humanish 0.107.0 → 0.108.0

package/docs/goals/current.md

@@ -1,207 +0,0 @@
-# Current Goals
-
-This page guides work on current source. [CHANGELOG.md](../../CHANGELOG.md) lists what each
-version changed.
-The [September 9 history](https://github.com/danielgwilson/humanish/blob/main/docs/goals/current-history-2026-09-09.md)
-preserves the former status log; its queues do not supersede this page.
-
-## North Star
-
-Humanish should let a maintainer ask:
-
-> What happens when synthetic personas try to use this app, CLI, or
-> agent-facing workflow?
-
-The answer should be observable, verifiable, public-safe, and useful for
-making a repair. The working loop is:
-
-```text
-study → recorded evidence → verify → feedback → repair → comparable rerun
-```
-
-The run bundle is the source of truth; Observer is its review surface. Keep
-product-specific tasks, state checks and vocabulary in adapters, with generic
-execution, evidence and lifecycle primitives in core.
-
-## The Three Roles
-
-Check changes against the [researcher, stakeholder and participant](../principles/three-roles.md):
-
-- The researcher declares the study, tasks, hidden success criteria, panel and
-  budgets. Supported routes return observation-backed task outcomes.
-- The stakeholder needs inspectable moments, findings and denominators, with
-  evidence quality separate from participant success.
-- The participant receives a goal and behavioral constraints. They may finish,
-  abandon, encounter a blocker or be interrupted; these outcomes must remain
-  distinct from failures of the harness.
-
-A participant does not see their hidden success criteria. Missing observation
-inputs remain unmeasured. Provider and session limits are safeguards, and a
-limit ending a session must not be presented as natural completion.
-
-## Best Next Work
-
-An independent maintainer uses the published package on their own app,
-adjudicates a useful finding, makes a repair and retains a comparable rerun.
-Voluntary repeat use is the next adoption signal to establish.
-
-Measure the effort and decisions in that loop:
-
-- setup effort and interventions needed to obtain a usable recording;
-- findings confirmed, dismissed or left uncertain after evidence review;
-- accepted repair decisions and the results of comparable reruns;
-- whether the maintainer chooses to use Humanish again.
-
-Prioritize work that changes one of those outcomes. Fix a reproduced first-use
-failure or evidence-review obstacle before expanding the platform. Use actual
-recordings to check whether people can identify what happened, find the
-relevant capture and understand the limits of the evidence.
-
-The [own-app guide](https://humanish.dev/docs/your-app) and
-[TodoMVC repair study](https://humanish.dev/docs/todomvc-edit-study) provide
-starting points. Named public applications in study receipts are subjects,
-not adopters or endorsements. An invitation is not activation.
-
-## What The Evidence Establishes
-
-- A keyless `first-run` is a contract and review preview. It does not establish
-  live execution, app findings or independent use.
-- Kept live studies establish the behavior observed on their named subjects,
-  versions, tasks and actors. Preserve interruptions and unsuccessful attempts
-  alongside successful ones.
-- The [TodoMVC repair comparison](https://github.com/danielgwilson/humanish/blob/main/docs/goals/computer-use-actor/receipts/todomvc-edit-confirmation-2026-09-05.md)
-  supports one synthetic keyboard repair result; it does not estimate human
-  completion rates or general defect recall.
-- The [evidence/export workflow receipt](https://github.com/danielgwilson/humanish/blob/main/docs/goals/computer-use-actor/receipts/redacted-evidence-workflow-2026-09-07.md)
-  establishes readable originals and verified shareable derivatives on retained
-  runs. External maintainer acceptance remains a separate gate.
-- Explicit keyboard/pointer contrasts do not isolate the value of rich persona
-  prompting. Matched comparisons need the same tasks, model, budgets and source
-  conditions, with validated findings and adjudication effort measured. See
-  [actor fidelity](../principles/actor-fidelity.md) for claim boundaries.
-
-Capability proof also differs from replacing an adopter's bespoke harness.
-The [proof roadmap](https://github.com/danielgwilson/humanish/blob/main/docs/goals/proof-roadmap/README.md)
-requires decision-equivalent retained evidence and a real deletion branch.
-No first-party deletion branch has met that gate. Public demonstrations do not
-substitute for it.
-
-## Current Program Truth
-
-| Surface               | Available in source                                                                                                                                                                                                                                                                                                                  | Remaining boundary                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Study authoring       | YAML labs, `lanes[]`/roster composition, model settings and study/per-participant caps                                                                                                                                                                                                                                               | Route support varies; declarations are not promises of engine parity                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| Actors                | Seven first-party descriptors; computer-use, scripted-browser and terminal-product dispatch                                                                                                                                                                                                                                          | No supported public out-of-tree actor-registration API                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| Subjects              | `this-repo`, `clone`, `app-url`, `local-app`, `terminal-product`, `desktop-cli`, `local-tree`                                                                                                                                                                                                                                        | `this-repo` is dry-run-only; `local-app` needs a caller-supplied executor/provider                                                                                                                                                                                                                                                                                                                                                                                                             |
-| Task protocol         | Hidden criteria and per-task outcomes on supported separate-world CUA paths, including local-agent and desktop-cli                                                                                                                                                                                                                   | Shared-world, terminal-product, scripted and synthetic routes reject `tasks` before execution                                                                                                                                                                                                                                                                                                                                                                                                  |
-| Shared state          | Concurrent single-origin shared-world studies with retained evidence (the sequential route was removed in 0.106.0)                                                                                                                                                                                                                   | Multi-origin implementation remains gated; concurrent state change does not establish per-action causation                                                                                                                                                                                                                                                                                                                                                                                     |
-| Observer              | Live/recorded views, shared grid and participant playback, participant assignments, action-specific links, saved moments, zoom, comparison and phone-width review                                                                                                                                                                    | Sparse captures cannot prove every action's effect; visual comparison alone is not a controlled experiment                                                                                                                                                                                                                                                                                                                                                                                     |
-| Review and feedback   | Verification grades, feedback drafts, portable HTML, redacted bundle derivatives and computer-use completion-source labels                                                                                                                                                                                                           | Sharing requires the appropriate grade; participant reports and condition matches still need task adjudication                                                                                                                                                                                                                                                                                                                                                                                 |
-| Study findings        | Default post-run analysis on supported live routes with a separate disclosed $3 admission estimate limit and opt-out; explicit `analyze`, fairer evidence selection, concern review and versioned findings with exact source links; explicit restricted Codex account analysis on qualified Linux x64 and Apple Silicon Mac profiles | Account dollars/output-token caps are unavailable; Keychain/other CLI profiles are unqualified. Model interpretation needs review; selection limits coverage; opening Observer never dispatches analysis                                                                                                                                                                                                                                                                                       |
-| TUI and serving       | Detached starts, run stopping, reclamation, Observer attachment, loopback serving, run library and AgentMail setup, authentication and lab configuration                                                                                                                                                                             | Stopping a process does not itself prove sandbox cleanup; TUI views over CLI `stats`/`export` remain follow-ups                                                                                                                                                                                                                                                                                                                                                                                |
-| Off-app communication | Recipient-scoped local capture and fresh real AgentMail receiving, supported inline raster images, bounded collection and host-owned recovery                                                                                                                                                                                        | Real mail uses isolated participant surfaces and remains local-only for publication. Hosted mail/model processing, bounded fidelity and interrupted-run recovery are explicit; real receiving through local-agent, borrowed inboxes and SMS are unsupported                                                                                                                                                                                                                                    |
-| Local browsers        | Shared study loop on Linux x64/Docker/KVM and M3-or-newer Mac/Lima; pinned runtime download, Codex account participants and automatic analysis                                                                                                                                                                                       | Explicit local labs support recipient-scoped captured inboxes; real receiving on local desktops, automatic onboarding, larger cohorts and sleep/wake remain unqualified                                                                                                                                                                                                                                                                                                                        |
-| Mobile and media      | Hosted viewport/emulation, desktop geometry checks, bounded dwell and declared camera feed; optional camera and speech passed two-person Linux and Mac conversations with validated analysis; hosted audio-only uses the same worker; optional screen/mixed-audio MP4 capture shipped with Linux/E2B and Mac acceptance              | Hosted camera+speech is unsupported; English recognition and robotic voice have fidelity limits; raw AV recording is shipped but local-only, excluded from HTML export and analysis (screenshots/text only); the reproduced recording-mix startup video gap is corrected; variable guest capture stalls, initial device/transport availability and cold audio-source delivery remain limits (#854); forced TURN, larger-cohort capacity, physical-device and touch fidelity remain unqualified |
-
-Use the [task support matrix](../architecture/task-protocol-support.md),
-[actor registry](https://github.com/danielgwilson/humanish/blob/main/src/actors/registry.ts)
-and [CLI reference](https://humanish.dev/docs/cli) when choosing a concrete path.
-Source and tests establish observed behavior. Resolve conflicts with requirements
-explicitly; neither stale status prose nor a passing test makes a bug correct.
-
-The library-assisted `local-app` route now includes a
-[runnable npm example](../../examples/participant/README.md).
-Its deterministic provider demonstrates the integration with a real loopback
-app; it does not establish persona effectiveness or independent adoption.
-
-The [local browser runtime](../architecture/local-browser-runtime.md)
-runs isolated Linux browser participants through the same scheduler, recordings
-and automatic analysis as hosted studies. It uses Docker-owned resources and
-ordinary TAP/NAT networking. Continue managed-local work from this complete study
-path. Explicit
-Linux local labs now use the installed CLI/TUI, with a verified runtime download
-before the first live run. Mac browser support is also shipped. Captured inbox integration reuses the existing
-catch and evidence contracts; local provider-backed receiving remains unsupported.
-Optional media passed Linux and Mac conversations with receiving-side evidence
-and owned-resource cleanup. The original Mac recording produced validated
-analysis after its citation instructions were clarified. Existing hosted labs
-retain their behavior.
-
-## Gates And Deferred Work
-
-- [Multi-origin shared-world work](https://github.com/danielgwilson/humanish/issues/239)
-  needs a real adopter's cross-origin requirement and a reviewed implementation
-  packet. It has a ratified core-design direction, but the implementation gate is still closed.
-- [Nested provider grants](https://github.com/danielgwilson/humanish/pull/534)
-  remain unmerged. Do not assume a nested provider-credential channel exists.
-- Paused adopter-deletion work stays paused until its current readiness and
-  maintainer decisions permit it. Do not resume it from the historical queue.
-- Broader actor/plugin APIs, additional media, registry promotion and TUI
-  expansion are follow-ups, not substitutes for a useful maintainer workflow.
-  A concrete use case and current issue readiness determine when to take them up.
-
-## Safety And Autonomous Work
-
-Follow [AGENTS.md](../../AGENTS.md), the [invariants](../principles/invariants-and-defaults.md)
-and the [public-readiness standard](../release/public-readiness-standard.md).
-
-- Keep `main` clean and work on scoped branches/worktrees. Keep the task's scope,
-  authority, relevant checks and material failure boundaries in its issue, PR or
-  current handoff; do not create a separate packet for routine work.
-- Existing explicit shipping authority governs implementation and merge;
-  otherwise issue readiness does not create authority by itself. Machine-readiness
-  fields gate automated queue pickup, not directly assigned interactive work.
-- Never commit secrets, private transcripts/screenshots, customer data or
-  private project context. Keep generated proof in ignored `.humanish/` and
-  retain needed evidence before removing a worktree.
-- Managed paths bind to validated filesystem identities. Stored provider IDs
-  are evidence, not cleanup authority; reclaim only resources the operation is
-  authorized to own, and keep unknown cleanup explicitly unresolved.
-- Verification distinguishes `share_ready`, `local_only` and `blocked`.
-  Feedback drafts do not mutate GitHub by default. Live spend, publishing,
-  external mutation and broader credential access are explicit choices.
-- Provider credential placement is route-specific. The computer-use model key stays
-  on the host; the default terminal runtime uses command-scoped credentials. Do not infer safety from an unqualified “keys stay outside” claim.
-
-## Proof Before Shipping
-
-Use the [verification guidance](../principles/engineering.md#verification): check the changed
-behavior and material risks, then stop unless new evidence warrants more work.
-Required CI remains the merge gate. For a release, run the full release gates
-from a clean contributor worktree:
-
-```bash
-pnpm install --frozen-lockfile
-pnpm release:check
-pnpm docs:check
-git diff --check
-```
-
-For Observer changes, build before its tests and inspect real bundle data at
-390px and desktop width. Run `pnpm --filter humanish-observer test` and
-`pnpm observer:browser:proof`; preserve the source and limits of each receipt.
-For website changes, run site typecheck, build and `registry:check`.
-Required CI remains the merge gate.
-
-Before a release, follow the [release procedure](../release/open-source-readiness.md),
-including the candidate-package `pnpm release:dogfood` study with authorized
-credentials and bounded paid spend. A successful build alone is not participant
-proof. Verify the published package and any changed publishing surface.
-
-A disposable, keyless consumer check is:
-
-```bash
-npm i -D humanish
-npx humanish init --yes
-npx humanish run first-run --json
-npx humanish verify --run latest --json
-npx humanish feedback issue --run latest --repo owner/repo --format markdown
-```
-
-This checks installation, preview evidence and feedback generation. A live
-claim needs actual participant execution, retained evidence and verified
-cleanup. Use N > 1 where the claim needs replication; report cost estimates,
-unknowns and failures without turning them into zeros or successes.
-
-Start from the [ramp](../ramp/README.md), choose one changed user outcome, and
-close work with what changed, what was checked and what remains uncertain.

package/docs/product/lobby-trivia-3player-external-public.md

@@ -1,77 +0,0 @@
-# Example: 3 mobile personas share ONE public multiplayer lobby at once
-
-`humanish/labs/lobby-trivia-3player.yaml` is a worked example of the EXTERNAL-PUBLIC shared-world route
-(#164 phase 2): three mobile-LAYOUT personas play the SAME multiplayer lobby on a REAL public
-deployment simultaneously, watched in ONE Observer. Point `subject.appUrl` + `subject.publicTarget` at
-a public deployment YOU own/operate.
-
-## What it does
-
-- The public site is the shared plane DIRECTLY: no clone, no getHost, no subject sandbox, no seed.
-- A host-first barrier: the `host: true` participant creates the lobby; the orchestrator reads the
-  `/lobby/CODE` from the host's CDP-observed URL and threads it into the follower Join missions.
-  Followers go through the real Join flow (a direct `/lobby/CODE` visit does not auto-join a
-  non-member).
-- Convergence (all three participants reaching one `/lobby/CODE`) is the pass signal (a digest-only
-  `lobbyConvergenceDigest`), plus temporal co-occupancy of the three participants' windows.
-
-## Mobile fidelity caveat (read before over-reading the results)
-
-The participants are `device: mobile` (414×896) and `device: small-mobile` (360×740). On the E2B-desktop
-route the rendered WIDTH is floored to `MIN_DESKTOP_RENDER_WIDTH` (500): Chrome refuses a window
-narrower than ~500 CSS px, and a narrower X screen let the window overflow and clip the page
-(0.20.3, #304). So both presets render at **500 wide**, `mobile` and `small-mobile` are identical in
-layout on this route, and this example does NOT currently exercise two different mobile widths. Only
-the HEIGHT renders as declared (896 and 740).
-
-Note that `desktopGeometry.screen.verified` checks the FLOORED number against itself, so a matching
-`verified` block is not evidence that the preset width rendered. Read `requested` against the preset
-in `device-presets.ts` if you need to know.
-
-There is NO touch input, and isMobile/DPR are prompt-signal + metadata (DPR renders only via the CDP
-geometry path). So "3 mobile personas" means 3 mobile-LAYOUT desktop-Chromium participants, NOT touch
-devices. If a flow needs true touch/tap semantics, these participants will not exercise it. True sub-500
-CSS-viewport rendering is the #221 CDP-device-emulation upgrade.
-
-## Run it
-
-Dry-run (the default, $0; proves the plumbing + the honesty contract, with no sandboxes and no tokens):
-
-```
-humanish lab run lobby-trivia-3player          # or: humanish watch lobby-trivia-3player
-```
-
-Live (opens 3 real mobile-layout participants against the public app):
-
-```
-# flip scenario.mode to live in the lab (or override), then:
-humanish watch lobby-trivia-3player --env-file .env.local   # OPENAI_API_KEY + E2B_API_KEY
-```
-
-Watch it from a phone (today): serve the run directory's Observer through an authed edge:
-
-```
-humanish serve --expose --tunnel <provider> --oauth <provider> --allow-emails you@example.com
-```
-
-Native live-desktop `--expose` streaming on the concurrent path (watch the 3 live desktops as well as
-the evolving Observer artifacts) is a 0.20.1 fast-follow.
-
-## Honesty
-
-This is a real public-application study of a deployment the operator attests they own/operate
-(`subject.publicTarget: { owner, authorized: true }`; this is author trust, which the harness cannot
-verify).
-Attribution stays `shared-world` (N participants, ONE plane), but every strength claim degrades honestly and
-is asserted-absent by verify: provenance `external-public` (not seeded); NO synthetic attestation (you
-cannot claim synthetic on a real site); plane control is operator-attested, not harness-controlled; NO
-authoritative shared-state proof; concurrency by temporal co-occupancy + observed lobby convergence.
-No one run implies adoption, scale, or repeatability.
-
-## Before a live run against a third-party site
-
-The verified lobby-trivia lobby mechanics (createLobby/joinLobby → `/lobby/CODE`, the 6-char
-`ABCDEFGHJKLMNPQRSTUVWXYZ23456789` alphabet, non-auto-join on a direct visit) are read from current
-source and could change on the next deploy. The two coupling points to re-verify are the lobby-code
-regex (`/\/lobby\/([A-Z2-9]{6})(?:$|[/?#])/`, tolerant of a locale prefix and query/hash) and the
-follower Join-flow mission wording.

package/docs/product/open-source-install-experience.md

@@ -1,240 +0,0 @@
-# Open-Source Install Experience
-
-Date: 2026-06-01
-
-Status: product target for the first `humanish` implementation.
-
-Safety amendment (2026-07-14): the `0.15.1` package binds managed run and
-output storage to validated physical paths and treats provider IDs persisted in a
-run bundle as evidence rather than cleanup authority. The historical product target below remains useful for
-intent and sequencing, but current behavior is defined by the README and
-[`docs/goals/current.md`](../goals/current.md).
-
-## Product Promise
-
-Drop humanish into an app and let a coding agent set up realistic persona
-simulations, run them safely, watch them in a polished observer, and turn
-friction into public-safe issue drafts.
-
-The first experience should feel like a mature one-command simulation harness,
-but with an open-source-safe package shape:
-
-```bash
-npm i -D humanish
-npx humanish init
-npm run humanish:doctor
-npm run humanish:watch
-npm run humanish:verify
-npx humanish feedback issue --run latest --repo example/app --format markdown
-```
-
-## Two-Part Distribution
-
-### NPM Package
-
-The npm package owns executable behavior:
-
-- binary: `humanish`;
-- CLI framework: `commander`;
-- commands: `init`, `doctor`, `run`, `watch`, `review`, `verify`,
-  `lab`, `feedback`;
-- schemas and validators;
-- synthetic starter templates;
-- observer static assets;
-- artifact and run-bundle utilities;
-- redaction and public issue-draft generation.
-
-### Agent Skill
-
-The agent skill owns installation guidance and repo adaptation:
-
-```bash
-npx skills add danielgwilson/humanish --skill humanish
-```
-
-Installable repo skill: [`skills/humanish/SKILL.md`](../../skills/humanish/SKILL.md).
-
-The skill should teach the user's coding agent how to:
-
-- install `humanish`;
-- run `humanish init`;
-- inspect the target app's routes and dev command;
-- create synthetic personas and scenarios;
-- create public-safe `humanish/labs/*.yaml` lab manifests;
-- keep private/local labs under ignored `.humanish/labs/*.yaml` or
-  `.humanish/local/labs/*.yaml`;
-- configure local app targets;
-- document E2B and OpenAI env var names without storing values;
-- use `--env-file <path>` for explicit local env hydration without persisting
-  values into artifacts;
-- run `doctor`, `watch`, `verify`, and `feedback issue`;
-- avoid PII, PHI, secrets, real customer data, and private artifacts.
-
-The skill should not hide critical behavior in chat memory. It should point to
-repo-owned `humanish/` files and package-owned docs.
-
-## Project File Formats
-
-New projects should get a boring, legible format stack:
-
-- `.yaml` for human-authored humanish source such as labs, personas and
-  scenarios;
-- `.mjs` for executable adopter scorers;
-- `.json` and `.ndjson` for generated run artifacts, Observer data, review
-  output, event streams, and synthetic fixtures.
-
-Use `.yml` only where an outside tool's convention already expects it, for
-example GitHub Actions workflows. Do not scaffold `.yml` for humanish source and
-do not use TOML unless a future scalar global-config case clearly needs it.
-
-## First-Run Principles
-
-- No keys required for the first successful run.
-- No live GitHub mutation.
-- No hosted queues or private infrastructure.
-- No real customer/user/patient data.
-- No generated personas from tickets, logs, transcripts, screenshots, or
-  production analytics.
-- Safe dry-run should produce a valid synthetic run bundle and observer view.
-- The user should see what changed in git.
-
-## Lab Manifest Shape
-
-Labs are the public-safe way to name a reusable simulation run. A starter app
-gets a committed synthetic lab:
-
-```yaml
-schema: humanish.lab.v2
-id: first-run
-title: First-run synthetic Observer
-description: Public-safe starter lab that generates a synthetic run bundle and Observer without provider spend.
-subject:
-  source: this-repo
-actors:
-  - type: synthetic-persona
-    count: 4
-scenario:
-  mode: dry-run
-defaults:
-  open: true
-```
-
-Resolution order:
-
-1. `humanish/labs/<id>.yaml` for committed, reproducible labs.
-2. `.humanish/labs/<id>.yaml` for ignored local labs.
-3. `.humanish/local/labs/<id>.yaml` for ignored machine-specific overlays.
-4. explicit `.yaml` path, for example
-   `.humanish/labs/local-dogfood.yaml`.
-
-Private repo targets, local env references, and maintainer dogfood variants
-belong in ignored lab manifests and should be invoked with explicit
-`--env-file`; do not make them package defaults.
-
-## `humanish init`
-
-`humanish init` should:
-
-1. Detect package manager and app framework when possible.
-2. Create committed starter files under `humanish/`.
-3. Create ignored runtime state under `.humanish/`.
-4. Add `.humanish/` and secret/local overlays to `.gitignore`.
-5. Patch `package.json` scripts only after showing the intended diff or when
-   `--yes` is passed.
-6. Create only synthetic public-safe personas and scenarios.
-7. Write credential references as env var names only.
-8. Run a dry-run verification if dependencies are available.
-
-Suggested scripts:
-
-```json
-{
-  "scripts": {
-    "humanish": "humanish",
-    "humanish:doctor": "humanish doctor",
-    "humanish:run": "humanish run --dry-run",
-    "humanish:watch": "humanish watch",
-    "humanish:lab:list": "humanish lab list",
-    "humanish:watch:ci": "humanish watch --json --no-open",
-    "humanish:verify": "humanish verify"
-  }
-}
-```
-
-## Command Ladder
-
-| Command                           | Purpose                                 | First version should                                                                                  |
-| --------------------------------- | --------------------------------------- | ----------------------------------------------------------------------------------------------------- |
-| `humanish init`                   | Set up project-owned harness files      | Scaffold committed `humanish/`, ignored `.humanish/`, package scripts                                 |
-| `humanish doctor`                 | Explain readiness                       | Check config, gitignore, app target, browser, env var names, redaction policy                         |
-| `humanish run --dry-run`          | Prove contract without app/browser/keys | Write synthetic run bundle                                                                            |
-| `humanish verify`                 | Validate bundle and public-safety gates | Fail closed on schema/evidence/redaction errors                                                       |
-| `humanish review`                 | Build review packet from evidence       | Summarize verdicts without inventing product proof                                                    |
-| `humanish watch`                  | Run synthetic participants and watch    | Create a fresh four-participant bundle, render Observer, open it, and keep the shell attached         |
-| `humanish watch [lab]`            | Run a named lab and watch it            | Resolve committed or ignored `.yaml` lab manifests, then open/follow Observer                         |
-| `humanish watch --json --no-open` | Agent/CI proof path                     | Create the same bundle and Observer artifacts without browser open or attached watch server           |
-| `humanish lab list`               | Discover available labs                 | List committed labs and ignored local labs with origin labels                                         |
-| `humanish lab inspect <lab>`      | Read a lab manifest                     | Print the parsed lab config, origin, path, and warnings without executing                             |
-| `humanish lab preflight <lab>`    | Check lab readiness before spend        | Validate routing and optionally probe declared targets from a hosted desktop without launching actors |
-| `humanish lab run <lab>`          | Run a lab manifest                      | Human or JSON execution path for every lab route                                                      |
-| `humanish feedback issue`         | Produce public-safe issue draft         | Print Markdown or prefilled issue URL, no GitHub API mutation                                         |
-
-## Live Capability Ladder
-
-Live execution should be staged after the dry-run path is boring:
-
-1. Synthetic dry-run bundle.
-2. Local app reachability and browser smoke.
-3. Scripted browser scenario.
-4. Observer over real screenshots/traces.
-5. Computer-use / OpenAI actor.
-6. E2B substrate.
-7. Multi-persona matrix.
-8. Optional maintainer-only issue sync tooling.
-
-Do not make E2B, OpenAI, or GitHub credentials part of the first successful
-run.
-
-For step 3, app-specific browser scenarios are authored as `.yaml` source under
-`humanish/scenarios/*.yaml`:
-
-```yaml
-schema: humanish.scenario.v1
-id: core-browser-flow
-title: Core browser flow
-persona: synthetic-new-user
-goal: Reach the first meaningful product state with synthetic data.
-mode: browser
-browser:
-  startPath: /
-  steps:
-    - id: open-home
-      label: Open the app
-      action: goto
-      path: /
-      expect:
-        text: "Get started"
-    - id: submit-primary-action
-      label: Submit the primary action
-      action: click
-      selector: "button[type='submit']"
-      expect:
-        stateChanged: true
-```
-
-A scripted-browser lab runs the scenario named by `scenario.ref` against a
-loopback `subject.appUrl`; `humanish/labs/scripted-demo.yaml` is the example.
-A missing or non-executable scenario fails before any browser starts.
-
-Live E2B desktop labs are an optional advanced path. Target projects that need
-them should install `@e2b/desktop` explicitly instead of receiving that
-substrate as part of the default humanish package install. When a GitHub token is
-present, repo labels are redacted in durable artifacts by default; live stream
-auth URLs are used only by the attached watch server and are not persisted.
-
-An explicitly selected [local browser lab](../architecture/local-browser-runtime.md)
-can instead use Linux x64, Docker/KVM and an existing Codex ChatGPT login for
-participants and findings. The installed CLI prepares its pinned image before
-the first live run. It does not install host prerequisites, and Mac, inbox and
-media integration remain separate follow-ups. Existing hosted lab configuration
-is preserved.