humanish 0.105.0 → 0.106.1

package/docs/release/0.90.0-automatic-analysis.md

@@ -1,21 +0,0 @@
-# 0.90.0 — Findings after live studies
-
-Labs can opt into independent analysis after their recording finishes with
-`review.analysis.maxCostUsd`. The command waits for the result; the TUI and
-Observer show analysis separately from participant execution and task outcomes.
-Without the setting, run behavior stays unchanged.
-
-The five supported live recording producers share the same completion boundary.
-Automatic analysis claims one attempt per recording, preserves usage and prior
-findings, and never starts again merely because a view is reopened. Cancellation
-requests target analysis without signaling the finished participant process.
-Recording identity remains pinned through dispatch, reuse and artifact writes.
-
-Scripted browser recordings now contribute their action-attached screenshots and
-declared goal to analysis and playback. Earlier saved analyses retain their
-original evidence mapping. Referenced error captures do not become duplicate
-frames. Missing assignments or unmapped captures remain visible limitations.
-
-See [automatic analysis](../product/automatic-analysis.md) for configuration,
-route support, spending and cancellation behavior. Analysis uses an admission
-estimate separate from participant caps; it is not a provider billing hard cap.

package/docs/release/0.91.0-analysis-quality-and-defaults.md

@@ -1,33 +0,0 @@
-# Humanish 0.91.0
-
-Supported live studies now request analysis when the recording finishes, using
-`gpt-6-astra` with high reasoning and a separate $3 admission estimate limit.
-The CLI, preflight and TUI disclose that budget. Set `review.analysis: false` to
-disable the extra request, or supply an analysis mapping with `maxCostUsd` to
-customize it. The estimate is additional to participant and desktop costs and
-is not a provider billing cap. Missing default credentials record a skip while
-preserving a successful recording; explicit analysis failures remain failures.
-Startup failures with no retained participant activity skip default analysis.
-
-Analysis now reviews material participant concerns before ranking findings.
-Useful reported uncertainty and recovered mistakes can remain findings even
-when product fault is unproven. **Concerns considered** shows evidence-linked
-decisions, including why material concerns were left out of the ranked list.
-It is model assessment, separate from original participant feedback and human
-reviewer annotations.
-
-Evidence selection shares count and text budgets across participants and samples
-their whole sessions, prioritizing beginnings, endings and context around
-recorded failures. Original frame and event identities remain intact. Missing
-assignments remain explicit; historical assignments are never invented.
-Existing analysis versions remain readable and unchanged.
-
-Selection is bounded and can still omit important moments. Concern review does
-not certify exhaustive discovery or accurate causal diagnosis. Opening Observer,
-exporting a recording and reading history never start a model request. Dry-runs
-and unsupported default routes remain request-free, and examples advertised as
-zero-spend explicitly disable automatic analysis.
-
-See the [analysis contract](../contracts/study-analysis.md),
-[automatic analysis guide](../product/automatic-analysis.md), and
-[bounded evaluation receipt](https://github.com/danielgwilson/humanish/blob/main/docs/goals/computer-use-actor/receipts/analysis-quality-and-defaults-2026-09-15.md).

package/docs/release/0.91.1-study-review-polish.md

@@ -1,28 +0,0 @@
-# Humanish 0.91.1
-
-Study cost summaries include retained analysis attempts alongside participant
-and desktop estimates. Reusing a saved analysis does not add another charge;
-separate retries do. Missing prices and incomplete histories remain explicit.
-The existing stats JSON fields keep their original participant-and-desktop
-meaning; additive cost fields provide the combined retained estimate.
-
-Finding previews prefer directly cited visual evidence over nearby context
-captures. Selection is deterministic, but does not establish that the chosen
-image is the best illustration of an issue. Exact source links and reviewer
-corrections remain available.
-
-Report qualifications are easier to scan, with the full limitations available
-through a disclosure. This changes presentation without changing saved analysis
-or participant feedback.
-
-Final hosted Chromium geometry follows the active page after tab changes.
-Valid CSS viewport measurements survive missing page-reported outer-window
-bounds. Missing measurements remain missing; physical screen dimensions never
-substitute for the page viewport.
-
-The own-app guide now describes the hosted reachability probe and its desktop
-cost. Starter comments document the existing opt-in mobile emulation settings.
-
-See the [cost accounting contract](../contracts/study-costs.md) and the
-[verification receipt](https://github.com/danielgwilson/humanish/blob/main/docs/goals/computer-use-actor/receipts/study-review-polish-2026-09-15.md)
-for the methods and limits of these checks.

package/docs/release/0.92.0-grid-playback.md

@@ -1,22 +0,0 @@
-# Humanish 0.92.0
-
-Play and scrub all recorded participants together in the Observer grid.
-The transport includes pause, playback speed and a shared recording timeline.
-Opening a displayed capture lands on its exact frame; returning restores the
-grid's time and participant page, paused.
-
-Playback follows recorded capture timestamps across the whole study, preserving
-staggered coverage regardless of filters or page selection. Each screen holds
-until its next capture, with its age visible. Missing timestamps and absent
-captures remain explicit; each participant's individual evidence stays available.
-Recorded timestamps can differ between producers, and a held image cannot show
-what happened between captures.
-
-The grid initially retains its latest previews. Playing or seeking enters
-recorded review and removes live desktop previews. Use **Follow live** or
-**Latest captures** to return. New evidence extends the timeline without moving
-a paused cursor. If refreshed evidence no longer covers that cursor, Observer
-explains the gap and lets the reviewer choose a new time.
-
-Playback works with self-contained HTML exports and existing recorded bundles.
-It runs locally in the viewer and does not start participants or analysis.

package/docs/release/0.93.0-global-playback.md

@@ -1,26 +0,0 @@
-# Humanish 0.93.0
-
-The Observer uses one study clock across the participant grid and individual
-recordings. Seek halfway through a study, open a participant, then scrub back:
-returning to the grid shows every participant at that same time. Playback also
-continues through ordinary participant navigation and browser Back/Forward.
-
-A compact bottom row holds play/pause, study time and the scrubber. It stays
-available while scrolling and reserves space for evidence. Playback options
-contains speed and **Follow live** or **Latest captures**. The sidebar and shell
-keep their layout across views, including phone widths.
-
-Study time uses recorded capture timestamps. Before a participant's first
-capture, the viewer shows that no capture is available yet; after their final
-capture, it holds that image with its age. Missing or invalid timestamps keep
-that participant's local recording controls, pausing the study clock until the
-reviewer returns. Findings and comparison retain their local evidence review.
-
-Opening an explicit frame, event or saved moment pauses and seeks to its
-associated capture. Exact frame identity is preserved even when two captures
-have the same timestamp. Ordinary participant navigation preserves the clock
-instead of repeatedly seeking to the displayed capture.
-
-This works in self-contained HTML exports and existing recorded bundles. It
-does not start participants, analysis or provider requests. Sparse captures
-still cannot show what happened between recorded images.

package/docs/release/0.93.1-observer-review-controls.md

@@ -1,24 +0,0 @@
-# Humanish 0.93.1
-
-Findings now starts with a compact overview: finding count, participants
-included, analyzed outcomes, and sampled captures. The original narrative
-remains under **Study summary**. Coverage notes, methodology and separate
-automatic-attempt status are available under **Coverage & analysis details**.
-A failed automatic attempt no longer replaces the status of a usable report.
-Running or unknown execution, changed evidence, and exceeded admission limits
-remain visible. Outcome counts are analysis judgments, not verified success
-rates; stale reports do not use current recordings as their denominators.
-
-Observer dropdowns and checkboxes use shared Base UI components styled with
-Humanish tokens. View options, playback speed, image zoom, activity filtering,
-and comparison use the same menus, including keyboard navigation, phone
-interaction and fullscreen placement.
-
-The library theme control shows one icon for the available action, pinned participants
-have a visible marker, and narrow grid previews avoid unnecessary letterboxing.
-Sidebar and disclosure transitions respect reduced-motion preferences. These
-changes preserve the shared study clock and evidence routes.
-
-The changes apply when existing recordings are rendered with this package.
-They do not rerun participants or analysis, alter source evidence, or remove
-padding already present inside recorded images.

package/docs/release/0.94.0-reliability.md

@@ -1,48 +0,0 @@
-# Humanish 0.94.0
-
-Long analysis requests now honor Humanish's configured deadline instead of
-ending early at the HTTP client's header timeout. The default deadline is ten
-minutes. Omitted output settings use up to 32,768 tokens when the existing
-declared budget admits that allowance, otherwise retaining 16,384. Explicit
-output settings remain exact. This adds no retries or automatic budget increase.
-
-Portable HTML stores each distinct raster capture once and resolves it on
-demand. A retained 12-participant, 344-capture recording decreased from about
-309 MiB to 143 MiB without changing capture bytes or timestamps. Existing
-recordings remain readable; new exports retain the same sharing checks.
-
-Participant inbox links now open that participant's synthetic recipient scope.
-Unknown scopes fail closed, while the shared inbox remains explicitly labeled
-for operators. Supported captured inline images render; unsupported references
-show an explanation. Remote images still depend on their original host.
-Recipient scopes are navigation isolation, not tenant authentication.
-
-`humanish doctor --lab <lab>` separates participant authentication, hosted
-desktop requirements and automatic-analysis credentials. Local Codex or Claude
-authentication is checked through that CLI rather than inferred from a file.
-The keyless first run needs no model or desktop credentials.
-Projects without `package.json` are valid; `doctor` treats the missing optional
-npm integration as information while still rejecting unsafe or unreadable files.
-
-Observer keeps the previous decoded capture visible while loading the selected
-one, labels it as previous evidence, and withholds action pins until the selected
-image is ready. Pinning animates the displaced cards as well as the selected
-card, preserving focus and respecting reduced motion. Pin and unpin are
-available directly on each card, with readable metadata and phone touch targets.
-A repeatable browser
-gate checks capture transitions, motion and automated accessibility in both
-themes at desktop and phone widths.
-
-An actual Humanish participant joined a synthetic camera room with a separate
-hosted peer, exchanged moving video, and left. A second participant denied the
-native camera prompt and stayed outside the room. Unsupported media routes and
-microphone-file injection now fail before execution instead of silently ignoring
-the declaration. This proves one video-only Chromium path; audio, TURN and
-provider-specific rooms remain unproven.
-
-Kept evidence and limits:
-
-- [Analysis reliability](../goals/computer-use-actor/receipts/analysis-reliability-2026-09-19.md)
-- [Portable recording comparison](../goals/observer-qol/receipts/2026-09-19-portable-export.md)
-- [Setup, inbox and camera proof](../goals/computer-use-actor/receipts/reliability-2026-09-19.md)
-- [Observer capture and accessibility gate](https://github.com/danielgwilson/humanish/blob/main/scripts/observer-reliability-proof.md)

package/docs/release/0.95.0-connections-setup.md

@@ -1,38 +0,0 @@
-# 0.95.0 — Connections and hidden key entry
-
-Open `humanish tui` and press **c** to configure AgentMail. **Add API key**
-opens a hidden terminal prompt, then returns to Connections. Ctrl+C cancels
-without changing the existing key or profile. Existing keys can be reused or
-replaced. Entry uses the host's key store, outside the TUI rendering contract.
-
-Keys live in the existing user-level store with file mode 0600. Project
-connection metadata lives in `.humanish/local/comms.yaml` and contains only a
-provider name and environment-variable reference. Explicit environment/env-file
-values retain precedence; strict key mode continues to disable discovery.
-The screen identifies those cases instead of claiming a newly stored key is active.
-
-Agents have matching commands:
-
-```bash
-humanish comms providers --json
-humanish keys set agentmail
-humanish comms connections add agentmail --json
-humanish comms connections list --json
-```
-
-This is connection setup only. Authentication, permissions, capacity and
-delivery are unverified, and this version does not acquire mailboxes or enable
-provider-backed email in studies. Unsupported study connection/SMS selectors
-and shared-world SMTP declarations fail before execution. Supported local
-email capture remains available.
-
-The release also includes TUI `--env-file` propagation and route-specific key
-requirements from #793. Dry-run, local-agent and terminal participants no longer
-inherit a hardcoded OpenAI-plus-E2B key requirement.
-
-Validation covers local configuration, containment, credential precedence,
-hidden entry/cancellation/paste, persistence and TUI frames at 80 and 45
-columns. `pnpm tui:connections:proof` drives the built CLI in a real PTY with
-synthetic keys and an isolated store, checking cancellation, replacement,
-restart and absence of credential values from terminal output. It requires
-Python 3 with Unix PTY support; it does not contact AgentMail.

package/docs/release/0.96.0-real-email-receiving.md

@@ -1,47 +0,0 @@
-# 0.96.0 — Real email receiving
-
-Supported browser studies can now give each participant a fresh AgentMail inbox.
-The application sends normally; participants open their own inbox, read the email
-and follow its confirmation link. Local capture remains a separate option for
-apps whose send configuration can point at a test catch.
-
-Connections checks authentication after hidden key entry and offers lab
-configuration and pending cleanup. Lab configuration previews a separate ignored
-copy, preserves the original, checks for stale previews and launches by exact
-selected path. Agents have matching `comms check`, `comms configure` and
-`comms recover` commands.
-
-Provider credentials remain on the host. Participants receive isolated loopback
-mail surfaces with original/plain views, supported inline raster images and a
-consistent allowed-origin link policy. Remote images and active HTML are blocked;
-missing content is explicit. Collection and publication are bounded and distinct
-from a participant reading mail. Later reads can fill temporarily missing content.
-
-Fresh mailbox ownership is recorded privately before acquisition. Normal teardown
-saves evidence and confirms provider deletion. Interrupted runs have explicit,
-project/account-bound recovery; mutable recording IDs cannot authorize deletion.
-Evidence-write failures retain the inbox as unresolved.
-
-Real mail may reach hosted desktops, actor/analysis models and recordings. These
-runs have a durable `local_only` publication restriction; blurring screenshots
-does not make them shareable. Immediate analysis uses the run's temporary scrub
-registry for generated narration, without saving raw secret values. Later analysis
-cannot reconstruct that registry and remains subject to the same publication gate.
-
-This release supports hosted computer-use app-url, clone and local-tree routes,
-including concurrent shared worlds. It rejects local-agent and unsupported routes
-before allocation. SMS, outbound participant mail, borrowed inboxes, arbitrary
-attachments and raw-MIME fallback remain unavailable.
-
-See [setup, behavior and recovery](../architecture/real-email-receiving.md) for
-configuration, processing disclosures and limits.
-
-Validation includes captured provider-wire contracts, crash/recovery and credential
-isolation tests, outer-runner tests for clone/local-tree and concurrent shared-world
-routes, inbox browser checks at desktop/phone widths, and hidden-key TUI proof.
-A retained live app-url study, `real-email-57ed0512-218d-4e58-9f76-c540541d0b56`,
-had two concurrent participants receive separate emails, follow their own links,
-reach the target dashboard and finish automatic analysis. Provider absence was
-confirmed for both participant inboxes and the synthetic sender. Raw mail and
-recordings remain private. This does not establish delivery for every target app
-or live-provider coverage of every execution route.

package/docs/release/0.96.1-browser-navigation.md

@@ -1,22 +0,0 @@
-# 0.96.1 — Preserve browser navigation
-
-Hosted browser studies now measure physical client bounds with `xwininfo`.
-The older `xdotool` build on hosted desktops can count window decorations twice,
-incorrectly reporting that a visible browser extends beyond the captured screen.
-That false reading could trigger fullscreen, hiding the tabs and address bar
-participants use to move between an application and their study inbox.
-
-The fitting step now remeasures the actual client origin after resizing and
-allows a second bounded adjustment when the window manager restores decorations.
-Normal browser controls remain visible when they fit. Narrow desktops retain
-the fullscreen fallback when a minimum-width browser cannot otherwise fit.
-
-New recordings identify the physical measurement as `source: xwininfo`.
-Historical `xdotool` and `cdp` geometry remains readable. Missing physical reads
-remain unverified; an emulated CSS viewport cannot establish screen containment.
-Final geometry capture still observes without moving or resizing the browser.
-
-Regression coverage includes a sanitized hosted-desktop measurement, ambiguous
-or missing geometry, decoration changes during resizing, narrow-screen fallback,
-and saved-run compatibility. This does not change inbox delivery or participant
-instructions.

package/docs/release/0.97.0-codex-account-analysis.md

@@ -1,45 +0,0 @@
-# 0.97.0 — Codex account reports on Linux
-
-Saved studies can use an existing Codex ChatGPT login for their separate
-findings report. Select it explicitly:
-
-```bash
-humanish analyze --run latest --provider codex --dry-run
-humanish analyze --run latest --provider codex
-```
-
-For an automatic report after a live study, set:
-
-```yaml
-review:
-  analysis:
-    provider: codex
-```
-
-The initial qualification is Linux x64, Codex CLI 0.154.0, a file-backed
-ChatGPT login, and `gpt-6-astra` with low reasoning effort. Other platforms,
-CLI versions and keychain-only logins are refused. Selected evidence still goes
-to remote inference. Model access and account allowance depend on the account.
-
-Account dollars and the generated-token ceiling are unknown; numeric dollar or
-output-token caps are rejected. Time and byte limits still apply. Token counts
-are retained when available, and interrupted usage remains incomplete. Existing
-OpenAI API analysis defaults and participant setup requirements are unchanged.
-
-The analyst has its own conversation and restricted tool configuration.
-Evidence admission, exact source references, secret scrubbing, immutable attempt
-accounting and source-change checks apply to both providers. Cancellation
-preserves recordings and earlier valid findings. Unconfirmed process cleanup or
-unexpected replacement credentials produce a failed attempt and private recovery
-guidance. Historical reports remain readable as execution profiles evolve.
-
-Doctor checks the selected analyst's setup without a model turn. Dry-run checks
-local evidence and configuration only; it does not test CLI/login/model access.
-The CLI, TUI and Observer disclose account limits consistently. This release
-does not introduce managed local desktops or qualify Mac account analysis.
-
-The [qualification receipt](https://github.com/danielgwilson/humanish/blob/46330116726f74080fa18947c36da4fb4b333805/docs/goals/computer-use-actor/receipts/codex-account-analysis-2026-09-23.md)
-records real screenshot analysis, cache reuse, cancellation, automatic reports
-after desktop cleanup, desktop/phone evidence review, failures and proof limits.
-See [configuration](../product/automatic-analysis.md) and the
-[restricted launcher contract](../architecture/restricted-codex-analysis.md).

package/docs/release/0.98.0-local-browser-studies.md

@@ -1,31 +0,0 @@
-# 0.98.0 — Local browser studies on Linux
-
-Explicit local browser labs now run from the installed CLI and TUI. On Linux
-x64 with Docker/KVM and a supported Codex ChatGPT login, isolated Firecracker
-participants use the normal scheduler, recordings, Observer and automatic
-analysis without E2B or OpenAI API keys. Codex inference remains remote and
-consumes account quota; dollar cost is unknown.
-
-`humanish runtime setup` prepares a pinned, verified runtime image. A live local
-lab also prepares it automatically before starting participants. `runtime status`
-and `doctor --lab` inspect readiness without downloading or launching a browser.
-The TUI shows that same runtime status. Existing hosted labs retain their
-configuration, and a missing local prerequisite never selects another provider.
-
-The [setup guide](../architecture/local-browser-runtime.md) includes a complete
-manifest and the current limits. This release supports loopback apps, fixed
-960×720 Chromium desktops, and optional OpenAI API participants. Mac/Lima,
-local inboxes and local camera/microphone integration remain follow-ups.
-
-Private state uses a Docker-owned anonymous volume, removed with its container
-on normal close or controller death. Runtime image downloads are checked for
-exact size and SHA-256 before loading; matching source archives and notices
-are distributed separately.
-
-Validation includes a packed installation outside the checkout: two concurrent
-Codex participants saved distinct notes in a local app, the app confirmed both
-saves, the recordings verified, and automatic analysis completed without model
-or desktop API keys. Separate checks cover controller death and state-volume
-removal, download integrity/cancellation, missing prerequisites and preserving
-existing hosted configurations. This is a small Linux integration proof, not
-a claim about Mac readiness, high concurrency or real conferencing apps.

package/docs/release/0.99.0-local-browser-mac.md

@@ -1,34 +0,0 @@
-# 0.99.0 — Local browser studies on Apple Silicon Macs
-
-Explicit local browser labs now run on M3-or-newer Macs through Lima/VZ and
-ARM64 Firecracker desktops. The same scheduler, Observer recordings and automatic
-analysis used on Linux remain in place. Codex and its file-backed ChatGPT login
-stay on the Mac; E2B and OpenAI API keys are unnecessary for the account route.
-Inference remains remote and uses account quota, with unknown dollar cost.
-
-Install Lima 2.2 or newer and use native ARM64 Node. `humanish runtime setup`
-creates a dedicated Linux host, installs Docker there and downloads the pinned
-ARM64 image with size/hash verification. Docker Desktop is not required. The
-first live local run can perform the same setup; status and doctor remain
-read-only. See the [setup guide](../architecture/local-browser-runtime.md).
-
-The host mounts no Mac directories. Standard OpenSSH forwards browser control
-and the selected loopback app port. Each participant retains its own VM and
-private state volume. Closing a study removes participant resources and keeps
-the reusable Lima host; `limactl stop humanish-runtime` stops it when idle.
-Native Codex discovery also handles hoisted npm packages correctly.
-
-An installed candidate on an M5 Max passed first-attempt public runtime setup,
-cache reuse and a two-participant study with distinct app-side saves, overlapping
-sessions, verified recordings and complete automatic analysis. Established Mac
-desktop close/cancel/controller-death cleanup passed. Focused real Linux checks
-of the shared lifecycle cover cancellation after creation and after start but before guest readiness, plus
-recovery when Docker creates a container but its reply is lost; Lima cleanup has
-separate regression coverage. These are scoped observations, not a capacity or
-cold-install performance benchmark.
-
-This remains browser-only with explicit lab configuration. Local inboxes,
-camera/microphone support and simpler default onboarding follow separately.
-Larger cohorts, smaller/Intel Macs, sleep/wake, keychain-only login, full-study
-cancellation and forced controller death during startup remain unqualified.
-Existing Linux and hosted labs retain their configuration and providers.

package/docs/release/0.99.1-action-recovery.md

@@ -1,19 +0,0 @@
-# 0.99.1 — Recover from rejected browser actions
-
-A participant can now recover when the desktop explicitly rejects an action
-before sending any input. For example, typing without an editable field focused
-previously ended a local browser study with a harness error, even though the
-browser remained usable.
-
-The shared execution loop records the rejection, withholds the remaining actions
-in that batch, and takes a fresh screenshot before asking the participant what
-to do next. This prevents a queued submit from running after rejected typing.
-The next turn receives accurate execution acknowledgements and a recovery hint;
-rejected actions are not recorded as completed input. The harness does not
-replay them automatically.
-
-Uncertain outcomes, transport failures, revoked sessions and failed observations
-retain their terminal handling. Existing time and no-progress limits still bound
-repeated rejections. Updated runtime images keep the browser-control connection
-open for this specific rejection; the shared host-side loop then allows recovery.
-Account configuration and desktop setup are unchanged.