humanish 0.86.0 → 0.87.0

package/docs/ramp/README.md

@@ -2,7 +2,7 @@
 
 Status: public-safe contributor and agent ramp.
 
-Package/source version in this tree: `0.86.0` (2026-09-09). The Observer is phone-usable as a stated requirement (observer/AGENTS.md); interactive primitives start from Base UI. The Observer renderer is the observer/ workspace artifact only; the legacy string-concat renderer was deleted at cutover (#426), and rollback is a version pin to 0.42.0. The containment boundary introduced in
+Package/source version in this tree: `0.87.0` (2026-09-10). The Observer is phone-usable as a stated requirement (observer/AGENTS.md); interactive primitives start from Base UI. The Observer renderer is the observer/ workspace artifact only; the legacy string-concat renderer was deleted at cutover (#426), and rollback is a version pin to 0.42.0. The containment boundary introduced in
 `0.15.1` remains in force: managed run and output paths bind to validated
 physical filesystem identities, and stored provider IDs are evidence, not
 cleanup authority. The bundled OSS meta-lab is dry-run only until
@@ -47,6 +47,14 @@ If a change does not improve one of those loops, it probably belongs elsewhere.
 
 ## Current State
 
+The [0.87.0 release note](../release/0.87.0-participant-endings-and-phone-review.md)
+describes recorded interruption causes, phone playback controls beside fitted
+captures, and credential and evidence-sharing guidance by execution route.
+
+The [0.86.1 release note](../release/0.86.1-task-preflight-saved-recordings.md)
+describes task preflight on unsupported execution paths and saved HTML recordings
+that remain snapshots when served over HTTP.
+
 The [0.86.0 release note](../release/0.86.0-participant-evidence.md) describes
 participant assignments, action-specific replay links and bounded cleanup with
 the current desktop SDK. Old runs without assignment fields remain readable;
@@ -75,7 +83,7 @@ Implemented:
 - first-class lab manifest resolution through `humanish/labs/*.yaml` and
   ignored `.humanish/labs/*.yaml` overlays — `humanish.lab.v2` compositions
   (`src/lab-config.ts`), one engine, no hardcoded lab kinds;
-- a first-party actor registry with six registered descriptors
+- a first-party actor registry with seven registered descriptors
   (`src/actor-registry.ts`); `actors[0].type` is a real dispatch key on the
   computer-use, scripted-browser, and terminal-product routes;
 - a computer-use route and clone subject provider: `subject.source: app-url`
@@ -126,7 +134,7 @@ without changing its success standard.
 - capability receipts are not adopter replacement: no first-party deletion
   branch has yet removed a bespoke generic harness while preserving
   decision-equivalent proof;
-- the six actor descriptors are a closed first-party union, not a supported
+- the seven actor descriptors are a closed first-party union, not a supported
   out-of-tree actor-registration API;
 - run storage and provider-resource lifecycle logic still spans several routes
   instead of one `RunStore` and `ResourceLease` boundary;

package/docs/release/0.86.1-task-preflight-saved-recordings.md

@@ -0,0 +1,40 @@
+# Humanish 0.86.1: enforce declared tasks and preserve saved recordings
+
+Humanish now refuses a task protocol when the chosen execution path cannot run
+it. Previously, a shared-world, terminal, scripted or synthetic lab could accept
+`actors[0].tasks` and then omit those tasks during execution. Preflight now names
+the unsupported field before creating a run or starting hooks, processes,
+desktops or model requests. Remove `tasks` only when you intend a mission-only
+study, or choose a supported per-lane computer-use route.
+
+The same check protects direct library callers. Per-lane computer-use tasks
+remain supported, including `local-agent`, `local-app` and `desktop-cli` paths.
+Tasks on a second or later actor are rejected because current runners consume
+the first actor. The [support matrix](../architecture/task-protocol-support.md)
+describes the execution boundaries and structured errors.
+
+Portable HTML exports now identify themselves as **Saved recording**, including
+when opened from a website. They do not request a live feed, show a retry warning
+for a missing endpoint, or open a desktop preview from a recording captured
+while the participant was running. Recorded outcomes, timestamps and images
+remain intact. Ordinary `humanish observe` and `humanish serve` pages still
+request updates and report real connection failures.
+
+Install with `npm install -g humanish@0.86.1`. Regenerate an existing export with
+`humanish export --run RUN --format html` to use the corrected viewer. Existing
+HTML files keep the behavior of the version that produced them.
+
+## Verification and limits
+
+The task preflight proof exercises unsupported lab shapes through the compiled
+CLI with provider, network and subprocess operations denied. Parser and direct
+runner tests also cover supported CUA paths and mission-only execution. These
+are refusal and compatibility checks; they do not establish task support in
+the rejected engines.
+
+Production browser checks use a retained real recording over HTTP and from a
+local file at desktop and phone widths. Controls cover ordinary served pages,
+legacy exports and a snapshot captured while running. Snapshot checks verify
+that no feed, history or live desktop request occurs; served controls preserve
+the visible connection failure. No run-data schema or original study result
+changes, and this release adds no continuous video or physical-device proof.

package/docs/release/0.87.0-participant-endings-and-phone-review.md

@@ -0,0 +1,64 @@
+# Humanish 0.87.0: see why a participant stopped
+
+The Observer now distinguishes a provider response limit from elapsed time or
+estimated spend. Participant cards, summaries and reports show the recorded
+cause, including for participants with no screenshot frames. New computer-use
+traces retain an optional `stopCause` alongside the existing status and
+completion reason.
+
+New computer-use sessions that hit their estimated spend cap before any action
+are classified as interrupted, with no target-app feedback inferred from that
+harness stop. The cap timing and recorded usage are unchanged.
+
+Older recordings use exact machine-generated notices where available. A recorded
+“provider token limit reached” notice remains **provider token limit**: it does
+not establish whether the provider exhausted its output or context allowance.
+When an older run records only a generic limit, the Observer says **limit
+reached**. Updating a viewer preserves the original evidence and outcome counts;
+it does not infer a cause from participant prose.
+
+On phones, a saved landscape capture in Fit mode keeps playback controls beside
+the fitted image. Portrait captures, zoomed views and live views retain their
+bounded viewing area. The run banner states **Saved recording** once; the player
+keeps the participant status and selected capture timestamp. Exact action links
+and saved-moment recall retain their existing behavior.
+
+Expanded assignments show the recorded lane focus before the mission, so a long
+mission does not put those instructions below it in the phone panel. The full
+mission and participant tasks remain available.
+
+The website also explains credential placement by execution route. Computer-use
+model keys remain on the host. Terminal actors receive a command-scoped runtime
+key by default; optional `openai-egress` keeps the raw key outside the sandbox
+while still allowing sandbox processes to make paid requests through its proxy.
+Evidence stays local by default, and exposing Observer or sharing an export makes
+it accessible to others. See the [credential and sharing guide](https://humanish.dev/docs/budgets-and-privacy#store-credentials).
+
+Install with `npm install -g humanish@0.87.0`. Reopen a run with
+`humanish observe --run RUN`, or regenerate its HTML export, to use the updated
+viewer. Existing HTML files retain the renderer that produced them.
+
+## Verification and limits
+
+[Interruption-cause checks](https://github.com/danielgwilson/humanish/pull/747)
+cover recorded provider output limits, legacy token-limit notices, elapsed time,
+spend and incomplete provider responses. Tests preserve old outcome counts and
+source evidence through served and exported projections. A retained real
+recording was inspected at desktop and phone widths, including its participant
+whose provider stopped before any app action.
+
+[Zero-action spend-cap checks](https://github.com/danielgwilson/humanish/pull/752)
+verify one provider turn, zero executed actions, retained usage, an interrupted
+outcome and no inferred target-app feedback. Older bundle counts are unchanged.
+
+[Phone review checks](https://github.com/danielgwilson/humanish/pull/746) cover
+landscape and portrait capture/control spacing, keyboard seeking, focus, zoom,
+action links, refresh and saved-moment recall against retained recordings.
+These browser checks do not establish physical-phone behavior or new live-stream
+coverage. Screenshot replay remains sparse, and no participant success rate or
+incremental persona benefit is inferred from these changes.
+
+The [assignment ordering change](https://github.com/danielgwilson/humanish/pull/754)
+preserves recorded text while moving lane instructions to the top of expanded
+assignments. This addresses visibility; it does not establish that every reader
+will interpret the instructions correctly.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.86.0",
+  "version": "0.87.0",
   "description": "Open-source-safe CLI for persona simulation, observer review, and public-safe feedback drafts.",
   "author": "Daniel G Wilson <daniel@danielgwilson.com>",
   "keywords": [
@@ -50,8 +50,9 @@
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json && pnpm --filter humanish-observer build && pnpm --filter humanish-tui build && node scripts/finish-build.mjs",
-    "check": "pnpm typecheck && pnpm test && pnpm tui:test && pnpm build && pnpm cli:startup:test && pnpm tui:smoke",
+    "check": "pnpm typecheck && pnpm test && pnpm tui:test && pnpm build && pnpm cli:startup:test && pnpm cli:preflight:test && pnpm tui:smoke",
     "cli:startup:test": "node scripts/terminal-startup-exit-proof.mjs",
+    "cli:preflight:test": "node scripts/task-route-preflight-proof.mjs",
     "humanish": "tsx src/cli.ts",
     "pack:dry-run": "npm pack --dry-run",
     "prepack": "pnpm build",