humanish 0.86.1 → 0.88.0

package/docs/ramp/README.md

@@ -2,7 +2,7 @@
 
 Status: public-safe contributor and agent ramp.
 
-Package/source version in this tree: `0.86.1` (2026-09-09). The Observer is phone-usable as a stated requirement (observer/AGENTS.md); interactive primitives start from Base UI. The Observer renderer is the observer/ workspace artifact only; the legacy string-concat renderer was deleted at cutover (#426), and rollback is a version pin to 0.42.0. The containment boundary introduced in
+Package/source version in this tree: `0.88.0` (2026-09-11). The Observer is phone-usable as a stated requirement (observer/AGENTS.md); interactive primitives start from Base UI. The Observer renderer is the observer/ workspace artifact only; the legacy string-concat renderer was deleted at cutover (#426), and rollback is a version pin to 0.42.0. The containment boundary introduced in
 `0.15.1` remains in force: managed run and output paths bind to validated
 physical filesystem identities, and stored provider IDs are evidence, not
 cleanup authority. The bundled OSS meta-lab is dry-run only until
@@ -47,6 +47,14 @@ If a change does not improve one of those loops, it probably belongs elsewhere.
 
 ## Current State
 
+The [0.88.0 release note](../release/0.88.0-study-diagnostics.md) describes
+computer-use CLI diagnostics, explicit local admission limits and retained
+uncertainty when an earlier provider request did not report usage.
+
+The [0.87.0 release note](../release/0.87.0-participant-endings-and-phone-review.md)
+describes recorded interruption causes, phone playback controls beside fitted
+captures, and credential and evidence-sharing guidance by execution route.
+
 The [0.86.1 release note](../release/0.86.1-task-preflight-saved-recordings.md)
 describes task preflight on unsupported execution paths and saved HTML recordings
 that remain snapshots when served over HTTP.
@@ -79,7 +87,7 @@ Implemented:
 - first-class lab manifest resolution through `humanish/labs/*.yaml` and
   ignored `.humanish/labs/*.yaml` overlays — `humanish.lab.v2` compositions
   (`src/lab-config.ts`), one engine, no hardcoded lab kinds;
-- a first-party actor registry with six registered descriptors
+- a first-party actor registry with seven registered descriptors
   (`src/actor-registry.ts`); `actors[0].type` is a real dispatch key on the
   computer-use, scripted-browser, and terminal-product routes;
 - a computer-use route and clone subject provider: `subject.source: app-url`
@@ -130,7 +138,7 @@ without changing its success standard.
 - capability receipts are not adopter replacement: no first-party deletion
   branch has yet removed a bespoke generic harness while preserving
   decision-equivalent proof;
-- the six actor descriptors are a closed first-party union, not a supported
+- the seven actor descriptors are a closed first-party union, not a supported
   out-of-tree actor-registration API;
 - run storage and provider-resource lifecycle logic still spans several routes
   instead of one `RunStore` and `ResourceLease` boundary;

package/docs/release/0.87.0-participant-endings-and-phone-review.md

@@ -0,0 +1,64 @@
+# Humanish 0.87.0: see why a participant stopped
+
+The Observer now distinguishes a provider response limit from elapsed time or
+estimated spend. Participant cards, summaries and reports show the recorded
+cause, including for participants with no screenshot frames. New computer-use
+traces retain an optional `stopCause` alongside the existing status and
+completion reason.
+
+New computer-use sessions that hit their estimated spend cap before any action
+are classified as interrupted, with no target-app feedback inferred from that
+harness stop. The cap timing and recorded usage are unchanged.
+
+Older recordings use exact machine-generated notices where available. A recorded
+“provider token limit reached” notice remains **provider token limit**: it does
+not establish whether the provider exhausted its output or context allowance.
+When an older run records only a generic limit, the Observer says **limit
+reached**. Updating a viewer preserves the original evidence and outcome counts;
+it does not infer a cause from participant prose.
+
+On phones, a saved landscape capture in Fit mode keeps playback controls beside
+the fitted image. Portrait captures, zoomed views and live views retain their
+bounded viewing area. The run banner states **Saved recording** once; the player
+keeps the participant status and selected capture timestamp. Exact action links
+and saved-moment recall retain their existing behavior.
+
+Expanded assignments show the recorded lane focus before the mission, so a long
+mission does not put those instructions below it in the phone panel. The full
+mission and participant tasks remain available.
+
+The website also explains credential placement by execution route. Computer-use
+model keys remain on the host. Terminal actors receive a command-scoped runtime
+key by default; optional `openai-egress` keeps the raw key outside the sandbox
+while still allowing sandbox processes to make paid requests through its proxy.
+Evidence stays local by default, and exposing Observer or sharing an export makes
+it accessible to others. See the [credential and sharing guide](https://humanish.dev/docs/budgets-and-privacy#store-credentials).
+
+Install with `npm install -g humanish@0.87.0`. Reopen a run with
+`humanish observe --run RUN`, or regenerate its HTML export, to use the updated
+viewer. Existing HTML files retain the renderer that produced them.
+
+## Verification and limits
+
+[Interruption-cause checks](https://github.com/danielgwilson/humanish/pull/747)
+cover recorded provider output limits, legacy token-limit notices, elapsed time,
+spend and incomplete provider responses. Tests preserve old outcome counts and
+source evidence through served and exported projections. A retained real
+recording was inspected at desktop and phone widths, including its participant
+whose provider stopped before any app action.
+
+[Zero-action spend-cap checks](https://github.com/danielgwilson/humanish/pull/752)
+verify one provider turn, zero executed actions, retained usage, an interrupted
+outcome and no inferred target-app feedback. Older bundle counts are unchanged.
+
+[Phone review checks](https://github.com/danielgwilson/humanish/pull/746) cover
+landscape and portrait capture/control spacing, keyboard seeking, focus, zoom,
+action links, refresh and saved-moment recall against retained recordings.
+These browser checks do not establish physical-phone behavior or new live-stream
+coverage. Screenshot replay remains sparse, and no participant success rate or
+incremental persona benefit is inferred from these changes.
+
+The [assignment ordering change](https://github.com/danielgwilson/humanish/pull/754)
+preserves recorded text while moving lane instructions to the top of expanded
+assignments. This addresses visibility; it does not establish that every reader
+will interpret the instructions correctly.

package/docs/release/0.88.0-study-diagnostics.md

@@ -0,0 +1,43 @@
+# Humanish 0.88.0: see what ended a study
+
+When a computer-use study stops before the task is done, `humanish lab run` now
+shows its diagnostic category and recorded stop cause. Fan-out results retain
+each participant's ending. Different endings remain mixed. Older generic budget
+stops retain an unspecified limit. Successful dry-runs are reported as contract
+previews.
+
+New review packets and feedback participant summaries use recorded interruption
+labels. Previously saved review packets keep their original wording.
+
+An adapter can use the new `CuaAdmissionLimitError` to declare that its local
+limit refused a request before dispatch. Humanish records **adapter admission
+limit** and ends the interaction without another retry, action or closing
+report. Earlier actions and measured usage remain available. A refusal of an
+optional closing report preserves the already observed task outcome. See the
+[adapter contract](../contracts/adapter-admission.md) for when this signal applies.
+
+If an earlier request stalled or had an ambiguous transport outcome, a later
+success or local refusal does not make its missing usage known. The cost summary
+keeps measured token estimates and an explicit unmeasured line. With a spending
+cap, Humanish skips the optional closing report while that usage is uncertain.
+
+Install with `npm install -g humanish@0.88.0`. CLI JSON adds optional diagnostics
+without changing the existing status or exit-code contract. Usage telemetry,
+enabled by default, adds two fields with fixed allowed values: diagnostic
+category and stop cause. See [TELEMETRY.md](https://github.com/danielgwilson/humanish/blob/main/TELEMETRY.md)
+for their scope and opt-out controls.
+
+## Verification and limits
+
+[Admission-limit checks](https://github.com/danielgwilson/humanish/pull/759)
+cover refusal before and after activity, sanitized error handling, preserved
+outcomes and unknown usage after both successful and refused retries.
+[CLI diagnostic checks](https://github.com/danielgwilson/humanish/pull/758)
+cover previews, mixed endings, missing causes, invalid evidence and telemetry
+allowlists. The required release checks also cover package installation,
+Observer rendering and the website.
+
+The admission signal depends on an accurate adapter declaration; it is not a
+provider billing receipt. Existing generic failures keep their recorded
+outcomes. This release does not infer causes from participant prose or establish
+why an older study failed.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.86.1",
+  "version": "0.88.0",
   "description": "Open-source-safe CLI for persona simulation, observer review, and public-safe feedback drafts.",
   "author": "Daniel G Wilson <daniel@danielgwilson.com>",
   "keywords": [