humanish 0.134.0 → 0.136.0

package/dist/verify/screenshot-reads.js

@@ -35,7 +35,7 @@ export async function readScreenshot(runPaths, relativePath) {
     const facts = {
         state: "read",
         size: read.bytes.length,
-        error: screenshotEvidenceError(relativePath, read.bytes),
+        error: await screenshotEvidenceError(relativePath, read.bytes),
         redactedShape: isRedactedFrameShape(read.bytes),
     };
     if (read.stamp.ctimeNs <= startedNs - RACY_WINDOW_NS)

package/docs/architecture/observer.md

@@ -39,10 +39,22 @@ account participant's `executionProfile` without its receipts. `events.ndjson` i
 contract that live adapters update while a run is active.
 
 `observer/index.html` carries both parts: the data slot holds observer-data.json's
-content, and `<script id="observer-items" type="application/octet-stream"
-data-encoding="gzip">` holds the items and full artifact lists (`humanish.observer-items.v1`, by stream id)
-gzip-compressed in base64, which a `file://` page decodes without a fetch. Real
-trace items compress about eight times. The page joins the two before it renders
+content, and `<script id="observer-items" type="application/json">` holds the items
+and full artifact lists by stream id (`humanish.observer-items.v2`) as
+`{ schema, runId, streams }`, where `streams` lists one entry for each participant: its
+JSON with its stream id, gzip-compressed in base64, which a `file://` page decodes
+without a fetch. The ids stay inside the compressed entries because verify's scan
+reads the element's plain text. There, an id such as `GITHUB_TOKEN` before a long
+base64 value reads as a credential, and `https://` with a later id shaped like an
+address at an E2B host reads as one E2B URL across the base64 between them. Each participant is packed
+(`src/observer/page-data.ts`) and decoded (`observer/lib/data.ts`) on its own, so no
+string holds two participants' items. A run of 25 participants with
+30 MiB traces, 786 MB together, past V8's longest string of 536,870,888 characters,
+renders to a 138 MiB page. The page itself is one string, at about 0.18 characters
+for each trace byte, so it passes that limit near 3 GB of traces, and memory may run
+out first; neither has been measured past 25 participants. Real trace items compress
+about eight times. The page
+joins the two before it renders
 (`joinObserverData` in `src/observer/participant-items.ts`), so every view reads the
 same data as before. A stream whose screenshot entries moved records how many in
 `screenshotArtifacts`, and the page renders nothing from items that are another
@@ -83,9 +95,14 @@ public-safe metadata.
 
 The browser polls `observer-feed.json` with `no-store` caching: the server's
 projection of the run as `{ data, items }`, observer-data.json's content and the
-items, from one read of the run per poll. While a participant runs, its entry in
-`items` carries `live`, a cursor `<position>.<generation>.<items>.<bytes>` naming its
-live file (`live/<position>.<generation>.ndjson`) and how far the list goes. The page
+items packed as the page packs them (`observerFeedBody`), from one read of the run
+per poll. The feed compresses each entry at gzip level 1 on the libuv thread pool, one
+participant at a time, so the server answers other requests while it builds a poll.
+Every poll sends every finished participant's items again: on the 25-participant run
+above a poll takes 17 to 20 seconds, past the 15 seconds the page waits, so that page
+never updates and says the server stopped answering. While a participant runs, its entry in `items` carries `live`, a cursor
+`<position>.<generation>.<items>.<bytes>` naming its live file
+(`live/<position>.<generation>.ndjson`) and how far the list goes. The page
 sends the cursors of its last body back as `?after=<cursor>,<cursor>`, and the server
 then reads and sends only the items past each one, marking that entry with
 `liveAfter`, the cursor they follow (`src/observer/feed-cursors.ts`). A cursor for an

package/docs/architecture/state-driven-executor.md

@@ -110,9 +110,10 @@ action**, not a fatal error:
 
 Public-safety: the notice text carries only the substrate's own stderr (tailed +
 whitespace-collapsed) and a numeric exit code, and is still run through the loop's
-`redactNarration` (known-value scrub + pattern redaction). Raw typed text, secret
-values, and machine paths never appear. The action label comes from
-`describeCuaAction`, which never includes typed text.
+`redactNarration` (known-value scrub, then pattern redaction of keys as written, base64- or
+percent-encoded, then the known-value scrub again). Raw typed text, secret values, and machine
+paths never appear. The action label comes from `describeCuaAction`, which never includes typed
+text.
 
 ## You need a non-vision provider too
 

package/docs/contracts/run-bundle.md

@@ -153,6 +153,9 @@ projection is served.
 observer-data.json is built from the loaded bundle. From 0.124.0 it leaves out each participant's
 trace items, which stay in the traces, and from this release it is `humanish.observer-data.v3`,
 which also leaves out each participant's per-request lists (docs/architecture/observer.md).
+The Observer page and `observer-feed.json` carry the items as `humanish.observer-items.v2`, each
+participant's entry gzip-compressed on its own, so `humanish observe` renders a run whose traces
+together pass V8's longest string. It was measured on 25 participants with 30 MiB traces.
 
 ## Per-request lists
 

package/docs/contracts/study-analysis.md

@@ -191,8 +191,9 @@ from run.json before any trace is read, and the first 80 captures selection may
 read. Beside the one trace it is reading, analysis holds at most 800 entries for
 each request and 80 for each participant; their size grows with each trace
 item's text. A run.json past 16 MiB is refused as `ANALYSIS_SOURCE_TOO_LARGE`, and
-a run.json or trace without the fields analysis reads as `ANALYSIS_SOURCE_INVALID`;
-each message names the file, says why, and says no request was sent. Analysis
+a run.json or trace without the fields analysis reads, or a run.json with two of a
+participant's run events sharing an id, as `ANALYSIS_SOURCE_INVALID`; each message
+names the file, says why, and says no request was sent. Analysis
 verifies the run before it reads a trace, so a trace that does not match its
 index in run.json fails verify and `humanish analyze` reports
 `ANALYSIS_VERIFY_FAILED`. A trace past 32 MiB leaves the run `local_only`, and
@@ -287,9 +288,10 @@ value inside a bracketed span, such as `[REDACTED_373433393231]`, is found too:
 humanish writes (`[REDACTED_SECRET]`, `[REDACTED_LOCAL_PATH]`, `[REDACTED_RUNTIME_PATH]`,
 `[REDACTED_PROMPT_TEXT]`, `[REDACTED_LOBBY_CODE]`) are left as they are. If another reading of
 the stored field still holds a value (decoded once more, with percent escapes as UTF-8, with
-transfer escapes expanded, or with Latin-1 characters read as UTF-8 bytes), as for a value encoded
-twice, the whole field becomes `[REDACTED_SECRET]`. A known value in any of
-these forms in an ID, enum or reference refuses the response.
+transfer escapes expanded, with Latin-1 characters read as UTF-8 bytes, with HTML references
+left as written, or with only HTML references decoded), as for a value encoded twice, the whole
+field becomes `[REDACTED_SECRET]`. A known value in any of these forms in an ID, enum or
+reference refuses the response.
 
 When a reviewer amends a finding, its headline and experience describe the replaced claim.
 Text output, the Observer and feedback drafts show the reviewer's claim in their place and say the

package/docs/decisions/0002-observer-is-one-self-contained-file.md

@@ -13,9 +13,9 @@ exactly those cases.
 The `observer/` workspace builds with Vite into a single HTML file with fonts inlined and no
 network references. The root build copies it to `dist/observer-app.html`. `renderObserverHtml`
 is the one path every surface (observe, observe --all, watch, studies) uses; it injects the run's
-`humanish.observer-data.v3` snapshot into that file, with the participants' trace items beside it
-gzip-compressed (docs/architecture/observer.md). There is no second renderer and no feature
-flag; rolling back means pinning an older package version.
+`humanish.observer-data.v3` snapshot into that file, with each participant's trace items beside
+it, gzip-compressed on their own (docs/architecture/observer.md). There is no second renderer and
+no feature flag; rolling back means pinning an older package version.
 
 ## Consequences
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.134.0",
+  "version": "0.136.0",
   "description": "Synthetic user research for apps, CLIs, and agent-facing product flows.",
   "keywords": [
     "cli",