humanish 0.96.0 → 0.97.0

package/docs/architecture/desktop-sessions.md

@@ -0,0 +1,80 @@
+# Owned desktop sessions
+
+Independent hosted computer-use lanes acquire an owned desktop allocation before
+subject setup, then bind its executor after browser setup. The participant loop
+still consumes `CuaExecutor`; provisioning commands stay in the hosted adapter.
+This internal interface is not a public runtime plugin API.
+
+`desktop-session.ts` holds the lifecycle contract. The allocation captures a
+resource ID and a release closure. Its ID is a record of acquisition, not
+authority to reconstruct or reclaim a resource from an arbitrary saved bundle.
+
+An allocation binds one participant executor. Closing it immediately rejects new
+observations and actions, forwards no further calls, and shares one release
+attempt across repeated or concurrent callers. Cancellation signals pass through
+unchanged. Closing does not wait for an already-dispatched backend operation;
+that operation may fail as the desktop stops.
+
+Cleanup has three outcomes:
+
+- `released`: the adapter confirmed termination or that the resource was already
+  gone;
+- `retained`: an existing debug-retention policy deliberately kept the desktop;
+- `unconfirmed`: release was unavailable, failed, or returned an invalid result.
+
+A closed allocation never implicitly retries cleanup or reopens input. Recovery
+needs its own authorized operation. Runtime exceptions remain untrusted and must
+pass the caller's existing redaction before entering warnings or artifacts.
+
+The E2B adapter preserves the existing create options, template overload, startup
+retry guard and kill-on-timeout policy. It captures the acquired ID and kill
+method before provisioning hooks can mutate the SDK object. E2B's boolean kill
+result confirms either termination (`true`) or prior absence (`false`, its 404
+case). Other values do not confirm cleanup. Account-wide enumeration is never
+part of release.
+
+Already-absent cleanup carries a warning: the exact termination time is unknown.
+As before, desktop cost is an estimate over the host's acquisition-to-cleanup
+span, not a provider billing measurement.
+
+`CuaDesktopLane` separates desktop preparation from the participant runner:
+
+1. `prepare()` acquires and prepares the desktop. Failures still leave cleanup
+   authority with the adapter.
+2. The runner starts its model session and signals the existing hosted pipeline
+   gate, preserving the current scheduling order.
+3. `openSession()` measures initial browser geometry, starts the optional live
+   stream, and supplies a `CuaExecutor` plus any participant inbox location.
+4. The runner executes the participant loop and closes its model session.
+5. `finalize()` collects final evidence and releases the desktop, including after
+   preparation or participant failure. Repeated calls share one finalization.
+6. `snapshot()` supplies the desktop facts for the existing lane outcome.
+
+The E2B implementation lives in `e2b-cua-desktop.ts`; its browser, media and
+subject provisioning primitives live in `e2b-cua-provisioning.ts`. Existing
+helper imports through `cua-actor-lab.ts` remain supported. The adapter never
+imports the lab runner at runtime.
+
+The runner owns instructions, model execution, spend guards, screenshots, trace
+persistence and participant outcome interpretation. It does not invoke desktop
+shell commands or manufacture E2B objects for an alternate executor. The internal
+`CuaLaneDeps.createDesktopLane` seam is for construction and contract testing;
+it does not add a user-facing runtime option or bypass CLI admission checks.
+
+Final evidence errors cannot skip desktop release. Existing bundle fields and
+desktop lifetime accounting retain their meanings; unconfirmed or retained
+desktops do not become confirmed cleanup. Provider facts remain absent when the
+adapter cannot establish them.
+
+This change supplies an internal boundary for future runtime adapters. Managed
+local execution, artifact installation, controller-death leases, capability
+admission and new media support require separate implementations and proofs.
+Independent hosted browser and terminal lanes, plus concurrent shared-world
+seats that use `runCuaLane`, use this boundary. Sequential shared-world lifecycle
+remains separate and uses the same re-exported provisioning helpers.
+
+The independent lane's `runSession` testing hook now receives a constructed
+`executor` instead of `desktop`/`executorOptions`. A hook should consume the
+normal `CuaActorSessionOptions` executor or delegate to `runCuaActorSession`.
+Library calls directly using `runCuaActorSession({ desktop, executorOptions })`
+remain supported; the custom in-process `buildExecutor` route is unchanged.

package/docs/architecture/restricted-codex-analysis.md

@@ -0,0 +1,89 @@
+# Restricted Codex account analysis
+
+The optional account analyst uses a new Codex app-server process after participant
+execution, with a separate conversation, process and tool authority. It can use
+the same host Codex login as a local-agent participant. Existing API analysis
+remains a separate provider.
+
+The qualified launcher profile is **Codex CLI 0.154.0, Linux x64, file-backed
+ChatGPT login, `gpt-6-astra`, low reasoning effort**. Other versions/platforms,
+keychain-only logins and API-key Codex logins are refused before a model turn.
+Readiness validates the installation and effective profile without submitting a
+model turn; it does not guarantee current quota or model access.
+
+## Authority and request limits
+
+The host creates a private temporary Codex home and links only the existing
+`auth.json`. Humanish never reads or copies its values. The native CLI owns
+authentication and provider network traffic. Its environment excludes provider
+keys, target-app variables, alternate endpoints and operator configuration.
+The selected native binary is launched directly; npm wrappers are resolved to
+their native executable before launch.
+
+Before creating a thread, Humanish checks the effective config. Nonempty system
+settings, inherited instructions, MCP, plugins, hooks, alternate stores/endpoints
+and unsupported authority are rejected. The thread is ephemeral, has no runtime
+environments or workspace roots, and uses only the supplied text/images and
+closed output schema. No provider/model fallback is allowed.
+
+This profile is **not advertised as tool-free**. The CLI retains code-mode
+descriptions, but the qualified `features.code_mode_host=false` setting rejects
+their actual dispatch. `agents.enabled=false` removes delegation; the older
+feature toggle alone did not. Humanish also refuses raw tool calls, unexpected
+host RPCs and asynchronous question messages before accepting any report. The
+actual notification/denial captures and provenance are in
+[`tests/fixtures/restricted-codex`](https://github.com/danielgwilson/humanish/blob/46330116726f74080fa18947c36da4fb4b333805/tests/fixtures/restricted-codex/README.md).
+
+There is one active analyst/readiness session per Humanish process, across all
+provider factories. One fresh thread receives one turn. Evidence is not silently
+downselected: at most 128 images, 20 MiB decoded image data, and 32 MiB serialized
+request data are admitted. Generated report text is limited to 2 MiB. Raw input
+notifications echo image data URLs, so their frame budget is the larger of 2 MiB
+or the admitted serialized packet plus 1 MiB; total stdout is bounded separately
+at the larger of 8 MiB or twice that frame budget plus 4 MiB. Stderr is bounded at
+2 MiB and is not retained. Notifications are limited to 65,536; aggregate
+generated assistant-text deltas are independently limited to 2 MiB, regardless
+of the input-image wire budget. The request's
+deadline includes startup; individual RPCs also have a 15-second ceiling.
+
+Account analysis has unknown dollar cost and no supported generated-token cap.
+Numeric output-token caps are rejected. The integration must likewise reject
+numeric dollar caps for this provider. Known token usage is retained; missing or
+interrupted usage is unknown/partial, not zero. The ordinary analysis validator,
+source-integrity checks and narrative secret scrubber remain responsible for
+accepting and publishing the report.
+
+## Cancellation and auth recovery
+
+Cancellation interrupts the turn, then closes the directly owned native child
+and its stdio with bounded termination/kill waits. No stored PID or process group
+is signaled after exit. This proves the direct child's lifecycle, not arbitrary
+descendant-tree reclamation; process-spawning tools are outside this profile.
+If native closure cannot be confirmed, Humanish preserves its private state and
+blocks another session in the same process until that exact child closes.
+
+After confirmed closure, normal cleanup removes the owned auth symlink and
+temporary directory. It never deletes or overwrites the operator's original
+login. Unexpected replacement of the symlink is different: it might contain
+rotated auth state. Humanish preserves that private file with mode 0600 inside a
+0700 task home, removes other scratch/evidence, refuses the report, and returns
+`codex_cleanup_failed`. It does not copy the replacement into the original
+login, which could overwrite a newer concurrent login.
+
+Local recovery markers live under
+`$XDG_CACHE_HOME/humanish/codex-analysis-recovery/`, or
+`~/.cache/humanish/codex-analysis-recovery/`. A marker contains only the generated
+task directory name and fixed file names. Find that same directory under the
+system temporary directory (`$TMPDIR` when configured); retained login state is
+inside `home/auth.json`. Do not discard a retained replacement before recovering
+the login. Run `codex login` before retrying if the persistent login is no longer
+usable. Actual private paths and credentials are never included in an analysis
+artifact. An unconfirmed-process marker instead means the private directory is
+retained until the process lifecycle can be inspected safely.
+
+Qualification used short, existing-login calls; it did not force token refresh.
+The available Codex file-store source writes through the auth path, but matching
+binary refresh behavior and concurrency with unrelated Codex applications are
+not established by that proof. Recovery deliberately fails closed if storage
+behaves differently. Keychain/other-platform support and whole-process-tree
+leases require their own qualification.

package/docs/contracts/run-bundle.md

@@ -154,14 +154,17 @@ different facts separate:
   it did not: a `mobile` (414) and a `small-mobile` (360) seat both render at 500 and are
   indistinguishable by rendered width;
 - `browserWindow`: measured browser bounds after the window-fill attempt; physical X client
-  bounds (`source: xdotool`) take precedence over page-reported outer bounds (`source: cdp`),
-  which can reflect mobile emulation;
+  bounds (`source: xwininfo`) take precedence over page-reported outer bounds (`source: cdp`),
+  which can reflect mobile emulation. Historical `source: xdotool` bundles remain readable;
+  older xdotool versions can double-count decorations in reported coordinates;
 - `viewport`: the page's CSS layout viewport and device-pixel ratio measured through CDP on
   Chromium-family hosted browsers.
 
 Before participant actions, hosted computer-use lanes check measured X bounds against every
-edge of the captured desktop. If a browser is clipped, one bounded move-and-fit correction
-accounts for the window manager's client origin. A window that remains clipped, or whose repair
+edge of the captured desktop. If a browser is clipped, a bounded move-and-fit correction
+remeasures the client origin after each of up to two resize attempts, preserving browser
+controls when they fit. A fullscreen fallback remains for minimum-width windows that cannot
+fit a narrow desktop. A window that remains clipped, or whose repair
 cannot be verified, ends the lane before participant actions. A fully contained smaller window
 can run. Missing X measurements are explicitly unverified; an emulated CSS viewport cannot
 establish physical containment. Final capture observes geometry without resizing the app.

package/docs/contracts/schemas.md

@@ -3,7 +3,7 @@
 Date: 2026-06-02 (current-state note updated 2026-07-14)
 
 Status: reference map for the major contracts shipped through source version
-`0.96.0`; it is not an exhaustive inventory of command/result envelopes. Exported types,
+`0.97.0`; it is not an exhaustive inventory of command/result envelopes. Exported types,
 schema constants, parsers, and validators in `src/` are authoritative. Rows
 marked "reserved" name layering intent only — no code emits or validates them
 yet. Do not emit a reserved schema.

package/docs/contracts/study-analysis.md

@@ -22,10 +22,10 @@ not a participant study. Here, `analyze --dry-run` means checking an existing
 study's input and admission estimate without credentials, a provider request,
 or a new analysis artifact.
 
-The default model is `gpt-6-astra`, with high reasoning effort. A request sends selected retained text and
+The default provider is `openai`; its default model is `gpt-6-astra`, with high reasoning effort. A request sends selected retained text and
 captures to OpenAI, without tools, redirects, provider-side response storage, or
 automatic retries. `--question` adds a reviewer question; it never changes the
-participant assignment. `--max-cost` is required, including for dry-run
+participant assignment. For OpenAI API analysis, `--max-cost` is required, including for dry-run
 admission. It bounds a conservative estimate, not an exact provider bill.
 `--timeout-ms` and `--max-output-tokens` bound the request. An exceeded admission
 estimate retains valid findings and usage but returns a partial result and a
@@ -48,6 +48,48 @@ success. Findings keep reported concerns and observed recovery distinct across
 participants. Other supported models can be selected explicitly, but evidence
 reference validation does not certify their interpretation of small visual details.
 
+## Explicit Codex account analysis
+
+An existing completed recording can use a separate restricted Codex analyst:
+
+```bash
+humanish analyze --run latest --provider codex --dry-run --json
+humanish analyze --run latest --provider codex --json
+```
+
+This branch is qualified on Linux x64 with Codex CLI `0.154.0`, a file-backed
+ChatGPT account login, and `gpt-6-astra` with low reasoning effort. The participant conversation
+is never reused. Selected text and screenshots still go to remote inference;
+this is account authentication, not local inference. No API-key, alternate model
+or configured-provider fallback occurs. Model access and account allowance are
+not established by installation or login alone. Keychain-only login, other
+platforms and CLI versions are refused before a turn; they are not silently
+converted to API authentication.
+
+Omit `--max-cost` and `--max-output-tokens` for Codex. Numeric declarations are
+rejected because this transport does not enforce them. `maxCostUsd` and
+`maxOutputTokens` are stored as null. The existing evidence bounds, one analyst
+turn, bounded response bytes and whole-operation timeout still apply. One turn
+is not a claim of one upstream billed request; account limits apply. Reported
+tokens remain inspectable, but dollar estimates, admission dollars and rate dates
+remain null. Interrupted token observations remain explicitly incomplete.
+
+The dry-run validates only local evidence and configuration. It does not check
+the CLI, login, model access or quota and does not start a provider request.
+`doctor --lab <lab>` checks the selected analyst setup without a model call.
+Failures leave the recording available; inspect `analyze show` and the attempt's
+accounting before an explicit `analyze --provider codex --rerun`.
+
+The persisted identity is the required qualified execution profile: transport,
+authentication and billing class, requested and required resolved model, effort,
+tool-policy revision and CLI version. The launcher must confirm it before the
+turn. A failed pre-dispatch attempt does not prove the CLI or model was observed.
+These fields participate in the configuration digest, preventing reuse across
+providers or changed execution policies. Historical API configurations, hashes
+and corrections are read without inserting new defaults.
+
+## Evidence interpretation
+
 Analysis distinguishes participant actions from harness setup and accounting.
 Runtime credentials or model usage do not establish that a participant made an
 external call while performing their task. Observations with an action basis

package/docs/goals/current.md

@@ -1,9 +1,9 @@
 # Current Goals
 
-Status date: 2026-09-21. Release baseline: `0.96.0`.
+Status date: 2026-09-23. Release baseline: `0.97.0`.
 
 This page guides work on current merged source. Published behavior is described
-in the [release notes](../release/0.96.0-real-email-receiving.md).
+in the [release notes](../release/0.97.0-codex-account-analysis.md).
 The [September 9 history](https://github.com/danielgwilson/humanish/blob/main/docs/goals/current-history-2026-09-09.md)
 preserves the former status log; its queues do not supersede this page.
 
@@ -88,7 +88,7 @@ requires decision-equivalent retained evidence and a real deletion branch.
 No first-party deletion branch has met that gate. Public demonstrations do not
 substitute for it.
 
-## Current Program Truth (source `0.96.0`)
+## Current Program Truth (source `0.97.0`)
 
 | Surface | Available in merged source | Remaining boundary |
 | --- | --- | --- |
@@ -99,7 +99,7 @@ substitute for it.
 | Shared state | Sequential and concurrent single-origin shared-world studies with retained evidence | Multi-origin implementation remains gated; concurrent state change does not establish per-action causation |
 | Observer | Live/recorded views, shared grid and participant playback, participant assignments, action-specific links, saved moments, zoom, comparison and phone-width review | Sparse captures cannot prove every action's effect; visual comparison alone is not a controlled experiment |
 | Review and feedback | Verification grades, feedback drafts, portable HTML, redacted bundle derivatives and computer-use completion-source labels | Sharing requires the appropriate grade; participant reports and condition matches still need task adjudication |
-| Study findings | Default post-run analysis on supported live routes with a separate disclosed $3 admission estimate limit and opt-out; explicit `analyze`, fairer evidence selection, concern review and versioned findings with exact source links | Model interpretation needs review; bounded selection and source truncation limit coverage; opening Observer never dispatches analysis |
+| Study findings | Default post-run analysis on supported live routes with a separate disclosed $3 admission estimate limit and opt-out; explicit `analyze`, fairer evidence selection, concern review and versioned findings with exact source links; explicit restricted Codex account analysis on the qualified Linux profile | Account dollars/output-token caps are unavailable; Mac/keychain/other CLI profiles are unqualified. Model interpretation needs review; selection limits coverage; opening Observer never dispatches analysis |
 | TUI and serving | Detached starts, run stopping, reclamation, Observer attachment, loopback serving, run library and AgentMail setup, authentication and lab configuration | Stopping a process does not itself prove sandbox cleanup; TUI views over CLI `stats`/`export` remain follow-ups |
 | Off-app communication | Recipient-scoped local capture and fresh real AgentMail receiving, supported inline raster images, bounded collection and host-owned recovery | Real mail uses isolated participant surfaces and remains local-only for publication. Hosted mail/model processing, bounded fidelity and interrupted-run recovery are explicit; local-agent, borrowed inboxes and SMS are unsupported |
 | Mobile and media | Hosted viewport/emulation, desktop geometry checks, bounded dwell and declared camera feed; a synthetic video-only call with separate hosted peers is proven | Audio, TURN, provider-specific rooms, physical-device and touch fidelity remain unproven; unsupported media declarations are rejected |

package/docs/product/automatic-analysis.md

@@ -22,7 +22,7 @@ review:
 
 Omitting `review.analysis` uses these defaults. Set `review.analysis: false` to
 run participants without the additional analysis request. An explicit analysis
-mapping requires `maxCostUsd`. This limits an admission estimate, not the
+mapping using the default OpenAI API provider requires `maxCostUsd`. This limits an admission estimate, not the
 provider's final bill, and is separate from participant spending limits. Analysis
 can decline a large study before dispatch when its conservative estimate exceeds
 that limit. Use `analyze --dry-run --max-cost <usd>` on retained evidence to inspect
@@ -37,6 +37,27 @@ its existing authentication boundary. Review the separate analysis budget before
 zero-dollar cap does not cap post-run analysis. The bundled first-contact
 zero-spend product fixture explicitly disables analysis.
 
+To explicitly use your Codex ChatGPT account for the separate analyst:
+
+```yaml
+review:
+  analysis:
+    provider: codex
+    model: gpt-6-astra
+    timeoutMs: 600000
+```
+
+This requires Linux x64, qualified Codex CLI `0.154.0`, and a file-backed ChatGPT account login; the analyst
+uses low reasoning effort and remote inference. Dollar cost and a provider
+enforced output-token ceiling are unknown, so omit `maxCostUsd` and
+`maxOutputTokens`. Numeric values are rejected before participant resources are
+allocated. There is no API fallback. Missing or unsupported account setup leaves
+an explicit failed analysis state and the original recording intact. Use
+`humanish doctor --lab <lab>` for setup checks; account allowance and model access
+remain untested until a request. An omitted provider still means OpenAI, including
+hosted studies whose participant uses a local Codex or Claude login. This setting
+does not enable managed local desktops.
+
 The same configuration works through `humanish run <lab>`, `lab run <lab>`,
 `watch <lab>`, and TUI live starts. Direct library calls to the five recording
 producers honor it too. Supported routes are computer-use, scripted-browser,
@@ -53,7 +74,7 @@ Default analysis also skips recordings containing only setup or failure records
 with no retained participant activity. A desktop startup failure does not start
 an analysis request. The original failure remains visible.
 
-CLI live starts disclose the separate admission estimate limit before execution.
+CLI live starts disclose the selected analyst and its separate admission estimate limit or unknown account dollars before execution.
 `humanish lab preflight <lab> --json` and the TUI lab screen also expose the
 resolved budget without dispatching analysis. Library callers can inspect
 `resolveAutomaticAnalysis` or `automaticAnalysisBudget` before running.
@@ -64,7 +85,7 @@ existing job and does not start another request. Concurrent or repeated automati
 invocations cannot silently retry a paid attempt. If a process disappears while
 an attempt is in flight, its state can be unknown rather than falsely complete.
 Use manual `humanish analyze --run <exact-run-id> --max-cost 3` for an intentional
-follow-up after inspecting the existing attempt and its accounting.
+follow-up after inspecting the existing attempt and its accounting. For the account branch, use `humanish analyze --run <exact-run-id> --provider codex --rerun` without a dollar limit.
 
 Stopping participant execution does not start a fresh automatic analysis. A
 recorded harness cancellation is skipped; ordinary time limits and participant

package/docs/ramp/README.md

@@ -2,7 +2,7 @@
 
 Status: public-safe contributor and agent ramp.
 
-Package/source version in this tree: `0.96.0` (2026-09-21). The Observer is phone-usable as a stated requirement (observer/AGENTS.md); interactive primitives start from Base UI. The Observer renderer is the observer/ workspace artifact only; the legacy string-concat renderer was deleted at cutover (#426), and rollback is a version pin to 0.42.0. The containment boundary introduced in
+Package/source version in this tree: `0.97.0` (2026-09-23). The Observer is phone-usable as a stated requirement (observer/AGENTS.md); interactive primitives start from Base UI. The Observer renderer is the observer/ workspace artifact only; the legacy string-concat renderer was deleted at cutover (#426), and rollback is a version pin to 0.42.0. The containment boundary introduced in
 `0.15.1` remains in force: managed run and output paths bind to validated
 physical filesystem identities, and stored provider IDs are evidence, not
 cleanup authority. The bundled OSS meta-lab is dry-run only until
@@ -47,6 +47,16 @@ If a change does not improve one of those loops, it probably belongs elsewhere.
 
 ## Current State
 
+The [0.97.0 release note](../release/0.97.0-codex-account-analysis.md) describes
+explicit Codex account analysis on a qualified Linux CLI/login profile, with
+separate analyst authority, evidence-linked reports and unknown-dollar accounting.
+Existing API defaults remain unchanged; managed local desktops and Mac account
+analysis are not qualified by this release.
+
+The [0.96.1 release note](../release/0.96.1-browser-navigation.md) describes
+accurate physical browser measurements and bounded fitting that preserves normal
+browser controls when they fit. Narrow screens retain the fullscreen fallback.
+
 The [0.96.0 release note](../release/0.96.0-real-email-receiving.md) describes
 fresh per-participant AgentMail inboxes, isolated desktop mail views, host-owned
 cleanup/recovery, local-only evidence publication, and authentication/configuration

package/docs/release/0.96.1-browser-navigation.md

@@ -0,0 +1,22 @@
+# 0.96.1 — Preserve browser navigation
+
+Hosted browser studies now measure physical client bounds with `xwininfo`.
+The older `xdotool` build on hosted desktops can count window decorations twice,
+incorrectly reporting that a visible browser extends beyond the captured screen.
+That false reading could trigger fullscreen, hiding the tabs and address bar
+participants use to move between an application and their study inbox.
+
+The fitting step now remeasures the actual client origin after resizing and
+allows a second bounded adjustment when the window manager restores decorations.
+Normal browser controls remain visible when they fit. Narrow desktops retain
+the fullscreen fallback when a minimum-width browser cannot otherwise fit.
+
+New recordings identify the physical measurement as `source: xwininfo`.
+Historical `xdotool` and `cdp` geometry remains readable. Missing physical reads
+remain unverified; an emulated CSS viewport cannot establish screen containment.
+Final geometry capture still observes without moving or resizing the browser.
+
+Regression coverage includes a sanitized hosted-desktop measurement, ambiguous
+or missing geometry, decoration changes during resizing, narrow-screen fallback,
+and saved-run compatibility. This does not change inbox delivery or participant
+instructions.

package/docs/release/0.97.0-codex-account-analysis.md

@@ -0,0 +1,45 @@
+# 0.97.0 — Codex account reports on Linux
+
+Saved studies can use an existing Codex ChatGPT login for their separate
+findings report. Select it explicitly:
+
+```bash
+humanish analyze --run latest --provider codex --dry-run
+humanish analyze --run latest --provider codex
+```
+
+For an automatic report after a live study, set:
+
+```yaml
+review:
+  analysis:
+    provider: codex
+```
+
+The initial qualification is Linux x64, Codex CLI 0.154.0, a file-backed
+ChatGPT login, and `gpt-6-astra` with low reasoning effort. Other platforms,
+CLI versions and keychain-only logins are refused. Selected evidence still goes
+to remote inference. Model access and account allowance depend on the account.
+
+Account dollars and the generated-token ceiling are unknown; numeric dollar or
+output-token caps are rejected. Time and byte limits still apply. Token counts
+are retained when available, and interrupted usage remains incomplete. Existing
+OpenAI API analysis defaults and participant setup requirements are unchanged.
+
+The analyst has its own conversation and restricted tool configuration.
+Evidence admission, exact source references, secret scrubbing, immutable attempt
+accounting and source-change checks apply to both providers. Cancellation
+preserves recordings and earlier valid findings. Unconfirmed process cleanup or
+unexpected replacement credentials produce a failed attempt and private recovery
+guidance. Historical reports remain readable as execution profiles evolve.
+
+Doctor checks the selected analyst's setup without a model turn. Dry-run checks
+local evidence and configuration only; it does not test CLI/login/model access.
+The CLI, TUI and Observer disclose account limits consistently. This release
+does not introduce managed local desktops or qualify Mac account analysis.
+
+The [qualification receipt](https://github.com/danielgwilson/humanish/blob/46330116726f74080fa18947c36da4fb4b333805/docs/goals/computer-use-actor/receipts/codex-account-analysis-2026-09-23.md)
+records real screenshot analysis, cache reuse, cancellation, automatic reports
+after desktop cleanup, desktop/phone evidence review, failures and proof limits.
+See [configuration](../product/automatic-analysis.md) and the
+[restricted launcher contract](../architecture/restricted-codex-analysis.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.96.0",
+  "version": "0.97.0",
   "description": "Open-source-safe CLI for persona simulation, observer review, and public-safe feedback drafts.",
   "author": "Daniel G Wilson <daniel@danielgwilson.com>",
   "keywords": [

package/skills/humanish/SKILL.md

@@ -93,6 +93,25 @@ exact returned path, not a basename that could resolve to another manifest.
    - keep `.env.example` commit-safe and value-free;
    - never commit generated run bundles.
 
+## Choosing a findings analyst
+
+Analysis is separate from the participant. Existing manual and automatic defaults
+use the OpenAI API with its own admission budget; a local-agent participant does
+not change that default. To use the restricted Codex ChatGPT account analyst,
+set `review.analysis.provider: codex` or pass `analyze --provider codex` on a
+completed recording. This uses remote inference and the qualified CLI/login,
+not local inference or the participant's existing conversation. See
+[the analysis contract](../../docs/contracts/study-analysis.md) for the current
+CLI/model qualification and setup limits.
+
+Do not pass numeric `maxCostUsd`/`maxOutputTokens` or their CLI flags to the
+account branch. It cannot enforce those ceilings and rejects them. Account dollar
+cost remains unknown even when token usage is reported. There is no fallback to
+an API key or another provider. `analyze --dry-run --provider codex` validates
+local evidence/configuration only; `doctor --lab` checks setup without a model
+request. Inspect a failed attempt before explicitly retrying `--provider codex
+--rerun`. Opening Observer never starts analysis.
+
 ## Format Stack
 
 When creating or editing Humanish files: