humanish 0.19.0 → 0.20.0

package/docs/release/0.20.0-external-public-shared-world.md

@@ -0,0 +1,43 @@
+# 0.20.0 — External-public shared-world plane + CDP lobby-code handoff
+
+Additive minor release. No breaking change to the provisioned-getHost path, its schema, or its verify
+asserts (byte-stable; a snapshot regression pins it).
+
+## Highlights
+
+- **External-public shared-world plane class** (`sharedWorld.planeClass: "external-public"`). A real,
+  operator-OWNED public deployment can now be the shared plane DIRECTLY: `subject.source: app-url` +
+  `subject.topology: shared-world` + `policies.allowPublicTargets: true` +
+  `execution.concurrency > 1`. NO getHost, NO clone, NO subject sandbox, NO seed. The N>1 +
+  `allowPublicTargets` refusal now ROUTES here when `topology: shared-world` is declared, instead of
+  failing.
+- **Operator-ownership attestation** `subject.publicTarget: { owner, authorized: true }` — the honest
+  analog of `exposure: synthetic` for a plane the harness does not own (author-trust, unverifiable).
+- **CDP lobby-code handoff barrier.** A new runtime-only `CuaLoopOptions.onObservedUrl(url)` callback
+  (fired after every `executor.observe()`, never persisted) feeds a host-first barrier: the host seat
+  creates the shared lobby, the orchestrator extracts `/lobby/CODE` from its CDP-observed URL and
+  threads the code into the follower JOIN missions; followers fail closed WITHOUT opening on
+  `HUMANISH_CONCURRENT_SHARED_WORLD_LAB_HANDOFF_TIMEOUT`.
+- **3-mobile cineguessr example** (`humanish/labs/cineguessr-3player.yaml` + an init template): 3
+  mobile-LAYOUT personas play the same multiplayer lobby on a real public app at once. Dry-run $0.
+- **Honest evidence class.** Attribution stays `shared-world`; every strength claim degrades honestly
+  and is asserted-ABSENT by verify: `subject.state.provenance == external-public` (not seeded);
+  `plane.exposure` ABSENT (no synthetic claim on a real site); `plane.publicOriginDigest` is the
+  OBSERVED origin the seats converged on (redirect-tolerant — a cross-origin apex→www/http→https
+  redirect is normal; the declared origin is recorded separately as `plane.declaredOriginDigest` and
+  is never asserted equal) with every observed `routeHostDigest` converging on it (operator-attested,
+  not harness-controlled); NO
+  authoritative `stateSeries` (Option A); relaxed concurrency-on-pass (temporal co-occupancy only);
+  optional `lobbyConvergenceDigest`. The getHost synthetic gate stays UNCHANGED and is deliberately
+  unreachable from the app-url branch.
+
+## Watch-from-phone
+
+`humanish serve --expose` covers the evolving Observer/artifacts from a phone TODAY. Native
+live-desktop `--expose` streaming on the concurrent path is a clean 0.20.1 fast-follow reusing
+`startExposedObserver` on the concurrent observer server.
+
+## Notes
+
+- Cost tracking (0.19.0) and the CommandExitError resilience fix (0.19.1) remain in place.
+- `execution.timeoutMs` caps the host-first handoff deadline (default 120s).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Open-source-safe CLI for persona simulation, observer review, and public-safe feedback drafts.",
   "author": "Daniel G Wilson <daniel@danielgwilson.com>",
   "keywords": [