humanish 0.99.1 → 0.100.1

package/docs/architecture/local-browser-runtime.md

@@ -18,8 +18,22 @@ and account restrictions. Docker access is an administrative capability.
 Humanish does not install Docker on Linux or change host permissions. On Mac,
 setup installs Docker only inside the dedicated Lima host.
 
-Start your app on loopback, then save a lab such as
-`.humanish/labs/local-browser.yaml`:
+Configure the starter while initializing the project, then start your app on
+the same loopback URL:
+
+```sh
+npx humanish init --yes \
+  --local-browser http://127.0.0.1:3000 \
+  --local-mission "Create a note and explain anything confusing about saving it"
+npx humanish doctor --lab local-browser
+npx humanish lab run local-browser
+```
+
+`init` also writes `humanish/labs/local-browser.yaml` with safe defaults when
+the two options are omitted. The options provide the normal setup path for the
+app URL and mission on first setup. If the file already exists, `init` preserves
+it and warns that these options were skipped; edit the existing manifest to
+change its URL or mission. The resulting lab has this shape:
 
 ```yaml
 schema: humanish.lab.v2
@@ -42,10 +56,9 @@ execution:
 ```
 
 ```sh
-npx humanish init --yes
 npx humanish runtime status --json
-npx humanish doctor --lab .humanish/labs/local-browser.yaml --json
-npx humanish lab run .humanish/labs/local-browser.yaml
+npx humanish doctor --lab local-browser --json
+npx humanish lab run local-browser
 ```
 
 The first live run downloads the pinned runtime archive (about 569 MiB on x64 or
@@ -68,6 +81,13 @@ For API billing and its supported caps, use `type: openai-computer-use`, remove
 default. Neither path silently falls back to another provider or hosted desktop.
 Existing labs without `execution.target: local` retain their previous behavior.
 
+Before handing the desktop to the participant, the guest navigates to the
+selected app and waits up to 30 seconds for the initial document's
+`DOMContentLoaded` event, then allows a bounded paint. It does not wait for app
+data, images or network idle: the app's own loading screen remains observable.
+Navigation failures and timeouts fail startup and release the owned desktop.
+Later participant actions and observations do not use this startup wait.
+
 ## Current limits
 
 - Linux x64 or M3-or-newer Mac with native ARM64 Node and Lima. The installed

package/docs/architecture/restricted-codex-analysis.md

@@ -36,11 +36,20 @@ host RPCs and asynchronous question messages before accepting any report. The
 actual notification/denial captures and provenance are in
 [`tests/fixtures/restricted-codex`](https://github.com/danielgwilson/humanish/blob/46330116726f74080fa18947c36da4fb4b333805/tests/fixtures/restricted-codex/README.md).
 
-Each request owns a separate child process, temporary home and fresh thread;
-participant, analyst and readiness requests may run concurrently. An unresolved
-child process blocks new requests until its exit is confirmed. Each thread receives
-one turn. Evidence is not silently
-downselected: at most 128 images, 20 MiB decoded image data, and 32 MiB serialized
+Each analyst or readiness request owns a separate child process, temporary home
+and fresh thread. Participants use the same launcher with one process and thread
+for their entire interaction and closing feedback; successive turns append the
+current screenshot, context and action acknowledgments to that conversation.
+Codex manages context compaction. Humanish does not replace it with a rolling
+history window or restart a failed conversation without its memory. Participant
+threads never share state with each other or the analyst.
+
+An unresolved child process blocks new sessions until its exit is confirmed.
+Limits and deadlines apply to each request, including startup on the first turn.
+Thread-cumulative token usage is converted to per-turn usage before accounting.
+The qualified CLI omits compaction requests from its thread totals. A turn that
+compacts therefore retains known counts but records incomplete usage.
+Evidence is not silently downselected: at most 128 images, 20 MiB decoded image data, and 32 MiB serialized
 request data are admitted. Generated report text is limited to 2 MiB. Raw input
 notifications echo image data URLs, so their frame budget is the larger of 2 MiB
 or the admitted serialized packet plus 1 MiB; total stdout is bounded separately

package/docs/contracts/schemas.md

@@ -3,7 +3,7 @@
 Date: 2026-06-02 (current-state note updated 2026-07-14)
 
 Status: reference map for the major contracts shipped through source version
-`0.99.1`; it is not an exhaustive inventory of command/result envelopes. Exported types,
+`0.100.1`; it is not an exhaustive inventory of command/result envelopes. Exported types,
 schema constants, parsers, and validators in `src/` are authoritative. Rows
 marked "reserved" name layering intent only — no code emits or validates them
 yet. Do not emit a reserved schema.
@@ -768,6 +768,13 @@ scenario:
 
 ## Actor Trace
 
+Failed account participant requests may include an optional `failurePhase` in
+`providerRequests`, identifying startup, the named Codex setup RPC, `turn/start`,
+`response`, or cleanup. It is a finite local classification, never raw provider
+text. Older receipts without it remain valid. The phase does not replace the
+separate dispatch, usage, or cleanup evidence, and does not establish the cause
+of a timeout. Participant outcome text includes the phase when available.
+
 Actors execute or simulate the trial. Actor evidence is the provider-neutral
 `humanish.actor-trace.v1` (`src/actor-contract.ts`): Codex app-server items,
 Claude Agent SDK blocks, pi events, computer-use cycles, scripted browser

package/docs/goals/current.md

@@ -1,9 +1,9 @@
 # Current Goals
 
-Status date: 2026-09-24. Release baseline: `0.99.1`.
+Status date: 2026-09-25. Release baseline: `0.100.1`.
 
 This page guides work on current merged source. Published behavior is described
-in the [release notes](../release/0.99.1-action-recovery.md).
+in the [release notes](../release/0.100.1-participant-continuity.md).
 The [September 9 history](https://github.com/danielgwilson/humanish/blob/main/docs/goals/current-history-2026-09-09.md)
 preserves the former status log; its queues do not supersede this page.
 
@@ -88,7 +88,7 @@ requires decision-equivalent retained evidence and a real deletion branch.
 No first-party deletion branch has met that gate. Public demonstrations do not
 substitute for it.
 
-## Current Program Truth (source `0.99.1`)
+## Current Program Truth (source `0.100.1`)
 
 | Surface | Available in merged source | Remaining boundary |
 | --- | --- | --- |

package/docs/ramp/README.md

@@ -2,7 +2,7 @@
 
 Status: public-safe contributor and agent ramp.
 
-Package/source version in this tree: `0.99.1` (2026-09-24). The Observer is phone-usable as a stated requirement (observer/AGENTS.md); interactive primitives start from Base UI. The Observer renderer is the observer/ workspace artifact only; the legacy string-concat renderer was deleted at cutover (#426), and rollback is a version pin to 0.42.0. The containment boundary introduced in
+Package/source version in this tree: `0.100.1` (2026-09-25). The Observer is phone-usable as a stated requirement (observer/AGENTS.md); interactive primitives start from Base UI. The Observer renderer is the observer/ workspace artifact only; the legacy string-concat renderer was deleted at cutover (#426), and rollback is a version pin to 0.42.0. The containment boundary introduced in
 `0.15.1` remains in force: managed run and output paths bind to validated
 physical filesystem identities, and stored provider IDs are evidence, not
 cleanup authority. The bundled OSS meta-lab is dry-run only until
@@ -54,6 +54,12 @@ If a change does not improve one of those loops, it probably belongs elsewhere.
 
 ## Current State
 
+The [0.100.1 release note](../release/0.100.1-participant-continuity.md) describes
+continuing local participant conversations and per-turn usage accounting.
+
+The [0.100.0 release note](../release/0.100.0-local-setup.md) describes local
+browser setup discovery, initial navigation readiness and Codex failure stages.
+
 The [0.99.1 release note](../release/0.99.1-action-recovery.md) describes
 participant recovery from browser actions rejected before dispatch.
 

package/docs/release/0.100.0-local-setup.md

@@ -0,0 +1,31 @@
+# 0.100.0 — Local study setup and startup reliability
+
+Initialize a local browser study for your app without writing its lab manifest:
+
+```sh
+humanish init --yes --local-browser http://127.0.0.1:3000 \
+  --local-mission "Create a note and find it again"
+humanish doctor --lab local-browser
+humanish run local-browser
+```
+
+The starter uses local Firecracker browsers and the supported Codex account
+login. Model inference remains remote and consumes account quota; E2B and OpenAI
+API keys are unnecessary for this route. Linux needs local Docker/KVM/TUN;
+supported Apple Silicon Macs use Lima. Init and the TUI explain prerequisites
+and reuse the CLI's readiness checks. Existing lab files are preserved; if the
+local starter already exists, edit its URL and mission in
+`humanish/labs/local-browser.yaml` instead of rerunning the init flags.
+The free preview and hosted starter remain available. Local dry runs work without
+starting a desktop or requesting a model turn.
+
+The first local participant capture now follows the target document's
+DOMContentLoaded event and a paint. Previously a fixed 500 ms wait could expose
+the runtime's starter page. Navigation is bounded, supports redirects, and
+reports startup failures; it does not wait for all app data or subsequent loads.
+Updated x64 and ARM64 runtime images carry the initial-navigation change.
+
+Failed account participant requests retain their finite execution stage, such
+as `thread/start`, in the recording and outcome text. Older recordings remain
+readable. This adds diagnostic evidence without changing retry or deadline
+behavior; it does not claim the cause of a past timeout is known.

package/docs/release/0.100.1-participant-continuity.md

@@ -0,0 +1,20 @@
+# 0.100.1 — Continuing participant conversations
+
+Local Codex participants now keep one conversation for their entire study,
+including closing feedback. Previously, each screenshot started a new thread
+with only eight turns of summarized history. Earlier observations, actions and
+participant context now remain in the Codex conversation, with Codex managing
+context compaction.
+
+Each participant has its own process and thread. The existing browser executor,
+recordings and separate post-run analyst are preserved. Request deadlines still
+apply per turn; thread-cumulative token usage is converted to per-turn receipts.
+Codex omits compaction requests from its thread totals, so turns that compact
+retain known counts and report incomplete usage.
+An interrupted or failed participant closes its session rather than silently
+restarting with empty memory. Dollar usage remains unknown for account-backed
+inference.
+
+Existing E2B/API and hosted Codex participants already continued their
+conversations and retain those paths. Older Observer recordings remain readable.
+No setup changes or Firecracker image downloads are required for this fix.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.99.1",
+  "version": "0.100.1",
   "description": "Open-source-safe CLI for persona simulation, observer review, and public-safe feedback drafts.",
   "author": "Daniel G Wilson <daniel@danielgwilson.com>",
   "keywords": [