humanish 0.117.0 → 0.119.0

package/CHANGELOG.md

@@ -8,6 +8,48 @@ The Unreleased section holds the full notes for the next version until it is tag
 
 ## Unreleased
 
+## 0.119.0: Participants arrive over time, one analysis past 16 participants in cohorts, late starts skipped past the budget, study warnings redacted (2026-10-09)
+
+humanish 0.119.0 lets a computer-use or shared-world study start its participants over time, and
+analyses a run of 17 to 100 participants in one report. `participants[].startAfterMs` starts a
+participant up to 24 hours after the run starts its participants, and a `count` group's
+`startEveryMs` spreads its members. Each participant's desktop is created at its start, the plan and
+`study check` print the first and last start and the most participants at once, and run.json records
+each participant's `arrival`. A participant whose start comes after the study crossed
+`caps.maxTotalUsd` is skipped before its desktop is created. The analysis of more than 16
+participants splits them into cohorts of at most 16, analyses each cohort with its own request, and
+merges the cohort reports into the run's one report with one more request; 0.118.0 skipped the
+automatic analysis of such a run. Admission, the plan's analysis line, `study check` and the
+`analyze --dry-run` worst case count every request, and `analyze --json` gives their number as
+`admission.requests`. At the default $3 cap the analysis of 17 or more participants is refused even
+with no evidence, so it needs a higher `review.analysis.maxCostUsd`. A provisioned shared world gets
+an app sandbox that lives until the last start or wave can end. A study warning recorded in the
+run's bundle is redacted as a run failure is, so a hosted study whose participant instruction names
+a sandbox URL other than the subject's verifies `share_ready` again, as on 0.111.2.
+
+[Release notes](https://github.com/danielgwilson/humanish/releases/tag/v0.119.0)
+
+## 0.118.0: Up to 100 participants, E2B concurrent sandboxes, study check plans like run, analysis range (2026-10-09)
+
+humanish 0.118.0 lets a computer-use study have up to 100 participants, up from 16, holds a
+shared-world study to the same 100, and runs them within the number of sandboxes the E2B plan runs
+at once. The new setting `HUMANISH_E2B_MAX_CONCURRENT_SANDBOXES` gives that number (20 when unset,
+E2B Hobby's limit; Pro runs 100). A study with more participants than that runs them in waves, an
+`execution.concurrency` above it is refused before any sandbox is created, and `doctor` shows it. A
+live run of more than 16 participants records its automatic analysis as skipped with
+`AUTOMATIC_ANALYSIS_PARTICIPANT_LIMIT`, because one analysis reads at most 16 participants. `study
+check` now plans a study the way `humanish run` does and fails a study the run refuses, and a
+shared-world or scripted clone study whose sandbox deadline passes the ceiling is refused at plan
+time. The analysis line that `run`, `study check` and the TUI print ends its expected range at the
+largest run admission admits (`$0.75 to $2.83` for one participant at the default $3 cap, where it
+read `$3.79`) and states the rule as admission applies it. An in-process `local-app` run records
+`subject.source: local-app`, a desktop-cli dry run names its product, and `verify` names an unlisted
+folder and the 10,000-entry stop in their own sentences. In `humanish tui`, the key legend says what
+Enter and Esc do while an action is armed, a study's median cost includes its analyses, and Esc
+after entering a key returns to the screen the keys were opened from.
+
+[Release notes](https://github.com/danielgwilson/humanish/releases/tag/v0.118.0)
+
 ## 0.117.0: Long participant waits, OpenAI wait length, serve.build fails fast, TUI confirmations (2026-10-09)
 
 humanish 0.117.0 lets a participant wait through a long hosted study, gives an OpenAI

package/dist/analysis/admission.d.ts

@@ -1,7 +1,12 @@
 import type { ModelRate } from "../run/pricing.js";
-/** Admission compares the expected cost times this margin with the cap. */
-export declare const ADMISSION_MARGIN = 1.1;
-export interface AnalysisRequestSize {
+/**
+ * When admission refuses a request, in words, for the cap as the sentence names it: `$3`, or `this`
+ * in the help of the option that sets it. Admission compares the smaller of the worst case and the
+ * expected cost with the margin, so it refuses only when both are over the cap. Every text that
+ * states the rule reads it here.
+ */
+export declare function admissionRule(cap: string): string;
+interface AnalysisRequestSize {
     /** UTF-8 bytes of the instructions, the evidence packet and the result schema. */
     textBytes: number;
     imageTokens: number;
@@ -9,6 +14,14 @@ export interface AnalysisRequestSize {
     /** The request's output limit. The worst case spends all of it. */
     outputAllowance: number;
 }
+/**
+ * The requests of one analysis: one per cohort and, for more than one cohort, a merge request.
+ * `mergeTextBytes` are the merge request's instructions, schema and packet without the reports.
+ */
+export interface AnalysisRequests {
+    cohorts: readonly AnalysisRequestSize[];
+    mergeTextBytes: number;
+}
 export interface AnalysisCostEstimate {
     inputTokens: number;
     expectedOutputTokens: number;
@@ -17,7 +30,12 @@ export interface AnalysisCostEstimate {
     /** The expected cost with the margin, never above the worst case: what admission compares. */
     admittedCostUsd: number;
 }
-export declare function estimateAnalysisCost(rate: ModelRate, size: AnalysisRequestSize): AnalysisCostEstimate;
+/**
+ * Every request of one analysis, summed. A merge request reads each cohort's report, priced at
+ * that request's whole output allowance since the report and its reasoning share it, and is
+ * expected to write what one request covering every participant would.
+ */
+export declare function estimateAnalysisCost(rate: ModelRate, requests: AnalysisRequests): AnalysisCostEstimate;
 /** The numbers a cost refusal reports. */
 export interface RefusedAnalysisCost {
     expectedCostUsd: number;
@@ -45,3 +63,4 @@ export declare function refusedCost(admission: {
     worstCaseCostUsd: number | null;
     maxCostUsd: number | null;
 }): RefusedAnalysisCost | undefined;
+export {};

package/dist/analysis/admission.js

@@ -1,5 +1,5 @@
-// The admission cost model for one study analysis request: the expected cost, the worst case, the
-// figure admission compares with the cap, and the words and command a cost refusal gives.
+// The admission cost model for one study analysis: the expected cost, the worst case, the figure
+// admission compares with the cap, and the words and command a cost refusal gives.
 /**
  * UTF-8 bytes per input token for the instructions, evidence packet and schema. On 148 billed
  * gpt-6-astra analyses the evidence packet ran 3.1 to 3.3 bytes per token and the instructions
@@ -16,7 +16,17 @@ const FRAMING_TOKENS = 2048;
 const EXPECTED_OUTPUT_TOKENS = 12_000;
 const EXPECTED_OUTPUT_TOKENS_PER_PARTICIPANT = 1_000;
 /** Admission compares the expected cost times this margin with the cap. */
-export const ADMISSION_MARGIN = 1.1;
+const ADMISSION_MARGIN = 1.1;
+const MARGIN_PERCENT = Math.round((ADMISSION_MARGIN - 1) * 100);
+/**
+ * When admission refuses a request, in words, for the cap as the sentence names it: `$3`, or `this`
+ * in the help of the option that sets it. Admission compares the smaller of the worst case and the
+ * expected cost with the margin, so it refuses only when both are over the cap. Every text that
+ * states the rule reads it here.
+ */
+export function admissionRule(cap) {
+    return `both its worst case and its expected cost plus a ${MARGIN_PERCENT}% margin are over ${cap}`;
+}
 /** Rounded up to the micro-dollar, so a small positive boundary never rounds into admission. */
 const roundUp = (usd) => Math.ceil(usd * 1e6) / 1e6;
 /** One request's cost. Input is priced at the highest input rate the model bills, cache writes
@@ -27,14 +37,43 @@ function requestCost(rate, inputTokens, outputTokens) {
     return roundUp(inputTokens * inputRate * (long ? rate.longContext.inputMultiplier : 1) +
         outputTokens * rate.outputUsdPerToken * (long ? rate.longContext.outputMultiplier : 1));
 }
-export function estimateAnalysisCost(rate, size) {
-    const inputTokens = Math.ceil(size.textBytes / BYTES_PER_INPUT_TOKEN) + FRAMING_TOKENS + size.imageTokens;
+/** One request's input and costs. `reportTokens` are earlier requests' reports it reads. */
+function estimateRequest(rate, size, reportTokens = 0) {
+    const inputTokens = Math.ceil(size.textBytes / BYTES_PER_INPUT_TOKEN) +
+        FRAMING_TOKENS +
+        size.imageTokens +
+        reportTokens;
     const expectedOutputTokens = Math.min(size.outputAllowance, EXPECTED_OUTPUT_TOKENS + EXPECTED_OUTPUT_TOKENS_PER_PARTICIPANT * size.participants);
-    const expectedCostUsd = requestCost(rate, inputTokens, expectedOutputTokens);
-    const worstCaseCostUsd = requestCost(rate, inputTokens, size.outputAllowance);
     return {
         inputTokens,
         expectedOutputTokens,
+        expectedCostUsd: requestCost(rate, inputTokens, expectedOutputTokens),
+        worstCaseCostUsd: requestCost(rate, inputTokens, size.outputAllowance),
+    };
+}
+/**
+ * Every request of one analysis, summed. A merge request reads each cohort's report, priced at
+ * that request's whole output allowance since the report and its reasoning share it, and is
+ * expected to write what one request covering every participant would.
+ */
+export function estimateAnalysisCost(rate, requests) {
+    const { cohorts } = requests;
+    const estimates = cohorts.map((size) => estimateRequest(rate, size));
+    if (cohorts.length > 1)
+        estimates.push(estimateRequest(rate, {
+            textBytes: requests.mergeTextBytes,
+            imageTokens: 0,
+            participants: cohorts.reduce((total, size) => total + size.participants, 0),
+            outputAllowance: Math.max(...cohorts.map((size) => size.outputAllowance)),
+        }, cohorts.reduce((total, size) => total + size.outputAllowance, 0)));
+    const sum = (key) => estimates.reduce((total, estimate) => total + estimate[key], 0);
+    // Each request's cost is a whole number of micro-dollars, so rounding the sum to the nearest one
+    // only removes the addition's float noise.
+    const expectedCostUsd = Math.round(sum("expectedCostUsd") * 1e6) / 1e6;
+    const worstCaseCostUsd = Math.round(sum("worstCaseCostUsd") * 1e6) / 1e6;
+    return {
+        inputTokens: sum("inputTokens"),
+        expectedOutputTokens: sum("expectedOutputTokens"),
         expectedCostUsd,
         worstCaseCostUsd,
         admittedCostUsd: Math.min(worstCaseCostUsd, roundUp(expectedCostUsd * ADMISSION_MARGIN)),
@@ -47,9 +86,8 @@ export function estimateAnalysisCost(rate, size) {
  * This module keeps only type imports, so the Observer can bundle it.
  */
 export function costRefusal(cost, runFlags, cli) {
-    const margin = Math.round((ADMISSION_MARGIN - 1) * 100);
     return {
-        text: `The expected cost is $${cost.expectedCostUsd.toFixed(2)} and the worst case is $${cost.worstCaseCostUsd.toFixed(2)}. With a ${margin}% margin the expected cost is over the $${cost.maxCostUsd} cap, so no request was sent. To run it, raise the cap:`,
+        text: `The expected cost is $${cost.expectedCostUsd.toFixed(2)} and the worst case is $${cost.worstCaseCostUsd.toFixed(2)}. With a ${MARGIN_PERCENT}% margin the expected cost is over the $${cost.maxCostUsd} cap, so no request was sent. To run it, raise the cap:`,
         command: cli(`analyze ${runFlags} --max-cost ${Math.max(1, Math.ceil(cost.worstCaseCostUsd))}`),
     };
 }

package/dist/analysis/analysis-limits.d.ts

@@ -1,3 +1,35 @@
+/**
+ * What one run's analysis reads. `participants` is the most participants it covers, which is also
+ * the most streams the analysis reads from a run bundle. Each request covers at most
+ * `cohortParticipants` of them, and the counts and byte limits below apply to each request's
+ * packet: a run with more participants is analysed in cohorts, one request each, and one more
+ * request merges their reports. `sourceBytes` bounds the run bundle file.
+ */
+export declare const EVIDENCE_LIMITS: Readonly<{
+    participants: 128;
+    cohortParticipants: 16;
+    evidence: 800;
+    captures: 40;
+    textBytes: number;
+    imageBytes: number;
+    totalImageBytes: number;
+    sourceBytes: number;
+}>;
+/** The most cohorts one analysis sends: every participant it covers, in cohorts at the limit. */
+export declare const MAX_ANALYSIS_COHORTS: number;
+/** How many cohorts this many participants are analysed in. */
+export declare const analysisCohortCount: (participants: number) => number;
+/**
+ * The provider requests an analysis of this many participants sends: one per cohort, and the
+ * merge request when there is more than one cohort.
+ */
+export declare function analysisRequestCount(participants: number): number;
+/**
+ * The cohorts a run's participants are analysed in: one when there are at most
+ * `cohortParticipants`, otherwise the fewest that hold at most that many each. Participants are
+ * dealt in turn, so cohort sizes differ by at most one and each cohort holds a spread of the roster.
+ */
+export declare function analysisCohorts<T>(participants: readonly T[]): T[][];
 /**
  * How much an analysis result may hold, for the fields the Observer checks as well. Characters are
  * counted as `String.length` counts them.

package/dist/analysis/analysis-limits.js

@@ -1,6 +1,44 @@
-// The analysis result's limits and prompt revision boundaries, kept apart from the zod schemas in
-// validation.ts so the Observer can read them: it bundles this module, and zod stays out of its
-// page.
+// The analysis input's and result's limits and prompt revision boundaries, kept apart from the zod
+// schemas in validation.ts so the Observer can read them: it bundles this module, and zod stays out
+// of its page.
+/**
+ * What one run's analysis reads. `participants` is the most participants it covers, which is also
+ * the most streams the analysis reads from a run bundle. Each request covers at most
+ * `cohortParticipants` of them, and the counts and byte limits below apply to each request's
+ * packet: a run with more participants is analysed in cohorts, one request each, and one more
+ * request merges their reports. `sourceBytes` bounds the run bundle file.
+ */
+export const EVIDENCE_LIMITS = Object.freeze({
+    participants: 128,
+    cohortParticipants: 16,
+    evidence: 800,
+    captures: 40,
+    textBytes: 160 * 1024,
+    imageBytes: 8 * 1024 * 1024,
+    totalImageBytes: 20 * 1024 * 1024,
+    sourceBytes: 16 * 1024 * 1024,
+});
+/** The most cohorts one analysis sends: every participant it covers, in cohorts at the limit. */
+export const MAX_ANALYSIS_COHORTS = Math.ceil(EVIDENCE_LIMITS.participants / EVIDENCE_LIMITS.cohortParticipants);
+/** How many cohorts this many participants are analysed in. */
+export const analysisCohortCount = (participants) => Math.max(1, Math.ceil(participants / EVIDENCE_LIMITS.cohortParticipants));
+/**
+ * The provider requests an analysis of this many participants sends: one per cohort, and the
+ * merge request when there is more than one cohort.
+ */
+export function analysisRequestCount(participants) {
+    const cohorts = analysisCohortCount(participants);
+    return cohorts === 1 ? 1 : cohorts + 1;
+}
+/**
+ * The cohorts a run's participants are analysed in: one when there are at most
+ * `cohortParticipants`, otherwise the fewest that hold at most that many each. Participants are
+ * dealt in turn, so cohort sizes differ by at most one and each cohort holds a spread of the roster.
+ */
+export function analysisCohorts(participants) {
+    const count = analysisCohortCount(participants.length);
+    return Array.from({ length: count }, (_, cohort) => participants.filter((_, index) => index % count === cohort));
+}
 /**
  * How much an analysis result may hold, for the fields the Observer checks as well. Characters are
  * counted as `String.length` counts them.

package/dist/analysis/automatic-config.d.ts

@@ -36,14 +36,24 @@ export interface AutomaticAnalysisBudget {
     trigger: "default" | "explicit";
     /** The participants the expected cost range is for. */
     participants?: number;
-    /** The expected cost, from a run that keeps no evidence to one at the evidence limits. */
+    /**
+     * The expected cost of the analysis admission would start, from a run that keeps no evidence to
+     * one that keeps the most evidence admission admits, at most the evidence limits.
+     */
     expectedCostUsd?: {
         low: number;
         high: number;
     };
+    /** In place of the range when admission refuses even a run that keeps no evidence: its cost. */
+    refusedFromUsd?: number;
 }
 /** Metadata only: resolving the future live-run budget never reads keys or dispatches. With a
  * participant count it also gives the expected cost range for that many participants. */
 export declare function automaticAnalysisBudget(raw: unknown, route: StudyRoute, participants?: number): AutomaticAnalysisBudget | undefined;
+/**
+ * An analysis's requests in words, from their count: undefined for one request. The plan's
+ * analysis line and the dry run's worst case both say it.
+ */
+export declare function analysisRequestsText(requests: number): string | undefined;
 export declare function formatAutomaticAnalysisBudget(budget: AutomaticAnalysisBudget): string;
 export {};

package/dist/analysis/automatic-config.js

@@ -1,6 +1,7 @@
 import { CODEX_ANALYSIS_MODEL, codexAnalysisIdentity } from "./codex-config.js";
 import { DEFAULT_ANALYSIS_MAX_OUTPUT_TOKENS, MAX_ANALYSIS_OUTPUT_TOKENS, analysisCostRange, isSupportedAnalysisModel, } from "./execute.js";
-import { ADMISSION_MARGIN } from "./admission.js";
+import { admissionRule } from "./admission.js";
+import { analysisRequestCount, EVIDENCE_LIMITS } from "./analysis-limits.js";
 import { plural } from "../run/text.js";
 import { containsSensitive } from "../evidence/redaction.js";
 export const DEFAULT_ANALYSIS_TIMEOUT_MS = 600_000;
@@ -123,11 +124,9 @@ export function automaticAnalysisBudget(raw, route, participants) {
     if (!resolved.ok || !resolved.config)
         return undefined;
     const { config } = resolved;
-    const range = participants === undefined || config.provider === "codex"
+    const range = participants === undefined
         ? undefined
-        : analysisCostRange(resolved.preferLargerOutput
-            ? { ...config, maxOutputTokens: MAX_ANALYSIS_OUTPUT_TOKENS }
-            : config, participants);
+        : analysisCostRange(config, participants, resolved.preferLargerOutput === true);
     return {
         ...(config.provider === "codex"
             ? { provider: "codex", billing: "account-unknown" }
@@ -135,16 +134,32 @@ export function automaticAnalysisBudget(raw, route, participants) {
         model: config.model,
         maxCostUsd: config.maxCostUsd,
         trigger: raw === undefined ? "default" : "explicit",
-        ...(range === undefined || participants === undefined
-            ? {}
-            : { participants, expectedCostUsd: range }),
+        ...(range === undefined || participants === undefined ? {} : { participants, ...range }),
     };
 }
+/**
+ * An analysis's requests in words, from their count: undefined for one request. The plan's
+ * analysis line and the dry run's worst case both say it.
+ */
+export function analysisRequestsText(requests) {
+    return requests <= 1
+        ? undefined
+        : `${requests - 1} cohort requests of at most ${EVIDENCE_LIMITS.cohortParticipants} participants and one merge request`;
+}
 export function formatAutomaticAnalysisBudget(budget) {
     if (budget.provider === "codex")
         return `After live runs: Codex account analysis · ${budget.model} · separate restricted analyst with remote inference. Account limits apply; dollar cost and output-token ceiling are unknown. Set review.analysis: false to disable.`;
-    const range = budget.expectedCostUsd === undefined || budget.participants === undefined
+    const rule = admissionRule(`$${budget.maxCostUsd}`);
+    // The participants, and the requests that analyse them when there is more than one.
+    const requests = analysisRequestsText(analysisRequestCount(Math.min(budget.participants ?? 0, EVIDENCE_LIMITS.participants)));
+    const who = budget.participants === undefined
+        ? undefined
+        : `${plural(budget.participants, "participant")}${requests === undefined ? "" : ` in ${requests}`}`;
+    const range = budget.expectedCostUsd === undefined || who === undefined
         ? ""
-        : ` · expected $${budget.expectedCostUsd.low.toFixed(2)} to $${budget.expectedCostUsd.high.toFixed(2)} for ${plural(budget.participants, "participant")}, depending on how much evidence the run keeps`;
-    return `After live runs: ${budget.trigger} analysis · ${budget.model}${range} · refused before it starts if the expected cost plus a ${Math.round((ADMISSION_MARGIN - 1) * 100)}% margin is over $${budget.maxCostUsd}; this is not a billing cap. Set review.analysis: false to disable.`;
+        : ` · expected $${budget.expectedCostUsd.low.toFixed(2)} to $${budget.expectedCostUsd.high.toFixed(2)} for ${who}, depending on how much evidence the run keeps`;
+    const refused = budget.refusedFromUsd === undefined || who === undefined
+        ? `refused before it starts if ${rule}`
+        : `refused before it starts for ${who} even with no evidence (expected $${budget.refusedFromUsd.toFixed(2)}), since ${rule}`;
+    return `After live runs: ${budget.trigger} analysis · ${budget.model}${range} · ${refused}; this is not a billing cap. Set review.analysis: false to disable.`;
 }

package/dist/analysis/cohorts.d.ts

@@ -0,0 +1,103 @@
+import { z } from "zod";
+import { type CheckedProviderAnalysis } from "./responses.js";
+import type { AnalysisInput, AnalysisResult } from "./types.js";
+/**
+ * The input each cohort request sends: the input itself when it is one cohort. `includedStreamIds`
+ * keeps the bundle's stream order, the order captureEvidence split the packet by. A cohort's input
+ * is never stored, so it keeps the run's input digest.
+ */
+export declare function cohortInputs(input: AnalysisInput): AnalysisInput[];
+/**
+ * The merge request's packet: the participants, the coverage and each cohort's report. With no
+ * reports it is the part admission prices before any request is sent.
+ */
+export declare function mergePacket(input: AnalysisInput, reports?: readonly AnalysisResult[]): string;
+/** The merge request writes everything but the participant reviews, which the cohorts wrote. */
+export declare const mergeResultJsonSchema: z.core.ZodStandardJSONSchemaPayload<z.ZodObject<{
+    summary: z.ZodString;
+    concernReviews: z.ZodNonOptional<z.ZodOptional<z.ZodArray<z.ZodObject<{
+        claim: z.ZodString;
+        basis: z.ZodEnum<{
+            action: "action";
+            inference: "inference";
+            participant_statement: "participant_statement";
+            visual: "visual";
+        }>;
+        evidenceIds: z.ZodArray<z.ZodString>;
+        limitation: z.ZodString;
+        disposition: z.ZodEnum<{
+            context: "context";
+            finding: "finding";
+            unsupported: "unsupported";
+        }>;
+        findingId: z.ZodNullable<z.ZodString>;
+        reason: z.ZodString;
+    }, z.core.$strict>>>>;
+    limitations: z.ZodArray<z.ZodString>;
+    findings: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        title: z.ZodString;
+        headline: z.ZodNonOptional<z.ZodOptional<z.ZodString>>;
+        experience: z.ZodNonOptional<z.ZodOptional<z.ZodString>>;
+        summary: z.ZodString;
+        impact: z.ZodEnum<{
+            blocked_task: "blocked_task";
+            friction: "friction";
+            recovery: "recovery";
+            uncertain: "uncertain";
+        }>;
+        affectedStreamIds: z.ZodArray<z.ZodString>;
+        exposedStreamIds: z.ZodArray<z.ZodString>;
+        exposureReason: z.ZodString;
+        recovery: z.ZodEnum<{
+            not_observed: "not_observed";
+            recovered: "recovered";
+            unknown: "unknown";
+        }>;
+        confidence: z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+        }>;
+        observations: z.ZodArray<z.ZodObject<{
+            claim: z.ZodString;
+            basis: z.ZodEnum<{
+                action: "action";
+                inference: "inference";
+                participant_statement: "participant_statement";
+                visual: "visual";
+            }>;
+            evidenceIds: z.ZodArray<z.ZodString>;
+            limitation: z.ZodString;
+        }, z.core.$strict>>;
+        nextStep: z.ZodString;
+        priorityReason: z.ZodString;
+    }, z.core.$strict>>;
+    designFindings: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        headline: z.ZodString;
+        screen: z.ZodString;
+        notice: z.ZodString;
+        whyItMatters: z.ZodString;
+        suggestion: z.ZodString;
+        severity: z.ZodEnum<{
+            major: "major";
+            minor: "minor";
+            moderate: "moderate";
+        }>;
+        confidence: z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+        }>;
+        seenByStreamIds: z.ZodArray<z.ZodString>;
+        evidenceIds: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>>;
+/**
+ * Check the merge request's answer as a whole report: with the cohorts' participant reviews, in
+ * the run's participant order, it passes the same check as any request's report. Its findings,
+ * design findings and concern reviews may cite only evidence that the cohort reports cite in
+ * theirs: the merge request saw no evidence, so any other citation would be a new claim.
+ */
+export declare function checkMergedResponse(input: AnalysisInput, reports: readonly AnalysisResult[], output: unknown): CheckedProviderAnalysis;

package/dist/analysis/cohorts.js

@@ -0,0 +1,80 @@
+// A run with more participants than one request covers is analysed in cohorts: each cohort's
+// request reads only its own participants' evidence, and one more request merges the cohort
+// reports into the run's one report.
+import { z } from "zod";
+import { analysisCohorts } from "./analysis-limits.js";
+import { checkProviderAnalysis } from "./responses.js";
+import { analysisResponseSchema } from "./validation.js";
+/**
+ * The input each cohort request sends: the input itself when it is one cohort. `includedStreamIds`
+ * keeps the bundle's stream order, the order captureEvidence split the packet by. A cohort's input
+ * is never stored, so it keeps the run's input digest.
+ */
+export function cohortInputs(input) {
+    const cohorts = analysisCohorts(input.coverage.includedStreamIds);
+    if (cohorts.length === 1)
+        return [input];
+    return cohorts.map((streamIds) => {
+        const members = new Set(streamIds);
+        const evidence = input.evidence.filter((entry) => members.has(entry.streamId));
+        const ids = new Set(evidence.map((entry) => entry.id));
+        return {
+            ...input,
+            participants: input.participants.filter((participant) => members.has(participant.streamId)),
+            coverage: {
+                ...input.coverage,
+                includedStreamIds: streamIds,
+                evidenceCount: evidence.length,
+                captureCount: evidence.filter((entry) => entry.capture !== null).length,
+            },
+            evidence,
+            images: input.images.filter((image) => ids.has(image.evidenceId)),
+        };
+    });
+}
+/**
+ * The merge request's packet: the participants, the coverage and each cohort's report. With no
+ * reports it is the part admission prices before any request is sent.
+ */
+export function mergePacket(input, reports = []) {
+    return JSON.stringify({
+        runId: input.runId,
+        participants: input.participants.map(({ streamId, label }) => ({ streamId, label })),
+        coverage: input.coverage,
+        cohorts: analysisCohorts(input.coverage.includedStreamIds).map((streamIds, index) => ({
+            streamIds,
+            report: reports[index] ?? null,
+        })),
+    });
+}
+/** The merge request writes everything but the participant reviews, which the cohorts wrote. */
+export const mergeResultJsonSchema = z.toJSONSchema(analysisResponseSchema.omit({ participants: true }));
+/** The evidence a report's findings, design findings and concern reviews cite. */
+const findingEvidence = (report) => [
+    ...report.findings.flatMap((finding) => finding.observations.flatMap((observation) => observation.evidenceIds)),
+    ...(report.designFindings ?? []).flatMap((finding) => finding.evidenceIds),
+    ...(report.concernReviews ?? []).flatMap((review) => review.evidenceIds),
+];
+/**
+ * Check the merge request's answer as a whole report: with the cohorts' participant reviews, in
+ * the run's participant order, it passes the same check as any request's report. Its findings,
+ * design findings and concern reviews may cite only evidence that the cohort reports cite in
+ * theirs: the merge request saw no evidence, so any other citation would be a new claim.
+ */
+export function checkMergedResponse(input, reports, output) {
+    const reviews = new Map(reports.flatMap((report) => report.participants).map((review) => [review.streamId, review]));
+    const merged = output === null || typeof output !== "object" || Array.isArray(output)
+        ? output
+        : {
+            ...output,
+            participants: input.participants.flatMap(({ streamId }) => reviews.get(streamId) ?? []),
+        };
+    const checked = checkProviderAnalysis(input, merged);
+    if (!checked.ok)
+        return checked;
+    const cited = new Set(reports.flatMap(findingEvidence));
+    if (findingEvidence(checked.result).every((id) => cited.has(id)))
+        return checked;
+    const error = "analysis_validation_failed_merge_reference_invalid";
+    return { ok: false, error, rejected: { error, errors: [], output: checked.result } };
+}

package/dist/analysis/evidence.d.ts

@@ -1,16 +1,11 @@
 import { type PreparedRunArtifactPaths } from "../run/paths.js";
 import { type AnalysisArtifact, type AnalysisInput } from "./types.js";
-export declare const EVIDENCE_LIMITS: Readonly<{
-    participants: 16;
-    evidence: 800;
-    captures: 40;
-    textBytes: number;
-    imageBytes: number;
-    totalImageBytes: number;
-    sourceBytes: number;
-}>;
+import { EVIDENCE_LIMITS } from "./analysis-limits.js";
+export { EVIDENCE_LIMITS };
+/** Lower limits: `participants` for the run, the rest for each cohort's packet. The cohort size
+ * stays `EVIDENCE_LIMITS.cohortParticipants`, the size runAnalysis splits by. */
 export type EvidenceLimits = {
-    [Key in keyof typeof EVIDENCE_LIMITS]?: number;
+    [Key in Exclude<keyof typeof EVIDENCE_LIMITS, "cohortParticipants">]?: number;
 };
 /** Select once from retained source. Models receive no filesystem or network resolver. */
 export declare function captureEvidence(prepared: PreparedRunArtifactPaths, bundleBytes: Buffer, requested?: EvidenceLimits): Promise<AnalysisInput>;