humanish 0.106.0 → 0.107.0

package/dist/verify/actor.d.ts

@@ -2,7 +2,7 @@ import { type PreparedRunArtifactPaths } from "../run/paths.js";
 import { type RunBundle } from "../run/bundle.js";
 export declare function isZeroEventTerminalTrace(value: unknown): boolean;
 /**
- * Verifier for the terminal-product real-agent lane (the in-sandbox command-scoped key route). A
+ * Verifier for the terminal-product real-agent route (the in-sandbox command-scoped key route). A
  * LIVE terminal stream must carry the durable proof the safety contract requires, and must FAIL
  * CLOSED when any of it is missing — a blocked/failed agent run stays structurally verifiable (the
  * failure is the evidence) ONLY when the substrate/cleanup/interventions ledgers are present; it
@@ -13,15 +13,15 @@ export declare function isZeroEventTerminalTrace(value: unknown): boolean;
 export declare function validateTerminalProductEvidence(runPaths: PreparedRunArtifactPaths, bundle: RunBundle): Promise<string[]>;
 export declare function validateCodexAppServerEvidence(runPaths: PreparedRunArtifactPaths, bundle: RunBundle): Promise<string[]>;
 /**
- * Independent mirror of the producer-side no-engagement guard (routes/computer-use/lanes.ts): a
- * LIVE actor trace claiming goal_satisfied while carrying zero action-bearing items AND zero
- * message items is a hollow run — the actor neither did nor said anything — and must not verify as
- * evidence (invariant 4: evidence verifies fail-closed). Live-vs-dry-run is judged exactly as the
- * producer judges it, from bundle.mode alone; dry-run/contract bundles legitimately carry no
- * actions and stay exempt. Engagement is accepted from EITHER surface — itemized trace items or the
- * producer's counts — because providers differ in what they itemize; a hollow run reports zero on
- * both. The trace is read defensively: isRunStream does not validate the actor seam, and verify
- * must not throw on a malformed one.
+ * Independent mirror of the producer-side no-engagement guard
+ * (routes/computer-use/participant-execution.ts): a LIVE actor trace claiming goal_satisfied while
+ * carrying zero action-bearing items AND zero message items is a hollow run — the actor neither did
+ * nor said anything — and must not verify as evidence (invariant 4: evidence verifies fail-closed).
+ * Live-vs-dry-run is judged exactly as the producer judges it, from bundle.mode alone;
+ * dry-run/contract bundles legitimately carry no actions and stay exempt. Engagement is accepted
+ * from EITHER surface — itemized trace items or the producer's counts — because providers differ in
+ * what they itemize; a hollow run reports zero on both. The trace is read defensively: isRunStream
+ * does not validate the actor seam, and verify must not throw on a malformed one.
  */
 export declare function noEngagementActorFindings(bundle: RunBundle): string[];
 export declare function actorVerdictConsistencyFindings(bundle: RunBundle): string[];

package/dist/verify/actor.js

@@ -14,7 +14,7 @@ export function isZeroEventTerminalTrace(value) {
         value.counts.terminalEvents === 0);
 }
 /**
- * Verifier for the terminal-product real-agent lane (the in-sandbox command-scoped key route). A
+ * Verifier for the terminal-product real-agent route (the in-sandbox command-scoped key route). A
  * LIVE terminal stream must carry the durable proof the safety contract requires, and must FAIL
  * CLOSED when any of it is missing — a blocked/failed agent run stays structurally verifiable (the
  * failure is the evidence) ONLY when the substrate/cleanup/interventions ledgers are present; it
@@ -27,14 +27,14 @@ export async function validateTerminalProductEvidence(runPaths, bundle) {
         return [];
     }
     const findings = [];
-    // Detect the terminal-PRODUCT lane by its unique actor-trace protocol ("terminal-exec"), NOT by
-    // the broad stream.kind "terminal" — the existing local codex-exec/TUI lanes also use terminal
-    // streams (with a different protocol) and must not be held to this lane's ledger contract.
+    // Detect the terminal-PRODUCT route by its unique actor-trace protocol ("terminal-exec"), NOT by
+    // the broad stream.kind "terminal" — the existing local codex-exec/TUI routes also use terminal
+    // streams (with a different protocol) and must not be held to this route's ledger contract.
     const terminalStreams = bundle.streams.filter((stream) => stream.actor?.protocol === "terminal-exec" && stream.status !== "contract_proof_only");
     if (terminalStreams.length === 0) {
         return findings;
     }
-    // The lane writes exactly one terminal run's ledgers/evidence at fixed paths in the run root.
+    // The route writes exactly one terminal run's ledgers/evidence at fixed paths in the run root.
     const ledgers = await readSafeRunArtifactJson(runPaths, TERMINAL_LEDGERS_ARTIFACT);
     if (!isRecord(ledgers) || ledgers.schema !== "humanish.terminal-ledgers.v1") {
         findings.push(`missing or malformed ${TERMINAL_LEDGERS_ARTIFACT} (humanish.terminal-ledgers.v1)`);
@@ -76,7 +76,7 @@ export async function validateTerminalProductEvidence(runPaths, bundle) {
     if (!(await readSafeRunArtifactBytes(runPaths, TERMINAL_TRANSCRIPT_ARTIFACT))) {
         findings.push(`missing normalized terminal transcript artifact (${TERMINAL_TRANSCRIPT_ARTIFACT})`);
     }
-    // The provider-neutral actor trace must be on the terminal lane with redaction passed.
+    // The provider-neutral actor trace must have `lane: "terminal"` with redaction passed.
     for (const stream of terminalStreams) {
         const traceArtifact = stream.artifacts.find((artifact) => artifact.kind === "trace");
         const tracePath = traceArtifact?.path ?? "actor.json";
@@ -214,15 +214,15 @@ const ACTION_BEARING_ACTOR_ITEM_KINDS = new Set([
     "file_change",
 ]);
 /**
- * Independent mirror of the producer-side no-engagement guard (routes/computer-use/lanes.ts): a
- * LIVE actor trace claiming goal_satisfied while carrying zero action-bearing items AND zero
- * message items is a hollow run — the actor neither did nor said anything — and must not verify as
- * evidence (invariant 4: evidence verifies fail-closed). Live-vs-dry-run is judged exactly as the
- * producer judges it, from bundle.mode alone; dry-run/contract bundles legitimately carry no
- * actions and stay exempt. Engagement is accepted from EITHER surface — itemized trace items or the
- * producer's counts — because providers differ in what they itemize; a hollow run reports zero on
- * both. The trace is read defensively: isRunStream does not validate the actor seam, and verify
- * must not throw on a malformed one.
+ * Independent mirror of the producer-side no-engagement guard
+ * (routes/computer-use/participant-execution.ts): a LIVE actor trace claiming goal_satisfied while
+ * carrying zero action-bearing items AND zero message items is a hollow run — the actor neither did
+ * nor said anything — and must not verify as evidence (invariant 4: evidence verifies fail-closed).
+ * Live-vs-dry-run is judged exactly as the producer judges it, from bundle.mode alone;
+ * dry-run/contract bundles legitimately carry no actions and stay exempt. Engagement is accepted
+ * from EITHER surface — itemized trace items or the producer's counts — because providers differ in
+ * what they itemize; a hollow run reports zero on both. The trace is read defensively: isRunStream
+ * does not validate the actor seam, and verify must not throw on a malformed one.
  */
 export function noEngagementActorFindings(bundle) {
     if (bundle.mode !== "live") {

package/dist/verify/artifacts.d.ts

@@ -6,7 +6,7 @@ export declare function missingLocalEvidenceArtifacts(runPaths: PreparedRunArtif
 /**
  * The PNG frames that actor traces register as stream screenshots, relative to the run root.
  * RAW_SCREENSHOTS grades these, so the public-safety scan does not report them as unread. Only
- * frames under screenshots/ count: the computer-use lane writer and the scripted-browser steps
+ * frames under screenshots/ count: the computer-use frame writer and the scripted-browser steps
  * write every frame there, and nothing else in the harness does. A trace reference elsewhere (an
  * adapter's PNG, say) stays required evidence but goes to UNSCANNED_ARTIFACT.
  */

package/dist/verify/artifacts.js

@@ -1,7 +1,7 @@
 import { lstat, readdir } from "node:fs/promises";
 import path from "node:path";
 import { isRedactedFrameShape, screenshotEvidenceError } from "../evidence/image.js";
-import { isStudyAnalysisRecordPath } from "../analysis/sharing.js";
+import { isAnalysisRecordPath } from "../analysis/sharing.js";
 import { scanEncodedTextCached } from "../evidence/encoded-text.js";
 import { readPlainText } from "../evidence/plain-text.js";
 import { containsSensitive } from "../evidence/redaction.js";
@@ -130,7 +130,7 @@ function declaredActorScreenshotReferences(stream) {
 /**
  * The PNG frames that actor traces register as stream screenshots, relative to the run root.
  * RAW_SCREENSHOTS grades these, so the public-safety scan does not report them as unread. Only
- * frames under screenshots/ count: the computer-use lane writer and the scripted-browser steps
+ * frames under screenshots/ count: the computer-use frame writer and the scripted-browser steps
  * write every frame there, and nothing else in the harness does. A trace reference elsewhere (an
  * adapter's PNG, say) stays required evidence but goes to UNSCANNED_ARTIFACT.
  */
@@ -302,7 +302,7 @@ async function scanRunPublicSafetyDirectory(runPaths, relativeDirectory, finding
         const relativePath = relativeDirectory ? `${relativeDirectory}/${entryName}` : entryName;
         const stats = await lstat(path.join(current, entryName), { bigint: true }).catch(() => null);
         const selectedFindings = !stats?.isDirectory() &&
-            (relativePath === "observer/study-analysis.json" || isStudyAnalysisRecordPath(relativePath))
+            (relativePath === "observer/study-analysis.json" || isAnalysisRecordPath(relativePath))
             ? derivedFindings
             : findings;
         if (isRiskyPublicArtifactPath(relativePath) || containsSensitive(relativePath)) {

package/dist/verify/costs.d.ts

@@ -1,5 +1,5 @@
 import type { RunBundle } from "../run/bundle.js";
-/** Account lanes must never acquire a price through an aggregate or ambiguous model line. */
+/** Account-billed participants must never acquire a price through an aggregate or ambiguous model line. */
 export declare function contradictsAccountBilling(streams: readonly {
     id?: string;
     laneId?: string;
@@ -21,7 +21,7 @@ export declare function contradictsAccountBilling(streams: readonly {
  * Verify the LABELING/provenance of any cost figure a bundle CLAIMS — never its magnitude. Returns
  * [] (pass) unless a dollar claim lacks its provenance (invariant 6) or a total misreports its
  * known lines. ABSENCE always passes (fail-open on display, discipline #3): a bundle with no cost,
- * a null estimate, or a lane without estimatedCost is fine. A NON-NULL figure must carry its
+ * a null estimate, or a participant without estimatedCost is fine. A NON-NULL figure must carry its
  * ratesAsOf date + source; a NUMBER total must equal round6(sum of ONLY the non-null lines) and a
  * null line may never be coerced to 0. A null estimate must be declared honestly (a reason + null
  * ratesAsOf), mirroring the terminal no-spend proof's null-discipline. Account-billed participants

package/dist/verify/costs.js

@@ -2,7 +2,7 @@
 // totals match their known lines, and account-billed participants never acquire a price.
 import { validActorExecutionProfile, validActorProviderRequests } from "../actors/contract.js";
 import { round6 } from "../run/pricing.js";
-/** Account lanes must never acquire a price through an aggregate or ambiguous model line. */
+/** Account-billed participants must never acquire a price through an aggregate or ambiguous model line. */
 export function contradictsAccountBilling(streams, cost) {
     const account = (stream) => (stream.liveActor?.executionProfile ?? stream.actor?.executionProfile)?.billing ===
         "account-unknown";
@@ -25,7 +25,7 @@ export function contradictsAccountBilling(streams, cost) {
  * Verify the LABELING/provenance of any cost figure a bundle CLAIMS — never its magnitude. Returns
  * [] (pass) unless a dollar claim lacks its provenance (invariant 6) or a total misreports its
  * known lines. ABSENCE always passes (fail-open on display, discipline #3): a bundle with no cost,
- * a null estimate, or a lane without estimatedCost is fine. A NON-NULL figure must carry its
+ * a null estimate, or a participant without estimatedCost is fine. A NON-NULL figure must carry its
  * ratesAsOf date + source; a NUMBER total must equal round6(sum of ONLY the non-null lines) and a
  * null line may never be coerced to 0. A null estimate must be declared honestly (a reason + null
  * ratesAsOf), mirroring the terminal no-spend proof's null-discipline. Account-billed participants

package/dist/verify/liveness.d.ts

@@ -2,6 +2,6 @@ import type { RunBundle } from "../run/bundle.js";
 import type { PreparedRunArtifactPaths } from "../run/paths.js";
 /**
  * One warning when the run is not finished, by the run index's rule: its status record when it
- * has a usable one, else a simulation still `running` in its bundle. Empty for a finished run.
+ * has a usable one, else a participant still `running` in its bundle's `simulations[]`. Empty for a finished run.
  */
 export declare function runNotFinishedWarnings(runPaths: PreparedRunArtifactPaths, bundle: RunBundle, nowMs?: number): Promise<string[]>;

package/dist/verify/liveness.js

@@ -13,7 +13,7 @@ const RUN_NOT_FINISHED = "RUN_NOT_FINISHED";
 const GONE_STATES = new Set(["killed", "already-gone"]);
 /**
  * One warning when the run is not finished, by the run index's rule: its status record when it
- * has a usable one, else a simulation still `running` in its bundle. Empty for a finished run.
+ * has a usable one, else a participant still `running` in its bundle's `simulations[]`. Empty for a finished run.
  */
 export async function runNotFinishedWarnings(runPaths, bundle, nowMs = Date.now()) {
     const runId = path.basename(runPaths.absoluteRunRoot);
@@ -29,6 +29,9 @@ export async function runNotFinishedWarnings(runPaths, bundle, nowMs = Date.now(
     else if (liveness === "running") {
         seen.push(`${RUN_STATUS_FILE} state is ${record.state} and its owner updated it at ${record.updatedAt}, so the run may still be writing`);
     }
+    else if (record.state === "interrupted") {
+        seen.push(`${RUN_STATUS_FILE} state is interrupted${record.signal === undefined ? "" : ` by ${record.signal}`} at ${record.updatedAt}`);
+    }
     else {
         seen.push(`${RUN_STATUS_FILE} state is ${record.state} and its owner stopped updating it at ${record.updatedAt}`);
     }

package/dist/verify/rerun.d.ts

@@ -1,3 +1,3 @@
 import type { RunBundle } from "../run/bundle.js";
-/** A rerun bundle must link each selected lane to its prior status and a fan-out rerun event. */
+/** A rerun bundle must link each selected participant to its prior status and a fan-out rerun event. */
 export declare function rerunLineageFindings(bundle: RunBundle): string[];

package/dist/verify/rerun.js

@@ -1,4 +1,4 @@
-/** A rerun bundle must link each selected lane to its prior status and a fan-out rerun event. */
+/** A rerun bundle must link each selected participant to its prior status and a fan-out rerun event. */
 export function rerunLineageFindings(bundle) {
     const rerun = bundle.rerun;
     if (!rerun) {

package/dist/verify/shared-world.js

@@ -152,7 +152,7 @@ function skippedTailCauseFailures(bundle, turns, tail) {
             failures.push("usage_unreported requires recorded unavailable usage");
     }
     else if (tail.cause === "study_spend_limit") {
-        if (!studySpendLimitRecorded(bundle, turns, tail)) {
+        if (!runSpendLimitRecorded(bundle, turns, tail)) {
             failures.push("study_spend_limit requires known prefix estimates exceeding the recorded finite threshold");
         }
     }
@@ -166,7 +166,7 @@ function skippedTailCauseFailures(bundle, turns, tail) {
     return failures;
 }
 /** Every executed participant's estimate is known, and their sum exceeds the recorded threshold. */
-function studySpendLimitRecorded(bundle, turns, tail) {
+function runSpendLimitRecorded(bundle, turns, tail) {
     const estimates = bundle.streams
         .slice(0, turns.length)
         .map((stream) => stream.actor?.estimatedCost?.estimatedCostUsd);

package/dist/verify/verify.js

@@ -1,7 +1,7 @@
 import path from "node:path";
-import { listStudyAnalysisExecutions } from "../analysis/store-executions.js";
-import { loadStudyAnalysis } from "../analysis/load.js";
-import { studyAnalysisSharingProblems } from "../analysis/sharing.js";
+import { listAnalysisExecutions } from "../analysis/store-executions.js";
+import { loadAnalysis } from "../analysis/load.js";
+import { analysisSharingProblems } from "../analysis/sharing.js";
 import { containsSensitive } from "../evidence/redaction.js";
 import { validatePreparedRunArtifactPaths } from "../run/paths.js";
 import { RUN_BUNDLE_FILE, RUN_BUNDLE_SCHEMA } from "../run/bundle.js";
@@ -224,9 +224,9 @@ function bundlePresenceChecks(bundle, reviewArtifactsExist) {
  * to silently promote stale or malformed derived text into sharing.
  */
 async function applyAnalysisSharing(runPaths, warnings, shareSafety) {
-    const analysis = await loadStudyAnalysis(runPaths);
-    const analysisSharing = studyAnalysisSharingProblems(analysis);
-    const executionHistory = await listStudyAnalysisExecutions(runPaths);
+    const analysis = await loadAnalysis(runPaths);
+    const analysisSharing = analysisSharingProblems(analysis);
+    const executionHistory = await listAnalysisExecutions(runPaths);
     if (!analysisSharing.unverified &&
         !analysisSharing.sensitive &&
         executionHistory.warnings.length === 0)

package/docs/README.md

@@ -38,7 +38,7 @@ than one kind is split file by file.
 - [architecture/task-protocol-support.md](architecture/task-protocol-support.md): which routes
   accept `actors[0].tasks`.
 - [architecture/external-public-shared-world.md](architecture/external-public-shared-world.md) and
-  [architecture/terminal-product-lane.md](architecture/terminal-product-lane.md): two routes in
+  [architecture/terminal-product-route.md](architecture/terminal-product-route.md): two routes in
   depth. Both keep dated slice notes beside the current rules.
 - [architecture/restricted-codex-analysis.md](architecture/restricted-codex-analysis.md) and
   [product/automatic-analysis.md](product/automatic-analysis.md): study analysis.

package/docs/architecture/actor-contract.md

@@ -23,8 +23,8 @@ descriptor `runSession` is a fail-closed compatibility entry. Live execution is
 owned by `runTerminalProductLab`, which coordinates sandbox creation,
 command-scoped runtime auth, evidence, caps, and by-id cleanup.
 
-The `pi-agent-core` and `claude-agent-sdk` descriptors, the `app` run kind and the
-`in-process-sdk` protocol were removed. No lab route dispatched either descriptor, and a
+#955 removed the `pi-agent-core` and `claude-agent-sdk` descriptors, the `app` run kind and
+the `in-process-sdk` protocol. No lab route dispatched either descriptor, and a
 lab that names one now fails to parse. A signed-in Claude Code drives computer-use studies
 through `local-agent`, which plugs into the provider-neutral `CuaProvider` port
 (`src/actors/computer-use/loop/types.ts`, re-exported from `loop.ts`).
@@ -64,13 +64,24 @@ API surface.
    Agent SDK, Stagehand). The existing Codex app-server integration is the
    reference adapter. `pi-agent-core` was planned as the first in-process-SDK
    adapter to prove both shapes early; it shipped only as a trace mapper with no
-   route and has been removed.
-
-2. **One normalized evidence schema: `humanish.actor-trace.v1`.** Codex `item/*`
-   events, Claude `ToolUse`/`ToolResult` blocks, pi `tool_execution_*` events,
-   and computer-use `computer_call` cycles all map onto one `ActorTrace` with a
-   typed `items[]`. `humanish.codex-app-server-trace.v1` remains a back-compat
-   alias during migration.
+   route, and #955 removed it.
+
+2. **One normalized evidence schema: `humanish.actor-trace.v1`.** Four producers map
+   their records onto one `ActorTrace` with a typed `items[]`:
+   - Codex app-server `item/*` events, protocol `json-rpc`: `codexResultToActorTrace`
+     (`src/actors/codex/app-server-actor-trace.ts`).
+   - Computer-use loop turns, protocol `cua-loop`, whether the provider returned an OpenAI
+     `computer_call` or a local agent's JSON actions: `loopResult`
+     (`src/actors/computer-use/loop/trace.ts`).
+   - Scripted-browser steps, protocol `scripted-steps`: `projectScriptedActorTrace`
+     (`src/actors/scripted-browser/actor.ts`).
+   - The terminal route's command log and terminal events, protocol `terminal-exec`:
+     `buildTerminalActorTrace` (`src/routes/terminal/trace.ts`).
+
+   The Codex app-server still writes its own `humanish.codex-app-server-trace.v1` record
+   (`CodexAppServerTrace` in `src/actors/codex/app-server-trace.ts`), which
+   `codexResultToActorTrace` converts. The Claude Agent SDK `ToolUse`/`ToolResult` and pi
+   `tool_execution_*` mappers went with their adapters in #955.
 
 3. **A run is multi-turn within one trace; it stops on goal, abandonment, unrecoverable
    failure, or a wall-clock safety timeout, never on a turn cap.** Turn count is explicitly
@@ -260,7 +271,13 @@ export interface Actor {
   run-bundle wiring is provider-agnostic. The artifact names differ by route: the Codex
   app-server adapter writes `events.ndjson`, `summary.json` and `transcript.txt`; a
   computer-use participant writes its trace to `actor.json` or `actors/<streamId>.json`; the
-  terminal route writes `terminal-events.ndjson` and `terminal-transcript.txt`.
+  terminal route writes `terminal-events.ndjson` and `terminal-transcript.txt`. Analysis quotes
+  only `message` and `reasoning` items, so they carry the participant's own words. The terminal
+  route reads them from the Codex `agent_message` and `reasoning` items in the raw exec JSON
+  stream, in memory, before source redaction can break a line's JSON. It removes verdict marker
+  lines, then scrubs and redacts the decoded text. The trace keeps the last 200 items within
+  128 KiB and adds a `notice` item when it leaves older ones out. The stream's last 2000
+  characters stay in the `command` item's `outputTail`.
 - **Approvals.** Call `approval.onRequest`; never embed adapter-local decline
   strings. Every call is recorded as an `items[kind=approval]`.
 - **Redaction.** Use the injected `RedactionHooks`. Never re-implement redaction
@@ -374,12 +391,12 @@ attaches product-specific scoring + feedback as a THIN in-repo extension WITHOUT
 core. The seam is exported contract types (`RunBundle`, `RunFeedbackCandidate`,
 `RunAdapterScore`, `ActorTrace`, `AdapterScorerModule` and the terminal-route
 `TerminalProductScoringContext`) plus a registrable scorer module, `RunLabOptions.scorer`,
-with optional `score` and `deriveFeedback`. The older `score` / `deriveFeedback` members of
-`terminalHooks` and `cuaHooks` are deprecated. The adapter records its product nouns ONLY
+with optional `score` and `deriveFeedback`. The older `terminalHooks` and `cuaHooks` bags were
+removed from `RunLabOptions`. The adapter records its product nouns ONLY
 under an adapter-NAMESPACED block (`RunFeedbackCandidate.adapter` /
 `RunAdapterScore.{namespace,data}`), so core's enums stay product-agnostic: no adopter noun
 is hardcoded into a core enum. Default (no hook) behavior is unchanged. See
-[`terminal-product-lane.md`](./terminal-product-lane.md#slice-4-the-product-adapter-extension-seam-layer-6)
+[`terminal-product-route.md`](./terminal-product-route.md#slice-4-the-product-adapter-extension-seam-layer-6)
 for the full seam and the thin-adapter conformance proof.
 
 ## Making personas load-bearing
@@ -419,12 +436,33 @@ traits: { patience, skill, accessibilityNeeds? }, constraints[], sourceDigest }`
    toward the success predicate) and annotates the abandonment friction as a feedback
    candidate. The harness imposes no turn cap; its hard stops are the wall-clock
    `timeoutMs` and declared spend caps.
-4. **Bind the same directives per harness**: pi (`systemPrompt` +
-   `beforeToolCall` allow rules), Claude (`system_prompt`/`--append-system-prompt`
-   - `allowedTools`), Codex (prepend to `turn/start` input), Stagehand (agent
-     context + action policy). Each binds the friction-tolerance, skill, and
-     accessibility directives identically; none uses a `max_turns`-style cap as the
-     persona stop condition.
+4. **Bind the same directives per harness.** `renderPersonaPromptSection`
+   (`src/lab/persona.ts`) renders the directives as one prompt section, and each harness puts
+   that section where its model reads standing instructions:
+   - Computer use: `composeParticipantInstructions`
+     (`src/routes/computer-use/participant-prompt.ts`) opens the participant instructions
+     with it. `openai-computer-use` sends those instructions as each Responses request's
+     `instructions`. A local-agent Codex runs as a restricted app-server participant and
+     receives them as thread/start `baseInstructions` (`threadStartParams` in
+     `src/actors/codex/restricted-launch.ts`), on an ephemeral read-only thread whose only
+     dynamic tool is `humanish_ui`. A local-agent Claude Code runs one `claude -p`
+     stream-json session with `--allowedTools Read`; the instructions open its first user
+     message (`promptFor` in `src/actors/local-agent/cli.ts`), and later turns rely on the
+     session's memory. `HUMANISH_LOCAL_AGENT_ONE_SHOT` instead spawns one `claude -p` per
+     turn, which resends the instructions every turn.
+   - Terminal: the section opens the `codex exec` prompt (`composeLivePrompt` in
+     `src/routes/terminal/session.ts`).
+   - The scripted-browser route replays declared steps with no model, so it binds no
+     directives and records an empty `traitsApplied`. The Codex app-server session behind
+     `humanish codex app-server` and the `codex-app-server` registry descriptor binds none
+     either: it sends the operator's prompt to turn/start as given.
+   - Stagehand remains roadmap. This rule once planned a pi binding (`systemPrompt` +
+     `beforeToolCall`) and a Claude Agent SDK one (`systemPrompt` + `allowedTools`). pi
+     shipped only as a trace mapper, the Claude Agent SDK descriptor never had a route, and
+     #955 removed both.
+
+   None of these uses a `max_turns`-style cap as the persona stop condition.
+
 5. **Prove it.** `ActorTrace.persona.traitsApplied` lists the injected directives; a
    `persona-fidelity` verify check asserts that the friction and accessibility directives
    reached the actor input and that a `gave_up` run cites a concrete friction reason (not a
@@ -504,10 +542,10 @@ turns as a stop signal.
    is provider-neutral); then a follow-up live SDK shim behind a DI seam, deferred
    until the package identity (`@earendil-works/pi-agent-core` vs
    `@mariozechner/pi-coding-agent`) and the Node `>=22.19` vs engines `>=20` gap
-   are pinned against an installed build. The live shim never landed, and the
-   mapper-only descriptor was removed because no route dispatched it.
+   are pinned against an installed build. The live shim never landed, and #955
+   removed the mapper-only descriptor because no route dispatched it.
 5. `claude-agent-sdk` adapter (the `app` run kind). It shipped as a descriptor with
-   a live session but no route, and was removed along with the `app` run kind.
+   a live session but no route, and #955 removed it along with the `app` run kind.
 6. Computer-use route. (Shipped as `openai-computer-use`: registered 0.3.0,
    lab-dispatched 0.4.0; `stagehand-cua` as a multi-provider front remains
    not-yet-shipped roadmap.)

package/docs/architecture/desktop-sessions.md

@@ -68,11 +68,11 @@ runtime.
 The runner owns instructions, model execution, spend guards, screenshots, trace
 persistence and participant outcome interpretation. It does not invoke desktop
 shell commands or manufacture E2B objects for an alternate executor. A local
-Firecracker study supplies its desktops through the `PARTICIPANT_DESKTOP` symbol on
-the hook bag (`src/routes/computer-use/participant-desktop.ts`), which no caller
-can set by name. The public `cuaHooks.createDesktopLane` is deprecated, warns once,
-and goes in the next minor; contract tests still inject a desktop through it. Neither
-bypasses CLI admission checks.
+Firecracker run supplies its desktops through the computer-use run's `localVm`
+input (`LocalVmInput` in `src/routes/computer-use/types.ts`). runLab builds that
+input with `prepareLocalVmRun` (`src/routes/computer-use/local-vm.ts`), and no
+package caller can set it. Contract tests pass a `localVm` desktop on a lab with
+`execution.target: local`. Neither bypasses CLI admission checks.
 
 Final evidence errors cannot skip desktop release. Existing bundle fields and
 desktop lifetime accounting retain their meanings; unconfirmed or retained
@@ -85,8 +85,8 @@ described in [local browser studies](local-browser-runtime.md).
 
 The `runSession` testing hook for independent participants now receives a constructed
 `executor` instead of `desktop`/`executorOptions`. A hook should consume the
-normal `CuaActorSessionOptions` executor or delegate to `runCuaActorSession`.
-Library calls directly using `runCuaActorSession({ desktop, executorOptions })`
-still work but warn as deprecated; use `runComputerUseLoop`. A custom in-process
+normal `CuaActorSessionOptions` executor or delegate to the internal
+`runCuaActorSession`. The `runCuaActorSession` export was removed in 0.107.0; a
+library caller uses `runComputerUseLoop`. A custom in-process
 executor now goes through `RunLabOptions.inProcess`, which replaces the
-deprecated `cuaHooks.buildExecutor`.
+removed `cuaHooks.buildExecutor`.

package/docs/architecture/external-public-shared-world.md

@@ -57,6 +57,11 @@ threaded through `CuaActorSessionOptions` → `CuaParticipantDeps` → the concu
 code; no lobby-trivia change. The CDP URL read later proved unreliable on E2B desktops, so the
 host's code can now also come from its narration or its screen (step 2).
 
+`onObservedUrl`, `onMessage` and `onScreenshot` are deprecated on `CuaLoopOptions`, and the next
+minor removes them. A `runComputerUseLoop` caller that used them wraps the executor's `observe`
+(for `url` and `screenshot`) or the provider's `nextTurn` (for `reasoning` and `message`). The
+handoff still passes all three.
+
 Flow, a host-first barrier inside `runConcurrentSharedWorld`'s fan-out:
 
 1. **Designated host.** Exactly one roster entry carries `host: true` (validated). Its mission = create

package/docs/architecture/observer.md

@@ -46,9 +46,9 @@ regardless of substrate:
 - `artifact`: artifact-only evidence stream;
 - `summary`: run-level synthesis stream.
 
-Each stream points back to a simulation and carries its own transport,
-terminal tail, UI state, artifact links, event timeline, and public-safe
-metadata.
+Each stream points back to its participant's `simulations[]` entry and carries its
+own transport, terminal tail, UI state, artifact links, event timeline, and
+public-safe metadata.
 
 ## Live Watch
 
@@ -243,7 +243,7 @@ Subsequent additions through 2026-06-11 included:
   registered in `src/actors/registry.ts`);
 - E2B desktop participants on the computer-use and shared-world routes;
 - computer-use bundles persist a `screenshots/` directory and the Observer
-  renders the frames (`src/routes/computer-use/lanes.ts` writes them).
+  renders the frames (`src/routes/computer-use/participant-execution.ts` writes them).
 
 Intentionally still adapter work:
 

package/docs/architecture/restricted-codex-analysis.md

@@ -13,8 +13,10 @@ Linux x64 accepts 0.154.0, 0.157.1
 ([receipt](https://github.com/danielgwilson/humanish/blob/main/docs/goals/computer-use-actor/receipts/codex-cli-0.157.1-requalification-2026-09-30.md))
 0.159.2
 ([receipt](https://github.com/danielgwilson/humanish/blob/main/docs/goals/computer-use-actor/receipts/codex-cli-0.159.2-qualification-2026-09-30.md))
-and 0.159.3
-([receipt](https://github.com/danielgwilson/humanish/blob/main/docs/goals/computer-use-actor/receipts/codex-cli-0.159.3-qualification-2026-10-01.md)).
+0.159.3
+([receipt](https://github.com/danielgwilson/humanish/blob/main/docs/goals/computer-use-actor/receipts/codex-cli-0.159.3-qualification-2026-10-01.md))
+and 0.160.0
+([receipt](https://github.com/danielgwilson/humanish/blob/main/docs/goals/computer-use-actor/receipts/codex-cli-0.160.0-qualification-2026-10-01.md)).
 Apple Silicon accepts 0.154.0, which passed installed participant/analysis studies and the
 native dispatch restriction check on an M5 Max; later releases need the same check on a Mac.
 Hosted participants on Linux arm64 and Intel macOS keep 0.154.0 as a pre-existing admission,
@@ -33,6 +35,31 @@ release stay readable.
 Readiness validates the installation and effective profile without submitting a
 model turn; it does not guarantee current quota or model access.
 
+Each launch also checks the release's app-server schema. After `--version`, the launcher runs
+`codex app-server generate-json-schema --experimental` into its private work directory, bounded
+at 15 seconds and 64 KiB of output. It reads only regular files of at most 16 MiB, waits on the
+request deadline while reading, and removes the schema afterwards.
+[`src/actors/codex/protocol-contract.ts`](https://github.com/danielgwilson/humanish/blob/main/src/actors/codex/protocol-contract.ts)
+lists each method humanish calls with the fields and values it sends and the response fields it
+reads, each notification and server request it consumes, the reply it sends to a tool call, and
+the containers (`items`, `turn.items`, `thread.turns[].items`) its item policy reads in every
+notification, including the consumed ones outside the ServerNotification union. Where the
+baseline carries items (`thread.turns[].items` in `thread/started`, `turn.items` in
+`turn/started` and `turn/completed`), the carrier is required, so a release that renames it
+refuses. The schema does not link a response to its method, so the table names each response
+definition. A read field is checked in every alternative the schema allows, including each
+object or array on its path; a sent field needs one alternative that still accepts it. `allOf`
+members intersect, and `false` allows no value. The launch refuses as
+`codex_incompatible_release` before app-server starts, listing each change, when a read field
+is gone or allows another type, a compared value is no longer allowed, a sent field or value is
+no longer accepted, a field humanish does not send is newly required, or a method or definition
+is missing. A value beyond those the admitted releases offer, such as a new item type, is
+recorded on an admitted launch and reported as a warning; a new item type that arrives is still
+refused by the item allowlist. Values humanish only refuses, such as an asynchronous delivery,
+are listed as known values: their removal does not refuse the launch, since it cannot make
+humanish accept more. The check covers only the listed fields. It does not attest the binary,
+and the `config/read` keys the schema leaves untyped are checked by exact value after launch.
+
 ## Authority and request limits
 
 The host creates a private temporary Codex home and links only the existing
@@ -52,8 +79,17 @@ This profile is **not advertised as tool-free**. The CLI retains code-mode
 descriptions, but the qualified `features.code_mode_host=false` setting rejects
 their actual dispatch. `agents.enabled=false` removes delegation; the older
 feature toggle alone did not. humanish also refuses raw tool calls, unexpected
-host RPCs and asynchronous question messages before accepting any report. The
-actual notification/denial captures and provenance are in
+host RPCs and asynchronous question messages before accepting any report. Every
+item an app-server notification carries (`item`, `items`, `turn.items`,
+`thread.turns[].items`) passes the item allowlist whatever its method, from the
+launch handshake until the app-server exits. Output that arrives after a request
+stopped, or during shutdown, is still read for the item policy. Every refusal, and
+any output that could not be checked, is kept for the session's close: it fails a
+participant's run even when a step that tolerates a failed request absorbed it,
+and it fails an analysis that had completed. A last frame cut off by humanish's
+own signal, delivered to the running app-server and ending it, is a warning with
+its byte count. A method humanish does not know that carries no item is counted
+in the run's warnings and does not refuse. The actual notification/denial captures and provenance are in
 [`tests/fixtures/restricted-codex`](https://github.com/danielgwilson/humanish/blob/46330116726f74080fa18947c36da4fb4b333805/tests/fixtures/restricted-codex/README.md).
 
 Each analyst or readiness request owns a separate child process, temporary home

package/docs/architecture/state-driven-executor.md

@@ -195,7 +195,7 @@ to reconstruct them.
 
 Pass `inProcess: { executor }` and `createProvider` in `RunLabOptions`. The type requires
 `createProvider` beside `inProcess`: a state executor returns no frame, so it needs a non-vision
-provider. With `inProcess` set, `runCuaActorLab` takes a branch that NEVER
+provider. With `inProcess` set, the computer-use route takes a branch that NEVER
 loads the E2B module, creates a sandbox, runs `prepareDesktop`, provisions a
 clone, opens a browser, or starts a stream. `sandboxId`/`streamUrl` stay
 undefined, so `result.sandbox` is omitted. That omission is the verifiable
@@ -207,8 +207,7 @@ Fail-closed guards, all BEFORE any key check, so a CLI invocation never sees a m
 - `HUMANISH_LAB_OPTION_UNSUPPORTED`: `inProcess` without `createProvider` (from JavaScript,
   where the type does not stop it), or on a subject other than `app-url` or `local-app`.
   `createProvider` alone is allowed; that is a model swap on the normal E2B route.
-- `HUMANISH_CUA_LAB_FANOUT_INVALID`: `inProcess`, or the deprecated `cuaHooks.buildExecutor`,
-  with more than one participant. The planner refuses it, because fan-out gives each participant
+- `HUMANISH_CUA_LAB_FANOUT_INVALID`: `inProcess` with more than one participant. The planner refuses it, because fan-out gives each participant
   its own E2B desktop and the in-process route has none.
 - `HUMANISH_CUA_LAB_LOCAL_APP_NO_EXECUTOR`: a `subject.source: local-app` config run
   without `inProcess` (there is no built-in in-process driver yet). A structured error,
@@ -216,8 +215,8 @@ Fail-closed guards, all BEFORE any key check, so a CLI invocation never sees a m
 - `HUMANISH_CUA_LAB_LOCAL_DESKTOP_MISSING`: an `app-url` lab with `execution.target: local`
   and no local desktop. `runLab` gives a local browser study its desktop; a direct route
   call or an in-process executor on the same lab has none.
-- `HUMANISH_CUA_LAB_EXECUTOR_NO_PROVIDER`: the deprecated `cuaHooks.buildExecutor` without
-  `cuaHooks.buildProvider`.
+- `HUMANISH_CUA_LAB_EXECUTOR_NO_PROVIDER`: the route's internal executor hook without its
+  provider hook. A package caller gets `HUMANISH_LAB_OPTION_UNSUPPORTED` above instead.
 
 Key gating is route-aware: the in-process route uses the caller's OWN model and
 executor, so no `OPENAI_API_KEY`/`E2B_API_KEY` is required.

package/docs/architecture/task-protocol-support.md

@@ -23,12 +23,10 @@ Custom session hooks remain caller-owned implementations of that same contract;
 this preflight does not certify arbitrary hook behavior.
 
 The parser reports `HUMANISH_LAB_INVALID` with the unsupported field path. `runLab`
-and the deprecated direct route runners report `HUMANISH_LAB_TASKS_UNSUPPORTED` in
-their failure envelopes, from `planLab` (`src/lab/plan.ts`) and each route's plan.
+reports `HUMANISH_LAB_TASKS_UNSUPPORTED` in the route's failure envelope, from
+`planLab` (`src/lab/plan.ts`) and each route's plan.
 Refusal precedes run storage, source preparation, user hooks, local processes,
-sandbox allocation, and model calls. No task content appears in the error. The
-deprecated synthetic API, `runDryRun`, accepts no lab config or tasks. Its lab
-declaration boundary is `runLab`.
+sandbox allocation, and model calls. No task content appears in the error.
 
 A future route gains support only after proving participant goals, hidden criteria,
 observation-backed completion, honest missing-input treatment, and per-participant