1 +
-  `allowPublicTargets` refusal now ROUTES here when `topology: shared-world` is declared, instead of
-  failing.
-- **Operator-ownership attestation** `subject.publicTarget: { owner, authorized: true }` — the honest
-  analog of `exposure: synthetic` for a plane the harness does not own (author-trust, unverifiable).
-- **CDP lobby-code handoff barrier.** A new runtime-only `CuaLoopOptions.onObservedUrl(url)` callback
-  (fired after every `executor.observe()`, never persisted) feeds a host-first barrier: the host seat
-  creates the shared lobby, the orchestrator extracts `/lobby/CODE` from its CDP-observed URL and
-  threads the code into the follower JOIN missions; followers fail closed WITHOUT opening on
-  `HUMANISH_CONCURRENT_SHARED_WORLD_LAB_HANDOFF_TIMEOUT`.
-- **3-mobile lobby-trivia example** (`humanish/labs/lobby-trivia-3player.yaml` + an init template): 3
-  mobile-LAYOUT personas play the same multiplayer lobby on a real public app at once. Dry-run $0.
-- **Honest evidence class.** Attribution stays `shared-world`; every strength claim degrades honestly
-  and is asserted-ABSENT by verify: `subject.state.provenance == external-public` (not seeded);
-  `plane.exposure` ABSENT (no synthetic claim on a real site); `plane.publicOriginDigest` is the
-  OBSERVED origin the seats converged on (redirect-tolerant — a cross-origin apex→www/http→https
-  redirect is normal; the declared origin is recorded separately as `plane.declaredOriginDigest` and
-  is never asserted equal) with every observed `routeHostDigest` converging on it (operator-attested,
-  not harness-controlled); NO
-  authoritative `stateSeries` (Option A); relaxed concurrency-on-pass (temporal co-occupancy only);
-  optional `lobbyConvergenceDigest`. The getHost synthetic gate stays UNCHANGED and is deliberately
-  unreachable from the app-url branch.
-
-## Watch-from-phone
-
-`humanish serve --expose` covers the evolving Observer/artifacts from a phone TODAY. Native
-live-desktop `--expose` streaming on the concurrent path is a clean 0.20.1 fast-follow reusing
-`startExposedObserver` on the concurrent observer server.
-
-## Notes
-
-- Cost tracking (0.19.0) and the CommandExitError resilience fix (0.19.1) remain in place.
-- `execution.timeoutMs` caps the host-first handoff deadline (default 120s).

package/docs/release/0.84.0-redacted-evidence.md

@@ -1,42 +0,0 @@
-# Humanish 0.84.0: share evidence while keeping readable originals
-
-`humanish export --format bundle --redact-screenshots` creates a separate
-workspace containing a redacted copy of a completed run. The original screenshots
-remain readable for local adjudication. The copied run keeps the same ID,
-participants, findings, task results, subject pins, settings and cost records.
-
-```bash
-humanish export --run RUN --format bundle --redact-screenshots --out shared-study
-humanish verify --cwd shared-study --run RUN
-humanish feedback draft --cwd shared-study --run RUN
-humanish feedback issue --cwd shared-study --run RUN --repo OWNER/REPO
-```
-
-The exporter verifies frozen source bytes, transforms every PNG, rebuilds the
-Observer and verifies the resulting workspace before publishing it. Its receipt
-records copied, changed and omitted files. Unsupported image or binary formats,
-unsafe paths, unfinished runs, changing source files and existing destinations
-are refused. Operational journals do not give the derivative a resource lease
-or create another study attempt.
-
-The existing full-frame blur makes screenshots unsuitable for detailed visual
-adjudication. Keep the original, and review text and findings before sharing.
-
-Ordinary `verify` also checks declared actor and partial-trace screenshots and
-feedback candidate evidence. Missing, unsafe or invalid referenced files fail.
-Explicitly raw frames retain `local_only`, including partial traces and a raw
-frame under a conflicting blurred declaration. Empty nonimage feedback files
-remain valid when no other consumer requires content. Missing or unknown
-per-frame redaction metadata keeps existing compatibility behavior; this is
-not a pixel audit or certification of absent metadata.
-
-Static Observer renders now display their actual verification grade. HTML
-attachments retain screenshot playback and grid thumbnails; generic artifact
-links retain their containment restrictions.
-
-The [workflow receipt](../goals/computer-use-actor/receipts/redacted-evidence-workflow-2026-09-07.md)
-records four real sessions, 67 unchanged original files and 31 transformed frames.
-All four moved workspaces passed published 0.83.2 verification and feedback
-commands with the originals unavailable. Browser inspection covered bundle and
-HTML playback at desktop and mobile sizes. This was an operator rehearsal using
-a known TodoMVC repair; external maintainer adoption remains unproven.

package/docs/release/0.84.1-portable-feedback.md

@@ -1,20 +0,0 @@
-# Humanish 0.84.1: feedback commands work in exported workspaces
-
-Feedback acceptance commands now call the installed `humanish` CLI directly.
-They work from a standalone exported evidence workspace without a package
-manifest or repository script:
-
-```bash
-humanish verify --run RUN --json
-humanish watch --run RUN --no-open
-```
-
-Run them from the directory containing `.humanish/`, with the CLI on `PATH`.
-The watch command serves the Observer until stopped. These commands do not
-download a different package version.
-
-Redrafting feedback from recognized first-party candidates also updates exact
-legacy command templates. Custom acceptance instructions and all original
-candidate evidence and receipts remain unchanged. Unusual run IDs are quoted
-for shell use. The [feedback contract](../contracts/feedback.md) describes the
-compatibility boundary.

package/docs/release/0.85.0-observer-review.md

@@ -1,56 +0,0 @@
-# Humanish 0.85.0: watch and review complete screens
-
-Observer now shows portrait and desktop captures at their original proportions,
-with equal-height grid previews and a compact caption below each screen. Live
-labels and controls leave the captured pixels clear. A stable Info button opens
-participant details, labeled Pin/Compare actions and recorded notices.
-
-Run activity, viewing mode and evidence freshness are distinct. Finished studies
-say they are finished; failed updates preserve the last evidence and offer retry.
-Seeking, keyboard controls, moment links and refresh agree about the displayed
-capture. Paused replay stays on its selected frame as new evidence arrives.
-
-The review tools include:
-
-- elapsed-time playback, capture-gap labels, Skip waits and action/finding navigation;
-- fit, actual size, zoom/pan, fullscreen and a hideable/resizable inspector;
-- copyable moment links, original-frame inspection and local saved moments;
-- preview size, filtering, pinning, monitoring and reachable participant pages;
-- participant and cross-run comparison with explicit capture age and missing coverage;
-- consistent icons, keyboard hints, explicit popover dismissal and larger touch targets.
-
-`observe` and the built TUI open existing evidence through a local viewer. Live
-desktop access remains owned by the attached process; opening an existing study
-cannot recover another process's credentials. Offline exports keep the current
-renderer and saved images without runtime desktop authority. The
-[Observer review guide](../architecture/observer-review.md) explains these paths.
-
-## Updating
-
-Install this version using your usual package manager. For a global installation:
-
-```bash
-npm install -g humanish@0.85.0
-humanish --version
-humanish observe --run RUN
-```
-
-Run the last command from the workspace containing the existing study. Previously
-generated HTML embeds its viewer: reopen the run with the updated CLI, or
-regenerate its HTML export, to get the new interface.
-
-## Verification and limits
-
-The implementation was exercised with five hosted two-participant studies and
-140 retained screenshots. A separate check opened all 28 frames through observe,
-the built headed TUI and HTML export: 84 of 84 opens passed. The
-[implementation receipt](https://github.com/danielgwilson/humanish/blob/main/docs/goals/observer-qol/receipts/2026-09-08-observer-review.md)
-distinguishes failed probes, accepted runs and cleanup evidence.
-
-Regression coverage includes 156 Observer tests, 33 production-artifact browser
-scenarios and 15 iframe/artifact isolation checks. Browser acceptance covers
-Chromium on Linux, including touch emulation; physical devices and other engines
-remain unverified. Screenshot replay remains sparse evidence, without a
-continuous video track or guaranteed before/after capture for every action.
-The pre-existing source-checkout TUI loader limitation remains; the built CLI
-is the tested installation path.

package/docs/release/0.85.1-observer-continuity.md

@@ -1,20 +0,0 @@
-# Humanish 0.85.1: keep your place while reviewing evidence
-
-The Observer review flow now carries the selected evidence between views:
-
-- The library button opens a drawer from the player and comparison on desktop and phone.
-- Comparison previews share a height, preserving complete portrait and desktop screens. Panels use the same participant names as the grid and link to their exact recorded frames. Open a frame, save it, and return to the previous comparison alignment and cursor. Reopening the same comparison from the grid also keeps its place.
-- Adding another run cannot silently remove one of the three selected participants. Grid-only filters no longer appear in comparison.
-- Recalling a saved moment after reloading and stepping through frames selects the saved image as well as its URL.
-- Player details identify the selected participant rather than the study's fan-out placeholder.
-- Selecting Reported thinking shows existing narration even when thinking is hidden in All evidence. Warnings & findings includes a separate, paged list of run/setup notices with their recorded timestamps; these notices do not invent screenshot links or claim participant product findings.
-
-Install with `npm install -g humanish@0.85.1`. Reopen an existing run with the updated CLI (`humanish observe --run RUN` from its workspace), or regenerate its HTML export, to refresh embedded viewers.
-
-## Verification and limits
-
-The [retained workflow receipt](https://github.com/danielgwilson/humanish/blob/main/docs/goals/observer-qol/receipts/2026-09-09-review-continuity.md) records actual-study outcomes, independent review and practical limits. The production browser suite adds desktop/touch library access, comparison-to-frame/save/return, browser history and explicit capacity checks. Player regression tests cover narration filtering and separate notice pagination without changing the selected frame.
-
-A fresh hosted two-participant drawDB study exercises actual growing captures and the review journey. Retained run: `observer-review-journey-n2-20260909`. The attached `observe` check follows updated captures; it does not establish a new live-desktop connection or physical mobile fidelity. The release gate separately exercises the packed candidate in disposable terminal sandboxes.
-
-Saved moments remain local to the browser. Cross-run review requires the served run library. Screenshot replay remains sparse; continuous video, physical devices, other browser engines, and screen-reader acceptance remain separate work.

package/docs/release/0.86.0-participant-evidence.md

@@ -1,50 +0,0 @@
-# Humanish 0.86.0: know which assignment and action you are reviewing
-
-The Observer now shows each participant's assigned mission and lane focus.
-Expand **Assigned task** in the player or participant details to read the
-instructions. Computer-use runs also include their participant-facing task
-goals. Hidden success checks and runtime access details stay outside this
-assignment. Older recordings explicitly say when an assignment was not recorded.
-
-Selecting an activity entry now selects that entry's identity, timestamp and
-coordinate pin. Two clicks between the same screenshots can be inspected
-separately. The image remains the recorded capture; its label explains whether
-its timestamp is before, after or equal to the selected entry's timestamp.
-Missing timestamps stay explicit. **Show capture interval** returns to the
-complete interval, and **Next action** visits actions within the same interval.
-
-Copied links and local saved moments retain the selected action. Saved entries
-include subsecond timestamps and their recorded order, so repeated clicks or
-keypresses remain distinguishable. A missing saved entry reports its absence.
-On phones, the player keeps the selected participant's name above the evidence.
-
-This release also supports the current `@e2b/desktop` 2.4.0 startup cleanup path.
-If startup fails after an instance is acquired, the SDK's internal kill and
-Humanish's fallback share one cleanup result bounded by the lower of the
-caller's request timeout and ten seconds. Unconfirmed cleanup prevents another
-allocation. Successful creation restores normal teardown behavior. Older
-supported SDKs retain their cleanup protection.
-
-Install with `npm install -g humanish@0.86.0`. Reopen an existing run with
-`humanish observe --run RUN`, or regenerate its HTML export, to update its viewer.
-Updating the viewer cannot reconstruct assignments absent from the original run.
-
-## Verification and limits
-
-The [retained study receipt](https://github.com/danielgwilson/humanish/blob/main/docs/goals/observer-qol/receipts/2026-09-09-participant-context.md)
-records the two-participant app study, actual-recording browser review and two
-hosted SDK startup-fault probes, including their incomplete outcomes and limits.
-
-Assignment tests cover computer-use, shared-world and terminal producers,
-including redaction, old bundles and hidden-field exclusion. Shared-world and
-terminal routes retain their mission and role instructions; they do not expose
-unexecuted manifest tasks as participant assignments. Browser checks cover
-action selection, refresh, save/recall and phone context in the production
-artifact. SDK conformance uses the actual installed create/start implementation
-with controlled method faults on the current, older and minimum supported peers.
-
-Screenshot replay remains sparse. This change does not add continuous video,
-infer participant thoughts, or certify physical mobile input. A cleanup deadline
-does not establish ownership before the SDK returns a handle or prove provider
-reclamation after an unconfirmed response. Saved moments remain local to the
-browser.

package/docs/release/0.86.1-task-preflight-saved-recordings.md

@@ -1,40 +0,0 @@
-# Humanish 0.86.1: enforce declared tasks and preserve saved recordings
-
-Humanish now refuses a task protocol when the chosen execution path cannot run
-it. Previously, a shared-world, terminal, scripted or synthetic lab could accept
-`actors[0].tasks` and then omit those tasks during execution. Preflight now names
-the unsupported field before creating a run or starting hooks, processes,
-desktops or model requests. Remove `tasks` only when you intend a mission-only
-study, or choose a supported per-lane computer-use route.
-
-The same check protects direct library callers. Per-lane computer-use tasks
-remain supported, including `local-agent`, `local-app` and `desktop-cli` paths.
-Tasks on a second or later actor are rejected because current runners consume
-the first actor. The [support matrix](../architecture/task-protocol-support.md)
-describes the execution boundaries and structured errors.
-
-Portable HTML exports now identify themselves as **Saved recording**, including
-when opened from a website. They do not request a live feed, show a retry warning
-for a missing endpoint, or open a desktop preview from a recording captured
-while the participant was running. Recorded outcomes, timestamps and images
-remain intact. Ordinary `humanish observe` and `humanish serve` pages still
-request updates and report real connection failures.
-
-Install with `npm install -g humanish@0.86.1`. Regenerate an existing export with
-`humanish export --run RUN --format html` to use the corrected viewer. Existing
-HTML files keep the behavior of the version that produced them.
-
-## Verification and limits
-
-The task preflight proof exercises unsupported lab shapes through the compiled
-CLI with provider, network and subprocess operations denied. Parser and direct
-runner tests also cover supported CUA paths and mission-only execution. These
-are refusal and compatibility checks; they do not establish task support in
-the rejected engines.
-
-Production browser checks use a retained real recording over HTTP and from a
-local file at desktop and phone widths. Controls cover ordinary served pages,
-legacy exports and a snapshot captured while running. Snapshot checks verify
-that no feed, history or live desktop request occurs; served controls preserve
-the visible connection failure. No run-data schema or original study result
-changes, and this release adds no continuous video or physical-device proof.

package/docs/release/0.87.0-participant-endings-and-phone-review.md

@@ -1,64 +0,0 @@
-# Humanish 0.87.0: see why a participant stopped
-
-The Observer now distinguishes a provider response limit from elapsed time or
-estimated spend. Participant cards, summaries and reports show the recorded
-cause, including for participants with no screenshot frames. New computer-use
-traces retain an optional `stopCause` alongside the existing status and
-completion reason.
-
-New computer-use sessions that hit their estimated spend cap before any action
-are classified as interrupted, with no target-app feedback inferred from that
-harness stop. The cap timing and recorded usage are unchanged.
-
-Older recordings use exact machine-generated notices where available. A recorded
-“provider token limit reached” notice remains **provider token limit**: it does
-not establish whether the provider exhausted its output or context allowance.
-When an older run records only a generic limit, the Observer says **limit
-reached**. Updating a viewer preserves the original evidence and outcome counts;
-it does not infer a cause from participant prose.
-
-On phones, a saved landscape capture in Fit mode keeps playback controls beside
-the fitted image. Portrait captures, zoomed views and live views retain their
-bounded viewing area. The run banner states **Saved recording** once; the player
-keeps the participant status and selected capture timestamp. Exact action links
-and saved-moment recall retain their existing behavior.
-
-Expanded assignments show the recorded lane focus before the mission, so a long
-mission does not put those instructions below it in the phone panel. The full
-mission and participant tasks remain available.
-
-The website also explains credential placement by execution route. Computer-use
-model keys remain on the host. Terminal actors receive a command-scoped runtime
-key by default; optional `openai-egress` keeps the raw key outside the sandbox
-while still allowing sandbox processes to make paid requests through its proxy.
-Evidence stays local by default, and exposing Observer or sharing an export makes
-it accessible to others. See the [credential and sharing guide](https://humanish.dev/docs/budgets-and-privacy#store-credentials).
-
-Install with `npm install -g humanish@0.87.0`. Reopen a run with
-`humanish observe --run RUN`, or regenerate its HTML export, to use the updated
-viewer. Existing HTML files retain the renderer that produced them.
-
-## Verification and limits
-
-[Interruption-cause checks](https://github.com/danielgwilson/humanish/pull/747)
-cover recorded provider output limits, legacy token-limit notices, elapsed time,
-spend and incomplete provider responses. Tests preserve old outcome counts and
-source evidence through served and exported projections. A retained real
-recording was inspected at desktop and phone widths, including its participant
-whose provider stopped before any app action.
-
-[Zero-action spend-cap checks](https://github.com/danielgwilson/humanish/pull/752)
-verify one provider turn, zero executed actions, retained usage, an interrupted
-outcome and no inferred target-app feedback. Older bundle counts are unchanged.
-
-[Phone review checks](https://github.com/danielgwilson/humanish/pull/746) cover
-landscape and portrait capture/control spacing, keyboard seeking, focus, zoom,
-action links, refresh and saved-moment recall against retained recordings.
-These browser checks do not establish physical-phone behavior or new live-stream
-coverage. Screenshot replay remains sparse, and no participant success rate or
-incremental persona benefit is inferred from these changes.
-
-The [assignment ordering change](https://github.com/danielgwilson/humanish/pull/754)
-preserves recorded text while moving lane instructions to the top of expanded
-assignments. This addresses visibility; it does not establish that every reader
-will interpret the instructions correctly.

package/docs/release/0.88.0-study-diagnostics.md

@@ -1,43 +0,0 @@
-# Humanish 0.88.0: see what ended a study
-
-When a computer-use study stops before the task is done, `humanish lab run` now
-shows its diagnostic category and recorded stop cause. Fan-out results retain
-each participant's ending. Different endings remain mixed. Older generic budget
-stops retain an unspecified limit. Successful dry-runs are reported as contract
-previews.
-
-New review packets and feedback participant summaries use recorded interruption
-labels. Previously saved review packets keep their original wording.
-
-An adapter can use the new `CuaAdmissionLimitError` to declare that its local
-limit refused a request before dispatch. Humanish records **adapter admission
-limit** and ends the interaction without another retry, action or closing
-report. Earlier actions and measured usage remain available. A refusal of an
-optional closing report preserves the already observed task outcome. See the
-[adapter contract](../contracts/adapter-admission.md) for when this signal applies.
-
-If an earlier request stalled or had an ambiguous transport outcome, a later
-success or local refusal does not make its missing usage known. The cost summary
-keeps measured token estimates and an explicit unmeasured line. With a spending
-cap, Humanish skips the optional closing report while that usage is uncertain.
-
-Install with `npm install -g humanish@0.88.0`. CLI JSON adds optional diagnostics
-without changing the existing status or exit-code contract. Usage telemetry,
-enabled by default, adds two fields with fixed allowed values: diagnostic
-category and stop cause. See [TELEMETRY.md](https://github.com/danielgwilson/humanish/blob/main/TELEMETRY.md)
-for their scope and opt-out controls.
-
-## Verification and limits
-
-[Admission-limit checks](https://github.com/danielgwilson/humanish/pull/759)
-cover refusal before and after activity, sanitized error handling, preserved
-outcomes and unknown usage after both successful and refused retries.
-[CLI diagnostic checks](https://github.com/danielgwilson/humanish/pull/758)
-cover previews, mixed endings, missing causes, invalid evidence and telemetry
-allowlists. The required release checks also cover package installation,
-Observer rendering and the website.
-
-The admission signal depends on an accurate adapter declaration; it is not a
-provider billing receipt. Existing generic failures keep their recorded
-outcomes. This release does not infer causes from participant prose or establish
-why an older study failed.

package/docs/release/0.88.1-completion-evidence-and-local-app.md

@@ -1,79 +0,0 @@
-# Humanish 0.88.1: distinguish reported completion from condition matches
-
-When a computer-use participant says it finished, review and Observer now
-label that completion as **participant-reported**. A recorded `stopWhen` match
-or completed dwell window identifies a **recorded completion condition** instead.
-Missing, malformed or conflicting completion evidence is labeled unavailable.
-Zero-completion counts use **0/N recorded completions**, and aggregate stats use
-**recorded goal completions**.
-
-A matched condition establishes only that condition, not every aspect of the
-mission. The run gate and share-safety verification remain separate from task
-adjudication. This release adds no automatic semantic evaluator.
-
-Existing actor statuses, `participants.reachedGoal`, verdict values and
-denominators stay unchanged. Current review commands, Observer rendering and
-newly generated feedback drafts apply these labels to older runs while
-preserving original bundles and actor traces. Existing HTML exports keep their
-original renderer. Other actor routes retain their own completion semantics.
-
-## Run a local app from npm
-
-To connect your local app's state and actions to Humanish, start with the
-[complete npm example](../architecture/examples/state-driven-local-app/README.md):
-
-```bash
-npm install humanish@0.88.1
-node node_modules/humanish/docs/architecture/examples/state-driven-local-app/runner.mjs
-```
-
-It starts a synthetic loopback app, reads its state, sends a greeting through
-its HTTP action endpoint and verifies the recorded run. A `finally` block closes
-the app. The provider follows a deterministic rule, so the example needs no
-model credentials or E2B desktop. Use Node.js 20.3 or later.
-
-The runner supplies both `CuaExecutor` and `CuaProvider`, passes a decoded object
-to `parseLabConfig`, and checks the config and backend discriminants. The
-existing `stableProgressKey` utility is now exported from `humanish`, so callers
-can use the same bounded state projection as the loop. Replace the two ports
-with your app bridge and provider; the example guide explains the responsibilities
-that remain with them.
-
-## Clipboard fallback returns after the write
-
-When direct desktop typing fails, Humanish can write the text to the X clipboard
-and paste it. `xclip` and `xsel` fork a process to keep the selection available;
-inherited output pipes could leave the command runner waiting until timeout.
-Both clipboard-write commands now detach their output while preserving the
-existing exit checks, temporary-file cleanup and paste dispatch.
-
-Custom desktop images still need a working `xclip` or `xsel`. Missing utilities
-continue to report `clipboard-utility-missing`. This patch adds no typing retry,
-and recovery after a primary write inserted an unknown partial prefix remains
-unproven. [Issue #340](https://github.com/danielgwilson/humanish/issues/340) remains
-open for that broader typing problem.
-
-## Verification and limits
-
-[Completion label checks](https://github.com/danielgwilson/humanish/pull/765)
-cover participant reports, recorded condition matches, zero completions and
-unavailable legacy detail. They preserve recorded counts and statuses while
-refreshing historical review and feedback projections. Existing adapter
-narrative remains available.
-
-[The packaged example](https://github.com/danielgwilson/humanish/pull/762) completed
-two independent local runs on Node 20.20.2 and 24.12.0. Each made two HTTP state
-reads and one state-changing request, reached `goal_satisfied`, verified as
-`share_ready` and closed its server. These checks used locally packed candidate
-source labeled 0.88.0, distinct from the registry release with that version.
-
-[The clipboard correction](https://github.com/danielgwilson/humanish/pull/761)
-passed two real desktop conformance cases, one with explicitly installed `xclip`
-and one with `xsel`. Each preserved the exact Unicode/newline/quoted text with
-one paste and removed its transfer file. Both cases refused the primary write
-before it could type anything. They do not establish default-image clipboard
-availability or recovery from partial typing.
-
-Both checks were model-free. They establish the tested integration and executor
-behavior; persona effectiveness and independent maintainer adoption remain
-separate questions.

package/docs/release/0.88.2-sequential-study-budgets.md

@@ -1,57 +0,0 @@
-# Humanish 0.88.2: sequential studies honor model-spend thresholds
-
-Sequential shared-world studies now enforce the `execution.caps.maxUsd` and
-`maxTotalUsd` thresholds they previously accepted without applying. This covers
-computer-use participants sharing a clone or local-tree subject with
-`subject.topology: shared-world` and `execution.concurrency: 1`.
-
-Each participant's reported usage feeds the per-participant threshold and the
-shared study estimate. Final usage, including a closing report, is reconciled
-before the next participant starts. A participant interrupted by a threshold
-has `budget_reached` / `incomplete`; its reason distinguishes prior activity
-from no material progress. Later participants blocked by the shared threshold
-make no model requests and add no executed turn to the checkpoint timeline.
-A closing report that crosses the threshold preserves the already recorded
-completion condition while blocking subsequent participants.
-The bundle retains all declared participants and an explicit blocked suffix.
-Verification checks the suffix against its preceding interruption, participant
-records and unchanged executed timeline; absent participants cannot masquerade
-as budget-blocked seats.
-
-These checks happen after a model response and before its actions or another
-participant turn. The current request can overshoot a threshold. They estimate
-model spend; they do not reserve future requests or cap provider invoices,
-desktop compute, or target-app charges. A zero threshold can still allow the
-first model request. Use an explicit dry-run for a path without provider calls.
-
-An unpriced model with a declared threshold is refused before allocation. For
-an otherwise completed response, missing or partial usage ends capped sequential
-execution with `harness_error` and `usage_unreported` (“provider usage unavailable”).
-The CUA loop sends no further participant request, retry or closing request.
-An explicitly incomplete provider response retains its original interruption
-cause first; its missing usage remains unknown. For these strict capped sessions,
-the default OpenAI adapter makes one dispatch per requested turn, including
-HTTP errors and policy negotiation. The loop cancels the request signal when
-its timeout wins, so an outstanding transport cannot retry after the loop ends.
-Injected providers must honor that signal and control their own dispatches;
-cancellation cannot undo an already billed request. Known partial costs stay
-in the trace, and an unknown shared budget blocks later participants.
-
-Sequential traces now retain dated model estimates. The run total explicitly
-marks desktop compute as unmeasured, so the model subtotal is a lower bound.
-Observer labels a partial estimate as known cost with the total unknown.
-A custom session returning a different model identity fails orchestration and
-blocks later participants while preserving its original outcome and the
-estimate for its returned model. This does not retrospectively enforce an
-arbitrary custom runner that ignored its cap options.
-
-Existing bundles are not rewritten. Uncapped sessions and other execution
-routes retain their existing behavior. The stricter unknown-usage rule applies
-to sequential capped studies; the sequential route still has no running
-Observer usage stream.
-
-Verification covers the actual participant loop with captured provider usage,
-individual and shared thresholds, unstarted seats, zero and missing usage,
-closing requests, model mismatches, checkpoint evidence and cleanup. These
-contract checks establish the tested behavior; they do not establish persona
-effectiveness, independent adoption, or exact provider billing.

package/docs/release/0.89.0-study-findings.md

@@ -1,79 +0,0 @@
-# Humanish 0.89.0: evidence-linked study findings
-
-Completed studies can now produce ranked findings with links to the participant
-events and captures that support them. Observer keeps Participants and Findings
-inside the same study shell, with the recording grid, original participant
-feedback and playback controls available throughout the review.
-
-## Analyze a completed study
-
-```bash
-npm install humanish@0.89.0
-npx humanish analyze --run latest --max-cost 3 --dry-run --json
-npx humanish analyze --run latest --max-cost 3 --json
-npx humanish observe --run latest
-```
-
-Select a verified, completed live run. The first analysis command checks admission
-without credentials or a provider request; the second requires `OPENAI_API_KEY`
-and sends selected text and captures to OpenAI. The required cost ceiling bounds
-a conservative estimate, not the provider's invoice. Opening Observer never
-starts analysis.
-
-The standard analysis covers session summary, apparent intent, observed outcome,
-friction, dead ends and recovery. Findings explain task impact, affected and
-exposed participants, evidence and limitations. Participant reports, recorded
-completion conditions and independent analysis remain separate. Missing evidence
-can leave an outcome unknown even when the participant reported success.
-
-Identical source input, configuration and prompt version reuse a saved analysis.
-`--rerun` requests a new immutable version; `--question` adds a reviewer question.
-The default is `gpt-6-astra` with high reasoning, a five-minute timeout and 16,384
-output tokens including reasoning. Each attempt makes one stateless request,
-without tools or automatic retries, and retains known usage or explicit
-uncertainty.
-
-## Review findings against the recording
-
-Participants and Findings share the study library, header and available width.
-Ranked findings expand in place and open their exact source event. A screenshot
-shown only as context is labeled accordingly; nonvisual evidence opens its
-original event without inventing a frame. Playback links, return navigation and
-phone controls retain their source context. The scrubber thumb and track now
-share the same centerline, with component geometry checks at multiple sizes.
-
-Use `analyze list` and `analyze show` to inspect history. `analyze correct` appends
-a confirmed, dismissed or amended review against the exact analysis and finding
-hashes. Original claims and evidence remain intact. Full correction history
-refuses another write before existing records become unreadable; analysis and
-correction writers share the run lock.
-
-Feedback drafting and export validate the included analysis snapshot and retain
-the existing sharing gates. Redacted bundle derivatives omit analyses tied to
-the original source bytes. A local-only HTML export remains portable and clearly
-labeled. Feedback commands print drafts; they do not post to GitHub.
-
-## Compatibility and verification
-
-The Observer data v1 contract is unchanged. Older recordings remain readable,
-and absent, failed, stale or invalid analysis does not erase participant evidence.
-The CLI also explains empty participant-feedback candidates and the available
-run-summary drafting path.
-
-[The feature implementation and verification](https://github.com/danielgwilson/humanish/pull/773)
-cover analysis validation and storage, sharing boundaries, the existing Observer
-flows, mobile layout, component geometry and fresh-package review/export paths.
-Final source-first model review covered five exposed regression cases and two
-untouched controlled task families, with a separate hostile-evidence challenge.
-That is bounded validation, not a general accuracy benchmark. One conservative
-outcome required an explicit task-scope reconciliation; one accurate positive
-recovery item did not motivate a product change.
-
-Evidence selection follows source order and has size/count limits; upstream
-truncation also constrains what can be established. Schema and reference checks
-do not certify interpretation or exhaustive issue discovery. Review the cited
-evidence before acting. Browser proof uses Chromium desktop and phone emulation;
-physical-device and cross-browser behavior remain separate verification work.
-
-See the [study-analysis contract](../contracts/study-analysis.md) for limits,
-artifact layout, cancellation, corrections and sharing behavior.

package/docs/release/0.89.1-analysis-finished-notice.md

@@ -1,24 +0,0 @@
-# Humanish 0.89.1: finished analysis notice
-
-Observer now labels a partial analysis result **“Analysis finished with
-limitations.”** The previous notice described findings as covering evidence
-“included so far,” which could make a finished analysis appear to be running.
-
-A partial result can contain validated findings after evidence selection limits
-or an exceeded admission estimate. Review the recorded coverage, limitations and
-usage when interpreting that result. The analysis status and saved evidence keep
-their existing meaning.
-
-## Update an existing recording
-
-```bash
-npm install humanish@0.89.1
-npx humanish observe --run latest
-```
-
-This renders the existing study with the updated Observer. An already exported
-HTML file is a saved snapshot; export it again to get the new wording. Reuse the
-appropriate sharing options for that run. No new analysis request is needed.
-
-The [0.89.0 release note](0.89.0-study-findings.md) describes the underlying study
-findings feature and its verification limits.