humanish 0.118.0 → 0.120.0

package/CHANGELOG.md

@@ -8,6 +8,45 @@ The Unreleased section holds the full notes for the next version until it is tag
 
 ## Unreleased
 
+## 0.120.0: Analysis completes under Bun, runs past 16 participants print a bounded list, Observer counts participants by status (2026-10-09)
+
+humanish 0.120.0 completes an analysis run from a Bun process, prints a run of more than 16
+participants in a bounded number of lines, and counts and filters the Observer's participants by
+status and persona. Under Bun, `undici` is Bun's built-in module, whose `Agent` has no `destroy()`,
+and the analysis provider's teardown after each request threw a `TypeError` that replaced the
+request's result, so every automatic analysis from a Bun process ended `unknown` with
+`AUTOMATIC_ANALYSIS_OUTCOME_UNKNOWN` and kept no receipt. A failing teardown is now ignored.
+`humanish watch` and `humanish run` print a computer-use run of more than 16 participants as one
+line counting them by status, up to 16 participants that did not pass, and a `not listed:` line.
+Each participant line holds its closing message on one line cut at 160 characters, and a warning
+printed the same for each participant prints once. The Observer's participant grid counts the
+participants by status when they ended more than one way, and pressing a count filters the grid.
+Its view options gain a Persona filter, a filter change returns to the first page, and Next page
+and Previous page open the new page at its first participant.
+
+[Release notes](https://github.com/danielgwilson/humanish/releases/tag/v0.120.0)
+
+## 0.119.0: Participants arrive over time, one analysis past 16 participants in cohorts, late starts skipped past the budget, study warnings redacted (2026-10-09)
+
+humanish 0.119.0 lets a computer-use or shared-world study start its participants over time, and
+analyses a run of 17 to 100 participants in one report. `participants[].startAfterMs` starts a
+participant up to 24 hours after the run starts its participants, and a `count` group's
+`startEveryMs` spreads its members. Each participant's desktop is created at its start, the plan and
+`study check` print the first and last start and the most participants at once, and run.json records
+each participant's `arrival`. A participant whose start comes after the study crossed
+`caps.maxTotalUsd` is skipped before its desktop is created. The analysis of more than 16
+participants splits them into cohorts of at most 16, analyses each cohort with its own request, and
+merges the cohort reports into the run's one report with one more request; 0.118.0 skipped the
+automatic analysis of such a run. Admission, the plan's analysis line, `study check` and the
+`analyze --dry-run` worst case count every request, and `analyze --json` gives their number as
+`admission.requests`. At the default $3 cap the analysis of 17 or more participants is refused even
+with no evidence, so it needs a higher `review.analysis.maxCostUsd`. A provisioned shared world gets
+an app sandbox that lives until the last start or wave can end. A study warning recorded in the
+run's bundle is redacted as a run failure is, so a hosted study whose participant instruction names
+a sandbox URL other than the subject's verifies `share_ready` again, as on 0.111.2.
+
+[Release notes](https://github.com/danielgwilson/humanish/releases/tag/v0.119.0)
+
 ## 0.118.0: Up to 100 participants, E2B concurrent sandboxes, study check plans like run, analysis range (2026-10-09)
 
 humanish 0.118.0 lets a computer-use study have up to 100 participants, up from 16, holds a

package/dist/analysis/admission.d.ts

@@ -6,7 +6,7 @@ import type { ModelRate } from "../run/pricing.js";
  * states the rule reads it here.
  */
 export declare function admissionRule(cap: string): string;
-export interface AnalysisRequestSize {
+interface AnalysisRequestSize {
     /** UTF-8 bytes of the instructions, the evidence packet and the result schema. */
     textBytes: number;
     imageTokens: number;
@@ -14,6 +14,14 @@ export interface AnalysisRequestSize {
     /** The request's output limit. The worst case spends all of it. */
     outputAllowance: number;
 }
+/**
+ * The requests of one analysis: one per cohort and, for more than one cohort, a merge request.
+ * `mergeTextBytes` are the merge request's instructions, schema and packet without the reports.
+ */
+export interface AnalysisRequests {
+    cohorts: readonly AnalysisRequestSize[];
+    mergeTextBytes: number;
+}
 export interface AnalysisCostEstimate {
     inputTokens: number;
     expectedOutputTokens: number;
@@ -22,7 +30,12 @@ export interface AnalysisCostEstimate {
     /** The expected cost with the margin, never above the worst case: what admission compares. */
     admittedCostUsd: number;
 }
-export declare function estimateAnalysisCost(rate: ModelRate, size: AnalysisRequestSize): AnalysisCostEstimate;
+/**
+ * Every request of one analysis, summed. A merge request reads each cohort's report, priced at
+ * that request's whole output allowance since the report and its reasoning share it, and is
+ * expected to write what one request covering every participant would.
+ */
+export declare function estimateAnalysisCost(rate: ModelRate, requests: AnalysisRequests): AnalysisCostEstimate;
 /** The numbers a cost refusal reports. */
 export interface RefusedAnalysisCost {
     expectedCostUsd: number;
@@ -50,3 +63,4 @@ export declare function refusedCost(admission: {
     worstCaseCostUsd: number | null;
     maxCostUsd: number | null;
 }): RefusedAnalysisCost | undefined;
+export {};

package/dist/analysis/admission.js

@@ -1,5 +1,5 @@
-// The admission cost model for one study analysis request: the expected cost, the worst case, the
-// figure admission compares with the cap, and the words and command a cost refusal gives.
+// The admission cost model for one study analysis: the expected cost, the worst case, the figure
+// admission compares with the cap, and the words and command a cost refusal gives.
 /**
  * UTF-8 bytes per input token for the instructions, evidence packet and schema. On 148 billed
  * gpt-6-astra analyses the evidence packet ran 3.1 to 3.3 bytes per token and the instructions
@@ -37,14 +37,43 @@ function requestCost(rate, inputTokens, outputTokens) {
     return roundUp(inputTokens * inputRate * (long ? rate.longContext.inputMultiplier : 1) +
         outputTokens * rate.outputUsdPerToken * (long ? rate.longContext.outputMultiplier : 1));
 }
-export function estimateAnalysisCost(rate, size) {
-    const inputTokens = Math.ceil(size.textBytes / BYTES_PER_INPUT_TOKEN) + FRAMING_TOKENS + size.imageTokens;
+/** One request's input and costs. `reportTokens` are earlier requests' reports it reads. */
+function estimateRequest(rate, size, reportTokens = 0) {
+    const inputTokens = Math.ceil(size.textBytes / BYTES_PER_INPUT_TOKEN) +
+        FRAMING_TOKENS +
+        size.imageTokens +
+        reportTokens;
     const expectedOutputTokens = Math.min(size.outputAllowance, EXPECTED_OUTPUT_TOKENS + EXPECTED_OUTPUT_TOKENS_PER_PARTICIPANT * size.participants);
-    const expectedCostUsd = requestCost(rate, inputTokens, expectedOutputTokens);
-    const worstCaseCostUsd = requestCost(rate, inputTokens, size.outputAllowance);
     return {
         inputTokens,
         expectedOutputTokens,
+        expectedCostUsd: requestCost(rate, inputTokens, expectedOutputTokens),
+        worstCaseCostUsd: requestCost(rate, inputTokens, size.outputAllowance),
+    };
+}
+/**
+ * Every request of one analysis, summed. A merge request reads each cohort's report, priced at
+ * that request's whole output allowance since the report and its reasoning share it, and is
+ * expected to write what one request covering every participant would.
+ */
+export function estimateAnalysisCost(rate, requests) {
+    const { cohorts } = requests;
+    const estimates = cohorts.map((size) => estimateRequest(rate, size));
+    if (cohorts.length > 1)
+        estimates.push(estimateRequest(rate, {
+            textBytes: requests.mergeTextBytes,
+            imageTokens: 0,
+            participants: cohorts.reduce((total, size) => total + size.participants, 0),
+            outputAllowance: Math.max(...cohorts.map((size) => size.outputAllowance)),
+        }, cohorts.reduce((total, size) => total + size.outputAllowance, 0)));
+    const sum = (key) => estimates.reduce((total, estimate) => total + estimate[key], 0);
+    // Each request's cost is a whole number of micro-dollars, so rounding the sum to the nearest one
+    // only removes the addition's float noise.
+    const expectedCostUsd = Math.round(sum("expectedCostUsd") * 1e6) / 1e6;
+    const worstCaseCostUsd = Math.round(sum("worstCaseCostUsd") * 1e6) / 1e6;
+    return {
+        inputTokens: sum("inputTokens"),
+        expectedOutputTokens: sum("expectedOutputTokens"),
         expectedCostUsd,
         worstCaseCostUsd,
         admittedCostUsd: Math.min(worstCaseCostUsd, roundUp(expectedCostUsd * ADMISSION_MARGIN)),

package/dist/analysis/analysis-limits.d.ts

@@ -1,3 +1,35 @@
+/**
+ * What one run's analysis reads. `participants` is the most participants it covers, which is also
+ * the most streams the analysis reads from a run bundle. Each request covers at most
+ * `cohortParticipants` of them, and the counts and byte limits below apply to each request's
+ * packet: a run with more participants is analysed in cohorts, one request each, and one more
+ * request merges their reports. `sourceBytes` bounds the run bundle file.
+ */
+export declare const EVIDENCE_LIMITS: Readonly<{
+    participants: 128;
+    cohortParticipants: 16;
+    evidence: 800;
+    captures: 40;
+    textBytes: number;
+    imageBytes: number;
+    totalImageBytes: number;
+    sourceBytes: number;
+}>;
+/** The most cohorts one analysis sends: every participant it covers, in cohorts at the limit. */
+export declare const MAX_ANALYSIS_COHORTS: number;
+/** How many cohorts this many participants are analysed in. */
+export declare const analysisCohortCount: (participants: number) => number;
+/**
+ * The provider requests an analysis of this many participants sends: one per cohort, and the
+ * merge request when there is more than one cohort.
+ */
+export declare function analysisRequestCount(participants: number): number;
+/**
+ * The cohorts a run's participants are analysed in: one when there are at most
+ * `cohortParticipants`, otherwise the fewest that hold at most that many each. Participants are
+ * dealt in turn, so cohort sizes differ by at most one and each cohort holds a spread of the roster.
+ */
+export declare function analysisCohorts<T>(participants: readonly T[]): T[][];
 /**
  * How much an analysis result may hold, for the fields the Observer checks as well. Characters are
  * counted as `String.length` counts them.

package/dist/analysis/analysis-limits.js

@@ -1,6 +1,44 @@
-// The analysis result's limits and prompt revision boundaries, kept apart from the zod schemas in
-// validation.ts so the Observer can read them: it bundles this module, and zod stays out of its
-// page.
+// The analysis input's and result's limits and prompt revision boundaries, kept apart from the zod
+// schemas in validation.ts so the Observer can read them: it bundles this module, and zod stays out
+// of its page.
+/**
+ * What one run's analysis reads. `participants` is the most participants it covers, which is also
+ * the most streams the analysis reads from a run bundle. Each request covers at most
+ * `cohortParticipants` of them, and the counts and byte limits below apply to each request's
+ * packet: a run with more participants is analysed in cohorts, one request each, and one more
+ * request merges their reports. `sourceBytes` bounds the run bundle file.
+ */
+export const EVIDENCE_LIMITS = Object.freeze({
+    participants: 128,
+    cohortParticipants: 16,
+    evidence: 800,
+    captures: 40,
+    textBytes: 160 * 1024,
+    imageBytes: 8 * 1024 * 1024,
+    totalImageBytes: 20 * 1024 * 1024,
+    sourceBytes: 16 * 1024 * 1024,
+});
+/** The most cohorts one analysis sends: every participant it covers, in cohorts at the limit. */
+export const MAX_ANALYSIS_COHORTS = Math.ceil(EVIDENCE_LIMITS.participants / EVIDENCE_LIMITS.cohortParticipants);
+/** How many cohorts this many participants are analysed in. */
+export const analysisCohortCount = (participants) => Math.max(1, Math.ceil(participants / EVIDENCE_LIMITS.cohortParticipants));
+/**
+ * The provider requests an analysis of this many participants sends: one per cohort, and the
+ * merge request when there is more than one cohort.
+ */
+export function analysisRequestCount(participants) {
+    const cohorts = analysisCohortCount(participants);
+    return cohorts === 1 ? 1 : cohorts + 1;
+}
+/**
+ * The cohorts a run's participants are analysed in: one when there are at most
+ * `cohortParticipants`, otherwise the fewest that hold at most that many each. Participants are
+ * dealt in turn, so cohort sizes differ by at most one and each cohort holds a spread of the roster.
+ */
+export function analysisCohorts(participants) {
+    const count = analysisCohortCount(participants.length);
+    return Array.from({ length: count }, (_, cohort) => participants.filter((_, index) => index % count === cohort));
+}
 /**
  * How much an analysis result may hold, for the fields the Observer checks as well. Characters are
  * counted as `String.length` counts them.

package/dist/analysis/automatic-config.d.ts

@@ -50,5 +50,10 @@ export interface AutomaticAnalysisBudget {
 /** Metadata only: resolving the future live-run budget never reads keys or dispatches. With a
  * participant count it also gives the expected cost range for that many participants. */
 export declare function automaticAnalysisBudget(raw: unknown, route: StudyRoute, participants?: number): AutomaticAnalysisBudget | undefined;
+/**
+ * An analysis's requests in words, from their count: undefined for one request. The plan's
+ * analysis line and the dry run's worst case both say it.
+ */
+export declare function analysisRequestsText(requests: number): string | undefined;
 export declare function formatAutomaticAnalysisBudget(budget: AutomaticAnalysisBudget): string;
 export {};

package/dist/analysis/automatic-config.js

@@ -1,6 +1,7 @@
 import { CODEX_ANALYSIS_MODEL, codexAnalysisIdentity } from "./codex-config.js";
 import { DEFAULT_ANALYSIS_MAX_OUTPUT_TOKENS, MAX_ANALYSIS_OUTPUT_TOKENS, analysisCostRange, isSupportedAnalysisModel, } from "./execute.js";
 import { admissionRule } from "./admission.js";
+import { analysisRequestCount, EVIDENCE_LIMITS } from "./analysis-limits.js";
 import { plural } from "../run/text.js";
 import { containsSensitive } from "../evidence/redaction.js";
 export const DEFAULT_ANALYSIS_TIMEOUT_MS = 600_000;
@@ -136,11 +137,24 @@ export function automaticAnalysisBudget(raw, route, participants) {
         ...(range === undefined || participants === undefined ? {} : { participants, ...range }),
     };
 }
+/**
+ * An analysis's requests in words, from their count: undefined for one request. The plan's
+ * analysis line and the dry run's worst case both say it.
+ */
+export function analysisRequestsText(requests) {
+    return requests <= 1
+        ? undefined
+        : `${requests - 1} cohort requests of at most ${EVIDENCE_LIMITS.cohortParticipants} participants and one merge request`;
+}
 export function formatAutomaticAnalysisBudget(budget) {
     if (budget.provider === "codex")
         return `After live runs: Codex account analysis · ${budget.model} · separate restricted analyst with remote inference. Account limits apply; dollar cost and output-token ceiling are unknown. Set review.analysis: false to disable.`;
     const rule = admissionRule(`$${budget.maxCostUsd}`);
-    const who = budget.participants === undefined ? undefined : plural(budget.participants, "participant");
+    // The participants, and the requests that analyse them when there is more than one.
+    const requests = analysisRequestsText(analysisRequestCount(Math.min(budget.participants ?? 0, EVIDENCE_LIMITS.participants)));
+    const who = budget.participants === undefined
+        ? undefined
+        : `${plural(budget.participants, "participant")}${requests === undefined ? "" : ` in ${requests}`}`;
     const range = budget.expectedCostUsd === undefined || who === undefined
         ? ""
         : ` · expected $${budget.expectedCostUsd.low.toFixed(2)} to $${budget.expectedCostUsd.high.toFixed(2)} for ${who}, depending on how much evidence the run keeps`;

package/dist/analysis/cohorts.d.ts

@@ -0,0 +1,103 @@
+import { z } from "zod";
+import { type CheckedProviderAnalysis } from "./responses.js";
+import type { AnalysisInput, AnalysisResult } from "./types.js";
+/**
+ * The input each cohort request sends: the input itself when it is one cohort. `includedStreamIds`
+ * keeps the bundle's stream order, the order captureEvidence split the packet by. A cohort's input
+ * is never stored, so it keeps the run's input digest.
+ */
+export declare function cohortInputs(input: AnalysisInput): AnalysisInput[];
+/**
+ * The merge request's packet: the participants, the coverage and each cohort's report. With no
+ * reports it is the part admission prices before any request is sent.
+ */
+export declare function mergePacket(input: AnalysisInput, reports?: readonly AnalysisResult[]): string;
+/** The merge request writes everything but the participant reviews, which the cohorts wrote. */
+export declare const mergeResultJsonSchema: z.core.ZodStandardJSONSchemaPayload<z.ZodObject<{
+    summary: z.ZodString;
+    concernReviews: z.ZodNonOptional<z.ZodOptional<z.ZodArray<z.ZodObject<{
+        claim: z.ZodString;
+        basis: z.ZodEnum<{
+            action: "action";
+            inference: "inference";
+            participant_statement: "participant_statement";
+            visual: "visual";
+        }>;
+        evidenceIds: z.ZodArray<z.ZodString>;
+        limitation: z.ZodString;
+        disposition: z.ZodEnum<{
+            context: "context";
+            finding: "finding";
+            unsupported: "unsupported";
+        }>;
+        findingId: z.ZodNullable<z.ZodString>;
+        reason: z.ZodString;
+    }, z.core.$strict>>>>;
+    limitations: z.ZodArray<z.ZodString>;
+    findings: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        title: z.ZodString;
+        headline: z.ZodNonOptional<z.ZodOptional<z.ZodString>>;
+        experience: z.ZodNonOptional<z.ZodOptional<z.ZodString>>;
+        summary: z.ZodString;
+        impact: z.ZodEnum<{
+            blocked_task: "blocked_task";
+            friction: "friction";
+            recovery: "recovery";
+            uncertain: "uncertain";
+        }>;
+        affectedStreamIds: z.ZodArray<z.ZodString>;
+        exposedStreamIds: z.ZodArray<z.ZodString>;
+        exposureReason: z.ZodString;
+        recovery: z.ZodEnum<{
+            not_observed: "not_observed";
+            recovered: "recovered";
+            unknown: "unknown";
+        }>;
+        confidence: z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+        }>;
+        observations: z.ZodArray<z.ZodObject<{
+            claim: z.ZodString;
+            basis: z.ZodEnum<{
+                action: "action";
+                inference: "inference";
+                participant_statement: "participant_statement";
+                visual: "visual";
+            }>;
+            evidenceIds: z.ZodArray<z.ZodString>;
+            limitation: z.ZodString;
+        }, z.core.$strict>>;
+        nextStep: z.ZodString;
+        priorityReason: z.ZodString;
+    }, z.core.$strict>>;
+    designFindings: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        headline: z.ZodString;
+        screen: z.ZodString;
+        notice: z.ZodString;
+        whyItMatters: z.ZodString;
+        suggestion: z.ZodString;
+        severity: z.ZodEnum<{
+            major: "major";
+            minor: "minor";
+            moderate: "moderate";
+        }>;
+        confidence: z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+        }>;
+        seenByStreamIds: z.ZodArray<z.ZodString>;
+        evidenceIds: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>>;
+/**
+ * Check the merge request's answer as a whole report: with the cohorts' participant reviews, in
+ * the run's participant order, it passes the same check as any request's report. Its findings,
+ * design findings and concern reviews may cite only evidence that the cohort reports cite in
+ * theirs: the merge request saw no evidence, so any other citation would be a new claim.
+ */
+export declare function checkMergedResponse(input: AnalysisInput, reports: readonly AnalysisResult[], output: unknown): CheckedProviderAnalysis;

package/dist/analysis/cohorts.js

@@ -0,0 +1,80 @@
+// A run with more participants than one request covers is analysed in cohorts: each cohort's
+// request reads only its own participants' evidence, and one more request merges the cohort
+// reports into the run's one report.
+import { z } from "zod";
+import { analysisCohorts } from "./analysis-limits.js";
+import { checkProviderAnalysis } from "./responses.js";
+import { analysisResponseSchema } from "./validation.js";
+/**
+ * The input each cohort request sends: the input itself when it is one cohort. `includedStreamIds`
+ * keeps the bundle's stream order, the order captureEvidence split the packet by. A cohort's input
+ * is never stored, so it keeps the run's input digest.
+ */
+export function cohortInputs(input) {
+    const cohorts = analysisCohorts(input.coverage.includedStreamIds);
+    if (cohorts.length === 1)
+        return [input];
+    return cohorts.map((streamIds) => {
+        const members = new Set(streamIds);
+        const evidence = input.evidence.filter((entry) => members.has(entry.streamId));
+        const ids = new Set(evidence.map((entry) => entry.id));
+        return {
+            ...input,
+            participants: input.participants.filter((participant) => members.has(participant.streamId)),
+            coverage: {
+                ...input.coverage,
+                includedStreamIds: streamIds,
+                evidenceCount: evidence.length,
+                captureCount: evidence.filter((entry) => entry.capture !== null).length,
+            },
+            evidence,
+            images: input.images.filter((image) => ids.has(image.evidenceId)),
+        };
+    });
+}
+/**
+ * The merge request's packet: the participants, the coverage and each cohort's report. With no
+ * reports it is the part admission prices before any request is sent.
+ */
+export function mergePacket(input, reports = []) {
+    return JSON.stringify({
+        runId: input.runId,
+        participants: input.participants.map(({ streamId, label }) => ({ streamId, label })),
+        coverage: input.coverage,
+        cohorts: analysisCohorts(input.coverage.includedStreamIds).map((streamIds, index) => ({
+            streamIds,
+            report: reports[index] ?? null,
+        })),
+    });
+}
+/** The merge request writes everything but the participant reviews, which the cohorts wrote. */
+export const mergeResultJsonSchema = z.toJSONSchema(analysisResponseSchema.omit({ participants: true }));
+/** The evidence a report's findings, design findings and concern reviews cite. */
+const findingEvidence = (report) => [
+    ...report.findings.flatMap((finding) => finding.observations.flatMap((observation) => observation.evidenceIds)),
+    ...(report.designFindings ?? []).flatMap((finding) => finding.evidenceIds),
+    ...(report.concernReviews ?? []).flatMap((review) => review.evidenceIds),
+];
+/**
+ * Check the merge request's answer as a whole report: with the cohorts' participant reviews, in
+ * the run's participant order, it passes the same check as any request's report. Its findings,
+ * design findings and concern reviews may cite only evidence that the cohort reports cite in
+ * theirs: the merge request saw no evidence, so any other citation would be a new claim.
+ */
+export function checkMergedResponse(input, reports, output) {
+    const reviews = new Map(reports.flatMap((report) => report.participants).map((review) => [review.streamId, review]));
+    const merged = output === null || typeof output !== "object" || Array.isArray(output)
+        ? output
+        : {
+            ...output,
+            participants: input.participants.flatMap(({ streamId }) => reviews.get(streamId) ?? []),
+        };
+    const checked = checkProviderAnalysis(input, merged);
+    if (!checked.ok)
+        return checked;
+    const cited = new Set(reports.flatMap(findingEvidence));
+    if (findingEvidence(checked.result).every((id) => cited.has(id)))
+        return checked;
+    const error = "analysis_validation_failed_merge_reference_invalid";
+    return { ok: false, error, rejected: { error, errors: [], output: checked.result } };
+}

package/dist/analysis/evidence.d.ts

@@ -1,16 +1,11 @@
 import { type PreparedRunArtifactPaths } from "../run/paths.js";
 import { type AnalysisArtifact, type AnalysisInput } from "./types.js";
-export declare const EVIDENCE_LIMITS: Readonly<{
-    participants: 16;
-    evidence: 800;
-    captures: 40;
-    textBytes: number;
-    imageBytes: number;
-    totalImageBytes: number;
-    sourceBytes: number;
-}>;
+import { EVIDENCE_LIMITS } from "./analysis-limits.js";
+export { EVIDENCE_LIMITS };
+/** Lower limits: `participants` for the run, the rest for each cohort's packet. The cohort size
+ * stays `EVIDENCE_LIMITS.cohortParticipants`, the size runAnalysis splits by. */
 export type EvidenceLimits = {
-    [Key in keyof typeof EVIDENCE_LIMITS]?: number;
+    [Key in Exclude<keyof typeof EVIDENCE_LIMITS, "cohortParticipants">]?: number;
 };
 /** Select once from retained source. Models receive no filesystem or network resolver. */
 export declare function captureEvidence(prepared: PreparedRunArtifactPaths, bundleBytes: Buffer, requested?: EvidenceLimits): Promise<AnalysisInput>;

package/dist/analysis/evidence.js

@@ -8,15 +8,8 @@ import { ACTION_CAPTURE_VERSION, } from "./types.js";
 import { digestAnalysisInput, hashAnalysisValue, validateAnalysisInputMetadata, } from "./validation.js";
 import { boundedText, fairShares, hasUnmappedCaptures, participantAssignment, participantSource, sourceEntries, sourceOrder, impressionEventIds, } from "./evidence-sources.js";
 import { readBoundedFile, readBoundedFileResult } from "../run/evidence-files.js";
-export const EVIDENCE_LIMITS = Object.freeze({
-    participants: 16,
-    evidence: 800,
-    captures: 40,
-    textBytes: 160 * 1024,
-    imageBytes: 8 * 1024 * 1024,
-    totalImageBytes: 20 * 1024 * 1024,
-    sourceBytes: 16 * 1024 * 1024,
-});
+import { analysisCohortCount, analysisCohorts, EVIDENCE_LIMITS } from "./analysis-limits.js";
+export { EVIDENCE_LIMITS };
 // A second guard for direct callers. The analysis service already requires every stream to be in
 // TERMINAL_SIMULATION_STATUSES; this refuses only statuses that mean still running, so a dry-run
 // bundle's contract_proof_only streams stay capturable. The source is not shape-guarded here, so
@@ -39,7 +32,7 @@ function parseSource(prepared, bytes) {
         value.schema !== "humanish.run-bundle.v1" ||
         value.runId !== runIdOf(prepared) ||
         !Array.isArray(value.streams) ||
-        value.streams.length > 128 ||
+        value.streams.length > EVIDENCE_LIMITS.participants ||
         !Array.isArray(value.events) ||
         value.events.length > 100000 ||
         (value.commsReceiving !== undefined && !isCommsReceivingEvidence(value.commsReceiving)))
@@ -108,7 +101,7 @@ export async function captureEvidence(prepared, bundleBytes, requested = {}) {
     const evidence = [];
     const images = [];
     const omissions = new Set();
-    let textBytes = 0;
+    const contextBytes = new Map();
     const participants = selected.map((stream) => {
         const participant = participantSource(stream, captureVersion);
         const assignment = participantAssignment(stream, captureVersion);
@@ -118,30 +111,38 @@ export async function captureEvidence(prepared, bundleBytes, requested = {}) {
             participant.assignment !== assignment ||
             participant.recordedReason !== (stream.actor?.reason ?? null))
             omissions.add("Participant context exceeded the text limit.");
-        textBytes += Buffer.byteLength(JSON.stringify(participant));
+        contextBytes.set(stream, Buffer.byteLength(JSON.stringify(participant)));
         return participant;
     });
-    if (textBytes > limits.textBytes)
-        throw new Error("ANALYSIS_PARTICIPANT_CONTEXT_TOO_LARGE");
-    // Tie-breaking uses stable participant IDs, not the order of streams in a bundle.
-    // The emitted packet still preserves participant and source event order.
-    const packings = selected
-        .map((stream) => ({
-        stream,
-        entries: sourceEntries(bundle, stream, captureVersion),
-        captures: new Map(),
-        admitted: new Set(),
-        captureCursor: 0,
-        attempts: 0,
-        readBytes: 0,
-        imageBytes: 0,
-        reservationBlocked: false,
-    }))
-        .sort((a, b) => (a.stream.id < b.stream.id ? -1 : a.stream.id > b.stream.id ? 1 : 0));
-    const sel = planCaptureSelection(packings, limits);
-    await selectCaptures(prepared, packings, sel, omissions);
-    recordCaptureOmissions(packings, sel, omissions);
-    const textByEntry = boundEvidenceText(packings, limits.textBytes - textBytes, omissions);
+    // Each cohort is one request's packet, selected under the full limits on its own.
+    const packings = [];
+    const textByEntry = new Map();
+    for (const cohort of analysisCohorts(selected)) {
+        const textBytes = cohort.reduce((total, stream) => total + contextBytes.get(stream), 0);
+        if (textBytes > limits.textBytes)
+            throw new Error("ANALYSIS_PARTICIPANT_CONTEXT_TOO_LARGE");
+        // Tie-breaking uses stable participant IDs, not the order of streams in a bundle.
+        // The emitted packet still preserves participant and source event order.
+        const cohortPackings = cohort
+            .map((stream) => ({
+            stream,
+            entries: sourceEntries(bundle, stream, captureVersion),
+            captures: new Map(),
+            admitted: new Set(),
+            captureCursor: 0,
+            attempts: 0,
+            readBytes: 0,
+            imageBytes: 0,
+            reservationBlocked: false,
+        }))
+            .sort((a, b) => (a.stream.id < b.stream.id ? -1 : a.stream.id > b.stream.id ? 1 : 0));
+        const sel = planCaptureSelection(cohortPackings, limits);
+        await selectCaptures(prepared, cohortPackings, sel, omissions);
+        recordCaptureOmissions(cohortPackings, sel, omissions);
+        for (const [entry, text] of boundEvidenceText(cohortPackings, limits.textBytes - textBytes, omissions))
+            textByEntry.set(entry, text);
+        packings.push(...cohortPackings);
+    }
     packEvidence(selected, packings, textByEntry, evidence, images);
     const omittedStreamIds = bundle.streams.slice(limits.participants).map((stream) => stream.id);
     const coverage = {
@@ -425,6 +426,8 @@ export async function validateAnalysisEvidence(prepared, artifact, bundleBytes)
     }
     const sourceKeys = new Set();
     const checkedCaptures = new Map();
+    // Each cohort's packet holds at most totalImageBytes.
+    const imageByteLimit = analysisCohortCount(included.size) * EVIDENCE_LIMITS.totalImageBytes;
     let checkedImageBytes = 0;
     for (const entry of artifact.evidence) {
         const matches = sourceByStream
@@ -462,7 +465,7 @@ export async function validateAnalysisEvidence(prepared, artifact, bundleBytes)
                 if (!bytes || screenshotEvidenceError(source.capturePath, bytes) !== null)
                     throw new Error("ANALYSIS_CAPTURE_UNAVAILABLE");
                 checkedImageBytes += bytes.length;
-                if (checkedImageBytes > EVIDENCE_LIMITS.totalImageBytes)
+                if (checkedImageBytes > imageByteLimit)
                     throw new Error("ANALYSIS_IMAGE_LIMIT_EXCEEDED");
                 hash = sha256(bytes);
                 checkedCaptures.set(source.capturePath, hash);

package/dist/analysis/execute.d.ts

@@ -23,6 +23,9 @@ export interface AnalysisAdmission {
     admittedCostUsd: number | null;
     maxCostUsd: number | null;
     ratesAsOf: string | null;
+    /** The provider requests the costs cover: one per cohort, and the merge request for more than
+     *  one cohort. Null when the input or configuration was refused. */
+    requests: number | null;
 }
 export interface AnalysisProgress {
     phase: "admitted" | "requesting" | "validating" | "finished";
@@ -59,8 +62,10 @@ export type AnalysisCostRange = {
  * The expected cost of the analysis admission would start for this many participants, before any
  * evidence exists. Packets grow from no evidence toward the evidence limits with every capture at
  * the image-token ceiling, and the range ends at the largest one admission admits, so it never
- * passes the cap. With `preferLargerOutput` each packet gets the output allowance dispatch would
- * give it (preferLargerAnalysisOutput). Undefined for Codex and for a model without rates.
+ * passes the cap. There is one packet per cohort, each a share of its own limits, and the merge
+ * request when there is more than one cohort. With `preferLargerOutput` each request gets the
+ * output allowance dispatch would give it (preferLargerAnalysisOutput). Undefined for Codex and
+ * for a model without rates.
  */
 export declare function analysisCostRange(config: AnalysisConfig, participants: number, preferLargerOutput?: boolean): AnalysisCostRange | undefined;
 /** Only for an omitted output limit. Preserve the established allowance when